Obc failsafe

This is a *WIP* PR to track progress in bringing up failsafe behavior according to the OBC rules (and also improving general failsafe behavior)

includes #1205
I think the parameter and the switch for the more complex behaviour should be in the commander. But probably this goes back to the old endless discussion...