PURPOSE: To detect the runaway of a program and the perform secure processing by comparing the characteristic index of a module which is executed actually with the characteristic index of a module which should be executed originally.

CONSTITUTION: An index confirmation instruction is executed in a period shorter than the period wherein a timer 47 counts from "0" to overflow. If a program runs away to enter an endless loop in a module, the timer 47 generates an overflow signal to inform a CPU41 of the abnormal execution state of the program. When the program branches to a completely different module, the index confirmation instruction is executed at the end of a runaway-destination module and a comparator 45 compares the index of the module that should be executed to the end original which is held in an index register 43 with the index of the runaway-destination module in an index register 42. The both do not coincide with each other and a dissidence signal is outputted to a CPU41 to report the runaway of the program.