As security functions are dually applied to the MMI and site, only the operator or an equivalent manager can carry out control and monitoring after logging in, and all control and monitoring works can be carried out using the master controller (MCU-3000) even when a problem occurs with the MMI. If this too is impossible, the same operation can be carried out using the current controller.