Microprocessor runaway monitoring control circuit

• US 6,883,123 B2
• Filed: 04/23/2002
• Issued: 04/19/2005
• Est. Priority Date: 10/24/2001
• Status: Expired due to Fees

• Current Assignee: Mitsubishi Denki Kabushiki Kaisha (Mitsubishi Electric Corporation)
• Original Assignee: Mitsubishi Denki Kabushiki Kaisha (Mitsubishi Electric Corporation)
• Inventors: Fujita, Masahide, Hashimoto, Kohji, Nakamoto, Katsuya, Mitsueda, Hiroyuki
• Primary Examiner(s): Beausoliel, Robert
• Assistant Examiner(s): PUENTE, EMERSON C
• Application Number:
  US10/127,484
• Publication Number:
  US 20030079163A1
• Time in Patent Office: 1,092 Days
• Field of Search: 714/23, 714/41, 714/51, 714/55
• US Class Current: 714/55
• CPC Class Codes: G06F 11/0721 within a central processing unit [CPU]
• CPC Class Codes: G06F 11/0757 by exceeding a time limit, i.e. time-out, e.g. watchdogs
• CPC Class Codes: G06F 11/079 Root cause analysis, i.e. error or fault diagnosis in a hardware test environment G06F11/22; in a software test environment G06F11/36

Abstract

A microprocessor runaway monitoring control circuit with which self-diagnosis of a watchdog timer WDT can be carried out safely and cheaply even during operation of the microprocessor (CPU). A microprocessor 101 supplies first and second watchdog clearing signals WD1 and WD2 to first and second watchdog timers WDT1 and WDT2, and when the both of the watchdog clearing signals WD1 and WD2 stop, the microprocessor 101 is reset by way of a logical connector circuit 122. The microprocessor 101 has failure diagnosing means 103 which intentionally stops the first watchdog clearing signal WD1 and diagnoses the response of the first watchdog timer WDT1 on the basis of a monitor signal MN1 and stops the second watchdog clearing signal WD2 and diagnoses the response of the second watchdog timer WDT2 on the basis of a monitor signal MN2, whereby diagnosis of the watchdog timers WDT1, WDT2 is carried out without the microprocessor 101 being stopped.

Claims

1. A microprocessor runaway monitoring control circuit, for a microprocessor which controls an electrical load and generates a first watchdog clearing signal and a second watchdog clearing signal for monitoring runaway of the microprocessor, comprising:

a first watchdog timer for receiving the first watchdog clearing signal and generating a first reset signal if this first watchdog clearing signal is abnormal;

a second watchdog timer for receiving the second watchdog clearing signal and generating a second reset signal if this second watchdog clearing signal is abnormal;

a logical connector circuit for resetting the microprocessor by outputting an effective resetting signal when the first and second reset signals are both generated; and

failure diagnosing means for inputting the first and second reset signals respectively as first and second monitor signals to the microprocessor,

wherein at different timing to each other, the microprocessor intentionally renders abnormal the first and second watchdog clearing signals and checks whichever of the first and second monitor signals corresponds to one of the first and second watchdog clearing signals intentionally rendered abnormal and thereby checks the operation of whichever of the first and second watchdog timers corresponding to one of the first and second watchdog clearing signals rendered abnormal.

2. A microprocessor runaway monitoring control circuit according to claim 1, wherein the microprocessor generates a first error signal when it determines that the first watchdog timer is abnormal and generates a second error signal when it determines that the second watchdog timer is abnormal, and the microprocessor has first and second failure response circuits, and in response to the first error signal the first failure response circuit forcibly renders reset-effective the reset signal of the first watchdog timer and in response to the second error signal the second failure response circuit forcibly renders reset-effective the reset signal of the second watchdog timer, and in either case, in response to one of the first and second reset signals from whichever of the first and second watchdog timers not forcibly reset the logical connector circuit generates an effective resetting signal and resets the microprocessor, so that even if one of the first and second watchdog timers is abnormally failing to generate its reset signal the effective resetting signal output can still be generated.

3. A microprocessor runaway monitoring control circuit according to claim 2, wherein the failure diagnosing means, to check the normal operation of one of the failure response circuits, causes one of the first and second error signals to be generated from the microprocessor and inputted to the respective failure response circuit, and the failure diagnosing means has first and second checking means, and the first checking means checks the response of the first monitor signal to the first error signal inputted to the first failure response circuit and the second checking means checks the response of the second monitor signal to the second error signal inputted to the second failure response circuit.

4. A microprocessor runaway monitoring control circuit according to claim 1, further comprising starting circuits for, when a power supply to the runaway monitoring control circuit is switched on, causing the effective resetting signal to be generated by forcibly rendering reset-effective for a predetermined time the reset signals of both the first and second watchdog timers, wherein the microprocessor is reset when the power supply is switched on even if one of the first and second watchdog timers is abnormal and not operating.

5. A microprocessor runaway monitoring control circuit according to claim 1, wherein the logical connector circuit is a multiplex logical connector circuit comprising a plurality of logical connector circuits connected in parallel.

6. A microprocessor runaway monitoring circuit according to claim 1, wherein the first and second watchdog timers are timers which generate respectively first and second reset signals of a predetermined time width.

7. A microprocessor runaway monitoring circuit according to claim 1, wherein the microprocessor generates an error signal when the failure diagnosing means determines that at least one of the first and second watchdog timers is abnormal, the runaway monitoring circuit further comprising failure occurrence storing means for storing the error signal and the effective resetting signal and then clearing the stored error signal and effective resetting signal and setting to a ready-to-store state when a power supply to the runaway monitoring circuit is turned on and reporting means for outputting at least one of the stored error signal and effective resetting signal as a report signal, the microprocessor being able to report based on this report signal.

8. A microprocessor runaway monitoring circuit according to claim 1, further comprising a sub-microprocessor which is subordinate to the microprocessor and shares overall control therewith, wherein the microprocessor comprises runaway monitoring means for the sub-microprocessor for monitoring a watchdog timer clearing signal generated by the sub-microprocessor and when there is an abnormality thereof supplying a reset signal to and thereby resetting the sub-microprocessor, and the effective resetting signal supplied from the first and second watchdog timers resets the microprocessor and the sub-microprocessor.

9. A microprocessor runaway monitoring control circuit according to claim 8, wherein the sub-microprocessor controls a different electrical load from the main microprocessor and power is supplied to the electrical loads controlled by the main microprocessor and the sub-microprocessor with a supply power source supplying power to the runaway monitoring control circuit as a load power supply, the runaway monitoring control circuit further comprising switching means for switching ON/OFF the connection between the load power supply and the electrical loads, the switching means being switched OFF when the supply power source is turned on and when the effective resetting signal is outputted and switched ON when the effective resetting signal output is canceled.

10. A microprocessor runaway monitoring control circuit according to claim 8, wherein the sub-microprocessor controls a different electrical load from the main microprocessor and the main microprocessor generates an error signal when the failure diagnosing means determines that at least one of the first and second watchdog timers is abnormal, the runaway monitoring circuit further comprising failure occurrence storing means, for storing the error signal and the effective resetting signal and then clearing the stored error signal and effective resetting signal and setting to a ready-to-store state when a power supply to the runaway monitoring circuit is turned on, and drive-stopping means, for stopping the output to at least one of the electrical loads controlled by the main microprocessor and the sub-microprocessor when the failure occurrence storing means stores the error signal and the effective resetting signal.

11. A microprocessor runaway monitoring circuit according to claim 1, further comprising switching means for, when a supply power source supplying power to the runaway monitoring control circuit is used as a load power supply and power is supplied to the electrical load from this load power supply, switching ON/OFF the connection between the load power supply and the electrical loads, wherein the switching means is switched OFF when the supply power source is turned on and when the effective resetting signal is outputted and the switching means is switched ON when the effective resetting signal output is canceled.

12. A microprocessor runaway monitoring control circuit according to claim 1, wherein the microprocessor generates an error signal when the failure diagnosing means determines that at least one of the first and second watchdog timers is abnormal, the runaway monitoring circuit further comprising failure occurrence storing means, for storing the error signal and the effective resetting signal and then clearing the stored error signal and effective resetting signal and setting to a ready-to-store state when a power supply to the runaway monitoring circuit is turned on, and drive-stopping means, for stopping the microprocessor output to at least one electrical load when the failure occurrence storing means stores the error signal and the effective resetting signal.

13. A microprocessor runaway monitoring control circuit, for a main microprocessor which controls an electrical load and generates a first watchdog clearing signal and a second watchdog clearing signal for runaway monitoring control of the main microprocessor, the microprocessor runaway monitoring control circuit comprising:

a sub-microprocessor, cooperating with the main microprocessor, which receives the second watchdog clearing signal from the main microprocessor and generates a third watchdog clearing signal;

a first watchdog timer for receiving the first watchdog clearing signal and generating a first reset signal if this first watchdog clearing signal is abnormal;

a second watchdog timer, incorporated in the sub-microprocessor, for receiving the second watchdog clearing signal and generating a second reset signal if this second watchdog clearing signal is abnormal;

runaway monitoring means, incorporated in the main microprocessor, for receiving the third watchdog clearing signal from the sub-microprocessor and resetting the sub-microprocessor by generating a third reset signal if this third watchdog clearing signal is abnormal;

a logical connector circuit for inferring abnormality of the main microprocessor and resetting the main microprocessor and the sub-microprocessor by outputting an effective resetting signal when the first and second reset signals are both generated; and

failure diagnosing means, for inputting the first and second reset signals respectively as first and second monitor signals to the main microprocessor,

wherein at different timing to each other, the main microprocessor intentionally renders abnormal the first and second watchdog clearing signals and checks whichever of the first and second monitor signals corresponds to one of the first and second watchdog clearing signals rendered abnormal and thereby checks the operation of whichever of the first and second watchdog timers corresponding to one of the first and second watchdog clearing signals intentionally rendered abnormal.

14. A microprocessor runaway monitoring control circuit according to claim 13, wherein the main microprocessor generates a first error signal when it determines that the first watchdog timer is abnormal and generates a second error signal when it determines that the second watchdog timer is abnormal, and the main microprocessor has first and second failure response circuits, and in response to the first error signal the first failure response circuit forcibly renders reset-effective the reset signal of the first watchdog timer and in response to the second error signal the second failure response circuit forcibly renders reset-effective the reset signal of the second watchdog timer, so that in response to the reset signal from the watchdog timer not forcibly reset the logical connector circuit generates an effective resetting signal and resets the main microprocessor and the sub-microprocessor and thus even if one of the first and second watchdog timers is abnormally failing to generate its reset signal the effective resetting signal output can still be generated.

15. A microprocessor runaway monitoring control circuit according to claim 14, wherein the failure diagnosing means, to check the normal operation of one of the failure response circuits, causes one of the first and second error signals to be generated from the microprocessor and inputted to the respective failure response circuit, and the failure diagnosing means has first and second checking means, and the first checking means checks the response of the first monitor signal to the first error signal inputted to the first failure response circuit and the second checking means checks the response of the second monitor signal to the second error signal inputted to the second failure response circuit.

16. A microprocessor runaway monitoring control circuit according to claim 13, further comprising starting circuits for, when a power supply to the runaway monitoring control circuit is switched on, causing the effective resetting signal to be generated by forcibly rendering reset-effective for a predetermined time the reset signals of both the first and second watchdog timers, wherein the main microprocessor and the sub-microprocessor are reset when the power supply is switched on even if one of the first and second watchdog timers is abnormal and not operating.

17. A microprocessor runaway monitoring control circuit according to claim 13, wherein the logical connector circuit is a multiplex logical connector circuit comprising a plurality of logical connector circuits connected in parallel.

18. A microprocessor runaway monitoring circuit according to claim 13, wherein the first and second watchdog timers are timers which generate respectively first and second reset signals of a predetermined time width.

19. A microprocessor runaway monitoring circuit according to claim 13, wherein the main microprocessor generates an error signal when the failure diagnosing means determines that at least one of the first and second watchdog timers is abnormal, the runaway monitoring circuit further comprising failure occurrence storing means for storing the error signal and the effective resetting signal and then clearing the stored error signal and effective resetting signal and setting to a ready-to-store state when a power supply to the runaway monitoring circuit is turned on and reporting means for outputting at least one of the stored error signal and effective resetting signal as a report signal, the microprocessor being able to report based on this report signal.

20. A microprocessor runaway monitoring control circuit according to claim 13, wherein the sub-microprocessor controls a different electrical load from the main microprocessor and power is supplied to the electrical loads controlled by the main microprocessor and the sub-microprocessor with a supply power source supplying power to the runaway monitoring control circuit as a load power supply, the runaway monitoring control circuit further comprising switching means for switching ON/OFF the connection between the load power supply and the electrical loads, the switching means being switched OFF when the supply power source is turned on and when the effective resetting signal is outputted and switched ON when the effective resetting signal output is canceled.

21. A microprocessor runaway monitoring control circuit according to claim 13, wherein the sub-microprocessor controls a different electrical load from the main microprocessor and the main microprocessor generates an error signal when the failure diagnosing means determines that at least one of the first and second-watchdog timers is abnormal, the runaway monitoring circuit further comprising failure occurrence storing means, for storing the error signal and the effective resetting signal and then clearing the stored error signal and effective resetting signal and setting to a ready-to-store state when a power supply to the runaway monitoring circuit is turned on, and drive-stopping means, for stopping the output to at least one of the electrical loads controlled by the main microprocessor and the sub-microprocessor when the failure occurrence storing means stores the error signal and the effective resetting signal.

22. A microprocessor runaway monitoring control circuit according to claim 13, wherein the failure diagnosing means inputs the state of the first reset signal to the main microprocessor as a first monitor signal and the main microprocessor checks the operation of the first watchdog timer by intentionally rendering abnormal the first watchdog clearing signal and checking the response of the first monitor signal, and failure diagnosis of the second watchdog timer is carried out by the runaway monitoring means.

23. A microprocessor runaway monitoring control circuit according to claim 22, wherein the sub-microprocessor receives supply of a test mode signal from the main microprocessor at the time of a test and includes forced outputting means which when the test mode signal is received forcibly generates the second reset signal and supplies it to the gate circuit, and the response of the second monitor signal to the second reset signal forcibly generated by the sub-microprocessor is checked to diagnose whether or not the second reset signal generated by the sub-microprocessor has reached the gate circuit.

24. A microprocessor runaway monitoring control circuit according to claim 13, further comprising a default circuit for, until the sub-microprocessor has started and is operating normally, making the second reset signal effective so that the effective resetting signal is generated in response to the first reset signal generated by the watchdog timer.

25. A microprocessor runaway monitoring control circuit, for a microprocessor which controls an electrical load and generates a first watchdog clearing signal and a second watchdog clearing signal for runaway monitoring control of the microprocessor and also generates a first test signal and a second test signal for testing, comprising:

a first watchdog timer, for receiving the first watchdog clearing signal from the microprocessor and generating a first reset signal if this first watchdog clearing signal is abnormal;

a second watchdog timer, for receiving the second watchdog clearing signal from the microprocessor and generating a second reset signal if this second watchdog clearing signal is abnormal;

a gate circuit, which receives the first test signal and the second test signal from the microprocessor and when receiving the first test signal stops the effective resetting signal output irrespective of the state of the first reset signal from the first watchdog timer and when receiving the second test signal stops the effective resetting signal output irrespective of the state of the second reset signal from the second watchdog timer and when receiving neither of the first and second test signals outputs the effective resetting signal in accordance with the states of the first and second reset signals; and

failure diagnosing means for inputting the first and second reset signals to the microprocessor as first and second monitor signals,

wherein at different timing to each other, the microprocessor generates the first test signal and the second test signal, and when generating the first test signal the microprocessor checks the operation of the first watchdog timer by intentionally rendering abnormal the first watchdog clearing signal inputted to the first watchdog timer and checking the output state of the first reset signal, and when generating the second test signal the microprocessor checks the operation of the second watchdog timer by intentionally rendering abnormal the second watchdog clearing signal inputted to the second watchdog timer and checking the output state of the second reset signal.

26. A microprocessor runaway monitoring circuit according to claim 25, further comprising:

means for continuing a test signal on the basis of a failure diagnosis result from the failure diagnosing means, which means for continuing a test signal causes the microprocessor to generate the first test signal continuously when determining that the first watchdog timer is abnormal and causes the microprocessor to generate the second test signal continuously when determining that the second watchdog timer is abnormal and so ensures that the effective reset signal is not generated as a result of abnormal operation of either of the first and second watchdog timers; and

failure response means for forcibly resetting the microprocessor by outputting an effective resetting signal when the first and second test signals from the microprocessor are erroneously generated together.

27. A microprocessor runaway monitoring circuit according to claim 25, further comprising a starting circuit for generating an effective resetting signal when a power supply to the runaway monitoring circuit is turned on by forcibly rendering reset-effective for a predetermined time the reset signals of both of the first and second watchdog timers, wherein the microprocessor can be reset with the effective resetting signal even when both of the first and second watchdog timers are inoperative when the power supply is turned on.

28. A microprocessor runaway monitoring circuit according to claim 25, wherein the first and second watchdog timers are timers which generate respectively first and second reset signals of a predetermined time width.

29. A microprocessor runaway monitoring circuit according to claim 25, wherein the microprocessor generates an error signal when the failure diagnosing means determines that at least one of the first and second watchdog timers is abnormal, the runaway monitoring circuit further comprising failure occurrence storing means for storing the error signal and the effective resetting signal and then clearing the stored error signal and effective resetting signal and setting to a ready-to-store state when a power supply to the runaway monitoring circuit is turned on and reporting means for outputting at least one of the stored error signal and effective resetting signal as a report signal, the microprocessor being able to report based on this report signal.

30. A microprocessor runaway monitoring circuit according to claim 25, further comprising a sub-microprocessor which is subordinate to the microprocessor and shares overall control therewith, wherein the microprocessor comprises runaway monitoring means for the sub-microprocessor for monitoring a watchdog timer clearing signal generated by the sub-microprocessor and when there is an abnormality thereof supplying a reset signal to and thereby resetting the sub-microprocessor, and the effective resetting signal supplied from the first and second watchdog timers resets the microprocessor and the sub-microprocessor.

31. A microprocessor runaway monitoring control circuit according to claim 30, wherein the sub-microprocessor controls a different electrical load from the main microprocessor and power is supplied to the electrical loads controlled by the main microprocessor and the sub-microprocessor with a supply power source supplying power to the runaway monitoring control circuit as a load power supply, the runaway monitoring control circuit further comprising switching means for switching ON/OFF the connection between the load power supply and the electrical loads, the switching means being switched OFF when the supply power source is turned on and when the effective resetting signal is outputted and switched ON when the effective resetting signal output is canceled.

32. A microprocessor runaway monitoring control circuit according to claim 30, wherein the sub-microprocessor controls a different electrical load from the main microprocessor and the main microprocessor generates an error signal when the failure diagnosing means determines that at least one of the first and second watchdog timers is abnormal, the runaway monitoring circuit further comprising failure occurrence storing means, for storing the error signal and the effective resetting signal and then clearing the stored error signal and effective resetting signal and setting to a ready-to-store state when a power supply to the runaway monitoring circuit is turned on, and drive-stopping means, for stopping the output to at least one of the electrical loads controlled by the main microprocessor and the sub-microprocessor when the failure occurrence storing means stores the error signal and the effective resetting signal.

33. A microprocessor runaway monitoring circuit according to claim 25, further comprising switching means for, when a supply power source supplying power to the runaway monitoring control circuit is used as a load power supply and power is supplied to the electrical load from this load power supply, switching ON/OFF the connection between the load power supply and the electrical load, wherein the switching means is switched OFF when the supply power source is turned on and when the effective resetting signal is outputted and the switching means is switched ON when the effective resetting signal output is canceled.

34. A microprocessor runaway monitoring control circuit according to claim 25, wherein the microprocessor generates an error signal when the failure diagnosing means determines that at least one of the first and second watchdog timers is abnormal, the runaway monitoring circuit further comprising failure occurrence storing means, for storing the error signal and the effective resetting signal and then clearing the stored error signal and effective resetting signal and setting to a ready-to-store state when a power supply to the runaway monitoring circuit is turned on, and drive-stopping means, for stopping the microprocessor output to at least one electrical load when the failure occurrence storing means stores the error signal and the effective resetting signal.

35. A microprocessor runaway monitoring control circuit, for a main microprocessor which controls an electrical load and generates a first watchdog clearing signal and a second watchdog clearing signal for runaway monitoring control of the microprocessor and also generates a first test signal and a second test signal for testing, comprising:

a sub-microprocessor, cooperating with the main microprocessor, which generates a third watchdog clearing signal for runaway monitoring control of the sub-microprocessor;

a first watchdog timer, for receiving the first watchdog clearing signal from the main microprocessor and generating a first reset signal if this first watchdog clearing signal is abnormal;

a second watchdog timer, incorporated in the sub-microprocessor, for receiving the second watchdog clearing signal from the main microprocessor and generating a second reset signal if this second watchdog clearing signal is abnormal;

runaway monitoring means, incorporated in the main microprocessor, which receives the third watchdog clearing signal from the sub-microprocessor and resets the sub-microprocessor by generating a third reset signal when the third watchdog clearing signal is abnormal;

a gate circuit, which receives the first test signal and the second test signal from the main microprocessor and when receiving the first test signal stops the effective resetting signal output irrespective of the state of the first reset signal from the first watchdog timer and when receiving the second test signal stops the effective resetting signal output irrespective of the state of the second reset signal from the second watchdog timer and when receiving neither of the first and second test signals outputs the effective resetting signal and resets the main microprocessor and the sub-microprocessor in accordance with the states of the first and second reset signals; and

failure diagnosing means for inputting the first and second reset signals to the main microprocessor as first and second monitor signals,

wherein at different timing to each other, the main microprocessor generates the first test signal and the second test signal, and when generating the first test signal the main microprocessor checks the operation of the first watchdog timer by intentionally rendering abnormal the first watchdog clearing signal inputted to the first watchdog timer and checking the output state of the first reset signal, and when generating the second test signal the main microprocessor checks the operation of the second watchdog timer by intentionally rendering abnormal the second watchdog clearing signal inputted to the second watchdog timer and checking the output state of the second reset signal.

36. A microprocessor runaway monitoring circuit according to claim 35, further comprising:

means for continuing a test signal on the basis of a failure diagnosis result from the failure diagnosing means, which means for continuing a test signal causes the main microprocessor to generate the first test signal continuously when determining that the first watchdog timer is abnormal and causes the main microprocessor to generate the second test signal continuously when determining that the second watchdog timer is abnormal and so ensures that the effective reset signal is not generated as a result of abnormal operation of either of the first and second watchdog timers; and

failure response means for forcibly resetting the main microprocessor and the sub-microprocessor by outputting an effective resetting signal when the first and second test signals from the main microprocessor are erroneously generated together.

37. A microprocessor runaway monitoring circuit according to claim 35, further comprising a starting circuit for generating an effective resetting signal when a power supply to the runaway monitoring circuit is turned on by forcibly rendering reset-effective for a predetermined time the reset signals of both of the first and second watchdog timers, wherein the main microprocessor and the sub-microprocessor can be reset with the effective resetting signal even when both of the first and second watchdog timers are inoperative when the power supply is turned on.

38. A microprocessor runaway monitoring circuit according to claim 35, wherein the first and second watchdog timers are timers which generate respectively first and second reset signals of a predetermined time width.

39. A microprocessor runaway monitoring circuit according to claim 35, wherein the main microprocessor generates an error signal when the failure diagnosing means determines that at least one of the first and second watchdog timers is abnormal, the runaway monitoring circuit further comprising failure occurrence storing means for storing the error signal and the effective resetting signal and then clearing the stored error signal and effective resetting signal and setting to a ready-to-store state when a power supply to the runaway monitoring circuit is turned on and reporting means for outputting at least one of the stored error signal and effective resetting signal as a report signal, the microprocessor being able to report based on this report signal.

40. A microprocessor runaway monitoring control circuit according to claim 35, wherein the sub-microprocessor controls a different electrical load from the main microprocessor and power is supplied to the electrical loads controlled by the main microprocessor and the sub-microprocessor with a supply power source supplying power to the runaway monitoring control circuit as a load power supply, the runaway monitoring control circuit further comprising switching means for switching ON/OFF the connection between the load power supply and the electrical loads, the switching means being switched OFF when the supply power source is turned on and when the effective resetting signal is outputted and switched ON when the effective resetting signal output is canceled.

41. A microprocessor runaway monitoring control circuit according to claim 35, wherein the sub-microprocessor controls a different electrical load from the main microprocessor and the main microprocessor generates an error signal when the failure diagnosing means determines that at least one of the first and second watchdog timers is abnormal, the runaway monitoring circuit further comprising failure occurrence storing means, for storing the error signal and the effective resetting signal and then clearing the stored error signal and effective resetting signal and setting to a ready-to-store state when a power supply to the runaway monitoring circuit is turned on, and drive-stopping means, for stopping the output to at least one of the electrical loads controlled by the main microprocessor and the sub-microprocessor when the failure occurrence storing means stores the error signal and the effective resetting signal.

42. A microprocessor runaway monitoring control circuit according to claim 35, wherein the failure diagnosing means inputs the state of the first reset signal to the main microprocessor as a first monitor signal and the main microprocessor checks the operation of the first watchdog timer by intentionally rendering abnormal the first watchdog clearing signal and checking the response of the first monitor signal, and failure diagnosis of the second watchdog timer is carried out by the runaway monitoring means.

43. A microprocessor runaway monitoring control circuit according to claim 42, wherein the sub-microprocessor receives supply of a test mode signal from the main microprocessor at the time of a test and includes forced outputting means which when the test mode signal is received forcibly generates the second reset signal and supplies it to the gate circuit, and the response of the second monitor signal to the second reset signal forcibly generated by the sub-microprocessor is checked to diagnose whether or not the second reset signal generated by the sub-microprocessor has reached the gate circuit.

44. A microprocessor runaway monitoring control circuit according to claim 35, further comprising a default circuit for, until the sub-microprocessor has started and is operating normally, making the second reset signal ineffective so that the effective resetting signal is generated in response to the first reset signal generated by the watchdog timer.