Safety and limitations

Start with the official NotAutopilot safety page — it is required reading before you install or drive with NAP. This page adds the wiki-level detail behind it.

This page exists to be read, not skimmed. The limits described here are real, physical constraints of the car — not software toggles.

The braking problem

Pre-Autopilot Model S has a vacuum-assisted hydraulic brake system, the same type used in conventional ICE cars. There is no electronic brake actuator. NAP cannot command the brakes.

When NAP needs to slow down, it has one tool: regenerative braking through the motor. Regen braking is effective at highway speeds but becomes weaker as speed drops, and it does nothing below about 5 mph (8 km/h). It is not enough for a sudden stop.

NAP cannot apply friction brakes. You are the brakes.

Every single time you drive with NAP engaged, your foot needs to stay close to the brake pedal. If a car cuts in, if a light turns red, if the car ahead stops faster than regen can match — you brake. The system will not do it for you.

This is not a recoverable situation through more careful driving. It is the physical reality of the hardware. AP-era cars got stop-and-go capability because Tesla introduced the iBooster electric brake booster in 2015. Pre-AP cars were built before that. An iBooster retrofit worked in the Tinkla era, but the controller ECU it depended on is no longer made and NAP support is not currently available — see the iBooster page for where that stands.

Speed floor in no-pedal mode

Without a Comma Pedal, NAP steers while the factory Tesla cruise control holds your set speed. NAP engages and cancels stock cruise with synthesized stalk commands, but it does not adjust the speed — there is no adaptive following in this mode. Stock cruise is plain, fixed-speed cruise, and it only operates above roughly 18 mph (29 km/h). Below that speed, cruise disengages and the car coasts. Steering may stay active.

This means no-pedal NAP is a highway tool: lane centering plus old-fashioned cruise control. It is not useful in stop-and-go traffic, at low speeds, or anywhere you expect traffic to force speed changes — those are yours to handle, with the stalk or the brake.

With a Comma Pedal, the floor drops to about 1 mph — though regen-only braking still applies, so the braking caveat above remains fully in force regardless of pedal mode.

Driver monitoring

NAP runs openpilot's standard driver-monitoring system, which uses the comma device's driver-facing camera to watch for inattention. If you look away from the road for too long, the system will alert you and may disengage. This is a feature, not an annoyance. The car is not safe to operate without attention; the camera is a reminder.

Driver monitoring does not verify that your hands are near the wheel or your foot is near the brake. It watches your eyes and head. You are still responsible for being in control.

What the safety layer does and does not enforce

NAP uses a standalone panda safety mode called tesla_preap, written specifically for this car. It enforces:

• Steering angle and rate limits — the panda caps how fast and how far NAP can command the wheel
• Hands-on override disengage — if you apply enough steering force, the panda registers it and cuts steering commands
• EPAS error disengage — if the EPAS controller reports error codes 6–9 (which indicate it has rejected a steering command), the panda disengages
• Door-open and out-of-Drive disengage — opening a door or shifting out of Drive drops all control
• Stalk cancel — a stalk cancel event fully disengages regardless of other state
• AEB blocking — the panda will not allow openpilot to synthesize Automatic Emergency Braking commands, since the car has no way to execute them electronically

The safety layer does not:

• Apply the brakes under any circumstances
• Prevent you from driving into a situation where regen braking is insufficient
• Guarantee that lane-centering commands are correct under all road conditions

See Safety model for the technical detail on what the panda enforces at the firmware level.

Disclaimer

NAP is experimental research software, for academic or research purposes only. It is alpha quality, provided as-is without warranty of any kind, and it is not certified or approved for use on any public road. It operates your car's steering, and it may behave unexpectedly or disengage without warning.

By installing and running NAP, you accept full responsibility for your vehicle and for any consequences of its behavior. The software is provided under the MIT License with no warranty, express or implied. The NAP project, its contributors, and its maintainers accept no liability for any outcome arising from the use of this software.

NAP is not affiliated with Tesla, Inc., comma.ai, or the Tinkla project. None of those parties have reviewed or approved this software. Running NAP on your car may void portions of your warranty and could trigger unexpected behavior from Tesla's own vehicle software; you assess that risk yourself.

You are responsible for complying with the laws and regulations of the jurisdiction where you drive. In many places, driver-assistance software that affects steering or speed control has legal requirements that may or may not be satisfied by NAP's current implementation.

Drive as if the system could fail at any moment.