To positively cut off fuel supply to an engine when there is inconsistency between softwares executed by a plurality of cutoff valve controllers.

In the first and second cutoff valve controllers 50A, 50B, when changing executed control programs 70A, 70B, controlled fuel cutoff valves 33A, 33B are closed, and after changing the control programs 70A, 70B, it is judged whether there is consistency between the control programs 70A, 70B after changing, and control programs 70A, 70B executed by other first and second cutoff valve controllers 50A, 50B. If there is consistency, control is started conforming to the control programs 70A, 70B after changing.