PURPOSE: To detect runaway with the expiration of either of both watchdog timers by providing two kinds of watchdog timer for monitoring program runaway and setting a monitor time to one watchdog timer with a program and fixing a set time to the other with hardware.

CONSTITUTION: After the program is started, a time slightly longer than an initial processing time t3 is set to an auxiliary watchdog timer (WDT)3 by a signal (d). Next, a signal (c) is outputted for the purpose of resetting and starting WDTs 2 and 3. If the initial processing is terminated within the time t3, a value slightly shorter than a normal processing time t4 is set to the auxiliary WDT3, and the WDT2 and the auxiliary WDT3 are reset and started for every processing. If the WDT2 is not reset over the runaway allowable processing time t4 during the normal operation, the auxiliary WDT3 expires, and a time over signal (g) is generated. This signal is outputted as a WDT signal (e) from an OR gate 4 and is used as a condition of restart or stop of the program.