To increase reliability, the control nodes 500 a and 500 b are constituted in dual redundancy such that one (e.g., 500 a) of the control nodes 500 a and 500 b is a currently operating system and is operated in the usual state, and that the other (e.g., the control node 500 b) is a standby system and is held standby in the usual state.