Patent Publication Number: US-9889839-B2

Title: Vehicle engine control system

Description:
INCORPORATION BY REFERENCE 
     The disclosure of Japanese Patent Application No. 2016-076987 filed on Apr. 7, 2016 including its specification, claims and drawings, is incorporated herein by reference in its entirety. 
     BACKGROUND OF THE INVENTION 
     The present invention relates to a vehicle engine control system provided with a microprocessor that has an engine control function and a transmission control function or with a first microprocessor and a second microprocessor that have the engine control function and the transmission control function, respectively, and particularly to a vehicle engine control system improved in such a way that a plurality of evacuation driving (limb-home) means can effectively be combined and utilized in response to an abnormality in valve-opening control of a throttle intake valve and/or an abnormality in speed-change control of a transmission. 
     DESCRIPTION OF THE RELATED ART 
     In general, engine control functions in a vehicle engine control system include a basic control function consisting of an ignition control function (in the case of a gasoline engine) and a fuel injection control function and a valve-opening control function for controlling the valve opening degree of an air-intake throttle; when an abnormality occurs in the valve-opening control, first evacuation driving can be implemented using a fixed throttle valve opening degree. In contrast, a transmission control function incorporated in the vehicle engine control system or implemented by a transmission control apparatus externally connected with the vehicle engine control system includes a speed-change control function that controls the transmission ratio of a continuously variable transmission in response to the step-on degree of the accelerator pedal and the present vehicle speed or performs multi-step automatic speed changing by combining the actions of a plurality of linear solenoid valves and hydraulic-clutch hydraulic pressure control, which is another basic control function, for back/forth switching, torque-converter lockup, all-wheel driving, and the like; when the control operation for the transmission is stopped, forward driving with a fixed transmission ratio suitable for a middle- or high-speed drive can be implemented. 
     For example, according to FIGS. 1 and 2 of Japanese Patent Application No. JP-A-2003-161194 (FIGS. 1 and 2 and ABSTRACT OF THE DISCLOSURE) “engine control apparatus”, listed below, there are provided a main CPU 111 that functions as an engine control means for performing fuel injection control and valve-opening control of an intake valve and a sub-CPU 121 that functions as a transmission control means; when a first abnormality storage device 133 stores an abnormality, a power-supply load relay 104 a  for an intake valve opening degree control motor 108 is de-energized and then severe-abnormality evacuation driving is implemented using the fixed throttle valve opening degree represented in FIG. 2. The first abnormality storage device 133 is set when a first reset signal RST1 for the main CPU 111, a second reset signal RST2 for the sub-CPU 121, an actuator-system error output ER0, for valve-opening driving, that is detected by the main CPU 111, or a sever-sensor-abnormality detection output ER1 of a valve opening control system occurs; the first abnormality storage device 133 is reset when a power switch 107 is closed. 
     JP-A-2003-161194 is characterized in that an abnormality is categorized into a sever abnormality or a slight abnormality by determining, for example, as to whether both of a pair of accelerator position sensors that detects the step-on degree of an accelerator pedal are abnormal or any one of them is regarded as being normal or as to whether both of a pair of throttle position sensors that detects the intake valve opening degree are abnormal or any one of them is regarded as being normal, so that simple evacuation driving can be implemented without relying on the fixed throttle valve opening degree. 
     According to FIG. 1 of Japanese Patent Application No. JP-A-2009-129267 (FIG. 1, ABSTRACT OF THE DISCLOSURE, and Paragraphs [0006], [0007], [0008], and [0009]) “a vehicle electronic control apparatus with a monitoring control circuit”, listed below, a main control circuit unit 20A that performs fuel injection control, valve-opening control of an intake valve, and speed-change control of a transmission is serial connected with a monitoring control circuit unit 30A that includes transmission-related input and output circuits; question information for monitoring the controlling operation of the main control circuit unit 20A is transmitted thereto by the monitoring control circuit unit 30A; the monitoring control circuit unit 30A compares answer information obtained from the main control circuit unit 20A with correct answer information preliminarily stored in the monitoring control circuit unit 30A so as to determine whether or not an abnormality exists in the control by the main control circuit unit 20A; then, in the case where an abnormality is detected, the monitoring control circuit unit 30A generates a reset output RST2 so as to initialize and then restart the main control circuit unit 20A. When detecting an abnormality in the monitoring control circuit unit 30A, the main control circuit unit 20A generates a reset output RST1 so as to initialize and then restart the monitoring control circuit unit 30A; a watchdog timer 40 monitors a watchdog signal WD, which is a pulse train signal generated by a microprocessor 20 included in the main control circuit unit 20A; when the pulse width of the watchdog signal WD exceeds a predetermined value, the watchdog timer 40 generates a reset pulse RST so as to initialize and then restart the main control circuit unit 20A and the monitoring control circuit unit 30A. JP-A-2009-129267 is characterized in that the same question information is repeatedly transmitted in order to prolong the question communication period so that synchronous communication of upstream and downstream signals is implemented while the control load on the main control circuit unit 20A is reduced. 
     In contrast, Japanese Patent Application No. JP-A-2007-177932 (FIG. 5, ABSTRACT OF THE DISCLOSURE, and Paragraph [0011]) “a hydraulic pressure controller for a multi-step automatic transmission” discloses a hydraulic pressure controller that makes it possible that in the case where when a vehicle is traveling, all of the solenoids of a plurality of electromagnetic valves for selecting a gear step turn off, the gear step is fixed to a relatively high-speed step and the engine is restarted so that the gear step is set to a relatively low-speed step and hence the vehicle is restarted. As a result, an abnormality that occurs while a vehicle travels can be prevented from suddenly decelerating the vehicle; moreover, restating after a temporary stop can be facilitated. 
     SUMMARY OF THE INVENTION 
     (1) Explanation for Problems in the Prior Art 
     In JP-A-2003-161194, the engine control apparatus is configured in such a way that actuator-system and sensor-system hardware abnormalities can be detected; however, when an abnormality exists in the control system, a hardware abnormality cannot be recognized although it exists, or a determination that a hardware abnormality exists is implemented although it does not exist; thus, the reliability of the abnormality detection means is posed as a problem. Moreover, in JP-A-2003-161194, when due to a run-away abnormality in the sub-CPU 121, the second reset signal RST2 is generated, the first abnormality storage device 133 stores the occurrence of this abnormality; as a result, power supply to the intake valve opening degree control motor 108 is stopped so that the valve opening degree is set to a fixed intake valve opening degree, and the transmission ratio is set, for example, to the third-speed fixed transmission ratio for middle- or high-speed driving. Accordingly, there has been a problem that in the case where the engine output is limited and the transmission ratio is set to the third speed for middle- or high-speed driving, it is difficult to escape from a run-off state or to drive on an uphill road. In the case where a transmission ratio fixation mechanism is designed in such a way that when the sub-CPU 121 is abnormally stopped by the second reset signal RST2, the transmission ratio is set to the first-speed ratio or the second-speed ratio for low-speed driving, the foregoing problems are solved; however, there has been a problem that when during high-speed driving, an abnormality occurs in the sub-CPU 121 and the transmission ratio moves to the first-speed ratio or the second-speed ratio, the sudden deceleration may be caused. 
     According to foregoing JP-A-2009-129267, the monitoring control circuit unit 30A determines whether or not an abnormality exists in the control performed by the main control circuit unit 20A, and in the case where an abnormality is detected, the main control circuit unit 20A is initialized and then restarted; thus, there is demonstrated a characteristic that in the case where hardware-abnormality detection based on JP-A-2003-161194 and control-abnormality detection based on JP-A-2009-129267 are combined, the abnormality detection means becomes many-sided. However, according to JP-A-2009-129267, when abnormal control by at least one of the valve-opening control means and the gear-shift control means continues, the main control circuit unit 20A is stopped by the reset output RST2; thus, there has been a problem that stoppage of the fuel injection control may make the evacuation driving infeasible. 
     Control abnormality includes a temporary abnormality caused by a malfunction attributed to noise or the like and a continuous abnormality caused by an abnormality in a microprocessor hardware; the continuous abnormality includes a non-runaway repeated abnormality in which repeated control operation of the microprocessor is continued and hence no watchdog-timer abnormality is caused and a runaway repeated abnormality in which the repeated control operation of the microprocessor is stopped and hence the watchdog-timer abnormality is caused. In the case the control abnormality is a temporary abnormality, the microprocessor is reset and restarted through reset processing, so that the abnormal state can be cancelled and be followed by the normal state. However, there has been a problem that the fuel injection control is stopped not only at a time when the runaway repeated abnormality is continuing but also at a time of the non-runaway repeated abnormality that is not so severe as the run-away abnormality. 
     According to foregoing JP-A-2007-177932, in the case where when a transmission-control abnormality occurs, the driving of the automatic transmission control electromagnetic valve is fully stopped, the transmission ratio moves to, for example, the third speed fixation suitable for middle- or high-speed driving, so that sudden deceleration of the vehicle can be prevented; however, when the vehicle should be restarted in this situation, it is required to restart the engine. When in order to restart the engine, the power switch is temporarily opened, the memory about the fact that an abnormality has occurred is reset, in general; thus, there has been a problem that when the abnormality factor has not been eliminated, the transmission-control abnormality occurs again as the driving is restarted and hence endless abnormality occurrence routine is caused. When a nonvolatile memory stores the fact that a transmission-control abnormality has occurred, this kind of problem is not caused; however, there has been a problem that in the case where the transmission-control abnormality has temporarily been caused by a malfunction attributed to noise, recovery processing for this abnormality cannot be implemented, although this abnormality is originally the one from which normal driving can be recovered by restarting. 
     (2) Objective of the Present Invention 
     The first objective of the present invention is that a single vehicle engine control system performs both engine control and transmission control so that as a whole, a compact, inexpensive, and integrated vehicle engine control system is configured, and that appropriate diverse evacuation driving that responds to an abnormality in the throttle valve control system and an abnormality in the transmission control system is made possible. The second objective of the present invention is that a vehicle engine control system is disposed in the vicinity of the engine and a transmission control apparatus is disposed in the vicinity of the transmission so that a separate-type vehicle engine control system that can shorten the lengths of input and output wiring leads is configured, and that further diverse evacuation driving that responds to an abnormality in the throttle valve control system and an abnormality in the transmission control system is made possible. The third objective of the present invention is that an integrated or separate-type vehicle engine control system is configured compact and inexpensive and in such a way as to make it possible to perform diverse evacuation driving in response to an abnormality in the throttle valve control system and an abnormality in the transmission control system; the third objective of the present invention is also to provide a vehicle engine control system that can raise the abnormality-monitoring function and can prevent evacuation driving function from being lost because due to the raising of the abnormality-monitoring function, the basic function is inappropriately stopped. 
     A vehicle engine control system according to the first invention of the present invention is a multi-function vehicle engine control system whose collective case includes a main control circuit unit connected with an engine control output circuit unit and a transmission control output circuit unit, a monitoring control circuit unit serial connected with the main control circuit unit, and an error processing circuit unit. The main control circuit unit includes a microprocessor that operates with an opening/closing signal or an analogue signal, as an input signal, obtained from a first sensor group and a second sensor group, which are utilized in engine control and transmission control, and that generates at least a fuel injection control output for a fuel-injection electromagnetic valve, a valve-opening control output for an intake valve opening degree control motor for an intake valve provided in an air-intake throttle, and a transmission-control output, including at least a speed-change control output, for an automatic transmission; and a valve-opening drive mechanism of the intake valve using the intake valve opening degree control motor includes an initial-position returning mechanism that makes it possible to perform evacuation driving using a fixed intake valve opening degree when power supply to the intake valve opening degree control motor is stopped. A transmission driving mechanism of the automatic transmission includes a transmission ratio fixation mechanism that makes it possible to at least travel forward at a fixed transmission ratio suitable for middle- or high-speed driving when during variable-speed forward driving, power supply to the automatic transmission is stopped or when power-supply driving of all automatic transmission control electromagnetic valves included in the automatic transmission is stopped; the monitoring control circuit unit is provided with a valve-opening system control abnormality determinator that sequentially transmits to the microprocessor in operation a plurality of question information pieces related to at least a creation program for the valve-opening control output, receives from the microprocessor answer information pieces corresponding to the question information pieces, compares the answer information pieces with the respective corresponding correct answer information pieces, preliminarily stored in the monitoring control circuit unit, determines whether or not a code check abnormality and an answering-response delay exist in the answer information so as to determine whether or not a valve-opening control abnormality including a communication abnormality and a question-answer abnormality exists, and then creates a valve opening control abnormality signal, which is one of valve opening system control abnormality signals. 
     The error processing circuit unit is provided with a watchdog timer that generates a basic reset signal when a calculation period of the microprocessor is abnormal and then initializes and restarts the microprocessor, a first storage circuit that is set when a first state is established in which the occurrence count or the occurrence frequency of each of the basic reset signal and the valve opening control abnormality signal becomes the same as or larger than a predetermined threshold value or the total occurrence count or the total occurrence frequency of the basic reset signal and the valve opening control abnormality signal becomes the same as or larger than a predetermined threshold value, and a first gate circuit; when the first storage circuit has stored the occurrence of an abnormality, a first cutoff circuit stops power supply to the intake valve opening degree control motor; the first gate circuit resets the microprocessor through the basic reset signal and the valve opening control abnormality signal when the first state has not been established, and after the first storage circuit has stored the occurrence of an abnormality, the first gate circuit prohibits the valve opening control abnormality signal from performing reset processing of the microprocessor so that a continuous non-runaway repeated abnormality related to valve-opening control is suppressed from providing an effect to fuel injection control, and the error processing circuit unit further detects and stores an occurrence state of at least a transmission system control abnormality signal, and a second cutoff circuit, which responds to the transmission system control abnormality signal, stops power supply to at least the automatic transmission control electromagnetic valve in the automatic transmission by having detected a transmission-control abnormality. 
     A vehicle engine control system according to the second invention of the present invention is a function-separated vehicle engine control system whose first case includes a first main control circuit unit connected with an engine control output circuit unit, a first monitoring control circuit unit serial connected with the first main control circuit unit, and a first error processing circuit unit. The vehicle engine control system is connected with a transmission control apparatus whose second case includes a second main control circuit unit connected with a transmission control output circuit unit, a second monitoring control circuit unit serial connected with the second main control circuit unit, and a second error processing circuit unit; the first main control circuit unit includes a first microprocessor that operates with an opening/closing signal or an analogue signal, as an input signal, obtained from a first sensor group, which is utilized in engine control, and a second sensor group, which is shared with partial transmission control, and that generates at least a fuel injection control output for a fuel-injection electromagnetic valve and a valve-opening control output for an intake valve opening degree control motor for an intake valve provided in an air-intake throttle; a valve-opening drive mechanism of the intake valve using the intake valve opening degree control motor includes an initial-position returning mechanism that makes it possible to perform evacuation driving using a fixed intake valve opening degree when power supply to the intake valve opening degree control motor is stopped; the second main control circuit unit includes a second microprocessor that operates with an opening/closing signal or an analogue signal, as an input signal, obtained from the second sensor group utilized in transmission control and the first sensor group, which is shared with partial engine control, and that generates at least a speed-change control output for an automatic transmission control electromagnetic valve; a transmission driving mechanism of an automatic transmission containing the automatic transmission control electromagnetic valve includes a transmission ratio fixation mechanism that makes it possible to at least travel forward at a fixed transmission ratio suitable for middle- or high-speed driving when during variable-speed forward driving, power supply to the automatic transmission is stopped or when driving of all the automatic transmission control electromagnetic valves is stopped. 
     The first monitoring control circuit unit is provided with a valve-opening system control abnormality determinator that sequentially transmits to the first microprocessor in operation a plurality of question information pieces related to at least a creation program for the valve-opening control output, receives from the first microprocessor answer information pieces corresponding to the question information pieces, compares the answer information pieces with the respective corresponding correct answer information pieces, preliminarily stored in the first monitoring control circuit unit, determines whether or not a code check abnormality and an answering-response delay exist in the answer information so as to determine whether or not a valve-opening control abnormality including a communication abnormality and a question-answer abnormality exists, and then creates the valve opening control abnormality signal, which is one of valve opening system control abnormality signals; the first error processing circuit unit is provided with a watchdog timer that generates a basic reset signal when a calculation period of the first microprocessor is abnormal and then initializes and restarts the first microprocessor, a first storage circuit that is set when a first state is established in which the occurrence count or the occurrence frequency of each of the basic reset signal and the valve opening control abnormality signal becomes the same as or larger than a predetermined threshold value or the total occurrence count or the total occurrence frequency of the basic reset signal and the valve opening control abnormality signal becomes the same as or larger than a predetermined threshold value, and a first gate circuit. 
     When the first storage circuit has stored the occurrence of an abnormality, a first cutoff circuit stops power supply to the intake valve opening degree control motor; the first gate circuit resets the first microprocessor through the basic reset signal and the valve opening control abnormality signal when the first state has not been established, and after the first storage circuit has stored the occurrence of an abnormality, the first gate circuit prohibits the valve opening control abnormality signal from performing reset processing of the first microprocessor so that a continuous non-runaway repeated abnormality related to valve-opening control is suppressed from providing an effect to fuel injection control; the second error processing circuit unit further detects and stores an occurrence state of at least a transmission system control abnormality signal, and a second cutoff circuit, which responds to the transmission system control abnormality signal, stops driving of or power supply to at least the automatic transmission control electromagnetic valve in the automatic transmission by having detected a transmission-control abnormality. 
     A vehicle engine control system according to the third invention of the present invention is a multi-function vehicle engine control system whose collective case includes a main control circuit unit connected with an engine control output circuit unit and a transmission control output circuit unit, a monitoring control circuit unit serial connected with the main control circuit unit, and an error processing circuit unit, or a function-separated vehicle engine control system whose first case includes a first main control circuit unit connected with an engine control output circuit units, a first monitoring control circuit unit serial connected with the first main control circuit unit, and a first error processing circuit unit. 
     The function-separated vehicle engine control system is connected with a transmission control apparatus whose second case includes a second main control circuit unit connected with a transmission control output circuit unit, a second monitoring control circuit unit serial connected with the second main control circuit unit, and a second error processing circuit unit; the monitoring control circuit unit, and the first monitoring control circuit unit and the second monitoring control circuit unit, and, the error processing circuit unit, and the first error processing circuit unit and the second error processing circuit unit are all integrated in such a way that the redundancy of common part among the corresponding circuit units is avoided, and the integrated device forms a shared integrated circuit device that collaborates with the main control circuit unit, the first main control circuit unit, or the second main control circuit unit; the main control circuit unit or the first main control circuit unit includes a microprocessor or a first microprocessor, as the case may be, that operates with an opening/closing signal or an analogue signal, as an input signal, obtained from a first sensor group, which is utilized in engine control, and a second sensor group, which is utilized in transmission control, and that generates at least a fuel injection control output for a fuel-injection electromagnetic valve and a valve-opening control output for an intake valve opening degree control motor for an intake valve provided in an air-intake throttle. 
     The main control circuit unit or the second main control circuit unit includes the microprocessor or the second microprocessor, as the case may be, that operates with an opening/closing signal or an analogue signal, as an input signal, obtained from the first sensor group, which is utilized in engine control, and the second sensor group, which is utilized in transmission control, and that generates a transmission-control output, including at least a speed-change control output, for an automatic transmission; a valve-opening drive mechanism of the intake valve using the intake valve opening degree control motor includes an initial-position returning mechanism that makes it possible to perform evacuation driving using a fixed intake valve opening degree when power supply to the intake valve opening degree control motor is stopped; a transmission driving mechanism of the automatic transmission includes a transmission ratio fixation mechanism that makes it possible to at least travel forward at a fixed transmission ratio suitable for middle- or high-speed driving when during variable-speed forward driving, power supply to the automatic transmission is stopped or when power-supply driving of all automatic transmission control electromagnetic valves included in the automatic transmission is stopped; a shared monitoring control circuit unit incorporated in the integrated circuit device is provided with a valve-opening system control abnormality determinator that sequentially transmits to the microprocessor or the first microprocessor in operation a plurality of question information pieces related to at least a creation program for the valve-opening control output, receives from the microprocessor or the first microprocessor answer information pieces corresponding to the question information pieces, compares the answer information pieces with the respective corresponding correct answer information pieces, preliminarily stored in the shared monitoring control circuit unit, determines whether or not a code check abnormality and an answering-response delay exist in the answer information so as to determine whether or not a valve-opening control abnormality including a communication abnormality and a question-answer abnormality exists, and then creates a valve opening control abnormality signal, which is one of valve opening system control abnormality signals. 
     A shared error processing circuit unit incorporated in the integrated circuit device is provided with a watchdog timer that generates a basic reset signal when a calculation period of the microprocessor or the first microprocessor is abnormal and then initializes and restarts the microprocessor or the first microprocessor, a first storage circuit that is set when a first state is established in which the occurrence count or the occurrence frequency of each of the basic reset signal and the valve opening control abnormality signal becomes the same as or larger than a predetermined threshold value or the total occurrence count or the total occurrence frequency of the basic reset signal and the valve opening control abnormality signal becomes the same as or larger than a predetermined threshold value, and a first gate circuit; when the first storage circuit has stored the occurrence of an abnormality, a first cutoff circuit stops power supply to the intake valve opening degree control motor; the first gate circuit resets the microprocessor or the first microprocessor through the basic reset signal and the valve opening control abnormality signal when the first state has not been established, and after the first storage circuit has stored the occurrence of an abnormality, the first gate circuit prohibits the valve opening control abnormality signal from performing reset processing of the microprocessor or the first microprocessor so that a continuous non-runaway repeated abnormality related to valve-opening control is suppressed from providing an effect to fuel injection control, and the main control circuit unit or the second main control circuit unit collaborates with the shared error processing circuit unit incorporated in the integrated circuit device so as to detect and store an occurrence state of at least a transmission system control abnormality signal, and a second cutoff circuit, which responds to the transmission system control abnormality signal, stops a driving output to at least the automatic transmission control electromagnetic valve in the automatic transmission by having detected a transmission-control abnormality. 
     As described above, the vehicle engine control system according to the first invention of the present invention includes a microprocessor that performs engine control and transmission control; when the first state is established in which the occurrence count or the occurrence frequency of each of the basic reset signal generated by the watchdog timer and the valve opening control abnormality signal generated by the control abnormality determinator becomes the same as or larger than a predetermined threshold value, the first storage circuit stores the occurrence of an abnormality and stops power supply to the intake valve opening degree control motor so as to set the intake valve opening degree to a fixed intake valve opening degree; until the first storage circuit stores the occurrence of an abnormality, the basic reset signal and the valve opening control abnormality signal implement reset processing of the microprocessor, and after the first storage circuit has stored the occurrence of an abnormality, the basic reset signal continues the reset processing of the microprocessor; however, the valve opening control abnormality signal is prohibited from implementing reset processing of the microprocessor. The microprocessor further responds to the occurrence of a transmission system control abnormality during variable-speed forward driving, and stops power supply to at least all the automatic transmission control electromagnetic valves, so that the driving mode moves to the mode of driving at a fixed transmission ratio for forward and middle- or high-speed driving. 
     In the vehicle engine control system according to the second invention of the present invention, the first microprocessor that performs engine control and the second microprocessor that performs transmission control are contained in respective separate cases and collaborate with each other; with regard to the first microprocessor, when the first state is established in which the occurrence count or the occurrence frequency of each of the basic reset signal generated by the watchdog timer and the valve opening control abnormality signal generated by the control abnormality determinator becomes the same as or larger than a predetermined threshold value, the first storage circuit stores the occurrence of an abnormality and stops power supply to the intake valve opening degree control motor so as to set the intake valve opening degree to a fixed intake valve opening degree; until the first storage circuit stores the occurrence of an abnormality, the basic reset signal and the valve opening control abnormality signal implement reset processing of the first microprocessor, and after the first storage circuit has stored the occurrence of an abnormality, the basic reset signal continues the reset processing of the first microprocessor; however, the valve opening control abnormality signal is prohibited from implementing reset processing of the first microprocessor. The second microprocessor further responds to the occurrence of a transmission system control abnormality during variable-speed forward driving, and stops power supply to at least all the automatic transmission control electromagnetic valves, so that the driving mode moves to the mode of driving at a fixed transmission ratio for forward and middle- or high-speed driving. 
     In the vehicle engine control system according to the third invention of the present invention, the microprocessor that performs engine control and transmission control or the first and second microprocessors that perform engine control and transmission control, respectively, are separately utilized; when the first state is established in which the occurrence count or the occurrence frequency of each of the basic reset signal generated by the watchdog timer and the valve opening control abnormality signal generated by the control abnormality determinator for each of the microprocessors the becomes the same as or larger than a predetermined threshold value, the first storage circuit stores the occurrence of an abnormality and stops power supply to the intake valve opening degree control motor so as to set the intake valve opening degree to a fixed intake valve opening degree; until the first storage circuit stores the occurrence of an abnormality, the basic reset signal and the valve opening control abnormality signal implement reset processing of the microprocessor for engine control, and after the first storage circuit has stored the occurrence of an abnormality, the basic reset signal continues the reset processing of the microprocessor for engine control; however, the valve opening control abnormality signal is prohibited from implementing reset processing of the microprocessor for engine control. The microprocessor or the second microprocessor related to transmission control responds to the occurrence of a transmission system control abnormality during variable-speed forward driving, and stops power supply to at least all the automatic transmission control electromagnetic valves, so that the driving mode moves to the mode of driving at a fixed transmission ratio for forward and middle- or high-speed driving. 
     Accordingly, abnormality monitoring by the watchdog timer on a sporadic abnormality or a continuous abnormality in the microprocessor and initialization/restarting processing based on the abnormality monitoring are always effective; with regard to the valve opening control abnormality signal related to valve-opening control of the intake valve, when after driving is started, an abnormality with less occurrence count or less occurrence frequency than a predetermined occurrence count or a predetermined occurrence frequency occurs, the microprocessor is initialized and restarted and recovery processing for the sporadic abnormality is performed, so that fuel injection control, the valve-opening control, and the transmission control can normally be performed; in the case where the occurrence of an abnormality continues, this recovery processing is stopped; thus, in the case of a non-runaway repeated abnormality that is a continuous abnormality but does not lead to a runaway abnormality of the microprocessor, the microprocessor is not reset by the basic reset signal; as a result, although the valve-opening control by the microprocessor cannot be implemented, the fuel injection control can be implemented and hence evacuation driving at a fixed transmission ratio becomes effective, and when a runaway abnormality occurs in the microprocessor, initialization and restarting are implemented through the basic reset signal; thus, there is demonstrated an effect that when the runaway abnormality is contingent and sporadic, at least fuel injection control recovers to the normal state and hence the evacuation driving can be continued. 
     An automatic transmission mechanically or electrically performs selection at least among the variable-speed forward driving mode, the backward driving mode, the neutral mode, and the parking mode; in the case where while the variable-speed forward driving mode is selected, a transmission system control abnormality occurs and hence power supply and driving of all the automatic transmission control electromagnetic valves are stopped or all power sources for the automatic transmission are cut off, the transmission ratio of the transmission is fixed to a ratio that is the middle transmission ratio or larger, for example, the third-speed forward driving mode; however, because the engine control is effective, there is demonstrated an effect that third-speed evacuation driving, which is more advantageous than evacuation driving at a fixed intake valve opening degree, can be implemented. In particular, when during high-speed driving, both the valve-opening control and the transmission control become abnormal, the high-speed driving is followed by the third-speed-fixed driving with a fixed throttle valve opening degree; however, because the transmission ratio is the middle-speed ratio or higher, for example, the third speed, there is demonstrated an effect that the engine brake does not operate in a rapid and abrupt manner. In this regard, however, when all the power sources for the automatic transmission are stopped, the present mode such as the backward driving mode, the forward driving mode, the neutral mode, or the parking mode is maintained regardless of which mode has been selected, and then the gear step is set, for example, to the third-speed fixation step. 
     The foregoing and other object, features, aspects, and advantages of the present invention will become more apparent from the following detailed description of the present invention when taken in conjunction with the accompanying drawings. 
    
    
     
       BRIEF DESCRIPTION OF THE DRAWINGS 
         FIG. 1  is a block diagram illustrating the overall configuration of a vehicle engine control system according to Embodiment 1 of the present invention; 
         FIG. 2  is a detailed circuit configuration diagram of an error processing circuit unit in the vehicle engine control system in  FIG. 1 ; 
         FIG. 3  is an equivalent flowchart for explaining determination operation, for a question-answer abnormality, that is performed by the vehicle engine control system in  FIG. 1 ; 
         FIG. 4  is a flowchart for explaining the operation concept of abnormality determination by the vehicle engine control system in  FIG. 1 ; 
         FIG. 5  is a block diagram illustrating the overall configuration of a vehicle engine control system according to Embodiment 2 of the present invention; 
         FIG. 6  is a detailed circuit configuration diagram of an error processing circuit unit in the vehicle engine control system in  FIG. 5 ; 
         FIG. 7  is a block diagram illustrating the overall configuration of a transmission control apparatus that is connected with the vehicle engine control system in  FIG. 5 ; 
         FIG. 8  is a detailed circuit configuration diagram of an error processing circuit unit in the transmission control apparatus in  FIG. 7 ; 
         FIG. 9  is a block diagram illustrating the overall configuration of a vehicle engine control system according to Embodiment 3 of the present invention; 
         FIG. 10  is a block diagram illustrating the overall configuration of a vehicle engine control system, as a variant of the vehicle engine control system in  FIG. 9 ; and 
         FIG. 11  is a block diagram illustrating the overall configuration of a transmission control apparatus that is connected with the vehicle engine control system in  FIG. 10 . 
     
    
    
     DETAILED DESCRIPTION OF THE EMBODIMENTS 
     Embodiment 1 
     (1) Detailed Description of Configuration 
     Hereinafter, with reference to  FIG. 1 , which is a block diagram illustrating the overall configuration of a vehicle engine control system  100 A according to Embodiment 1 of the present invention, the configuration thereof will be explained in detail. In  FIG. 1 , the vehicle engine control system  100 A is configured mainly with a main control circuit unit  120 A, a monitoring control circuit unit  130 A, and an error processing circuit unit  160 A that are mounted on an unillustrated circuit board and are contained in a collective case  70 ; the vehicle engine control system  100 A is an integrated engine control apparatus in which an engine control circuit function and a transmission control function are included. The power-source terminal of the vehicle engine control system  100 A is connected with a vehicle battery  101  through a main apparatus power supply command output RY 0 , which is an output element of a main apparatus control power source relay  107   b  that is energized by way of an after-mentioned self-holding circuit  197  when a power switch  105  is closed. A first sensor group  103  includes various kinds of sensors to be utilized in controlling an engine such as a crank angle sensor for detecting the rotation angle of an engine and a rotation sensor for detecting the rotation speed thereof, an air flow sensor for measuring an intake amount of air that passes through a throttle intake valve, an accelerator position sensor for detecting the step-on degree of an accelerator pedal, a throttle position sensor for detecting an intake valve opening degree, and a gas sensor for detecting a concentration of oxygen in an exhaust-gas sensor. 
     In this regard, however, the accelerator position sensor and the engine rotation sensor among the various kinds of sensors are utilized also in transmission control. The second sensor group  104  includes various kinds of sensors to be utilized in controlling a transmission such as a vehicle speed sensor, a gearshift sensor for detecting the selection position of a gearshift lever, an oil temperature sensor or an oil pressure sensor in a transmission. In this regard, however, a vehicle speed sensor and a gearshift sensor among the various kinds of sensors are utilized also in engine control. A fuel-injection electromagnetic valve  107   a , which is one of basic electric loads to be supplied with electric power by the vehicle battery  101  through the main apparatus power supply command output RY 0 , is provided in each of the cylinders of a multi-cylinder engine; in the case where this engine is a gasoline engine, an unillustrated ignition coil, as another one of the basic electric loads, is added thereto. An intake valve opening degree control motor  108   a , which is a major first auxiliary apparatus, is supplied with electric power by the vehicle battery  101  through a first auxiliary apparatus power supply command output RY 1 , which is an output element of a valve-opening control power source relay  108   b ; there is provided a fail-safe mechanism for compulsory and mechanical resetting so that when power supply to the intake valve opening degree control motor  108   a  is stopped, the opening degree is set to a fixed intake valve opening degree at which a rotation speed higher than the idling rotation speed can be obtained. 
     An automatic transmission  109   a , which is a major second auxiliary apparatus, is supplied with electric power by the vehicle battery  101  through a second auxiliary apparatus power supply command output RY 2 , which is an output element of a transmission control power source relay  109   b ; when the power supply is stopped, a predetermined fixed transmission ratio, which is a transmission ratio suitable for middle- or high-speed driving, is obtained. The basic electric loads of the automatic transmission  109   a  include a low-speed step selection electromagnetic valve  109   d , which is driven when a low-speed forward driving mode or a backward driving mode is mechanically or electrically selected through manual operation of a gearshift lever; as the power supply system for the basic electric load, instead of the second auxiliary apparatus power supply command output RY 2 , the main apparatus power supply command output RY 0  can also be utilized in such a way as represented by a dotted line; the low-speed step selection electromagnetic valve  109   d  is included in an automatic transmission control electromagnetic valve  109   c  or a dedicated electromagnetic valve is utilized, as the low-speed step selection electromagnetic valve  109   d . The automatic transmission control electromagnetic valve  109   c  in the automatic transmission  109   a  is to change the transmission ratios in a no-step manner or in a multistep manner; in the case where when a variable-speed forward driving mode is selected, power supply to all the automatic transmission control electromagnetic valves  109   c  is stopped, the fixed transmission ratio suitable for middle- or high-speed driving is obtained. 
     With regard to the internal configuration of the vehicle engine control system  100 A, the constant voltage power source  110  generates a control voltage Vcc, which is a stabilized voltage of, for example, DC 5V, and other stabilized voltages and supplies electric power to a microprocessor CPU 0  and input/output interface circuit units. The main control circuit unit  120 A, which is an integrated circuit device and includes mainly a microprocessor CPU 0 , is configured with a nonvolatile program memory, which is, for example, a flash memory, a data memory, which is part of the region of the program memory or another nonvolatile memory with which reading and writing can electrically be performed, a built-in memory including a volatile RAM, a multi-channel A/D converter, and a communication interface circuit SIF. The main control circuit unit  120 A is connected with the first sensor group  103  by way of a first input interface circuit  173  and with the second sensor group  104  by way of a second input interface circuit  174 ; the main control circuit unit  120 A is also connected with a fuel-injection electromagnetic valve  107   a  and the intake valve opening degree control motor  108   a  by way of engine control output circuit units  177   a  and  178   a , respectively, and with an automatic transmission control electromagnetic valve  109   c  and the low-speed step selection electromagnetic valve  109   d  of the automatic transmission  109   a  by way of a transmission control output circuit unit  179   a.    
     A fuel injection control output OUT 0  generated by the microprocessor CPU 0  performs energization drive of the fuel-injection electromagnetic valve  107   a  provided in each of the cylinders, at a predetermined timing and for a predetermined period; however, in practice, instantaneous rapid power supply control through an unillustrated stepped-up voltage or opened-valve holding control is implemented. A valve-opening control output OUT 1  performs reversible rotation drive of the intake valve opening degree control motor  108   a  so as to obtain the valve opening degree of the air-intake throttle corresponding to a step-on degree of the accelerator pedal. A transmission-control output OUT 2  for controlling the automatic transmission  109   a  includes a transmission control output OUT 20  and a speed-change control output OUT 22 ; in the case where the automatic transmission  109   a  operates in mechanical conjunction with a selection position of the shift lever to be manually operated, so that each of the driving modes including Reverse R, Neutral N, Low-speed forward D 1 , Variable-speed forward D, and Parking P is determined, the transmission control output OUT 20  performs energization drive of the low-speed step selection electromagnetic valve  109   d . In the case where the driving mode of the automatic transmission  109   a  is electrically controlled in conjunction with a selection position of the shift lever, for example, a control output for a motor that performs driving-mode-selection drive is added and the transmission control output OUT 20  performs energization drive of the low-speed step selection electromagnetic valve  109   d  in the selected backward driving mode or low-speed forward driving mode. 
     The speed-change control output OUT 22  operates in conjunction with the step-on degree of the accelerator pedal and the vehicle speed so as to perform energization drive of a plurality of automatic transmission control electromagnetic valves  109   c  at a time when a variable-speed forward driving mode is selected. The plurality of automatic transmission control electromagnetic valves  109   c  is configured in such a way that energization drive is selectively applied to one of or a number of them so that multistep transmission ratios are obtained; alternatively, each of the plurality of automatic transmission control electromagnetic valves  109   c  is a linear solenoid valve for obtaining a no-step transmission ratio by increasing or decreasing the effective diameter of a pair of variable-speed pulleys. The error processing circuit unit  160 A, described later in  FIG. 2 , monitors the pulse width of a pulse train signal WDS 0 , which is a watchdog signal to be generated by the microprocessor CPU 0 ; when the pulse width of the train signal WDS 0  is normal, the error processing circuit unit  160 A generates an output permission signal OUTE. In addition, the error processing circuit unit  160 A monitors a hardware abnormality signal HDEi, a memory abnormality signal MMEj, and a question-answer abnormality signal QAEk to be generated by the monitoring control circuit unit  130 A, described later in  FIG. 3 ; in the case where an abnormality occurs, a composite reset signal RST 00  initializes and then restarts the microprocessor CPU 0 . 
     The monitoring control circuit unit  130 A is serial connected with the microprocessor CPU 0  by way of the serial-parallel converter SIF, and the monitoring control circuit unit  130 A and the microprocessor CPU 0  mutually perform signal communication by use of a downstream signal DN and an upstream signal UP that are synchronized with a clock signal CLK; in this example, part of signals obtained from the second sensor group  104  are transmitted to the microprocessor CPU 0  through the upstream signal UP. The monitoring control circuit unit  130 A is provided with a valve-opening system control abnormality determination means  308   a  for creating the question-answer abnormality signal QAEk, and generates a main apparatus power supply control output RY 00 , a first auxiliary apparatus power supply control output RY 01 , and a second auxiliary apparatus power supply control output RY 02  in response to commands issued by the microprocessor CPU 0  through the downstream signal DN. In addition, with regard to the question-answer abnormality signal QAEk, the transmission system control abnormality determination means  308   b  may be omitted. The error processing circuit unit  160 A generates a first state storage signal S 1  for storing occurrence of an abnormality in the valve opening control system and a second state storage signal S 2  for storing occurrence of an abnormality in the transmission control system; each of the storage states is erased by a reset circuit  175  that generates a power-on-reset signal POR when the power switch  105  is closed. 
     The power cutoff circuit  196  receives, as a self-holding signal for the self-holding circuit  197 , the output of a logical multiplication of the main apparatus power supply control output RY 00  generated by the monitoring control circuit unit  130 A and the output permission signal OUTE generated by the error processing circuit unit  160 A; a circuit-closure signal from the power switch  105  is inputted, as a driving signal for a logical sum, to the self-holding circuit  197 ; the output of the self-holding circuit  197  energizes the main apparatus control power source relay  107   b . Accordingly, when the power switch  105  is closed, the main apparatus control power source relay  107   b  is energized, so that the main apparatus power supply command output RY 0  is generated, and hence the microprocessor CPU 0  starts its operation and generates the main apparatus power supply control output RY 00 ; after that, even when the power switch  105  is closed, the energization of the main apparatus control power source relay  107   b  is continued; however, when the microprocessor CPU 0  stops the main apparatus power supply control output RY 00  or when the error processing circuit unit  160 A stops the output permission signal OUTE, the main apparatus control power source relay  107   b  is de-energized. 
     A first cutoff circuit  198  energizes the valve-opening control power source relay  108   b  by use of the output of a logical multiplication of the first auxiliary apparatus power supply control output RY 01  generated by the monitoring control circuit unit  130 A, the output permission signal OUTE generated by the error processing circuit unit  160 A, and the logical inversion signal of the first state storage signal S 1 ; the valve-opening control power source relay  108   b  is energized and controlled by the first auxiliary apparatus power supply control output RY 01 ; however, when the watchdog signal becomes abnormal and hence the output permission signal OUTE is stopped or when the first state storage signal S 1  is generated as an abnormality occurs in the valve opening control system, the valve-opening control power source relay  108   b  is de-energized. A second cutoff circuit  199  energizes the transmission control power source relay  109   b  by use of the output of a logical multiplication of the second auxiliary apparatus power supply control output RY 02  generated by the monitoring control circuit unit  130 A, the output permission signal OUTE generated by the error processing circuit unit  160 A, and the logical inversion signal of the second state storage signal S 2 ; the transmission control power source relay  109   b  is energized and controlled by the second auxiliary apparatus power supply control output RY 02 ; however, when the watchdog signal becomes abnormal and hence the output permission signal OUTE is stopped or when the second state storage signal S 2  is generated as an abnormality occurs in the transmission control system, the transmission control power source relay  109   b  is de-energized. 
     The microprocessor CPU 0  generates a reverse monitoring abnormality determination signal QAER for resetting the monitoring control circuit unit  130 A; the reverse monitoring abnormality determination signal QAER is a signal for initializing the monitoring control circuit unit  130 A in the case where when in response to question information obtained from the monitoring control circuit unit  130 A, the microprocessor CPU 0  intentionally transmits an erroneous answer to the monitoring control circuit unit  130 A, monitors the processing state of the monitoring control circuit unit  130 A, and then determines whether or not the monitoring control circuit unit  130 A is normally operating, it is determined that the monitoring control circuit unit  130 A is not normally operating. With regard to the basic electric loads of the automatic transmission  109   a , in the case where selection control of the positions of Reverse, Neutral, Forward, and Parking is electrically performed through manual operation of the gearshift lever, this mode selection function is regarded as the second basic function of the microprocessor CPU 0 ; as the power supply system for the basic electric load including the low-speed step selection electromagnetic valve  109   d , instead of the second auxiliary apparatus power supply command output RY 2 , the main apparatus power supply command output RY 0  can also be utilized in such a way as represented by a dotted line. As the microprocessor CPU 0  whose control load is large, a multicore CPU can also be utilized. 
     Next,  FIG. 2 , which is a detailed circuit configuration diagram of the error processing circuit unit represented in  FIG. 1 , will be explained. In  FIG. 2 , a watchdog timer  161  provided in the error processing circuit unit  160 A measures the on-time width and the off-time width of the pulse train signal WDS 0 , which is a watchdog signal generated by the microprocessor CPU 0 ; when the pulse width of the pulse train signal WDS 0  exceeds a predetermined time, the watchdog timer  161  generates a basic reset signal RST 0 , and when the microprocessor CPU 0  normally operates, the watchdog timer  161  generates the output permission signal OUTE. The error processing circuit unit  160 A is provided with a total logical sum circuit  162  for generating the composite reset signal RST 00 , a first logical sum circuit  163   a  for generating a valve opening system control abnormality signal ER 1 , and a second logical sum circuit  163   b  for generating a transmission system control abnormality signal ER 2 . The basic reset signal RST 0  generated by the watchdog timer  161 , a valve opening control abnormality signal QAE 1  generated by the valve-opening system control abnormality determination means  308   a , described later in  FIG. 3 , a valve opening control unit memory abnormality signal MME 1  generated by the microprocessor CPU 0 , and a valve opening control unit H/W abnormality signal HDE 1  are inputted to and logically summed up in the first logical sum circuit  163   a.    
     With regard to the first logical sum circuit  163   a , the valve opening control abnormality signal QAE 1  is an abnormality detection signal that relates to a creation program for the valve-opening control output OUT 1 , which is created by the microprocessor CPU 0 , and that is created by the monitoring control circuit unit  130 A in the case where when each of two or more question information pieces to be generated by the monitoring control circuit unit  130 A and corresponding answer information obtained from the microprocessor CPU 0  are compared with each other, no predetermined correct answer information is obtained. The valve opening control unit memory abnormality signal MME 1  is an abnormality detection signal that is created by the microprocessor CPU 0  when there occurs a code check abnormality related to a valve-opening control region of the RAM that collaborates with the microprocessor CPU 0 . The valve opening control unit H/W abnormality signal HDE 1  is an abnormality detection signal that is created by the microprocessor CPU 0  when there occurs a hardware error that is caused by disconnection or a short circuit in part of the input/output circuits that are connected with the microprocessor CPU 0  and are related to valve-opening control. A first counter  164   a  counts the number of occurrence instances of the valve opening system control abnormality signal ER 1 , which is an output signal of the first logical sum circuit  163   a ; when the number of occurrence instances thereof reaches a predetermined threshold number, the first counter  164   a  sets a first storage circuit  165   a , which is a flip-flop circuit, so as to generate the first state storage signal S 1 . 
     A subtraction clock signal  167   a  periodically decreases the present counting value of the first counter  164   a  so that when the occurrence frequency of the valve opening system control abnormality signal ER 1  is low, the present counting value of the first counter  164   a  does not increase up to a predetermined threshold number and hence the first storage circuit  165   a  is not set; subtraction limitation prevents the present counting value from becoming smaller than “0”. The first storage circuit  165   a  is reset by a power-on-reset signal POR to be generated when the power switch  105  is closed. A first gate circuit  166   a  generates the first reset signal RST 1 , which is the output of a multiplication of the logical inversion signal of the first state storage signal S 1  and the valve opening system control abnormality signal ER 1 , and inputs the first reset signal RST 1  to the total logical sum circuit  162 . Thus, before the first state storage signal S 1  is generated, the valve opening system control abnormality signal ER 1  is inputted to the total logical sum circuit  162 ; however, after the first state storage signal S 1  has been generated, the valve opening system control abnormality signal ER 1  is cut off. In this regard, however, because directly inputted also to the total logical sum circuit  162 , the basic reset signal RST 0  is still effective after the first state storage signal S 1  is generated. 
     The basic reset signal RST 0  generated by the watchdog timer  161 , a transmission control abnormality signal QAE 2  generated by the transmission system control abnormality determination means  308   b , described later in  FIG. 3 , a transmission control unit memory abnormality signal MME 2  generated by the microprocessor CPU 0 , and a transmission control unit H/W abnormality signal HDE 2  are inputted to and logically summed up in the second logical sum circuit  163   b . With regard to the second logical sum circuit  163   b , the transmission control abnormality signal QAE 2  is an abnormality detection signal that relates to a creation program for the speed-change control output OUT 22 , which is created by the microprocessor CPU 0 , and that is created by the monitoring control circuit unit  130 A in the case where when each of two or more question information pieces to be generated by the monitoring control circuit unit  130 A and corresponding answer information obtained from the microprocessor CPU 0  are compared with each other, no predetermined correct answer information is obtained. The transmission control unit memory abnormality signal MME 2  is an abnormality detection signal that is created by the microprocessor CPU 0  when there occurs a code check abnormality related to a transmission control region of the RAM that collaborates with the microprocessor CPU 0 . The transmission control unit H/W abnormality signal HDE 2  is an abnormality detection signal that is created by the microprocessor CPU 0  when there occurs a hardware error that is caused by disconnection or a short circuit in part of the input/output circuits that are connected with the microprocessor CPU 0  and are related to transmission control. 
     A second counter  164   b  counts the number of occurrence instances of the transmission system control abnormality signal ER 2 , which is an output signal of the second logical sum circuit  163   b ; when the number of occurrence instances thereof reaches a predetermined threshold number, the second counter  164   b  sets a second storage circuit  165   b , which is a flip-flop circuit, so as to generate the second state storage signal S 2 . A subtraction clock signal  167   b  periodically decreases the present counting value of the second counter  164   b  so that when the occurrence frequency of the transmission system control abnormality signal ER 2  is low, the present counting value of the second counter  164   b  does not increase up to a predetermined threshold number and hence the second storage circuit  165   b  is not set; subtraction limitation prevents the present counting value from becoming smaller than “0”. The second storage circuit  165   b  is reset by the power-on-reset signal POR to be generated when the power switch  105  is closed. A second gate circuit  166   b  generates the second reset signal RST 2 , which is the output of a multiplication of the logical inversion signal of the second state storage signal S 2  and the transmission system control abnormality signal ER 2 , and inputs the second reset signal RST 2  to the total logical sum circuit  162 . 
     Thus, before the second state storage signal S 2  is generated, the transmission system control abnormality signal ER 2  is inputted to the total logical sum circuit  162 ; however, after the second state storage signal S 2  has been generated, the transmission system control abnormality signal ER 2  is cut off. In this regard, however, because directly inputted also to the total logical sum circuit  162 , the basic reset signal RST 0  is still effective after the second state storage signal S 2  is generated. The basic reset signal RST 0  generated by the watchdog timer  161 , a basic control abnormality signal QAE 0  generated by the valve-opening system control abnormality determination means  308   a  or the transmission system control abnormality determination means  308   b , described later in  FIG. 3 , a basic unit memory abnormality signal MME 0  generated by the microprocessor CPU 0 , and a basic unit H/W abnormality signal HDE 0  are inputted to and logically summed up in the total logical sum circuit  162 . With regard to the total logical sum circuit  162 , the basic control abnormality signal QAE 0  is an abnormality detection signal that relates to a creation program for the fuel injection control signal OUT 0  or the transmission control output OUT 20 , which is created by the microprocessor CPU 0 , and that is created by the monitoring control circuit unit  130 A in the case where when each of two or more question information pieces to be generated by the monitoring control circuit unit  130 A and corresponding answer information obtained from the microprocessor CPU 0  are compared with each other, no predetermined correct answer information is obtained. 
     The basic unit memory abnormality signal MME 0  is an abnormality detection signal that is created by the microprocessor CPU 0  when there occurs a code check abnormality related to a basic control region of the RAM that collaborates with the microprocessor CPU 0 ; the basic unit H/W abnormality signal HDE 0  is an abnormality detection signal that is created by the microprocessor CPU 0  when there occurs a hardware error that is caused by disconnection or a short circuit in part of the input/output circuits that are connected with the microprocessor CPU 0  and are related to the basic control. When there exists an overlapping part between the basic control region and the valve-opening control region or the transmission control region of the RAM, the overlapping part is dealt as the one that belongs to any one of or both of the basic control region and the valve-opening control region or the transmission control region. In this embodiment, the first counter  164   a  and the second counter  164   b  are provided in the output circuit units of the first logical sum circuit  163   a  and second logical sum circuit  163   b , respectively; however, it may be allowed that the first counter  164   a  and the second counter  164   b  are moved to the input circuit units of the first logical sum circuit  163   a  and second logical sum circuit  163   b , respectively, and the respective determination threshold values for the input signals are set or that the subtraction processing steps of the subtraction clock signals  167   a  and  167   b  are omitted. 
     In the foregoing explanation, the memory abnormality signal is limited to a code check abnormality in the RAM; however, it may be allowed that a code check abnormality in a related program memory or data memory is included. It may be allowed that the reset processing by the microprocessor CPU 0  is software resetting without utilizing the resetting terminal. With regard to a hardware abnormality, for example, in the case where both of a pair of accelerator position sensors for detecting the step-on degree of the accelerator pedal are abnormal, power supply to the intake valve opening degree control motor  108   a  is immediately stopped without resetting the microprocessor CPU 0  so that the driving mode moves to the evacuation driving using the fixed throttle valve opening degree. As described above, the respective separate abnormality processing steps are applied to various hardware abnormalities detected separately; it is desirable that with regard to the detection means for hardware abnormality, related to part of the input and output circuits that highly depend on software, the initialization and restarting of the microprocessor CPU 0  are once implemented before abnormality dealing processing is implemented so that it is reconfirmed whether or not there exists an abnormality; thus, the foregoing hardware abnormality signals HDEi (I=0, 1, 2) are logically summed up so as to become the composite reset signal RST 00 . 
     (2) Detailed Description of Operation and Action 
     Next, the operation of the vehicle engine control system according to Embodiment 1 of the present invention, configured as illustrated in  FIGS. 1 through 2 , will be explained in detail. At first, in  FIGS. 1 and 2 , when the power switch  105  is closed, the main apparatus control power source relay  107   b  is driven by way of the self-holding circuit  197 ; the vehicle battery  101  supplies electric power to the constant voltage power source  110  through the main apparatus power supply command output RY 0 , which is an output element of the main apparatus control power source relay  107   b ; the control voltage Vcc is applied to the main control circuit unit  120 A, the monitoring control circuit unit  130 A, and the error processing circuit unit  160 A, so that control operation is started. The microprocessor CPU 0  included in the main control circuit unit  120 A performs driving control of the fuel-injection electromagnetic valve  107   a , the intake valve opening degree control motor  108   a , and the automatic transmission  109   a , in response to the operation states of the first and second sensor groups and the contents of program memories that collaborate with the microprocessor CPU 0 . A valve opening mechanism of the intake valve includes an initial-position returning mechanism that makes it possible to perform evacuation driving using the fixed intake valve opening degree when power supply to the intake valve opening degree control motor  108   a  is stopped; when the valve-opening control power source relay  108   b  is energized, the intake valve opening degree control motor  108   a  can be supplied with electric power. 
     A transmission driving mechanism of the automatic transmission  109   a  includes a transmission ratio fixation mechanism that makes it possible to at least travel forward at a fixed transmission ratio suitable for middle- or high-speed driving when during variable-speed forward driving, power supply to the automatic transmission  109   a  is stopped or when power-supply driving of all the automatic transmission control electromagnetic valves  109   c  included in the automatic transmission  109   a  is stopped; when the transmission control power source relay  109   b  is energized, the automatic transmission  109   a  can be supplied with electric power. In the case where the low-speed step selection electromagnetic valve  109   d  included in the automatic transmission  109   a  is supplied with electric power through the main apparatus power supply command output RY 0 , as represented by a dotted line in  FIG. 1 , forward and backward driving at a low-speed step can be implemented when the gearshift lever is set to a low-speed forward or backward position, even when the transmission control power source relay  109   b  has been de-energized; when the gearshift lever is switched to the variable-speed forward driving mode, evacuation driving at a fixed transmission ratio corresponding to the third speed, for example, can be implemented. 
     The watchdog signal to be generated by the microprocessor CPU 0  is monitored by the watchdog timer  161  represented in  FIG. 2 ; when a runaway abnormality that causes an excessive calculation period occurs, the basic reset signal RST 0  is generated so as to initialize and then restart the microprocessor CPU 0 . In the case where even when the microprocessor CPU 0  restarts, the watchdog timer  161  immediately operates and hence the basic reset signal RST 0  is generated again and where this situation continues, the microprocessor CPU 0  eventually does not perform control operation and hence the electric loads are in a non-operating state. However, when a sporadic malfunction attributed to noise causes a runaway abnormality in the microprocessor CPU 0 , the microprocessor CPU 0  can be recovered to the normal state through initialization and restarting. The abnormality monitoring of the main control circuit unit  120 A is implemented in such a way that subject of abnormality monitoring is divided into basic system control, valve opening system control, and transmission system control; in each of the systems, the abnormality monitoring is implemented in such a way that the subject of abnormality monitoring is divided into a question-answer abnormality, a memory abnormality, and a hardware abnormality. 
     Specifically explaining the concept of the foregoing question-answer abnormality, for example, it is assumed that the microprocessor CPU 0  includes a control program of “adding an input X and an input Y so as to obtain the output Z”; in order to ascertain whether or not this program is correctly implemented, the input X is replaced by a constant A and the input Y is replaced by a constant B so that the addition result Z is answered, and then it is determined whether or not the addition result Z coincides with an expected result C. There exist various combinations between the constant A and the constant B; the data table number thereof is designated by a question number Qi. In response to the question number Qi transmitted from the monitoring control circuit unit  130 A, the microprocessor CPU 0  returns the result of addition of (A+B) to the monitoring control circuit unit  130 A by use of a data table, which is preliminarily stored in the program memory; the monitoring control circuit unit  130 A compares the answer information with known correct answer information C so as to determine whether or not a calculation control abnormality exists. 
     When any one of a question-answer abnormality, a memory abnormality, and a hardware abnormality occurs, there exist two cases, i.e., the case where the calculation period becomes so long that there occurs a runaway abnormality that results in occurrence of the basic reset signal RST 0  and the case where the abnormality occurrence period is so short that no runaway abnormality occurs. Even in the case where no runaway abnormality occurs, there exist two cases, i.e., the case where when due to occurrence of an abnormality, the microprocessor CPU 0  is initialized and then restarted, the abnormality occurs again (a non-runaway repeated abnormality) and the case where the abnormality is eliminated through initialization. Even in the case where a runaway abnormality occurs, there exist two cases, i.e., the case where when due to occurrence of an abnormality, the microprocessor CPU 0  is initialized and then restarted, the abnormality occurs again (a runaway repeated abnormality) and the case where the abnormality is eliminated through initialization. 
     Next, there will in detail be explained  FIG. 3 , which is an equivalent flowchart for explaining determination operation, for a question-answer abnormality, that is performed by the vehicle engine control system in  FIG. 1 . In  FIG. 3 , the process  300  is an operation start step for the monitoring control circuit unit  130 A, which is a local control unit (LCU) formed of a logic circuit having no microprocessor. The process  309   a  is a determination step in which it is monitored whether or not the first storage circuit  165   a  of the valve opening control system or the second storage circuit  165   b  of the transmission control system in  FIG. 2  has stored the fact that an abnormality occurred, in which in the case where any one of the foregoing storage circuits has stored the fact that an abnormality occurred, the determination result becomes “YES” and the process  309   a  is followed by the process  309   b , and in which in the case where none of the foregoing storage circuits has stored the fact that an abnormality occurred, the determination result becomes “NO” and the process  309   a  is followed by the process  301   b . The process  309   b  is a step in which it is decided that transmission of any new question information for the control system where the fact that an abnormality occurred has been stored is stopped and in which a command for stopping implementation of the control program that creates the valve-opening control output OUT 1  or the speed-change control output OUT 22  is transmitted. 
     The process  301   b  is a step in which the question number Qi stored in a question information data memory  301   a  provided in the monitoring control circuit unit  130 A is selected at random and transmitted to the microprocessor CPU 0 ; in this embodiment, a question, to the valve-opening control system or the transmission control system, that has been stopped in the process  309   b  is eliminated. The process  302  is a step in which the present value of a totaling means that performs addition processing and subtraction processing in after-mentioned processes  305   c  and  305   b , respectively, is transmitted to the microprocessor CPU 0 ; the process  302  is followed by the process  303   a . The process  303   a  is a step in which the answer information from the microprocessor CPU 0 , which relates to immediately previous question information transmitted in the process  301   b , is received; the process  303   a  is followed by the process  304   b . The process  304   b  is a step in which it is determined whether or not there exists a code check abnormality or an answer delay abnormality in the answer information received in the process  303   a  and in which in the case where normal data is received, correct answer information stored in a correct answer information data memory  304   a  provided in the monitoring control circuit unit  130 A is referred to, the correct answer data for the question information transmitted in the process  301   b  is read, and then it is determined whether or not the received normal answer data and the correct data coincide with each other; the process  304   b  is followed by the process  305   a.    
     The process  305   a  is a determination step; in the case where in the process  304   b , it is determined that an abnormality exists, the result of the determination in the process  305   a  becomes “YES”, and then the process  305   c  follows the process  305   a ; in the case where there exists no abnormality, the result of the determination in the process  305   a  becomes “NO”, and then the process  305   b  follows the process  305   a . The process  305   b  is a step in which “1” is subtracted from the present value of a totaling register provided in the monitoring control circuit unit  130 A; subtraction limitation prevents the present value of the totaling register from becoming smaller than “0”; the process  305   b  is followed by the process  306 . The process  305   c  is a step in which a variation value n is added to the present value of the totaling register provided in the monitoring control circuit unit  130 A; the step  305   c  is followed by the step  306 . The value of the variation value n differs depending on the contents of the abnormality determination in the process  304   b ; for example, in the case where a code error such as a parity error exists in received answer data, n is set to “1”, in the case where an answer delay exists, n is set to “2”, and in the case where the received answer data does not coincide with the correct answer information, n is set to “3”. 
     The totaling registers that perform addition and subtraction processing items in the processes  305   b  and  305   c  include a basic totaling register for determining whether or not a basic control abnormality exists, a valve-opening totaling register for determining whether or not a valve-opening control abnormality exists, and a transmission totaling register for determining whether or not a transmission-control abnormality exists; the determination as to which totaling register performs the addition or subtraction is made based on the number of transmitted question information. In the process  306 , it is determined whether or not the present value of any one of the totaling registers has exceeded a predetermined abnormality determination threshold value (e.g., 9); in the case where the present value of any one of the totaling registers has exceeded the predetermined abnormality determination threshold value, the result of the determination becomes “YES”, and then the step  306  is followed by the step  307 ; in the case where the present value of none of the totaling registers has exceeded the predetermined abnormality determination threshold value, the result of the determination becomes “NO”, and then, the step  306  is followed by the operation end process  310 . In the process  307 , based on the register in which the threshold value has been exceeded, the basic control abnormality signal QAE 0 , the valve opening control abnormality signal QAE 1 , or the transmission control abnormality signal QAE 2  in  FIG. 2  is generated; when the occurrence of any one of the abnormality signals is recognized, the present value of the corresponding totaling register is initialized to “0”, and then the next abnormality determination is started. Other control items are implemented in the operation end process  310 , and then the operation start process  300  is resumed. 
     Each of the process blocks  308   a  and  308   b  consisting of the processes  305   a  through  307  serves as the control abnormality determination means based on a question and an answer; in this control abnormality determination means, by use of the totaling register, it is determined whether or not an abnormality has occurred, in response to a plurality of abnormality instances; therefore, the valve opening control abnormality signal QAE 1  or the transmission control abnormality signal QAE 2  in  FIG. 2  may set the first storage circuit  165   a  or second storage circuit  165   b  without passing through the first counter  164   a  or the second counter  164   b , as the case may be. The microprocessor CPU 0  receives information on the present value of the totaling register, transmitted upstream in the process  302 ; when there exists some margin in the present value, the microprocessor CPU 0  intentionally transmits downstream erroneous answer information for question information transmitted upstream in the process  301   b  and monitors the operation state of the monitoring control circuit unit  130 A by determining whether or not the monitoring control circuit unit  130 A, which has received the erroneous answer information, sends, in the next upstream transmission, present value information to which the variation value of 3 has been added; when the operation of the monitoring control circuit unit  130 A is abnormal, the reverse monitoring abnormality determination signal QAER is generated; then, in the process  303   b , the monitoring control circuit unit  130 A is initialized. 
     Next,  FIG. 4 , which is a flowchart representing the operation concept of the abnormality determination by the vehicle engine control system in  FIG. 1 , will be explained. In  FIG. 4 , the process  400  is a step in which controlling operation by the microprocessor CPU 0  is started. The process  400   a  is a time slot determination step in which it is determined whether or not the present timing is an abnormality determination timing related to the basic control operation including the fuel injection control output OUT 0 ; in the case where the present timing is the abnormality determination timing, the result of the determination becomes “YES”, and then the process  400   a  is followed by the process  401 ; in the case where the present timing is not the abnormality determination timing, the result of the determination becomes “NO”, and then the process  400   a  is followed by the process  400   b . The process  400   b  is a time slot determination step in which it is determined whether or not the present timing is an abnormality determination timing related to the valve-opening control operation including the valve-opening control output OUT 1 ; in the case where the present timing is the abnormality determination timing, the result of the determination becomes “YES”, and then the process  400   b  is followed by the process  410 ; in the case where the present timing is not the abnormality determination timing, the result of the determination becomes “NO”, and then the process  400   b  is followed by the process  400   c . The process  400   c  is a time slot determination step in which it is determined whether or not the present timing is an abnormality determination timing related to the transmission control operation including the transmission-control output OUT 2 ; in the case where the present timing is the abnormality determination timing, the result of the determination becomes “YES”, and then the process  400   c  is followed by the process  420 ; in the case where the present timing is not the abnormality determination timing, the result of the determination becomes “NO”, and then the process  400   c  is followed by the process  404 . In the operation end process  404 , other control operation items are implemented; then, the operation start process  400  is resumed. 
     In the process  401 , it is determined whether or not any one of the basic operation abnormalities related to various items inputted to the total logical sum circuit  162  represented in  FIG. 2  has occurred and hence the composite reset signal RST 00  has been generated; in the case where no abnormality has occurred, the result of the determination becomes “NO”, and then the process  401  is followed by the process  402 ; in the case where an abnormality has occurred, the determination operation for “YES” is not implemented and the process  401  is automatically followed by the process  403 . In the process  402 , fuel injection control, which is basic control operation, is implemented; then, the process  402  is followed by the operation end process  404 . In the case where when the composite reset signal RST 00  initializes and restarts the microprocessor CPU 0  in the process  403  and then the processes  400 ,  400   a , and  401  are resumed, the basic operation abnormality has occurred again, the result of the determination become “YES” again, and then the process  401  is followed by the process  403 , where the fuel injection control, which is basic control operation, is stopped; thus, the processes  400  through  403  is recurrently implemented while the engine is stopped. In the case where when the composite reset signal RST 00  initializes and restarts the microprocessor CPU 0  in the process  403  and then the processes  400 ,  400   a , and  401  are resumed, the composite reset signal RST 00  has been cancelled, the result of the determination become “NO”, and then the process  401  is followed by the process  402 , where the basic control operation is implemented. 
     The process  410  is a determination step in which it is monitored whether the first storage circuit  165   a  in  FIG. 2  has already stored occurrence of the first state; in the case where the first storage circuit  165   a  has already stored occurrence of the first state, the result of the determination becomes “YES”, and then the process  410  is followed by the process  400   c ; in the case where the first storage circuit  165   a  has not stored any occurrence of the first state, the result of the determination becomes “NO”, and then the process  410  is followed by the process  411 . In the process  411 , it is determined whether or not any one of the valve-opening system operation abnormalities related to various items inputted to the first logical sum circuit  163   a  represented in  FIG. 2  has occurred and hence the composite reset signal RST 00  has been generated; in the case where no abnormality has occurred, the result of the determination becomes “NO”, and then the process  411  is followed by the process  412 ; in the case where an abnormality has occurred, the determination operation for “YES” is not implemented and the process  401  is automatically followed by the process  403 . In the case where when the composite reset signal RST 00  initializes and restarts the microprocessor CPU 0  in the process  403  and then the processes  400 ,  400   a ,  400   b ,  410 , and  411  are resumed, the composite reset signal RST 00  has been cancelled, the result of the determination becomes “NO”, and then the process  411  is followed by the process  412 . In the process  412 , the valve-opening control operation is implemented so that the valve-opening control output OUT 1  performs reversible rotation drive of the intake valve opening degree control motor  108   a , and then the intake valve opening degree is controlled so that the throttle valve opening degree corresponding to the step-on degree of the accelerator pedal is obtained. 
     In the process  413 , in the case where any one of the basic reset signal RST 0 , the valve opening control abnormality signal QAE 1 , the valve opening control unit memory abnormality signal MME 1 , and the valve opening control unit H/W abnormality signal HDE 1  is continuously generated and the number of times of the generation thereof exceeds a predetermined number of times or a predetermined frequency, the first storage circuit  165   a  stores occurrence of the first state; then, the result of the determination in the process  410  becomes “YES”. In the process  413 , the first cutoff circuit  198  in  FIG. 1  de-energized the valve-opening control power source relay  108   b . The process  420  is a determination step in which it is monitored whether the second storage circuit  165   b  in  FIG. 2  has already stored occurrence of the second state; in the case where the second storage circuit  165   b  has already stored occurrence of the second state, the result of the determination becomes “YES”, and then the process  420  is followed by the process  404 ; in the case where the second storage circuit  165   b  has not stored any occurrence of the second state, the result of the determination becomes “NO”, and then the process  420  is followed by the process  421 . 
     In the process  421 , it is determined whether or not any one of the transmission system operation abnormalities related to various items inputted to the second logical sum circuit  163   b  represented in  FIG. 2  has occurred and hence the composite reset signal RST 00  has been generated; in the case where no abnormality has occurred, the result of the determination becomes “NO”, and then the process  421  is followed by the process  422 ; in the case where an abnormality has occurred, the determination operation for “YES” is not implemented and the process  421  is automatically followed by the process  403 . In the case where when the composite reset signal RST 00  initializes and restarts the microprocessor CPU 0  in the process  403  and then the processes  400 ,  400   a ,  400   b ,  400   c ,  420 , and  421  are resumed, the composite reset signal RST 00  has been cancelled, the result of the determination become “NO”, and then the process  421  is followed by the process  422 . In the process  422 , the transmission control operation is continued so that the speed-change control output OUT 22  performs selective drive of the automatic transmission control electromagnetic valve  109   c , and then the automatic transmission control is performed so that the transmission ratio corresponding to the step-on degree of the accelerator pedal and the present vehicle speed is obtained; when the low-speed forward driving or backward driving is selected through the shift lever, the transmission control output OUT 20  controls the low-speed step selection electromagnetic valve  109   d.    
     In this regard, however, in the case where as represented by a dotted line in  FIG. 1 , the low-speed step selection electromagnetic valve  109   d  is supplied with electric power through the main apparatus power supply command output RY 0 , the low-speed step selection electromagnetic valve  109   d  is controlled by the transmission control output OUT 20  in the process  402  in  FIG. 4 . In the process  423 , in the case where any one of the basic reset signal RST 0 , the transmission control abnormality signal QAE 2 , the transmission control unit memory abnormality signal MME 2 , and the transmission control unit H/W abnormality signal HDE 2  is continuously generated and the number of times of the generation thereof exceeds a predetermined number of times or a predetermined frequency, the second storage circuit  165   b  stores the occurrence of the second state; then, the result of the determination in the process  420  becomes “YES”. In the process  423 , the second cutoff circuit  199  in  FIG. 1  de-energized the transmission control power source relay  109   b.    
     In the foregoing explanation, it has been described that when in the process  309   b  represented in  FIG. 3 , the first state or the second state occurs, the transmission of question information for the valve-opening control system or the transmission control system and the implementation of an output control program are stopped; however, although the first auxiliary apparatus power supply command output RY 1  or the second auxiliary apparatus power supply command output RY 2  is stopped as an abnormality occurs, the processes  410  and  420  are deleted in  FIG. 4 , explaining the case where the question and the implementation of the program are not stopped. As a result, when the result of the determination in the process  400   b  or  400   c  becomes “YES”, the process  411  or  421 , as the case may be, is immediately implemented. However, in the case of a non-runaway abnormality at a time when any one of the valve opening control abnormality signal QAE 1 , the valve opening control unit memory abnormality signal MME 1 , and the valve opening control unit H/W abnormality signal HDE 1  is generated in the process  411  and the basic reset signal RST 0  does not operate, neither the basic control operation nor the transmission control operation is stopped, but only the valve-opening control operation is temporarily stopped (in the case of a non-runaway sporadic abnormality) or continuously stopped (in the case of a non-runaway continuous abnormality). In addition, in the case of a non-runaway abnormality at a time when any one of the transmission control abnormality signal QAE 2 , the transmission control unit memory abnormality signal MME 2 , and the transmission control unit H/W abnormality signal HDE 2  is generated in the process  421  and the basic reset signal RST 0  does not operate, neither the basic control operation nor the valve-opening control operation is stopped, but only the transmission control operation is temporarily stopped (in the case of a non-runaway sporadic abnormality) or continuously stopped (in the case of a non-runaway continuous abnormality). 
     (3) Gist and Feature of Embodiment 1 
     As is clear from the foregoing explanation, the vehicle engine control system  100 A according to Embodiment 1 of the present invention is a multi-function vehicle engine control system whose collective case  70  contains the main control circuit unit  120 A connected with the engine control output circuit units  177   a  and  178   a  and the transmission control output circuit unit  179   a , the monitoring control circuit unit  130 A serial connected with the main control circuit unit  120 A, and the error processing circuit unit  160 A; the main control circuit unit  120 A includes the microprocessor CPU 0  that operates with an opening/closing signal or an analogue signal, as an input signal, obtained from the first sensor group  103  and the second sensor group  104 , which are utilized in engine control and transmission control, and that generates at least the fuel injection control output OUT 0  for the fuel-injection electromagnetic valve  107   a , the valve-opening control output OUT 1  for the intake valve opening degree control motor  108   a  for an intake valve provided in the air-intake throttle, and the transmission-control output OUT 2 , including at least the speed-change control output OUT 22 , for the automatic transmission  109   a ; the valve-opening drive mechanism of the intake valve using the intake valve opening degree control motor  108   a  includes an initial-position returning mechanism that makes it possible to perform evacuation driving using a fixed intake valve opening degree when power supply to the intake valve opening degree control motor  108   a  is stopped; the transmission driving mechanism of the automatic transmission  109   a  includes a transmission ratio fixation mechanism that makes it possible to at least travel forward at a fixed transmission ratio suitable for middle- or high-speed driving when during variable-speed forward driving, power supply to the automatic transmission  109   a  is stopped or when power-supply driving of all the automatic transmission control electromagnetic valves  109   c  included in the automatic transmission  109   a  is stopped. 
     The monitoring control circuit unit  130 A is provided with the valve-opening system control abnormality determination means  308   a  that sequentially transmits to the microprocessor CPU 0  in operation a plurality of question information pieces related to at least a creation program for the valve-opening control output OUT 1 , receives from the microprocessor CPU 0  the answer information pieces corresponding to the question information pieces, compares the answer information pieces with the respective corresponding correct answer information pieces, preliminarily stored in the monitoring control circuit unit  130 A, determines whether or not a code check abnormality and an answering-response delay exist in the answer information so as to determine whether or not a valve-opening control abnormality including a communication abnormality and a question-answer abnormality exists, and then creates the valve opening control abnormality signal QAEk (k=1), which is one of the valve opening system control abnormality signals ER 1 ; the error processing circuit unit  160 A is provided with the watchdog timer  161  that generates the basic reset signal RST 0  when the calculation period of the microprocessor CPU 0  is abnormal and then initializes and restarts the microprocessor CPU 0 , the first storage circuit  165   a  that is set when the first state is established in which the occurrence count or the occurrence frequency of each of the basic reset signal RST 0  and the valve opening control abnormality signal QAE 1  becomes the same as or larger than a predetermined threshold value or the total occurrence count or the total occurrence frequency of the basic reset signal RST 0  and the valve opening control abnormality signal QAE 1  becomes the same as or larger than a predetermined threshold value, and the first gate circuit  166   a ; when the first storage circuit  165   a  has stored the occurrence of an abnormality, the first cutoff circuit  198  stops power supply to the intake valve opening degree control motor  108   a ; the first gate circuit  166   a  resets the microprocessor CPU 0  through the basic reset signal RST 0  and the valve opening control abnormality signal QAE 1  when the first state has not been established, and after the first storage circuit  165   a  has stored the occurrence of an abnormality, the first gate circuit  166   a  prohibits the valve opening control abnormality signal QAE 1  from performing reset processing of the microprocessor CPU 0  so that a continuous non-runaway repeated abnormality related to the valve-opening control is suppressed from providing an effect to the fuel injection control; the error processing circuit unit  160 A further detects and stores the occurrence state of at least the transmission system control abnormality signal ER 2 , and the second cutoff circuit  199 , which responds to the transmission system control abnormality signal ER 2 , stops power supply to at least the automatic transmission control electromagnetic valve  109   c  in the automatic transmission  109   a  by having detected a transmission-control abnormality. 
     The transmission-control output OUT 2  to be generated by the main control circuit unit  120 A includes the speed-change control output OUT 22  for the automatic transmission control electromagnetic valve  109   c  and the transmission control output OUT 20  for the low-speed step selection electromagnetic valve  109   d ; the monitoring control circuit unit  130 A is provided also with the transmission system control abnormality determination means  308   b  that sequentially transmits to the microprocessor CPU 0  in operation a plurality of question information pieces related to at least a creation program for the speed-change control output OUT 22 , receives from the microprocessor CPU 0  the answer information pieces corresponding to the question information pieces, compares the answer information pieces with the respective corresponding correct answer information pieces, preliminarily stored in the monitoring control circuit unit  130 A, determines whether or not a code check abnormality and an answering-response delay exist in the answer information so as to determine whether or not a transmission control abnormality including a communication abnormality and a question-answer abnormality exists, and then creates the transmission control abnormality signal QAEk (k=2), which is one of the transmission system control abnormality signals ER 2 ; the error processing circuit unit  160 A is provided with the second gate circuit  166   b  and the second storage circuit  165   b  that is set when the second state is established in which the occurrence count or the occurrence frequency of each of the basic reset signal RST 0  and the transmission control abnormality signal QAE 2  becomes the same as or larger than a predetermined threshold value or the total occurrence count or the total occurrence frequency of the basic reset signal RST 0  and the transmission control abnormality signal QAE 2  becomes the same as or larger than a predetermined threshold value. 
     Then, when the second storage circuit  165   b  has stored the occurrence of an abnormality, the second cutoff circuit  199  stops power supply to at least the automatic transmission control electromagnetic valve  109   c ; the second gate circuit  166   b  resets the microprocessor CPU 0  through the basic reset signal RST 0  and the transmission control abnormality signal QAE 2  when the second state has not been established, and after the second storage circuit  165   b  has stored the occurrence of an abnormality, the second gate circuit  166   b  prohibits the transmission control abnormality signal QAE 2  from performing reset processing of the microprocessor CPU 0  so that a continuous non-runaway repeated abnormality related to the transmission control is suppressed from providing an effect to the fuel injection control; when after the second storage circuit  165   b  has stored the occurrence of an abnormality, the variable-speed forward driving mode is once manually cancelled and then the driving mode is switched to the backward driving mode or the low-speed forward driving mode, the transmission control output OUT 20  becomes effective so as to perform energization drive of the low-speed step selection electromagnetic valve  109   d.    
     As described above, with regard to claim 4 of the present invention, when the second state is established in which the occurrence count or the occurrence frequency of each of the basic reset signal generated by the watchdog timer and the transmission control abnormality signal generated by the control abnormality determination means becomes the same as or larger than a predetermined threshold value, the second storage circuit stores the occurrence of an abnormality and stops power supply to the automatic transmission control electromagnetic valve so as to set the transmission ratio to a fixed transmission ratio for middle- or high-speed driving; until the second storage circuit stores the occurrence of an abnormality, the basic reset signal and the transmission control abnormality signal implement reset processing of the microprocessor; after the second storage circuit has stored the occurrence of an abnormality, the basic reset signal continues the reset processing of the microprocessor; however, the transmission control abnormality signal is prohibited from implementing reset processing of the microprocessor. Accordingly, with regard to the transmission control abnormality signal, when after driving is started, an abnormality with less occurrence count or less occurrence frequency than a predetermined occurrence count or a predetermined occurrence frequency occurs, the microprocessor is initialized and restarted and recovery processing for the sporadic abnormality is performed, so that fuel injection control, the valve-opening control, and the transmission control can normally be performed; in the case where the occurrence of an abnormality continues, this recovery processing is stopped; thus, in the case of a non-runaway repeated abnormality that is a continuous abnormality but does not lead to a runaway abnormality of the microprocessor, the microprocessor is not reset by the basic reset signal; as a result, although the transmission control by the microprocessor cannot be implemented, the fuel injection control and the valve-opening control can be implemented and hence evacuation driving at a fixed transmission ratio becomes effective; when a runaway abnormality occurs in the microprocessor occurs, the microprocessor is initialized and restarted by the basic rest signal; thus, there is demonstrated a characteristic that when the runaway abnormality is contingent and sporadic, at least the fuel injection control recovers to the normal state and hence the evacuation driving can be continued. When power supply to the automatic transmission is not stopped and the backward driving mode or the low-speed forward driving mode is selected, backward driving or low-speed forward driving can be performed by use of part of automatic transmission control electromagnetic valves or a dedicated low-speed step selection electromagnetic valve; thus, there is demonstrated a characteristic that it is readily made possible to escape from a run-off state or to perform evacuation driving for uphill-road driving. This characteristic is demonstrated also by a vehicle engine control system  100 Ad according to Embodiment 3. 
     The monitoring control circuit unit  130 A stops transmission of question information on valve-opening control for creating the valve opening control abnormality signal QAE 1 , after the first storage circuit  165   a  has stored the first state, or stops transmission of question information on transmission control for creating the transmission control abnormality signal QAE 2  after the second storage circuit  165   b  has stored the second state; alternatively, the main control circuit unit  120 A stops implementation of a control program for creating the valve-opening control output OUT 1  for the intake valve opening degree control motor  108   a , after the first storage circuit  165   a  has stored the first state, or stops implementation of a control program for creating the speed-change control output OUT 22  for the automatic transmission control electromagnetic valve  109   c , after the second storage circuit  165   b  has stored the second state. As described above, with regard to claim 5 of the present invention, after the first storage circuit has stored the occurrence of a valve-opening control abnormality, transmission of question information on the valve-opening control is stopped, or, preferably, implementation of the creation program for the valve-opening control output is stopped; after the second storage circuit has stored the occurrence of a transmission control abnormality, transmission of question information on the transmission control is stopped, or, preferably, implementation of the creation program for the speed-change control output is stopped. Therefore, there is demonstrated a characteristic that the microprocessor&#39;s load of implementing unnecessary control programs and answer creation programs is reduces and that the watchdog timer is prevented from operating through the implementation of the program that has caused an abnormality to occur. This characteristic is demonstrated also by a vehicle engine control system  100 Ad according to Embodiment 3. 
     Embodiment 2 
     (1) Detailed Description of Configuration 
     Hereinafter, with reference to  FIG. 5 , which is a block diagram representing the overall configuration of a vehicle engine control system  100 B according to Embodiment 2 of the present invention, and  FIG. 6 , which is a detailed configuration diagram of an error processing circuit unit of the vehicle engine control system in  FIG. 5 , the configurations of the vehicle engine control system  100 B and the error processing circuit unit will be explained in detail; the explanation will focus on the respective differences between the configurations of the vehicle engine control systems in  FIGS. 1 and 5  and between the configurations of the error processing circuit units in  FIGS. 2 and 6 . In each of the drawings, the same reference characters denote the same or similar portions. In  FIG. 5 , the vehicle engine control system  100 B is configured mainly with a first main control circuit unit  120 B, a first monitoring control circuit unit  130 B, and a first error processing circuit unit  160 B that are mounted on an unillustrated circuit board and are contained in a first case  70   a ; the vehicle engine control system  100 B contains only an engine control circuit function, and collaborates with an after-mentioned transmission control apparatus  100   c  including a transmission control function so that a function-separated vehicle engine control system is configured. The power-source terminal of the vehicle engine control system  100 B is connected with the vehicle battery  101  through a main apparatus power supply command output RY 10 , which is an output element of the main apparatus control power source relay  107   b  that is energized by way of the after-mentioned self-holding circuit  197  when a power switch  105  is closed. The first sensor group  103  includes various kinds of sensors to be utilized in controlling an engine such as a crank angle sensor for detecting the rotation angle of the engine and a rotation sensor for detecting the rotation speed thereof, an air flow sensor for measuring the intake amount of air that passes through a throttle intake valve, an accelerator position sensor for detecting the step-on degree of the accelerator pedal, a throttle position sensor for detecting the intake valve opening degree, and a gas sensor for detecting the oxygen concentration in an exhaust-gas sensor. 
     In this regard, however, the accelerator position sensor and the engine rotation sensor among the various kinds of sensors are utilized also in transmission control by the after-mentioned transmission control apparatus  100   c . A second sensor group  104   a  is part of the second sensor group  104  that is utilized also in transmission control by the after-mentioned transmission control apparatus  100   c  and includes a vehicle speed sensor and a gearshift sensor that are utilized also in engine control. The fuel-injection electromagnetic valve  107   a , which is one of basic electric loads to be supplied with electric power by the vehicle battery  101  through the main apparatus power supply command output RY 10 , is provided in each of the cylinders of a multi-cylinder engine; in the case where this engine is a gasoline engine, an unillustrated ignition coil, as another one of the basic electric loads, is added thereto. The intake valve opening degree control motor  108   a , which is a major first auxiliary apparatus, is supplied with electric power by the vehicle battery  101  through a first auxiliary apparatus power supply command output RY 11 , which is an output element of the valve-opening control power source relay  108   b ; there is provided a fail-safe mechanism for compulsory and mechanical resetting so that when power supply to the intake valve opening degree control motor  108   a  is stopped, the opening degree is set to a fixed intake valve opening degree at which a rotation speed higher than the idling rotation speed can be obtained. 
     With regard to the internal configuration of the vehicle engine control system  100 B, the constant voltage power source  110  generates a control voltage Vcc, which is a stabilized voltage of, for example, DC 5V, and other stabilized voltages and supplies electric power to a first microprocessor CPU 10  and an input/output interface circuit units. The first main control circuit unit  120 B, which is an integrated circuit device and includes mainly the first microprocessor CPU 10 , is configured with a nonvolatile program memory, which is, for example, a flash memory, a data memory, which is part of the region of the program memory or another nonvolatile memory with which reading and writing can electrically be performed, a built-in memory including a volatile RAM, a multi-channel A/D converter, and a communication interface circuit SIF. The first main control circuit unit  120 B is connected with the first sensor group  103  by way of the first input interface circuit  173  and with the second sensor group  104   a  by way of a second input interface circuit  174   a ; the first main control circuit unit  120 B is also connected with the fuel-injection electromagnetic valve  107   a  and the intake valve opening degree control motor  108   a  by way of the engine control output circuit units  177   a  and  178   a , respectively. 
     A fuel injection control output OUT 10  generated by the first microprocessor CPU 10  performs energization drive of the fuel-injection electromagnetic valve  107   a  provided in each of the cylinders, at a predetermined timing and for a predetermined period; however, in practice, instantaneous rapid power supply control through an unillustrated stepped-up voltage or opened-valve holding control is implemented. A valve-opening control output OUT 11  performs reversible rotation drive of the intake valve opening degree control motor  108   a  so as to obtain the valve opening degree of the air-intake throttle corresponding to a step-on degree of the accelerator pedal. The first error processing circuit unit  160 B, described later in  FIG. 6 , monitors the pulse width of a pulse train signal WDS 10 , which is a watchdog signal to be generated by the first microprocessor CPU 10 ; when the pulse width of the pulse train signal WDS 10  is normal, the first error processing circuit unit  160 B generates the output permission signal OUTE. In addition, the first error processing circuit unit  160 B monitors the hardware abnormality signal HDEi, the memory abnormality signal MMEj, and the question-answer abnormality signal QAEk to be generated by the first monitoring control circuit unit  130 B; in the case where an abnormality occurs, a composite reset signal RST 10  initializes and then restarts the first microprocessor CPU 10 . 
     The first monitoring control circuit unit  130 B is serial connected with the first microprocessor CPU 10  by way of the serial-parallel converter SIF, and the first monitoring control circuit unit  130 B and the first microprocessor CPU 10  mutually perform signal communication by use of the downstream signal DN and the upstream signal UP that are synchronized with the clock signal CLK; in this example, part of signals obtained from the second sensor group  104   a  are transmitted to the first microprocessor CPU 10  through the upstream signal UP. The first monitoring control circuit unit  130 B is provided with the valve-opening system control abnormality determination means  308   a  for creating the question-answer abnormality signal QAEk, and generates the main apparatus power supply control output RY 00  and the first auxiliary apparatus power supply control output RY 01  in response to commands issued by the first microprocessor CPU 10  through the downstream signal DN. The first error processing circuit unit  160 B also generates a first state storage signal S 10  for storing the fact that an abnormality has occurred in the valve opening control system; this storage state is erased by the reset circuit  175  that generates the power-on-reset signal POR when the power switch  105  is closed. The first microprocessor CPU 10  and a second microprocessor CPU 20 , described later in  FIG. 7 , mutually perform serial communication through an external communication circuit  190 ; part of signals from the first sensor group  103  for controlling the engine are transmitted from the first microprocessor CPU 10  to the second microprocessor CPU 20 ; part of signals from the second sensor group  104  for controlling the transmission are transmitted from the second microprocessor CPU 20  to the first microprocessor CPU 10 . 
     Accordingly, part of the input terminals of the second sensor group  104   a  in  FIG. 5  are saved; for example, among signals from the gearshift sensor, the detection signal for the neutral position or the parking position is made double so that confirmation operation can be implemented; the engine rotation speed calculated by the first microprocessor CPU 10  and A/D-converted numerical data for detecting the step-on degree of the accelerator pedal are transmitted to the second microprocessor CPU 20 ; numerical data on a vehicle speed calculated by the second microprocessor CPU 20 , as a duplication-system signal, is transmitted to the first microprocessor CPU 10 . The power cutoff circuit  196  inputs, as a self-holding signal, the output of a logical multiplication of the main apparatus power supply control output RY 00  generated by the first monitoring control circuit unit  130 B and the output permission signal OUTE generated by the first error processing circuit unit  160 B to the self-holding circuit  197 ; a circuit-closure signal from the power switch  105  is inputted, as a driving signal for a logical sum, to the self-holding circuit  197 ; the output of the self-holding circuit  197  energizes the main apparatus control power source relay  107   b . Accordingly, when the power switch  105  is closed, the main apparatus control power source relay  107   b  is energized, so that the main apparatus power supply command output RY 10  is generated, and hence the first microprocessor CPU 10  starts its operation and then the main apparatus power supply control output RY 00  is generated; after that, even when the power switch  105  is closed, the energization of the main apparatus control power source relay  107   b  is continued; however, when the first microprocessor CPU 10  stops the main apparatus power supply control output RY 00  or when the first error processing circuit unit  160 B stops the output permission signal OUTE, the main apparatus control power source relay  107   b  is de-energized. 
     The first cutoff circuit  198  energizes the valve-opening control power source relay  108   b  by use of the output of a logical multiplication of the first auxiliary apparatus power supply control output RY 01  generated by the first monitoring control circuit unit  130 B, the output permission signal OUTE generated by the first error processing circuit unit  160 B, and the logical inversion signal of the first state storage signal S 10 ; the valve-opening control power source relay  108   b  is energized and controlled by the first auxiliary apparatus power supply control output RY 01 ; however, when the watchdog signal becomes abnormal and hence the output permission signal OUTE is stopped or when the first state storage signal S 10  is generated as an abnormality occurs in the valve opening control system, the valve-opening control power source relay  108   b  is de-energized. The first microprocessor CPU 10  generates the reverse monitoring abnormality determination signal QAER for resetting the first monitoring control circuit unit  130 B; the reverse monitoring abnormality determination signal QAER is a signal for initializing the first monitoring control circuit unit  130 B in the case where when in response to question information obtained from the first monitoring control circuit unit  130 B, the first microprocessor CPU 10  intentionally transmits an erroneous answer to the first monitoring control circuit unit  130 B, monitors the processing state of the first monitoring control circuit unit  130 B, and then determines whether or not the first monitoring control circuit unit  130 B is normally operating, it is determined that the first monitoring control circuit unit  130 B is not normally operating. 
     Next,  FIG. 6 , which is a detailed circuit configuration diagram of the first error processing circuit unit  160 B represented in  FIG. 5 , will be explained. In  FIG. 6 , the watchdog timer  161  provided in the first error processing circuit unit  160 B measures the on-time width and the off-time width of a pulse train signal WDS 10 , which is a watchdog signal generated by the first microprocessor CPU 10 ; when the pulse width of the pulse train signal WDS 10  exceeds a predetermined time, the watchdog timer  161  generates the basic reset signal RST 0 , and when the first microprocessor CPU 10  normally operates, the watchdog timer  161  generates the output permission signal OUTE. The first error processing circuit unit  160 B is provided with the total logical sum circuit  162  for generating the composite reset signal RST 10  and the first logical sum circuit  163   a  for generating a valve opening system control abnormality signal ER 11 . The basic reset signal RST 0  generated by the watchdog timer  161 , a valve opening control abnormality signal QAE 11  generated by the valve-opening system control abnormality determination means  308   a , described above in  FIG. 3 , a valve opening control unit memory abnormality signal MME 11  generated by the first microprocessor CPU 10 , and a valve opening control unit H/W abnormality signal HDE 11  are inputted to and logically summed up in the first logical sum circuit  163   a.    
     With regard to the first logical sum circuit  163   a , the valve opening control abnormality signal QAE 11  is an abnormality detection signal that relates to a creation program for the valve-opening control output OUT 11 , which is created by the first microprocessor CPU 10 , and that is created by the first monitoring control circuit unit  130 B in the case where when each of two or more question information pieces to be generated by the first monitoring control circuit unit  130 B and corresponding answer information obtained from the first microprocessor CPU 10  are compared with each other, no predetermined correct answer information is obtained. The valve opening control unit memory abnormality signal MME 11  is an abnormality detection signal that is created by the first microprocessor CPU 10  when there occurs a code check abnormality related to a valve-opening control region of the RAM that collaborates with the first microprocessor CPU 10 . The valve opening control unit H/W abnormality signal HDE 11  is an abnormality detection signal that is created by the first microprocessor CPU 10  when there occurs a hardware error that is caused by disconnection or a short circuit in part of the input/output circuits that are connected with the first microprocessor CPU 10  and are related to valve-opening control. The first counter  164   a  counts the number of occurrence instances of the valve opening system control abnormality signal ER 11 , which is an output signal of the first logical sum circuit  163   a ; when the number of occurrence instances thereof reaches a predetermined threshold number, the first counter  164   a  sets the first storage circuit  165   a , which is a flip-flop circuit, so as to generate the first state storage signal S 10 . 
     The subtraction clock signal  167   a  periodically decreases the present counting value of the first counter  164   a  so that when the occurrence frequency of the valve opening system control abnormality signal ER 11  is low, the present counting value of the first counter  164   a  does not increase up to a predetermined threshold number and hence the first storage circuit  165   a  is not set; subtraction limitation prevents the present counting value from becoming smaller than “0”. The first storage circuit  165   a  is reset by the power-on-reset signal POR to be generated when the power switch  105  is closed. A first gate circuit  166   a  generates the first reset signal RST 11 , which is the output of a multiplication of the logical inversion signal of the first state storage signal S 10  and the valve opening system control abnormality signal ER 11 , and inputs the first reset signal RST 11  to the total logical sum circuit  162 . Thus, before the first state storage signal S 10  is generated, the valve opening system control abnormality signal ER 11  is inputted to the total logical sum circuit  162 ; however, after the first state storage signal S 10  has been generated, the valve opening system control abnormality signal ER 11  is cut off. In this regard, however, because directly inputted also to the total logical sum circuit  162 , the basic reset signal RST 0  is still effective after the first state storage signal S 10  is generated. 
     The basic reset signal RST 0  generated by the watchdog timer  161 , a basic control abnormality signal QAE 10  generated by the valve-opening system control abnormality determination means  308   a , described above, a basic unit memory abnormality signal MME 10  generated by the first microprocessor CPU 10 , and a basic unit H/W abnormality signal HDE 10  are inputted to and logically summed up in the total logical sum circuit  162 . With regard to the total logical sum circuit  162 , the basic control abnormality signal QAE 10  is an abnormality detection signal that relates to a creation program for the basic control including the fuel injection control output OUT 10 , which is created by the first microprocessor CPU 10 , and that is created by the first monitoring control circuit unit  130 B in the case where when each of two or more question information pieces to be generated by the first monitoring control circuit unit  130 B and corresponding answer information obtained from the first microprocessor CPU 10  are compared with each other, no predetermined correct answer information is obtained. 
     The basic unit memory abnormality signal MME 10  is an abnormality detection signal that is created by the first microprocessor CPU 10  when there occurs a code check abnormality related to a basic control region of the RAM that collaborates with the first microprocessor CPU 10 ; the basic unit H/W abnormality signal HDE 10  is an abnormality detection signal that is created by the first microprocessor CPU 10  when there occurs a hardware error that is caused by disconnection or a short circuit in part of the input/output circuits that are connected with the first microprocessor CPU 10  and are related to basic control. When there exists an overlapping part between the basic control region and the valve-opening control region of the RAM, the overlapping part is dealt as the one that belongs to any one of or both of the basic control region and the valve-opening control region. In this embodiment, the first counter  164   a  is provided in the output circuit unit of the first logical sum circuit  163   a ; however, it may be allowed that the first counter  164   a  is moved to the input circuit unit of the first logical sum circuit  163   a  and respective different determination threshold values are set for input signals or that subtraction processing by the subtraction clock signal  167   a  is omitted. 
     In the foregoing explanation, the memory abnormality signal is limited to a code check abnormality in the RAM; however, as is the case with Embodiment 1, it may be allowed that a code check abnormality in a related program memory or data memory is included. It may be allowed that the reset processing by the first microprocessor CPU 10  is software resetting without utilizing the resetting terminal. With regard to a hardware abnormality, for example, in the case where both of a pair of accelerator position sensors for detecting the step-on degree of the accelerator pedal are abnormal, power supply to the intake valve opening degree control motor  108   a  is immediately stopped without resetting the first microprocessor CPU 10  so that the driving mode moves to the evacuation driving mode using the fixed throttle valve opening degree. As described above, the respective separate abnormality processing steps are applied to various hardware abnormalities detected separately; as is the case with Embodiment 1, it is desirable that with regard to the detection means for hardware abnormality, related to part of the input and output circuits that highly depend on software, the initialization and restarting of the first microprocessor CPU 10  are once implemented before abnormality dealing processing is implemented so that it is reconfirmed whether or not there exists an abnormality; thus, the foregoing hardware abnormality signals HDEi (I=10, 11) are logically summed up so as to become the composite reset signal RST 10 . 
     Next, with reference to  FIG. 7 , which is a block diagram representing the overall configuration of a transmission control apparatus  100   c  according to Embodiment 2 of the present invention, and  FIG. 8 , which is a detailed configuration diagram of an error processing circuit unit of the transmission control apparatus  100   c  in  FIG. 7 , the configurations of the transmission control apparatus  100   c  and the error processing circuit unit will be explained in detail; the explanation will focus on the respective differences between the configurations of the vehicle engine control system  100 B in  FIG. 1  and the transmission control apparatus  100   c  in  FIG. 7  and between the configurations of the error processing circuit units in FIGS.  2  and  8 . In each of the drawings, the same reference characters denote the same or similar portions. In  FIG. 7 , the transmission control apparatus  100   c  contained in a second case  70   b  is configured mainly with a second main control circuit unit  120 C that is mounted on an unillustrated circuit board and contained in the second case  70   b , a second monitoring control circuit unit  130 C, and a second error processing circuit unit  160 C. The transmission control apparatus  100   c  contains only a transmission control function, and collaborates with the foregoing vehicle engine control system  100 B including an engine control function, so that the transmission control apparatus  100   c  is included in a function-separated vehicle engine control system. The power-source terminal of the transmission control apparatus  100   c  is connected with a vehicle battery  101  through a main apparatus power supply command output RY 20 , which is an output element of the main apparatus control power source relay  107   b  that is energized by way of the after-mentioned self-holding circuit  197  when the power switch  105  is closed. The first sensor group  103   a  is part of the first sensor group  103  for engine control and includes an engine rotation sensor and an accelerator position sensor for detecting the step-on degree of an accelerator pedal. 
     The second sensor group  104  includes various kinds of sensors to be utilized in controlling a transmission such as a vehicle speed sensor, a gearshift sensor for detecting the selection position of a gearshift lever, an oil temperature sensor or an oil pressure sensor in a transmission. In this regard, however, a vehicle speed sensor and a gearshift sensor among the various kinds of sensors are utilized also in engine control. The basic electric loads of the automatic transmission  109   a  include the low-speed step selection electromagnetic valve  109   d , which is driven when a low-speed forward driving mode or a backward driving mode is mechanically or electrically selected through manual operation of a gearshift lever; the power supply system for the basic electric load utilizes the main apparatus power supply command output RY 20 ; the low-speed step selection electromagnetic valve  109   d  is included in the automatic transmission control electromagnetic valve  109   c  or a dedicated electromagnetic valve is utilized, as the low-speed step selection electromagnetic valve  109   d . In the case where when the backward driving mode or the low-speed forward driving is selected through the shift lever, the low-speed step selection electromagnetic valve  109   d  is driven, low-speed forward driving or backward driving can be implemented. 
     Two or more automatic transmission control electromagnetic valves  109   c , which are major second auxiliary apparatuses, are supplied with electric power by the vehicle battery  101  through a second auxiliary apparatus power supply command output RY 22 , which is an output element of the transmission control power source relay  109   b ; when the power supply is stopped, a predetermined fixed transmission ratio, which is a transmission ratio suitable for middle- or high-speed driving, is obtained. In this regard, however, it may be allowed that instead of utilizing the transmission control power source relay  109   b , the two or more automatic transmission control electromagnetic valves  109   c  are supplied with electric power by the main apparatus power supply command output RY 20  and that the output of the speed-change control output OUT 22  is controlled by the after-mentioned second cutoff circuit  199  and a gate device  200 . The automatic transmission control electromagnetic valve  109   c  in the automatic transmission  109   a  is to change the transmission ratios in a no-step manner or in a multistep manner; in the case where when a variable-speed forward driving mode is selected, power supply to all the automatic transmission control electromagnetic valves  109   c  is stopped, the foregoing fixed transmission ratio suitable for middle- or high-speed driving is obtained. 
     With regard to the internal configuration of the transmission control apparatus  100   c , the constant voltage power source  110  generates a control voltage Vcc, which is a stabilized voltage of, for example, DC 5V, and other stabilized voltages and supplies electric power to the second microprocessor CPU 20  and an input/output interface circuit unit. The second main control circuit unit  120 C, which is an integrated circuit device and includes mainly the second microprocessor CPU 20 , is configured with a nonvolatile program memory, which is, for example, a flash memory, a data memory, which is part of the region of the program memory or another nonvolatile memory with which reading and writing can electrically be performed, a built-in memory including a volatile RAM, a multi-channel A/D converter, and a communication interface circuit SIF. The second main control circuit unit  120 C is connected with the first sensor group  103  by way of a first input interface circuit  173   a  and with the second sensor group  104  by way of the second input interface circuit  174 ; the second main control circuit unit  120 C is connected also with the low-speed step selection electromagnetic valve  109   d  and the automatic transmission control electromagnetic valve  109   c  by way of the transmission control output circuit units  179   d  and  179   c , respectively. 
     The second microprocessor CPU 20  generates the transmission control output OUT 20  and the speed-change control output OUT 22  so as to control the automatic transmission  109   a ; in the case where the automatic transmission  109   a  operates in mechanical conjunction with a selection position of the shift lever to be manually operated, so that each of the driving modes including Reverse R, Neutral N, Low-speed forward D 1 , Variable-speed forward D, and Parking P is determined, the transmission control output OUT 20  performs energization drive of the low-speed step selection electromagnetic valve  109   d . In the case where the driving mode of the automatic transmission  109   a  is electrically controlled in conjunction with a selection position of the shift lever, for example, a control output for a motor that performs driving-mode-selection drive is added and the transmission control output OUT 20  performs energization drive of the low-speed step selection electromagnetic valve  109   d  in the selected reverse driving mode or low-speed forward driving mode. 
     The speed-change control output OUT 22  operates in conjunction with the step-on degree of the accelerator pedal and the vehicle speed so as to perform energization drive of a plurality of automatic transmission control electromagnetic valves  109   c  at a time when a variable-speed forward driving mode is selected. The plurality of automatic transmission control electromagnetic valves  109   c  is configured in such a way that energization drive is selectively applied to one of or a number of them so that multistep transmission ratios are obtained; alternatively, each of the plurality of automatic transmission control electromagnetic valves  109   c  is a linear solenoid valve for obtaining a no-step transmission ratios by increasing or decreasing the effective diameter of a pair of variable-speed pulleys. The second error processing circuit unit  160 C, described later in  FIG. 8 , monitors the pulse width of a pulse train signal WDS 20 , which is a watchdog signal to be generated by the second microprocessor CPU 20 ; when the pulse width of the pulse train signal WDS 20  is normal, the second error processing circuit unit  160 C generates the output permission signal OUTE. In addition, the second error processing circuit unit  160 C monitors the hardware abnormality signal HDEi, the memory abnormality signal MMEj, and the question-answer abnormality signal QAEk to be generated by the second monitoring control circuit unit  130 C; in the case where an abnormality occurs, a composite reset signal RST 20  initializes and then restarts the second microprocessor CPU 20 . 
     The second monitoring control circuit unit  130 C is serial connected with the second microprocessor CPU 20  by way of the serial-parallel converter SIF, and the second monitoring control circuit unit  130 C and the second microprocessor CPU 20  mutually perform signal communication by use of the downstream signal DN and the upstream signal UP that are synchronized with the clock signal CLK; in this example, part of signals obtained from the first sensor group  103   a  are transmitted to the second microprocessor CPU 20  through the upstream signal UP. The second monitoring control circuit unit  130 C is provided with the transmission system control abnormality determination means  308   b  for creating the question-answer abnormality signal QAEk, and generates the main apparatus power supply control output RY 00  and the second auxiliary apparatus power supply control output RY 02  in response to commands issued by the second microprocessor CPU 20  through the downstream signal DN. The second error processing circuit unit  160 C also generates a second state storage signal S 20  for storing occurrence of an abnormality in the transmission control system; this storage state is erased by the reset circuit  175  that generates the power-on-reset signal POR when the power switch  105  is closed. 
     The power cutoff circuit  196  inputs, as a self-holding signal, the output of a logical multiplication of the main apparatus power supply control output RY 00  generated by the second monitoring control circuit unit  130 C and the output permission signal OUTE generated by the second error processing circuit unit  160 C to the self-holding circuit  197 ; a circuit-closure signal from the power switch  105  is inputted, as a driving signal for a logical sum, to the self-holding circuit  197 ; the output of the self-holding circuit  197  energizes the main apparatus control power source relay  107   b . Accordingly, when the power switch  105  is closed, the main apparatus control power source relay  107   b  is energized, so that the main apparatus power supply command output RY 20  is generated, and hence the second microprocessor CPU 20  starts its operation and then the main apparatus power supply control output RY 00  is generated; after that, even when the power switch  105  is closed, the energization of the main apparatus control power source relay  107   b  is continued; however, when the second microprocessor CPU 20  stops the main apparatus power supply control output RY 00  or when the second error processing circuit unit  160 C stops the output permission signal OUTE, the main apparatus control power source relay  107   b  is de-energized. 
     The second cutoff circuit  199  energizes the transmission control power source relay  109   b  by use of the output of a logical multiplication of the second auxiliary apparatus power supply control output RY 02  generated by the second monitoring control circuit unit  130 C, the output permission signal OUTE generated by the second error processing circuit unit  160 C, and the logical inversion signal of the second state storage signal S 20 ; the transmission control power source relay  109   b  is energized and controlled by the second auxiliary apparatus power supply control output RY 02 ; however, when the watchdog signal becomes abnormal and hence the output permission signal OUTE is stopped or when the second state storage signal S 20  is generated as an abnormality occurs in the transmission control system, the transmission control power source relay  109   b  is de-energized. In this regard, however, it may be allowed that the transmission control power source relay  109   b  is removed and the speed-change control output OUT 22  generated by the second microprocessor CPU 20  is directly cut off by the output signal of the second cutoff circuit  199 . The second microprocessor CPU 20  generates the reverse monitoring abnormality determination signal QAER for resetting the second monitoring control circuit unit  130 C; the reverse monitoring abnormality determination signal QAER is a signal for initializing the second monitoring control circuit unit  130 C in the case where when in response to question information obtained from the second monitoring control circuit unit  130 C, the second microprocessor CPU 20  intentionally transmits an erroneous answer to the second monitoring control circuit unit  130 C, monitors the processing state of the second monitoring control circuit unit  130 C, and then determines whether or not the second monitoring control circuit unit  130 C is normally operating, it is determined that the second monitoring control circuit unit  130 C is not normally operating. 
     Next,  FIG. 8 , which is a detailed circuit configuration diagram of the second error processing circuit unit  160 C represented in  FIG. 7 , will be explained. In  FIG. 8 , the watchdog timer  161  provided in the second error processing circuit unit  160 C measures the on-time width and the off-time width of the pulse train signal WDS 20 , which is a watchdog signal generated by the second microprocessor CPU 20 ; when the pulse width of the pulse train signal WDS 20  exceeds a predetermined time, the watchdog timer  161  generates the basic reset signal RST 0 , and when the second microprocessor CPU 20  normally operates, the watchdog timer  161  generates the output permission signal OUTE. The second error processing circuit unit  160 C is provided with the total logical sum circuit  162  for generating the composite reset signal RST 20  and the second logical sum circuit  163   b  for generating a transmission system control abnormality signal ER 22 . The basic reset signal RST 0  generated by the watchdog timer  161 , a transmission control abnormality signal QAE 22  generated by the transmission system control abnormality determination means  308   b , described above in  FIG. 3 , a transmission control unit memory abnormality signal MME 22  generated by the second microprocessor CPU 20 , and a transmission control unit H/W abnormality signal HDE 22  are inputted to and logically summed up in the second logical sum circuit  163   b.    
     With regard to the second logical sum circuit  163   b , the valve opening control abnormality signal QAE 22  is an abnormality detection signal that relates to a creation program for the speed-change control output OUT 22 , which is created by the second microprocessor CPU 20 , and that is created by the second monitoring control circuit unit  130 C in the case where when each of two or more question information pieces to be generated by the second monitoring control circuit unit  130 C and corresponding answer information obtained from the second microprocessor CPU 20  are compared with each other, no predetermined correct answer information is obtained. The transmission control unit memory abnormality signal MME 22  is an abnormality detection signal that is created by the second microprocessor CPU 20  when there occurs a code check abnormality related to a transmission control region of the RAM that collaborates with the second microprocessor CPU 20 . The transmission control unit H/W abnormality signal HDE 22  is an abnormality detection signal that is created by the second microprocessor CPU 20  when there occurs a hardware error that is caused by disconnection or a short circuit in part of the input/output circuits that are connected with the second microprocessor CPU 20  and are related to transmission control. 
     The second counter  164   b  counts the number of occurrence instances of the transmission system control abnormality signal ER 22 , which is an output signal of the second logical sum circuit  163   b ; when the number of occurrence instances thereof reaches a predetermined threshold number, the second counter  164   b  sets the second storage circuit  165   b , which is a flip-flop circuit, so as to generate the second state storage signal S 20 . The subtraction clock signal  167   b  periodically decreases the present counting value of the second counter  164   b  so that when the occurrence frequency of the transmission system control abnormality signal ER 22  is low, the present counting value of the second counter  164   b  does not increase up to a predetermined threshold number and hence the second storage circuit  165   b  is not set; subtraction limitation prevents the present counting value from becoming smaller than “0”. The second storage circuit  165   b  is reset by the power-on-reset signal POR to be generated when the power switch  105  is closed. The second gate circuit  166   b  generates a second reset signal RST 22 , which is the output of a multiplication of the logical inversion signal of the second state storage signal S 20  and the transmission system control abnormality signal ER 22 , and inputs the second reset signal RST 22  to the total logical sum circuit  162 . 
     Thus, before the second state storage signal S 20  is generated, the transmission system control abnormality signal ER 22  is inputted to the total logical sum circuit  162 ; however, after the second state storage signal S 20  has been generated, the transmission system control abnormality signal ER 22  is cut off. In this regard, however, because directly inputted also to the total logical sum circuit  162 , the basic reset signal RST 0  is still effective after the second state storage signal S 20  is generated. The basic reset signal RST 0  generated by the watchdog timer  161 , a basic control abnormality signal QAE 20  generated by the transmission system control abnormality determination means  308   b , described above in  FIG. 3 , a basic unit memory abnormality signal MME 20  generated by the second microprocessor CPU 20 , and a basic unit H/W abnormality signal HDE 20  are inputted to and logically summed up in the total logical sum circuit  162 . With regard to the total logical sum circuit  162 , the basic control abnormality signal QAE 20  is an abnormality detection signal that relates to a creation program for the basic control including the transmission control output OUT 20 , which is created by the second microprocessor CPU 20 , and that is created by the second monitoring control circuit unit  130 C in the case where when each of two or more question information pieces to be generated by the second monitoring control circuit unit  130 C and corresponding answer information obtained from the second microprocessor CPU 20  are compared with each other, no predetermined correct answer information is obtained. 
     The basic unit memory abnormality signal MME 20  is an abnormality detection signal that is created by the second microprocessor CPU 20  when there occurs a code check abnormality related to a basic control region of the RAM that collaborates with the second microprocessor CPU 20 ; the basic unit H/W abnormality signal HDE 20  is an abnormality detection signal that is created by the second microprocessor CPU 20  when there occurs a hardware error that is caused by disconnection or a short circuit in part of the input/output circuits that are connected with the second microprocessor CPU 20  and are related to basic control. When there exists an overlapping part between the basic control region and the transmission control region of the RAM, the overlapping part is dealt as the one that belongs to any one of or both of the basic control region and the transmission control region. In this embodiment, the second counter  164   b  is provided in the output circuit unit of the second logical sum circuit  163   b ; however, it may be allowed that the second counter  164   b  is moved to the input circuit unit of the second logical sum circuit  163   b  and respective different determination threshold values are set for input signals or that subtraction processing by the subtraction clock signal  167   b  is omitted. 
     In the foregoing explanation, the memory abnormality signal is limited to a code check abnormality in the RAM; however, it may be allowed that a code check abnormality in a related program memory or data memory is included. It may be allowed that the reset processing by the second microprocessor CPU 20  is software resetting without utilizing the resetting terminal. With regard to a hardware abnormality, for example, in the case where both of a pair of accelerator position sensors for detecting the step-on degree of the accelerator pedal are abnormal, power supply to the automatic transmission control electromagnetic valve  109   c  is immediately stopped without resetting the second microprocessor CPU 20  so that the driving mode moves to the evacuation driving mode using the fixed throttle valve opening degree. As described above, the respective separate abnormality processing steps are applied to various hardware abnormalities detected separately; it is desirable that with regard to the detection means for hardware abnormality, related to part of the input and output circuits that highly depend on software, the initialization and restarting of the second microprocessor CPU 20  are once implemented before abnormality dealing processing is implemented so that it is reconfirmed whether or not there exists an abnormality; the foregoing hardware abnormality signals HDEi (I=20, 22) are logically summed up so as to become the composite reset signal RST 20 . 
     (2) Detailed Description of Operation and Action 
     Next, the operation of the vehicle engine control system according to Embodiment 2 of the present invention, configured as illustrated in  FIGS. 5 and 7 , will be explained in detail. At first, in  FIGS. 5 and 7 , when the power switch  105  is closed, the main apparatus control power source relay  107   b  is driven by way of the self-holding circuit  197 ; the vehicle battery  101  supplies electric power to the constant voltage power source  110  through the main apparatus power supply command outputs RY 10  or RY 20 , which is an output element of the main apparatus control power source relay  107   b ; the control voltage Vcc is applied to the first and second main control circuit units  120 B and  120 C, the first and second monitoring control circuit units  130 B and  130 C, and the first and second error processing circuit units  160 B and  160 C, so that control operation is started. The first microprocessor CPU 10  included in the first main control circuit unit  120 B performs driving control of the fuel-injection electromagnetic valve  107   a  and the intake valve opening degree control motor  108   a , in response to the operation states of the first sensor group  103  and the second sensor group  104   a  and the contents of program memories that collaborate with the first microprocessor CPU 10 . A valve opening mechanism of the intake valve includes an initial-position returning mechanism that makes it possible to perform evacuation driving using the fixed intake valve opening degree when power supply to the intake valve opening degree control motor  108   a  is stopped; when the valve-opening control power source relay  108   b  is energized, the intake valve opening degree control motor  108   a  can be supplied with electric power. 
     The second microprocessor CPU 20  included in the second main control circuit unit  120 C performs driving control of the low-speed step selection electromagnetic valve  109   d  and the automatic transmission control electromagnetic valves  109   c , which are included in the basic electric load, in response to the operation states of the first and second sensor groups  103   a  and  104  and the contents of program memories that collaborate with the second microprocessor CPU 20 . A transmission driving mechanism of the automatic transmission  109   a  including the low-speed step selection electromagnetic valve  109   d  and the two or more automatic transmission control electromagnetic valves  109   c  contains a transmission ratio fixation mechanism that makes it possible to at least travel forward at a fixed transmission ratio suitable for middle- or high-speed driving when during variable-speed forward driving, power supply to the automatic transmission  109   a  is stopped or when power-supply driving of all the automatic transmission control electromagnetic valves  109   c  included in the automatic transmission  109   a  is stopped; when the transmission control power source relay  109   b  is energized or is capable of being energized, the automatic transmission control electromagnetic valve  109   c  can be supplied with electric power and can be driven. Because the low-speed step selection electromagnetic valve  109   d  included in the automatic transmission  109   a  is supplied with electric power through the main apparatus power supply command output RY 20 , forward and backward driving at a low-speed step can be implemented when the gearshift lever is set to a low-speed forward position or the backward position, respectively, even when the transmission control power source relay  109   b  has been de-energized; when the gearshift lever is switched to the variable-speed forward driving mode, evacuation driving at a fixed transmission ratio corresponding to, for example, the third speed can be implemented. 
     The watchdog signals to be generated by the first and second microprocessors CPU 10  and CPU 20  are monitored by the watchdog timer  161  represented in  FIGS. 6 and 8 ; when a runaway abnormality that causes an excessive calculation period occurs, the basic reset signal RST 0  is generated so as to initialize and then restart the first and second microprocessors CPU 10  and CPU 20 . In the case where even when the first and second microprocessors CPU 10  and CPU 20  restart, the watchdog timer  161  immediately operates and hence the basic reset signal RST 0  is generated again and where this situation continues, the first and second microprocessors CPU 10  and CPU 20  eventually do not perform control operation and hence the electric loads are in a non-operating state. However, when a sporadic malfunction attributed to noise causes a runaway abnormality in the first microprocessor CPU 10  or the second microprocessor CPU 20 , the first microprocessor CPU 10  or the second microprocessor CPU 20  can be recovered to the normal state through initialization and restarting. The abnormality monitoring of the first main control circuit unit  120 B, is implemented in such a way that the subject of abnormality monitoring is divided into basic system control and valve opening system control; in each of the systems, the abnormality monitoring is implemented in such a way that the subject of abnormality monitoring is divided into a question-answer abnormality, a memory abnormality, and a hardware abnormality. 
     The abnormality monitoring of the second main control circuit unit  120 C is implemented in such a way that the subject of abnormality monitoring is divided into basic system control and transmission system control; in each of the systems, the abnormality monitoring is implemented in such a way that the subject of abnormality monitoring is divided into a question-answer abnormality, a memory abnormality, and a hardware abnormality. The concept of a question-answer abnormality in this embodiment is the same as that explained already in Embodiment 1; each of respective program memories that collaborate with the first and second microprocessors CPU 10  and CPU 20  stores a monitoring-subject control program corresponding to a question number and a data table for substitute inputs to be applied to the monitoring-subject control program; in response to the question number Qi transmitted from the first or second monitoring control circuit unit  130 B or  130 C, a calculation result based on the monitoring-subject control program is returned to the first or second monitoring control circuit unit  130 B or  130 C, as the case may be; the first or second monitoring control circuit unit  130 B or  130 C compares known correct answer information with answer information so as to determine whether or not there exists a calculation control abnormality. 
     Next, supplementary explanations for the question-answer abnormality determination operation methods in the vehicle engine control system and the transmission control apparatus represented in  FIGS. 5 and 7 , respectively, will simply be made with reference to  FIG. 3 , described above. In  FIG. 3 , the process  300  corresponds to the operation start step for the first or second monitoring control circuit unit  130 B or  130 C, which is a local control unit LCU 10  or LCU 20 , as the case may be, formed of a logic circuit having no microprocessor. With regard to the types of abnormality signals obtained in the process  307  in response to question information transmitted in the process  301   b , the abnormality signals for the first monitoring control circuit unit  130 B are the basic control abnormality signal QAE 10  and the valve opening control abnormality signal QAE 11 ; the abnormality signals for the second monitoring control circuit unit  130 C are the basic control abnormality signal QAE 20  and the transmission control abnormality signal QAE 22 ; the basic control abnormality signal QAE 10  and the valve opening control abnormality signal QAE 11  are represented in  FIG. 6 , and the basic control abnormality signal QAE 20  and the transmission control abnormality signal QAE 22  are represented in  FIG. 8 . 
     Next, supplementary explanations for the operation concepts of the abnormality determinations in the vehicle engine control system and the transmission control apparatus represented in  FIGS. 5 and 7 , respectively, will simply be made with reference to  FIG. 4 , described above. In  FIG. 4 , the process  400  corresponds to a start step for the control operation by the first or second microprocessor CPU 10  or CPU 20 . In the case of the first microprocessor CPU 10 , basic control operation mainly based on the fuel injection control output OUT 10  and the abnormality monitoring therefor are implemented in the processes  400   a  through  402 , and controlling operation for the first auxiliary apparatus, based mainly on the valve-opening control output OUT 11 , and the abnormality monitoring therefor are implemented in the processes  400   b  through  412 ; when based on the valve opening system control abnormality signal ER 11 , the first storage circuit  165   a  stores the first state, power supply to the intake valve opening degree control motor  108   a  is stopped and the valve opening system control abnormality signal ER 11  is prohibited from resetting the first microprocessor CPU 10 ; however, the processes  400   c  through  422  are not the subjects thereof. 
     In the case of the second microprocessor CPU 20 , basic control operation mainly based on the transmission control output OUT 20  and the abnormality monitoring therefor are implemented in the processes  400   a  through  402 , and controlling operation for the second auxiliary apparatus, based mainly on the speed-change control output OUT 22 , and the abnormality monitoring therefor are implemented in the processes  400   c  through  422 ; when based on the transmission system control abnormality signal ER 22 , the second storage circuit  165   b  stores the second state, power supply to the automatic transmission control electromagnetic valve  109   c  is stopped and the transmission system control abnormality signal ER 22  is prohibited from resetting the second microprocessor CPU 20 ; however, the processes  400   b  through  412  are not the subjects thereof. In the foregoing explanation, it has been described that when in the process  309   b  represented in  FIG. 3 , the first state or the second state occurs, the transmission of question information for the valve-opening control system or the transmission control system and the implementation of the output control program are stopped; however, although the first auxiliary apparatus power supply command output RY 1  or the second auxiliary apparatus power supply command output RY 2  is stopped as an abnormality occurs, the control operation in Embodiment 2 is the same as that in Embodiment 1 when neither the transmission of question information nor the implementation of the program is stopped. 
     In the foregoing explanation, it has been described that when in the process  309   b  represented in  FIG. 3 , the first state or the second state occurs, the transmission of question information for the valve-opening control system or the transmission control system and the implementation of the output control program are stopped; however, although the first auxiliary apparatus power supply command output RY 11  or the second auxiliary apparatus power supply command output RY 22  is stopped as an abnormality occurs, the processes  410  and  420  are deleted in  FIG. 4 , explaining the case where the question and the implementation of the program are not stopped. As a result, when the result of the determination in the process  400   b  or  400   c  becomes “YES”, the process  411  or  421 , as the case may be, is immediately implemented. However, in the case of a non-runaway abnormality at a time when any one of the valve opening control abnormality signal QAE 11 , the valve opening control unit memory abnormality signal MME 11 , and the valve opening control unit H/W abnormality signal HDE 11  occurs in the process  411  and the basic reset signal RST 0  does not operate, neither the basic control operation nor the transmission control operation is stopped, but only the valve-opening control operation is temporarily stopped (in the case of a non-runaway sporadic abnormality) or continuously stopped (in the case of a non-runaway continuous abnormality). In addition, in the case of a non-runaway abnormality at a time when any one of the transmission control abnormality signal QAE 22 , the transmission control unit memory abnormality signal MME 22 , and the transmission control unit H/W abnormality signal HDE 22  occurs in the process  421  and the basic reset signal RST 0  does not operate, neither the basic control operation nor the valve-opening control operation is stopped, but only the transmission control operation is temporarily stopped (in the case of a non-runaway sporadic abnormality) or continuously stopped (in the case of a non-runaway continuous abnormality). This characteristic is the same as that of Embodiment 1. 
     (3) Gist and Feature of Embodiment 2 
     As is clear from the foregoing explanation, the vehicle engine control system  100 B according to Embodiment 2 of the present invention is a function-separated vehicle engine control system whose first case  70   a  contains the first main control circuit unit  120 B connected with the engine control output circuit units  177   a  and  178   a , the first monitoring control circuit unit  130 B serial connected with the first main control circuit unit  120 B, and the first error processing circuit unit  160 B; the vehicle engine control system  100 B is connected with the transmission control apparatus  100   c  whose second case  70   b  contains the second main control circuit unit  120 C connected with the transmission control output circuit units  179   d  and  179   c , the second monitoring control circuit unit  130 C serial connected with the second main control circuit unit  120 C, and the second error processing circuit unit  160 C; the first main control circuit unit  120 B includes the first microprocessor CPU 10  that operates with an opening/closing signal or an analogue signal, as an input signal, obtained from the first sensor group  103 , which is utilized in engine control, and the second sensor group  104   a , which is shared with partial transmission control, and that generates at least the fuel injection control output OUT 10  for the fuel-injection electromagnetic valve  107   a  and the valve-opening control output OUT 11  for the intake valve opening degree control motor  108   a  for an intake valve provided in the air-intake throttle; the valve-opening drive mechanism of the intake valve using the intake valve opening degree control motor  108   a  includes an initial-position returning mechanism that makes it possible to perform evacuation driving using a fixed intake valve opening degree when power supply to the intake valve opening degree control motor  108   a  is stopped; the second main control circuit unit  120 C includes the second microprocessor CPU 20  that operates with an opening/closing signal or an analogue signal, as an input signal, obtained from the second sensor group  104  utilized in the transmission control and the first sensor group  103   a , which is shared with the part of the engine control, and that generates at least the speed-change control output OUT 22  for the automatic transmission control electromagnetic valve  109   c.    
     The transmission driving mechanism of the automatic transmission  109   a  containing the automatic transmission control electromagnetic valve  109   c  includes a transmission ratio fixation mechanism that makes it possible to at least travel forward at a fixed transmission ratio suitable for middle- or high-speed driving when during variable-speed forward driving, power supply to the automatic transmission  109   a  is stopped or when driving of all the automatic transmission control electromagnetic valves  109   c  is stopped; the first monitoring control circuit unit  130 B is provided with the valve-opening system control abnormality determination means  308   a  that sequentially transmits to the first microprocessor CPU 10  in operation a plurality of question information pieces related to at least a creation program for the valve-opening control output OUT 11 , receives from the first microprocessor CPU 10  the answer information pieces corresponding to the question information pieces, compares the answer information pieces with the respective corresponding correct answer information pieces, preliminarily stored in the first monitoring control circuit unit  130 B, determines whether or not a code check abnormality and an answering-response delay exist in the answer information so as to determine whether or not a valve-opening control abnormality including a communication abnormality and a question-answer abnormality exists, and then creates the valve opening control abnormality signal QAEk (k=11), which is one of the valve opening system control abnormality signals ER 11 ; the first error processing circuit unit  160 B is provided with the watchdog timer  161  that generates the basic reset signal RST 0  when the calculation period of the first microprocessor CPU 10  is abnormal and then initializes and restarts the first microprocessor CPU 10 , the first storage circuit  165   a  that is set when the first state is established in which the occurrence count or the occurrence frequency of each of the basic reset signal RST 0  and the valve opening control abnormality signal QAE 11  becomes the same as or larger than a predetermined threshold value or the total occurrence count or the total occurrence frequency of the basic reset signal RST 0  and the valve opening control abnormality signal QAE 11  becomes the same as or larger than a predetermined threshold value, and the first gate circuit  166   a.    
     In addition, when the first storage circuit  165   a  has stored occurrence of an abnormality, the first cutoff circuit  198  stops power supply to the intake valve opening degree control motor  108   a ; the first gate circuit  166   a  resets the first microprocessor CPU 10  through the basic reset signal RST 0  and the valve opening control abnormality signal QAE 11  when the first state has not been established, and after the first storage circuit  165   a  has stored occurrence of an abnormality, the first gate circuit  166   a  prohibits the valve opening control abnormality signal QAE 11  from performing reset processing of the first microprocessor CPU 10  so that a continuous non-runaway repeated abnormality related to the valve-opening control is suppressed from providing an effect to the fuel injection control; the second error processing circuit unit  160 C detects and stores the occurrence state of at least the transmission system control abnormality signal ER 22 , and the second cutoff circuit  199 , which responds to the transmission system control abnormality signal ER 22 , stops driving of or power supply to at least the automatic transmission control electromagnetic valve  109   c  in the automatic transmission  109   a  by having detected a transmission-control abnormality. 
     The second main control circuit unit  120 C generates the speed-change control output OUT 22  for the automatic transmission control electromagnetic valve  109   c  and the transmission control output OUT 20  for the low-speed step selection electromagnetic valve  109   d ; the second monitoring control circuit unit  130 C is provided with the transmission system control abnormality determination means  308   b  that sequentially transmits to the second microprocessor CPU 20  in operation a plurality of question information pieces related to at least a creation program for the speed-change control output OUT 22 , receives from the second microprocessor CPU 20  the answer information pieces corresponding to the question information pieces, compares the answer information pieces with the respective corresponding correct answer information pieces, preliminarily stored in the second monitoring control circuit unit  130 C, determines whether or not a code check abnormality and an answering-response delay exist in the answer information so as to determine whether or not a transmission control abnormality including a communication abnormality and a question-answer abnormality exists, and then creates the transmission control abnormality signal QAEk (k=22), which is one of the transmission system control abnormality signals ER 22 ; the second error processing circuit unit  160 C is provided with the second gate circuit  166   b  and the second storage circuit  165   b  that is set when the second state is established in which the occurrence count or the occurrence frequency of each of the basic reset signal RST 0  and the transmission control abnormality signal QAE 22  becomes the same as or larger than a predetermined threshold value or the total occurrence count or the total occurrence frequency of the basic reset signal RST 0  and the transmission control abnormality signal QAE 22  becomes the same as or larger than a predetermined threshold value. 
     Then, when the second storage circuit  165   b  has stored occurrence of an abnormality, the second cutoff circuit  199  stops power supply to the automatic transmission control electromagnetic valve  109   c  or stops the speed-change control output OUT 22  from being generated; the second gate circuit  166   b  resets the second microprocessor CPU 20  through the basic reset signal RST 0  and the transmission control abnormality signal QAE 22  when the second state has not been established, and after the second storage circuit  165   b  has stored occurrence of an abnormality, the second gate circuit  166   b  prohibits the transmission control abnormality signal QAE 22  from performing reset processing of the second microprocessor CPU 20  so that a continuous non-runaway repeated abnormality related to the transmission control is suppressed from providing an effect to the operation of other transmission control outputs; when after the second storage circuit  165   b  has stored the occurrence of an abnormality, the variable-speed forward driving mode is once manually cancelled and then the driving mode is switched to the backward driving mode or the low-speed forward driving mode, the transmission control output OUT 20  becomes effective so as to perform energization drive of the low-speed step selection electromagnetic valve  109   d.    
     As described above, with regard to claim 6 of the present invention, when the second state is established in which the occurrence count or the occurrence frequency of each of the basic reset signal generated by the watchdog timer and the transmission control abnormality signal generated by the control abnormality determination means becomes the same as or larger than a predetermined threshold value, the second storage circuit stores the occurrence of an abnormality and stops power supply to the automatic transmission control electromagnetic valve or stops the generation of the speed-change control output so as to set the transmission ratio to a fixed transmission ratio for middle- or high-speed driving; until the second storage circuit stores the occurrence of an abnormality, the basic reset signal and the transmission control abnormality signal implement reset processing of the second microprocessor, and after the second storage circuit has stored the occurrence of an abnormality, the basic reset signal continues the reset processing of the second microprocessor; however, the transmission control abnormality signal is prohibited from implementing reset processing of the second microprocessor. 
     Accordingly, with regard to the transmission control abnormality signal, when after driving is started, an abnormality with less occurrence count or less occurrence frequency than a predetermined occurrence count or a predetermined occurrence frequency occurs, the second microprocessor is initialized and restarted and recovery processing for the sporadic abnormality is performed, so that the transmission control can normally be performed; in the case where the occurrence of an abnormality continues, this recovery processing is stopped; thus, in the case of a non-runaway repeated abnormality that is a continuous abnormality but does not lead to a runaway abnormality of the microprocessor, the second microprocessor is not reset; as a result, although the transmission control by the second microprocessor cannot be implemented, the driving control of the low-speed step selection electromagnetic valve can be implemented and hence evacuation driving at a fixed transmission ratio becomes effective; when a runaway abnormality occurs in the microprocessor occurs, the microprocessor is always initialized and restarted by the watchdog timer; thus, there is demonstrated a characteristic that when the runaway abnormality is contingent and sporadic, at least forward/backward selection control recovers to the normal state and hence the low-speed evacuation driving can be continued. That is to say, when power supply to the automatic transmission is not stopped and the backward driving mode or the low-speed forward driving mode is selected, backward driving or low-speed forward driving can be performed by use of part of automatic transmission control electromagnetic valves or a low-speed step selection electromagnetic valve; thus, there is demonstrated a characteristic that it is readily made possible to escape from a run-off state or to perform evacuation driving for uphill-road driving. This characteristic is demonstrated also by a vehicle engine control system  100 Bd and a transmission control apparatus  100 Cd according to Embodiment 3. 
     The first monitoring control circuit unit  130 B stops transmission of question information on valve-opening control for creating the valve opening control abnormality signal QAE 11 , after the first storage circuit  165   a  has stored the first state, or the second monitoring control circuit unit  130 C stops transmission of question information on transmission control for creating the transmission control abnormality signal QAE 22 , after the second storage circuit  165   b  has stored the second state; alternatively, the first main control circuit unit  120 B stops implementation of a control program for creating the valve-opening control output OUT 11  for the intake valve opening degree control motor  108   a , after the first storage circuit  165   a  has stored the first state, or the second main control circuit unit  120 C stops implementation of a control program for creating the speed-change control output OUT 22  for the automatic transmission control electromagnetic valve  109   c , after the second storage circuit  165   b  has stored the second state. 
     As described above, with regard to claim 7 of the present invention, after the first storage circuit has stored occurrence of a valve-opening control abnormality, transmission of question information on the valve-opening control is stopped, or, preferably, implementation of the creation program for the valve-opening control output is stopped; after the second storage circuit has stored occurrence of a transmission control abnormality, transmission of question information on the transmission control is stopped, or, preferably, implementation of the creation program for the speed-change control output is stopped. Therefore, there is demonstrated a characteristic that the microprocessor&#39;s load of implementing unnecessary control programs and answer creation programs is reduced and that the watchdog timer is prevented from operating through the implementation of the program that has caused an abnormality to occur. This characteristic is demonstrated also by the vehicle engine control system  100 Bd and the transmission control apparatus  100 Cd according to Embodiment 3. 
     Embodiment 3 
     (1) Detailed Description of Configuration 
     Hereinafter, with reference to  FIG. 9 , which is a block diagram representing the overall configuration of the vehicle engine control system  100 Ad according to Embodiment 3 of the present invention, the configuration thereof will be explained while attention is focused on the difference from the vehicle engine control system represented in  FIG. 1 . In  FIG. 9 , the vehicle engine control system  100 Ad is configured mainly with the main control circuit unit  120 A, a monitoring control circuit unit  130 D, and an error processing circuit unit  160 D that are mounted on an unillustrated circuit board and are contained in the collective case  70 ; as is the case with the vehicle engine control system  100 A, the vehicle engine control system  100 Ad is a function-integrated vehicle engine control system in which an engine control circuit function and a transmission control function are included. The external connection apparatuses of the vehicle engine control system  100 Ad are the same as those of the foregoing vehicle engine control system  100 A, and the respective functions of the monitoring control circuit unit  130 D and the error processing circuit unit  160 D are the same as those of the monitoring control circuit unit  130 A and the error processing circuit unit  160 A. In this regard, however, the monitoring control circuit unit  130 D and the error processing circuit unit  160 D are integrated with each other, as an integrated circuit device  180 . The integrated circuit device  180  contains the first and second input interface circuits  173  and  174 , the power cutoff circuit  196 , the self-holding circuit  197 , the first cutoff circuit  198 , and the second cutoff circuit  199 , which are represented in  FIG. 1 ; however, the engine control output circuit units  177   a  and  178   a , the transmission control output circuit unit  179   a  ( 179   d  and  179   c ), and the power circuit unit of the constant voltage power source  110  are directly mounted on an unillustrated circuit board. 
     Next, with reference to  FIG. 10 , which is a block diagram representing the overall configuration of the vehicle engine control system  100 Bd, which is a variant embodiment of Embodiment 3 of the present invention, the configuration thereof will be explained while attention is focused on the difference from the vehicle engine control system represented in  FIG. 5 . In  FIG. 10 , the vehicle engine control system  100 Bd is configured mainly with a first main control circuit unit  120 B, a first monitoring control circuit unit  130 D 1 , and a first error processing circuit unit  160 D 1  that are mounted on an unillustrated circuit board and are contained in the first case  70   a ; the vehicle engine control system  100 B contains only an engine control function, and collaborates with the after-mentioned transmission control apparatus  100 Cd including a transmission control function so that a function-separated vehicle engine control system is configured. The external connection apparatuses of the vehicle engine control system  100 Bd are the same as those of the foregoing vehicle engine control system  100 B, and the respective functions of the first monitoring control circuit unit  130 D 1  and the first error processing circuit unit  160 D 1  are the same as those of the first monitoring control circuit unit  130 B and the first error processing circuit unit  160 B. In this regard, however, the first microprocessor CPU 10  included in the first main control circuit unit  120 B is connected with the unillustrated external communication circuit  190 ; the first microprocessor CPU 10  and the after-mentioned second microprocessor CPU 20  mutually perform serial communication. 
     The first monitoring control circuit unit  130 D 1  and the first error processing circuit unit  160 D 1  are integrated with each other, as the integrated circuit device  180 ; the second logical sum circuit  163   b  in the first error processing circuit unit  160 D 1  is not utilized; the input circuit of the second logical sum circuit  163   b  is connected to the ground circuit through an unillustrated circuit board. The integrated circuit device  180  contains the first and second input interface circuits  173  and  174 , the power cutoff circuit  196 , the self-holding circuit  197 , the first cutoff circuit  198 , and the second cutoff circuit  199 , which are represented in  FIG. 1 ; however, the engine control output circuit units  177   a  and  178   a  and the power circuit unit of the constant voltage power source  110  are directly mounted on an unillustrated circuit board. However, the second sensor group  104   a , represented in  FIG. 5 , is connected with the second input interface circuit  174   a , and neither part of the second input interface circuit  174   a  nor the second cutoff circuit  199  is utilized. 
     Next, with reference to  FIG. 11 , which is a block diagram representing the overall configuration of the vehicle engine control system  100 Cd which is a variant embodiment of Embodiment 3 of the present invention, the configuration thereof will be explained while attention is focused on the difference from the vehicle engine control system represented in  FIG. 7 . In  FIG. 11 , the transmission control apparatus  100 Cd is configured mainly with the second main control circuit unit  120 C, a second monitoring control circuit unit  130 D 2 , and a second error processing circuit unit  160 D 2  that are mounted on an unillustrated circuit board and are contained in the second case  70   b ; the transmission control apparatus  100 Cd contains only a transmission control function, and collaborates with the foregoing vehicle engine control system  100 Bd including an engine control function, so that the transmission control apparatus  100 Cd is included in a function-separated vehicle engine control system. The external connection apparatuses of the transmission control apparatus  100 Cd are the same as those of the foregoing vehicle engine control system  100 C, and the respective functions of the second monitoring control circuit unit  130 D 2  and the second error processing circuit unit  160 D 2  are the same as those of the second monitoring control circuit unit  130 C and the second error processing circuit unit  160 C. In this regard, however, the second microprocessor CPU 20  included in the second main control circuit unit  120 C is connected with the unillustrated external communication circuit  190 ; the second microprocessor CPU 20  and the foregoing first microprocessor CPU 10  mutually perform serial communication. 
     The second monitoring control circuit unit  130 D 2  and the second error processing circuit unit  160 D 2  are integrated with each other, as the integrated circuit device  180 ; the first logical sum circuit  163   a  in the second error processing circuit unit  160 D 2  is not utilized; the input circuit of the first logical sum circuit  163   a  is connected to the ground circuit through an unillustrated circuit board. The integrated circuit device  180  contains the first and second input interface circuits  173  and  174 , the power cutoff circuit  196 , the self-holding circuit  197 , the first cutoff circuit  198 , and the second cutoff circuit  199 , which are represented in  FIG. 1 ; however, the transmission control output circuit unit  179   d  and  179   c  and the power circuit unit of the constant voltage power source  110  are directly mounted on an unillustrated circuit board. However, the first sensor group  103   a , represented in  FIG. 7 , is connected with the first input interface circuit  173 , and neither part of the first input interface circuit  173  nor the first cutoff circuit  198  is utilized. 
     As is clear from the foregoing explanation, the monitoring control circuit unit and the error processing circuit, explained in  FIGS. 9 through 11 , are the shared monitoring control circuit unit  130 D and the shared error processing circuit unit  160 D, respectively, and are integrated with each other, as an integrated circuit device  180 . In each of Embodiments 1 through 3, the main apparatus control power source relay  107   b , the valve-opening control power source relay  108   b , and the transmission control power source relay  109   b  are each represented as an electromagnetic relay having a contact; however, it may also be allowed that each of these relays is replaced by a no-contact power supply relay formed of a semiconductor opening/closing device and that the output element thereof is provided inside the vehicle engine control system. the fuel injection control outputs OUT 0  and OUT 10 , the valve-opening control output OUT 1  and OUT 11 , and the transmission control output OUT 20 , and the speed-change control output OUT 22  are connected with the corresponding electric loads at the respective downstream positions thereof; however, it may also be allowed that these outputs are connected with the corresponding electric loads at the respective upstream positions thereof. 
     (2) Gist and Feature of Embodiment 3 
     As is clear from the foregoing explanation, the vehicle engine control system according to Embodiment 3 of the present invention is the multi-function vehicle engine control system  100 Ad whose collective case  70  contains the main control circuit unit  120 A connected with the engine control output circuit units  177   a  and  178   a  and the transmission control output circuit unit  179   a , the monitoring control circuit unit  130 D serial connected with the main control circuit unit  120 A, and the error processing circuit unit  160 D; alternatively, the vehicle engine control system according to Embodiment 3 of the present invention is a function-separated vehicle engine control system  100 Bd whose first case  70   a  contains the first main control circuit unit  120 B connected with the engine control output circuit units  177   a  and  178   a , the first monitoring control circuit unit  130 D 1  serial connected with the main control circuit unit  120 B, and the first error processing circuit unit  160 D 1 . The function-separated vehicle engine control system  100 B is connected with the transmission control apparatus  100 Cd whose second case  70   b  contains the second main control circuit unit  120 C connected with the transmission control output circuit units  179   d  and  179   c , the second monitoring control circuit unit  130 D 2  serial connected with the second main control circuit unit  120 C, and the second error processing circuit unit  160 D 2 ; the monitoring control circuit unit  130 D, and the first monitoring control circuit unit  130 D 1  and the second monitoring control circuit unit  130 D 2 , and, the error processing circuit unit  160 D, and the first error processing circuit unit  160 D 1  and the second error processing circuit unit  160 D 2  are all integrated in such a way that the redundancy of common part among the corresponding circuit units is avoided (does not redundant); the integrated device forms the shared integrated circuit device  180  that collaborates with the main control circuit unit  120 A, the first main control circuit unit  120 B, or the second main control circuit unit  120 C; the main control circuit unit  120 A or the first main control circuit unit  120 B includes the microprocessor CPU 0  or the first microprocessor CPU 10 , as the case may be, that operates with an opening/closing signal or an analogue signal, as an input signal, obtained from the first sensor group  103  and the second group  104  or  104   a , which are utilized in engine control and transmission control, and that generates at least the fuel injection control output OUT 0  or OUT 10 , as the case may be, for the fuel-injection electromagnetic valve  107   a  and the valve-opening control output OUT 1  or OUT 11 , as the case may be, for the intake valve opening degree control motor  108   a  for an intake valve provided in the air-intake throttle. 
     The main control circuit unit  120 A or the second main control circuit unit  120 C includes the microprocessor CPU 0  or the second microprocessor CPU 20 , as the case may be, that operates with an opening/closing signal or an analogue signal, as an input signal, obtained from the first sensor group  103  or  103   a  and the second sensor group  104 , which are utilized in engine control and transmission control, and that generates the transmission-control output OUT 2 , including at least the speed-change control output OUT 22 , for the automatic transmission  109   a ; the valve-opening drive mechanism of the intake valve using the intake valve opening degree control motor  108   a  includes an initial-position returning mechanism that makes it possible to perform evacuation driving using a fixed intake valve opening degree when power supply to the intake valve opening degree control motor  108   a  is stopped; the transmission driving mechanism of the automatic transmission  109   a  includes a transmission ratio fixation mechanism that makes it possible to at least travel forward at a fixed transmission ratio suitable for middle- or high-speed driving when during variable-speed forward driving, power supply to the automatic transmission  109   a  is stopped or when power-supply driving of all the automatic transmission control electromagnetic valves  109   c  included in the automatic transmission  109   a  is stopped; the shared monitoring control circuit unit  130 D incorporated in the integrated circuit device  180  is provided with the valve-opening system control abnormality determination means  308   a  that sequentially transmits to the microprocessor CPU 0  or the first microprocessor CPU 10  in operation a plurality of question information pieces related to at least a creation program for the valve-opening control output OUT 1  or OUT 11 , receives from the microprocessor CPU 0  or the first microprocessor CPU 10  the answer information pieces corresponding to the question information pieces, compares the answer information pieces with the respective corresponding correct answer information pieces, preliminarily stored in the shared monitoring control circuit unit  130 D, determines whether or not a code check abnormality and an answering-response delay exist in the answer information so as to determine whether or not a valve-opening control abnormality including a communication abnormality and a question-answer abnormality exists, and then creates the valve opening control abnormality signal QAEk (k=1 or 11), which is one of the valve opening system control abnormality signal ER 1  or ER 11 . 
     The shared error processing circuit unit  160 D incorporated in the integrated circuit device  180  is provided with the watchdog timer  161  that generates the basic reset signal RST 0  when the calculation period of the microprocessor CPU 0  or the first microprocessor CPU 10  is abnormal and then initializes and restarts the microprocessor CPU 0  or the first microprocessor CPU 10 , the first storage circuit  165   a  that is set when the first state is established in which the occurrence count or the occurrence frequency of each of the basic reset signal RST 0  and the valve opening control abnormality signal QAE 1  or QAE 11  becomes the same as or larger than a predetermined threshold value or the total occurrence count or the total occurrence frequency of the basic reset signal RST 0  and the valve opening control abnormality signal QAE 1  or QAE 11  becomes the same as or larger than a predetermined threshold value, and the first gate circuit  166   a ; when the first storage circuit  165   a  has stored the occurrence of an abnormality, the first cutoff circuit  198  stops power supply to the intake valve opening degree control motor  108   a ; the first gate circuit  166   a  resets the microprocessor CPU 0  or the first microprocessor CPU 10  through the basic reset signal RST 0  and the valve opening control abnormality signal QAE 1  or QAE 11  when the first state has not been established, and after the first storage circuit  165   a  has stored the occurrence of an abnormality, the first gate circuit  166   a  prohibits the valve opening control abnormality signal QAE 1  or QAE 11  from performing reset processing of the microprocessor CPU 0  or the first microprocessor CPU 10  so that a continuous non-runaway repeated abnormality related to the valve-opening control is suppressed from providing an effect to the fuel injection control; the main control circuit unit  120 A or the second main control circuit unit  120 C collaborates with the shared error processing circuit unit  160 D incorporated in the integrated circuit device  180  so as to detect and store the occurrence state of at least the transmission system control abnormality signal ER 2  or ER 22 , as the case may be, and the second cutoff circuit  199 , which responds to the transmission system control abnormality signal ER 2  or ER 22 , stops a driving output to at least the automatic transmission control electromagnetic valve  109   c  in the automatic transmission  109   a  by having detected a transmission-control abnormality. 
     The transmission-control output OUT 2  to be generated by the main control circuit unit  120 A includes the speed-change control output OUT 22  for the automatic transmission control electromagnetic valve  109   c  and the transmission control output OUT 20  for the low-speed step selection electromagnetic valve  109   d ; the monitoring control circuit unit  130 D is provided also with the transmission system control abnormality determination means  308   b  that sequentially transmits to the microprocessor CPU 0  in operation a plurality of question information pieces related to at least a creation program for the speed-change control output OUT 22 , receives from the microprocessor CPU 0  the answer information pieces corresponding to the question information pieces, compares the answer information pieces with the respective corresponding correct answer information pieces, preliminarily stored in the monitoring control circuit unit  130 D, determines whether or not a code check abnormality and an answering-response delay exist in the answer information so as to determine whether or not a transmission control abnormality including a communication abnormality and a question-answer abnormality exists, and then creates the transmission control abnormality signal QAEk (k=2), which is one of the transmission system control abnormality signals ER 2 ; the error processing circuit unit  160 D is provided with the second gate circuit  166   b  and the second storage circuit  165   b  that is set when the second state is established in which the occurrence count or the occurrence frequency of each of the basic reset signal RST 0  and the transmission control abnormality signal QAE 2  becomes the same as or larger than a predetermined threshold value or the total occurrence count or the total occurrence frequency of the basic reset signal RST 0  and the transmission control abnormality signal QAE 2  becomes the same as or larger than a predetermined threshold value. 
     Then, when the second storage circuit  165   b  has stored the occurrence of an abnormality, the second cutoff circuit  199  stops power supply to at least the automatic transmission control electromagnetic valve  109   c ; the second gate circuit  166   b  resets the microprocessor CPU 0  through the basic reset signal RST 0  and the transmission control abnormality signal QAE 2  when the second state has not been established, and after the second storage circuit  165   b  has stored the occurrence of an abnormality, the second gate circuit  166   b  prohibits the transmission control abnormality signal QAE 2  from performing reset processing of the microprocessor CPU 0  so that a continuous non-runaway repeated abnormality related to the transmission control is suppressed from providing an effect to the fuel injection control; when after the second storage circuit  165   b  has stored the occurrence of an abnormality, the variable-speed forward driving mode is once manually cancelled and then the driving mode is switched to the backward driving mode or the low-speed forward driving mode, the transmission control output OUT 20  becomes effective so as to perform energization drive of the low-speed step selection electromagnetic valve  109   d . As described above, with regard to claim 8 of the present invention, there is the similar feature as claim 4 in Embodiment 1. 
     The monitoring control circuit unit  130 D stops transmission of question information on valve-opening control for creating the valve opening control abnormality signal QAE 1 , after the first storage circuit  165   a  has stored the first state, or stops transmission of question information on transmission control for creating the transmission control abnormality signal QAE 2  after the second storage circuit  165   b  has stored the second state; alternatively, the main control circuit unit  120 A stops implementation of a control program for creating the valve-opening control output OUT 1  for the intake valve opening degree control motor  108   a , after the first storage circuit  165   a  has stored the first state, or stops implementation of a control program for creating the speed-change control output OUT 22  for the automatic transmission control electromagnetic valve  109   c , after the second storage circuit  165   b  has stored the second state. As described above, with regard to claim 9 of the present invention, there is the similar feature as claim 5 in Embodiment 1. 
     The second main control circuit unit  120 C generates the speed-change control output OUT 22  for the automatic transmission control electromagnetic valve  109   c  and the transmission control output OUT 20  for the low-speed step selection electromagnetic valve  109   d ; the second monitoring control circuit unit  130 D 2  is provided with the transmission system control abnormality determination means  308   b  that sequentially transmits to the second microprocessor CPU 20  in operation a plurality of question information pieces related to at least a creation program for the speed-change control output OUT 22 , receives from the second microprocessor CPU 20  the answer information pieces corresponding to the question information pieces, compares the answer information pieces with the respective corresponding correct answer information pieces, preliminarily stored in the second monitoring control circuit unit  130 D 2 , determines whether or not a code check abnormality and an answering-response delay exist in the answer information so as to determine whether or not a transmission control abnormality including a communication abnormality and a question-answer abnormality exists, and then creates the transmission control abnormality signal QAEk (k=22), which is one of the transmission system control abnormality signals ER 22 ; the second error processing circuit unit  160 D 2  is provided with the second gate circuit  166   b  and the second storage circuit  165   b  that is set when the second state is established in which the occurrence count or the occurrence frequency of each of the basic reset signal RST 0  and the transmission control abnormality signal QAE 22  becomes the same as or larger than a predetermined threshold value or the total occurrence count or the total occurrence frequency of the basic reset signal RST 0  and the transmission control abnormality signal QAE 22  becomes the same as or larger than a predetermined threshold value. 
     Then, when the second storage circuit  165   b  has stored occurrence of an abnormality, the second cutoff circuit  199  stops power supply to the automatic transmission control electromagnetic valve  109   c  or stops the speed-change control output OUT 22  from being generated; the second gate circuit  166   b  resets the second microprocessor CPU 20  through the basic reset signal RST 0  and the transmission control abnormality signal QAE 22  when the second state has not been established, and after the second storage circuit  165   b  has stored occurrence of an abnormality, the second gate circuit  166   b  prohibits the transmission control abnormality signal QAE 22  from performing reset processing of the second microprocessor CPU 20  so that a continuous non-runaway repeated abnormality related to the transmission control is suppressed from providing an effect to the operation of other transmission control outputs; when after the second storage circuit  165   b  has stored the occurrence of an abnormality, the variable-speed forward driving mode is once manually cancelled and then the driving mode is switched to the backward driving mode or the low-speed forward driving mode, the transmission control output OUT 20  becomes effective so as to perform energization drive of the low-speed step selection electromagnetic valve  109   d . As described above, with regard to claim 10 of the present invention, there is the similar feature as claim 6 in Embodiment 2. 
     The first monitoring control circuit unit  130 D 1  stops transmission of question information on valve-opening control for creating the valve opening control abnormality signal QAE 11 , after the first storage circuit  165   a  has stored the first state, or the second monitoring control circuit unit  130 D 2  stops transmission of question information on transmission control for creating the transmission control abnormality signal QAE 22 , after the second storage circuit  165   b  has stored the second state; alternatively, the first main control circuit unit  120 B stops implementation of a control program for creating the valve-opening control output OUT 11  for the intake valve opening degree control motor  108   a , after the first storage circuit  165   a  has stored the first state, or the second main control circuit unit  120 C stops implementation of a control program for creating the speed-change control output OUT 22  for the automatic transmission control electromagnetic valve  109   c , after the second storage circuit  165   b  has stored the second state. As described above, with regard to claim 11 of the present invention, there is the similar feature as claim 7 in Embodiment 2. 
     The integrated circuit device  180  is provided with the main apparatus power supply control output RY 00 , the first auxiliary apparatus power supply control output RY 01 , the second auxiliary apparatus power supply control output RY 02  that are connected with respective command terminals for generating the main apparatus power supply command output RY 0 , RY 10 , or RY 20 , the first auxiliary apparatus power supply command output RY 1  or RY 11 , and the second auxiliary apparatus power supply command output RY 2  or RY 22 ; the main apparatus power supply command output RY 0 , RY 10 , or RY 20  generates a power supply output as the power switch  105  is closed; accordingly, the microprocessor CPU 0 , the first microprocessor CPU 10 , or the second microprocessor CPU 20  is supplied with electric power; as the control operation thereof starts, the power supply command is maintained and self-holding power supply is implemented while the watchdog timer  161  detects the normal operation of the microprocessor; the fuel injection control output OUT 0  or OUT 10  generated by the microprocessor CPU 0  or the first microprocessor CPU 10 , as the case may be, performs driving control of the fuel-injection electromagnetic valve  107   a , or the transmission control output OUT 20  generated by the microprocessor CPU 0  or the second microprocessor CPU 20  performs driving control of low-speed step selection electromagnetic valve  109   d , which is a basic electric load, included in the automatic transmission  109   a , other than the automatic transmission control electromagnetic valve  109   c ; the first auxiliary apparatus power supply command output RY 1  or RY 11  closes the power supply circuit for the intake valve opening degree control motor  108   a  so that the valve-opening control output OUT 1  or OUT 11  generated by the microprocessor CPU 0  or the first microprocessor CPU 10 , as the case may be, performs driving control of the intake valve opening degree control motor  108   a ; the second auxiliary apparatus power supply command output RY 2  or RY 22  closes the power supply circuit for the automatic transmission  109   a  so that the transmission-control output OUT 2  generated by the microprocessor CPU 0  performs driving control of the automatic transmission  109   a  or so that the speed-change control output OUT 22  generated by the second microprocessor CPU 20  performs driving control of the automatic transmission control electromagnetic valve  109   c.    
     As described above, with regard to claim 12 of the present invention, the integrated circuit device  180  that collaborates with any one of the microprocessors is provided with the first auxiliary apparatus power supply control output for valve opening control, the second auxiliary apparatus power supply control output for transmission control, and the main apparatus power supply control output to be utilized in engine control and transmission control. Thus, in the case where the engine control and the transmission control are performed by a single main control circuit unit, power supply to the whole transmission is implemented through the second auxiliary apparatus power supply control output, and in the case where the transmission control is performed by the second main control circuit unit, power supply to the whole transmission through the main apparatus power supply control output and the stoppage of power supply, through the second auxiliary apparatus power supply control output, to the automatic transmission control electromagnetic valve are separately implemented, so that even when a transmission control abnormality occurs, control of the basic electric loads, other than the transmission control, can be performed; thus, there is demonstrated a characteristic that the functions of the integrated circuit device can be utilized without being wasted. 
     The first storage circuit  165   a  related to the valve opening control includes, as the valve opening system control abnormality signals ER 1  or ER 11 , the basic reset signal RST 0 , the valve opening control abnormality signal QAE 1  or QAE 11 , the valve opening control unit memory abnormality signal MME 1  or MME 11 , and the valve opening control unit H/W abnormality signal HDE 1  or HDE 11 , and stores the first state when each of the occurrence counts or the occurrence frequencies of the occurrence causes of these abnormalities becomes the same as or larger than a predetermined threshold value or when the total occurrence count or the total occurrence frequency thereof becomes the same as or larger than a predetermined threshold value; the valve opening control unit memory abnormality signal MME 1  or MME 11  is an abnormality detection signal that is created by the microprocessor CPU 0  or the first microprocessor CPU 10  when there occurs a code check abnormality in the RAM, among memories that collaborate with the microprocessor CPU 0  or the first microprocessor CPU 10 , that is related to at least a valve-opening control region; the valve opening control unit H/W abnormality signal HDE 1  or HDE 11  is an abnormality detection signal that is created by the microprocessor CPU 0  or the first microprocessor CPU 10  when there occurs a hardware error that is caused by disconnection or a short circuit in part of the input/output circuits that are connected with the microprocessor CPU 0  or the first microprocessor CPU 10  and are related to valve-opening control; the integrated circuit device  180  is also provided with the second storage circuit  165   b  related to a transmission-control abnormality including a communication abnormality and a question-answer abnormality; the second storage circuit  165   b  includes, as the transmission system control abnormality signals ER 2  or ER 22 , the basic reset signal RST 0 , the transmission control abnormality signal QAE 2  or QAE 22 , the transmission control unit memory abnormality signal MME 2  or MME 22 , and the transmission control unit H/W abnormality signal HDE 2  or HDE 22 , and stores the second state when each of the occurrence counts or the occurrence frequencies of the occurrence causes of these abnormalities becomes the same as or larger than a predetermined threshold value or when the total occurrence count or the total occurrence frequency thereof becomes the same as or larger than a predetermined threshold value. 
     The transmission control abnormality signal QAE 2  or QAE 22  is an abnormality detection signal that relates to a creation program for speed-change control output OUT 22 , which is created by the microprocessor CPU 0  or the second microprocessor CPU 20 , and that is created by the shared monitoring control circuit unit  130 D in the case where when each of two or more question information pieces to be generated by the shared monitoring control circuit unit  130 D and corresponding answer information obtained from the microprocessor CPU 0  or the second microprocessor CPU 20  are compared with each other, no predetermined correct answer information is obtained; the transmission control unit memory abnormality signal MME 2  or MME 22  is an abnormality detection signal that is created by the microprocessor CPU 0  or the second microprocessor CPU 20  when there occurs a code check abnormality in the RAM, among memories that collaborate with the microprocessor CPU 0  or the second microprocessor CPU 20 , that is related to at least a transmission control region; the transmission control unit H/W abnormality signal HDE 2  or HDE 22  is an abnormality detection signal that is created by the microprocessor CPU 0  or the second microprocessor CPU 20  when there occurs a hardware error that is caused by disconnection or a short circuit in part of the input/output circuits that are connected with the microprocessor CPU 0  or the second microprocessor CPU 20  and are related to transmission control; when the second storage circuit  165   a  stores the occurrence of an abnormality, the second cutoff circuit  199  stops power supply to the automatic transmission  109   a  or driving of the automatic transmission control electromagnetic valve  109   c  is stopped, and then the first and the second storage circuits  165   a  and  165   b  are initializes when the power switch  105  is closed. 
     As described above, with regard to claim 13 of the present invention, the first storage circuit that stores the occurrence of the first state stops the valve-opening control in response to the occurrence states of the basic reset signal generated by the watchdog timer, and the valve opening control abnormality signal, the valve opening control unit memory abnormality signal, or the valve opening control unit H/W abnormality signal; the second storage circuit that stores the occurrence of the second state stops the valve-opening control in response to the occurrence states of the basic reset signal generated by the watchdog timer, and the transmission control abnormality signal, the transmission control unit memory abnormality signal, or the transmission unit H/W abnormality signal; the first and second storage circuits are reset when the power switch is turned on. Thus, because respective question-answer abnormalities in the valve-opening control and the transmission control are monitored separately from each other and diverse abnormality detections can be processed in a controlled manner by a unified error processing circuit, there is demonstrated a characteristic that the integrated circuit device can be simplified. Each of Embodiments 1 and 2 demonstrates the same characteristic. 
     The microprocessor CPU 0 , the first microprocessor CPU 10 , the second microprocessor CPU 20  are initialized and restarted by the composite reset signals RST 00 , RST  10 , and RST 20 , respectively, when an abnormality occurs; the composite reset signal RST 00 , RST 10 , or RST 20  is obtained by applying logical-sum operation to the basic reset signal RST 0  generated by the watchdog timer  161 , basic control abnormality signal QAE 0 , QAE 10 , or QAE 20 , the basic unit memory abnormality signal MME 0 , MME 10 , or MME 20 , the basic unit H/W abnormality signal HDE 0 , HDE 10 , or HDE 20 , and one of or both of the first reset signal RST 1  or RST 11  and the second reset signal RST 2  or RST 22 , as the case may be; the basic control abnormality signal QAE 0 , QAE 10 , or QAE 20  is an abnormality detection signal that relates to a creation program for the basic control including the fuel injection control output OUT 0  or OUT 10  which is created by the microprocessor CPU 0  or the first microprocessor CPU 10 , or the transmission control output OUT 20  which is created by the second microprocessor CPU 20 , and that is created by the shared monitoring control circuit unit  130 D in the case where when each of two or more question information pieces to be generated by the shared monitoring control circuit unit  130 D and corresponding answer information obtained from the microprocessor CPU 0 , or the first microprocessor CPU 10  and the second microprocessor CPU 20  are compared with each other, no predetermined correct answer information is obtained; the basic unit memory abnormality signal MME 0 , MME 10 , or MME 20  is an abnormality detection signal that is created by the microprocessor CPU 0 , or the first microprocessor CPU 10  and the second microprocessor CPU 20  when there occurs a code check abnormality in the RAM, among memories that collaborate with the microprocessor CPU 0 , or the first microprocessor CPU 10  and the second microprocessor CPU 20 , as the case may be, that is related to at least a transmission control region. 
     The basic unit H/W abnormality signal HDE 0 , HDE 10 , or HDE 20  is an abnormality detection signal that is created by the microprocessor CPU 0 , the first microprocessor CPU 10 , or the second microprocessor CPU 20  when there occurs a hardware error that is caused by disconnection or a short circuit in part of the input/output circuits that are connected with the microprocessor CPU 0 , the first microprocessor CPU 10 , or the second microprocessor CPU 20 , as the case may be, and are related to the basic control; the first reset signal RST 1  or RST 11  is a logical-sum signal obtained by applying logical-sum operation to the basic reset signal RST 0 , the valve opening control abnormality signal QAE 1  or QAE 11 , the valve opening control unit memory abnormality signal MME 1  or MME 11 , and the valve opening control unit H/W abnormality signal HDE 1  or HDE 11 , as the case may be, which forms the valve opening system control abnormality signals ER 1  or ER 11  for the first storage circuit  165   a , and this logical-sum signal is cut off by the first gate circuit  166   a  as the first storage circuit  165   a  stores the occurrence of an abnormality; the second reset signal RST 2  or RST 22  is a logical-sum signal obtained by applying logical-sum operation to the basic reset signal RST 0 , the transmission control abnormality signal QAE 2  or QAE 22 , the transmission control unit memory abnormality signal MME 2  or MME 22 , and the transmission control unit H/W abnormality signal HDE 2  or HDE 22 , as the case may be, which forms the transmission system control abnormality signals ER 2  or ER 22  for the second storage circuit  165   b , and this logical-sum signal is cut off by the second gate circuit  166   a  as the second storage circuit  165   b  stores the occurrence of an abnormality; when there exists an overlapping part between the basic control region, and the valve-opening control region or the transmission control region of the program memory, the overlapping part is dealt as the one that belongs to any one of or both of the basic control region, and the valve-opening control region or the transmission control region. 
     As described above, with regard to claim 14 of the present invention, each of the microprocessors is initialized and restarted by the composite reset signal; the composite reset signal includes a question-answer abnormality signal, a memory abnormality detection signal, and a hardware abnormality signal that relate to each of the basic control, the valve-opening control, and the transmission control; among the abnormality signals, the abnormality signal that relates to the valve-opening control becomes ineffective as the first storage circuit stores the occurrence of an abnormality, and the abnormality signal that relates to the transmission control becomes ineffective as the second storage circuit stores the occurrence of an abnormality. Therefore, there is demonstrated a characteristic that diverse abnormality detection means enhance the overall abnormality-monitoring function, that it is prevented that when the occurrence of any abnormality is detected, the basic function is stopped and hence evacuation driving cannot be implemented, and that the evacuation driving can be implemented in diverse evacuation driving modes. Each of Embodiments 1 and 2 demonstrates the same characteristic. 
     Various modifications and alterations of this invention will be apparent to those skilled in the art without departing from the scope and spirit of this invention, and it should be understood that this is not limited to the illustrative embodiments set forth herein.