PURPOSE: To prevent the discontinuation of working of a miroprogram controller by producing a microprogram using no error address to reload this program in a control storage in order to restore the fault when an uncorrectable error of the microprogram is detected and switching the controller to the double FW in the restoration state.

CONSTITUTION: A microprocessor 3 consists of a control storage group 32 which has the double or more storage capacity compared with the capacity of a microprogram and also has a double microprogram, a microprogram control means 33 which controls the selection and the validity of the microprogram, a 2-bit error detecting means 38, a microprogram execution suppressing means 36, a 2-bit error reporting means 35, a microprogram load instructing means 34, and an idle state detecting means 37. Meanwhile a service processor 1 contains a microprogram source file 11, an address definition file 12, an assembling means 13, an object storing means 14, an object transfer means 15, and an address assignment means 16 which updates the file 12.