commaai · adeebshihadeh · Jul 21, 2026
diff --git a/board/body/can.h b/board/body/can.h
@@ -7,7 +7,7 @@
 #include "board/health.h"
 #include "board/body/boards/board_declarations.h"
 #include "board/drivers/drivers.h"
-#include "opendbc/safety/declarations.h"
+#include "opendbc/safety/api.h"
 #include "board/body/bldc/bldc.h"
 
 #define BODY_CAN_ADDR_MOTOR_SPEED        0x201U

diff --git a/board/body/main.c b/board/body/main.c
@@ -1,3 +1,5 @@
+#define OPENDBC_SAFETY_API_ONLY
+
 #include <stdint.h>
 #include <stdbool.h>
 
@@ -141,4 +143,4 @@ int main(void) {
   }
 
   return 0;
-}
+}
diff --git a/board/jungle/main.c b/board/jungle/main.c
@@ -1,4 +1,6 @@
 // ********************* Includes *********************
+#define OPENDBC_SAFETY_API_ONLY
+
 #include "board/config.h"
 
 #include "opendbc/safety/safety.h"

diff --git a/board/main.c b/board/main.c
@@ -1,4 +1,6 @@
 // ********************* Includes *********************
+#define OPENDBC_SAFETY_API_ONLY
+
 #include "board/config.h"
 
 #include "board/drivers/led.h"
@@ -119,6 +121,8 @@ static void tick_handler(void) {
   static uint8_t prev_harness_status = HARNESS_STATUS_NC;
   static uint8_t loop_counter = 0U;
   static bool relay_malfunction_prev = false;
+  static bool controls_allowed_prev = false;
+  static uint32_t heartbeat_engaged_mismatches = 0U;
 
   if (TICK_TIMER->SR != 0U) {
 
@@ -131,14 +135,15 @@ static void tick_handler(void) {
     simple_watchdog_kick();
     sound_tick();
 
-    if (relay_malfunction_prev != relay_malfunction) {
-      if (relay_malfunction) {
+    safety_state safety = safety_get_state();
+    if (relay_malfunction_prev != safety.relay_malfunction) {
+      if (safety.relay_malfunction) {
         fault_occurred(FAULT_RELAY_MALFUNCTION);
       } else {
         fault_recovered(FAULT_RELAY_MALFUNCTION);
       }
     }
-    relay_malfunction_prev = relay_malfunction;
+    relay_malfunction_prev = safety.relay_malfunction;
 
     // re-init everything that uses harness status
     if (harness.status != prev_harness_status) {
@@ -147,12 +152,13 @@ static void tick_handler(void) {
 
       // re-init everything that uses harness status
       can_init_all();
-      set_safety_mode(current_safety_mode, current_safety_param);
+      set_safety_mode(safety.mode, safety.param);
       set_power_save_state(power_save_enabled);
     }
 
     // decimated to 1Hz
     if (loop_counter == 0U) {
+      safety = safety_get_state();
       //puth(usart1_dma); print(" "); puth(DMA2_Stream5->M0AR); print(" "); puth(DMA2_Stream5->NDTR); print("\n");
       #ifdef DEBUG
         print("** blink ");
@@ -163,7 +169,7 @@ static void tick_handler(void) {
       #endif
 
       // set green LED to be controls allowed
-      led_set(LED_GREEN, controls_allowed);
+      led_set(LED_GREEN, safety.controls_allowed);
 
       // turn off the blue LED, turned on by CAN
       // unless we are in power saving mode
@@ -181,15 +187,15 @@ static void tick_handler(void) {
       }
 
       // disabling heartbeat not allowed while in safety mode
-      if (is_car_safety_mode(current_safety_mode)) {
+      if (is_car_safety_mode(safety.mode)) {
         heartbeat_disabled = false;
       }
 
       if (siren_countdown > 0U) {
         siren_countdown -= 1U;
       }
 
-      if (controls_allowed || heartbeat_engaged) {
+      if (safety.controls_allowed || safety.heartbeat_engaged) {
         controls_allowed_countdown = 5U;
       } else if (controls_allowed_countdown > 0U) {
         controls_allowed_countdown -= 1U;
@@ -198,14 +204,19 @@ static void tick_handler(void) {
       }
 
       // exit controls allowed if unused by openpilot for a few seconds
-      if (controls_allowed && !heartbeat_engaged) {
+      if (safety.controls_allowed && !controls_allowed_prev) {
+        heartbeat_engaged_mismatches = 0U;
+      }
+      if (safety.controls_allowed && !safety.heartbeat_engaged) {
         heartbeat_engaged_mismatches += 1U;
         if (heartbeat_engaged_mismatches >= 3U) {
-          controls_allowed = false;
+          safety_disengage();
+          safety.controls_allowed = false;
         }
       } else {
         heartbeat_engaged_mismatches = 0U;
       }
+      controls_allowed_prev = safety.controls_allowed;
 
       if (!heartbeat_disabled) {
         // if the heartbeat has been gone for a while, go to SILENT safety mode and enter power save
@@ -220,14 +231,14 @@ static void tick_handler(void) {
           }
 
           // set flag to indicate the heartbeat was lost
-          if (is_car_safety_mode(current_safety_mode)) {
+          if (is_car_safety_mode(safety.mode)) {
             heartbeat_lost = true;
           }
 
           // clear heartbeat engaged state
-          heartbeat_engaged = false;
+          safety_set_heartbeat_engaged(false);
 
-          if (current_safety_mode != SAFETY_SILENT) {
+          if (safety.mode != SAFETY_SILENT) {
             set_safety_mode(SAFETY_SILENT, 0U);
           }
 
@@ -254,11 +265,10 @@ static void tick_handler(void) {
 
       // on to the next one
       uptime_cnt += 1U;
-      safety_mode_cnt += 1U;
       ignition_can_cnt += 1U;
 
       // synchronous safety check
-      safety_tick(&current_safety_config);
+      safety_tick();
     }
 
     loop_counter++;
@@ -375,7 +385,7 @@ int main(void) {
       #endif
     } else {
       if ((hw_type == HW_TYPE_CUATRO) && !current_board->read_som_gpio()) {
-        assert_fatal(current_safety_mode == SAFETY_SILENT, "Error: Entering low power mode while not in SAFETY_SILENT. Hanging\n");
+        assert_fatal(safety_get_state().mode == SAFETY_SILENT, "Error: Entering low power mode while not in SAFETY_SILENT. Hanging\n");
         enter_stop_mode(); // deep sleep, wakes on CAN or SBU activity
         assert_fatal(false, "Error: enter_stop_mode returned after system reset. Hanging\n");
       }

diff --git a/board/main_comms.h b/board/main_comms.h
@@ -7,6 +7,7 @@ bool is_car_safety_mode(uint16_t mode);
 static int get_health_pkt(void *dat) {
   COMPILE_TIME_ASSERT(sizeof(struct health_t) <= USBPACKET_MAX_SIZE);
   struct health_t * health = (struct health_t*)dat;
+  const safety_state safety = safety_get_state();
 
   health->uptime_pkt = uptime_cnt;
   health->voltage_pkt = current_board->read_voltage_mV();
@@ -15,18 +16,18 @@ static int get_health_pkt(void *dat) {
   health->ignition_line_pkt = (uint8_t)(harness_check_ignition());
   health->ignition_can_pkt = ignition_can;
 
-  health->controls_allowed_pkt = controls_allowed;
+  health->controls_allowed_pkt = safety.controls_allowed;
   health->safety_tx_blocked_pkt = safety_tx_blocked;
   health->safety_rx_invalid_pkt = safety_rx_invalid;
   health->tx_buffer_overflow_pkt = tx_buffer_overflow;
   health->rx_buffer_overflow_pkt = rx_buffer_overflow;
   health->car_harness_status_pkt = harness.status;
-  health->safety_mode_pkt = (uint8_t)(current_safety_mode);
-  health->safety_param_pkt = current_safety_param;
-  health->alternative_experience_pkt = alternative_experience;
+  health->safety_mode_pkt = (uint8_t)(safety.mode);
+  health->safety_param_pkt = safety.param;
+  health->alternative_experience_pkt = safety.alternative_experience;
   health->power_save_enabled_pkt = power_save_enabled;
   health->heartbeat_lost_pkt = heartbeat_lost;
-  health->safety_rx_checks_invalid_pkt = safety_rx_checks_invalid;
+  health->safety_rx_checks_invalid_pkt = safety.rx_checks_invalid;
 
   health->spi_error_count_pkt = spi_error_count;
 
@@ -244,8 +245,8 @@ int comms_control_handler(ControlPacket_t *req, uint8_t *resp) {
     // **** 0xdf: set alternative experience
     case 0xdf:
       // you can only set this if you are in a non car safety mode
-      if (!is_car_safety_mode(current_safety_mode)) {
-        alternative_experience = req->param1;
+      if (!is_car_safety_mode(safety_get_state().mode)) {
+        safety_set_alternative_experience(req->param1);
       }
       break;
     // **** 0xe0: uart read
@@ -297,7 +298,7 @@ int comms_control_handler(ControlPacket_t *req, uint8_t *resp) {
         heartbeat_counter = 0U;
         heartbeat_lost = false;
         heartbeat_disabled = false;
-        heartbeat_engaged = (req->param1 == 1U);
+        safety_set_heartbeat_engaged(req->param1 == 1U);
         break;
       }
     // **** 0xf6: set siren enabled
@@ -306,7 +307,7 @@ int comms_control_handler(ControlPacket_t *req, uint8_t *resp) {
       break;
     // **** 0xf8: disable heartbeat checks
     case 0xf8:
-      if (!is_car_safety_mode(current_safety_mode)) {
+      if (!is_car_safety_mode(safety_get_state().mode)) {
         heartbeat_disabled = true;
       }
       break;

diff --git a/pyproject.toml b/pyproject.toml
@@ -14,7 +14,7 @@ classifiers = [
 dependencies = [
   "libusb1",
   "libusb-package",
-  "opendbc @ git+https://github.com/commaai/opendbc.git@master#egg=opendbc",
+  "opendbc @ git+https://github.com/commaai/opendbc.git@d86186608c1d2b7dcfd09c0555e26c6fdcd35985#egg=opendbc",
   "spidev; platform_system == 'Linux'",  # runtime dependency on comma four
 ]
 

diff --git a/tests/libpanda/panda.c b/tests/libpanda/panda.c
@@ -1,3 +1,5 @@
+#define OPENDBC_SAFETY_API_ONLY
+
 #include "fake_stm.h"
 #include "config.h"
 #include "can.h"