Resident manufacturing test software based system for mitigating risks associated with vehicle control modules

1. A vehicle control module comprising:

a hybrid memory comprising

application memory configured to store application code,

boot memory configured to store a first resident manufacturing test software (RMTS) code and boot code, wherein the first RMTS code includes a first set of risk functions, and

ephemeral test memory configured to temporarily store a second RMTS code, wherein the second RMTS code includes a second set of risk functions accessible only via the first RMTS code; and

a processor configured to

based on at least an operating mode of the vehicle control module, execute the application code, the boot code, the first RMTS code and the second RMTS code,

erase the ephemeral test memory prior to at least one of installation of the vehicle control module in a vehicle or delivery of the vehicle to a customer, and

based on the first RMTS code,

permit execution of the first RMTS code prior to and subsequent to installation of the vehicle control module in the vehicle and subsequent to removal from the vehicle, and

permit execution of the second RMTS code prior to at least one of installation of the vehicle control module in the vehicle or delivery of the vehicle to a customer.

2. The vehicle control module of claim 1 , wherein:

the boot memory is configured to store boot code for booting up the vehicle control module; and

a bootloader of the boot code does not have access to the ephemeral test memory.

3. The vehicle control module of claim 1 , wherein at least some of the second set of risk functions have a higher risk than the first set of risk functions.

4. The vehicle control module of claim 1 , wherein:

the first RMTS code supports production and warranty analysis of the vehicle control module; and

the first RMTS code includes a function for reading inputs of the vehicle control module, a function for arbitrarily driving outputs of the vehicle control module, a function for querying the ephemeral test memory, a function to determine if the second RMTS code is stored in the ephemeral test memory, and a function to initiate a power-up reset of the vehicle control module to exit an RMTS mode of operation.

5. The vehicle control module of claim 1 , wherein the second RMTS code includes at least one of a function for manipulating a memory of the vehicle control module or a function for emulating elements of the behavior of the vehicle control module.

6. The vehicle control module of claim 1 , wherein:

the processor is configured to (i) receive a diagnostic control signal from a diagnostic test control module to erase the ephemeral test memory, and (ii) based on the diagnostic control signal and while executing boot software, erase the ephemeral test memory; and

the diagnostic test control module is separate from the vehicle control module.

7. The vehicle control module of claim 1 , wherein:

the processor is configured to check a status of the ephemeral test memory based on a request signal received from a diagnostic test control module; and

the diagnostic test control module is separate from the vehicle control module.

8. The vehicle control module of claim 7 , wherein:

the processor is configured to, if high risk RMTS functions are stored in the ephemeral test memory, at least one of permit access to the ephemeral test memory or execution of the second RMTS code via the first RMTS code; and

the second RMTS code includes the high risk RMTS functions.

9. The vehicle control module of claim 1 , wherein the processor is configured to execute the application code and while executing the application code generate a data identifier to check a status of the ephemeral test memory.

10. The vehicle control module of claim 9 , wherein:

the processor is configured to

based on the status of the ephemeral test memory, receive a diagnostic control signal from a diagnostic test control module, and

based on a routing identifier, erase the ephemeral test memory and update one or more software integrity check values in one or more blocks of the ephemeral test memory; and

the diagnostic test control module is separate from the vehicle control module.

11. The vehicle control module of claim 1 , wherein:

the processor is configured to:

receive and store the second RMTS code in the ephemeral test memory,

generate a software integrity check value indicating a status of at least a portion of the ephemeral test memory, and

store the software integrity check value in a portion of a block of the ephemeral test memory; and

the software integrity check value is a software image of another portion of the block of the ephemeral test memory.

12. The vehicle control module of claim 1 , wherein the processor is configured to:

during boot up of the vehicle control module, check a status of an interface of the vehicle control module including receiving signals at the interface;

based on the signals, determining whether a plurality of environmental enabling conditions are satisfied; and

based on whether the plurality of environmental enabling conditions are satisfied, at least one of permitting access to the ephemeral test memory or execution of the second RMTS code.

13. The vehicle control module of claim 12 , wherein:

the processor is configured to

execute a security procedure including receiving security information from a diagnostic test control module and verifying the security information, and

if the security information is verified and the environmental enabling conditions are satisfied, then at least one of permitting access to the ephemeral test memory or execution of the second RMTS code; and

the diagnostic test control module is separate from the vehicle control module.

14. The vehicle control module of claim 12 , wherein the processor is configured to:

check the status of the interface a predetermined number of times;

determine whether a predetermined period has lapsed since the interface was first checked after a last power up was initiated of the vehicle control module; and

if the environmental enabling conditions are not satisfied after the predetermined number of times or after the predetermined period has lapsed, then boot the vehicle control module, such that at least one of access to or execution of the second RMTS code is prevented.

15. A non-transitory computer-readable medium comprising application memory configured to store application code, boot memory configured to indefinitely store a first resident manufacturing test software (RMTS) code, and ephemeral test memory configured to temporarily store a second RMTS code, wherein the first RMTS code includes a first set of risk functions, wherein the second RMTS code includes a second set of risk functions, the non-transitory computer-readable medium having stored thereon instructions executable by a processor to:

based on at least an operating mode of a vehicle control module, execute the application code, the first RMTS code and the second RMTS code,

erase the ephemeral test memory prior to at least one of installation of the vehicle control module in a vehicle or delivery of the vehicle to a customer, and

based on the first RMTS code,

permit execution of the first RMTS code prior to and subsequent to installation of the vehicle control module in the vehicle, and

permit execution of the second RMTS code prior to at least one of installation of the vehicle control module in the vehicle or delivery of the vehicle to a customer.

16. The non-transitory computer-readable medium of claim 15 , wherein:

at least some of the second RMTS code includes higher risk functions than the first RMTS code;

the first RMTS code includes a function for reading inputs of the vehicle control module, a function for arbitrarily driving outputs of the vehicle control module, a function for querying the ephemeral test memory, a function to determine if the second RMTS code is stored in the ephemeral test memory and access the second RMTS code if stored in the ephemeral test memory, and a function to initiate a power-up reset of the vehicle control module; and

the second RMTS code includes at least one of a function for manipulating a memory of the vehicle control module or a function for emulating elements of the behavior of the vehicle control module.

17. The non-transitory computer-readable medium of claim 15 , wherein:

the instructions are further to:

check a status of the ephemeral test memory based on a request signal received from a diagnostic test control module, wherein the diagnostic test control module is separate from the vehicle control module, and

if high risk RMTS functions are stored in the ephemeral test memory, at least one of permit access to the ephemeral test memory or execution of the second RMTS code; and

the second RMTS code includes the high risk RMTS functions.

18. The non-transitory computer-readable medium of claim 15 , wherein the instructions are further to:

execute the application code and while executing the application code generate a data identifier to check a status of the ephemeral test memory;

based on the status of the ephemeral test memory, receive a diagnostic control signal from a diagnostic test control module, wherein the diagnostic test control module is separate from the vehicle control module; and

based on the diagnostic control signal, erase the ephemeral test memory and update one or more software integrity check values in one or more blocks of the ephemeral test memory.

19. The non-transitory computer-readable medium of claim 15 , wherein:

the instructions are further to

receive and store the second RMTS code in the ephemeral test memory,

generate a software integrity check value indicating a status of at least a portion of the ephemeral test memory, and

store the software integrity check value in a portion of a block of the ephemeral test memory; and

the software integrity check value is a software image of a second portion of the block of the ephemeral test memory.

20. The non-transitory computer-readable medium of claim 15 , wherein the instructions are further to:

during boot up of the vehicle control module, check a status of an interface of the vehicle control module including receiving signals at the interface;

based on the signals, determine whether a plurality of environmental enabling conditions are satisfied; and

based on whether the plurality of environmental enabling conditions are satisfied, execute the first RMTS code and at least one of permit access to the ephemeral test memory or execution of the second RMTS code via the first RMTS code.