Product: Platform_Protocol_SafeComm, the ERTMS/ETCS safe communication library (repository Platform_Protocol_SafeComm). Layer: safe communication service, delivered inside the RTE composition. Language: C99, MISRA C:2012, EN 50128 SIL 4 target, EN 50159. Assessment unit: safe communication (own SIL 4 / EN 50159 evidence, TSI interoperability constituent), see ../../../docs/safety/CERTIFICATION_PLAN.dox.

Responsibility

Carries the authenticated envelope of ETCS messages, not their content (Subset-026 stays in RBC_GP).

Subset	What	Module
Subset-037	EuroRadio FIS: safe communication EVC to RBC over a mobile bearer	euroradio/
Subset-098	RBC/RBC safe communication interface (fixed network)	rbc_rbc/
shared	Safety Functional sub-layer: AU1/AU2/AU3 setup, per-message MAC, sequence numbers, supervision	saf/, mac/

Not in scope: the mobile bearer (GSM-R, FRMCS), online key management (Subset-038, Subset-114), the EuroRadio conformance campaign (Subset-076, Subset-092) and ETCS message content. Keys are supplied as pre-shared material.

Modules on the vital / non-vital boundary (ADR-002)

CMake target	Tier	Runs in
safecomm::safety (SFM: saf, mac, profiles)	Vital, SIL 4	RBC channels A and B
safecomm::cfm (bearer management, whole-PDU interface upward)	Vital context	A and B
safecomm::ale (external listener, peer map, raw relay)	Non-vital	Role C gateway
safecomm::config (key = value loader)	Non-vital	Everywhere

safecomm::all aggregates the four. Only safecomm::cfm uses Platform_RTE (OAL and TCP transport), and only in installed-package mode; safecomm::safety has no dependency on the platform.

Interfaces exposed to other products

Interface	Header	Consumed by
Safety Functional layer	include/safecomm/saf/saf.h, mac/mac.h	RBC channels A and B
Profile fronts	include/safecomm/euroradio/euroradio.h, rbc_rbc/rbc_rbc.h	RBC_GP transport (future)
Transport contract	include/safecomm/transport/transport.h (safecomm_transport_t)	Any transport supplier
CFM	include/safecomm/cfm/cfm.h	RBC channels A and B
ALE	include/safecomm/ale/ale.h	Role C gateway, RBC_Test_CommServer
Configuration	include/safecomm/config/config.h, sample files in etc/	All nodes
Protocol adapter binding	include/safecomm/adapter/protocol_adapter.h	Platform_RTE (rte_protocol_adapter_ops_t)
Build artifacts	dist/<platform>/, CMake package safeCommFramework, Conan safecommframework/0.1.0	All consumers

The library never opens a socket itself; the consumer supplies the transport.

Status

Implemented and tested (9/9 ctest, both without and with the framework linked — see below): config, mac (CBC-MAC per Subset-037-2 §6.2.2, checked against the Annex B worked example), saf (AU1-3/AR handshake, Sa-DATA, Sa-DISCONNECT — PDU layouts per Subset-037-2 §6.2.5), ale, and transport's safecomm_transport_from_channel_service() — a safecomm_transport_t that wraps an already-open, caller-owned rte_channel_service_t (the shape RBC_GP's own train/IL relay channel needs), only compiled when SAFECOMM_USE_INSTALLED_FRAMEWORK links rte::channels; SAFECOMM_STATUS_NOT_IMPLEMENTED otherwise, so a plain unit-test build still needs no framework present. The protocol adapter binding is partly done. cfm, euroradio, rbc_rbc and transport's other entry point, safecomm_transport_oal_tcp() (a different case — a transport that opens its own bearer from a host/port, rather than wrapping one the caller already manages), still return SAFECOMM_STATUS_NOT_IMPLEMENTED. The Subset-098 SAI sub-layer is implemented for the EC-counter variant (sai/sai.c); Triple Time Stamping (the alternative technique) is not. See docs/safety/SUBSET_MAPPING.dox. Build-out order and exit criteria: docs/architecture/ADR-003-protocol-detail-and-build-out.dox.

Build and test

cmake -S . -B build          # finds platform/Platform_RTE by the workspace layout when needed
cmake --build build
ctest --test-dir build --output-on-failure
cmake --install build --prefix .        # dist/<platform>/

Working rules: CLAUDE.md. Design: docs/architecture/ADR-001..003. Clause to code map and the 3DES caveats: docs/safety/SUBSET_MAPPING.dox.