diff --git a/board/main.c b/board/main.c
index 3cbe9ca3..849772fd 100644
--- a/board/main.c
+++ b/board/main.c
@@ -554,6 +554,7 @@ int usb_cb_control_msg(USB_Setup_TypeDef *setup, uint8_t *resp) {
         heartbeat_counter = 0U;
         heartbeat_lost = false;
         heartbeat_disabled = false;
+        heartbeat_engaged = (setup->b.wValue.w == 1U);
         break;
       }
     // **** 0xf4: k-line/l-line 5 baud initialization
@@ -683,6 +684,16 @@ void tick_handler(void) {
 
       }
 
+      // exit controls allowed if unused by openpilot for a few seconds
+      if (controls_allowed && !heartbeat_engaged) {
+        heartbeat_engaged_mismatches += 1U;
+        if (heartbeat_engaged_mismatches >= 3U) {
+          controls_allowed = 0U;
+        }
+      } else {
+        heartbeat_engaged_mismatches = 0U;
+      }
+
       if (!heartbeat_disabled) {
         // if the heartbeat has been gone for a while, go to SILENT safety mode and enter power save
         if (heartbeat_counter >= (check_started() ? HEARTBEAT_IGNITION_CNT_ON : HEARTBEAT_IGNITION_CNT_OFF)) {
diff --git a/board/main_declarations.h b/board/main_declarations.h
index c211e598..1a8be2e9 100644
--- a/board/main_declarations.h
+++ b/board/main_declarations.h
@@ -19,7 +19,9 @@ bool green_led_enabled = false;
 // heartbeat state
 uint32_t heartbeat_counter = 0;
 bool heartbeat_lost = false;
-bool heartbeat_disabled = false; // set over USB
+bool heartbeat_disabled = false;            // set over USB
+bool heartbeat_engaged = false;             // openpilot enabled, passed in heartbeat USB command
+uint32_t heartbeat_engaged_mismatches = 0;  // count of mismatches between heartbeat_engaged and controls_allowed
 
 // siren state
 bool siren_enabled = false;
diff --git a/python/__init__.py b/python/__init__.py
index 269c5fd6..d71cf39f 100644
--- a/python/__init__.py
+++ b/python/__init__.py
@@ -675,8 +675,8 @@ class Panda(object):
     msg += self.kline_ll_recv(msg[-1]+1, bus=bus)
     return msg
 
-  def send_heartbeat(self):
-    self._handle.controlWrite(Panda.REQUEST_OUT, 0xf3, 0, 0, b'')
+  def send_heartbeat(self, engaged=True):
+    self._handle.controlWrite(Panda.REQUEST_OUT, 0xf3, engaged, 0, b'')
 
   # disable heartbeat checks for use outside of openpilot
   # sending a heartbeat will reenable the checks