Flash Driver (Fls)

Initializes the Flash Driver.

Erases flash sector(s).

Writes one or more complete flash pages.

Cancels an ongoing job.

Returns the driver state.

Returns the result of the last job.

Performs the processing of jobs.

Reads from flash memory.

Compares the contents of an area of flash memory with that of an application data buffer.

Sets the flash driver's operation mode.

Returns the version information of this module.

This callback function is called when a job has been completed with a positive result.

This callback function is called when a job has been canceled or finished with negative result.

The function Fls_BlankCheck shall verify, whether a given memory area has been erased but not (yet) programmed. The function shall limit the maximum number of checked flash cells per main function cycle to the configured value FlsMaxReadNormalMode or FlsMaxReadFastMode respectively.

A pointer to such a structure is provided to the flash driver initialization routine for configuration of the driver and flash memory hardware.

Used as address offset from the configured flash base address to access a certain flash memory area.

Specifies the number of bytes to read/write/erase/compare.

The FLS module shall offer asynchronous services for operations on flash memory (read/erase/write).

The FLS module shall not buffer data. The FLS module shall use application data buffers that are referenced by a pointer passed via the API.

The FLS module shall not ensure data consistency of the given application buffer.

Type of error Related error code Error value API service called with wrong parameter FLS_E_PARAM_CONFIG 0x01 API service called with wrong parameter FLS_E_PARAM_ADDRESS 0x02 API service called with wrong parameter FLS_E_PARAM_LENGTH 0x03 API service called with wrong parameter FLS_E_PARAM_DATA 0x04 API service called without module initialization FLS_E_UNINIT 0x05 API service called with NULL pointer FLS_E_PARAM_POINTER 0x0a – FLS_E_ALREADY_INITIALIZED 0x0b

The function Fls_Init shall initialize the FLS module (software) and all flash memory relevant registers (hardware) with parameters provided in the given configuration set.

If development error detection for the module Fls is enabled: the function Fls_Init shall check the (hardware specific) contents of the given configu- ration set for being within the allowed range. If this is not the case, it shall raise the development error FLS_E_PARAM_CONFIG .

If development error detection for the module Fls is enabled: the function Fls_Erase shall check that the erase start address (flash memory base ad- dress + TargetAddress ) is aligned to a flash sector boundary and that it lies within the specified lower and upper flash address boundaries. If this check fails, the func- tion Fls_Erase shall reject the erase request, raise the development error FLS_E_- PARAM_ADDRESS and return with E_NOT_OK.

If development error detection for the module Fls is enabled: the function Fls_Erase shall check that the erase length is greater than 0 and that the erase end address (erase start address + length) is aligned to a flash sector boundary and that it lies within the specified upper flash address boundary. If this check fails, the function Fls_Erase shall reject the erase request, raise the development error FLS_E_PARAM_LENGTH and return with E_NOT_OK.

If erase verification is enabled (compile switch FlsEraseVer- ificationEnabled set to TRUE): After a flash block has been erased, the func- tion Fls_MainFunction shall compare the contents of the addressed memory area against the value of an erased flash cell to check that the block has been completely erased. If this check fails, the function Fls_MainFunction shall set the FLS mod- ule's job result to MEMIF_JOB_FAILED and raise the runtime error FLS_E_VERIFY_- ERASE_FAILED .

If runtime error detection for the module Fls is enabled: the func- tion Fls_Erase shall check that the FLS module is currently not busy. If this check fails, the function Fls_Erase shall reject the erase request, raise the development error FLS_E_BUSY and return with E_NOT_OK.

If development error detection for the module Fls is enabled: the function Fls_Write shall check that the write start address (flash memory base ad- dress + TargetAddress ) is aligned to a flash page boundary and that it lies within the specified lower and upper flash address boundaries. If this check fails, the func- tion Fls_Write shall reject the write request, raise the development error FLS_E_- PARAM_ADDRESS and return with E_NOT_OK.

If development error detection for the module Fls is enabled: the function Fls_Write shall check that the write length is greater than 0, that the write end address (write start address + length) is aligned to a flash page boundary and that it lies within the specified upper flash address boundary. If this check fails, the func- tion Fls_Write shall reject the write request, raise the development error FLS_E_- PARAM_LENGTH and return with E_NOT_OK.

If runtime error detection for the module Fls is enabled: the func- tion Fls_Write shall check that the FLS module is currently not busy. If this check fails, the function Fls_Write shall reject the write request, raise the development error FLS_E_BUSY and return with E_NOT_OK.

The function Fls_Cancel shall set the job result to MEMIF_JOB_ CANCELED if the job result currently has the value MEMIF_JOB_PENDING. Other- wise the function Fls_Cancel shall leave the job result unchanged.

The function Fls_GetStatus shall return the FLS module state synchronously.

The function Fls_GetJobResult shall return the result of the last job synchronously

The erase, write, read and compare functions shall share the same job result, i.e. only the result of the last job can be queried. The FLS module shall overwrite the job result with MEMIF_JOB_PENDING if the FLS module has accepted a new job.

The function Fls_MainFunction shall perform the processing of the flash read, write, erase and compare jobs.

When a job has been initiated, the FLS module's environment shall call the function Fls_MainFunction cyclically until the job is finished.

The function Fls_MainFunction shall return without any action if no job is pending.

The function Fls_MainFunction shall only process as much data in one call cycle as statically configured for the current job type (read, write or compare) and the current FLS module's operating mode (normal, fast).

If supported by hardware, the function Fls_Init shall set the flash memory erase/write protection as provided in the configuration set.

If erase verification is enabled (compile switch FlsEraseVer- ificationEnabled set to TRUE): Before writing a flash block, the function Fls_- MainFunction shall compare the contents of the addressed memory area against the value of an erased flash cell to check that the block has been completely erased. If this check fails, the function Fls_MainFunction shall set the FLS module's job result to MEMIF_JOB_FAILED and raise the runtime error FLS_E_VERIFY_ERASE_FAILED .

If write verification is enabled (compile switch FlsWriteVerifi- cationEnabled set to TRUE): After writing a flash block, the function Fls_Main- Function shall compare the contents of the reprogrammed memory area against the contents of the provided application buffer to check that the block has been completely reprogrammed. If this check fails, the function Fls_MainFunction shall set the FLS module's job result to MEMIF_JOB_FAILED and raise the runtime error FLS_E_VER- IFY_WRITE_FAILED .

If development error detection for the module Fls is enabled: the function Fls_Erase shall check that the FLS module has been initialized. If this check fails, the function Fls_Erase shall reject the erase request, raise the development error FLS_E_UNINIT and return with E_NOT_OK.

If development error detection for the module Fls is enabled: the function Fls_Write shall check that the FLS module has been initialized. If this check fails, the function Fls_Write shall reject the write request, raise the development error FLS_E_UNINIT and return with E_NOT_OK.

The function Fls_Init shall initialize all FLS module global vari- ables and those controller registers that are needed for controlling the flash device and that do not influence or depend on other (hardware) modules. Registers that can in- fluence or depend on other modules shall be initialized by a common system module.

The functional requirements [2] and the functional scope are the same for both internal and external drivers. Hence the API is semantically identical.

If development error detection for the module Fls is enabled: the function Fls_Read shall check that the read start address (flash memory base address + SourceAddress ) lies within the specified lower and upper flash address bound- aries. If this check fails, the function Fls_Read shall reject the read job, raise de- velopment error FLS_E_PARAM_ADDRESS and return with E_NOT_OK.

If development error detection for the module Fls is enabled: the function Fls_Read shall check that the read length is greater than 0 and that the read end address (read start address + length) lies within the specified upper flash address boundary. If this check fails, the function Fls_Read shall reject the read job, raise the development error FLS_E_PARAM_LENGTH and return with E_NOT_OK.

If development error detection for the module Fls is enabled: the function Fls_Read shall check that the driver has been initialized. If this check fails, the function Fls_Read shall reject the read request, raise the development error FLS_- E_UNINIT and return with E_NOT_OK.

If runtime error detection for the module Fls is enabled: the func- tion Fls_Read shall check that the driver is currently not busy. If this check fails, the function Fls_Read shall reject the read request, raise the development error FLS_- E_BUSY and return with E_NOT_OK.

The function Fls_MainFunction shall set the job result to MEMIF_JOB_FAILED and report the error code FLS_E_ERASE_FAILED to the DET if a flash erase job fails due to a hardware error.

The function Fls_MainFunction shall set the job result to MEMIF_JOB_FAILED and report the error code FLS_E_WRITE_FAILED to the DET if a flash write job fails due to a hardware error.

The function Fls_MainFunction shall set the job result to MEMIF_JOB_FAILED and report the error code FLS_E_READ_FAILED to the DET if a flash read job fails due to a hardware error.

The callback notifications shall have no parameters and no return value.

The FLS module's implementer shall place the code of the flash access routines into a separate C-module Fls_ac.c.

The FLS module's erase routine shall load the flash access code for erasing the flash memory to the location in RAM pointed to by the erase function pointer contained in the flash drivers configuration set if the FLS module is configured to load the flash access code to RAM on job start.

The FLS module's write routine shall load the flash access code for writing the flash memory to the location in RAM pointed to by the write function pointer contained in the flash drivers configuration set if the FLS module is configured to load the flash access code to RAM on job start.

After an erase or write job has been finished or canceled, the FLS module's main processing routine shall unload (i.e. overwrite) the flash access code (internal erase / write routines) from RAM if they have been loaded to RAM by the flash driver.

During the initialization of the external flash driver, the FLS module shall check the hardware ID of the external flash device against the corresponding published parameter. If a hardware ID mismatch occurs, the FLS module shall report the error code FLS_E_UNEXPECTED_FLASH_ID to the Default Error Tracer (DET), set the FLS module status to FLS_E_UNINIT and shall not initialize itself.

If possible, e.g. with interrupt controlled implementations, the FLS module shall start the first round of the erase job directly within the function Fls_- Erase to reduce overall runtime.

If possible, e.g. with interrupt controlled implementations, the FLS module shall start the first round of the write job directly within the function Fls_Write to reduce overall runtime.

If configured, the function Fls_Cancel shall call the error notifi- cation function to inform the caller about the cancellation of a job.

If development error detection for the module Fls is enabled: the function Fls_Compare shall check that the compare start address (flash memory base address + SourceAddress ) lies within the specified lower and upper flash address boundaries. If this check fails, the function Fls_Compare shall reject the compare job, raise the development error FLS_E_PARAM_ADDRESS and return with E_NOT_OK.

If If development error detection for the module Fls is enabled: the function Fls_Compare shall check that the given length is greater than 0 and that the compare end address (compare start address + length) lies within the specified upper flash address boundary. If this check fails, the function Fls_Compare shall reject the compare job, raise the development error FLS_E_PARAM_LENGTH and return with E_ NOT_OK.

If development error detection for the module Fls is enabled: the function Fls_Compare shall check that the driver has been initialized. If this check fails, the function Fls_Compare shall reject the compare job, raise the development error FLS_E_UNINIT and return with E_NOT_OK.

If runtime error detection for the module Fls is enabled: the func- tion Fls_Compare shall check that the driver is currently not busy. If this check fails, the function Fls_Compare shall reject the compare job, raise the development error FLS_E_BUSY and return with E_NOT_OK.

The function Fls_MainFunction shall set the job result to MEMIF_JOB_FAILED and report the error code FLS_E_COMPARE_FAILED to the DET if a flash compare job fails due to a hardware error.

The function Fls_SetMode shall set the FLS module's operation mode to the given "Mode" parameter.

If runtime error detection for the module Fls is enabled: the func- tion Fls_SetMode shall check that the FLS module is currently not busy. If this check fails, the function Fls_SetMode shall reject the set mode request and raise the devel- opment error code FLS_E_BUSY .

If development error detection for the module Fls is enabled: the function Fls_Write shall check the given data buffer pointer for not being a null pointer. If the data buffer pointer is a null pointer, the function Fls_Write shall re- ject the write request, raise the development error FLS_E_PARAM_DATA and return with E_NOT_OK.

If development error detection for the module Fls is enabled: the function Fls_Read shall check the given data buffer pointer for not being a null pointer. If the data buffer pointer is a null pointer, the function Fls_Read shall reject the read request, raise the development error FLS_E_PARAM_DATA and return with E_NOT_ OK.

The FLS module shall call the callback function Fee_JobEndNo- tification when the module has completed a job with a positive result: • Read job finished & OK • Write job finished & OK • Erase job finished & OK • Compare job finished & memory blocks are the same

The function Fls_Cancel shall be pre-compile time configurable On/Off by the configuration parameter FlsCancelApi .

The function Fls_GetStatus shall be pre-compile time config- urable On/Off by the configuration parameter FlsGetStatusApi .

The function Fls_GetJobResult shall be pre-compile time configurable On/Off by the configuration parameter FlsGetJobResultApi .

The function Fls_Compare shall be pre-compile time config- urable On/Off by the configuration parameter FlsCompareApi .

The function Fls_SetMode shall be pre-compile time config- urable On/Off by the configuration parameter FlsSetModeApi .

The function Fls_Init shall store the pointer to the given config- uration set in a variable in order to allow the FLS module access to the configuration set contents during runtime.

Depending on implementation, callback routines provided and/or invoked by the FLS module may be called on interrupt level. The module providing those routines has therefore to make sure that their runtime is reasonably short, i.e. since callbacks may be propagated upward through several software layers.

The function Fls_MainFunction shall at the most issue one sector erase command (to the hardware) in each cycle.

The function Fls_MainFunction shall set the job result to MEMIF_BLOCK_INCONSISTENT if the compared data from a flash compare job are not equal.

The FLS module shall check static configuration parameters stat- ically (at the latest during compile time) for correctness.

The FLS module shall validate the version information in the FLS module header and source files for consistency (e.g. by comparing the version infor- mation in the module header and source files with a pre-processor macro).

The FLS module shall combine all available flash memory areas into one linear address space (denoted by the parameters FlsBaseAddress and FlsTotalSize ).

The FLS module shall map the address and length parameters for the read, write, erase and compare functions as "virtual" addresses to the physical addresses according to the physical structure of the flash memory areas.

The FLS module's implementer shall keep the execution time for the flash access code as short as possible.

The FLS module's main processing routine shall execute the flash access code routines.

The FLS module's main processing routine shall access the flash access code routines by means of the respective function pointer contained in the FLS module's configuration set (post-compile parameters) regardless whether the flash access code routines have been loaded to RAM or whether they can be executed directly from (flash) ROM.

The FLS module shall only load the access code to the RAM if the access code cannot be executed out of flash ROM.

The FLS module's flash access routines shall only disable inter- rupts and wait for the completion of the erase / write command if necessary (that is if it has to be ensured that no other code is executed in the meantime).

The type Fls_AddressType shall have 0 as lower limit for each flash device.

The FLS module shall add a device specific base address to the address type Fls_AddressType if necessary.

The job of the function Fls_Erase shall erase one or more com- plete flash sectors.

The FLS module shall execute the job of the function Fls_Erase asynchronously within the FLS module's main function.

The job of the function Fls_Erase shall erase a flash memory block starting from the flash memory base address + TargetAddress of size Length. Note: Length will be rounded up to the next full sector boundary since only complete flash sectors can be erased.

The job of the function Fls_Write shall write one or more com- plete flash pages to the flash device.

The FLS module shall execute the write job of the function Fls_- Write asynchronously within the FLS module's main function.

The job of the function Fls_Write shall program a flash memory block with data provided via SourceAddressPtr starting from the flash memory base address + TargetAddress of size Length.

The function Fls_Cancel shall cancel an ongoing flash read, write, erase or compare job.

The function Fls_Cancel shall abort a running job synchronously so that directly after returning from this function a new job can be started.

The configuration parameter FlsUseInterrupts shall switch between interrupt and polling controlled job processing if this is supported by the flash memory hardware.

The FLS module's implementer shall locate the interrupt service routine in Fls_Irq.c.

If interrupt controlled job processing is supported and enabled with the configuration parameter FlsUseInterrupts, the interrupt service routine shall reset the interrupt flag, check for errors reported by the underlying hardware, reload the hard- ware finite state machine for the next round of the pending job or call the appropriate notification routine if the job is finished or aborted.

The function Fls_MainFunction shall process jobs without hardware interrupt support (e.g. read jobs).

The function Fls_Read shall read from flash memory.

The FLS module shall execute the read job of the function Fls_Read asynchronously within the FLS module's main function.

The read job of the function Fls_Read shall copy a continuous flash memory block starting from the flash memory base address + SourceAddress of size Length to the buffer pointed to by TargetAddressPtr .

The FLS module's environment shall only call the function Fls_- Read after the FLS module has been initialized.

The function Fls_Compare shall compare the contents of an area of flash memory with that of an application data buffer.

The FLS module shall execute the job of the function Fls_- Compare asynchronously within the FLS module's main function.

The job of the function Fls_Compare shall compare a continuous flash memory block starting from the flash memory base address + SourceAddress of size Length with the buffer pointed to by TargetAddressPtr .

Module Header File Imported Type MemIf.h MemIf_JobResultType (obsolete) MemIf.h MemIf_ModeType (obsolete) MemIf MemIf.h MemIf_StatusType Std_Types.h Std_ReturnType Std Std_Types.h Std_VersionInfoType

Det_ReportRuntimeError Det.h Service to report runtime errors. If a callout has been configured then this callout shall be called.

Det_ReportError Det.h Service to report development errors.

If runtime error detection for the module Fls is enabled: the func- tion Fls_Init shall check module initialization status. If the module has already been initialized, the function Fls_Init shall raise the development error FLS_E_- ALREADY_INITIALIZED .

The Fls module shall provide only one scheduled function. Read- ing from / writing to flash memory cannot usually be done simultaneously and the over- head for synchronizing two scheduled functions would outweigh the benefits.

If timeout supervision is enabled (compile switch FlsTimeoutSu- pervisionEnabled set to TRUE): the function Fls_MainFunction shall provide a timeout monitoring for the currently running job, that is it shall supervise the deadline of the read / compare / erase or write job.

If development error detection for the module Fls is enabled: the function Fls_Compare shall check the given data buffer pointer for not being a null pointer. If the data buffer pointer is a null pointer, the function Fls_Compare shall reject the request, raise the development error FLS_E_PARAM_DATA and return with E_NOT_OK.

The following development error codes shall be reported when an API service is called with a wrong parameter: FLS_E_PARAM_CONFIG , FLS_- E_PARAM_ADDRESS , FLS_E_PARAM_LENGTH , FLS_E_PARAM_DATA .

The runtime error code FLS_E_BUSY shall be reported when an API service is called while the module is still busy.

The runtime error code FLS_E_VERIFY_ERASE_FAILED shall be reported when the erase verification function is enabled (by the com- pile switch FlsEraseVerificationEnabled ) and the erase verification func- tion (blankcheck) failed.

The runtime error code FLS_E_VERIFY_WRITE_FAILED shall be reported when the write verification function is enabled (by the compile switch FlsWriteVerificationEnabled ) and the write verification function (com- pare) failed.

The transient fault code FLS_E_ERASE_FAILED shall be reported when the flash erase function failed (in hardware).

The transient fault code FLS_E_WRITE_FAILED shall be reported when the flash write function failed (in hardware).

The transient fault code FLS_E_READ_FAILED shall be reported when the flash read function failed (in hardware).

The transient fault code FLS_E_COMPARE_FAILED shall be re- ported when the flash compare function failed (in hardware).

The transient fault code FLS_E_UNEXPECTED_FLASH_ID shall be reported when the expected flash ID is not matched (see [SWS_Fls_00144]).

The function Fls_Init shall set the FLS module state to MEMIF_ IDLE after having finished the FLS module initialization.

The function Fls_Init shall set the flash job result to MEMIF_ JOB_OK after having finished the FLS module initialization.

The function Fls_Erase shall copy the given parameters to FLS module internal variables and initiate an erase job.

After initiating the erase job, the function Fls_Erase shall set the FLS module status to MEMIF_BUSY.

After initiating the erase job, the function Fls_Erase shall set the job result to MEMIF_JOB_PENDING.

After initiating the erase job, the function Fls_Erase shall return with E_OK.

The function Fls_Write shall copy the given parameters to Fls module internal variables and initiate a write job.

After initiating the write job, the function Fls_Write shall set the FLS module status to MEMIF_BUSY.

After initiating the write job, the function Fls_Write shall set the job result to MEMIF_JOB_PENDING.

After initiating the write job, the function Fls_Write shall return with E_OK.

The function Fls_Cancel shall reset the FLS module's internal job processing variables (like address, length and data pointer).

The function Fls_Cancel shall set the FLS module state to MEMIF_IDLE.

The function Fls_Read shall copy the given parameters to FLS module internal variables and initiate a read job.

After initiating a read job, the function Fls_Read shall set the FLS module status to MEMIF_BUSY.

After initiating a read job, the function Fls_Read shall set the FLS module job result to MEMIF_JOB_PENDING.

After initiating a read job, the function Fls_Read shall return with E_OK.

The function Fls_Compare shall copy the given parameters to Fls module internal variables and initiate a compare job.

After initiating the compare job, the function Fls_Compare shall set the status to MEMIF_BUSY.

After initiating the compare job, the function Fls_Compare shall set the job result to MEMIF_JOB_PENDING.

After initiating the compare job, the function Fls_Compare shall return with E_OK.

After a read, erase, write or compare job has been finished, the function Fls_MainFunction shall set the FLS module's job result to MEMIF_JOB_ OK if it is currently in state MEMIF_JOB_PENDING. Otherwise, it shall leave the result unchanged.

After a read, erase, write or compare job has been finished, the function Fls_MainFunction shall set the FLS module's state to MEMIF_IDLE and call the job end notification function if configured (see [ECUC_Fls_00307]).

The FLS module shall call the callback function Fee_JobEr- rorNotification when the module has finished a job with a negative result: • Read job failed • Write job failed • Erase job failed • Compare job failed

The FLS module shall call the callback function Fee_JobEr- rorNotification when the module has canceled an ongoing job: • Read job aborted • Write job aborted • Erase job aborted • Compare job aborted

The FLS module shall call the callback function Fee_JobEr- rorNotification when the module has finished a compare job and the memory blocks differ: • Compare job finished and memory blocks differ

The table above specifies the parameters that shall be located in an external data structure of type Fls_ConfigType .

The organization and location of the data structure Fls_Config- Type shall be up to the implementer.

Hardware or implementation specific parameters can be added to Fls_ConfigType if necessary.

If development error detection for the module Fls is enabled: the function Fls_Cancel shall check that the FLS module has been initialized. If this check fails, the function Fls_Cancel shall raise the development error FLS_E_- UNINIT and return.

If development error detection for the module Fls is enabled: the function Fls_GetJobResult shall check that the FLS module has been initialized. If this check fails, the function Fls_GetJobResult shall raise the development error FLS_E_UNINIT and return with MEMIF_JOB_FAILED.

If timeout supervision is enabled (compile switch FlsTimeout- SupervisionEnabled set to TRUE): the function Fls_MainFunction shall check, whether the configured maximum erase time (see [ECUC_Fls_00298] FlsErase- Time ) has been exceeded. If this is the case, the function Fls_MainFunction shall raise the runtime error FLS_E_TIMEOUT .

If timeout supervision is enabled (compile switch FlsTimeout- SupervisionEnabled set to TRUE): the function Fls_MainFunction shall check, whether the expected maximum write time (see note below) has been exceeded. If this is the case, the function Fls_MainFunction shall raise the runtime error FLS_E_- TIMEOUT .

The runtime error code FLS_E_TIMEOUT shall be reported when the timeout supervision function is enabled (by the compile switch FlsTimeoutSu- pervisionEnabled ) and the timeout supervision of a read, write, erase or compare job (in hardware) failed.

If timeout supervision is enabled (compile switch FlsTimeout- SupervisionEnabled set to TRUE): the function Fls_MainFunction shall check, whether the expected maximum read / compare time (see note below) has been ex- ceeded. If this is the case, the function Fls_MainFunction shall raise the runtime error FLS_E_TIMEOUT .

If development error detection for the module Fls is enabled: the function Fls_GetVersionInfo shall raise the development error FLS_E_PARAM_- POINTER if the argument is a NULL pointer and return without any action.

The function Fls_BlankCheck shall verify, whether a given mem- ory area has been erased but not (yet) re-programmed.

The function Fls_BlankCheck shall copy the given parameters to FLS module internal variables and initiate the verification job.

After initiating the verification job, the function Fls_BlankCheck shall set the FLS module status to MEMIF_BUSY.

After initiating the verification job, the function Fls_BlankCheck shall set the FLS module job result to MEMIF_JOB_PENDING.

After initiating the verification job, the function Fls_BlankCheck shall return with E_OK.

The FLS module shall execute the verification job of the function Fls_BlankCheck asynchronously within the FLS module's main function.

The verification job of the function Fls_BlankCheck shall check, that the continuous flash memory area starting from the flash memory base address + TargetAddress of size Length is erased.

If development error detection for the module FLS is enabled; the function Fls_BlankCheck shall check that the verification start address (flash mem- ory base address + TargetAddress ) lies within the specified lower and upper flash address boundaries. If this check fails, the function Fls_BlankCheck shall reject the verification job, raise the development error FLS_E_PARAM_ADDRESS and return with E_NOT_OK.

If development error detection for the module FLS is enabled: the function Fls_BlankCheck shall check that the given length is greater than 0 and that the verification end address (verification start address + length) lies within the specified upper flash address boundary. If this check fails, the function Fls_BlankCheck shall reject the verification job, raise the development error FLS_E_PARAM_LENGTH and return with E_NOT_OK.

If development error detection for the module FLS is enabled: the function Fls_BlankCheck shall check that the driver has been initialized. If this check fails, the function Fls_BlankCheck shall reject the verification request, raise the de- velopment error FLS_E_UNINIT and return with E_NOT_OK.

If runtime error detection for the module FLS is enabled: the func- tion Fls_BlankCheck shall check that the driver is currently not busy. If this check fails, the function Fls_BlankCheck shall reject the verification request, raise the de- velopment error FLS_E_BUSY and return with E_NOT_OK.

If the underlying flash technology requires a certain alignment of the read address or length information and if the address and/or length parameter for a read or compare Job are not correctly aligned, the function Fls_MainFunction shall internally compensate for this missing alignment, that is the function Fls_Main- Function shall provide byte-wise read access to the flash memory, regardless of any alignment restrictions imposed by the Hardware.

The FLS module shall handle data buffer alignment internally. In- stead of imposing any requirements on RAM buffers' alignments (as they are uint8*), it shall handle passed pointers as being just byte-aligned.

If more than one instance of the flash driver is used in an ECU, the individual instances have to be given a unique instance ID. This instance ID shall be configured as the parameter FlsDriverIndex . If only one instance of the flash driver is used in an ECU, this instance shall have the parameter FlsDriverIndex configured as 0.

Type of error Related error code Error value API service called while driver still busy FLS_E_BUSY 0x06 Erase verification (blank check) failed FLS_E_VERIFY_ERASE_FAILED 0x07 Write verification (compare) failed FLS_E_VERIFY_WRITE_FAILED 0x08 Timeout exceeded FLS_E_TIMEOUT 0x09

Type of error Related error code Error value Flash erase failed (HW) FLS_E_ERASE_FAILED 0x01 Flash write failed (HW) FLS_E_WRITE_FAILED 0x02 Flash read failed (HW) FLS_E_READ_FAILED 0x03 Flash compare failed (HW) FLS_E_COMPARE_FAILED 0x04 Expected hardware ID not matched (see SWS_ Fls_00144) FLS_E_UNEXPECTED_FLASH_ID 0x05

These requirements are not applicable to this specifica- tion.