FlexRay State Manager (FrSM)

The FlexRay State Manager maintains a state machine per FlexRay cluster that translates the communication requests of the ComM into wake-up, startup, and shutdown via the FlexRay Interface. FrSM_RequestComMode only stores the request; it is processed only in the cyclic main function of the cluster [SWS_FrSM_00020]. The FrSM reports reached modes to ComM and BswM. The BswM can terminate key-slot-only operation or switch all clusters to receive mode. Only FRSM_ONLINE and FRSM_LOW_NUMBER_OF_COLDSTARTERS are considered FullCom (SWS FrSM p. 38).

more ›

The FlexRay State Manager translates the communication requests of the ComM for each FlexRay cluster into calls to the FlexRay Interface. In return, it reports the bus mode via ComM_BusSM_ModeIndication and its detailed state via BswM_FrSM_CurrentState [SWS_FrSM_00096]. Optionally, it uses DEM, DET, and FrNm as well as further FrIf services [SWS_FrSM_00097]. FrSm_Init transitions all cluster state machines to FRSM_READY (SWS FrSM p. 35).

Context diagram: ComM and BswM control, SchM clocks, FrIf executes; errors go to DEM, DET, FrNm, and optionally to a CDD. Sources: [SWS_FrSM_00096], [SWS_FrSM_00097]

FrSM_RequestComMode only stores the request. Only the main function of the cluster processes it (SWS FrSM p. 36, [SWS_FrSM_00118]). In the event of a FullCom request, the condition WUReason determines whether the FrSM sends wake-up patterns itself, forwards a single-channel wake-up to the second channel, or starts up directly. During startup, it calls FrIf_StartCommunication and, for coldstart ECUs, additionally FrIf_AllowColdstart. On POC normal active, it transitions to FRSM_ONLINE (SWS FrSM p. 20, SWS FrSM p. 52). If NoCom is requested from a FullCom state, the FrSM halts communication already during the call. After t_TrcvStdbyDelay, it sets the transceivers to standby and returns to FRSM_READY [SWS_FrSM_00209].

State diagram: Eight main states per cluster and the parallel ECU passive mode. The transitions to FRSM_ONLINE_PASSIVE and FRSM_LOW_NUMBER_OF_COLDSTARTERS are interpreted. Sources: SWS FrSM p. 18, SWS FrSM p. 27

For ComM, FullCom applies only in FRSM_ONLINE and FRSM_LOW_NUMBER_OF_COLDSTARTERS (SWS FrSM p. 38). Two special operating modes are available to the BswM. FrSm_AllSlots terminates key-slot-only operation [SWS_FrSM_00172]. FrSm_SetEcuPassive switches all clusters to pure receive mode [SWS_FrSM_00174]. FrSM_BswM_StateType reports both dimensions combined [SWS_FrSM_00199]. In R20-11, some functions are still named FrSm_…, and the service IDs differ from later releases [SWS_FrSM_00020].

In the event of an error, the FrSM reports development errors such as FRSM_E_UNINIT or FRSM_E_INV_HANDLE [SWS_FrSM_91001]. If synchronization is not successful, it calls FrNm_StartupError. It optionally reports a loss of synchronization via <Cdd>_SyncLossErrorIndication [SWS_FrSM_00190].

more ›

Role: bus state manager between ComM, BswM, and FlexRay Interface

The FlexRay State Manager (FrSM) translates the communication requests of the ComM for each FlexRay cluster into control calls to the FlexRay Interface. ComM requests a ComM_ModeType for a NetworkHandleType via FrSM_RequestComMode [SWS_FrSM_00020]. The FrSM reports the reached bus mode back via ComM_BusSM_ModeIndication, and its detailed state to the BswM via BswM_FrSM_CurrentState [SWS_FrSM_00096]. It never controls controllers and transceivers directly. Instead, it uses FrIf functions bundled in the specification into functional elements such as FE_START (FrIf_StartCommunication) or FE_HALT (FrIf_HaltCommunication) (SWS FrSM p. 22).

In addition, FrSM uses optional services: Dem_SetEventStatus, Det_ReportError, FrIf_AllSlots, FrIf_GetNumOfStartupFrames, FrIf_GetWakeupRxStatus, FrIf_SetWakeupChannel, and FrNm_StartupError [SWS_FrSM_00097]. It imports its types from ComM, ComStack_Types, DEM, Fr, and FrIf, among others [SWS_FrSM_00095]. BswM also actively controls FrSM. For example, it can set it to passive mode via FrSm_SetEcuPassive() for diagnostic use cases (EXP ModeMgmt p. 36).

Context diagram: FrSM is located between the requesters ComM/BswM, the clock generator SchM, and the executing FrIf, and reports errors to DEM, DET, FrNm, and an optional CDD. Sources: [SWS_FrSM_00096], [SWS_FrSM_00097], [SWS_FrSM_00118], [SWS_FrSM_00190]

State machine per cluster and parallel ECU passive mode

FrSM maintains a separate state machine with eight states for each cluster: FRSM_READY, FRSM_WAKEUP, FRSM_STARTUP, FRSM_HALT_REQ, FRSM_ONLINE, FRSM_ONLINE_PASSIVE, FRSM_KEYSLOT_ONLY, and FRSM_LOW_NUMBER_OF_COLDSTARTERS. Each state is assigned to a POC state of the controller:

• FRSM_ONLINE corresponds to POC:normal active with full communication.
• FRSM_ONLINE_PASSIVE corresponds to POC:normal passive. Due to clock synchronization errors, no data is transmitted or received there.
• In FRSM_KEYSLOT_ONLY, transmission is only permitted in the key slots.

SWS FrSM p. 18 describes this mapping. The transitions are defined in tabular form, and FrSM executes their actions in the sequence specified there (SWS FrSM p. 24).

In parallel, there are the states FRSM_ECU_ACTIVE and FRSM_ECU_PASSIVE (SWS FrSM p. 18). FrSm_SetEcuPassive switches all clusters of the ECU jointly to receive-only mode or back [SWS_FrSM_00174]. If a cluster is not in FRSM_READY during this, FrSM executes FE_TRCV_NORMAL for it (SWS FrSM p. 40). FrSM_BswM_StateType maps both dimensions: for each main state, there is a value with suffix _ECU_PASSIVE, from FRSM_BSWM_READY (0x00) to FRSM_LOW_NUMBER_OF_COLDSTARTERS_ECU_PASSIVE (0x0F) [SWS_FrSM_00199]. The two passive concepts must not be confused. ONLINE_PASSIVE is a fault consequence of synchronization, whereas ECU_PASSIVE is intentional receive mode.

Externally, only the mode provided by FrSM_GetCurrentComMode counts. COMM_FULL_COMMUNICATION applies exclusively in FRSM_ONLINE and FRSM_LOW_NUMBER_OF_COLDSTARTERS; in all other states, COMM_NO_COMMUNICATION applies (SWS FrSM p. 38, [SWS_FrSM_00024]). SilentCom is not supported on FlexRay (SWS FrSM p. 18).

State diagram: Main state machine per cluster with the paths Wakeup → Startup → Online as well as Halt → Ready, alongside the ECU passive mode common to all clusters. Interpretation: The transitions to FRSM_ONLINE_PASSIVE and FRSM_LOW_NUMBER_OF_COLDSTARTERS are derived from the state table and conditions. Sources: SWS FrSM p. 27, SWS FrSM p. 18, SWS FrSM p. 20, [SWS_FrSM_00209]

From FrSm_Init to full communication: Wakeup and startup

FrSm_Init is synchronous and non-reentrant. The function receives a pointer to FrSM_ConfigType, the implementation-specific post-build configuration ([SWS_FrSM_00013], [SWS_FrSM_00198]). It sets all cluster state machines to FRSM_READY (transition T00) and stores the configuration address. If FrSMDevErrorDetect is active, it also notes the successful initialization (SWS FrSM p. 35).

FrSM_RequestComMode operates asynchronously. The function stores the requested mode as reqComMode. It is only processed during the next run of FrSM_MainFunction_<FrSMCluster.ShortName> in the state machine of the affected cluster (SWS FrSM p. 36). There is one main function per cluster, provided via SchM_FrSm.h [SWS_FrSM_00118]. Its call rate likely follows parameter FrSMMainFunctionCycleTime (SWS FrSM p. 62). Question (open)

Upon a FullCom request in FRSM_READY, FrSM evaluates condition WUReason. If FrSMCheckWakeupReason is set, it queries each transceiver via FrIf_GetTransceiverWUReason. The result is NO_WU_BY_BUS, PARTIAL_WU_BY_BUS, or ALL_WU_BY_BUS; without checking, NO_WU_BY_BUS applies (SWS FrSM p. 20). If the ECU was woken up by the bus, it starts up without its own wakeup (SWS FrSM p. 52). If wakeup arrived on only one channel in a dual-channel node, FE_SET_WU_CHANNEL_FORWARD forwards it to the other channel (SWS FrSM p. 22, SWS FrSM p. 56).

Activity diagram: WUReason determines whether FrSM wakes up itself, forwards a wakeup, or starts up directly. Interpretation: The branch for non-wakeup ECUs is derived from FrSMIsWakeupEcu. Sources: SWS FrSM p. 20, SWS FrSM p. 22, SWS FrSM p. 54

In FRSM_WAKEUP, FrSM transmits wakeup patterns via FE_WAKEUP, i.e., FrIf_SendWUP per controller. It repeats this until FrSMNumWakeupPatterns is reached or bus traffic was detected (busTrafficDetected). If a controller transitions to HALT due to an error, transmission is aborted (SWS FrSM p. 27).

Activity diagram: Repeated transmission of wakeup patterns with evaluation of vPOC!WakeupStatus and abort upon controller HALT. Sources: SWS FrSM p. 27, SWS FrSM p. 18

Startup begins with FrIf_StartCommunication. FrSM calls FrIf_AllowColdstart only in FrSMIsColdstartEcu (SWS FrSM p. 22). Afterwards, it reports FRSM_STARTUP to BswM. As soon as the POC status is normal active, FrIf_SetState(FRIF_GOTO_ONLINE), the indication FRSM_ONLINE, and the mode indication to ComM follow (SWS FrSM p. 50, SWS FrSM p. 52).

Sequence diagram: Single-channel wakeup and startup up to FRSM_ONLINE, distributed across several runs of the main function. Interpretation: The order within the runs is reconstructed from the specification figures and simplified. Sources: SWS FrSM p. 50, SWS FrSM p. 52, [SWS_FrSM_00118]

Key-slot-only operation, enabling of all slots, and few coldstarters

If the controller is configured with pKeySlotOnlyEnabled, startup initially ends in FRSM_KEYSLOT_ONLY. This state corresponds to POC:normal active with vPOCSlotMode ≠ AllSlots (SWS FrSM p. 18, SWS FrSM p. 55). It is exited via FrSm_AllSlots [SWS_FrSM_00172]. The function calls FrIf_AllSlots for each controller of the cluster and only returns E_OK if all calls resulted in E_OK. It can be disabled at pre-compile time via FrSMAllSlotsSupport (SWS FrSM p. 41). According to the specification figure, BswM enables full operation. Only then does FrSM report FRSM_ONLINE and FullCom to ComM (SWS FrSM p. 57).

Sequence diagram: Two-stage ramp-up: first key slots only, then enabling of all slots via FrSm_AllSlots. The specification figure labels the BswM indication as FRSM_ONLINE_KEYSLOT_ONLY; here, the R20-11 value FRSM_BSWM_KEYSLOT_ONLY is used. Sources: SWS FrSM p. 57, SWS FrSM p. 55, [SWS_FrSM_00172], [SWS_FrSM_00199]

FRSM_LOW_NUMBER_OF_COLDSTARTERS denotes full communication where the cluster is synchronized only via sync frames (SWS FrSM p. 18). Condition lowNumberOfColdstarters is fulfilled if FrIf_GetNumOfStartupFrames() reports fewer startup frames than specified by the optional parameter FrSMMinNumberOfColdstarter (SWS FrSM p. 20).

Return to NoCom and cluster timers

NoCom can be requested while the state machine is in FRSM_ONLINE, FRSM_KEYSLOT_ONLY, FRSM_LOW_NUMBER_OF_COLDSTARTERS, or FRSM_ONLINE_PASSIVE. In this case, FrSM_RequestComMode already processes the transition without waiting for the main function (SWS FrSM p. 36). This includes FrIf_SetState(FRIF_GOTO_OFFLINE), FrIf_HaltCommunication, and the indication HALT_REQ to BswM. In later runs, FrSM reports NoCom to ComM, reinitializes the controllers, sets the transceivers to STANDBY, and reports READY (SWS FrSM p. 58).

Sequence diagram: From FullCom to NoCom. The halt takes place synchronously in the request call; reinitialization and standby follow with a delay in the main function. Interpretation: The order is reconstructed from the specification figure. Sources: SWS FrSM p. 58, SWS FrSM p. 36, [SWS_FrSM_00209]

FrSM operates with multiple timers per cluster (SWS FrSM p. 21):

• t1 delays FrIf_AllowColdstart. With FrSMDurationT1 = 0, the call directly follows FrIf_StartCommunication.
• t2 determines the time after which startup is repeated.
• t3 monitors the transition to FullCom.
• t4 ensures that a dual-channel node clears its coldstart inhibit bit.
• t_TrcvStdbyDelay delays reinitialization and standby. If FrSMTrcvStdbyDelay is not configured or 0, the state machine transitions immediately from FRSM_HALT_REQ to FRSM_READY [SWS_FrSM_00209].

Configuration per FrSMCluster and interface status R20-11

The container FrSMCluster (1..*) describes a cluster that can comprise multiple controllers on an ECU. It contains:

• the timers FrSMDurationT1 to FrSMDurationT4,
• the roles FrSMIsColdstartEcu and FrSMIsWakeupEcu,
• FrSMNumWakeupPatterns and FrSMStartupRepetitions,
• the references FrSMComMNetworkHandleRef and FrSMFrIfClusterRef.

SWS FrSM p. 62 describes these contents. In addition, FrSMVersionInfoApi for FrSM_GetVersionInfo and FrSMSyncLossErrorIndicationName are globally configurable (SystemTemplate p. 1528, [SWS_FrSM_00029]).

Many detailed passages originate from later releases. For R20-11, the requirements apply, and they deviate in some points:

• The functions are named FrSm_Init, FrSm_AllSlots, and FrSm_SetEcuPassive and are available via FrSm.h.
• FrSM_RequestComMode has the service ID 0x02 and is reentrant for different clusters. Later passages mention 0x40 and other parameter names.
• FrSM_GetCurrentComMode has the service ID 0x03 in R20-11.

References: [SWS_FrSM_00013], [SWS_FrSM_00020], [SWS_FrSM_00024], SWS FrSM p. 36.

Behavior in the event of an error

The following codes are defined for development errors [SWS_FrSM_91001]:

• FRSM_E_PARAM_POINTER: invalid pointer. The service returns immediately.
• FRSM_E_INV_HANDLE: invalid network handle.
• FRSM_E_UNINIT: module not initialized.
• FRSM_E_INV_MODE: invalid communication mode.
• FRSM_INIT_FAILED: initialization failed.

Some cases are explicitly regulated. FrSm_AllSlots reports FRSM_E_INV_HANDLE upon an invalid handle and returns E_NOT_OK (SWS FrSM p. 41). FrSm_SetEcuPassive reports a development error prior to initialization (SWS FrSM p. 40). FrSM_GetCurrentComMode returns E_NOT_OK in R20-11 without prior initialization [SWS_FrSM_00024].

FrSM responds at the bus level as follows:

• Upon clock synchronization errors, the cluster drops into FRSM_ONLINE_PASSIVE (SWS FrSM p. 18).
• If synchronization fails, FrSM calls FrNm_StartupError [SWS_FrSM_00097].
• Startup is repeated after t2 (SWS FrSM p. 21). FrSMStartupRepetitions is presumed to limit the number of repetitions. Question (open)

FrSM reports the startup status as DEM event FRSM_E_CLUSTER_STARTUP, in case of success with PASSED (SWS FrSM p. 52). The event IDs are located in FrSMClusterDemEventParameterRefs (SWS FrSM p. 62). Optionally, <Cdd>_SyncLossErrorIndication informs about a loss of synchronization with true. With false, the function indicates that synchronization has been restored or the FullCom request was withdrawn [SWS_FrSM_00190]. Without a configured function name, this notification is omitted (SystemTemplate p. 1528).

Further detailed evidence

• API core: initialization, mode request and query ([SWS_FrSM_00013], [SWS_FrSM_00020], [SWS_FrSM_00024]), as well as the cyclic main function per cluster [SWS_FrSM_00118].
• Special operation: enabling of all slots [SWS_FrSM_00172] and ECU passive mode [SWS_FrSM_00174].
• State notifications to BswM [SWS_FrSM_00199] and configuration type [SWS_FrSM_00198].
• Interfaces: required [SWS_FrSM_00096], optional [SWS_FrSM_00097], and configurable [SWS_FrSM_00190].
• State machine: states, variables, conditions, functional elements, and transition table (SWS FrSM p. 18, SWS FrSM p. 20, SWS FrSM p. 22, SWS FrSM p. 27).
• Timers and error codes: [SWS_FrSM_00209], [SWS_FrSM_91001], SWS FrSM p. 21.
• Procedures as sequences: wakeup, passive startup, dual-channel wakeup with and without forwarding, key-slot-only, and shutdown (SWS FrSM p. 50 to SWS FrSM p. 58).