diff --git a/panda b/panda
index 5307bf7277..0657064594 160000
--- a/panda
+++ b/panda
@@ -1 +1 @@
-Subproject commit 5307bf7277c267075aa03799c8749a60463c8804
+Subproject commit 06570645941c33a5d83808606b0559e9943fd7b2
diff --git a/selfdrive/test/test_panda_safety.py b/selfdrive/test/test_panda_safety.py
new file mode 100755
index 0000000000..67d08b914e
--- /dev/null
+++ b/selfdrive/test/test_panda_safety.py
@@ -0,0 +1,49 @@
+#!/usr/bin/env python3
+
+import os
+import sys
+import bz2
+import struct
+from panda import Panda
+from panda.tests.safety_replay.replay_drive import replay_drive
+from tools.lib.logreader import LogReader
+from xx.chffr.lib.route import Route
+
+# get a complete canlog (sendcan and can) for a drive
+def get_canlog(route):
+  if os.path.isfile(route + ".bz2"):
+    return
+
+  r = Route(route)
+  log_msgs = []
+  for i, segment in enumerate(r.log_paths()):
+    print("downloading segment %d/%d" % (i+1, len(r.log_paths())))
+    log = LogReader(segment)
+    log_msgs.extend(filter(lambda msg: msg.which() in ('can', 'sendcan'), log))
+  log_msgs.sort(key=lambda msg: msg.logMonoTime)
+
+  dat = b"".join(m.as_builder().to_bytes() for m in log_msgs)
+  dat = bz2.compress(dat)
+  with open(route + ".bz2", "wb") as f:
+    f.write(dat)
+
+
+def get_logreader(route):
+  try:
+    lr = LogReader(route + ".bz2")
+  except IOError:
+    print("downloading can log")
+    get_canlog(route)
+    lr = LogReader(route + ".bz2")
+
+  return lr
+
+if __name__ == "__main__":
+  route = sys.argv[1]
+  mode = int(sys.argv[2])
+  param = 0 if len(sys.argv) < 4 else int(sys.argv[3])
+
+  lr = get_logreader(route)
+  print("replaying drive %s with safety model %d and param %d" % (route, mode, param))
+
+  replay_drive(lr, mode, param)