PURPOSE: To improve the reliability of a controller and the safety of a control device, by counting the number of times of restart of a program after resetting and holding the device to be controlled in the safe state when this number reaches a set value.

CONSTITUTION: Switches of an address set circuit 14, a data set circuit 15, and a control signal set circuit 16 are operated to set prescribed values, and power is turned on. Just after power-on, outputs of a reset circuit 6 and a write time setting circuit 10 are 0, and a microprocessor MPU 1 is reset, and switching circuits 11W13 are conductive, and data is set to a designated address of an RAM 3. At a prescribed time, the circuit 10 outputs "1" to a line L, and circuits 11W13 are made non-conductive, and circuits 14W16 are disconnected. After a prescribed time, the output of the circuit 6 becomes 1, and the MPU 1 is set, and a program of an ROM 2 is executed. When the overrun of the program occurs, the program is restarted after the MPU is reset. When the number of times of restart reaches a prescribed value or more, the control is transferred to a safety program.