CAN Vehicle Network Gear Controller

/* SWR-002..SWR-007 */
bool gear_transition_allowed(const gear_ctx_t *ctx, gear_t requested)
{
    if (ctx == 0) return false;
    if (requested >= GEAR_COUNT) return false;
    if (requested == ctx->current) return true;

    /* SWR-005: neutral is always reachable. */
    if (requested == GEAR_NEUTRAL) return true;

    /* SWR-004: parking pawl protection. */
    if (requested == GEAR_PARK) {
        return ctx->speed_kph_x10 <= SPEED_PARK_LIMIT_X10;
    }

    /* SWR-003: reverse only at very low speed. */
    if (requested == GEAR_REVERSE) {
        if (ctx->speed_kph_x10 > SPEED_REVERSE_LIMIT_X10) return false;
        /* SWR-002: leaving PARK needs the brake. */
        if (ctx->current == GEAR_PARK && !ctx->brake_applied) return false;
        return true;
    }

    if (gear_is_forward(requested)) {
        /* SWR-002: leaving PARK needs the brake. */
        if (ctx->current == GEAR_PARK) {
            if (!ctx->brake_applied) return false;
            return requested == GEAR_D1;   /* pull away in first */
        }
        /* From reverse or neutral, engage first gear only. */
        if (ctx->current == GEAR_REVERSE || ctx->current == GEAR_NEUTRAL) {
            return requested == GEAR_D1;
        }
        /* SWR-007: single-step shifts between forward gears. */
        int delta = (int)requested - (int)ctx->current;
        return (delta == 1) || (delta == -1);
    }

    return false;
}

/* Byte layout (SWR-020):
     0    gear
     1-2  speed km/h x10, little endian
     3    throttle percent
     4    faults
     5    reserved (0)
     6    rolling counter, low nibble (SWR-021)
     7    checksum over bytes 0..6 (SWR-022)
*/

uint8_t can_checksum(const uint8_t *data, size_t len)
{
    uint8_t sum = 0u;
    if (data == 0) return 0u;
    for (size_t i = 0u; i < len; ++i) {
        sum = (uint8_t)(sum + data[i]);
    }
    return (uint8_t)(0xFFu - sum);
}

can_result_t can_encode_gear_status(const gear_status_t *in, uint8_t buf[CAN_DLC])
{
    if (in == 0 || buf == 0) return CAN_ERR_NULL;

    buf[0] = (uint8_t)in->gear;
    buf[1] = (uint8_t)(in->speed_kph_x10 & 0xFFu);
    buf[2] = (uint8_t)((in->speed_kph_x10 >> 8) & 0xFFu);
    buf[3] = in->throttle_pct;
    buf[4] = in->faults;
    buf[5] = 0u;
    buf[6] = (uint8_t)(in->counter & CAN_COUNTER_MAX);
    buf[7] = can_checksum(buf, 7u);

    return CAN_OK;
}

/* src/can_protocol.c - a frame is only trusted if it is fresh and intact */
/* SWR-024: counter must advance by exactly one, modulo 16. */
    if (ctx->have_last) {
        uint8_t expected = (uint8_t)((ctx->last_counter + 1u) & CAN_COUNTER_MAX);
        if (out->counter != expected) {
            ctx->last_counter = out->counter;
            return CAN_ERR_COUNTER_GAP;
        }
    }

/* SWR-032 */
void can_rx_tick(can_rx_ctx_t *ctx, uint32_t now_ms)
{
    if (ctx == 0) return;
    if (!ctx->have_last) return;
    if ((now_ms - ctx->last_rx_ms) >= CAN_TIMEOUT_MS) {
        ctx->faults |= (uint8_t)FAULT_TIMEOUT;
    }
}