Time Sync Over FlexRay (FrTSyn)

This function initializes the Time Synchronization over FlexRay.

Returns the version information of this module.

This API is used to turn on and off the TX capabilities of the FrTSyn.

Indication of a received PDU from a lower layer communication interface module.

Within this API, the upper layer module (called module) shall check whether the available data fits into the buffer size reported by PduInfoPtr->SduLength. If it fits, it shall copy its data into the buffer provided by PduInfoPtr->SduDataPtr and update the length of the actual copied data in PduInfoPtr->SduLength. If not, it returns E_NOT_OK without changing PduInfoPtr.

Main function for cyclic call / resp. Timesync message transmission

By this API service the FrTSyn gets an indication and the result of ICV generation.

By this API service the FrTSyn gets an indication and the result of ICV verification.

This is the base type for the configuration of the Time Synchronization over FlexRay. A pointer to an instance of this structure will be used in the initialization of the Time Synchronization over FlexRay. The content of this structure is defined in chapter 10 Configuration specification.

Handles the enabling and disabling of the transmission mode

A call to FrTSyn_Init initializes all internal vari- ables and sets the Time Synchronization over FlexRay to the initialized state.

The Sequence Counter ( SC ) shall be initialized with 0.

The byte order for time values inside Time Synchronization messages is "Big Endian".

The PayloadLength is 16.

Time Synchronization messages contain User Data according to the given message format.

User Data shall be read consistently from the incoming Time Synchronization messages.

User Data shall be written consistently to outgoing Time Syn- chronization messages. If the number of User Data Fields in a Time Synchronization message is greater than the number of User Data Bytes provided by the StbM, the remaining User Data Fields shall be set to 0 (default value).

User Data shall be mapped to the StbM_UserDataType , where the byte number given in the message and by the StbM_UserDataType shall match (User Byte 0 mapped to StbM_UserDataType . userByte0 etc.). StbM_- UserDataType . userDataLength shall be set to the Time Synchronization message type specific number of User Bytes.

0 Type 0x10 Message Type 1 User Byte 2 default: 0 2 7..4 D 0..15 Time Domain Id 3..0 SC 0..15 Sequence Counter 3 7..2 FCNT 0..63 FlexRay Cycle Counter 1 SGW 0 = SyncToGTM 1 = SyncToSubDomain 0 reserved 0 4 User Byte 0 default: 0 5 User Byte 1 default: 0 6..11 SyncTimeSec 48 Bit time value in seconds 12..15 SyncTimeNSec 32 Bit time value in nanoseconds Table 7.1: SYNC not CRC secured message format

0 Type 0x20 Message Type 1 CRC 0..255 Checksum 2 7..4 D 0..15 Time Domain Id 3..0 SC 0..15 Sequence Counter 3 7..2 FCNT 0..63 FlexRay Cycle Counter 1 SGW 0 = SyncToGTM 1 = SyncToSubDomain 0 reserved 0 4 User Byte 0 default: 0 5 User Byte 1 default: 0 6..11 SyncTimeSec 48 Bit time value in seconds 12..15 SyncTimeNSec 32 Bit time value in nanoseconds Table 7.2: SYNC CRC secured message format

A Time Synchronization message sequence consists of a SYNC message per Time Domain.

For each configured Time Master (refer to FrTSynGlobal- TimeMaster ) the FrTSyn module shall periodically transmit SYNC messages with the cycle FrTSynGlobalTimeTxPeriod including the time value, which will be valid at the start of the next FlexRay cycle 0 and User Data, if the GLOBAL_TIME_BASE bit within the timeBaseStatus is set and FrTSynGlobalTimeTxPeriod is unequal to 0 and if the associated cyclicMsgResumeCounter is not running. The cyclic transmission shall be started in the earliest possible FrT- Syn_MainFunction call once the requirements above are fulfilled.

The SGW value (Time Gateway synchronization status) shall be retrieved from the Time Base synchronization status. If the SYNC_TO_GATEWAY bit within timeBaseStatus is not set the SGW value shall be SyncToGTM . Otherwise the SGW value shall be set to SyncToSubDomain .

Depending on FrTSynGlobalTimeTxCrcSecured the SYNC message shall be of type: FrTSynGlobalTimeTxCrcSecured Value SYNC Message Type CRC_NOT_SUPPORTED 0x10 SYNC not CRC secured message CRC_SUPPORTED 0x20 SYNC CRC secured message Table 7.5

An offset message sequence consists of an OFS message per Time Domain.

For each configured Time Master ( FrTSynGlobalTimeMas- ter ) the FrTSyn module shall periodically transmit OFS messages with the cycle FrTSynGlobalTimeTxPeriod ) including the Offset Time value and User Data, if the GLOBAL_TIME_BASE bit within the timeBaseStatus is set and FrTSynGlobal- TimeTxPeriod is unequal to 0 and if the associated cyclicMsgResumeCounter is not running. The cyclic transmission shall be started in the earliest possible FrTSyn_MainFunc- tion call once the requirements above are fulfilled.

Depending on FrTSynGlobalTimeTxCrcSecured the OFS message shall be of type: FrTSynGlobalTimeTxCrcSecured Value OFS Message Type CRC_NOT_SUPPORTED 0x34 OFS not CRC secured message CRC_SUPPORTED 0x44 OFS CRC secured message Table 7.6

If FrTSyn_SetTransmissionMode(Controller, Mode) is called and parameter Mode equals FRTSYN_TX_OFF , all trans- mit requests from FrTSyn shall be omitted on this FlexRay channel.

If FrTSyn_SetTransmissionMode(Controller, Mode) is called and parameter Mode equals FRTSYN_TX_ON , all transmit re- quests from FrTSyn on this FlexRay channel shall be able to be transmitted.

The transmitter of a Synchronized Time Base (Time Master) shall perform the following steps to distribute the Synchronized Time Base: 1. Retrieve current Synchronized Time Base's Time Tuple as [T SYNC ;T0 VLT ] via StbM_BusGetCurrentTime 2. Protect the following two steps against interruptions: (a) Get currentCycle and currentMacroticks via FrIf_GetGlobal- Time (b) Retrieve current Virtual Local Time value as T1 VLT via StbM_GetCur- rentVirtualLocalTime 3. Calculate the (future) time value of the Time Base at the start of the next FlexRay cycle by T0 = T SYNC + (T1 VLT - T0 VLT ) + (64 - currentCycle ) * CycleLength - ( CycleLength / MacroticksPerCycle ) * currentMacroticks 4. Calculate SyncTimeSec (second portion of T0) and SyncTimeNSec (nanosec- ond portion of T0)

The transmitter of an Offset Time Base (Time Master) shall perform the following steps to distribute the Offset Time Base: 1. Retrieve current Offset Time via StbM_GetOffset 2. Write second portion of the Offset Time to OfsTimeSec 3. Write nanosecond portion of the Offset Time to OfsTimeNSec

A Sequence Counter ( SC ) of 4 bit is representing numbers from 0 to 15 per Time Domain. The Sequence Counter shall be independent be- tween SYNC and OFS messages and shall be incremented by 1 on every transmis- sion request of a SYNC or OFS message. It shall wrap around at 15 to 0 again.

The function Crc_CalculateCRC8H2F as defined in [6] shall be used to calculate the CRC , if configured.

The DataID shall be calculated as DataID = Data IDList[SC] , where DataIDList is given by configuration for each message type (refer to FrTSynGlobalTimeSyncDataIDList and FrTSynGlobalTimeOfs- DataIDList ).

The CRC shall be calculated over Time Synchroniza- tion message Byte 2 to Byte 15 and DataID , where Byte 2 is applied first, followed by the other bytes in ascending order, and DataID last.

For each transmission of a Time Synchronization message the FrTSyn module shall assemble the message as follows: • Calculate SC • Copy currentCycle (refer to [SWS_FrTSyn_00028]) to FCNT (for SYNC mes- sage) • Calculate SGW • Copy all data to the appropriate position within the related message • Calculate CRC (configuration dependent)

The FrTSyn shall only accept a SYNC message with Type equal to 0x20 and a correct CRC value if FrTSynRxCrcValidated is configured to CRC_VALIDATED .

The FrTSyn shall only accept a SYNC message with Type equal to 0x10 if FrTSynRxCrcValidated is configured to CRC_NOT_VALIDATED .

The FrTSyn shall only accept a SYNC message with Type equal to 0x10 or 0x20 if FrTSynRxCrcValidated is configured to CRC_IGNORED .

For valid SYNC messages a new Time Tuple, consisting of the Global Time value and the associated value of the Virtual Local Time, shall be calculated and forwarded to the StbM module via StbM_BusSetGlobalTime .

The FrTSyn shall only accept an OFS message with Type equal to 0x44 and a correct CRC value if FrTSynRxCrcValidated is configured to CRC_VALIDATED .

The FrTSyn shall only accept an OFS message with Type equal to 0x34 if FrTSynRxCrcValidated is configured to CRC_NOT_VALIDATED .

The FrTSyn shall only accept an OFS message with Type equal to 0x34 or 0x44 if FrTSynRxCrcValidated is configured to CRC_IGNORED .

For valid OFS messages a new Time Tuple, consisting of the Offset Time value and the associated value of the Virtual Local Time, shall be calculated (according [SWS_FrTSyn_00047]) and forwarded to the StbM module via StbM_BusSetGlobalTime .

The receiver of a Synchronized Time Base shall perform the following steps to assemble the Synchronized Time Base: 1. On SYNC message RX indication (or in the subsequent MainFunction call) store received time value T0 ( SyncTimeSec , SyncTimeNSec ) 2. Protect the following two steps against interruptions: (a) Get currentCycle and currentMacroticks via FrIf_GetGlobal- Time (b) Retrieve current Virtual Local Time value as T1 VLT via StbM_GetCur- rentVirtualLocalTime 3. Calculate Time Tuple [T1; T1 VLT ] to update the Time Slave's local instance of the Time Base: (a) T1 = T0 + ( CycleLength * currentCycle ) + (( CycleLength / MacrotickPerCycle ) * currentMacroticks ) (b) If currentCycle is greater or equal than the retrieved FCNT value from the transmitter (Time Master), then the calculated value T1 shall be subtracted by 64 times the FlexRay cycle duration: T1 = T1 - ( CycleLength * 64)

The receiver of an Offset Time Base shall perform the follow- ing steps to assemble the Offset Time: 1. Get second portion of the Offset Time out of OfsTimeSec 2. Get nanosecond portion of the Offset Time out of OfsTimeNSec 3. Retrieve current Virtual Local Time value via StbM_GetCurrentVirtualLo- calTime

The Sequence Counter Jump Width between two consecutive SYNC or two consecutive OFS messages of the same Time Domain shall be greater than 0 and smaller than or equal to FrTSynGlobalTimeSequenceCounterJump- Width . Otherwise a Time Slave shall discard the respective SYNC / OFS message. If the FrTSynGlobalTimeSequenceCounterJumpWidth value is set to 0, the Time Slave shall not do Sequence Counter Jump Width checks.

Upon reception of a SYNC (or OFS) message a Time Slave shall check the Sequence Counter of the received message per Time Domain against the configured value of FrTSynGlobalTimeSequenceCounterJumpWidth (ac- cording to [SWS_FrTSyn_00048]), unless it is the first message • at Startup or • after a Time Base update timeout has been detected ( TIMEOUT bit set in Time Base synchronization status timeBaseStatus ).

The function Crc_CalculateCRC8H2F as defined in [6] shall be used to validate the CRC , if configured.

The DataID shall be calculated as DataID = DataIDList [SC] , where DataIDList is given by configuration for each message Type .

The CRC shall be calculated over Time Synchroniza- tion message Byte 2 to Byte 15 and DataID , where Byte 2 is applied first, followed by the other bytes in ascending order, and DataID last.

For each received Time Synchronization message the FrT- Syn shall validate the message as follows (all conditions must match): 1. Type matches depending on the FrTSynRxCrcValidated parameter 2. SC value is within the accepted range (refer to [SWS_FrTSyn_00048] and [SWS_FrTSyn_00049]) 3. D matches to the defined Time Domain range for each Type 4. D matches to one of the configured Time Domains 5. SyncTimeNSec (SYNC message) or OfsTimeNSec (OFS message) matches the defined range of StbM_TimeStampType . nanoseconds . 6. CRC (including DataID ) matches depending on the FrTSynRxCrcValidated parameter.

For each received Time Synchronization message the FrTSyn shall disassemble the message after successful validation [SWS_FrTSyn_00056].

On errors and exceptions, the FrTSyn module shall not mod- ify its current module state but shall simply report the error event.

Type of error Related error code Error value API service called with wrong PDU or SDU. FRTSYN_E_INVALID_PDUID 0x01 API service used in un-initialized state FRTSYN_E_UNINIT 0x20 A pointer is invalid FRTSYN_E_NULL_POINTER 0x21 Type of error Related error code Error value FrTSyn initialization failed FRTSYN_E_INIT_FAILED 0x22 API called with invalid parameter FRTSYN_E_PARAM 0x23 Invalid Controller index FRTSYN_E_INV_CTRL_IDX 0x24

Module Header File Imported Type ComStack_Types.h PduIdType ComStack_Types ComStack_Types.h PduInfoType Module Header File Imported Type ComStack_Types.h PduLengthType FrIf FrIf.h FrIf_StateType Rte_StbM_Type.h StbM_FrTimeMasterMeasurementType Rte_StbM_Type.h StbM_FrTimeSlaveMeasurementType Rte_StbM_Type.h StbM_SynchronizedTimeBaseType Rte_StbM_Type.h StbM_TimeBaseStatusType Rte_StbM_Type.h StbM_TimeStampShortType Rte_StbM_Type.h StbM_TimeStampType Rte_StbM_Type.h StbM_UserDataType StbM.h StbM_MeasurementType StbM StbM.h StbM_VirtualLocalTimeType Std_Types.h Std_ReturnType Std Std_Types.h Std_VersionInfoType

The callback function FrTSyn_RxIndication shall inform the Det , if development error detection is enabled FrTSynDevErrorDetect is set to TRUE ) and if function call has failed because of the following reasons: • Invalid RxPduId (FRTSYN_E_INVALID_PDUID) • PduInfoPtr or SduDataPtr equals NULL_PTR (FRTSYN_E_NULL_ POINTER)

The callback function FrTSyn_TriggerTransmit shall in- form the Det , if development error detection is enabled FrTSynDevErrorDetect is set to TRUE ) and if function call has failed because of the following reasons: • Invalid TxPduId (FRTSYN_E_INVALID_PDUID) • PduInfoPtr or SduDataPtr equals NULL_PTR (FRTSYN_E_NULL_ POINTER)

The frequency of invocations of FrTSyn_MainFunction is determined by the configuration parameter FrTSynMainFunctionPeriod .

FrIf_GetCycleLength FrIf.h This API returns the configured time of the configuration parameter "GdCycle" in nanoseconds for the FlexRay controller with index FrIf_CtrlIdx. FrIf_GetGlobalTime FrIf.h Wraps the FlexRay Driver API function Fr_Get GlobalTime(). Important Note: FrIf_GetGlobalTime may be called within an exclusive area. FrIf_GetMacrotickDuration FrIf.h Retrieves the Duration of a Macrotick in ns FrIf_GetMacroticksPerCycle FrIf.h Retrieves the amount of Macroticks per Cycle FrIf_GetState FrIf.h Get current FrIf state. StbM_GetCurrentVirtualLocalTime StbM.h Returns the Virtual Local Time of the referenced Time Base.

Crc_CalculateCRC8H2F Crc.h This service makes a CRC8 calculation with the Polynomial 0x2F on Crc_Length Det_ReportError Det.h Service to report development errors. FrIf_Transmit FrIf.h Requests transmission of a PDU. StbM_BusGetCurrentTime StbM.h Returns the current Time Tuple, status and User Data of the Time Base. StbM_BusSetGlobalTime StbM.h Allows the Time Base Provider Modules to forward a new Global Time tuple (i.e., Rx Time Tuple) to the StbM. StbM_FrSetMasterTimingData (draft) StbM_FrTSyn.h Provides Flexray Timesyn module specific data for a Time Master to the StbM. Tags: atp.Status=draft StbM_FrSetSlaveTimingData (draft) StbM_FrTSyn.h Allows the FrTSyn Module to forward Flexray specific details to the StbM. Tags: atp.Status=draft StbM_GetCurrentTime StbM.h Returns a time value (Local Time Base derived from Global Time Base) in standard format. Note: This API shall be called with locked interrupts / within an Exclusive Area to prevent interruption (i.e., the risk that the time stamp is outdated on return of the function call). StbM_GetOffset StbM.h Allows the Timesync Modules to get the current Offset Time and User Data. StbM_GetTimeBaseStatus StbM.h Returns detailed status information for a Synchronized (or Pure Local) Time Base and, if called for an Offset Time Base, for the Offset Time Base and the underlying Synchronized Time Base. StbM_GetTimeBaseUpdateCounter StbM.h Allows the Timesync Modules to detect, whether a Time Base should be transmitted immediately in the subsequent <Bus>TSyn_MainFunction() cycle.

The Time Synchronization over FlexRay shall support the configuration for Time Master, Time Slave and Time Gateway.

The FrTSyn module shall call FrIf_GetGlobalTime only if FrIf_GetState returns FRIF_STATE_ONLINE . This is to ensure that FrIf_Get- GlobalTime returns valid time information, i.e. that the FlexRay communication con- troller is synchronous to the FlexRay global time.

0 Type 0x34 Message Type 1 User Byte 2 default: 0 2 7..4 D 16..31 Time Domain Id 3..0 SC 0..15 Sequence Counter 3 7..2 reserved 0 1 SGW 0 = SyncToGTM 1 = SyncToSubDomain 0 reserved 0 4 User Byte 0 default: 0 5 User Byte 1 default: 0 6 reserved 0 7 reserved 0 8..11 OfsTimeSec 32 Bit offset time value in seconds 12..15 OfsTimeNSec 32 Bit offset time value in nanoseconds Table 7.3: OFS not CRC secured message format

0 Type 0x44 Message Type 1 CRC 0..255 Checksum 2 7..4 D 16..31 Time Domain Id 3..0 SC 0..15 Sequence Counter 3 7..2 reserved 0 1 SGW 0 = SyncToGTM 1 = SyncToSubDomain 0 reserved 0 4 User Byte 0 default: 0 5 User Byte 1 default: 0 6 reserved 0 7 reserved 0 8..11 OfsTimeSec 32 Bit offset time value in seconds 12..15 OfsTimeNSec 32 Bit offset time value in nanoseconds Table 7.4: OFS CRC secured message format

The FrTSyn shall only accept a SYNC message with Type equal to 0x10 or a SYNC message with Type equal to 0x20 and a correct CRC value if FrTSynRxCrcValidated is configured to CRC_OPTIONAL .

The FrTSyn shall only accept an OFS message with Type equal to 0x34 or an OFS message with Type equal to 0x44 and a correct CRC value if FrTSynRxCrcValidated is configured to CRC_OPTIONAL .

If FrTSynGlobalTimeDebounceTime ) is greater than 0 for a Time Base, FrTSyn shall always do debouncing for the corresponding Timesync PDUs as described below, otherwise FrTSyn shall not do any debouncing.

FrTSynGlobalTimeDebounceTime represents the de- bounce value of a debounceCounter of a Time Base. FrTSyn shall reload the de- bounceCounter after a Timesync PDU for the corresponding Time Base (SYNC and OFS) has been sent. FrTSyn shall decrement the debounceCounter value on each invocation of FrTSyn_MainFunction , if no Timesync PDU is transmitted.

A new Timesync PDU shall only be sent if the corresponding debounceCounter has a value equal or less than zero.

If FrTSynImmediateTimeSync is set to TRUE for a Time Base, FrTSyn shall check on each FrTSyn_MainFunction call by calling StbM_- GetTimeBaseUpdateCounter , if the timeBaseUpdateCounter of the corre- sponding Time Base has changed.

If FrTSynImmediateTimeSync is set to TRUE and the time BaseUpdateCounter of a Time Base has changed and the GLOBAL_TIME_BASE bit of the timeBaseStatus is set, FrTSyn shall trigger an immediate transmission of Time Synchronization messages for the corresponding Time Base.

If FrTSynImmediateTimeSync is set to TRUE , cyclicMs- gResumeCounter and FrTSynCyclicMsgResumeTime shall be considered.

FrTSynCyclicMsgResumeTime represents the timeout value of a cyclicMsgResumeCounter that shall be started when either a SYNC or OFS message has been sent immediately, asynchronous to the cyclic Timesync message transmission. cyclicMsgResumeCounter shall be decremented on each invocation of FrTSyn_MainFunction , if no Timesync PDU is transmitted asyn- chronously.

If the cyclicMsgResumeCounter has reached a value equal or less than zero, FrTSyn shall resume cyclic Timesync message transmis- sion by sending either a SYNC or OFS message.

On an invocation of StbM_BusSetGlobalTime the member pathDelay of the measureDataPtr structure shall be set to 0.

If the cyclicMsgResumeCounter is started, FrTSyn shall stop cyclic Timesync message transmission.

If the SGW value (SYNC and OFS) is set to SyncToSubDo- main , the SYNC_TO_GATEWAY bit within timeBaseStatus shall be set to TRUE . Oth- erwise, it shall be set to FALSE .

The function FrTSyn_SetTransmissionMode shall inform the Det , if development error detection is enabled ( FrTSynDevErrorDetect is set to TRUE ) and if function call has failed because of the following reasons: • Invalid CtrlIdx (FRTSYN_E_INV_CTRL_IDX) • Invalid Mode (FRTSYN_E_PARAM)

The FrTSyn shall support Time Validation, if FrTSyn- TimeValidationSupport set to TRUE .

If • FrTSynTimeValidationSupport is enabled and • FrTSynEnableTimeValidation for the Time Domain is enabled FrTSyn shall do time recording for Time Validation for that Time Domain.

If • time recording for Time Validation is enabled for a Time Domain (refer to [SWS_FrTSyn_00096] and [SWS_FrTSyn_00097]) and • FrTSyn is configured as Time Slave for that Time Domain, FrTSyn shall call StbM_FrSetSlaveTimingData upon successful reception of a SYNC message. StbM_FrSetSlaveTimingData shall be called after StbM_BusSetGlobalTime .

Upon invocation of StbM_FrSetSlaveTimingData FrT- Syn shall pass following values • the Sequence Counter as received in the SYNC message, • the segment id of the physical channel on which the SYNC message has been received (refer to parameter FrTSynGlobalTimeNetworkSegmentId ) • currentCycle and currentMacroticks and FCNT as read upon reception of the SYNC message (refer to step 2 in [SWS_FrTSyn_00046]), • CycleLength and MacrotickDuration • the Sync ingress timestamp T1 VLT as retrieved in step 1 in [SWS_FrTSyn_00046]) • T0 as received in the SYNC message (refer to step 1 in [SWS_FrTSyn_00046]), by the parameter measureDataPtr . Struct members • measureDataPtr → referenceLocalTimestamp and • measureDataPtr → referenceGlobalTimestamp shall be passed as 0.

If • time recording for Time Validation is enabled for a Time Domain (refer to [SWS_FrTSyn_00096] and [SWS_FrTSyn_00097]) and • FrTSyn is configured as Time Master for that Time Domain, FrTSyn shall call StbM_FrSetMasterTimingData upon successful transmission of a SYNC message.

Upon invocation of StbM_FrSetMasterTimingData FrT- Syn shall pass the following data • the Sequence Counter as sent in the SYNC message • the segment id of the physical channel on which the SYNC message has been sent (refer to parameter FrTSynGlobalTimeNetworkSegmentId ) • currentCycle and currentMacroticks read upon construction of the Sync message (refer to step 2 in [SWS_FrTSyn_00028]), • cycleLength and macrotickDuration • the reference timestamp T1 VLT (refer to step 2 In [SWS_FrTSyn_00028]), • T0 as sent in the SYNC message (refer to step 3 In [SWS_FrTSyn_00028]), by the parameter measureDataPtr .

While a Time Base Timeout is present ( TIMEOUT bit is set in Time Base synchronization status timeBaseStatus ), FrTSyn shall discard SYNC (or OFS) messages until it has successfully validated (refer to [SWS_FrTSyn_00048]) 'n' consecutive SYNC (or OFS) messages ('n' is given by the parameter FrTSynGlob- alTimeSequenceCounterHysteresis ).

[SWS_FrTSyn_00103]) ⌋(RS_TS_20074) Refer to the chapter 10.2.5 in [7] for the configuration details of CSM job used for ICV generation.

[SWS_FrTSyn_00114] Upstream requirements: RS_TS_20074 ⌈When: • the FV is referenced (refer FrTSynIcvGenerationFvIdRef), • and the configured truncated FV length (StbMFreshnessValueTruncLength) is equal to the FV length (StbMFreshnessValueLength), the Time Master shall call StbM_GetTxFreshness to obtain the FV by using the StbMFreshnessValueId (referenced via the FrTSynIcvGenerationFvIdRef pa- rameter).⌋

[SWS_FrTSyn_00115] Upstream requirements: RS_TS_20074 ⌈When: • the FV is referenced (refer FrTSynIcvGenerationFvIdRef), • and the configured truncated FV length (StbMFreshnessValueTruncLength) < FV length (StbMFreshnessValueLength), the Time Master shall call StbM_GetTxFreshnessTruncData to obtain the FV and the truncated FV by using the StbMFreshnessValueId (referenced via the FrTSyn- IcvGenerationFvIdRef parameter).⌋ Note: Having the configured truncated FV length (StbMFreshnessValueTrun- cLength) > FV length (StbMFreshnessValueLength) in StbM is not a valid con- figuration. FlexRay

[SWS_FrTSyn_00116] Upstream requirements: RS_TS_20074 ⌈When the FV is not referenced (refer FrTSynIcvGenerationFvIdRef), the Time Master shall not include the FV in the ICV generation and neither in the SYNC mes- sage.⌋

[SWS_FrTSyn_00117] Upstream requirements: RS_TS_20074 ⌈If StbM_GetTxFreshness returns E_OK, the Time Master shall construct the SYNC message with FV and use the full FV in the ICV generation.⌋

[SWS_FrTSyn_00118] Upstream requirements: RS_TS_20074 ⌈If StbM_GetTxFreshnessTruncData returns E_OK, the Time Master shall con- struct the SYNC message with truncated FV and use the full FV in the ICV generation.⌋

[SWS_FrTSyn_00119] Upstream requirements: RS_TS_20074 ⌈When StbM_GetTxFreshness or StbM_GetTxFreshnessTruncData return a non-recoverable error code (i.e, E_NOT_OK), then the Time Master shall: • stop the ICV generation and set the FVL and the ICVL to 0 in the SYNC message, • call Det_ReportRuntimeError with parameter ErrorId set to FRTSYN_E_- FRESHNESSFAILURE (refer [SWS_FrTSyn_91000]), • call IdsM_SetSecurityEventWithContextData with parameter EventId set to SEV_TSYN_FR_FRESHNESS_NOT_AVAILABLE. ⌋ Refer to the chapter 10.2.5 in [7] for the configuration details of CSM job used for ICV generation.

[SWS_FrTSyn_00120] Upstream requirements: RS_TS_20074 ⌈If FrTSynIcvGenerationBase for the Time Domain is configured to ICV_MAC, the Time Master shall call Csm_MacGenerate to generate the ICV value.⌋ FlexRay

[SWS_FrTSyn_00121] Upstream requirements: RS_TS_20074 ⌈If FrTSynIcvGenerationBase for the Time Domain is configured to ICV_SIG- NATURE, the Time Master shall call Csm_SignatureGenerate to generate the ICV value.⌋ Note: The mode parameter is intentionally left open for the implementer to choose ( i.e. CRYPTO_OPERATIONMODE_SINGLECALL would possibly be the best option since it does not require further calls to CSM). The CSM job used to generate the ICV can be configured to synchronous or asyn- chronous behavior. The ICV generation timeout observation should be disabled, when the CSM job used to generate the ICV, is configured in synchronous behavior.

[SWS_FrTSyn_00122] Upstream requirements: RS_TS_20074 ⌈If FrTSynIcvGenerationTimeout is set to 0, the Time Master shall not do ICV generation timeout monitoring.⌋

[SWS_FrTSyn_00123] Upstream requirements: RS_TS_20074 ⌈If: • FrTSynIcvGenerationTimeout is set to any value greater than 0, • and Csm_MacGenerate or Csm_SignatureGenerate returns E_OK, the Time Master shall start the FrTSynIcvGenerationTimeout.⌋

[SWS_FrTSyn_00124] Upstream requirements: RS_TS_20074 ⌈If: • FrTSynIcvGenerationTimeout is set to any value greater than 0, • the callback FrTSyn_IcvGenerationIndication is called, the Time Master shall stop the FrTSynIcvGenerationTimeout.⌋

[SWS_FrTSyn_00125] Upstream requirements: RS_TS_20074 ⌈If one of the following conditions is true: • the authentication build counter has reached the configuration value FrTSynTx- AuthenticationBuildAttempts, FlexRay • the verification of the ICV has returned a non-recoverable error such as returning E_NOT_OK or KEY_FAILURE, • FrTSynIcvGenerationTimeout expires before the notification of the FrT- Syn_IcvGenerationIndication callback then the Time Master shall • stop the ICV generation and set the FVL and the ICVL to 0 in the SYNC message, • and call IdsM_SetSecurityEventWithContextData with parameter Even- tId set to SEV_TSYN_FR_ICV_GENERATION_FAILED. ⌋

[SWS_FrTSyn_00126] Upstream requirements: RS_TS_20074 ⌈With the notification of the FrTSyn_IcvGenerationIndication callback, the Time Master shall add the generated ICV to the SYNC message and transmit it.⌋

[SWS_FrTSyn_00127] Upstream requirements: RS_TS_20074 ⌈When the FV is referenced (refer FrTSynIcvGenerationFvIdRef), then the Time Master shall notify the successful transmission of the SYNC message to FVM by calling StbM_SPduTxConfirmation.⌋

[SWS_FrTSyn_00151] Upstream requirements: SRS_BSW_00323, SRS_BSW_00337, SRS_BSW_00386 ⌈The function FrTSyn_IcvGenerationIndication shall inform the Det, if devel- opment error detection is enabled (FrTSynDevErrorDetect is set to TRUE) and if the function call has failed because of the following reasons: • jobId is invalid (FRTSYN_E_PARAM) ⌋

[SWS_FrTSyn_00152] Upstream requirements: SRS_BSW_00323, SRS_BSW_00337 ⌈The function FrTSyn_IcvVerificationIndication shall inform the Det, if de- velopment error detection is enabled (FrTSynDevErrorDetect is set to TRUE) and if the function call has failed because of the following reasons: • jobId is invalid (FRTSYN_E_PARAM) ⌋

[SWS_FrTSyn_00153] Status: DRAFT Upstream requirements: RS_TS_20074 ⌈For every transmission of messages of type 0x50 and 0x60, the Time Master shall shall maintain an authentication build counter (refer to FrTSynTxAuthentication- BuildAttempts).⌋

[SWS_FrTSyn_00154] Status: DRAFT Upstream requirements: RS_TS_20074 ⌈Upon the initial processing of messages of type 0x50 and 0x60 (i.e., upon the first attempt of a freshness value and ICV generation for each received message) the Time Master shall set the authentication build counter to 0.⌋

[SWS_FrTSyn_00155]{DRAFT} ⌈If StbM_GetTxFreshness or StbM_Get- TxFreshnessTruncData return a recoverable error code (e.g., STBM_E_BUSY), then the Time Master shall increment the authentication build counter.⌋(RS_TS_20074)

[SWS_FrTSyn_00156]{DRAFT} ⌈If Csm_MacGenerate or Csm_SignatureGener- ate return a recoverable error code (e.g., E_BUSY, QUEUE_FULL), then the Time Mas- ter shall increment the authentication build counter.⌋(RS_TS_20074)

[SWS_FrTSyn_00171]{DRAFT} ⌈If • the generation of the authenticated message has failed • and the authentication build counter has not yet reached the configuration value FrTSynTxAuthenticationBuildAttempts, then the Time Master shall retry the freshness attempt and the ICV calculation in the next call of FrTSyn_MainFunction.⌋(RS_TS_20074)

These requirements on Time Synchronization from the RS Time Synchronization [1] are not applicable to FrTSyn , because they refer ei- ther to network types other than FlexRay or to the Time Base Manager mod- ule

[SWS_FrTSyn_91000]), • call IdsM_SetSecurityEventWithContextData with parameter EventId set to SEV_TSYN_FR_FRESHNESS_NOT_AVAILABLE. ⌋ Refer to the chapter 10.2.5 in [7] for the configuration details of CSM job used for ICV generation.