Time Sync Over Ethernet (EthTSyn)

This function initializes the Time Synchronization over Ethernet.

Returns the version information of this module.

This API is used to turn on and off the TX capabilities of the EthTSyn.

By this API service the EthTSyn gets an indication and the data of a received frame.

Confirms the transmission of an Ethernet frame

Allows resetting state machine in case of unexpected Link loss to avoid inconsistent Sync and Follow_Up sequences

Main function for cyclic call / resp. Sync, Follow_Up and Pdelay_Req transmissions

This API is used to set FollowUp information TLV parameters of a Follow_Up message prior transmission. The API is called within StbM_SetBusProtocolParam which provides the content of the structure protocolParam.

This API is used to read FollowUp information TLV parameters from received Follow_Up message.

This API is used to set Follow Up information TLV parameters of a Follow_ Up message prior transmission. The API is called within Stb M_ Set Bus Protocol Param which provides the content of the structure p rotocol Param.

This API is used to read Follow Up information TLV parameters from received Follow_ Up message.

This is the base type for the configuration of the Global Time Synchronization over Ethernet. A pointer to an instance of this structure will be used in the initialization of the Global Time Synchronization over Ethernet. The content of this structure is defined in chapter 10 Configuration specification.

Handles the enabling and disabling of the transmission mode

The EthTSyn module shall use for latency calculation  either static Pdelay values ( EthTSynGlobalTimePropagationDelay ( ECUC_EthTSyn_00070 : ) )  or runtime - based values calculated by Pdelay_Req , Pdelay_Resp , Pdelay_Resp_Follow_Up according to Figure 3 , depending on configuration of EthTSynGlobalTimeTxPdelayReqPeriod ( ECUC_EthTSyn_00071 : ) .

A call to EthTSyn_Init initializes all internal variables and sets the EthTSyn module to the initialized state.

When EthTSyn_Init() is called in initialized state, the EthTSyn module shall re - initialize its inter nal variables.

When EthTSyn_Init() is called in initialized state, the EthTSyn module shall set each por t - specific Pdelay value to 0 .

On invocation of EthTSyn_TxConfirmation with param- eter Result equal to E_OK the egress time stamp shall be retrieved for t1 from the EthIf via EthIf_GetEgressTimeStamp on egress of the Pdelay_Req message, if EthTSynHardwareTimestampSupport is set to TRUE. If the StbM does not use the Ethernet controller as source for the Virtual Local Time (refer to parameter StbMLocalTimeHardware , in [2]), the EthTSyn shall convert the egress time stamp to the Virtual Local Time as used in the StbM.

If EthTSynGlobalTimePdelayRespEnable is set to TRUE, Time Master and Time Slave shall transmit Pdelay_Resp_Follow_Up with the transmission timestamp of that messages as defined in [SWS_EthTSyn_00159] as well as defined in [1, PRS Time Synchronization Protocol] chapter 11.1.2 "Propagation delay measurement" considering debounceCounter which represents a time offset between Pdelay_Resp and Pdelay_Resp_Follow_Up. For that, the following sequence shall be applied: 1. Get a free transmission buffer via EthIf_ProvideTxBuffer 2. Trigger transmit request with the transmission timestamp of [SWS_EthTSyn_00159] via EthIf_Transmit .

If EthTSynHardwareTimestampSupport is set to TRUE and if the StbM does not use the Ethernet hardware counter as Virtual Local Time Source for the Time Base, the following sequence shall be applied on invocation of EthTSyn_TxConfirmation with parameter 'Result' equal to E_OK or in the following EthTSyn_MainFunction call: 1. Protect the following two steps against interruptions: 2. the current time of the Ethernet hardware counter shall be retrieved via EthIf_- GetCurrentTime from the EthIf and converted to the Virtual Local Time T3 V LT . 3. the current value of the Virtual Local Time of the Time Base shall be retrieved as T4 V LT via StbM_GetCurrentVirtualLocalTime 4. the preciseOriginTimestamp shall be calculated as T0 - (T3 V LT - T2 V LT ) + (T4 V LT - T0 V LT )

A transceiver link state change (notification call of EthT- Syn_TrcvLinkStateChg ) from ETHTRCV_LINK_STATE_ACTIVE to ETHTRCV_ LINK_STATE_DOWN resets the state machines for transmission and reception of Time Synchronization messages.

A transceiver link state change (notification call of EthT- Syn_TrcvLinkStateChg ) from ETHTRCV_LINK_STATE_DOWN to ETHTRCV_ LINK_STATE_ACTIVE (re-)starts the transmission and reception of Time Synchroniza- tion messages.

If EthTSyn_SetTransmissionMode is called and the pa- rameter Mode equals ETHTSYN_TX_OFF, all transmit request from EthTSyn shall be omitted on this Ethernet controller.

If EthTSyn_SetTransmissionMode is called and the pa- rameter Mode equals ETHTSYN_TX_ON, all transmit request from EthTSyn on this Ethernet controller shall be able to be transmitted.

On invocation of EthTSyn_RxIndication() or in the following EthTSyn _MainFunction() call, a reference time shall be retrieved on reception of the Follow_Up message via EthIf_GetCurrentTime () f rom the EthIf and con verted to the Virtual Local Time T2 VLT , if EthTSynHardwareTimestampSupport ( ECUC_EthTSyn_00018 : ) is set to TRUE and if the StbM does use the Ethernet hardware counter as Virtual Local Time Source for the Time Base. The Sync reception delay shall be calculated as T2 VLT – T1 VLT .

On errors and exceptions, the EthTSyn module shall not modify its current module state but shall simply report the error event.

Type of error Related error code Error value API service used in un-initialized state ETHTSYN_E_UNINIT 0x20 EthTSyn initialization failed ETHTSYN_E_INIT_FAILED 0x21 API called with invalid controller index ETHTSYN_E_CTRL_IDX 0x22 API called with invalid pointer ETHTSYN_E_PARAM_POINTER 0x23 API called with invalid parameter ETHTSYN_E_PARAM 0x24

Module Header File Imported Type ComStack_Types ComStack_Types.h BufReq_ReturnType Eth_GeneralTypes.h Eth_BufIdxType Eth_GeneralTypes.h Eth_DataType Eth_GeneralTypes.h Eth_FrameType Eth_GeneralTypes.h Eth_TimeStampQualType Eth Eth_GeneralTypes.h Eth_TimeStampType EthSwt Eth_GeneralTypes.h EthSwt_MgmtInfoType EthTrcv Eth_GeneralTypes.h EthTrcv_LinkStateType Rte_StbM_Type.h StbM_EthTimeMasterMeasurementType Rte_StbM_Type.h StbM_EthTimeSlaveMeasurementType Rte_StbM_Type.h StbM_PdelayInitiatorMeasurementType Rte_StbM_Type.h StbM_PdelayResponderMeasurementType Rte_StbM_Type.h StbM_PortIdType Rte_StbM_Type.h StbM_ProtocolParamType Rte_StbM_Type.h StbM_SynchronizedTimeBaseType Rte_StbM_Type.h StbM_TimeBaseStatusType StbM Rte_StbM_Type.h StbM_TimeStampShortType Module Header File Imported Type Rte_StbM_Type.h StbM_TimeStampType Rte_StbM_Type.h StbM_TimeSyncType Rte_StbM_Type.h StbM_UserDataType StbM.h StbM_MeasurementType StbM.h StbM_VirtualLocalTimeType Std_Types.h Std_ReturnType Std Std_Types.h Std_VersionInfoType

The callback function EthTSyn_RxIndication() shall inform the DET, if development error detection is enabled (EthTSynDevErrorDetect (ECUC_ EthTSyn_00002 : ) is set to TRUE) and if the function call has failed because of the following reasons: • CtrlIdx is invalid (ETHTSYN_E_CTRL_IDX) • DataPtr or PhysAddrPtr is invalid (ETHTSYN_E_PARAM_POINTER)

The frequency of invocations of EthTSyn_MainFunction() is determined by the configuration parameter EthTSynMainFunctionPeriod (ECUC_Eth TSyn_00012 : ).

Crc_CalculateCRC8H2F Crc.h This service makes a CRC8 calculation with the Polynomial 0x2F on Crc_Length Det_ReportError Det.h Service to report development errors. Det_ReportRuntimeError Det.h Service to report runtime errors. If a callout has been configured then this callout shall be called. EthIf_EnableEgressTimeStamp EthIf.h Activates egress time stamping on a dedicated message object. Some HW does store once the egress time stamp marker and some HW needs it always before transmission. There will be no "disable" functionality, due to the fact, that the message type is always "time stamped" by network design. EthIf_GetCurrentTime EthIf.h Returns a time value out of the HW registers according to the capability of the HW. Is the HW resolution is lower than the Eth_TimeStampType resolution resp. range, the remaining bits will be filled with 0. Important Note: EthIf_GetCurrentTime may be called within an exclusive area. API Function Header File Description EthIf_GetEgressTimeStamp EthIf.h Reads back the egress time stamp on a dedicated message object. It must be called within the Tx Confirmation() function. EthIf_GetIngressTimeStamp EthIf.h Reads back the ingress time stamp on a dedicated message object. It must be called within the Rx Indication() function. EthIf_ProvideTxBuffer EthIf.h Provides access to a transmit buffer of the specified Ethernet controller. EthIf_SetSwitchMgmtInfo EthIf.h Provides additional management information along to an Ethernet frame that requires special treatment within the Switch. It has to be called between EthIf_ ProvideTxBuffer() and EthIf_Transmit() of the related frame. EthIf_SwitchEnableTimeStamping EthIf.h Activates egress time stamping on a dedicated message object, addressed by CtrlIdx and BufIdx. EthIf_Transmit EthIf.h Triggers transmission of a previously filled transmit buffer StbM_BusGetCurrentTime StbM.h Returns the current Time Tuple, status and User Data of the Time Base. StbM_BusSetGlobalTime StbM.h Allows the Time Base Provider Modules to forward a new Global Time tuple (i.e., Rx Time Tuple) to the StbM. StbM_EthSetMasterTimingData (draft) StbM_EthTSyn.h Provides Ethernet Timesyn module specific data for a Time Master to the StbM. Tags: atp.Status=draft StbM_EthSetPdelayInitiatorData (draft) StbM_EthTSyn.h – Tags: atp.Status=draft StbM_EthSetPdelayResponderData (draft) StbM_EthTSyn.h – Tags: atp.Status=draft StbM_EthSetSlaveTimingData (draft) StbM_EthTSyn.h Allows the EthTSyn Module to forward Ethernet specific details to the StbM. Tags: atp.Status=draft StbM_GetCurrentTime StbM.h Returns a time value (Local Time Base derived from Global Time Base) in standard format. Note: This API shall be called with locked interrupts / within an Exclusive Area to prevent interruption (i.e., the risk that the time stamp is outdated on return of the function call). StbM_GetCurrentVirtualLocalTime StbM.h Returns the Virtual Local Time of the referenced Time Base. StbM_GetOffset StbM.h Allows the Timesync Modules to get the current Offset Time and User Data. StbM_GetTimeBaseStatus StbM.h Returns detailed status information for a Synchronized (or Pure Local) Time Base and, if called for an Offset Time Base, for the Offset Time Base and the underlying Synchronized Time Base. StbM_GetTimeBaseUpdateCounter StbM.h Allows the Timesync Modules to detect, whether a Time Base should be transmitted immediately in the subsequent <Bus>TSyn_MainFunction() cycle.

On invocation of EthTSyn_RxIndication the ingress time stamp shall be retrieved for t4 from the EthIf via E EthIf_GetIngressTimeS- tamp on ingress of the Pdelay_Resp message, if EthTSynHardwareTimestamp- Support is set to TRUE. If the StbM does not use the Ethernet controller as source for the Virtual Local Time (refer to parameter StbMLocalTimeHardware in [2]), the EthTSyn shall convert the ingress time stamp to the Virtual Local Time as used in the StbM.

The EthTSyn module shall support the configuration for Time Master, Time Slave and Time Gateway.

For a valid Follow_Up message a new Rx Time Tuple [T2;T2 V LT ] shall be calculated and forwarded to the StbM module via StbM_Bus- SetGlobalTime , according to EthTSyn Ingress Time Stamping , where T2 is the sum of: • preciseOriginTimestamp, • correctionField, • Pdelay and • the Sync reception delay T SRD .

The AUTOSAR Sub-TLV: UserData shall be mapped to the StbM_UserDataType , whereas the User Byte number given in the message and by the StbM_UserDataType shall match ( UserByte_0 mapped to StbM_User- DataType . userByte0 etc.). The UserDataLength shall be mapped to StbM_UserDataType . StbM_User- DataLength and vice versa.

If a Offset Time Domain on Ethernet references a Synchro- nized Time Domain on Ethernet (refer to parameter StbMOffsetTimeBase in the StbM), the corresponding AUTOSAR TLV Sub-TLV: OFS shall be mapped to the Fol- low_Up Message of that Synchronized Time Domain.

The User Data of the AUTOSAR Sub-TLV: OFS shall be mapped to the StbM_UserDataType , whereas the byte number given in the message and by the StbM_UserDataType shall match ( UserByte_0 mapped to StbM_User- DataType . userByte0 etc.). The UserDataLength shall be mapped to StbM_UserDataType . StbM_User- DataLength and vice versa.

The function Crc_CalculateCRC8H2F as defined in [7] shall be used to calculate the CRC if configured.

For each transmission of a Time Synchronization message, the EthTSyn module shall assemble the message as follows: • If Sync: Calculate Message Header • If Follow_Up: Calculate Follow_Up.preciseOriginTimestamp and Message Header inclusive correctionField • If Follow_Up: Calculate IEEE TLV • If Follow_Up: Calculate AUTOSAR TLV (configuration dependent) – Calculate CRC (configuration dependent) • Copy all data to the appropriate position within the related message

The function Crc_CalculateCRC8H2F as defined in [7] shall be used to calculate the CRC if configured.

On invocation of EthTSyn_TxConfirmation with parame- ter Result equal to E_OK the egress timestamp shall be retrieved for t3 from the StbM via StbM_GetCurrentVirtualLocalTime on egress of Pdelay_Resp message, if EthTSynHardwareTimestampSupport is set to FALSE.

On invocation of EthTSyn_TxConfirmation with parame- ter Result equal to E_OK the egress time stamp shall be retrieved for t1 from the StbM via StbM_GetCurrentVirtualLocalTime on egress of the Pdelay_Req message, if EthTSynHardwareTimestampSupport is set to FALSE.

On invocation of EthTSyn_RxIndication the ingress timestamp shall be retrieved for t2 from the StbM via StbM_GetCurrentVirtual- LocalTime on ingress of Pdelay_Req message, if EthTSynHardwareTimestamp- Support is set to FALSE.

On invocation of EthTSyn_TxConfirmation with param- eter 'Result' equal to E_OK the egress time stamp of the Sync message shall be re- trieved via EthIf_GetEgressTimeStamp from the EthIf and converted to the Vir- tual Local Time T2 V LT according to EthTSyn_Egress_Time_Stamping, if EthTSyn- HardwareTimestampSupport is set to TRUE .

On invocation of EthTSyn_RxIndication the ingress time stamp shall be retrieved for the Sync message via EthIf_GetIngressTimeS- tamp from the EthIf and converted to the Virtual Local Time T1 V LT according to EthTSyn Ingress Time Stamping , if EthTSynHardwareTimestampSupport is set to TRUE .

When providing a new Global Time tuple to the StbM via StbM_BusSetGlobalTime , EthTSyn shall set the SYNC_TO_GATEWAY bit in time BaseStatus (structure member, which is referenced by the parameter timeStampPtr), according to the SGW value (refer to [PRS_TS_00156]). The remaining status bits shall be set to 0.

If EthTSynGlobalTimeDebounceTime is set to 0, Eth TSyn shall ignore any debouncing.

If EthTSynGlobalTimeDebounceTime is greater than 0, EthTSyn shall always consider debouncing for all Timesync PDUs (Sync, Follow_Up, Pdelay_Req, Pdelay_Resp and Pdelay_Resp_Follow_Up) as described below.

If EthTSynGlobalTimeDebounceTime is greater than 0, EthTSyn shall always consider debouncing for all Timesync PDUs (Sync, Follow_Up, Pdelay_Req, Pdelay_Resp and Pdelay_Resp_Follow_Up) as described below.

A new Timesync PDU shall only be sent, if the correspond- ing debounceCounter has reached 0.

If EthTSynImmediateTimeSync is set to TRUE , EthT- Syn shall check within each EthTSyn_MainFunction call by calling StbM_Get- TimeBaseUpdateCounter if the returned timeBaseUpdateCounter has been changed.

If • EthTSynImmediateTimeSync is set to TRUE • and the timeBaseUpdateCounter [timeBaseId] for the updated Time Base resp. timeBaseId has been changed • and the GLOBAL_TIME_BASE bit within the timeBaseStatus, which is read from StbM, is set, EthTSyn shall trigger an immediate transmission of Time Synchronization messages belonging to this Time Base.

If EthTSynImmediateTimeSync is set to TRUE , EthT- SynCyclicMsgResumeTime shall be considered.

EthTSynCyclicMsgResumeTime represents the timeout value of a cyclicMsgResumeCounter that shall be started when a Sync has been sent immediately, asynchronous to the cyclic transmission. The cyclicMsgResume- Counter shall be decremented on each invocation of EthTSyn_MainFunction if no Timesync PDU is transmitted asynchronously.

On invocation of EthTSyn_RxIndication for the Sync message and if EthTSynHardwareTimestampSupport is set to TRUE and if the StbM does use the Ethernet hardware counter as Virtual Local Time Source for the Time Base: • The T2 V LT part of the Rx Time Tuple shall be set to the value of T1 V LT (i.e., T2 V LT = T1 V LT ) • The Sync reception delay T SRD shall be set to 0

If the cyclicMsgResumeCounter has reached a value equal or less than 0, EthTSyn shall resume cyclic Timesync message transmission by sending a Sync.

Type of error Related error code Error value Time Master conflict ETHTSYN_E_TMCONFLICT 0x01 Time Slave conflict ETHTSYN_E_TSCONFLICT 0x02

If EthTSynMasterSlaveConflictDetection is set to TRUE and if the Time Master receives a Sync message from another Time Mas- ter, it shall report a runtime error by calling Det_ReportRuntimeError with error code ETHTSYN_E_TMCONFLICT and discard the received Sync message.

If EthTSynMasterSlaveConflictDetection is set to TRUE and if the Time Slave receives a Sync frame with different sourcePortIdentity (i.e., different MAC addresses), it shall report a runtime error by calling Det_Re- portRuntimeError with error code ETHTSYN_E_TSCONFLICT and discard the re- ceived Sync frame.

If the parameter EthTSynFramePrio exists, the EthT- SynGlobalTimeEthIfRef shall refer to a Virtual Ethernet Controller representing a VLAN.

On an invocation of StbM_BusSetGlobalTime the current Pdelay value shall be passed by the parameter measureDataPtr->PathDelay.

If userByte0 is set to 0 the complete AUTOSAR Sub-TLV: UserData shall be excluded from the message.

On invocation of EthTSyn_TxConfirmation with param- eter Result equal to E_OK the egress timestamp shall be retrieved for t3 from the Eth If via EthIf_EnableEgressTimeStamp on egress of the Pdelay_Resp message, if EthTSynHardwareTimestampSupport is set to TRUE. If the StbM does not use the Ethernet controller as source for the Virtual Local Time (refer to parameter StbMLocalTimeHardware , in [2]), the EthTSyn shall convert the egress time stamp to the Virtual Local Time as used in the StbM.

On invocation of EthTSyn_RxIndication the ingress timestamp t2 shall be retrieved from the EthIf via EthIf_GetIngressTimeStamp on ingress of the Pdelay_Req message, if EthTSynHardwareTimestampSupport is set to TRUE. If the StbM does not use the Ethernet controller as source for the Virtual Local Time (refer to parameter StbMLocalTimeHardware in [2]), the EthTSyn shall convert the ingress time stamp to the Virtual Local Time as used in the StbM.

On invocation of EthTSyn_RxIndication the ingress time stamp shall be retrieved for t4 on ingress of the Pdelay_Resp message from the StbM via StbM_GetCurrentVirtualLocalTime , if EthTSynHardwareTimes- tampSupport is set to FALSE.

Time Slave and Time Master shall use the EthTSyn- FramePrio value as priority parameter when calling EthIf_ProvideTxBuffer .

The function EthTSyn_SetTransmissionMode() shall inform the DET, if development error detection is enabled (EthTSynDevErrorDetect (ECUC_ EthTSyn_00002 : ) is set to TRUE) and if function call has failed because of the following reasons: • CtrlIdx is invalid (ETHTSYN_E_CTRL_IDX) • Mode is invalid (ETHTSYN_E_PARAM)

The function EthTSyn_TrcvLinkStateChg() shall inform the DET, if development error detection is enabled (EthTSynDevErrorDetect (ECUC_Eth TSyn_00002 : ) is set to TRUE) and if function call has failed because of the following reasons: • CtrlIdx is invalid (ETHTSYN_E_CTRL_IDX)

The function EthTSyn_TxConfirmation() shall inform the DET, if development error detection is enabled (EthTSynDevErrorDetect (ECUC_Eth TSyn_00002 : ) is set to TRUE) and if function call has failed because of the following reasons: • CtrlIdx is invalid (ETHTSYN_E_CTRL_IDX)

On invocation of EthTSyn_TxConfirmation() with parameter 'Result' equal to E_NOT_OK the process of collection of synchronized time distribution shall be aborted and all intermediate result variables shall be reset to default value.

On invocation of EthTSyn_RxIndication() or in the following EthTSyn _MainFunction() call, the reference time T2 VLT shall be retrieved on reception of the Follow_Up message via StbM _GetCurrent VirtualLocal Time () f rom the StbM, if EthTSynHardwareTimestampSupport ( ECUC_EthTSyn_00018 : ) is set to FALSE . The Sync reception delay shall be calculated as T2 VLT – T1 VLT .

On invocation of EthTSyn_RxIndication and if EthT- SynHardwareTimestampSupport is set to FALSE the following sequence shall be applied: • Immediately establish a protection against interruptions and run the next step directly afterwards: • Retrieve the reference time T1 V LT for the Sync message via StbM_GetCur- rentVirtualLocalTime from the StbM • The protection against interruptions may be removed now. The T2 V LT part of the Rx Time Tuple shall be set to the value of T1 V LT (i.e., T2 V LT = T1 V LT ). The Sync reception delay T SRD shall be set to 0.

Each port of a EthTSynGlobalTimeDomain shall have its own debounceCounter .

If EthTSynHardwareTimestampSupport is set to TRUE and if the StbM does use the Ethernet hardware counter as Virtual Local Time Source for the Time Base, the preciseOriginTimestamp shall be calculated as T0 + (T2 V LT - T0 V LT ) .

If EthTSynHardwareTimestampSupport is set to FALSE the preciseOriginTimestamp shall be calculated as T0 + (T4 V LT - T0 V LT ) .

On invocation of EthTSyn_RxIndication , a reference time shall be retrieved on reception of the Sync message if EthTSynHardware- TimestampSupport is set to TRUE and if the StbM does not use the Ethernet hard- ware counter as Virtual Local Time Source for the Time Base by applying the following sequence: • Protect the following two steps against interruptions: • the current time of the Ethernet hardware counter shall be retrieved via EthIf_- GetCurrentTime from the EthIf and converted to the Virtual Local Time T3 V LT • the current value of the Virtual Local Time of the Time Base shall be retrieved as T2 V LT via StbM_GetCurrentVirtualLocalTime • the Sync reception delay T SRD shall be calculated as T3 V LT - T1 V LT

The Time Slave shall forward the new Offset Time to the StbM via StbM_BusSetGlobalTime (as calculated according to [PRS_TS_00110]), if successfully validated.

The Time Master shall get the Offset Time Base value from the StbM via StbM_GetOffset .

If Master and Time Slave transmit Pdelay_Req for latency calculation with the cycle (refer to PRS_TS_00011 in [1, PRS Time Synchronization Protocol]), the following sequence shall be applied: 1. Get a free transmission buffer via EthIf_ProvideTxBuffer 2. Activate the time stamping via EthIf_EnableEgressTimeStamp if EthTSyn- HardwareTimestampSupport is set to TRUE 3. Trigger transmit request via EthIf_Transmit .

If Time Master and Time Slave transmit Pdelay_Resp for la- tency calculation (refer to PRS_TS_00012 in [1, PRS Time Synchronization Protocol]) the following sequence shall be applied: 1. Get a free transmission buffer via EthIf_ProvideTxBuffer 2. Activate the time stamping via EthIf_EnableEgressTimeStamp if EthTSyn- HardwareTimestampSupport is set to TRUE 3. Trigger transmit request via EthIf_Transmit

If the Time Master transmits a Sync message (refer to [PRS_ TS_00016] in [1]), the following sequence shall be applied: • The Global Time Tuple [T0;T0 V LT ] shall be retrieved from the StbM via StbM_- BusGetCurrentTime according to EthTSyn Egress Time Stamping . • Get a free transmission buffer via EthIf_Provide_TxBuffer • Activate the time stamping via EthIf_EnableEgressTimeStamp if EthTSyn- HardwareTimestampSupport is set to TRUE • Trigger transmit request via EthIf_Transmit

If the Time Master transmits a Follow_Up message (refer to [PRS_TS_00018] in [1]), the following sequence shall be applied: • Get a free transmission buffer via EthIf_Provide_TxBuffer • Trigger transmit request with the transmission timestamp of [SWS_ EthT- Syn _00017] via EthIf_Transmit

The Time Master shall consider the debounceCounter , which represents a time offset between Sync and Follow_Up message, before trans- mitting the Follow_Up message.

EthTSyn shall discard a timestamp derived from the Ether- net Controller HW (e.g., via EthIf_GetCurrentTime , EthIf_GetIngressTimeS- tamp or EthIf_GetEgressTimeStamp ), if the quality of the timestamp (refer to Eth_TimeStampQualType ) is indicated as ETH_INVALID or ETH_UNCERTAIN .

The Time Master shall start cyclic transmission of Sync mes- sages in the earliest possible EthTSyn_MainFunction call once the protocol require- ment [PRS_TS_00016] is fulfilled.

The EthTSyn shall support Time Validation, if EthTSyn- TimeValidationSupport set to TRUE .

If • EthTSynTimeValidationSupport is enabled and • EthTSynEnableTimeValidation for the Time Domain is enabled, EthTSyn shall do time recording for Time Validation for that Time Domain

If time recording for Time Validation is enabled for a Mas- ter Port Domain of a Time Domain (refer to [SWS_EthTSyn_00212] and [SWS_Eth TSyn_00213]) the EthTSyn shall call StbM_EthSetMasterTimingData upon successful transmis- sion of a Sync message (refer to EthTSyn TimesyncSequence )

Upon invocation of StbM_EthSetMasterTimingData (re- fer to [SWS_EthTSyn_00214]) the EthTSyn shall pass the following parameters • the sequenceId of the sent Sync message, • the sourcePortIdentity as sent in the Sync message and • the Virtual Local Time T2 V LT sampled on egress of the Sync message (refer to [SWS_EthTSyn_00127]), • the preciseOriginTimestamp as copied to the Follow_Up message and (refer to [SWS_EthTSyn_00188]) • the correctionField as copied to the Follow_Up message by the parameter measureDataPtr .

If • time recording for Time Validation is enabled for a Time Domain (refer to [SWS_ EthTSyn_00212] and [SWS_EthTSyn_00213]) and • EthTSyn is configured as Time Slave for that Time Domain EthTSyn shall call StbM_EthSetSlaveTimingData upon successful reception of a FollowUp message (refer to EthTSyn TimesyncSequence ) StbM_EthSetSlaveTimingData shall be called after StbM_BusSetGlobalTime .

Upon invocation of StbM_EthSetSlaveTimingData EthTSyn shall pass following values • the sequenceId received in the Follow_Up message, • the sourcePortIdentity received in the Follow_Up message and • the Virtual Local Time T1 V LT sampled on ingress of the Sync message (refer to [SWS_EthTSyn_00128]), • the preciseOriginTimestamp received in the Follow_Up message • the correctionField received in the Follow_Up message and • the current value of the Pdelay to the function by the parameter measureDataPtr . The struct members • measureDataPtr -> referenceLocalTimestamp and • measureDataPtr -> referenceGlobalTimestamp shall be passed as 0.

If • time recording for Time Validation is enabled for a Time Domain (refer to [SWS_ EthTSyn_00212] and [SWS_EthTSyn_00213]) and • EthTSyn is configured as Time Master for that Time Domain EthTSyn shall call StbM_BusGetCurrentTime to retrieve a Time Tuple [ T ref P DResponder ; T V LT _ ref P DResponder ] before sending the Pdelay_Resp message (refer to EthTSyn PdelaySequence ).

If • time recording for Time Validation is enabled for the Time Domain (refer to [SWS_ EthTSyn_00212] and [SWS_EthTSyn_00213]) and • EthTSyn is configured as Time Master for that Time Domain EthTSyn shall call StbM_EthSetPdelayResponderData after the current Pdelay measurement is finished, i.e., upon transmission of the Pdelay_Resp_Follow_Up message (refer to EthTSyn PdelaySequence ).

The Time Master shall pass the following parameters • the sequenceId of the received Pdelay_Req message and • the sourcePortIdentity of the received Pdelay_Req message, • the sourcePortIdentity of the sent Pdelay_Resp message • t2 (refer to [SWS_EthTSyn_00160], [SWS_EthTSyn_00124]) • t3 (refer to [SWS_EthTSyn_00159], [SWS_EthTSyn_00122]) and • the sampled reference Time Tuple [ T ref P DResponder ; T V LT _ ref P DResponder ] (refer to [SWS_EthTSyn_00218]) to StbM_EthSetPdelayResponderData upon invocation by the parameter measure DataPtr.

If • time recording for Time Validation is enabled for the Time Domain (refer to [SWS_ EthTSyn_00212] and [SWS_EthTSyn_00213]) and • EthTSyn is configured as Time Slave for that Time Domain EthTSyn shall call StbM_EthSetPdelayInitiatorData after the current Pdelay measurement is finished, i.e., upon reception of the Pdelay_Resp_Follow_Up mes- sage (refer to EthTSyn PdelaySequence ).

The Time Slave shall pass the following parameters • the sequenceId of the sent Pdelay_Req message, • the sourcePortIdentity of the sent Pdelay_Req message, • the sourcePortIdentity of the received Pdelay_Resp message • t1 (refer to [SWS_EthTSyn_00013]), t4 (refer to [SWS_EthTSyn_00049] ), • the requestReceiptTimestamp from the Pdelay_Resp message, • the responseOriginTimestamp from the Pdelay_Resp_Follow_Up mes- sage, • the sampled reference Time Tuple [ T ref P DInitiator ; T V LT _ ref P DInitiator ] (refer [SWS_EthTSyn_00223]) to StbM_EthSetPdelayInitiatorData upon invocation by the parameter mea- sureDataPtr .

If time recording for Time Validation is enabled for the Time Domain (refer to [SWS_EthTSyn_00212] and [SWS_EthTSyn_00213]), the Time Slave shall call StbM_BusGetCurrentTime to retrieve a Time Tuple [ T ref P DInitiator ; T V LT _ ref P DInitiator ] before sending the pDelay_Req message (refer to EthTSyn PdelaySequence ).

The Time Master shall set requestReceiptTimestamp (to be used in the Pdelay_Resp message) to t2.

The Time Master shall set responseOriginTimestamp (for the Pdelay_Resp_Follow_Up message) to t3.

The following parameters provided by the invocation of EthTSyn_SetProtocolParam in argument protocolParam, shall be used by EthT- Syn for the next Follow_Up information TLV message: • cumulativeScaledRateOffset • gmTimeBaseIndicator • lastGmPhaseChange • scaledLastGmFreqChange

On invocation of EthTSyn_GetProtocolParam EthTSyn shall return the following values received in the latest Follow_Up information TLV via argument protocolParam: • cumulativeScaledRateOffset • gmTimeBaseIndicator • lastGmPhaseChange • scaledLastGmFreqChange Member protocolType of argument protocolParam shall be set to STBM_TIMESYNC_ ETHERNET

The function EthTSyn_SetProtocolParam() shall inform the DET, if development error detection is enabled (EthTSynDevErrorDetect (ECUC_Eth TSyn_00002 : ) is set to TRUE) and if function call has failed because of the following reasons: • timeBaseId does not belong to a Time Base, which is mapped to a Time Domain with ID 0 ..15 in EthTSyn (Development Error: ETHTSYN_E_PARAM) • protocolParam is NULL (Development Error: ETHTSYN_E_PARAM_POINTER)

The function EthTSyn_GetProtocolParam() shall inform the DET, if development error detection is enabled (EthTSynDevErrorDetect (ECUC_Eth TSyn_00002 : ) is set to TRUE) and if function call has failed because of the following reasons: • timeBaseId does not belong to a Time Base, which is mapped to a Time Domain with ID 0 ..15 in EthTSyn (Development Error: ETHTSYN_E_PARAM) • protocolParam is NULL (Development Error: ETHTSYN_E_PARAM_POINTER)

[SWS_EthTSyn_00233] Upstream requirements: RS_TS_20072 ⌈When the FV is referenced (refer EthTSynIcvVerificationFvIdRef), FVL is greater than 0 and ’ICV with FV’ bit is set in ICV_Flags of received Follow_Up mes- sage, the Time Slave shall call the StbM_GetRxFreshness Api in order to obtain the Freshness Value by using • the StbMFreshnessValueId from the reference EthTSynIcvVerifica- tionFvIdRef • the StbMTruncatedFreshnessValue as received in the FV field of the Fol- low_Up message • the StbMTruncatedFreshnessValueLength as received in the FVL field of the Follow_Up message • the StbMAuthVerifyAttempts as the number of failed verification attempt counts for the current message (ICV verification attempt counter) • the StbMFreshnessValueLength from the reference EthTSynIcvVerifi- cationFvIdRef ⌋

[SWS_EthTSyn_00234] Upstream requirements: RS_TS_20072 ⌈If StbM_GetRxFreshness returns E_OK, the Time Slave shall use the FV in ICV verification.⌋

[SWS_EthTSyn_00236] Upstream requirements: RS_TS_20072 ⌈If • StbM_GetRxFreshness returns non-recoverable error code (e.g., E_NOT_OK) Ethernet • or FVL == 0 and ICV with FV bit is set in ICV_Flags of received Follow_Up mes- sage, the ICV verification of received Follow_Up message is considered to be failed, and the Time Slave shall : • stop the ICV verification (refer to chapter "ICV Verification". see link in note below) and discard the received Follow_Up message, • call Det_ReportRuntimeError with the parameter ErrorId := ETHT- SYN_E_FRESHNESSFAILURE (refer [SWS_EthTSyn_00144]), • report the security event SEV_TSYN_ETH_FRESHNESS_NOT_AVAILABLE to the IdsM (refer to [SWS_EthTSyn_00261]). ⌋ Refer to the chapter in [11] for the configuration details of CSM job used for ICV verifi- cation.

[SWS_EthTSyn_00237] Upstream requirements: RS_TS_20072 ⌈If EthTSynIcvVerificationBase for the Time Domain is configured to ICV_MAC, the Time Slave shall call Csm_MacVerify to verify the ICV value.⌋

[SWS_EthTSyn_00238] Upstream requirements: RS_TS_20072 ⌈If EthTSynIcvVerificationBase for the Time Domain is configured to ICV_SIGNATURE, the Time Slave shall call Csm_SignatureVerify to verify the ICV value.⌋ Note: 7.8.2.4 Note: The mode parameter is intentionally left open for the implementer to choose ( i.e. CRYPTO_OPERATIONMODE_SINGLECALL would possibly be the best option since it does not require further calls to Csm). The CSM job used to generate the ICV can be configured to synchronous or asyn- chronous behaviour.

[SWS_EthTSyn_00239] Upstream requirements: RS_TS_20072 ⌈The ICV verification timeout observation is disabled, when the CSM job to verify ICV is configured in synchronous behaviour. In this case, the EthTSynIcvVerifica- tionTimeout shall be set to 0.⌋ Ethernet

[SWS_EthTSyn_00240] Upstream requirements: RS_TS_20072 ⌈If Csm_MacVerify or Csm_SignatureVerify returns E_OK, the Time Slave shall start the EthTSynIcvVerificationTimeout.⌋

[SWS_EthTSyn_00241] Upstream requirements: RS_TS_20072 ⌈If Csm_MacVerify or Csm_SignatureVerify returns recoverable error code (e.g., CRYPTO_E_BUSY, CRYPTO_QUEUE_FULL), the current verification of received Fol- low_Up message is considered to be failed , and the Time Slave shall increment the authentication build counter for this Follow_Up message.⌋

[SWS_EthTSyn_00242] Upstream requirements: RS_TS_20072 ⌈The EthTSynIcvVerificationTimeout shall be stopped with the notification of the EthTSyn_IcvVerificationIndication callback.⌋

[SWS_EthTSyn_00243] Upstream requirements: RS_TS_20072 ⌈If one of the following conditions is true: • the authentication build counter has reached the configuration value EthTSyn- RxAuthenticationBuildAttempts, • the ICV verification attempt counter has reached the configuration value EthT- SynIcvVerificationAttempts, • the verification of the ICV has returned a non-recoverable error such as returning E_NOT_OK or KEY_FAILURE, • EthTSynIcvVerificationTimeout expires before the notification of the EthT- Syn_IcvVerificationIndication callback, the time slave shall: • stop the ICV verification (refer to chapter ICV Verification, see link in note below) and discard the received Follow_Up message, • report the security event SEV_TSYN_ETH_ICV_VERIFICATION_FAILED to the IdsM (refer to [SWS_EthTSyn_00261]). ⌋ Note: 7.8.2.4 Ethernet

[SWS_EthTSyn_00244] Upstream requirements: RS_TS_20072 ⌈When the EthTSyn_IcvVerificationIndication callback is called and ICV verification result is successful, the Time Slave shall accept the Follow_Up message and call StbM_BusSetGlobalTime to forward the global time to StbM.⌋

[SWS_EthTSyn_00246] Upstream requirements: RS_TS_20072 ⌈When the FV is referenced (refer EthTSynIcvGenerationFvIdRef, see link in note below) and the configured truncated FV length (StbMFreshnessValueTrun- cLength) is equal to FV length (StbMFreshnessValueLength) in StbM, the Time Master shall call the StbM_GetTxFreshness Api in order to obtain the full FV by using the StbMFreshnessValueId.⌋

[SWS_EthTSyn_00247] Upstream requirements: RS_TS_20072 ⌈When the FV is referenced (refer EthTSynIcvGenerationFvIdRef) and the con- figured truncated FV length (StbMFreshnessValueTruncLength) is less than FV length (StbMFreshnessValueLength) in StbM, the Time Master shall call the StbM_GetTxFreshnessTruncData Api in order to obtain the full FV and the trun- cated FV by using the StbMFreshnessValueId.⌋

[SWS_EthTSyn_00248] Upstream requirements: RS_TS_20072 ⌈If StbM_GetTxFreshness returns E_OK, the Time Master shall construct of the AUTOSAR Sub-TLV: Time Authenticated with FV and use the full FV in ICV gen- eration.⌋

[SWS_EthTSyn_00249] Upstream requirements: RS_TS_20072 ⌈If StbM_GetTxFreshnessTruncData returns E_OK, the Time Master shall con- struct of the AUTOSAR Sub-TLV: Time Authenticated with truncated FV and use the full FV in ICV generation.⌋

[SWS_EthTSyn_00250] Upstream requirements: RS_TS_20072 ⌈If StbM_GetTxFreshness or StbM_GetTxFreshnessTruncData returns non- recoverable error code i.e, E_NOT_OK, the Time Master shall: Ethernet • stop the ICV generation (refer to chapter "ICV Generation", see link in note below) and accordingly set the ICV_Flags in AUTOSAR Sub-TLV: Time Authen- ticated of Follow_Up message, • call Det_ReportRuntimeError with the parameter ErrorId := ETHT- SYN_E_FRESHNESSFAILURE (refer [SWS_EthTSyn_00144]), • report the security event SEV_TSYN_ETH_FRESHNESS_NOT_AVAILABLE to the IdsM (refer [SWS_EthTSyn_00261]). ⌋ Note: Refer to chapter ICV Generation 7.7.3.4 Note: Refer to the chapter in [11] for the configuration details of CSM job used for ICV generation.

[SWS_EthTSyn_00251] Upstream requirements: RS_TS_20072 ⌈If EthTSynIcvGenerationBase for the Time Domain is configured to ICV_MAC, the Time Master shall call Csm_MacGenerate to generate the ICV value.⌋

[SWS_EthTSyn_00252] Upstream requirements: RS_TS_20072 ⌈If EthTSynIcvGenerationBase for the Time Domain is configured to ICV_SIGNATURE, the Time Master shall call Csm_SignatureGenerate to generate the ICV value.⌋ Note: The mode parameter is intentionally left open for the implementer to choose ( i.e. CRYPTO_OPERATIONMODE_SINGLECALL would possibly be the best option since it does not require further calls to Csm). The CSM job used to generate the ICV can be configured to synchronous or asyn- chronous behaviour.

[SWS_EthTSyn_00253] Upstream requirements: RS_TS_20072 ⌈If the CSM job used to generate ICV is configured in synchronous behaviour, the Time Master shall disable ICV generation timeout monitoring.⌋

[SWS_EthTSyn_00254] Upstream requirements: RS_TS_20072 ⌈If Csm_MacGenerate or Csm_SignatureGenerate returns E_OK, the Time Master shall start the EthTSynIcvGenerationTimeout.⌋ Ethernet

[SWS_EthTSyn_00255] Upstream requirements: RS_TS_20072 ⌈When the EthTSyn_IcvGenerationIndication callback is called, the Time Master shall stop the running ICV generation timeout timer (EthTSynIcvGenera- tionTimeout).⌋

[SWS_EthTSyn_00256] Upstream requirements: RS_TS_20072 ⌈If one of the following conditions is true: • authentication build counter has reached the configuration value EthTSynTxAu- thenticationBuildAttempts, • the verification of the ICV has returned a non-recoverable error such as returning E_NOT_OK or KEY_FAILURE, • EthTSynIcvGenerationTimeout expires before the notification of the EthT- Syn_IcvGenerationIndication callback, the time master shall: • stop the ICV generation and accordingly set the ICV_Flags in AUTOSAR Sub- TLV: Time Authenticated of Follow_Up message, • report the security event SEV_TSYN_ETH_ICV_GENERATION_FAILED to the IdsM (refer to [SWS_EthTSyn_00261]). ⌋ Note: If ICV generation failed, there is no need to include the FV in the AUTOSAR Sub-TLV: Time Authenticated.

[SWS_EthTSyn_00257] Upstream requirements: RS_TS_20072 ⌈With the notification of the EthTSyn_IcvGenerationIndication callback, the Time Master shall add the generated ICV to AUTOSAR Sub-TLV: Time Authen- ticated and transmit the Follow_Up message.⌋

[SWS_EthTSyn_00258] Upstream requirements: RS_TS_20072 ⌈When a FV is referenced (refer EthTSynIcvGenerationFvIdRef), the Time Mas- ter shall notify the successful transmission of the Follow_Up message to FVM by calling StbM_SPduTxConfirmation.⌋ Ethernet

[SWS_EthTSyn_00259] Upstream requirements: SRS_BSW_00323, SRS_BSW_00337 ⌈The function EthTSyn_IcvGenerationIndication() shall inform the DET, if development error detection is enabled (EthTSynDevErrorDetect is set to TRUE) and if function call has failed because of the following reasons: • jobId is invalid (ETHTSYN_E_PARAM) ⌋ Ethernet

[SWS_EthTSyn_00260] Upstream requirements: SRS_BSW_00323, SRS_BSW_00337 ⌈The function EthTSyn_IcvVerificationIndication() shall inform the DET, if development error detection is enabled (EthTSynDevErrorDetect is set to TRUE) and if function call has failed because of the following reasons: • jobId is invalid (ETHTSYN_E_PARAM) ⌋

[SWS_EthTSyn_00261]). ⌋ Note: Refer to chapter ICV Generation 7.7.3.4 Note: Refer to the chapter in [11] for the configuration details of CSM job used for ICV generation.

[SWS_EthTSyn_00263]{DRAFT} ⌈If • configuration parameter EthTSynRateRatioEnable is set to TRUE • and EthTSynRateRatioMeasurementCount consecutive pDelay measure- ments have been completed successfully, then EthTSyn shall calculate in the next main function call the neighborRateRatio as given in PRS_TS_00259 in [1].⌋(RS_TS_20048)

[SWS_EthTSyn_00264]{DRAFT} ⌈If • configuration parameter EthTSynGlobalTimeTxPdelayReqPeriod is not 0 • and a valid Pdelay_Resp_Follow_Up message has been received, Ethernet then EthTSyn shall calculate the value linkDelay in the next main function call as given in PRS_TS_00003 in [1].⌋(RS_TS_20048)

[SWS_EthTSyn_00265] Status: DRAFT Upstream requirements: RS_TS_20047 ⌈When EthTSynPortRole is set to DYNAMIC or TIME_MASTER, ports (for eth con- troller only 1 port and for switch individual port) shall transmit Sync and Follow_Up message according to the configuration parameter EthTSynGlobalTimeTxPe- riod.⌋ Note: For [SWS_EthTSyn_00265] Immediate Synchronization is not further affected by the port-specific EthTSynGlobalTimeTxPeriod. Refer to chapter Message Processing in [1, PRS Time Synchronization Over Ethernet Protocol] for additional requirements.

[SWS_EthTSyn_00402] Status: DRAFT Upstream requirements: RS_TS_20072 ⌈For every transmission of messages that contain the AUTOSAR Sub-TLV: Time Au- thenticated, EthTSyn shall maintain an authentication build counter (refer EthTSyn- TxAuthenticationBuildAttempts).⌋

[SWS_EthTSyn_00403] Status: DRAFT Upstream requirements: RS_TS_20072 ⌈Upon the initial processing of messages that contain the AUTOSAR Sub-TLV: Time Authenticated, the authentication build counter shall be set to 0.⌋

[SWS_EthTSyn_00404] Status: DRAFT Upstream requirements: RS_TS_20072 ⌈If StbM_GetTxFreshness or StbM_GetTxFreshnessTruncData return recover- able error code (e.g., STBM_E_BUSY), the authentication build counter shall be incre- mented.⌋

[SWS_EthTSyn_00405] Status: DRAFT Upstream requirements: RS_TS_20072 ⌈If Csm_MacGenerate or Csm_SignatureGenerate return recoverable error code (e.g., E_BUSY, QUEUE_FULL), the authentication build counter shall be incremented.⌋

[SWS_EthTSyn_00406] Status: DRAFT Upstream requirements: RS_TS_20072 ⌈If building the authenticated message generation has failed and the authentication build counter has not yet reached the configuration value EthTSynTxAuthentica- tionBuildAttempts, the freshness attempt and ICV calculation shall be retried in the next call of the EthTSyn_MainFunction.⌋

[SWS_EthTSyn_00407] Status: DRAFT Upstream requirements: RS_TS_20072 ⌈For every reception of messages that require ICV verification, EthTSyn shall main- tain an authentication build counter (refer EthTSynRxAuthenticationBuildAt- tempts).⌋

[SWS_EthTSyn_00408] Status: DRAFT Upstream requirements: RS_TS_20072 ⌈Upon the initial processing of messages that require ICV verification, the authentica- tion build counter shall be set to 0.⌋

[SWS_EthTSyn_00409] Status: DRAFT Upstream requirements: RS_TS_20072 ⌈If StbM_GetRxFreshness returns recoverable error code (e.g., STBM_E_BUSY), the authentication build counter shall be incremented and no attempt for verification of the ICV shall be executed.⌋

[SWS_EthTSyn_00410] Status: DRAFT Upstream requirements: RS_TS_20072 ⌈If building the authenticated message verification has failed and the authentication build counter has not yet reached the configuration value EthTSynRxAuthentica- tionBuildAttempts, the freshness attempt and ICV verification shall be retried in the next call of the EthTSyn_MainFunction.⌋

[SWS_EthTSyn_00411] Status: DRAFT Upstream requirements: RS_TS_20072 ⌈If the verification of the ICV could be successfully executed but the verification failed (e.g. the MAC verification has failed or the key was invalid), the ICV verification attempt counter shall be incremented and the authentication build counter shall be set to 0.⌋ Note: Resetting the authentication build counter shall prevent to drop the authentica- tion process too early even though ICV verification attempts are still possible.

The EthTSynPortConfig container exists for Synchronized Time Domains ( EthTSynGlobalTimeDomain 0 .. 15) only.