JPH05143379A - Program monitoring device - Google Patents

Abstract

PURPOSE:To improve a monitoring function and to reduce the load of a computer system by preparing the monitoring function for the program operation status of a multiplex computer system as an independent hardware. CONSTITUTION:This program monitoring device 7 is constituted of a comparator 5 having a function for receiving data from processors 1, 2 and comparing the program operation states of both the processors 1, 2, a timer circuit 6 having a time-out detecting function for checking the program operation states of both the processors 1, 2 and a control circuit 4 having a function for controlling the timer circuit 6 and informing the judged results of the operation states to the processors 1, 2. Since the device 7 is independent from the processors 1, 2, the abnormal operation of program monitoring due to the problem of each processor itself can be evaded and the load of the CPU can be reduced.

Description

Detailed Description of the Invention

[0001]

BACKGROUND OF THE INVENTION 1. Field of the Invention The present invention relates to an apparatus for monitoring a program operating state between processors in a multi-computer system.

[0002]

2. Description of the Related Art Conventionally, as a measure for confirming that a computer system is operating normally, a plurality of processing units are used, each processing unit is made to execute the same program, and the execution results are compared to compare each processing unit. There is a known method for determining whether or not is operating normally. A conventional method for confirming the operation of the processing apparatus by this comparison will be described with reference to FIGS. 11 to 14.

FIG. 11 shows a system configuration in the case where the processing apparatus itself which compares the operating states of the programs is used as an example of a dual system, and FIG. 12 compares the operating states of the programs of the processing apparatuses in that case. The flow of the program around the function is shown.

FIG. 13 shows a system configuration when a processing device different from the processing device for comparing the operating states of the programs is used as an example of a double system, and FIG. 14 shows the processing device in that case. The flow of the program around the function of comparing the operating states of the programs is shown. Next, referring to FIGS. 11 and 12, a case will be described in which the operations of the programs are compared by the compared processing devices themselves.

Here, the processing unit 16 and the processing unit 17 are processing units whose operating states of programs are compared. When the programs of the processing devices 16 and 17 operate up to the start point (checkpoint) of the program operating state comparison process installed at the time of program design, the processing devices 16 and 17 show the operating status of their own programs installed at the time of program design. The data (check data) is sent to the processing devices 16 and 17 of the other party via the communication line 18, and the check data of the processing devices 17 and 16 of the other party are similarly sent to the communication line 1
8, the check data of the other party is compared with the check data of the other party, and if the check data are the same, if both processing devices 16 and 17 are operating normally, the check data is different. If one or both of the processing devices 16 and 17 have an abnormality, the operating state of the program is determined. When it is determined that the processing devices 16 and 17 are normal, the next normal program processing is started, and when it is determined that the processing is abnormal, abnormal-time processing is started. In many cases, a plurality of checkpoints are set in the program of one processing device 16 or 17.

As the check data, the registers of the CPUs of the processing units 16 and 17 at the checkpoint, the output of the operation immediately before the checkpoint, the memory data changed between the checkpoints, and the like are used. For abnormal time processing, the processing device 1 determined to be abnormal
The process of separating 6 and 17 from the multiple system, the self-diagnosis process,
There is a recovery process. In addition, according to FIG. 13 and FIG.
Processing device 1 for comparing program operating states
A case where the processing device 20 different from the processing devices 6 and 17 is used will be described.

When the programs operate up to the checkpoints, the processing units 16 and 17 send the check data to the processing unit 20 dedicated to comparing the program operation with the communication line 21.
And send via 22. The processing device 20 is the processing device 16
If the check data is the same, the processing devices 16 and 17 are operating normally. If the check data is different, the processing device 16 is different.
If one or both of 17 is abnormal, the operating state of the program is judged, and the result is sent to the processors 16 and 17 via the communication lines 21 and 22, respectively.
When it is determined that the processing devices 16 and 17 are normal, the next normal program process is started, and when it is determined that the process is abnormal, the abnormal time process is started.

[0008]

However, in the method in which the comparison of the check data is executed by the compared processing devices themselves, there is no guarantee that the comparison operation itself is normal when the processing devices 16 and 17 are in an abnormal state. There is a problem. In addition, since it is realized by software, the processing devices 16 and 1
There is a problem of increasing the load of 7. Furthermore, in the method in which the comparison of the check data is executed by the processing device 20 different from the processing devices 16 and 17 to be compared, the redundant processing device 2 is used.
0 is required.

The present invention has been made to solve the above problems, and an object of the present invention is to improve the monitoring function by making the monitoring function of the program operating state of the multi-computer system independent hardware. To reduce the load on the computer system.

[0010]

A program monitoring apparatus according to the present invention is an apparatus for monitoring program execution states of two processing units of a multi-system computer system, the check data being received from the two processing units of the multi-system. A comparator circuit having a function of comparing program operating states, a timer circuit having a time-out detection function for checking program synchronization of the two processing devices of the multiplex system, a comparator circuit and a timer circuit for controlling the comparator circuit, And a control circuit having a function of notifying the two processing devices of the multiplex system of the determination result of the operating state, and the comparison circuit is a check data indicating the execution state of each of the two processing devices of the multiplex system. Inputs are respectively input from the two processing devices of the multiplex system, and the two processing devices of the multiplex system output check data inputs, respectively. The check data completion input for notifying that the check data is completed is input from each of the two processing devices of the multiplex system, and the two check processes of the multiplex system are performed using the respective check data received from the two processing devices of the multiplex system. The timer circuit has a function of comparing operation states between devices, and the timer circuit checks the check data from the two processing devices of the multiplex system in order to check the synchronization state of the programs of the two processing devices of the multiplex system. A timeout detection function is provided to limit the allowable time difference between completion inputs by the timeout time set by inputting the timeout time data input and timeout time setting input from the two processing devices of the multiplex system or independent processing devices. However, in the control circuit, the check data completion input and the two processing devices of the multiplex system detect the abnormality by themselves. Inputting a processor abnormality occurrence input indicating the above from each of the two processors of the multiplex system, outputting a timer start signal and a timer stop signal for controlling the timeout detection function of the timer circuit to the timer circuit, From which a time-out signal is detected and a comparison start signal for controlling the comparison function of the comparison circuit is output to the comparison circuit to display the comparison result of the program execution states of the two processing devices in the multiplex system. A status signal indicating the operation state of the two processing devices of the multiplex system and a status completion signal for notifying the two processing devices of the multiplex system, respectively, that a comparison result signal to be notified is input It has a function of outputting.

[0011]

The operation of the present invention will be described with reference to FIG. When the programs of the processing devices 1 and 2 are operating normally, the following processing is performed.

When the program reaches the checkpoints of the processing devices 1 and 2, the check data is input from the processing devices 1 and 2 to the comparison circuit 5 as the check data inputs a1 and a2, respectively, and then checked by the processing devices 1 and 2. The data completion inputs b1 and b2 are input to the control circuit 4 and the comparison circuit 5. The check data completion inputs b1 and b2 are not input completely at the same time. Here, as an example, it is assumed that the check data completion inputs b1 and b2 are input in this order.

Upon receiving the check data completion input b1, the control circuit 4 sends a timer start signal k to the timer circuit 6. When the timer circuit 6 receives the timer start signal k, it starts the timer. Next, check data completion input b2
When the control circuit 4 receives the
A timer stop signal m is sent to the comparison circuit 5 and a comparison start signal h is sent to the comparison circuit 5. Upon receiving the timer stop signal m, the timer circuit 6 stops the timer. The comparison circuit 5 receiving the comparison start signal h compares the already input check data inputs a1 and a2, and sends the comparison result to the control circuit 4 as a comparison result signal i,
Further, the comparison result completion signal j is sent. If the processing devices 1 and 2 are operating normally, check data inputs a1 and a2
Are the same, the comparison result signal i is returned as no comparison abnormality. When the control circuit 4 receives the comparison result completion signal j and confirms that the comparison result signal i is normal, the status output d is output to the processing devices 1 and 2, respectively.
1 and d2 are output as normal, and status completion output e1
And e2 are output to the processing devices 1 and 2, respectively.

If the program operating state of the processing device 1 or 2 is abnormal and the check data inputs a1 and a2 are different, the process of the program monitoring device 7 will be continued until the explanation of the normal operation and the stop of the timer. The processing is the same, and the subsequent processing is as follows. The comparison circuit 5 is the control circuit 4
The comparison result signal i is sent as an abnormal signal, and the comparison result completion signal j is sent. When the comparison result signal i and the comparison result completion signal j are received and it is confirmed that the comparison result signal is abnormal, the control circuit 4 outputs the status outputs d1 and d2 to the processing devices 1 and 2, respectively, as the comparison abnormality. ,
The status completion outputs e1 and e2 are output to the processing devices 1 and 2, respectively.

When the programs of the processing devices 1 and 2 are out of synchronization with each other, or when the programs of any of the processing devices run out of control so that the operation comparison process cannot be executed, the following process is performed. Here, a case will be described in which the processing device 1 reaches the checkpoint first, and the timeout is detected before the processing device 2 reaches the same checkpoint.

Check data is input from the processing device 1 to the comparison circuit 5 as the check data input a1, and then the check data completion input b1 from the processing device 1 is input to the control circuit 4.
Is input to the comparison circuit 5. Upon receiving the check data completion input b1, the control circuit 4 sends a timer start signal k to the timer circuit 6. Since the timer stop signal m is not input from the control circuit 4, the timer circuit 6 detects the time-out. The timer circuit 6 sends a time-out signal n to the control circuit 4. The control circuit 4 which has received the time-out signal n sets the status output d1 to the processing device 1 which is sending the check data, and sets the status output d1 to the partner processing device time-out, and sets the status to the processing device 2 which has not sent the check data. The output d2 is output as the own processing device timeout, and status completion outputs e1 and e2
Are output to the processing devices 1 and 2, respectively.

When the program of the processor runs out of control and continuously executes the operation comparison processing, the following processing is performed. Here, it is assumed that the processing device 1 is in a runaway state.

Check data is input from the processing device 1 to the comparison circuit 5 as the check data input a1, and then the check data completion input b1 from the processing device 1 is input to the control circuit 4.
Is input to the comparison circuit 5. Upon receiving the check data completion input b1, the control circuit 4 sends a timer start signal k to the timer circuit 6. The check data is again input from the processing device 1 to the comparison circuit 5 as the check data completion input a1, and then the check data input b1 is input from the processing device 1 to the control circuit 4 and the comparison circuit 5. When the control circuit 4 receives the check data completion input b1 and waits for the next check data completion input b2 to be input, and detects that the check data completion input b1 is continuously input, the control circuit 4 Sends a timer stop signal m to the timer circuit 6 and sends the check data completion input b2 to the processing device 1 which has sent the check data completion input b1 twice as the status output d1 as the own processing device error. Status output d to the processing device 2 that did not exist
2 is output as the partner processing device abnormality, and then status completion outputs e1 and e2 are output to the processing devices 1 and 2, respectively. The timer circuit 6 that has received the timer stop signal m stops the timer.

When the processing device detects an abnormality by itself and sends a processing device abnormality occurrence input to the supervisory control circuit,
The following processing is performed. Here, it is assumed that the processing device 1 detects the abnormality by itself.

Processing device abnormality occurrence input c from the processing device 1
The control circuit 4 which has received 1 sends a timer stop signal m to the timer circuit 6, and the processor abnormality occurrence input c1
The status output d2 is output to the processing device 2 that did not send the message as an error in the other processing device, and the status completion output e2 is output. Upon receiving the timer stop signal m, the timer circuit 6 stops the timer.

The time-out time is set by the value of the time-out time data input g when the time-out time setting input f is input to the timer circuit 6.

[0022]

Embodiments of the present invention will be described below with reference to the drawings. 1 is a configuration diagram of the present embodiment, FIG. 2 is a configuration diagram of an implementation example of the control circuit 4, FIG. 3 is a configuration diagram of an implementation example of the comparison circuit 5, and FIG. 4 is a configuration diagram of an implementation example of the timer circuit 6. ..

The program monitoring device 7 includes the processing devices 1 and 2.
Comparing circuit 5 having a function of receiving check data from each other and comparing program operating states, timer circuit 6 having a time-out detecting function for checking program synchronization of processing devices 1 and 2, comparing circuit 5 and timer circuit 6
And a control circuit 4 having a function of notifying the processing devices 1 and 2 of the determination result of the operating state.

The comparison circuit 5 inputs check data inputs a1 and a2 for inputting the check data from the processing devices 1 and 2 to the comparison circuit 5 and the check data input a for the processing devices 1 and 2.
Check data completion inputs b1 and b2 for notifying the comparison circuit 5 that 1 and a2 have been output, and the control circuit 4 instructs the comparison circuit 5 to execute comparison of the check data of the processing devices 1 and 2 The comparison result signal i having the signal h as an input and sending the comparison result of the check data of the processing devices 1 and 2 to the control circuit 4 and the fact that the comparison result signal i has been sent to the control circuit 4 are notified. It has a comparison result completion signal j as an output.

The timer circuit 6 inputs the timeout time from the processing devices 1 and 2 to be compared or the processing device 3 representing another processing device.
And a timeout time setting input f for inputting an instruction to set a timeout time from the processing device 3, a timer start signal k from the control circuit 4 for instructing the timer to start, and a timer from the control circuit 4 for instructing to stop the timer. It has a stop signal m as an input and a time-out signal n as an output for notifying the control circuit 4 of detection of a time-out.

The control circuit 4 indicates that the processors 1 and 2 have completed outputting the check data inputs a1 and a2.
Of the check data completion inputs b1 and b2 for notifying the control circuit 4 and the processing device abnormality occurrence inputs c1 and c2 for notifying the control circuit 4 of the self-abnormality detected by the processing devices 1 and 2 and the comparison result indicating the comparison result from the comparison circuit 5. The result signal i, the comparison result completion signal j that notifies the control circuit 4 that the comparison circuit 5 has output the comparison result signal i, and the timeout signal n that notifies the control circuit 4 that the timer circuit 6 has detected a timeout.
As an input, and a comparison start signal h for instructing the comparison circuit 5 to execute comparison of check data of the processing devices 1 and 2,
The timer start signal k instructing the timer circuit 6 to start the timer function, the timer stop signal m instructing the timer circuit 6 to stop the timer function, and the determination result of the program operating state to the processing devices 1 and 2 are notified. It outputs and holds status outputs d1 and d2 that perform output, and status completion outputs e1 and e2 that notify the processing devices 1 and 2 that the output of the status outputs d1 and d2 has been completed.

In the present embodiment, the control circuit 4 comprises a timing control circuit 8 and an output control circuit 9. The comparison circuit 5 has two check data latch circuits 10 and 11.
And a data comparison circuit 12. The timer circuit 6 includes a counter circuit 13 and a timeout time latch circuit 1.
4 and a clock circuit 15.

The timing control circuit 8 includes processing devices 1 and 2
Input check data completion inputs b1 and b2 and processing device abnormality occurrence inputs c1 and c2, output a comparison start signal h to the data comparison circuit 12, and output control circuit 9 a timeout status signal o and processing device abnormality status signal p. , A timer start signal k and a timer stop signal m are output to the counter circuit 13, and a timeout signal n is input from the counter circuit 13.

The output control circuit 9 receives the comparison result signal i and the comparison result completion signal j from the data comparison circuit 12, and the timing control circuit 8 outputs the timeout status signal o.
The processing device abnormal status signal p is input, and status outputs d1 and d2 and status completion outputs e1 and e2 are output to the processing devices 1 and 2.

The check data latch circuits 10 and 11 receive check data inputs a1 and a2 from the processors 1 and 2, respectively.
And check data completion inputs b1 and b2 are input, and comparison data signals q1 and q2 are output to the data comparison circuit.

The data comparison circuit 12 receives the comparison data signals q1 and q2 from the check data latch circuits 10 and 11, the comparison start signal h from the timing control circuit 8, and the comparison result signal i to the output control circuit 9. The comparison result completion signal j is output.

The counter circuit 13 receives the timer start signal k and the timer stop signal m from the timing control circuit 8, and the timing control circuit 8 outputs the time-out signal n.
The counter data signal r is input from the time-out time latch circuit 14 and the clock signal s is input from the clock circuit 15.

The timeout time latch circuit 14 receives the timeout time input g and the timeout time setting input f from the processing device 3, and outputs the counter data signal r to the counter circuit 13. The clock circuit 15 outputs the clock signal s to the counter circuit. Next, the operation of this embodiment will be described with reference to FIGS. First, the input / output operation of each basic component circuit will be described. 1. Timing Circuit 8 The timing circuit 8 has three states: an initial state, a processing device 1 check data completion wait and a processing device 2 check data completion wait. The state transition is shown in FIG. (A) In the initial state

When receiving the check data completion input b1 (b2) from the processing device 1 (2), a timer start signal k is sent to the timer circuit 6, and the processing device 2 (1) shifts to the check data completion waiting state. When the check data completion inputs c1 and c2 are simultaneously input, the comparison start signal h is sent to the comparison circuit 5, and the state does not shift.

When the processing device abnormality occurrence inputs c1 and c2 are received, the timer stop signal m is sent to the timer circuit 6, and the processing device abnormality status signal p is sent to the output control circuit 9 as the occurrence of the processing device 1 and 2 abnormality. Do not move. (B) Processing device 1 (2) Check data completion waiting state

When the check data completion input b1 (b2) is received from the processing device 1 (2), the timer stop signal m is sent to the timer circuit 6 and the comparison start signal h is sent to the comparison circuit 5 to shift to the initial state.

When the check data completion input b2 (b1) is received from the processing device 2 (1), a timer stop signal m is sent to the timer circuit 6 and the processing device abnormality status signal p is sent to the output control circuit 9 by the processing device 1 (2). ) Send as abnormal and shift to the initial state.

When the time-out signal n is received from the timer circuit 6, the time-out status signal o is sent to the output control circuit 9 as the time-out of the processing device 2 (1), and the initial state is entered.

When the processor abnormality input c1 (c2) is received, a timer stop signal m is sent to the timer circuit 6,
The processor abnormality status signal p is sent to the output control circuit 9 as an abnormality occurrence of the processor 1 (2), and the initial state is entered. 2. Output control circuit 9

When the comparison result completion signal j is received from the comparison circuit, the status output d to the two processing devices 1 and 2 is given.
1 and d2 are sent to the respective processing devices 1 and 2 as the comparison abnormal signal if there is no abnormality in the comparison result signal i and as the comparison abnormal signal if the comparison result is abnormal, and the status completion outputs e1 and e2 are sent.
To the respective processing devices 1 and 2.

When the processing device abnormality status signal p is received from the timing control circuit 8, the status outputs d1 and d2 for the two processing devices 1 and 2 are sent to the processing device designated as abnormal by the processing device abnormality status signal p. On the other hand, it is sent to each processing device as an error in its own processing device and as an error in the other processing device to the other processing device, and status completion outputs e1 and e2 are sent to the respective processing devices 1 and 2.

When the time-out status signal o is received from the timing control circuit 8, when the processing device 1 (2) receives the time-out status signal o, the status output d1 (d
2) is sent to the respective processing devices 1 and 2 as the self-processing device timeout and the status output d2 (d1) is sent to the respective processing devices 1 and 2 as a status completion output e.
1 and e2 are sent to the respective processing devices 1 and 2. 3. Check data latch circuits 10 and 11

When the check data completion input b1 (b2) is received from the processing device 1 (2), the check data input a1 (a2) at that time is held as check data. 4. Data comparison circuit 12

When the comparison start signal h is received from the control circuit 4, the two check data latch circuits 10 and 11
Each check data is compared data signal q1, q2
, And compare the data. Then, the comparison result signal i is sent to the control circuit 4 as normal if the contents of the check data are the same, as a comparison error if the contents of the check data are different, and the comparison result completion signal j is sent to the control circuit 4. 5. About the counter circuit 13

When receiving the timer start signal k from the control circuit 4, the counter initial value is read from the timeout time latch circuit 14 as counter data r, and the clock signal s from the clock circuit 15 counts down.

When receiving the timer stop signal m from the control circuit 4, the counter is stopped. Count down,
When the count reaches 0, the time-out signal n is sent to the control circuit 4. 6. Regarding the time-out time latch circuit 14, when the time-out time setting input f is received from the processing device 3, the time-out time input g at that time is stored as the counter initial value of the counter circuit 13. 7. Clock circuit 15 Clock signal s for counting down the counter circuit 13
To occur. 6 to 10 show the signal flow of the supervisory control device.

FIG. 6 is a time chart showing the normal operation of the processing devices 1 and 2. FIG. 7 is a time chart showing the normal operation of both the processing devices 1 and 2, and the check data completion input is simultaneously input. FIG. 8 is a time chart showing a synchronization shift between the processing devices 1 and 2, showing occurrence of a timeout.
FIG. 9 is a time chart showing the normal operation of both the processing devices 1 and 2, and the check data completion input is input at the same time when the timeout occurs. FIG. 10 shows a processing device abnormality.
The processing device 1 operates normally, the processing device 2 detects an abnormality by itself, and the processing device 2 inputs the processing device abnormality occurrence input to the check data input from the processing device 1.

As described above, according to the present embodiment, firstly, the monitoring function is made independent of the processing device, so that the abnormal operation of the program monitoring due to the problem of the processing device itself can be avoided. Second, since the monitoring function is independent of the processing device, the load on the CPU of the processing device can be reduced. Thirdly, when the data to be compared is input at the time-out interval, the timing control circuit process can suppress the notification of the time-out occurrence. Fourthly, when implemented by software, the time-out process is performed by an interrupt, so the time accuracy is poor, but because it is implemented by hardware, the time accuracy is high.

[0049]

As described above, according to the present invention, the function of monitoring the execution states of the programs of the two processing devices is improved.
Also, the accuracy of the timeout time is improved. Further, the comparison function operates correctly even when the CPU is abnormal. Furthermore, CP
There is an advantage that the load on U can be reduced.

[Brief description of drawings]

FIG. 1 is an overall configuration diagram of an embodiment of the present invention.

FIG. 2 is a configuration diagram of a control circuit according to an embodiment of the present invention.

FIG. 3 is a configuration diagram of a comparison circuit according to an embodiment of the present invention.

FIG. 4 is a configuration diagram of a timer circuit according to an embodiment of the present invention.

FIG. 5 is a state transition diagram of the timing control circuit according to the embodiment of the present invention.

FIG. 6 is a time chart when the embodiment of the present invention is normal.

FIG. 7 is a time chart when the embodiment of the present invention is normal (simultaneous input of check data).

FIG. 8 is a time chart (timeout) at the time of abnormality in the embodiment of the present invention.

FIG. 9 is a time chart when the embodiment of the present invention is normal (check data input at the same time as occurrence of timeout).

FIG. 10 is a time chart at the time of abnormality in the embodiment of the present invention (processing device abnormality occurrence input).

FIG. 11 is a configuration diagram in the case of performing comparison by the processing apparatus itself to be compared in the conventional example.

FIG. 12 is a diagram showing a flow of a program in the case where the comparison is performed by the processing device itself in the conventional example.

FIG. 13 is a configuration diagram of comparison using a special processing device in a conventional example.

FIG. 14 is a diagram showing the flow of a program in the case of comparison using a special processing device in a conventional example.

[Explanation of symbols]

1, 2, 3 ... Processing device, 4 ... Control device, 5 ... Comparison circuit,
6 ... Timer circuit, 7 ... Program monitoring device, 8 ... Timing control circuit, 9 ... Output control circuit, 10, 11 ... Check data latch circuit, 12 ... Data comparison circuit, 13 ... Counter circuit, 14 ... Timeout time latch circuit, 15
… Clock circuit

Claims (1)

[Claims] 1. An apparatus for monitoring program execution states of two processing units of a multi-system computer system, comprising: a comparison circuit having a function of receiving check data from the two processing units of the multi-system and comparing program operating states. , A timer circuit having a time-out detection function for checking the synchronization of programs of the two processing devices of the multiplex system, and a comparator circuit and a timer circuit are controlled so that the two processing devices of the multiplex system are in the operating state. And a control circuit having a function of notifying a determination result, wherein the comparison circuit inputs check data inputs indicating respective execution states of the two processing devices of the multiplex system from the two processing devices of the multiplex system, respectively. The check data completion input for notifying that the two processing devices of the multiplex system have output the check data input, respectively. Type each from the heavy-based two processing devices, 2 of the multi-system
A function of comparing the operating states of the two processing devices of the multiplex system by using respective check data received from one of the multiple processing devices; In order to check the synchronization state, the allowable time difference of the check data completion input from the two processing devices of the multiplex system is set by the timeout time data input and the timeout time setting from the two processing devices of the multiplex system or independent processing devices. The control circuit has a timeout detection function for limiting the timeout time set by inputting the input, and the control circuit detects the abnormality by the check data completion input or the two processing devices of the multiplex system. A processor abnormality occurrence input indicating that the time-out of the timer circuit is input from each of the two processors of the multiplex system. A comparison start signal that outputs a timer start signal and a timer stop signal for controlling the detection function to the timer circuit, inputs a time-out signal for notifying that the time-out is detected from the timer circuit, and controls the comparison function of the comparison circuit. To the comparison circuit and inputs a comparison result signal for notifying the comparison result of the program execution states of the two processing devices of the multiplex system, and a status signal indicating the operating state of the two processing devices of the multiplex system and this status. A program monitoring device having a function of outputting a status completion signal for notifying the two processing devices of the multiplex system that the signal has been output.