You can not select more than 25 topics Topics must start with a letter or number, can include dashes ('-') and can be up to 35 characters long.
Kevin Roscom 4522320fdc use SAE J1850 for pedal 3 months ago
.github/workflows Switch panda to scons builder (#635) 1 year ago
board use SAE J1850 for pedal 3 months ago
certs Deprecate ESP (#592) 2 years ago
crypto Switch panda to scons builder (#635) 1 year ago
docs Deprecate ESP (#592) 2 years ago
drivers Fix linux can-utils bus numbering (#637) 1 year ago
examples Stricter pylint (#550) 2 years ago
python fix health in python 1 year ago
release Added build type to release version strings 3 years ago
tests Toyota: whitelist LTA message (#638) 1 year ago
.dockerignore Deprecate ESP (#592) 2 years ago
.gitignore build libpandasafety with scons (#639) 1 year ago
.pre-commit-config.yaml Deprecate ESP (#592) 2 years ago
Dockerfile update python to 3.8.5 1 year ago
Dockerfile.panda VW MQB: Updated message and signal data, round 1 (#632) 1 year ago
Jenkinsfile Switch panda to scons builder (#635) 1 year ago
LICENSE initial commit 5 years ago Remove reference to missing image 2 years ago
SConstruct build libpandasafety with scons (#639) 1 year ago more Python 3 fixes, attempting to fix jenkins wifi regresison test (#295) 3 years ago
VERSION Make sure relay faults make it to the health packet (#492) 2 years ago Switch panda to scons builder (#635) 1 year ago
panda.png update readme graphics 4 years ago
requirements.txt Switch panda to scons builder (#635) 1 year ago Deprecate ESP (#592) 2 years ago
setup.cfg Created python package and implemented industry best practices. 5 years ago Replace pycrypto with pycryptodome (#581) 2 years ago

Welcome to panda

panda is the nicest universal car interface ever.

It supports 3x CAN, 2x LIN, and 1x GMLAN. It also charges a phone. On the computer side, it has USB.

It uses an STM32F413.

It is 2nd gen hardware, reusing code and parts from the NEO interface board.

panda tests panda drivers



To install the library:

pip install pandacan

See this class for how to interact with the panda.

For example, to receive CAN messages:

>>> from panda import Panda
>>> panda = Panda()
>>> panda.can_recv()

And to send one on bus 0:

>>> panda.can_send(0x1aa, "message", 0)

Note that you may have to setup udev rules for Linux, such as

sudo tee /etc/udev/rules.d/11-panda.rules <<EOF
SUBSYSTEM=="usb", ATTRS{idVendor}=="bbaa", ATTRS{idProduct}=="ddcc", MODE="0666"
SUBSYSTEM=="usb", ATTRS{idVendor}=="bbaa", ATTRS{idProduct}=="ddee", MODE="0666"
sudo udevadm control --reload-rules && sudo udevadm trigger


See PandaJS

Software interface support

As a universal car interface, it should support every reasonable software interface.

Directory structure

  • board -- Code that runs on the STM32
  • drivers -- Drivers (not needed for use with python)
  • python   -- Python userspace library for interfacing with the panda
  • tests -- Tests and helper programs for panda


See board/


To print out the serial console from the STM32, run tests/

Safety Model

When a panda powers up, by default it's in SAFETY_SILENT mode. While in SAFETY_SILENT mode, the buses are also forced to be silent. In order to send messages, you have to select a safety mode. Currently, setting safety modes is only supported over USB. Some of safety modes (for example SAFETY_ALLOUTPUT) are disabled in release firmwares. In order to use them, compile and flash your own build.

Safety modes optionally supports controls_allowed, which allows or blocks a subset of messages based on a customizable state in the board.

Code Rigor

When compiled from the EON or comma two dev kits, the panda FW is configured and optimized (at compile time) for its use in conjuction with openpilot. The panda FW, through its safety model, provides and enforces the openpilot safety. Due to its critical function, it's important that the application code rigor within the board folder is held to high standards.

These are the CI regression tests we have in place:

  • A generic static code analysis is performed by cppcheck.
  • In addition, cppcheck has a specific addon to check for MISRA C:2012 violations. See current coverage.
  • Compiler options are relatively strict: the flags -Wall -Wextra -Wstrict-prototypes -Werror are enforced on board and pedal Makefiles.
  • The safety logic is tested and verified by unit tests for each supported car variant.
  • A recorded drive for each supported car variant is replayed through the safety logic to ensure that the behavior remains unchanged.
  • An internal Hardware-in-the-loop test, which currently only runs on pull requests opened by's organization members, verifies the following functionalities:
    • compiling the code in various configuration and flashing it both through USB.
    • Receiving, sending and forwarding CAN messages on all buses, over USB.

In addition, we run the pylint and flake8 linters on all python files within the panda repo.


Check out the hardware guide


panda software is released under the MIT license unless otherwise specified.