JP2014035729A - Vehicle control device - Google Patents

Abstract

PROBLEM TO BE SOLVED: To provide a vehicle control device that is able to prevent malfunction when writing of updated data on a non-volatile memory is interrupted.SOLUTION: In the beginning and the end of the process of writing updated data in a non-volatile memory, the sum values of all are written. Prior to the correction of an error detected in the reading of the updated data in the start, the sum values of the all are subjected to a conformity determination, thereby determining whether interruption has occurred or not due to power shutdown, or the like, in the course of writing updated data. Here, if a determination is made that writing has been interrupted, the updated data is re-written to a fixed value, then, the updated data is subjected to the correction of a detected error. Thus, a detected error is corrected while the updated data in the state of abnormal due to interruption of writing is present. Accordingly, reset and erroneous detection are prevented from being repeated due to an abnormal state of data the error of which cannot be corrected.

Description

  The present invention relates to a vehicle control device including a nonvolatile memory that can be electrically erased and written.

  Japanese Patent Application Laid-Open No. 2004-228688 shows whether or not data is written in a redundant area of the first page of a physical block when data is written to a nonvolatile memory composed of a plurality of physical blocks, and whether or not the data is written in the first page. Disclosed is a method for controlling a non-volatile storage device, comprising: a first flag writing step for writing a fixed value indicating that data is written to one flag; and a data writing step for writing data to the physical block. Has been.

International Publication No. 2004/031966

  For example, in a vehicle control device that is configured to detect an error in update data written in the nonvolatile memory at the time of start-up, the writing is interrupted because the power is cut off while the update data is being written to the nonvolatile memory. However, if there is an abnormality in the update data, it will be possible to reset the error data without a chance to forcibly rewrite the error data at the time of restart, and it will be impossible to move the system due to repeated error detection and reset. there were.

  The present invention has been made in view of the above problems, and an object of the present invention is to provide a vehicle control device that can suppress malfunction when writing of update data to a nonvolatile memory is interrupted.

  Therefore, in the present invention, there is provided a non-volatile memory that is electrically erasable and writable, and at the time of start-up, an error is detected in update data of the non-volatile memory, and a reset is performed when an error is detected. In the apparatus, when there is an interruption in the writing of update data to the nonvolatile memory, the update data is rewritten to a predetermined value prior to the error detection at the time of startup, and then the error detection is performed.

  According to the above invention, even when there is an interruption in the writing of the update data, it is possible to suppress repeated error detection and reset by rewriting the update data to a predetermined value prior to error detection at the time of startup. Therefore, it is possible to suppress malfunction.

It is a block diagram of a control device for vehicles in an embodiment of the invention of this application. It is a figure which shows the address space of the non-volatile memory in embodiment of this invention. It is a time chart which shows the state change at the time of starting of the control apparatus for vehicles in embodiment of this invention, and access of a non-volatile memory. It is a flowchart which shows an example of the process at the time of starting of the control apparatus for vehicles in embodiment of this invention. It is a figure for demonstrating the mode of writing of the whole sum value (interruption discriminating value) in the embodiment of this invention, and the mode of rewriting by a fixed value. It is a flowchart which shows an example of the process at the time of starting of the control apparatus for vehicles in embodiment of this invention. It is a flowchart which shows an example of the process at the time of starting of the control apparatus for vehicles in embodiment of this invention.

Embodiments of the present invention will be described below.
FIG. 1 is a block diagram illustrating an example of a vehicle control device.
A vehicle control device 1 shown in FIG. 1 is a device that controls various vehicle-mounted devices (engines, automatic transmissions, air conditioners, etc.), and includes a microcomputer (calculator) 2, a power supply circuit 3, and an I / F circuit 4. Etc.

A microcomputer (hereinafter referred to as “microcomputer”) 2 includes a CPU (arithmetic processing unit) 21, an electrically erasable and writable nonvolatile memory 22 such as a flash ROM and an EEPROM, and a volatile memory 23 such as a RAM. It is out.
The nonvolatile memory 22 can be a memory module (ECC memory) with a bit error detection function. A memory module with a bit error detection function has, for example, an error correction code ECC (redundant data), and can detect and correct an error for a 1-bit error, whereas for a 2-bit error, This is a module that can detect errors but cannot correct them.
The microcomputer 2 inputs a sensor signal or the like from the outside via the I / F circuit 4 and outputs an operation signal or the like toward the outside via the I / F circuit 4.

The microcomputer 2 and the power supply circuit 3 are supplied with electric power from a vehicle power supply (battery) 6 via a power switch 5 that is turned on / off by the driver.
Further, the power of the vehicle power supply 6 is also supplied to the microcomputer 2 and the power supply circuit 3 through a path through the self-shutoff relay 7 whose on / off is controlled by the power supply circuit 3. By keeping 7 on, it is possible to continue supplying power to the microcomputer 2 even after the power switch 5 is turned off.
The power supply circuit 3 also has a function as an external monitoring circuit that inputs a program run signal P-RUN from the microcomputer 2 and outputs a reset signal to the microcomputer 2.

For example, as shown in FIG. 2, a code (error correction code ECC) for bit error detection and bit error correction is stored in the nonvolatile memory 22 for each one or a plurality of stored data. ing.
In FIG. 2, the update data is learning data or failure diagnosis data (failure history data) that is updated and written sequentially during the power-on period of the microcomputer 2, and the fixed data is a control constant that is written in the initial state. Data that is not updated.

As shown in FIG. 3, when the microcomputer 2 is started by turning on the power, first, after performing the initialization process, the update data is read from the nonvolatile memory 22 while performing error detection and correction, and all update data is read. Upon completion, other processing (including writing update data) is performed.
The update data is written to the nonvolatile memory 22 as necessary during the power-on period after the reading of all the update data is completed, and the update data write timing is random.

Hereinafter, an example of update data processing at the time of startup in the microcomputer 2 will be described in detail according to the flowchart of FIG.
When the microcomputer 2 is turned on (when the power is turned on and the reset is released), first, initialization processing is performed in step S101.

When the initialization process is completed, the process proceeds to step S102, where error detection / correction is prohibited for all the update data in the nonvolatile memory 22 or the storage data area including the update data (in other words, the start of error detection / correction is delayed). ), Prior to error detection and correction, the process proceeds to the update data rewrite process in steps S103 to S105.
In the update data rewrite process in steps S103 to S105, the update data is set to a predetermined value when the update data is interrupted due to power interruption or the like during the update data write and an abnormality occurs in the update data. This is a process of rewriting the updated error correction code ECC calculated in the rewriting and writing processes.
Then, after the update data rewrite process is completed, in step S106, error detection and correction for all the update data in the nonvolatile memory 22 or the storage data area including the update data is activated.

In step S103, the first sum value and the second sum value, which are interruption determination values for determining whether or not the writing of update data has been interrupted, are stored in an area (hereinafter referred to as “the update data” in the nonvolatile memory 22). Update data area).
In writing update data to the update data area, before starting writing, the total sum value of a plurality of update data determined to be written is calculated, and the total sum value is used to determine whether or not the writing is interrupted. A plurality of values are written in the nonvolatile memory 22 in the process of writing update data.

More specifically, as shown in FIG. 5A, the whole sum value is written together with the update data to be written first, and the same whole sum value as the first is written together with the update data to be written last. Yes. That is, the same whole sum value (interruption determination value) is written to the update data area at the beginning and end of the update data write process.
In step S103, the total sum value stored together with the update data written at the beginning of the writing process is read as the first sum value, and further the total sum value stored together with the update data written at the end of the writing process. Is read as the second sum value.
The total sum value as the interruption determination value can be written immediately before the first update data is written, or can be written immediately after the last update data is written.

Here, when the writing is interrupted due to power interruption or the like during the writing of the update data, as shown in FIG. 5A, the entire sum value (first sum value) on the first side of the writing process is written at that time. The total sum value of the scheduled update data is updated, but the last update data writing process does not proceed, so the last total value (second sum value) in the writing process is overwritten with the previous value. Therefore, the first sum value and the second sum value are inconsistent (mismatched).
Note that the power interruption in the microcomputer 2 occurs due to removal of the power source (battery), disconnection of the power supply harness, disconnection of the intermediate connector, or the like. When the power supply to the microcomputer 2 is momentarily interrupted, the program run signal P-RUN output from the microcomputer 2 is interrupted, and the power supply circuit 3 outputs a reset signal to the microcomputer 2 to restart the microcomputer 2.

On the other hand, if the process of writing a series of update data proceeds without interruption, the entire sum value is written at the beginning of the writing process, and the entire sum value is written at the end of the writing process. And the total sum value (interruption discriminant value) of the last side coincide (match).
Therefore, the first sum value stored in the address to which the entire sum value (interruption determination value) is written on the first side in the writing process and the address to which the entire sum value (interruption determination value) is written on the last side in the writing process. Whether or not the previous update data writing process is interrupted can be determined based on whether or not the second sum value matches (matches).

Therefore, in step S104, the first sum value and the second sum value read in step S103 are compared (collated), and if the first sum value and the second sum value do not match (mismatch), In the last update data write process, it is determined that the write interruption has occurred, and the process proceeds to step S105 to deal with an abnormality (damage) of the update data due to the interruption.
On the other hand, when the first sum value and the second sum value match (match), in the previous update data write process, the series of update data is not interrupted until the last update data is written. Judge that writing was performed normally from the beginning to the end. In this case, there is no damage (uncorrectable abnormality) of the update data due to the interruption of writing, and the process of step S105 is unnecessary, so the process bypasses step S105 and proceeds to step S106.

If update data with error detection and correction is read in a state where there is an abnormality (damage) in the update data, an update data error (a 2-bit error that cannot be corrected) is detected, which will be described later. Then, the microcomputer 2 is reset. Here, when the processing of each step from step S102 to step S106 is not performed, the reset and error detection are repeated by performing the error detection and correction again without resolving the abnormality of the update data after canceling the reset. The control operation will not be started.
Therefore, in order to prevent reset based on error detection, in step S105, the update data which is a fixed value and the error correction code ECC calculated in the writing process are overwritten in all the update data areas, and an abnormality is detected. All the update data including the update data is rewritten to a predetermined fixed value, rewritten to the updated all error correction code ECC calculated in the writing process, and the rewritten update data is a fixed value. An appropriate total sum value is written to the update data area at the beginning and end of writing.

FIG. 5B shows a state after the update data and the error correction code ECC are overwritten with fixed values in the update data area, and further interrupted from the first update data to the update data at the time when writing was interrupted. All of the update data that has not been newly written (overwritten) thereafter has been rewritten to a fixed value, and all error correction codes ECC are error correction codes ECC calculated in the writing process corresponding to the update data. Has been rewritten.
The fixed value of the update data is stored in the nonvolatile memory 22 in advance.
Note that the fixed value of the update data and the error correction code ECC can be stored in the nonvolatile memory 22 in advance as a combination of update data and error correction code ECC in which no error is detected in error detection.

Here, when the update data is a learning value, the fixed value can be an initial value (default value) of the learning value. Further, a fixed value is held for each address of the update data, and the fixed value corresponding to each address can be overwritten.
In addition, the entire sum value can be used as the interruption determination value. For example, a random value or a value that is sequentially updated for each writing process is set as the interruption determination value, and this is set in the update data writing process. Can be written at the beginning and end.

In addition, a plurality of interruption determination values to be written in time series in the writing process can be different values satisfying a predetermined correlation. In this case, if a plurality of interruption determination values satisfy a prescribed correlation, The interruption determination values are consistent, indicating that there was no interruption. Here, the state satisfying the specified correlation is, for example, a case where the ratio or the deviation is a predetermined value.
Further, for example, when writing update data, the total sum value of the update data to be written is calculated and written to the non-volatile memory 22, while all the update data in the update data area is read at startup and the total sum value is read. Whether or not the writing is interrupted by determining the consistency (match or mismatch) between the total sum value written in the nonvolatile memory 22 and the total sum value calculated based on the read update data. Can be determined.

  When all the update data and the error correction code ECC including the update data in which an error has occurred are rewritten to a predetermined fixed value as described above, the process proceeds to step S107 and thereafter error detection is performed. In addition, the occurrence of an abnormality in the update data (an error that cannot be corrected) is detected and reset is avoided, and finally the process proceeds to step S112, where the control by the vehicle control device 1 can be started.

In step S106, the cancellation of error detection and correction in the nonvolatile memory 22 is canceled, and reading of update data after step S107 is started.
In step S107, the update data and its error correction code ECC are read from the update data area of the nonvolatile memory 22. Here, in step S105, all update data is rewritten to a fixed value, and after rewriting to the updated all error correction code ECC, when the process proceeds to step S107, the update data and error correction code ECC as fixed values are read. It will be.

In step S108, the update data and its error correction code ECC are collated.
If there is no abnormality in the collation result, the process proceeds to step S111 to determine whether reading of all update data is completed. If reading of all update data is not completed, the process returns to step S107. Then, the next update data and its error correction code ECC are read, and when reading of all the update data is completed, the process proceeds to step S112 and proceeds to other processing.

On the other hand, if there is an abnormality in the collation result in step S108 (if there is an error in the read update data), the process proceeds to step S109.
In step S109, it is determined whether or not the update data error is a correctable bit error. For example, it is determined whether or not the update data error is a 1-bit error.

Here, if the abnormality of the update data is a 1-bit error, it can be corrected. Therefore, the process proceeds to step S110, the update data is corrected, and the process proceeds to step S111.
If an error of 2 bits or more has occurred, it is determined that correction is not possible, and the process proceeds to step S113, where, for example, the address of update data in which an error has occurred is stored in the nonvolatile memory 22 as error information.

Next, in step S114, the microcomputer 2 is shut down (execution of an instruction for shutting down), and in step S115, the output of the program run signal P-RUN is stopped.
The power supply circuit 3 functioning as an external monitoring circuit monitors the program run signal P-RUN output from the microcomputer 2 and outputs a reset signal for resetting the microcomputer 2 when the program run signal P-RUN is interrupted.

The microcomputer 2 that has input the reset signal executes the reset process in step S116 and restarts, thereby performing the initialization process in step S101 again, and then proceeds to step S102.
As described above, if update data writing is interrupted due to power interruption or the like during update data writing, the presence or absence of interruption based on the first sum value and the second sum value at the time of restart prior to error detection If it is determined that the interruption has occurred, the update data in the update data area is rewritten to a fixed value and rewritten to the updated error correction code ECC.

As a result, even if there is an abnormality in the update data due to the interruption of writing, error detection is not performed as it is, and update data is rewritten in a state where no error is detected, and then error detection is performed. It is possible to prevent the error detection and the reset from being repeated due to the power interruption during the data writing.
It should be noted that even when the power supply is interrupted while the update data is being rewritten to a fixed value in step S105, the total sum value written first (interrupt discriminant value) and the last sum value written last (interrupt discriminant value) Thus, it is determined that the writing has been interrupted at the time of activation, and the update data in the update data area is rewritten to a fixed value and the process of rewriting the updated error correction code ECC is performed again. It will be. Therefore, it is possible to prevent the error detection and reset from being repeated even when the writing process is interrupted in step S105.

By the way, in the process shown in the flowchart of FIG. 4, it is determined whether or not writing has been interrupted for the entire update data area. If there is an interrupt, the entire update data area is rewritten with a fixed value. It is possible to divide the update data area into a plurality of blocks, determine whether or not the writing is interrupted for each block, and rewrite only the block in which the writing interruption has occurred with a fixed value.
As described above, if rewriting is performed with the presence or absence of interruption and a fixed value in units of blocks obtained by dividing the update data area, it is possible to suppress rewriting of a normal value with no error detected to a fixed value. If the update data is, for example, a learning value, it is possible to prevent the progress of learning from being impaired.
In the process shown in the flowchart of FIG. 4, after the shutdown process is performed in step S114, the external monitoring circuit outputs a reset signal due to the stop of the program run signal P-RUN, or the microcomputer 2 itself resets the reset signal. Can be output.

The flowchart of FIG. 6 shows the flow of processing of the microcomputer 2 in which rewriting is performed with or without writing interruption and a fixed value in units of blocks obtained by dividing the update data area into a plurality of blocks.
In the flowchart of FIG. 6, steps that perform the same processes as those in the flowchart of FIG. 4 are given the same step numbers, and steps S103A, 104A, 105A, and the steps that are different from the flowchart of FIG. 105B will be described in detail, and descriptions of other steps will be omitted.

In step S103A, the first sum value and the second sum value, which are interruption determination values for determining whether or not update data writing has been interrupted, are read for each of a plurality of blocks into which the update data area is divided.
When writing update data to the update data area, the total sum value of the update data determined to be written for each block is calculated, and the total sum value is calculated when writing the first update data and the last update data of each block. I write it.
In step S103A, the whole sum value written together with the first update data in the target block is read as the first sum value, and the whole sum value written together with the last update data is read out as the second sum value.

In the next step S104A, the first sum value and the second sum value for each block read in step S103A are compared (collated), and the first sum value and the second sum value do not match (inconsistency). In this case, it is determined that writing interruption has occurred in the previous update data writing process in the block, and the process proceeds to step S105A.
In step S105A, the update data of the block for which it is determined that the write interruption has occurred is rewritten to a fixed value, and the error correction code ECC that is calculated and updated during the write process is rewritten.

On the other hand, if the first sum value and the second sum value match (match), in the previous update data write processing in the block, from the first update data write to the last update data write Judge that it was done normally without interruption. In this case, since the process of step S105A is unnecessary, the process bypasses step S105A and proceeds to step S105B.
In step S105B, it is checked whether or not writing has been interrupted for all blocks obtained by dividing the update data area into a plurality of blocks. Return to S103A.

Then, in step S103A, the first sum value and the second sum value are read out for the blocks for which it has not been determined whether or not the writing is interrupted. Then, the process proceeds to step S104A, where the first sum value and the second sum value are determined. Thus, it is determined whether or not an interruption due to power interruption or the like has occurred in writing update data in the block.
If it is determined in step S105B that all blocks that divide the update data area are determined to be interrupted, the process proceeds to step S106. In step S106, the cancellation of the error detection / correction of the update data in step S102 is canceled, and the update data accompanying the error detection process in step S107 and subsequent steps is started.

As described above, if the update data area is divided into a plurality of blocks and the presence or absence of write interruption is determined for each block, the update data can be written normally without interruption. Are not rewritten to fixed values.
Therefore, it is possible to prevent the update data that has been normally written from being rewritten unnecessarily to a fixed value while suppressing the reset and error detection from being repeated due to an abnormality in the update data due to the interruption of writing, For example, if the update data is a learning value, it is possible to prevent the learning from being redone.

By the way, when writing update data to the non-volatile memory 22, mirroring for writing the same update data to two areas is performed, in other words, when a data file having the same configuration is duplicated, Even when an interruption (power interruption) occurs in writing and an error occurs in the update data, the update data can be written to the other area of the same structure without interruption.
In this case, since the correct value of the update data in which the error has occurred is stored in the other area, the update data of the area in which the write interruption has occurred is stored in the other update data area. Can be rewritten to a certain value.

An example of the rewriting process in the mirroring will be described with reference to the flowchart of FIG.
In the flowchart of FIG. 7, steps that perform the same processing as in the flowchart of FIG. 4 are given the same step numbers, and steps S103B, S104B, and S105C, which are steps different from those in the flowchart of FIG. Step S105D will be described in detail, and description of other steps will be omitted.

In step S103B, for one area (surface) in mirroring, the entire sum value (interruption determination value) stored together with the update data written at the beginning of the writing process is read as the first sum value, and further, at the end of the writing process The total sum value (interruption determination value) stored together with the update data written to is read as the second sum value.
In step S104B, the first sum value and the second sum value read in step S103B are compared (collated), and if the first sum value and the second sum value do not match (mismatch), In the previous update data writing process, it is determined that the interruption of the writing due to the power interruption has occurred, and the process proceeds to step S105C for coping with the abnormality of the updating data due to the interruption.

On the other hand, if the first sum value and the second sum value match (match), in the previous update data writing process, the area (surface) is interrupted until the last update data is written. Judge that it was done normally. In this case, since the process of step S105C is unnecessary, the process proceeds to step S105D bypassing step S105C.
In step S105C, a process of rewriting all the update data in the area where the occurrence of the interruption is detected is duplicated data stored in the other area (duplicate area) having the same structure. The error correction code ECC calculated during the rewriting process is also rewritten.

In step S105D, it is determined whether or not write interruption has been determined for each mirroring area. If there is an area where the write interruption has not been determined, the process returns to step S103B, and the interruption determination has not ended. The first sum value and the second sum value are read out.
Here, before proceeding to step S105C, it is determined whether or not writing has been interrupted for each of the mirroring surfaces. If the interrupt has occurred on the one hand and no interrupt has occurred on the other, the process proceeds to step S105C. Thus, the update data of the area where the interruption has occurred can be overwritten with the update data of the area where the interruption has not occurred.

In addition, when interruption occurs on both sides of the mirroring, the update data of both areas can be rewritten to a fixed value.
Furthermore, each surface of the mirroring is divided into a plurality of blocks, an interruption determination value (overall sum value) is stored for each block, the presence / absence of interruption is determined in units of blocks, and the block in which writing interruption has occurred The update data of the corresponding block on the other side can be overwritten.

In the process shown in the flowchart of FIG. 7, when update data is replicated by mirroring, even if an update data error occurs due to write interruption, it is possible to overwrite the correct value.
Therefore, even if the update data becomes abnormal due to the interruption of writing, it is possible to prevent the reset and error detection from being repeated by preventing the reset due to the error detection at the start. If it is learning data, it is possible to avoid re-learning and to perform control reflecting the learning results up to that point.

The interruption determination value can be written to the nonvolatile memory 22 every time one or a plurality of update data is written, without being limited to the beginning and the end of the update data writing process. In this case, the interruption determination value is consistent. From the switching timing between the status and the inconsistent status, the writing interruption (power cutoff) occurrence position, in other words, the update data that may have been damaged by the power shutdown, the interruption discriminating value writing cycle is the smallest unit Can be specified.
In this case, since the interruption position of writing can be specified, at least one or more update data (update data that is likely to be damaged) corresponding to the interruption position is rewritten to a fixed value, and the update corresponding to the data is performed. While the error correction code ECC is rewritten, other update data can be retained as it is.

Here, technical ideas other than the claims that can be grasped from the above embodiment will be described together with effects.
(A) The vehicle control device according to claim 2 or 3, wherein the interruption determination value is written at least at the beginning and at the end of the update data writing process to the nonvolatile memory.
According to the above invention, when the first interruption determination value and the last interruption determination value do not match, it can be determined that an interruption has occurred in the middle of writing.

(B) The vehicle control device according to any one of claims 1 to 3, wherein the interruption determination value is an entire sum value of update data for which writing has been determined.
According to the above invention, a plurality of total sum values of the update data determined to be written are written in the update data writing process, and the total sum value written before the writing is interrupted is the update of the write schedule at that time. Since the total sum value is not rewritten after the interruption, the whole sum value with the writing timing after the interruption corresponds to the data before the update, and the whole sum value is inconsistent. The presence or absence of interruption can be determined.

(C) The vehicle control device according to any one of claims 1 to 3, wherein the predetermined value is a predetermined fixed value.
According to the above-described invention, the update data damaged by the interruption of writing is rewritten to a fixed value so that it is determined to be normal even if error detection is performed.

(D) When the update data is written, duplicate data is written,
The vehicle control device according to claim 1, wherein the predetermined value is duplicate data of update data.
According to the above invention, even if the update data is damaged due to the interruption of writing, it can be determined to be normal even if error detection is performed by rewriting the copy data separately stored, and the latest value as the update data. Can be revived.

(E) the update data is written to the nonvolatile memory together with an error correction code;
The vehicle control device according to claim 1, wherein when the update data is rewritten to a predetermined value, the updated error correction code calculated in the writing process is rewritten.
According to the above invention, the occurrence of an error is prevented from being detected by error detection by rewriting the updated error correction code calculated in the update data writing process.

  DESCRIPTION OF SYMBOLS 1 ... Control apparatus for vehicles, 2 ... Microcomputer, 3 ... Power supply circuit, 4 ... I / F circuit, 5 ... Power switch, 6 ... Vehicle power supply, 7 ... Self shut-off relay, 21 ... CPU, 22 ... Non-volatile memory

Claims (3)

In a vehicle control device that includes a nonvolatile memory that is electrically erasable and writable, performs error detection of update data in the nonvolatile memory at startup, and performs reset when an error is detected,
A vehicle control device that rewrites the update data to a predetermined value prior to the error detection at the time of activation and then performs the error detection when there is an interruption in the writing of the update data to the nonvolatile memory. In the process of writing update data to the nonvolatile memory, a plurality of interruption determination values are written,
The vehicle control device according to claim 1, wherein, when the plurality of interruption determination values do not match, the update data is rewritten to a predetermined value prior to the error detection at the time of activation.   The update data storage area in the nonvolatile memory is divided into a plurality of blocks, and in the process of writing the update data, a plurality of interruption determination values are written for each of the plurality of blocks, and the predetermined number of the update data is written for each of the plurality of blocks. The vehicle control device according to claim 2, wherein the value is rewritten.