// 0x100 is the start value for MNR, also used after wrap-around

// The values 0…0xFF are reserved for future use

This timer is used to check whether the next valid ResponseSPDU has arrived on time. It is initialized using the parameter SPI.SafetyConsumerTimeout.

NOTE As opposed to other parameters, a modification of the parameter value SafetyConsumerTimeout takes effect immediately, i.e. not only when state S11 is visited, see RQ7.26.

This timer is used to check the elapsed time between errors. If the elapsed time between two consecutive errors is smaller than the value SafetyErrorIntervalLimit, FSV will be activated. Otherwise, the ResponseSPDU is discarded and the SafetyConsumer waits for the next ResponseSPDU.

This timer is initialized using the local variable SPI_SafetyErrorIntervalLimit_i.

See Table 26, 6.3.4.3, and 9.4 for more information.

NOTE The local variable SPI_SafetyErrorIntervalLimit_i is not to be confused with the parameter SPI.SafetyErrorIntervalLimit. The local variable is copied from the parameter in state S11 (restart). Hence, if the parameter value changes during runtime, the new value will only be used after the connection has been restarted.

// detection of a rising edge:

If x==true && tmp==false
Then
result:= true
Else
result:= false
Endif

tmp:= x

SAPI.SafetyData is set to binary 0

If [<ConsumerTimer expired || SAPI.Enable==0 ?>]
Then
SAPI.NonSafetyData is set to binary 0

Else
SAPI.NonSafetyData is set to ResponseSPDU.NonSafetyData

Endif

SAPI.FSV_Activated:= 1

RequestSPDU.Flags.FSV_Activated:= 1

NOTE 1 If a safety application prefers fail-safe values other than binary 0, this can be implemented in the safety application by querying SAPI.FSV_Activated.

NOTE 2 The NonSafetyData is always updated if data is available. In case of a timeout, no data is available, which is indicated using binary zero. If it is necessary for an application to distinguish between “no data available” and “binary zero received”, it can add a Boolean variable to the NonSafetyData. This value is set to ”1” during normal operation, and to ”0” for indicating that no data is available.

SAPI.SafetyData is set to ResponseSPDU.SafetyData

SAPI.NonSafetyData is set to ResponseSPDU.NonSafetyData

SAPI.FSV_Activated:= 0

RequestSPDU.Flags.FSV_Activated:= 0

RequestSPDU.Flags.CommunicationError:= 0

If SAPI.SafetyConsumerID != 0

Then

ConsumerID_i:= SAPI.SafetyConsumerID

Else

ConsumerID_i:= SPI_SafetyConsumerID_i

Endif
RequestSPDU.SafetyConsumerID:= ConsumerID_i

uint128 BaseID

uint32 ProviderID

const uint32 SafetyProviderLevel_ID:= … // see 7.2.3.4

If(SAPI.SafetyBaseID == 0)

Then
BaseID:= SPI_SafetyBaseID_i
Else
BaseID:= SAPI.SafetyBaseID

Endif
If(SAPI.SafetyProviderID == 0)

Then
ProviderID:= SPI_SafetyProviderID_i
Else
ProviderID:= SAPI.SafetyProviderID

Endif

SPDU_ID_1_i:= BaseID (octets 0…3)
XOR SafetyProviderLevel_ID

SPDU_ID_2_i:= BaseID (octets 4…7)
XOR SPI_SafetyStructureSignature_i

SPDU_ID_3_i:= BaseID (octets 8…11)
XOR BaseID (octets 12…15)
XOR ProviderID

// see 7.2.3.2 for clarification

Boolean result:= true
If(SAPI.SafetyBaseID == 0 && SPI_SafetyBaseID_i==0)
Then
result:= false
Else
Endif

If(SAPI.SafetyProviderID == 0 && SPI_SafetyProviderID_i==0)
Then
result:= false
Else
Endif

If(SAPI.SafetyConsumerID == 0 && SPI_SafetyConsumerID_i==0)
Then
result:= false
Else
Endif

If(SPI_SafetyStructureSignature_i==0)
Then
result:= false
Else
Endif

yield result

<Set Diag(ID,

Boolean isPermanent)>

// ID is the identifier for the type of diagnostic output, see Table 28.
// Parameter isPermanent is used to indicate a permanent error.
// Only one diagnostic message is created for multiple permanent
// errors in sequence

If(RequestSPDU.Flags.CommunicationError == 0)
Then
<do vendor-specific function for diagnostic output using ID>
Else
//do nothing
Endif

RequestSPDU.Flags.CommunicationError:= isPermanent
// NOTE See Table 28 for possible values for “ID” and their codes.

Boolean result:= false

If MNR_re_sync_i == false

Then
If ResponseSPDU.MNR <> prevMNR_i

Then result:= true

Else
//do nothing
Endif

Else

If ResponseSPDU.MNR == MNR_i

Then result:= true

Else
//do nothing
Endif

Endif

yield result

<Set Diag(CommErrTO,isPermanent:=true)>
<Use FSV>

If SPI_SafetyOperatorAckNecessary_i == 1
Then
FaultReqOA_i:= 1
SAPI.OperatorAckRequested:= 0
RequestSPDU.Flags.OperatorAckRequested:= 0
Else
// do nothing
Endif

// Initial state of the SafetyConsumer instance.

<Use FSV>

SAPI.OperatorAckRequested:= 0
RequestSPDU.Flags.OperatorAckRequested:= 0
SAPI.OperatorAckProvider:= 0

FaultReqOA_i:= 0
OperatorAckConsumerAllowed_i:= 0
SAPI.TestModeActivated:= 0

RequestSPDU.Flags.CommunicationError:= 0

MNR_re_sync_i:= false

// Safety layer is waiting for (Re)Start

// Changes to these parameters are only considered in this state

// Exception: a change of SafetyConsumerTimeout is possible during operation

// Read parameters from the SPI and store them in local variables:

SPI_SafetyConsumerID_i:= SPI.SafetyConsumerID

SPI_SafetyProviderID_i:= SPI.SafetyProviderIDConfigured

SPI_SafetyBaseID_i:= SPI.SafetyBaseIDConfigured

SPI_SafetyStructureSignature_i:= SPI.SafetyStructureSignature

SPI_SafetyOperatorAckNecessary_i:= SPI.SafetyOperatorAckNecessary

SPI_SafetyErrorIntervalLimit_i:= SPI_SafetyErrorIntervalLimit

// Use previous MNR if known
// or random MNR within the allowed range (e.g. after cold start), see 9.2.

MNR_i:= (previous MNR_i if known) or (random MNR)

MNR_i:= max(MNR_i, MNR_min)1

// Safety Layer is waiting for next ResponseSPDU from SafetyProvider.

// A new ResponseSPDU is characterized by a change in the MNR.

// Check CRC

uint32 CRC_calc
CRCCheck_i:= (CRC_calc == ResponseSPDU.CRC)

// see 7.2.3.6 on how to calculate CRC_calc

// Check SafetyConsumerID and SPDU_ID and MNR (see T22, T23, T24)

SPDUCheck_i:=
ResponseSPDU.SPDU_ID_1 == SPDU_ID_1_i &&
ResponseSPDU.SPDU_ID_2 == SPDU_ID_2_i && ResponseSPDU.SPDU_ID_3 == SPDU_ID_3_i && ResponseSPDU.SafetyConsumerID == ConsumerID_i &&
ResponseSPDU.MNR == MNR_i

// Second check of WDTimeout

// Prevents restarting of ConsumerTimer if it expired since initial check

//Start

[SAPI.Enable==1 && <ParametersOK?>]

<(Re)Start ConsumerTimer>

<Assign ConsumerID>

// Termination

[SAPI.Enable==0]

<Use FSV>

RequestSPDU.Flags.CommunicationError:= 0

// necessary to make sure that no diagnostic

// message is lost, see macro <Set Diag ...>

// NOTE Depending on its implementation, it could

// be necessary to stop the ConsumerTimer here.

prevMNR_i:= MNR_i

If MNR_i == 0xFFFFFFFFF
Then
MNR_i:= MNR_min
Else

MNR_i:= MNR_i + 1
Endif

RequestSPDU.MonitoringNumber:= MNR_i

<Set RequestSPDU>

// Changed ResponseSPDU
// is received1

<Get ResponseSPDU>2

<ResponseSPDU ready for checks>

// WDTimeout

[<ConsumerTimer expired?>]

MNR_re_sync_i:= true

<(Re)Start ErrorIntervalTimer>
<Set Diag(CRCerrIgn, isPermanent:=false)>

// When CRC err and ErrorIntervalTimer not expired

[(crcCheck_i == 0) && not <ErrorIntervalTimer expired?>]

<(Re)Start ErrorIntervalTimer>
<Set Diag(CRCerrOA, isPermanent:=true)>
<Use FSV>

FaultReqOA_i:= 1
SAPI.OperatorAckRequested:= 0
RequestSPDU.Flags.OperatorAckRequested:= 0

// When CRCCheckOK

[crcCheck_i == 1]

// SPDU OK

[SPDUCheck_i==true]

// For clarification, refer to Figure 19;

MNR_re_sync_i:= false

// indicate OA from provider

SAPI.OperatorAckProvider:= ResponseSPDU.Flags.OperatorAckProvider

// OA requested due to rising edge at ActivateFSV?

If (<risingEdge ResponseSPDU.Flags.ActivateFSV>&& SPI_SafetyOperatorAckNecessary_i == true)
Then
FaultReqOA_i:= 1;
<Set Diag(FSV_Requested,isPermanent:=true)>
Else
// do nothing

Endif

// Set Flags if OA requested:

If FaultReqOA_i==1
Then
SAPI.OperatorAckRequested:= 1,
RequestSPDU.Flags.OperatorAckRequested:= 1,
OperatorAckConsumerAllowed_i:= 0,
FaultReqOA_i:= 0
Else
//do nothing
Endif

// Wait until OperatorAckConsumer is not active

If SAPI.OperatorAckConsumer==0

Then

OperatorAckConsumerAllowed_i:= 1

Else

//do nothing

Endif

// Reset Flags after OA:

If SAPI.OperatorAckConsumer ==1 && OperatorAckConsumerAllowed_i == 1

Then

SAPI.OperatorAckRequested:= 0, RequestSPDU.Flags.OperatorAckRequested:= 0
Else

// do nothing

Endif

If SAPI.OperatorAckRequested==1 || ResponseSPDU.Flags.ActivateFSV==1
Then <Use FSV>
Else <Use PV>
Endif

// Notify safety application that SafetyProvider is in test mode:

SAPI.TestModeActivated:= ResponseSPDU.Flags.TestModeActivated

<(Re)Start ErrorIntervalTimer>,

MNR_re_sync_i:= true

// Send diagnostic message according to the
// detected error:

If ResponseSPDU.SafetyConsumerID <> ConsumerID_i
Then <Set Diag(CoIDerrIgn, isPermanent:=false)>
Else
If ResponseSPDU.MNR<>MNR_i
Then <Set Diag(MNRerrIgn, isPermanent:=false)>
Else
//do nothing
EndIf
If
ResponseSPDU.SPDU_ID_1<> SPDU_ID_1_i ||
ResponseSPDU.SPDU_ID_2<> SPDU_ID_2_i ||
ResponseSPDU.SPDU_ID_3<> SPDU_ID_3_i
Then
<Set Diag(SD_IDerrIgn,

isPermanent:=false)>3
Else
// do nothing
Endif
Endif

// SPDU NOK and ErrorIntervalTimer not expired

[SPDUCheck_i == 0 && not <ErrorIntervalTimer expired?>]

<(Re)Start ErrorIntervalTimer>
// Send diagnostic message according to the
// detected error:

If ResponseSPDU.SafetyConsumerID<> ConsumerID_i
Then <Set Diag(CoIDerrOA, isPermanent:=true)>
Else
If ResponseSPDU.MNR<>MNR_i
Then
<Set Diag(MNRerrOA,isPermanent:=true)>
Else
//do nothing
Endif
If ResponseSPDU.SPDU_ID_1<> SPDU_ID_1_i ||
ResponseSPDU.SPDU_ID_2<> SPDU_ID_2_i ||
ResponseSPDU.SPDU_ID_3<> SPDU_ID_3_i
Then <Set Diag(SD_IDerrOA,isPermanent:=true)>
Else
//do nothing
Endif
Endif

FaultReqOA_i:= 1

SAPI.OperatorAckRequested:= 0
RequestSPDU.Flags.OperatorAckRequested:= 0
<Use FSV>

// SPDU NOK

-

// Restart Cycle

[SAPI.Enable==1]

// Invalid parameters

[SAPI.Enable==1 && not <ParametersOK?>]

// WDTimeout

[<ConsumerTimer expired?>]

1 Another event like “Method completion successful” can be used as guard condition of “Changed ResponseSPDU received” as well.

2 SPDUs with all values (incl. CRC signature) being zero shall be ignored, see requirement RQ5.6.

3 See Table 28.