clearpilot/sessions/2026-04-26-1229-hyundai-canfd-steer-torque-bump/README.md

Session: 2026-04-26 — Hyundai CAN-FD steering torque bump

Documentation for commit 4058269 on clearpilot. Reference for any future re-tuning.

What changed

Bumped this Tucson HDA2 (CAN-FD platform) from comma's conservative steer ceiling to a value that gives more headroom on tighter on-ramp clovers, plus a small rate-limit nudge so the controller can actually reach the new ceiling within reasonable transient time.

Constant	Before (comma default for CAN-FD)	After (this commit)	Comma's non-CAN-FD HKG default
max_steer / STEER_MAX	270	324	384
max_rate_up / STEER_DELTA_UP	2	3	3
max_rate_down / STEER_DELTA_DOWN	3	5	7
max_rt_delta	112	134	~150

Where the change lives — TWO files in lockstep

The panda safety firmware enforces these limits independently of openpilot. If only one side is bumped, panda rejects the larger commands and you get cut-out / commIssue behavior. Always change both, always to the same numbers, in the same commit.

1. panda/board/safety/safety_hyundai_canfd.h (lines 3-19)

   • HYUNDAI_CANFD_STEERING_LIMITS struct: max_steer, max_rate_up, max_rate_down, max_rt_delta.
   • This is C; modifying it changes the panda firmware hash, which forces an automatic re-flash on next pandad start. No manual panda flash command needed.

2. selfdrive/car/hyundai/values.py (CAN-FD branch of CarControllerParams.__init__, lines 29-36)

   • STEER_MAX, STEER_DELTA_UP, STEER_DELTA_DOWN.
   • Pure Python; picked up on next controlsd start.

What each constant does

• max_steer / STEER_MAX — peak torque magnitude the controller can request. Hard ceiling. Going past this is the headline "more torque" knob.
• max_rate_up / STEER_DELTA_UP — per-100Hz-cycle upward slew cap. Higher = faster ramp into a turn. With max_rate_up = 3 and max_steer = 324, time from 0 to ceiling is 324 / 3 = 108 cycles = 1.08 s.
• max_rate_down / STEER_DELTA_DOWN — per-cycle downward slew cap. Higher = faster release back toward straight. We chose 5 (vs comma's 7) for a smoother release feel.
• max_rt_delta — cumulative torque change allowed across a rolling 250 ms window (max_rt_interval). It's a long-window envelope check, separate from the per-cycle rate. Should scale with max_steer — we used max_steer × ~0.41 to mirror comma's ratio.
• driver_torque_allowance / STEER_DRIVER_ALLOWANCE — driver wheel torque (Nm read off the wheel) that's tolerated before the system starts derating its own command. Left at 250.
• driver_torque_factor / STEER_DRIVER_MULTIPLIER — how aggressively the system fights driver input above the allowance. Left at 2.

How to go higher (path to 384)

384 is the community-consensus safe ceiling for HKG. Comma uses it as the default for every non-CAN-FD HKG that isn't on the explicit 255-blacklist, and they merged it for HDA1 CAN-FD (EV6 / Ioniq 5) in openpilot PR #25723. The PR author noted "max steer needed to be 384 to make basic turns." Tucson NX4 HDA2 is not on the 255-blacklist (see issue #24122 for the verified blacklist).

To go from 324 → 384:

// panda/board/safety/safety_hyundai_canfd.h
.max_steer = 384,
.max_rt_delta = 158,         // ~max_steer × 0.41
.max_rate_up = 3,
.max_rate_down = 5,          // or 7 for comma-matched aggressive release

# selfdrive/car/hyundai/values.py CAN-FD branch
self.STEER_MAX = 384
self.STEER_DELTA_UP = 3
self.STEER_DELTA_DOWN = 5    # or 7

Beyond 384 is uncharted for HKG — comma has not tested past it. Some forks (sunnypilot has discussions) try higher for very heavy vehicles but with mixed results. Don't go past 384 without an explicit reason.

Things to watch for / community-flagged risks at higher values

1. EPS time-out cut every ~90 frames. The CAN-FD safety already forces a brief torque cut to stop the EPS from faulting (the min_valid_request_frames = 89, max_invalid_request_frames = 2, min_valid_request_rt_interval = 810000 block of HYUNDAI_CANFD_STEERING_LIMITS). This is independent of max_steer. Bumping the ceiling does not lengthen the cut-free window — you just hold the higher torque for the same ~890 ms before the brief cut. If you're getting Steering Temporarily Unavailable during sustained turns, the issue is this cut, not the ceiling, and it can't be tuned without risking a real EPS fault.

2. steerTempUnavailable / "Cruise Fault: Restart the Car". Has been reported on cars in the 255-blacklist when pushed to 384. Tucson NX4 is not blacklisted, so 324–384 is normally safe — but if you see this alert during slow sweeping turns, that's the symptom. Roll back to 270 and confirm.

3. Lateral accel retune. Higher torque headroom can cause the torque controller to overshoot if latAccelFactor was tuned for the old ceiling. EV6/Ioniq 5 testing in PR #25723 had to drop lateral accel to 2.5 m/s² when bumping from 270 to 384. Watch for over-correction (zig-zag in lane center) after a bump and retune latAccelFactor in selfdrive/locationd/torqued.py or via the torque-tune Params if needed.

4. Driver-fight feel. driver_torque_allowance = 250 / driver_torque_factor = 2 is the blending knob. Most "openpilot fights my hands" complaints come from people who lowered allowance or raised factor. Don't touch these without a specific reason.

5. Panda safety hash mismatch. Changing safety_hyundai_canfd.h regenerates the panda firmware binary with a different signed hash. On the next pandad start, pandad detects the mismatch and re-flashes the panda automatically (see pandad.log: "Panda firmware out of date" → "flash: flashing" → "Done flashing"). Takes ~10 s. No manual action needed; just expect a brief delay before controls come up.

Verifying the change took effect

# 1. Confirm the rebuild happened and panda firmware was re-signed.
grep "panda/board/obj/panda_h7" /tmp/build_only.log 2>/dev/null   # or run build_only.sh and watch for "signing N bytes"

# 2. Watch for re-flash on launch.
tail -f /data/log2/current/pandad.log
# Should see: "Panda firmware out of date, update required"
#             "flash: flashing"
#             "Done flashing"

# 3. Confirm the openpilot side is using the new value.
su - comma -c 'PYTHONPATH=/data/openpilot python3 -c "
from cereal import car
from openpilot.common.params import Params
cp_bytes = Params().get(\"CarParams\")
with car.CarParams.from_bytes(cp_bytes) as cp:
    print(\"safetyConfig safetyParam:\", [c.safetyParam for c in cp.safetyConfigs])
"'

# 4. Live-check the actual commanded torque ceiling (drive a moderate turn).
# carControl.actuators.steer should now be able to peak above 0.79 (270/255 normalized)
# but stay under 1.0 (full saturation at the new ceiling).

Rollback

If anything misbehaves, revert just the two-file commit:

git revert 4058269
chown -R comma:comma /data/openpilot
su - comma -c "bash /data/openpilot/build_only.sh"
# Next pandad launch will re-flash back to 270.

Sources

• openpilot PR #25723 — HDA1 EV6/Ioniq 5 270 → 384
• openpilot issue #24122 — HKG torque blacklist verification
• openpilot PR #26427 — Hyundai Tucson 2023 support
• sunnypilot — increasing torque help
• sunnypilot — raising torque for heavier vehicles