pandad: close relay when openpilot goes offroad

[sshane]

Closes #35709.

Previously, the only user-facing way you could make openpilot go offroad was turning off the car ignition. pandad handled this by resetting the safety mode to NO_OUTPUT.

Then we added onroad cycling via toggles, but pandad only checked the ignition for resetting the safety mode. This kept the relay open and faulted the car, until openpilot set it to ELM327 for fingerprinting starting back up.

This bug also faulted the car if the device went offroad from device_temp_good going false.

---

Flipping the enable op toggle now:

      safetyModel = toyota,
      safetyModel = toyota,
      safetyModel = toyota,
      safetyModel = toyota,
      safetyModel = toyota,
      safetyModel = toyota,
      safetyModel = toyota,
      safetyModel = toyota,
      safetyModel = noOutput,
      safetyModel = noOutput,
      safetyModel = noOutput,
      safetyModel = noOutput,
      safetyModel = noOutput,
      safetyModel = noOutput,
      safetyModel = noOutput,
      safetyModel = noOutput,
      safetyModel = noOutput,
      safetyModel = noOutput,
      safetyModel = noOutput,
      safetyModel = noOutput,
      safetyModel = noOutput,
      safetyModel = noOutput,
      safetyModel = noOutput,
      safetyModel = noOutput,
      safetyModel = noOutput,
      safetyModel = noOutput,
      safetyModel = noOutput,
      safetyModel = elm327,
      safetyModel = elm327,
      safetyModel = elm327,
      safetyModel = elm327,
      safetyModel = elm327,
      safetyModel = elm327,

[Copilot]

Pull Request Overview

This PR fixes a bug where pandad didn't properly close the relay when openpilot went offroad through user toggles or device temperature issues, only handling ignition-based transitions. The change ensures the relay is closed whenever the system goes offroad, preventing car faults.

• Modified pandad to check both ignition state and onroad status when deciding whether to close the relay
• Updated the safety mode configuration to consider onroad state in addition to ignition
• Moved onroad state checking to the main loop for consistent tracking

Reviewed Changes

Copilot reviewed 3 out of 3 changed files in this pull request and generated 1 comment.

File	Description
selfdrive/pandad/pandad.h	Updated configureSafetyMode method signature to accept is_onroad parameter
selfdrive/pandad/pandad.cc	Added onroad state tracking and updated relay closing logic to consider both ignition and onroad status
selfdrive/pandad/panda_safety.cc	Removed local onroad parameter reading, now accepts it as method parameter