Check panda safety against CarState (#1995)

* check panda safety against CarState

* filter out bad honda routes

* bump a bit more
old-commit-hash: 7f16554ee3

selfdrive/test/test_models.py

@@ -3,12 +3,13 @@
 import os
 import importlib
 import unittest
-from collections import Counter
+from collections import defaultdict, Counter
 from parameterized import parameterized_class
 
 from cereal import log, car
 from selfdrive.car.fingerprints import all_known_cars
 from selfdrive.car.car_helpers import interfaces
+from selfdrive.car.honda.values import HONDA_BOSCH
 from selfdrive.test.test_routes import routes, non_tested_cars
 from selfdrive.test.openpilotci import get_url
 from tools.lib.logreader import LogReader
@@ -37,6 +38,17 @@ ignore_can_valid = [
   "HONDA ACCORD 2018 HYBRID TOURING",
 ]
 
+ignore_carstate_check = [
+  # TODO: chrysler gas state in panda also checks wheel speed, refactor so it's only gas
+  "CHRYSLER PACIFICA HYBRID 2017",
+
+  # TODO: get new routes for these cars, current routes are from giraffe with different buses
+  "HONDA CR-V 2019 HYBRID",
+  "HONDA ACCORD 2018 SPORT 2T",
+  "HONDA INSIGHT 2019 TOURING",
+  "HONDA ACCORD 2018 HYBRID TOURING",
+]
+
 @parameterized_class(('car_model'), [(car,) for car in all_known_cars()])
 class TestCarModel(unittest.TestCase):
 
@@ -128,7 +140,7 @@ class TestCarModel(unittest.TestCase):
         error_cnt += car.RadarData.Error.canError in radar_data.errors
     self.assertLess(error_cnt, 20)
 
-  def test_panda_safety_rx(self):
+  def test_panda_safety_rx_valid(self):
     if self.CP.dashcamOnly:
       self.skipTest("no need to check panda safety for dashcamOnly")
 
@@ -146,6 +158,46 @@ class TestCarModel(unittest.TestCase):
           failed_addrs[hex(msg.address)] += 1
     self.assertFalse(len(failed_addrs), f"panda safety RX check failed: {failed_addrs}")
 
+  def test_panda_safety_carstate(self):
+    if self.CP.dashcamOnly:
+      self.skipTest("no need to check panda safety for dashcamOnly")
+    if self.car_model in ignore_carstate_check:
+      self.skipTest("see comments in test_models.py")
+
+    safety = libpandasafety_py.libpandasafety
+    set_status = safety.set_safety_hooks(self.CP.safetyModel.raw, self.CP.safetyParam)
+    self.assertEqual(0, set_status)
+
+    checks = defaultdict(lambda: 0)
+    CC = car.CarControl.new_message()
+    for can in self.can_msgs:
+      for msg in can.can:
+        if msg.src >= 128:
+          continue
+        to_send = package_can_msg([msg.address, 0, msg.dat, msg.src])
+        safety.safety_rx_hook(to_send)
+      CS = self.CI.update(CC, (can.as_builder().to_bytes(),))
+
+      # TODO: check steering state
+      # check that openpilot and panda safety agree on the car's state
+      checks['gasPressed'] += CS.gasPressed != safety.get_gas_pressed_prev()
+      checks['brakePressed'] += CS.brakePressed != safety.get_brake_pressed_prev()
+      checks['controlsAllowed'] += not CS.cruiseState.enabled and safety.get_controls_allowed()
+
+    # TODO: reduce tolerance to 0
+    failed_checks = {k: v for k, v in checks.items() if v > 25}
+
+    # TODO: the panda and openpilot interceptor thresholds should match
+    if "gasPressed" in failed_checks and self.CP.enableGasInterceptor:
+      if failed_checks['gasPressed'] < 150:
+        del failed_checks['gasPressed']
+
+    # TODO: honda nidec: do same checks in carState and panda
+    if "brakePressed" in failed_checks and self.car_model.startswith(("HONDA", "ACURA")) and self.car_model not in HONDA_BOSCH:
+      if failed_checks['brakePressed'] < 150:
+        del failed_checks['brakePressed']
+
+    self.assertFalse(len(failed_checks), f"panda safety doesn't agree with CarState: {failed_checks}")
 
 if __name__ == "__main__":
   unittest.main()

selfdrive/test/test_onroad.py

@@ -71,7 +71,7 @@ def check_cpu_usage(first_proc, last_proc):
       cpu_usage = cpu_time / dt * 100.
       if cpu_usage > max(normal_cpu_usage * 1.1, normal_cpu_usage + 5.0):
         # TODO: fix high CPU when playing sounds constantly in UI
-        if proc_name == "./_ui" and cpu_usage < 40.:
+        if proc_name == "./_ui" and cpu_usage < 50.:
           continue
         result += f"Warning {proc_name} using more CPU than normal\n"
         r = False