Comment by adinisom

Soft disengage -- if the GPU fails it continues to drive via on-device model, alerts the user, and then disengages.

More generally, Comma's safety is handled by a microcontroller. The microcontroller limits steering torque commanded to a safe range for level 2 driver assistance and acts as a watchdog for the rest of the stack. Failure of openpilot causes it to disengage and sound an audible alarm.