There's openpilot code, and then there's panda code that runs on a separate real time micro chip. All the safety relavent code runs on the panda, and it's written in C following misra c guidelines. They also comply with iso 26262.

See more info about their safety model in the safety architecture section of this blog post.

https://comma-ai.medium.com/how-to-write-a-car-port-for-open...