Time Sync Over CAN (CanTSyn)

This function initializes the Time Synchronization over CAN.

Returns the version information of this module.

This API is used to turn on and off the TX capabilities of the CanTSyn.

Indication of a received PDU from a lower layer communication interface module.

The lower layer communication interface module confirms the transmission of a PDU, or the failure to transmit a PDU.

Main function for cyclic call / resp. Timesync message transmission

By this API service the CanTSyn gets an indication and the result of ICV generation.

By this API service the CanTSyn gets an indication and the result of ICV verification.

This is the base type for the configuration of the Time Synchronization over CAN. A pointer to an instance of this structure will be used in the initialization of the Time Synchronization over CAN. The content of this structure is defined in chapter 10 Configuration specification.

Handles the enabling and disabling of the transmission mode

A call to CanTSyn_Init initializes all internal variables and sets the Time Synchronization over CAN to the initialized state.

When CanTSyn_Init() is called in ini tialized state, the Time Synchronization over CAN shall re - initialize its internal varia bles.

The Sequence Counter ( SC ) shall be initialized with 0.

The byte order for time value signals in Time Synchroniza- tion messages is "Big Endian".

The DLC of SYNC, FUP, OFS and OFNS messages is 8 for classic CAN. The DLC of SYNC, FUP, OFS and OFNS messages is 16 for CAN FD if CanTSynUse- ExtendedMsgFormat is TRUE .

Depending on its type Time Synchronization messages may contain User Data according to the given message format.

User Data shall be read consistently from incoming Time Synchronization messages that contain User Data Fields.

User Data shall be written consistently to outgoing Time Synchronization messages that contain User Data Fields. If the number of User Data Fields in a Time Synchronization message is greater than the number of User Data Bytes provided by the StbM , the remaining User Data Fields shall be set to 0 (default value).

User Data shall be mapped to the StbM_UserDataType , where the byte number given in the message and by the StbM_UserDataType shall match (User Byte 0 mapped to StbM_UserDataType . userByte0 , etc.). StbM_UserDataType . userDataLength shall be set to the Time Synchronization message type specific number of User Bytes.

0 Type 0x10 1 User Byte 1 default: 0 2 7..4 D 0..15 Time Domain Id 3..0 SC 0..15 Sequence Counter 3 User Byte 0 default: 0 4-7 SyncTimeSec 32 bit LSB of the 48 bits seconds part of the time If CanTSynUseExtendedMsgFormat = TRUE : 8-15 reserved always 0 Table 7.1: SYNC not CRC secured message format

0 Type 0x18 1 User Byte 2 default: 0 2 7..4 D 0..15 Time Domain Id 3..0 SC 0..15 Sequence Counter 3 7..3 reserved default: 0 2 SGW SyncToGTM = 0 SyncToSubDomain = 1 1..0 OVS Overflow of seconds 4-7 SyncTimeNSec 32 Bit time value in nanoseconds If CanTSynUseExtendedMsgFormat = TRUE : 8-15 reserved always 0 Table 7.2: FUP not CRC secured message format

0 Type 0x20 1 CRC 2 7..4 D 0..15 Time Domain Id 3..0 SC 0..15 Sequence Counter 3 User Byte 0 default: 0 4-7 SyncTimeSec 32 bit LSB of the 48 bits seconds part of the time If CanTSynUseExtendedMsgFormat = TRUE : 8-15 reserved always 0 Table 7.3: SYNC CRC secured message format

0 Type 0x28 1 CRC 2 7..4 D 0..15 Time Domain Id 3..0 SC 0..15 Sequence Counter 3 7..3 reserved default: 0 2 SGW SyncToGTM = 0 SyncToSubDomain = 1 1..0 OVS Overflow of seconds 4-7 SyncTimeNSec 32 Bit time value in nanoseconds If CanTSynUseExtendedMsgFormat = TRUE : 8-15 reserved always 0 Table 7.4: FUP CRC secured message format

A Time Master shall start each Time Synchronization se- quence for a Synchronized Time Base with a SYNC message.

A Time Master shall finish each Time Synchronization se- quence for a Synchronized Time Base with a FUP message.

If a transmission of a SYNC or FUP message fails ( CanTSyn_TxConfirmation is called with E_NOT_OK ), CanTSyn shall reset the state machine to start with a new SYNC transmission again once it is due.

If configured as Time Master of a Synchronized Time Do- main (refer to CanTSynGlobalTimeDomain ) the CanTSyn module shall periodically transmit SYNC messages with the cycle CanTSynGlobalTimeTxPeriod if • the GLOBAL_TIME_BASE bit within the timeBaseStatus is set • and CanTSynGlobalTimeTxPeriod is unequal to 0 • and if the associated cyclicMsgResumeCounter is not running. The cyclic transmission shall be started in the earliest possible CanTSyn_MainFunc- tion call once the requirements above are fulfilled.

The SYNC and FUP sequence shall not be interrupted, nei- ther by Time Synchronization messages of the same Time Domain nor by Time Syn- chronization messages of other Time Domains if the same CAN ID is used for the Time Synchronization messages.

The SGW value (Time Gateway synchronization status) shall be retrieved from the Time Base synchronization status. If the SYNC_TO_GATEWAY bit within timeBaseStatus is not set the SGW value shall be SyncToGTM . Otherwise the SGW value shall be set to SyncToSubDomain .

Depending on CanTSynGlobalTimeTxCrcSecured the SYNC / FUP message shall be of type: CanTSynGlobalTimeTxCrcSecured Value SYNC Message Type FUP Message Type CRC_NOT_SUPPORTED 0x10 0x18 SYNC not CRC FUP not CRC secured message secured message CRC_SUPPORTED 0x20 0x28 SYNC CRC FUP CRC secured message secured message Table 7.11

A transmitter of FUP messages (Time Master) is using as trigger condition for SYNC to FUP that the debounceCounter value reaches 0.

Each transmission request of a SYNC message shall be monitored for a transmit confirmation timeout. If CanTSyn_TxConfirmation is not called within 3 sec after transmission request, CanTSyn shall • wait until CanTSyn_TxConfirmation is called (with E_OK or E_NOT_OK ) and • send no FUP message and • instead reset the state machine to start with a new SYNC transmission once it is due.

A Time Master shall start each Time Synchronization se- quence for an Offset Time Base with an OFS message.

If CanTSynUseExtendedMsgFormat is FALSE , a Time Master shall finish each Time Synchronization sequence for an Offset Time Base with an OFNS message.

If the transmission of an OFS or an OFNS message fails (i.e., CanTSyn_TxConfirmation for the corresponding PDU is called with parameter result set to E_NOT_OK ), the state machine shall be reset to start with a new OFS transmission again (once it is due).

If configured as Time Master of an Offset Time Domain (re- fer to CanTSynGlobalTimeDomain ) the CanTSyn module shall periodically transmit OFS messages with the cycle CanTSynGlobalTimeTxPeriod if • the GLOBAL_TIME_BASE bit within the timeBaseStatus of the referenced Time Base CanTSynSynchronizedTimeBaseRef is set • and CanTSynGlobalTimeTxPeriod is unequal to 0 • and if the associated cyclicMsgResumeCounter is not running. The cyclic transmission shall be started in the earliest possible CanTSyn_MainFunc- tion call once the requirements above are fulfilled.

The OFS and OFNS sequence shall not be interrupted, nei- ther by Time Synchronization messages of the same Time Domain nor by Time Syn- chronization messages of other Time Domains if the same CAN ID is used for the Time Synchronization messages.

A transmitter of OFNS messages (Time Master) is using as trigger condition for OFS to OFNS that the debounceCounter value reaches 0.

Depending on CanTSynGlobalTimeTxCrcSecured the OFS / OFNS message shall be of type: Bus Type Value of Parameter OFS Message Type OFNS Message Type CanTSynGlobalTimeTxCrcSecured CAN CRC_NOT_SUPPORTED 0x34 0x3C OFS not CRC OFNS not CRC secured message secured message CRC_SUPPORTED 0x44 0x4C OFS CRC OFNS CRC secured message secured message CAN FD CRC_NOT_SUPPORTED 0x54 Not Available ( CanTSyn- OFS not CRC UseExtended- secured message MsgFormat CRC_SUPPORTED 0x64 = TRUE ) OFS CRC secured message Table 7.12

Each transmission request of an OFS message shall be monitored for a transmit confirmation timeout. If CanTSyn_TxConfirmation is not called within 3 sec after transmission request, CanTSyn shall • wait until CanTSyn_TxConfirmation is called (with E_OK or E_NOT_OK ) and • send no OFNS message and • instead reset the state machine to start with a new OFS transmission once it is due.

If CanTSyn_SetTransmissionMode(Controller, Mode) is called and parameter Mode equals CANTSYN_TX_OFF , all transmit requests from CanTSyn shall be omitted on this CAN channel.

If CanTSyn_SetTransmissionMode(Controller, Mode) is called and parameter Mode equals CANTSYN_TX_ON , all transmit requests from CanTSyn on this CAN channel shall be able to be transmitted.

⌊ OBSOLETE g The transmitter of a Synchronized Time Base (Time Master) shall perform the following steps to distribute the Synchronized Time Base exactly: 1. On transmission of SYNC message (a) Get current Synchronized Time Base's Time Tuple as [T0 SYNC ;T0 VLT ] via StbM_BusGetCurrentTime and write second portion of T0 SYNC to Sync TimeSec 2. On SYNC message TX confirmation (a) Immediately establish a protection against interruptions and run the next step: (b) Retrieve current Virtual Local Time value as T1 VLT via StbM_GetCur- rentVirtualLocalTime (c) The protection against interruptions may be released (d) Calculate T4 for FUP message as T4 = T0 SYNC_ns + (T1 VLT - T0 VLT ) with T0 SYNC_ns as nanosecond portion of T0 SYNC 3. On transmission of FUP message (a) Write seconds portion of T4 (T4 >= 1s) to OVS (b) Write nanoseconds portion of T4 to SyncTimeNSec

The transmitter of an Offset Time Base (Time Master) shall perform the following steps to distribute the Offset Time Base exactly: • Retrieve current Offset Time via StbM_GetOffset • Write seconds portion of the Offset Time to the OfsTimeSec field • Write nanoseconds portion of the Offset Time to the OfsTimeNSec field

OVS shall be set within FUP messages if the transmitter detects a nanosecond overflow greater than the defined range of StbM_TimeStamp- Type . nanoseconds (refer to [SWS_CanTSyn_00154]). The leftover part of seconds which does not fit into StbM_TimeStampType . nanoseconds shall be written to OVS .

A Sequence Counter ( SC ) of 4 bit is representing numbers from 0 to 15 per Time Domain. The Sequence Counter shall be independent between SYNC and OFS messages and shall be incremented by 1 continuously on every trans- mission request of a SYNC or OFS message. It shall wrap around at 15 to 0 again.

The Sequence Counter ( SC ) value for a FUP message shall be set to the SC value of the corresponding SYNC message. The SC value for an OFNS message shall be set to the SC value of the corresponding OFS message.

The function Crc_CalculateCRC8H2F as defined in [6] shall be used to calculate the CRC if configured.

The DataID shall be calculated as DataID = DataIDList [SC] , where DataIDList is given by configuration for each message type (refer to configuration containers CanTSynGlobalTimeSyncDataIDList , CanTSynGlob- alTimeFupDataIDList , CanTSynGlobalTimeOfsDataIDList and CanTSyn- GlobalTimeOfnsDataIDList ).

If CanTSynUseExtendedMsgFormat is FALSE , the CRC shall be calculated over Time Synchronization message Byte 2 to Byte 7 and DataID , where Byte 2 is applied first, followed by the other bytes in ascending order, and Data ID last. If CanTSynUseExtendedMsgFormat is TRUE , the CRC shall be calculated over Time Synchronization message Byte 2 to Byte 15 and DataID for Extended Timesync mes- sage formats, where Byte 2 is applied first, followed by the other bytes in ascending order, and DataID last.

For each transmission of a Time Synchronization message the CanTSyn module shall assemble the message as follows: 1. Calculate OVS (FUP only) 2. Calculate SGW (FUP, OFNS and Extended OFS) 3. Calculate SC 4. Copy all data to the appropriate position within the related message 5. Calculate CRC (configuration dependent)

The CanTSyn shall only accept a SYNC message with Type equal to 0x20 and a correct CRC value if CanTSynRxCrcValidated is config- ured to CRC_VALIDATED .

The CanTSyn shall only accept a SYNC message with Type equal to 0x10 if CanTSynRxCrcValidated is configured to CRC_NOT_VAL- IDATED .

The CanTSyn shall only accept a SYNC message with Type equal to 0x10 or 0x20 if CanTSynRxCrcValidated is configured to CRC_- IGNORED .

The CanTSyn shall only accept a FUP message with an identical Sequence Counter to the value of the corresponding SYNC message and Type equal to 0x28 and a correct CRC value if CanTSynRxCrcValidated is config- ured to CRC_VALIDATED .

The CanTSyn shall only accept a FUP message with an identical Sequence Counter to the value of the corresponding SYNC message and Type equal to 0x18 if CanTSynRxCrcValidated is configured to CRC_NOT_VALI- DATED .

The CanTSyn shall only accept a FUP message with an identical Sequence Counter to the value of the corresponding SYNC message and Type equal to 0x18 or 0x28 if CanTSynRxCrcValidated is configured to CRC_- IGNORED .

For each configured Time Slave (refer to CanTSynGlob- alTimeSlave ) the CanTSyn module shall observe the reception timeout CanTSyn- GlobalTimeFollowUpTimeout between the SYNC and its FUP message. If the reception timeout occurs the sequence shall be reset (i.e., waiting for a new SYNC message).

For a valid pair of SYNC and FUP messages with success- fully validated set of values SyncTimeSec , OVS and SyncTimeNSec a new Syn- clocal Time Tuple [TL Sync ;T3 VLT ] (refer to [5]), consisting of the Global Time value and the associated value of the Virtual Local Time, shall be calculated (refer to [SWS_CanTSyn_00146], [SWS_CanTSyn_00147], [SWS_CanTSyn_00148]) and for- warded to the StbM module via StbM_BusSetGlobalTime .

The CanTSyn shall only accept an OFS message with Type equal to 0x44 or 0x64 and a correct CRC value if CanTSynRxCrcValidated is con- figured to CRC_VALIDATED .

The CanTSyn shall only accept an OFS message with Type equal to 0x34 or 0x54 if CanTSynRxCrcValidated is configured to CRC_NOT_- VALIDATED .

The CanTSyn shall only accept an OFS message with Type equal to 0x34 , 0x44 , 0x54 or 0x64 if CanTSynRxCrcValidated is configured to CRC_IGNORED .

The CanTSyn shall only accept an OFNS message with an identical Sequence Counter to the value of the corresponding OFS message and Type equal to 0x4C and a correct CRC value if CanTSynRxCrcValidated is configured to CRC_VALIDATED .

The CanTSyn shall only accept an OFNS message with an identical Sequence Counter to the value of the corresponding OFS message and Type equal to 0x3C if CanTSynRxCrcValidated is configured to CRC_VALIDATED .

The CanTSyn shall only accept an OFNS message with an identical Sequence Counter to the value of the corresponding OFS message and Type equal to 0x3C or 0x4C if CanTSynRxCrcValidated is configured to CRC_IGNORED .

If CanTSynUseExtendedMsgFormat is FALSE , the CanTSyn shall observe for each configured Time Slave ( CanTSynGlobal- TimeSlave ) the reception timeout CanTSynGlobalTimeFollowUpTimeout be- tween the OFS and its OFNS message. If the reception timeout occurs the sequence shall be reset (i.e. waiting for a new OFS message).

For a valid pair of OFS and OFNS messages and if CanTSynUseExtendedMsgFormat is FALSE , the CanTSyn shall calculate a new Time Tuple, consisting of the Offset Time value and the associated value of the Vir- tual Local Time, (according to [SWS_CanTSyn_00074]) and forward it to the StbM module via StbM_BusSetGlobalTime . If CanTSynUseExtendedMsgFormat is TRUE, the CanTSyn shall calculate a new Time Tuple, consisting of the Offset Time value and the associated value of the Virtual Local Time, (according to [SWS_CanTSyn_00074]) after receiving a valid OFS mes- sage and forward it to the StbM module via StbM_BusSetGlobalTime .

⌊ OBSOLETE g The receiver of a Synchronized Time Base shall perform the following steps to retrieve the Synchronized Time Base exactly: 1. On SYNC message RX indication, which delivers Synchronized Time Base part T0: (a) Immediately establish a protection against interruptions and run the next step directly afterwards: (b) Retrieve the current Virtual Local Time value as T2 VLT via StbM_GetCur- rentVirtualLocalTime (c) The protection against interruptions may be released 2. On FUP message reception (either in RX indication or in the subsequent Main Function invocation), which delivers Synchronized Time Base part T4 = ( OVS + SyncTimeNSec ), retrieve current Virtual Local Time value as T5 VLT via StbM_- GetCurrentVirtualLocalTime 3. Calculate the Time Tuple [T5;T5 VLT ] to update the Time Slave's Local Time Base: T5 = T0 + T4 + (T5 VLT - T2 VLT ).

The receiver of an Offset Time Base shall perform the fol- lowing steps to assemble the Offset Time: 1. Get seconds portion of the Offset Time out of OfsTimeSec 2. Get nanoseconds portion of the Offset Time out of OfsTimeNSec 3. Retrieve current Virtual Local Time value via StbM_GetCurrentVirtualLo- calTime

OVS (FUP only) shall be considered on the receiver side to retrieve the second portion of the received Synchronized Time Base.

The Sequence Counter of each SYNC message must match to the Sequence Counter of the next incoming FUP message of the same Time Domain. Otherwise, the contents of the already received SYNC message shall be dis- carded and the received FUP message shall be ignored.

If CanTSynUseExtendedMsgFormat is FALSE , the Se- quence Counter of each OFS message must match to the Sequence Counter of the next incoming OFNS message of the same Time Domain. If the SC s do not match, the received OFNS message shall be ignored and the contents of the already received OFS message shall be discarded.

The Sequence Counter Jump Width between two consec- utive SYNC or two consecutive OFS messages of the same Time Domain shall be greater than 0 and smaller than or equal to CanTSynGlobalTimeSequenceCoun- terJumpWidth . Otherwise, a Time Slave shall ignore the respective SYNC / OFS message. If the CanTSynGlobalTimeSequenceCounterJumpWidth value is set to 0, the Time Slave shall not do Sequence Counter Jump Width checks.

Upon reception of a SYNC (or OFS) message a Time Slave shall check the Sequence Counter of the received message per Time Domain against the configured value of CanTSynGlobalTimeSequenceCounterJumpWidth (ac- cording to [SWS_CanTSyn_00078]), unless it is the first message • at Startup or • after a Time Base update timeout has been detected ( TIMEOUT bit set in Time Base synchronization status timeBaseStatus ).

The function Crc_CalculateCRC8H2F as defined in [6] shall be used to validate the CRC if configured.

The DataID shall be calculated as DataID = Data IDList [ SC ], where DataIDList is given by configuration for each message Type.

If CanTSynUseExtendedMsgFormat is FALSE , the CRC shall be calculated over Time Synchronization message Byte 2 to Byte 7 and DataID , where Byte 2 is applied first, followed by the other Bytes in ascending order, and Data ID last. If CanTSynUseExtendedMsgFormat is TRUE , the CRC shall be calculated over Time Synchronization message Byte 2 to Byte 15 and DataID for Extended Timesync mes- sage formats, where Byte 2 is applied first, followed by the other bytes in ascending order, and DataID last.

For each received Time Synchronization message the CanTSyn shall validate the message as follows (all conditions must match): 1. Type matches depending on the CanTSynRxCrcValidated parameter 2. SC value is within the accepted range (refer to [SWS_CanTSyn_00078] and [SWS_CanTSyn_00079]) 3. D matches to the defined Time Domain range for each Type 4. D matches to one of the configured Time Domains (given by parameter CanTSynGlobalTimeDomainId ) 5. SyncTimeNSec (FUP / OFNS / Extended OFS only) matches the defined range of StbM_TimeStampType . nanoseconds . 6. CRC (including DataID ) matches depending on the CanTSynRxCrcValidated parameter

For each received Time Synchronization message the CanTSyn shall disassemble the message after successful validation (refer to [SWS_CanTSyn_00086]).

On errors and exceptions, the CanTSyn module shall not modify its current module state but shall simply report the error event.

Type of error Related error code Error value API service called with wrong PDU or SDU CANTSYN_E_INVALID_PDUID 0x01 API service used in un-initialized state CANTSYN_E_UNINIT 0x02 A pointer is NULL CANTSYN_E_NULL_POINTER 0x03 CanTSyn initialization failed CANTSYN_E_INIT_FAILED 0x04 API called with invalid parameter CANTSYN_E_PARAM 0x05 Invalid Controller index CANTSYN_E_INV_CTRL_IDX 0x06

Module Header File Imported Type Can Can_GeneralTypes.h Can_TimeStampType (draft) ComStack_Types.h PduIdType ComStack_Types.h PduInfoType ComStack_Types ComStack_Types.h PduLengthType Rte_StbM_Type.h StbM_CanTimeMasterMeasurementType Rte_StbM_Type.h StbM_CanTimeSlaveMeasurementType Rte_StbM_Type.h StbM_SynchronizedTimeBaseType Rte_StbM_Type.h StbM_TimeBaseStatusType Rte_StbM_Type.h StbM_TimeStampShortType Rte_StbM_Type.h StbM_TimeStampType Rte_StbM_Type.h StbM_UserDataType StbM.h StbM_MeasurementType StbM StbM.h StbM_VirtualLocalTimeType Std Std_Types.h Std_ReturnType Module Header File Imported Type Std_Types.h Std_VersionInfoType

The callback function CanTSyn_RxIndication shall in- form the Det , if development error detection is enabled ( CanTSynDevErrorDetect is set to TRUE) and if function call has failed because of the following reasons: • Invalid PDU ID (CANTSYN_E_INVALID_PDUID) • PduInfoPtr or SduDataPtr equals NULL_PTR (CANTSYN_E_NULL_ POINTER)

The callback function CanTSyn_TxConfirmation shall inform the Det , if development error detection is enabled ( CanTSynDevErrorDetect is set to TRUE) and if the function call has failed because of the following reason: • Invalid PDU ID (CANTSYN_E_INVALID_PDUID), i.e., a PDU ID not configured by parameter CanTSynGlobalTimeMasterConfirmationHandleId

The frequency of invocations of CanTSyn_MainFunc- tion is determined by the configuration parameter CanTSynMainFunctionPe- riod .

StbM_GetCurrentVirtualLocalTime StbM.h Returns the Virtual Local Time of the referenced Time Base.

CanIf_EnableEgressTimeStamp (draft) CanIf.h This service calls the corresponding CAN Driver service to activate egress time stamping on a dedicated message object. Tags: atp.Status=draft CanIf_GetCurrentTime (draft) CanIf.h This service calls the corresponding CAN Driver service to retrieve the current time value out of the HW registers. Tags: atp.Status=draft CanIf_GetEgressTimeStamp (draft) CanIf.h This service calls the corresponding CAN Driver service to read back the egress time stamp on a dedicated message object. It needs to be called within the TxConfirmation() function. Tags: atp.Status=draft CanIf_GetIngressTimeStamp (draft) CanIf.h This service calls the corresponding CAN Driver service to reads back the ingress time stamp on a dedicated message object. It needs to be called within the RxIndication() function. Tags: atp.Status=draft CanIf_Transmit CanIf.h Requests transmission of a PDU. Crc_CalculateCRC8H2F Crc.h This service makes a CRC8 calculation with the Polynomial 0x2F on Crc_Length Det_ReportError Det.h Service to report development errors. Det_ReportRuntimeError Det.h Service to report runtime errors. If a callout has been configured then this callout shall be called. StbM_BusGetCurrentTime StbM.h Returns the current Time Tuple, status and User Data of the Time Base. StbM_BusSetGlobalTime StbM.h Allows the Time Base Provider Modules to forward a new Global Time tuple (i.e., Rx Time Tuple) to the StbM. StbM_CanSetMasterTimingData (draft) StbM_CanTSyn.h Provides CAN Timesyn module specific data for a Time Master to the StbM. Tags: atp.Status=draft StbM_CanSetSlaveTimingData (draft) StbM_CanTSyn.h Allows the CanTSyn Module to forward CAN specific details to the StbM. Tags: atp.Status=draft StbM_GetCurrentTime StbM.h Returns a time value (Local Time Base derived from Global Time Base) in standard format. Note: This API shall be called with locked interrupts / within an Exclusive Area to prevent interruption (i.e., the risk that the time stamp is outdated on return of the function call). StbM_GetOffset StbM.h Allows the Timesync Modules to get the current Offset Time and User Data. StbM_GetTimeBaseStatus StbM.h Returns detailed status information for a Synchronized (or Pure Local) Time Base and, if called for an Offset Time Base, for the Offset Time Base and the underlying Synchronized Time Base. StbM_GetTimeBaseUpdateCounter StbM.h Allows the Timesync Modules to detect, whether a Time Base should be transmitted immediately in the subsequent <Bus>TSyn_MainFunction() cycle.

The Time Synchronization over CAN shall support the con- figuration for Time Master, Time Slave and Time Gateway.

The CanTSyn shall only accept a SYNC message with Type equal to 0x10 or a SYNC message with Type equal to 0x20 and a correct CRC value if CanTSynRxCrcValidated is configured to CRC_OPTIONAL .

The CanTSyn shall only accept a FUP message with an identical Sequence Counter to the value of the corresponding SYNC message and Type equal to 0x18 or a FUP message with an identical sequence counter to the value of the corresponding SYNC message and Type equal to 0x28 and a correct CRC value if CanTSynRxCrcValidated is configured to CRC_OPTIONAL .

0 Type 0x54 1 User Byte 2 default: 0 2 7..4 D 16..31 Time Domain Id 3..0 SC Sequence Counter 3 7..1 reserved default: 0 0 SGW SyncToGTM = 0 SyncToSubDomain = 1 4 User Byte 0 default: 0 5 User Byte 1 default: 0 6 reserved default: 0 7 reserved default: 0 8-11 OfsTimeSec 32 Bit offset time value in seconds 12-15 OfsTimeNSec 32 Bit offset time value in nanoseconds Table 7.9: OFS not CRC secured message format for CAN FD

0 Type 0x64 1 CRC 2 7..4 D 16..31 Time Domain 3..0 SC Sequence Counter 3 7..1 reserved default: 0 0 SGW SyncToGTM = 0 SyncToSubDomain = 1 4 User Byte 0 default: 0 5 User Byte 1 default: 0 6 reserved default: 0 7 reserved default: 0 8-11 OfsTimeSec 32 Bit offset time value in seconds 12-15 OfsTimeNSec 32 Bit offset time value in nanoseconds Table 7.10: OFS CRC secured message format for CAN FD

The CanTSyn n shall only accept an OFS message with Type equal to 0x34 or 0x54 or an OFS message with Type equal to 0x44 or 0x64 and a correct CRC value if CanTSynRxCrcValidated is configured to CRC_OPTIONAL .

The CanTSyn shall only accept an OFNS message with an identical Sequence Counter to the value of the corresponding OFS message and Type equal to 0x3C or an OFNS message with an identical Sequence Counter to the value of the corresponding OFS message and Type equal to 0x4C and a correct CRC value if CanTSynRxCrcValidated is configured to CRC_OPTIONAL .

On an invocation of StbM_BusSetGlobalTime the pa- rameter pathDelay of the measureDataPtr structure shall be set to 0.

On an invocation of StbM_BusSetGlobalTime the pa- rameter pathDelay of the measureDataPtr structure shall be set to 0.

If CanTSynImmediateTimeSync is set to TRUE for a Time Base, CanTSyn shall check on each CanTSyn_MainFunction call by calling StbM_GetTimeBaseUpdateCounter , if the timeBaseUpdateCounter of the cor- responding Time Base has changed.

If • CanTSynImmediateTimeSync is set to TRUE and • the timeBaseUpdateCounter of a Time Base has changed and • the GLOBAL_TIME_BASE bit of the timeBaseStatus is set and • the debounceCounter is 0 and • no transmission of the corresponding PDU is pending ( CanTSyn_TxConfirma- tion has been called with E_OK or E_NOT_OK ), CanTSyn shall trigger an immediate transmission of Time Synchronization messages for the corresponding Time Base.

If CanTSynImmediateTimeSync is set to TRUE, cyclic MsgResumeCounter and CanTSynCyclicMsgResumeTime shall be considered.

CanTSynCyclicMsgResumeTime represents the timeout value of a cyclicMsgResumeCounter that shall be started after an immediate trans- mission of a SYNC or an OFS message has been successfully completed (i.e., CanTSyn_TxConfirmation for the corresponding PDU is called with parameter re- sult set to E_OK), asynchronously to the cyclic Timesync message transmission. cyclicMsgResumeCounter shall be decremented on each invocation of CanTSyn_- MainFunction , if no Timesync PDU is transmitted asynchronously.

If the cyclicMsgResumeCounter has reached a value equal or less than zero, CanTSyn shall resume cyclic Timesync message transmission by sending either a SYNC or OFS message.

If the cyclicMsgResumeCounter is started CanTSyn shall stop cyclic Timesync message transmission.

If CanTSynGlobalTimeDebounceTime is greater than 0 for a Time Base, CanTSyn shall always do debouncing for the corresponding Timesync PDUs as described below, otherwise CanTSyn shall not do any debouncing.

CanTSynGlobalTimeDebounceTime represents the de- bounce value of a PDU specific debounceCounter that shall be started after the Timesync PDU has been successfully sent (i.e., CanTSyn_TxConfirmation for the corresponding PDU is called with parameter result set to E_OK ). CanTSyn shall decrement the debounceCounter value on each invocation of CanTSyn_MainFunction

A new Timesync PDU shall only be sent if the corresponding debounceCounter has a value equal or less than 0.

0 Type 0x34 1 User Byte 1 default: 0 2 7..4 D 16..31 Time Domain Id 3..0 SC Sequence Counter 3 User Byte 0 default: 0 4-7 OfsTimeSec 32 Bit offset time value in seconds Table 7.5: OFS not CRC secured message format

0 Type 0x3C 1 User Byte 2 default: 0 2 7..4 D 16..31 Time Domain Id 3..0 SC 0..15 Sequence Counter 3 7..1 reserved default: 0 0 SGW SyncToGTM = 0 SyncToSubDomain = 1 4-7 OfsTimeNSec 32 Bit offset time value in nanoseconds Table 7.6: OFNS not CRC secured message format

0 Type 0x44 1 CRC 2 7..4 D 16..31 Time Domain Id 3..0 SC Sequence Counter 3 User Byte 0 default: 0 4-7 OfsTimeSec 32 Bit offset time value in seconds Table 7.7: OFS CRC secured message format

0 Type 0x4C 1 CRC 2 7..4 D 16..31 Time Domain Id 3..0 SC Sequence Counter 3 7..1 reserved default: 0 0 SGW SyncToGTM = 0 SyncToSubDomain = 1 4-7 OfsTimeNSec 32 Bit offset time value in nanoseconds Table 7.8: OFNS CRC secured message format

If CanTSynUseExtendedMsgFormat is FALSE , then the Normal Offset Message Format shall be used, i.e., Offset Messages with message Type 0x34 , 0x44 , 0x3C and 0x4C .

If CanTSynUseExtendedMsgFormat is TRUE , then the Extended Offset Message Format shall be used, i.e., Offset Messages with message Type 0x54 and 0x64 .

CanTSynUseExtendedMsgFormat shall always be FALSE for CAN 2.0 buses.

If the SGW value (FUP, OFNS and Extended OFS) is set to SyncToSubDomain , the SYNC_TO_GATEWAY bit within timeBaseStatus shall be set to TRUE . Otherwise, it shall be set to FALSE .

The function CanTSyn_SetTransmissionMode shall in- form the Det , if development error detection is enabled (i.e., CanTSynDevErrorDe- tect is set to TRUE ) and if function call has failed because of the following reasons: • Invalid CtrlIdx (CANTSYN_E_INV_CTRL_IDX) • Invalid Mode (CANTSYN_E_PARAM)

If CanTSyn calls an API of the StbM , it shall use the Time Base ID of the Time Base referenced via the parameter CanTSynSynchronized- TimeBaseRef of the corresponding Time Domain.

A master shall transmit SYNC, FUP, OFS and OFNS mes- sages by calling CanIf_Transmit with the PduId derived via CanTSynGlobal- TimePduRef of the corresponding Time Domain.

The CanTSyn shall support Time Validation, if CanTSyn- TimeValidationSupport set to TRUE .

If • CanTSynTimeValidationSupport is enabled and • CanTSynEnableTimeValidation for the Time Domain is enabled CanTSyn shall do time recording for Time Validation for that Time Domain

If • time recording for Time Validation is enabled for a Time Domain (refer to [SWS_CanTSyn_00115] and [SWS_CanTSyn_00116]) and • CanTSyn is configured as Time Slave for that Time Domain, CanTSyn shall call StbM_CanSetSlaveTimingData upon successful reception of a FUP message. StbM_CanSetSlaveTimingData shall be called after StbM_BusSetGlobalTime .

Upon invocation of StbM_CanSetSlaveTimingData CanTSyn shall pass following values • the sequence counter value from the transmitter (Time Master), • the segment id of the physical channel on which the SYNC message has been received (refer to parameter CanTSynGlobalTimeNetworkSegmentId ) • T2 VLT as syncIngressTimestamp for the SYNC message (refer to step 1 in [SWS_CanTSyn_00144], [SWS_CanTSyn_00147] and [SWS_CanTSyn_00148]), • T0 + T4 as preciseOriginTimestamp received from the Time Master (refer to [SWS_CanTSyn_00144] and [SWS_CanTSyn_00145]) to the function by the parameter measureDataPtr . Struct members • measureDataPtr → referenceLocalTimestamp and • measureDataPtr → referenceGlobalTimestamp shall be passed as 0.

If • time recording for Time Validation is enabled for a Time Domain (refer to [SWS_CanTSyn_00115] and [SWS_CanTSyn_00115]) and • CanTSyn is configured as Time Master for that Time Domain CanTSyn shall call StbM_CanSetMasterValidationData upon successful trans- mission of a SYNC message).

Upon invocation of StbM_CanSetMasterValidation- Data CanTSyn shall pass the following data • the sequence counter as sent in the SYNC message • the segment id of the physical channel on which the SYNC message has been sent (refer to parameter CanTSynGlobalTimeNetworkSegmentId ) • T1 VLT as the syncEgressTimestamp of SYNC message (re- fer to [SWS_CanTSyn_00149], [SWS_CanTSyn_00152] and [SWS_CanTSyn_00153]), • T0 SYNC + (T1 VLT - T0 VLT ) as precise preciseOriginTimestamp (refer to [SWS_CanTSyn_00149], [SWS_CanTSyn_00151], [SWS_CanTSyn_00152] and [SWS_CanTSyn_00153]), to the function by the parameter measureDataPtr .

While a Time Base Timeout is present ( TIMEOUT bit is set in Time Base synchronization status timeBaseStatus ), CanTSyn shall discard SYNC/FUP (or OFS/OFNS) messages until it has successfully validated (refer to [SWS_CanTSyn_00078]) n consecutive SYNC/FUP (or OFS/OFNS) message pairs ( n is given by the parameter CanTSynGlobalTimeSequenceCounterHysteresis ).

⌊ DRAFT g Upon SYNC message RX indication for a Syn- chronized Time Domain, the Time Slave shall within the RX indication routine ( CanTSyn_RxIndication ) 1. • If HW timestamping is enabled, – Retrieve T2 CAN as ingress timestamp from CAN controller HW value via CanIf_GetIngressTimestamp • else – Retrieve T2 VLT as ingress timestamp by reading current Virtual Local Time value via StbM_GetCurrentVirtualLocalTime 2. Retrieve T0 from the SYNC message data

⌊ DRAFT g Upon reception of a FUP message, CanTSyn shall 1. retrieve the following data from the FUP message • the OVS field and • the SyncTimeNSec field 2. calculate T4 = OVS + SyncTimeNSec in the RX indication routine ( CanTSyn_RxIndication ).

⌊ DRAFT g If • HW timestamping is disabled, CanTSyn shall after successful capture of T4 (refer to [SWS_CanTSyn_00145]): 1. capture the current Virtual Local Time via StbM_GetCurrentVirtualLocal- Time from StbM as T3 VLT and 2. calculate TL Sync = (T0 + T4) + (T3 VLT - T2 VLT )

⌊ DRAFT g If • HW timestamping is enabled and • CanTSyn is using for internal time measurement the same time source as the StbM for Virtual Local Time, CanTSyn shall after successful capture of T4 (refer to [SWS_CanTSyn_00145]): 1. retrieve current time from CAN controller HW value via CanIf_GetCurrent- Time as T3 CAN , 2. set T2 VLT = T2 CAN , 3. set T3 VLT = T3 CAN and 4. calculate TL Sync = (T0 + T4) + (T3 VLT - T2 VLT )

⌊ DRAFT g If • HW timestamping is enabled and • CanTSyn is using for internal time measurement a different time source as the StbM for Virtual Local Time, CanTSyn shall after successful capture of T4 (refer to [SWS_CanTSyn_00145]): 1. establish a protection against interruptions 2. retrieve current time from CAN controller HW value via CanIf_GetCurrent- Time as T3 CAN , 3. capture the current Virtual Local Time via StbM_GetCurrentVirtualLocal- Time from StbM as T3 VLT 4. release the protection against interruptions 5. calculate T2 VLT = T3 VLT - (T3 CAN - T2 CAN ), 6. calculate TL Sync = (T0 + T4) + (T3 CAN - T2 CAN )

⌊ DRAFT g If for a Synchronized Time Domain a cyclic or im- mediate transmission of a SYNC message is requested, the Time Master shall 1. get current Synchronized Time Base's Time Tuple as [T0 SYNC ;T0 VLT ] via StbM_- BusGetCurrentTime and 2. call CanIf_Transmit with the seconds portion of T0 SYNC written to Sync- TimeSec field of the message data.

⌊ DRAFT g Upon successful SYNC message TX confirmation for a Synchronized Time Domain and if no TX confirmation timeout has occurred (refer to [SWS_CanTSyn_00033]) the Time Master shall within the TX confirmation routine ( CanTSyn_TxConfirmation ) • if HW timestamping is enabled, – Retrieve T1 CAN as egress timestamp from CAN controller HW value via CanIf_GetEgressTimestamp • else – Retrieve T1 VLT as egress timestamp by reading current Virtual Local Time value via StbM_GetCurrentVirtualLocalTime

⌊ DRAFT g If • HW timestamping is disabled, CanTSyn shall after successful capture of the egress timestamp (refer to [SWS_CanTSyn_00150]): • calculate T4 = T0 SYNC_ns + (T1 VLT - T0 VLT )

⌊ DRAFT g If • HW timestamping is enabled and • CanTSyn is using for internal time measurement the same time source as the StbM for Virtual Local Time, CanTSyn shall after successful capture of the egress timestamp (refer to [SWS_CanTSyn_00150]) • calculate T4 = T0 SYNC_ns + T1 VLT - T0 VLT , with T1 VLT = T1 CAN

⌊ DRAFT g If • HW timestamping is enabled and • CanTSyn is using for internal time measurement a different time source as the StbM for Virtual Local Time, CanTSyn shall after successful capture of the egress timestamp (refer to [SWS_CanTSyn_00150]): 1. establish a protection against interruptions 2. read T currentTime_CAN via CanIf_GetCurrentTime , 3. read T1 VLT via StbM_GetCurrentVirtualLocalTime , 4. release the protection against interruptions and 5. calculate T4 = T0 SYNC_ns + (T1 VLT - T0 VLT ) - (T currentTime_CAN - T1 CAN )

⌊ DRAFT g If for a Synchronized Time Domain a FUP mes- sage is due, the Time Master shall 1. call CanIf_Transmit and 2. write the following data to the message: (a) seconds portion of T4 (T4 >= 1s) to the OVS field and (b) nanoseconds portion of T4 to the SyncTimeNSec field

[SWS_CanTSyn_00159]{DRAFT} ⌈If the CanTSynGlobalTimeTxIcvSecured is ICV_SUPPORTED and CanTSynUseExtendedMsgFormat is TRUE, then depending on CanTSynGlobalTimeTxCrcSecured the SYNC / FUP message shall be of type: CanTSynGlobalTimeTxCrcSecured Value SYNC Message Type FUP Message Type CRC_NOT_SUPPORTED 0x10 0x78 SYNC message, FUP message, not CRC not CRC protected protected, ICV secured CRC_SUPPORTED 0x20 0x88 SYNC message, FUP message, CRC CRC protected protected, ICV secured Table 7.17: Settings of CanTSynGlobalTimeTxCrcSecured for SYNC / FUP messages with ICV ⌋(RS_TS_20073)

[SWS_CanTSyn_00161] Upstream requirements: RS_TS_20073 ⌈The CanTSyn shall calculate the ICV using • the SYNC payload (byte 0 .. 7), • the FUP payload (byte 0 .. 9) • and the FV (if configured by CanTSynIcvGenerationFvIdRef). ⌋ Refer to the chapter 7.3.13 in StbM [5] for the configuration details of FV referenced in each Time Domain.

[SWS_CanTSyn_00162]{DRAFT} ⌈The ICV shall be calculated over Extended OFS payload and FV (based on configuration CanTSynIcvGenerationFvIdRef) and is included in the Extended OFS message.⌋(RS_TS_20073) Refer to the chapter 7.3.13 in StbM [5] for the configuration details of FV referenced in each Time Domain.

[SWS_CanTSyn_00163] Upstream requirements: RS_TS_20073 ⌈When the FV is referenced (refer CanTSynIcvGenerationFvIdRef) and the con- figured truncated FV length (StbMFreshnessValueTruncLength) == FV length ( StbMFreshnessValueLength) in StbM, the Time Master shall call the StbM_Get- TxFreshness Api to obtain the FV by using the StbMFreshnessValueId.⌋

[SWS_CanTSyn_00164] Upstream requirements: RS_TS_20073 ⌈When the FV is referenced (refer CanTSynIcvGenerationFvIdRef) and the con- figured truncated FV length (StbMFreshnessValueTruncLength) < FV length ( StbMFreshnessValueLength), the Time Master shall call the StbM_GetTxFresh- nessTruncData Api to obtain the FV and the truncated FV by using the StbMFresh- nessValueId.⌋

[SWS_CanTSyn_00165] Upstream requirements: RS_TS_20073 ⌈When the FV is not referenced (refer CanTSynIcvGenerationFvIdRef), the Time Master shall not include the FV in the ICV generation and fill 0 for FVL field in message types 0x78 and 0x88.⌋

[SWS_CanTSyn_00166] Upstream requirements: RS_TS_20073 ⌈If StbM_GetTxFreshness returns E_OK, the Time Master shall construct the mes- sage types 0x78 and 0x88 with the full FV, set the FVL to StbMFreshnessValue- Length and use the full FV in ICV generation.⌋

[SWS_CanTSyn_00167] Upstream requirements: RS_TS_20073 ⌈If StbM_GetTxFreshnessTruncData returns E_OK, the Time Master shall con- struct the message types 0x78 or 0x88 with truncated FV, set the FVL to StbM- FreshnessValueTruncLength and use the full FV in ICV generation.⌋

[SWS_CanTSyn_00168] Upstream requirements: RS_TS_20073 ⌈If StbM_GetTxFreshness or StbM_GetTxFreshnessTruncData return a non- recoverable error code (i.e, E_NOT_OK), the Time Master shall: • stop the ICV generation and accordingly fill 0 for FVL and ICVL fields in message types 0x78 and 0x88, • call Det_ReportRuntimeError with the parameter ErrorId set to CANTSYN_ E_FRESHNESSFAILURE, • call IdsM_SetSecurityEventWithContextData with the parameter EventId set to SEV_TSYN_CAN_FRESHNESS_NOT_AVAILABLE. ⌋ Refer to the chapter 10.2.5 in [7] for the configuration details of CSM job used for ICV generation.

[SWS_CanTSyn_00169] Upstream requirements: RS_TS_20073 ⌈If CanTSynIcvGenerationBase for the Time Domain is configured to ICV_MAC, the Time Master shall call Csm_MacGenerate to generate the ICV value.⌋

[SWS_CanTSyn_00170] Upstream requirements: RS_TS_20073 ⌈If CanTSynIcvGenerationBase for the Time Domain is configured to ICV_SIG- NATURE, the Time Master shall call Csm_SignatureGenerate to generate the ICV value.⌋ Note: The mode parameter is intentionally left open for the implementer to choose ( i.e. CRYPTO_OPERATIONMODE_SINGLECALL would possibly be the best option since it does not require further calls to CSM). The CSM job used to generate the ICV can be configured to synchronous or asyn- chronous behaviour.

[SWS_CanTSyn_00171] Upstream requirements: RS_TS_20073 ⌈If the CSM job used to generate ICV is configured in synchronous behaviour, the Time Master shall disable ICV generation timeout monitoring.⌋

[SWS_CanTSyn_00172] Upstream requirements: RS_TS_20073 ⌈If the CanTSynIcvGenerationTimeout is set to 0, the Time Master shall not do the ICV generation timeout monitoring.⌋

[SWS_CanTSyn_00173] Upstream requirements: RS_TS_20073 ⌈If CanTSynIcvGenerationTimeout is set to any value > 0 and Csm_MacGener- ate or Csm_SignatureGenerate returns E_OK, the Time Master shall start the CanTSynIcvGenerationTimeout.⌋

[SWS_CanTSyn_00174] Upstream requirements: RS_TS_20073 ⌈If CanTSynIcvGenerationTimeout is set to any value > 0 and the CanTSyn_Icv- GenerationIndication callback is called, the Time Master shall stop the running CanTSynIcvGenerationTimeout.⌋

[SWS_CanTSyn_00175] Upstream requirements: RS_TS_20073 ⌈If one of the following conditions is true: • the authentication build counter has reached the configuration value CanTSyn- TxAuthenticationBuildAttempts, • the verification of the ICV has returned a non-recoverable error such as returning E_NOT_OK or KEY_FAILURE, • or CanTSynIcvGenerationTimeout expires before the notification of the CanTSyn_IcvGenerationIndication callback, then the Time Master shall • stop the ICV generation and accordingly fill 0 for ICVL field in message types 0x78 and 0x88, • and call IdsM_SetSecurityEventWithContextData with the parameter EventId set to SEV_TSYN_CAN_ICV_GENERATION_FAILED. ⌋

[SWS_CanTSyn_00176]{DRAFT} ⌈With the notification of the CanTSyn_IcvGener- ationIndication callback and successful generation of ICV, the Time Master shall add the generated ICV to the ICV field in message types 0x78, 0x88, 0x94 and 0xA4 and transmit the FUP, Extended OFS message.⌋(RS_TS_20073)

[SWS_CanTSyn_00177]{DRAFT} ⌈If the FV is referenced (refer CanTSynIcvGen- erationFvIdRef), then the Time Master shall notify the successful transmission of messages of type 0x78, 0x88, 0x94 and 0xA4 to FVM by calling StbM_SPduTx- Confirmation.⌋(RS_TS_20073)

[SWS_CanTSyn_00188] Upstream requirements: RS_TS_20073 ⌈When • the FV is referenced (refer CanTSynIcvVerificationFvIdRef) • and FVL > 0, in a received FUP message, then the Time Slave shall call the StbM_GetRxFreshness Api to obtain the Freshness Value by using • the StbMFreshnessValueId from the reference CanTSynIcvVerifica- tionFvIdRef • the StbMTruncatedFreshnessValue as received in the FV field of the FUP message • the StbMTruncatedFreshnessValueLength as received in the FVL field of the FUP message • the StbMAuthVerifyAttempts as the number of failed verification attempts for the current message (ICV verification attempt counter) • the StbMFreshnessValueLength from the reference CanTSynIcvVerifi- cationFvIdRef ⌋

[SWS_CanTSyn_00189] Upstream requirements: RS_TS_20073 ⌈When the FVL is 0 in the received FUP, then the Time Slave shall not include the FV in the ICV verification.⌋

[SWS_CanTSyn_00190] Upstream requirements: RS_TS_20073 ⌈When • the FV is not referenced (refer CanTSynIcvVerificationFvIdRef) • and FVL > 0, in the received FUP, then the Time Slave shall stop the ICV verification and consider ICV verification as failed.⌋

[SWS_CanTSyn_00191] Upstream requirements: RS_TS_20073 ⌈If StbM_GetRxFreshness returns E_OK, the Time Slave shall use the FV in ICV verification.⌋

[SWS_CanTSyn_00193] Upstream requirements: RS_TS_20073 ⌈If StbM_GetRxFreshness returned a non-recoverable error code (i.e, E_NOT_OK), then the Time Slave shall • consider the ICV verification of a received FUP message as failed • stop the ICV verification, • drop the received FUP message, • call Det_ReportRuntimeError with the parameter ErrorId set to CANTSYN_ E_FRESHNESSFAILURE, • and call IdsM_SetSecurityEventWithContextData with the parameter EventId set to SEV_TSYN_CAN_FRESHNESS_NOT_AVAILABLE. ⌋ Refer to the chapter 10.2.5 in [7] for the configuration details of CSM job used for ICV verification.

[SWS_CanTSyn_00194] Upstream requirements: RS_TS_20073 ⌈If CanTSynIcvVerificationBase for the Time Domain is configured to ICV_MAC, the Time Slave shall call Csm_MacVerify to verify the ICV value.⌋

[SWS_CanTSyn_00195] Upstream requirements: RS_TS_20073 ⌈If CanTSynIcvVerificationBase for the Time Domain is configured to ICV_SIG- NATURE, the Time Slave shall call Csm_SignatureVerify to verify the ICV value.⌋ Note: The mode parameter is intentionally left open for the implementer to choose (i.e. CRYPTO_OPERATIONMODE_SINGLECALL would possibly be the best option since it does not require further calls to CSM). The CSM job used to generate the ICV can be configured to synchronous or asyn- chronous behaviour.

[SWS_CanTSyn_00196] Upstream requirements: RS_TS_20073 ⌈The ICV verification timeout observation is disabled, when the CSM job to verify ICV is configured in synchronous behaviour. In this case, the CanTSynIcvVerification- Timeout shall be set to 0.⌋

[SWS_CanTSyn_00197] Upstream requirements: RS_TS_20073 ⌈If Csm_MacVerify or Csm_SignatureVerify returns E_OK, the Time Slave shall start the CanTSynIcvVerificationTimeout.⌋

[SWS_CanTSyn_00198] Upstream requirements: RS_TS_20073 ⌈The CanTSynIcvVerificationTimeout shall be stopped with the notification of the CanTSyn_IcvVerificationIndication callback.⌋

[SWS_CanTSyn_00199] Upstream requirements: RS_TS_20073 ⌈When Csm_MacVerify or Csm_SignatureVerify return a recoverable error code (e.g., E_BUSY, QUEUE_FULL), then the Time Slave shall • consider the verification of received FUP message as failed • and increment the authentication build counter for this FUP message. ⌋

[SWS_CanTSyn_00200] Upstream requirements: RS_TS_20073 ⌈If one of the following conditions is true: • the authentication build counter has reached the configuration value CanTSyn- RxAuthenticationBuildAttempts, • the ICV verification attempt counter has reached the configuration value CanTSynIcvVerificationAttempts • the verification of the ICV has returned a non-recoverable error such as returning E_NOT_OK or KEY_FAILURE, • CanTSynIcvVerificationTimeout expires before the notification of the CanTSyn_IcvVerificationIndication callback, then the Time Slave shall • stop the ICV verification and consider the ICV verification as failed, • and call IdsM_SetSecurityEventWithContextData with the parameter EventId set to SEV_TSYN_CAN_ICV_VERIFICATION_FAILED. ⌋

[SWS_CanTSyn_00202] Upstream requirements: SRS_BSW_00323, SRS_BSW_00337, SRS_BSW_00386 ⌈The function CanTSyn_IcvGenerationIndication shall inform the DET, if devel- opment error detection is enabled (CanTSynDevErrorDetect is set to TRUE) and if function call has failed because of the following reasons: • jobId is invalid (CANTSYN_E_PARAM) ⌋

[SWS_CanTSyn_00203] Upstream requirements: SRS_BSW_00323, SRS_BSW_00337 ⌈The function CanTSyn_IcvVerificationIndication() shall inform the DET, if development error detection is enabled (CanTSynDevErrorDetect is set to TRUE) and if function call has failed because of the following reasons: • jobId is invalid (CANTSYN_E_PARAM) ⌋

[SWS_CanTSyn_00204]) ⌋(RS_TS_20073) Refer to the chapter 10.2.5 in [7] for the configuration details of CSM job used for ICV generation.

[SWS_CanTSyn_00206] ⌈If the validation of the received Time Synchronization mes- sage has failed (refer to [SWS_CanTSyn_00086]), the CanTSyn shall discard the received Time Synchronization message.⌋(RS_TS_20035, RS_TS_20036, RS_TS_- 20073)

[SWS_CanTSyn_00210] Status: DRAFT Upstream requirements: RS_TS_20073 ⌈For every transmission of messages of type 0x78 and 0x88 the Time Master shall maintain an authentication build counter (refer CanTSynTxAuthenticationBuil- dAttempts).⌋

[SWS_CanTSyn_00211] Status: DRAFT Upstream requirements: RS_TS_20073 ⌈Upon the initial processing of messages of type 0x78 and 0x88 the Time Master shall set the authentication build counter to 0.⌋

[SWS_CanTSyn_00212] Status: DRAFT Upstream requirements: RS_TS_20073 ⌈When StbM_GetTxFreshness or StbM_GetTxFreshnessTruncData return a re- coverable error code (e.g., STBM_E_BUSY), then the Time Master shall increment the authentication build counter.⌋

[SWS_CanTSyn_00213] Status: DRAFT Upstream requirements: RS_TS_20073 ⌈When Csm_MacGenerate or Csm_SignatureGenerate return a recoverable error code (e.g., E_BUSY, QUEUE_FULL), then the Time Master shall increment the authen- tication build counter.⌋

[SWS_CanTSyn_00214]{DRAFT} ⌈If • building the authenticated message has failed • and the authentication build counter has not yet reached the configuration value CanTSynTxAuthenticationBuildAttempts, then the Time Master shall retry the freshness attempt and ICV calculation in the next call of CanTSyn_MainFunction.⌋(RS_TS_20073)

[SWS_CanTSyn_00215] Status: DRAFT Upstream requirements: RS_TS_20073 ⌈For every reception of messages that require ICV verification, the Time Slave shall maintain an authentication build counter (refer to CanTSynRxAuthentication- BuildAttempts).⌋

[SWS_CanTSyn_00216] Status: DRAFT Upstream requirements: RS_TS_20073 ⌈Upon the initial processing of messages that require ICV verification (i.e., upon the first attempt of a freshness and ICV check for each received message), the Time Slave shall set the authentication build counter to 0.⌋

[SWS_CanTSyn_00217] Status: DRAFT Upstream requirements: RS_TS_20073 ⌈When StbM_GetRxFreshness returns a recoverable error code (e.g., STBM_E_BUSY), then the Time Slave shall increment the authentication build counter and shall not execute verification of the ICV.⌋

[SWS_CanTSyn_00220] ⌈If for a Time Domain cyclicMsgResumeCounter is greater than 0, then the CanTSyn shall decrement upon each invocation of CanTSyn_- MainFunction the cyclicMsgResumeCounter of the corresponding Time Domain by CanTSynMainFunctionPeriod.⌋(RS_TS_20031)

[SWS_CanTSyn_00221], [SWS_CanTSyn_00222],

[SWS_CanTSyn_00222],

[SWS_CanTSyn_00223],

[SWS_CanTSyn_00224],

[SWS_CanTSyn_00225],

[SWS_CanTSyn_00226], [SWS_CanTSyn_00227]) 3. D matches to the defined Time Domain range for each Type 4. D matches to one of the configured Time Domains (given by parameter CanTSynGlobalTimeDomainId) 5. SyncTimeNSec (FUP / OFNS / Extended OFS only) matches the defined range of StbM_TimeStampType.nanoseconds. 6. CRC (including DataID) matches depending on the CanTSynRxCrcValidated parameter 7. ICV matches depending on the CanTSynRxIcvVerificationType parameter ⌋(RS_TS_20035, RS_TS_20036, RS_TS_20073)

[SWS_CanTSyn_00227]) 3. D matches to the defined Time Domain range for each Type 4. D matches to one of the configured Time Domains (given by parameter CanTSynGlobalTimeDomainId) 5. SyncTimeNSec (FUP / OFNS / Extended OFS only) matches the defined range of StbM_TimeStampType.nanoseconds. 6. CRC (including DataID) matches depending on the CanTSynRxCrcValidated parameter 7. ICV matches depending on the CanTSynRxIcvVerificationType parameter ⌋(RS_TS_20035, RS_TS_20036, RS_TS_20073)

These requirements on Time Synchronization from the RS Time Synchronization [1] are not applicable to CanTSyn , because they refer either to network types other than CAN or to the Time Base Manager module.

[SWS_CanTSyn_91001]), • call IdsM_SetSecurityEventWithContextData with the parame- ter EventId set to SEV_TSYN_CAN_FRESHNESS_NOT_AVAILABLE (refer

[SWS_CanTSyn_CONSTR_00001] ⌈If the CSM job used to generate ICV is config- ured in synchronous behaviour, the CanTSynIcvGenerationTimeout shall be set to 0.⌋

[SWS_CanTSyn_CONSTR_00002] ⌈If the CSM job used to verify ICV is configured in synchronous behavior, the CanTSynIcvVerificationTimeout shall be set to 0.⌋

[SWS_CanTSyn_CONSTR_00003] CanTSynGlobalTimeMasterPdu and CanTSynGlobalTimeSlavePdu constraint for keeping the local buffer Status: DRAFT ⌈The configuration of CanTSynGlobalTimeMasterPdu and CanTSynGlobal- TimeSlavePdu shall refer to PDUs where KeepLocalPduBuffer is set to FALSE. Otherwise the configuration shall be rejected as invalid.⌋