ADR-001 — Scope and layering of the Safe Communication Framework

Status: accepted (skeleton) Date: 2026-09-09 Note: §3 (single-library assumption) is refined by ADR-002 — Stack structure and vital / non-vital deployment**, which splits the library into four targets (safecomm::safety / cfm / ale / config) and places them onto the 2oo2 A/B + Gateway processes. The scope and non-goals in this ADR are unchanged.

Context

The RBC_Template workspace needs ERTMS/ETCS safe communication for two links that today run as plain unauthenticated TCP:

• EVC <-> RBC (the train sims <-> RBC_GP role-C gateways) — governed by Subset-037 (EuroRadio FIS).
• RBC <-> RBC (future handover between the WEST and EAST RBC pairs) — governed by Subset-098.

Both standards define the same safety mechanism (authenticated connection setup, per-message 3DES MAC, sequence numbering, supervision) differing mainly in identities, timers, transport and message set.

Decision

1. One project, one shared SaF sub-layer. Implement the Subset-037 §7 Safety Functional sub-layer once (saf/, mac/) and express Subset-037 and Subset-098 as thin profiles (euroradio/, rbc_rbc/) that only supply parameters and, later, message-set binding.
2. Transport is injected, never opened here. The SaF layer runs over a caller-supplied safecomm_transport_t (send/recv/close callbacks). The mobile bearer / CFM (GSM-R call, Subset-093/146, FRMCS) is out of scope — a simulation runs the safety layer straight over TCP. An OAL-backed TCP transport on Platform_RTE is provided for convenience but is not required to build or unit-test the core.
3. This is a library on Platform_RTE, not beside it. Same dual-mode consumption, same dist/<platform>/ + find_package() + Conan conventions as the rest of the workspace. Only transport/ touches the framework; saf//mac/ are OS-agnostic and testable alone.
4. Dependency arrow points inward only. RBC_GP* will one day consume this to wrap its rbc_wire envelopes; nothing here depends on the application. The ETCS payload (Subset-026) is not this project's concern — it carries the authenticated envelope.
5. Keys are pre-shared. Subset-038 online key management and the KMC (Subset-114) are out of scope; KMAC is a config field.
6. 3DES MAC is implemented as mandated, with the weakness recorded. See docs/safety/SUBSET_MAPPING.dox. A future AES MAC is an additive algorithm selector.

Consequences

• A single state machine and MAC to verify, not two.
• The core is unit-testable against the published SS-037 vectors with no network and no framework checkout.
• Bearer realism (call drop / re-establishment behaviour) is deferred; a simulation gets it "for free" from TCP semantics, a real product would add a CFM later behind the same transport interface.
• Conformance testing (Subset-076/092) is explicitly not attempted here.