An ECU activates a shutdown permission signal and provides it to an AND gate when a shutdown signal is inactive. Thus, when an abnormality sensing device does not sense an abnormality, the ECU always keeps the shutdown permission signal active. The AND gate performs logical AND between a signal provided from the abnormality sensing device and the shutdown permission signal to provide the shutdown signal to inverters. When a limp-home run permission signal becomes active while the shutdown signal is active, the ECU inactivates the shutdown permission signal.