PURPOSE: To detect wrong in the executing sequence of a program module and to restore a correct executing sequence, by confirming the executing history and executing schedule of a program.

CONSTITUTION: To confirm the executing history of an operation controlling device 11, a confirmation requesting signal 21 is sent to a confirming device 12 and a temporary stopping signal 23 is received from the confirming device 12 to stop the operation temporaily. The confirming device 12 compares the executing history of a program module stored in an executing history storing device 16 with the execution schedule of previously scheduled module. When both the data coincide with each other, the signal 23 is released and the execution is restarted. Consequently, the succeeeding output information stored in an output storage device 15 is transferred to output devices 13, 14 through a bus 22. When the data are not inconsistent as the result of comparison, the device 12 outputs a malfunction detecting signal 24.