Toyota: Add SECOC longitudinal control

[chrispypatt]

DBC:

• Add counter for secoc acc messages like the other secoc messages
• Add new acc message creation for second ACCEL_CMD
• Remove SECOC openpilotLongitudinalControl disable

Safety:

Creates a SECOC variant of common long messages. This is basically a copy of the TOYOTA_COMMON_LONG_TX_MSGS but:

swapped TOYOTA_COMMON_TX_MSGS for TOYOTA_COMMON_SECOC_TX_MSGS
added a the new secoc acc command address 0x183

[jyoung8607]

Long term I'd like to clean up the SecOC message wrapping convention, but that's a separate refactor that we don't need to get into for this PR.

For development purposes we've gotten away with setting the accel value in both ACC control messages, but before we merge we need to match stock actuation behavior: always set zero/inactive acceleration in ACC_CONTROL, and only send the true accel in ACC_CONTROL_2. There are checks in commaai/panda#2072 to ensure this correct behavior.

Aside from that, LGTM.

[nelsonjchen]

Just passing a Discord Link here to some of the chatter on the state of the PR:

Nov 21: "Well the mutation tests are failing so something seems wrong functionally. But I would also say my attempt at supporting two acc commands in the tests is a bit gross"

https://discord.com/channels/469524606043160576/905950538816978974/1309380353261174847

[chrispypatt]

@sshane @jyoung8607 I just resolved some merge conflicts w/ master and have updated my branch. Any feedback or discussion around my previous questions would be appreciated.

[GaganBhat]

Hi, @sshane Is there a process to get a review on this PR? Thank you!

[yuzisee]

Good news! Sounds like it's on Jason's radar https://discord.com/channels/469524606043160576/1184981830714261604/1400183941515972830 so for now we need to be patient 🙂

[dobromirmontauk]

So excited for this!

[jyoung8607]

Rebased.

I think the car port and safety code are basically okay, but we have to figure out a better way to run the accel tests. We can't hack up the common tests like that. Can you try doing it with inheritance instead?

Something like this in the base classes:

  def _accel_msg_835(self, accel, cancel_req=0):
    values = {"ACCEL_CMD": accel, "CANCEL_REQ": cancel_req}
    return self.packer.make_can_msg_panda("ACC_CONTROL", 0, values)

  def _accel_msg_387(self, accel):
    values = {"ACCEL_CMD": accel}
    return self.packer.make_can_msg_panda("ACC_CONTROL_2", 0, values)

Then in the non-SecOC cases:

  def _accel_msg(self, accel):
    return self._accel_msg_835(accel)

And in the SecOC cases:

  def _accel_msg(self, accel):
    return self._accel_msg_387(accel)

  def test_835_actuation_blocked(self, stock_longitudinal: bool = True):
    """
    For SecOC cars, longitudinal acceleration must be sent in ACC_CONTROL_2, but all other ACC
    data remains in ACC_CONTROL. Verify no actuation is sent via ACC_CONTROL.
    """
    (the same as test_acc_cancel but should_tx = accel == self.INACTIVE_ACCEL)

Also tweak test_acc_cancel to always call _accel_msg_835 instead of _accel_msg.

I started to do this myself but hadn't settled on how to juggle the existing classes, figured you could try.

[jyoung8607]

Tests need work. Left some untested ideas in an earlier comment.

[chrispypatt]

Sounds good I can take a stab at it. My time is a bit more limited ATM.

[chrispypatt]

should_tx = accel == self.INACTIVE_ACCEL

I couldn't get this exactly to work and had to follow how test_acc_cancel is implemented using should_tx = np.isclose(accel, self.INACTIVE_ACCEL, atol=0.0001) due to FP errors in comparing small floats.

But otherwise, @jyoung8607 I really like your suggestion. It's much cleaner than my previous implementation.

[jyoung8607]

LGTM pending comma review due to safety code changes.

[adeebshihadeh]

LGTM pending comma review due to safety code changes.

Since it's behind ALLOW_DEBUG, you're good to merge safety changes.

[GaganBhat]

Thank you for working on this @chrispypatt !! Awesome to see this merged.