A failure diagnostic unit (144) obtains a control value for controlling an actuator (20) from each of a first processing circuit (11) and a second processing circuit (12) that are duplicated processing circuits. In a case where a first control value that has been obtained from the first processing circuit (11) does not match a second control value that has been obtained from the second processing circuit (12), the failure diagnostic unit (144) compares a state normal range with at least either the first control value or the second control value, and determines which of the first processing circuit (11) and the second processing circuit (12) an abnormality has occurred in, the state normal range being a range of a normal value of the control value that is estimated from a current operation state of a higher-order system that includes the actuator (20).