Toyota: enable LTA

[sshane]

Route with no limiting showing that there's some EPS driver torque limiting! ad5a3fa719bc2f83|2023-10-10--00-49-07--0

---

Stock system achieving almost 1500 scaled (2000 unscaled) EPS torque units, 2 m/s^2.

Up rate is about 1000 units/sec, down is about 1500/sec limited by the EPS, compared to our current torque limits of 1500 up 2500 down

ad5a3fa719bc2f83|2023-10-10--02-27-54--2 or 3

Here's 1700 scaled units: https://github.com/commaai/openpilot/assets/25857203/d5fcd003-ad7e-4101-a80a-07a3cfcf34db

[github-actions]

⚠️ This PR makes changes to CARS.md ⚠️

➕ Added

Make	Model	Supported Package	ACC	No ACC accel below	No ALC below	Steering Torque	Resume from stop	Hardware Needed	Video
Toyota	RAV4 2023	All	Stock	0 mph	0 mph			Parts - 1 RJ45 cable (7 ft) - 1 Toyota A connector - 1 comma 3X - 1 comma power v2 - 1 harness box - 1 mount - 1 right angle OBD-C cable (1.5 ft) Buy Here
Toyota	RAV4 Hybrid 2023	All	Stock	0 mph	0 mph			Parts - 1 RJ45 cable (7 ft) - 1 Toyota A connector - 1 comma 3X - 1 comma power v2 - 1 harness box - 1 mount - 1 right angle OBD-C cable (1.5 ft) Buy Here

[sshane]

Possible messages/signals that describe LTA functionality:

• DS11D72->LKADRCC first bit is always 1 on 2023 RAV4, 0 on Camry TSS 2.5, Prius TSS-P, Corolla TSS2, RAV4 2022 - this changes with LKA/LTA engagement status, can't use
• LKAS_HUD->SET_ME_X02 0 on 2023 RAV4, 2 on 2022 RAV4, 2 on Corolla TSS2, 16 on Camry TSS 2.5, 2 on Prius TSS-P -- checked data, it's sometimes 0 on other cars too
• In LTA_RELATED, LDA_SA_TOGGLE signal is used on 2023 RAV4, but not 2022 RAV4. However, user can turn off lane keep assist and we wouldn't know -- can't use.
• Nothing in STEERING_LTA as far as I know

[sshane]

Looks like the Japanese RAV4 Hybrids don't have the same EPS driver torque blending, despite them using LTA for LKA, route from Chris on Discord: https://connect.comma.ai/43c5d3e441fccf54/1697689049592/1697689062191

I'll try to find any differences on CAN that explains this

---

Edit: In EPS_STATUS, byte idx 5 and 6 are always 0x00 on NA RAV4s, and 0xFF on Japanese RAV4s. When comparing two routes there were a few more different bits that were static and mismatching, but nothing that held up with data too well:

View

# Only really checked the lower addressed and higher rate msgs, as they were more likely to have any meaningful signals.
Bus: 0, Address: 0x25 (37), Byte Index: 3
Bus: 1, Address: 0x210 (528), Byte Index: 0
Bus: 0, Address: 0x262 (610), Byte Index: 5
Bus: 0, Address: 0x262 (610), Byte Index: 6
Bus: 0, Address: 0x315 (789), Byte Index: 0
Bus: 0, Address: 0x320 (800), Byte Index: 5
Bus: 0, Address: 0x380 (896), Byte Index: 3
Bus: 0, Address: 0x389 (905), Byte Index: 1
Bus: 0, Address: 0x3f6 (1014), Byte Index: 2
Bus: 0, Address: 0x420 (1056), Byte Index: 1
Bus: 0, Address: 0x420 (1056), Byte Index: 3
Bus: 0, Address: 0x420 (1056), Byte Index: 4
Bus: 0, Address: 0x420 (1056), Byte Index: 7
Bus: 0, Address: 0x435 (1077), Byte Index: 0
Bus: 0, Address: 0x435 (1077), Byte Index: 6
Bus: 0, Address: 0x45a (1114), Byte Index: 0
Bus: 0, Address: 0x45a (1114), Byte Index: 1
Bus: 2, Address: 0x489 (1161), Byte Index: 0
Bus: 2, Address: 0x489 (1161), Byte Index: 5
Bus: 2, Address: 0x48a (1162), Byte Index: 5
Bus: 2, Address: 0x48b (1163), Byte Index: 0
Bus: 2, Address: 0x48b (1163), Byte Index: 1
Bus: 2, Address: 0x48b (1163), Byte Index: 2
Bus: 2, Address: 0x48b (1163), Byte Index: 3
Bus: 2, Address: 0x48b (1163), Byte Index: 4
Bus: 2, Address: 0x48b (1163), Byte Index: 5
Bus: 1, Address: 0x502 (1282), Byte Index: 2
Bus: 1, Address: 0x502 (1282), Byte Index: 5
Bus: 1, Address: 0x502 (1282), Byte Index: 7
Bus: 0, Address: 0x610 (1552), Byte Index: 7
Bus: 0, Address: 0x611 (1553), Byte Index: 3
Bus: 0, Address: 0x611 (1553), Byte Index: 6
Bus: 0, Address: 0x614 (1556), Byte Index: 2
Bus: 0, Address: 0x615 (1557), Byte Index: 2
Bus: 0, Address: 0x615 (1557), Byte Index: 3
Bus: 0, Address: 0x624 (1572), Byte Index: 2
Bus: 0, Address: 0x624 (1572), Byte Index: 4
Bus: 0, Address: 0x624 (1572), Byte Index: 5
Bus: 0, Address: 0x624 (1572), Byte Index: 6
Bus: 0, Address: 0x639 (1593), Byte Index: 4
Bus: 0, Address: 0x63b (1595), Byte Index: 2
Bus: 0, Address: 0x63b (1595), Byte Index: 3
Bus: 2, Address: 0x6ef (1775), Byte Index: 5

We can check for the TSS2/TSS2.5 signal in STEERING_LTA from the camera to block TSS 2 cars without driver torque safety (but have lower torque anyway, about 1500 instead of 3000), but checking for the two EPS_STATUS bytes doesn't make sense as we want to support both RAV4s, so driver torque safety implemented for both is the way to go.

[sshane]

Sending at 100Hz doesn't have an impact, it's still roughly 1200 units/sec up here on NA ICE:

[sshane]

We currently have two ways to cut steering torque with LTA when above max EPS torque, or driver torque thresholds: the normal steering request bit(s), or the SETME_X64 signal. SETME_X64 is desirable because:

• it winds down torque at roughly the max ramp down limit (1800 units/sec), instead of instantly
• this allows us to hold a max torque in a curve, not jerk the wheel to center with instant loss of torque
• also allows smooth wind down when user overrides, instead of a jerk

---

The stock system uses this signal on occasion in the same way, when the user overrides hard and the EPS might wind up (more used on Camry, since there's no driver torque safety in the EPS. Seen used on the RAV4, but not as often)

---

RAV4 2023 testing STEER_REQUEST vs SETME_X64 for wind down:

Using `SETME_X64` ramped to ~0 torque in ~1.45 seconds, from ~2000 units (scaled with EPS factor)

ad5a3fa719bc2f83|2023-12-01--15-35-27--6

Using `STEER_REQUEST` ramped to ~0 torque in ~0.1 seconds, from ~2000 units (scaled with EPS factor)

ad5a3fa719bc2f83|2023-12-01--15-27-04--3