rename unsafeMode to alternativeExperience (#878)

* alternative experiences

* not unsafe

* more renames

more renames

* not yet true

* I think we import from panda now

* update comments and test

* not needed

* bump health pkt version

Co-authored-by: Adeeb Shihadeh <adeebshihadeh@gmail.com>

board/health.h

@@ -1,5 +1,5 @@
-// When changing this struct, boardd and python/__init__.py needs to be kept up to date!
-#define HEALTH_PACKET_VERSION 3
+// When changing this struct, python/__init__.py needs to be kept up to date!
+#define HEALTH_PACKET_VERSION 4
 struct __attribute__((packed)) health_t {
   uint32_t uptime_pkt;
   uint32_t voltage_pkt;
@@ -20,6 +20,6 @@ struct __attribute__((packed)) health_t {
   uint8_t fault_status_pkt;
   uint8_t power_save_enabled_pkt;
   uint8_t heartbeat_lost_pkt;
-  uint16_t unsafe_mode_pkt;
+  uint16_t alternative_experience_pkt;
   uint32_t blocked_msg_cnt_pkt;
 };

board/safety.h

@@ -204,7 +204,7 @@ bool addr_safety_check(CANPacket_t *to_push,
 
 void generic_rx_checks(bool stock_ecu_detected) {
   // exit controls on rising edge of gas press
-  if (gas_pressed && !gas_pressed_prev && !(unsafe_mode & UNSAFE_DISABLE_DISENGAGE_ON_GAS)) {
+  if (gas_pressed && !gas_pressed_prev && !(alternative_experience & ALT_EXP_DISABLE_DISENGAGE_ON_GAS)) {
     controls_allowed = 0;
   }
   gas_pressed_prev = gas_pressed;

board/safety/safety_ford.h

@@ -12,7 +12,7 @@ static int ford_rx_hook(CANPacket_t *to_push) {
 
   int addr = GET_ADDR(to_push);
   int bus = GET_BUS(to_push);
-  bool unsafe_allow_gas = unsafe_mode & UNSAFE_DISABLE_DISENGAGE_ON_GAS;
+  bool alt_exp_allow_gas = alternative_experience & ALT_EXP_DISABLE_DISENGAGE_ON_GAS;
 
   if (addr == 0x217) {
     // wheel speeds are 14 bits every 16
@@ -47,7 +47,7 @@ static int ford_rx_hook(CANPacket_t *to_push) {
   // exit controls on rising edge of gas press
   if (addr == 0x204) {
     gas_pressed = ((GET_BYTE(to_push, 0) & 0x03U) | GET_BYTE(to_push, 1)) != 0U;
-    if (!unsafe_allow_gas && gas_pressed && !gas_pressed_prev) {
+    if (!alt_exp_allow_gas && gas_pressed && !gas_pressed_prev) {
       controls_allowed = 0;
     }
     gas_pressed_prev = gas_pressed;
@@ -73,8 +73,8 @@ static int ford_tx_hook(CANPacket_t *to_send) {
   // disallow actuator commands if gas or brake (with vehicle moving) are pressed
   // and the the latching controls_allowed flag is True
   int pedal_pressed = brake_pressed_prev && vehicle_moving;
-  bool unsafe_allow_gas = unsafe_mode & UNSAFE_DISABLE_DISENGAGE_ON_GAS;
-  if (!unsafe_allow_gas) {
+  bool alt_exp_allow_gas = alternative_experience & ALT_EXP_DISABLE_DISENGAGE_ON_GAS;
+  if (!alt_exp_allow_gas) {
     pedal_pressed = pedal_pressed || gas_pressed_prev;
   }
   bool current_controls_allowed = controls_allowed && !(pedal_pressed);

board/safety/safety_gm.h

@@ -124,8 +124,8 @@ static int gm_tx_hook(CANPacket_t *to_send) {
   // disallow actuator commands if gas or brake (with vehicle moving) are pressed
   // and the the latching controls_allowed flag is True
   int pedal_pressed = brake_pressed_prev && vehicle_moving;
-  bool unsafe_allow_gas = unsafe_mode & UNSAFE_DISABLE_DISENGAGE_ON_GAS;
-  if (!unsafe_allow_gas) {
+  bool alt_exp_allow_gas = alternative_experience & ALT_EXP_DISABLE_DISENGAGE_ON_GAS;
+  if (!alt_exp_allow_gas) {
     pedal_pressed = pedal_pressed || gas_pressed_prev;
   }
   bool current_controls_allowed = controls_allowed && !pedal_pressed;

board/safety/safety_honda.h

@@ -195,8 +195,8 @@ static int honda_rx_hook(CANPacket_t *to_push) {
       }
     }
 
-    // disable stock Honda AEB in unsafe mode
-    if (!(unsafe_mode & UNSAFE_DISABLE_STOCK_AEB)) {
+    // disable stock Honda AEB in alternative experience
+    if (!(alternative_experience & ALT_EXP_DISABLE_STOCK_AEB)) {
       if ((bus == 2) && (addr == 0x1FA)) {
         bool honda_stock_aeb = GET_BYTE(to_push, 3) & 0x20U;
         int honda_stock_brake = (GET_BYTE(to_push, 0) << 2) + ((GET_BYTE(to_push, 1) >> 6) & 0x3U);
@@ -260,8 +260,8 @@ static int honda_tx_hook(CANPacket_t *to_send) {
   // disallow actuator commands if gas or brake (with vehicle moving) are pressed
   // and the the latching controls_allowed flag is True
   int pedal_pressed = brake_pressed_prev && vehicle_moving;
-  bool unsafe_allow_gas = unsafe_mode & UNSAFE_DISABLE_DISENGAGE_ON_GAS;
-  if (!unsafe_allow_gas) {
+  bool alt_exp_allow_gas = alternative_experience & ALT_EXP_DISABLE_DISENGAGE_ON_GAS;
+  if (!alt_exp_allow_gas) {
     pedal_pressed = pedal_pressed || gas_pressed_prev;
   }
   bool current_controls_allowed = controls_allowed && !(pedal_pressed);

board/safety_declarations.h

@@ -127,23 +127,21 @@ int desired_angle_last = 0;
 struct sample_t angle_meas;         // last 3 steer angles
 
 // This can be set with a USB command
-// It enables features we consider to be unsafe, but understand others may have different opinions
-// It is always 0 on mainline comma.ai openpilot
+// It enables features that allow alternative experiences, like not disengaging on gas press
+// It is only either 0 or 1 on mainline comma.ai openpilot
 
-// If using this flag, be very careful about what happens if your fork wants to brake while the
-//   user is pressing the gas. Tesla is careful with this.
-#define UNSAFE_DISABLE_DISENGAGE_ON_GAS 1
+#define ALT_EXP_DISABLE_DISENGAGE_ON_GAS 1
 
 // If using this flag, make sure to communicate to your users that a stock safety feature is now disabled.
-#define UNSAFE_DISABLE_STOCK_AEB 2
+#define ALT_EXP_DISABLE_STOCK_AEB 2
 
 // If using this flag, be aware that harder braking is more likely to lead to rear endings,
 //   and that alone this flag doesn't make braking compliant because there's also a time element.
 // Setting this flag is used for allowing the full -5.0 to +4.0 m/s^2 at lower speeds
 // See ISO 15622:2018 for more information.
-#define UNSAFE_RAISE_LONGITUDINAL_LIMITS_TO_ISO_MAX 8
+#define ALT_EXP_RAISE_LONGITUDINAL_LIMITS_TO_ISO_MAX 8
 
-int unsafe_mode = 0;
+int alternative_experience = 0;
 
 // time since safety mode has been changed
 uint32_t safety_mode_cnt = 0U;

board/usb_comms.h

@@ -29,7 +29,7 @@ int get_health_pkt(void *dat) {
   health->usb_power_mode_pkt = usb_power_mode;
   health->safety_mode_pkt = (uint8_t)(current_safety_mode);
   health->safety_param_pkt = current_safety_param;
-  health->unsafe_mode_pkt = unsafe_mode;
+  health->alternative_experience_pkt = alternative_experience;
   health->power_save_enabled_pkt = (uint8_t)(power_save_status == POWER_SAVE_STATUS_ENABLED);
   health->heartbeat_lost_pkt = (uint8_t)(heartbeat_lost);
   health->blocked_msg_cnt_pkt = blocked_msg_cnt;
@@ -288,11 +288,11 @@ int usb_cb_control_msg(USB_Setup_TypeDef *setup, uint8_t *resp) {
         UNUSED(ret);
       }
       break;
-    // **** 0xdf: set unsafe mode
+    // **** 0xdf: set alternative experience
     case 0xdf:
       // you can only set this if you are in a non car safety mode
       if (!is_car_safety_mode(current_safety_mode)) {
-        unsafe_mode = setup->b.wValue.w;
+        alternative_experience = setup->b.wValue.w;
       }
       break;
     // **** 0xe0: uart read

python/__init__.py

@@ -160,7 +160,7 @@ class Panda(object):
   HW_TYPE_RED_PANDA = b'\x07'
 
   CAN_PACKET_VERSION = 2
-  HEALTH_PACKET_VERSION = 3
+  HEALTH_PACKET_VERSION = 4
   HEALTH_STRUCT = struct.Struct("<IIIIIIIIBBBBBBBHBBBHI")
 
   F2_DEVICES = (HW_TYPE_PEDAL, )
@@ -375,7 +375,7 @@ def health(self):
       "fault_status": a[16],
       "power_save_enabled": a[17],
       "heartbeat_lost": a[18],
-      "unsafe_mode": a[19],
+      "alternative_experience": a[19],
       "blocked_msg_cnt": a[20],
     }
 

tests/safety/common.py

@@ -10,7 +10,7 @@
 
 MAX_WRONG_COUNTERS = 5
 
-class UNSAFE_MODE:
+class ALTERNATIVE_EXPERIENCE:
   DEFAULT = 0
   DISABLE_DISENGAGE_ON_GAS = 1
   DISABLE_STOCK_AEB = 2
@@ -82,15 +82,15 @@ def test_disengage_on_gas_interceptor(self):
       self._rx(self._interceptor_msg(0, 0x201))
       self.safety.set_gas_interceptor_detected(False)
 
-  def test_unsafe_mode_no_disengage_on_gas_interceptor(self):
+  def test_alternative_experience_no_disengage_on_gas_interceptor(self):
     self.safety.set_controls_allowed(True)
-    self.safety.set_unsafe_mode(UNSAFE_MODE.DISABLE_DISENGAGE_ON_GAS)
+    self.safety.set_alternative_experience(ALTERNATIVE_EXPERIENCE.DISABLE_DISENGAGE_ON_GAS)
     for g in range(0, 0x1000):
       self._rx(self._interceptor_msg(g, 0x201))
       self.assertTrue(self.safety.get_controls_allowed())
       self._rx(self._interceptor_msg(0, 0x201))
       self.safety.set_gas_interceptor_detected(False)
-    self.safety.set_unsafe_mode(UNSAFE_MODE.DEFAULT)
+    self.safety.set_alternative_experience(ALTERNATIVE_EXPERIENCE.DEFAULT)
 
   def test_allow_engage_with_gas_interceptor_pressed(self):
     self._rx(self._interceptor_msg(0x1000, 0x201))
@@ -349,10 +349,10 @@ def test_disengage_on_gas(self):
     self._rx(self._gas_msg(self.GAS_PRESSED_THRESHOLD + 1))
     self.assertFalse(self.safety.get_controls_allowed())
 
-  def test_unsafe_mode_no_disengage_on_gas(self):
+  def test_alternative_experience_no_disengage_on_gas(self):
     self._rx(self._gas_msg(0))
     self.safety.set_controls_allowed(True)
-    self.safety.set_unsafe_mode(UNSAFE_MODE.DISABLE_DISENGAGE_ON_GAS)
+    self.safety.set_alternative_experience(ALTERNATIVE_EXPERIENCE.DISABLE_DISENGAGE_ON_GAS)
     self._rx(self._gas_msg(self.GAS_PRESSED_THRESHOLD + 1))
     self.assertTrue(self.safety.get_controls_allowed())
 

tests/safety/libpandasafety_py.py

@@ -27,8 +27,8 @@
 
 void set_controls_allowed(bool c);
 bool get_controls_allowed(void);
-void set_unsafe_mode(int mode);
-int get_unsafe_mode(void);
+void set_alternative_experience(int mode);
+int get_alternative_experience(void);
 void set_relay_malfunction(bool c);
 bool get_relay_malfunction(void);
 void set_gas_interceptor_detected(bool c);

tests/safety/test.c

@@ -89,8 +89,8 @@ void set_controls_allowed(bool c){
   controls_allowed = c;
 }
 
-void set_unsafe_mode(int mode){
-  unsafe_mode = mode;
+void set_alternative_experience(int mode){
+  alternative_experience = mode;
 }
 
 void set_relay_malfunction(bool c){
@@ -105,8 +105,8 @@ bool get_controls_allowed(void){
   return controls_allowed;
 }
 
-int get_unsafe_mode(void){
-  return unsafe_mode;
+int get_alternative_experience(void){
+  return alternative_experience;
 }
 
 bool get_relay_malfunction(void){
@@ -212,7 +212,7 @@ void init_tests(void){
     hw_type = atoi(getenv("HW_TYPE"));
   }
   safety_mode_cnt = 2U;  // avoid ignoring relay_malfunction logic
-  unsafe_mode = 0;
+  alternative_experience = 0;
   set_timer(0);
 }
 

tests/safety/test_gm.py

@@ -5,7 +5,7 @@
 from panda import Panda
 from panda.tests.safety import libpandasafety_py
 import panda.tests.safety.common as common
-from panda.tests.safety.common import CANPackerPanda, UNSAFE_MODE
+from panda.tests.safety.common import CANPackerPanda, ALTERNATIVE_EXPERIENCE
 
 MAX_RATE_UP = 7
 MAX_RATE_DOWN = 17
@@ -242,9 +242,9 @@ def test_tx_hook_on_pedal_pressed(self):
       elif pedal == 'gas':
         self._rx(self._gas_msg(0))
 
-  def test_tx_hook_on_pedal_pressed_on_unsafe_gas_mode(self):
+  def test_tx_hook_on_pedal_pressed_on_alternative_gas_experience(self):
     for pedal in ['brake', 'gas']:
-      self.safety.set_unsafe_mode(UNSAFE_MODE.DISABLE_DISENGAGE_ON_GAS)
+      self.safety.set_alternative_experience(ALTERNATIVE_EXPERIENCE.DISABLE_DISENGAGE_ON_GAS)
       if pedal == 'brake':
         # brake_pressed_prev and vehicle_moving
         self._rx(self._speed_msg(100))
@@ -262,7 +262,7 @@ def test_tx_hook_on_pedal_pressed_on_unsafe_gas_mode(self):
 
       # reset status
       self.safety.set_controls_allowed(0)
-      self.safety.set_unsafe_mode(UNSAFE_MODE.DEFAULT)
+      self.safety.set_alternative_experience(ALTERNATIVE_EXPERIENCE.DEFAULT)
       self._tx(self._send_brake_msg(0))
       self._tx(self._torque_msg(0))
       if pedal == 'brake':

tests/safety/test_honda.py

@@ -6,7 +6,7 @@
 from panda import Panda
 from panda.tests.safety import libpandasafety_py
 import panda.tests.safety.common as common
-from panda.tests.safety.common import CANPackerPanda, make_msg, MAX_WRONG_COUNTERS, UNSAFE_MODE
+from panda.tests.safety.common import CANPackerPanda, make_msg, MAX_WRONG_COUNTERS, ALTERNATIVE_EXPERIENCE
 
 class Btn:
   NONE = 0
@@ -130,9 +130,9 @@ def test_rx_hook(self):
     self.assertTrue(self.safety.get_controls_allowed())
 
   def test_tx_hook_on_pedal_pressed(self):
-    for mode in [UNSAFE_MODE.DEFAULT, UNSAFE_MODE.DISABLE_DISENGAGE_ON_GAS]:
+    for mode in [ALTERNATIVE_EXPERIENCE.DEFAULT, ALTERNATIVE_EXPERIENCE.DISABLE_DISENGAGE_ON_GAS]:
       for pedal in ['brake', 'gas']:
-        self.safety.set_unsafe_mode(mode)
+        self.safety.set_alternative_experience(mode)
         allow_ctrl = False
         if pedal == 'brake':
           # brake_pressed_prev and vehicle_moving
@@ -141,7 +141,7 @@ def test_tx_hook_on_pedal_pressed(self):
         elif pedal == 'gas':
           # gas_pressed_prev
           self._rx(self._gas_msg(1))
-          allow_ctrl = mode == UNSAFE_MODE.DISABLE_DISENGAGE_ON_GAS
+          allow_ctrl = mode == ALTERNATIVE_EXPERIENCE.DISABLE_DISENGAGE_ON_GAS
 
         self.safety.set_controls_allowed(1)
         hw = self.safety.get_honda_hw()
@@ -152,7 +152,7 @@ def test_tx_hook_on_pedal_pressed(self):
 
         # reset status
         self.safety.set_controls_allowed(0)
-        self.safety.set_unsafe_mode(UNSAFE_MODE.DEFAULT)
+        self.safety.set_alternative_experience(ALTERNATIVE_EXPERIENCE.DEFAULT)
         if hw == HONDA_NIDEC:
           self._tx(self._send_brake_msg(0))
         self._tx(self._send_steer_msg(0))
@@ -342,12 +342,12 @@ def test_brake_safety_check(self):
     self.safety.set_honda_fwd_brake(False)
 
   def test_tx_hook_on_interceptor_pressed(self):
-    for mode in [UNSAFE_MODE.DEFAULT, UNSAFE_MODE.DISABLE_DISENGAGE_ON_GAS]:
-      self.safety.set_unsafe_mode(mode)
+    for mode in [ALTERNATIVE_EXPERIENCE.DEFAULT, ALTERNATIVE_EXPERIENCE.DISABLE_DISENGAGE_ON_GAS]:
+      self.safety.set_alternative_experience(mode)
       # gas_interceptor_prev > INTERCEPTOR_THRESHOLD
       self._rx(self._interceptor_msg(self.INTERCEPTOR_THRESHOLD + 1, 0x201))
       self._rx(self._interceptor_msg(self.INTERCEPTOR_THRESHOLD + 1, 0x201))
-      allow_ctrl = mode == UNSAFE_MODE.DISABLE_DISENGAGE_ON_GAS
+      allow_ctrl = mode == ALTERNATIVE_EXPERIENCE.DISABLE_DISENGAGE_ON_GAS
 
       self.safety.set_controls_allowed(1)
       self.safety.set_honda_fwd_brake(False)
@@ -357,7 +357,7 @@ def test_tx_hook_on_interceptor_pressed(self):
 
       # reset status
       self.safety.set_controls_allowed(0)
-      self.safety.set_unsafe_mode(UNSAFE_MODE.DEFAULT)
+      self.safety.set_alternative_experience(ALTERNATIVE_EXPERIENCE.DEFAULT)
       self._tx(self._send_brake_msg(0))
       self._tx(self._send_steer_msg(0))
       self._tx(self._interceptor_msg(0, 0x200))

tests/safety/test_toyota.py

@@ -5,7 +5,7 @@
 from panda import Panda
 from panda.tests.safety import libpandasafety_py
 import panda.tests.safety.common as common
-from panda.tests.safety.common import CANPackerPanda, make_msg, UNSAFE_MODE
+from panda.tests.safety.common import CANPackerPanda, make_msg, ALTERNATIVE_EXPERIENCE
 
 MAX_ACCEL = 2.0
 MIN_ACCEL = -3.5
@@ -93,14 +93,14 @@ def test_block_aeb(self):
           self.assertEqual(not bad, self._tx(msg))
 
   def test_accel_actuation_limits(self):
-    limits = ((MIN_ACCEL, MAX_ACCEL, UNSAFE_MODE.DEFAULT),
-              (MIN_ACCEL, MAX_ACCEL, UNSAFE_MODE.RAISE_LONGITUDINAL_LIMITS_TO_ISO_MAX))
+    limits = ((MIN_ACCEL, MAX_ACCEL, ALTERNATIVE_EXPERIENCE.DEFAULT),
+              (MIN_ACCEL, MAX_ACCEL, ALTERNATIVE_EXPERIENCE.RAISE_LONGITUDINAL_LIMITS_TO_ISO_MAX))
 
-    for min_accel, max_accel, unsafe_mode in limits:
+    for min_accel, max_accel, alternative_experience in limits:
       for accel in np.arange(min_accel - 1, max_accel + 1, 0.1):
         for controls_allowed in [True, False]:
           self.safety.set_controls_allowed(controls_allowed)
-          self.safety.set_unsafe_mode(unsafe_mode)
+          self.safety.set_alternative_experience(alternative_experience)
           if controls_allowed:
             should_tx = int(min_accel * 1000) <= int(accel * 1000) <= int(max_accel * 1000)
           else: