safety: dynamically relax lateral jerk limits during accel conflicts#3294
safety: dynamically relax lateral jerk limits during accel conflicts#3294devtekve wants to merge 2 commits intocommaai:masterfrom
Conversation
* Reorders the calculation of absolute lateral acceleration limits to occur before jerk limits. * Applies SAFETY_MAX and SAFETY_MIN to expand the permitted jerk boundaries strictly when unwinding. * Ensures that steering corrections required to satisfy the absolute physical acceleration envelope do not trigger a TX block.
Car behavior reportReplays driving segments through this PR and compares the behavior to master. ✅ No changes detected |
it's the ISO 11270 jerk limits, not comfort how does the solution look if we instead wind down considering jerk limits in opendbc, not safety? more or less complex? |
|
@devtekve Safety wise, ideally, I think jerk limit should take a priority, the steering should not disengage and the driver should be required to take over immediately, and disengaged only after enough driver torque is detected. But there is no framework for such reaction currently. This is a broader issue with panda safety that it optimistically assumes disengagement is always a safe state... What may mitigate the issue in practise is using better jerk calculation from: Positive (forward) acceleration will partially cancel out negative curvature (steering) rate and therefore make it harder to exceed the negative jerk limit. |
|
@dzid26 that makes sense about the corrupted speed signal. I agree that is a risk, but because this only happens when the wheel is unwinding, I think the danger is different. Even if a bad signal makes the wheel center too fast, it still feels safer than what happens today. Right now, we just drop all torque and let the mechanical trail of the car snap the wheels back to the center with zero control. In my view, a controlled unwind (even if it is fast) is always better than just letting go and letting the car physics take over. Regarding the formula... I don't feel qualified enough to properly assess whether that better jerk calculation would prevent the issue though, maybe @Discountchubbs can chime in here if he has time :D
Do you mean putting stricter limits in opendbc (lower max lat accel and lower max jerk) for a given car than ISO and leaving safety compliant with ISO? |
|
Got a report from a user that they experienced safety tx blocks with this fix And I can confirm the issue is still present, albeit at a smaller frequency, but it is still a problem, so I am converting this back to draft while I investigate. 
Route inforouteId: The user was actively with his hands on the steering wheel and 
|
|
You need to write a fuzzer to be able to validate this well |
|
I am coming to the painful realization that there may not be a solution to this problem. TL; DRInstead of relaxing the control limits, we need to implement a safe, gradual transition to the Background context on my existential crisisFundamentally I am trying to fix a problem that has its root cause in a variable we can't assume we control from the controls perspective which is an increase of Reading the ISO 112701, the limits are clear,
Basically we shall never exceed either. This PR is asking to allow exceeding one of those due to the lack of control of the The ISO even acknowledges implicitly that some situations may require a deceleration
Considering we can't assume we have control of the
Ultimately, since we cannot guarantee compliance under these specific conditions, pivoting to a graceful degradation strategy seems to be the only viable path forward. I would love to hear others' thoughts on this approach. Footnotes |
|
I've recorded a stock route where I drove a little questionable when LFA2 was engaged, trying to force the conflict situation and see how it resolves it / prioritizes. I am not sure if I reached the limits yet. This route is private but comma can see it: On the bookmark it's where I was surprised it hadn't disengaged yet :D |
4 participants
When a vehicle accelerates in a sharp curve, the steering correction required to stay within safe lateral acceleration limits can sometimes violate the maximum lateral jerk limit, triggering an unnecessary TX block.
The approach is to allow jerk limits to be exceeded as long as they comply with lateral acceleration, and only on the unwind direction.
In practice, if you are on a tight turn and you don't decelerate, instead of faulting, we allow the steering wheel to keep unwinding to comply with the lat acceleration limit, even if it means that the jerk would exceed our calculated limits. Lateral acceleration being prioritized over jerk considering that excessive lateral acceleration could cause loss of grip.
The alternative to this (which is what happens today) is that due to the safety violation controls would be dropped and an even higher jerk would be experienced as the physics of the car straighten the wheels on it's own.
This PR resolves the conflict by prioritizing physical acceleration limits over
comfort-basedISO 11270 jerk limits:max_angle_canboundaries before applying jerk limits.SAFETY_MAXandSAFETY_MINto dynamically relax thehighest/lowest_desired_angleboundaries.