A fuel cell system comprising: a fuel cell generating an electric power by a fuel and an oxidant gas; a reforming portion generating the fuel by a source material and water; a combusting portion burning an anode-off gas of the fuel cell to heat the reforming portion; an exhaust heat recovery system recovering an exhaust heat of the fuel cell system; a detection sensor (24d, 26b1, 26b2, 32b, 32c, 32d, 41b, 42c, 44b, 42b, 41c, 44c) detecting a state of a physical quantity of at least one of the fuel cell, the reforming portion, the combusting portion, the exhaust heat recovery system, and a fluid flowing in and out of each of the fuel cell, the reforming portion, the combusting portion, and the exhaust heat recovery system, the fluid including the fuel, the oxidant gas, the source material, the water, and the anode-off gas; and a control device controlling the fuel cell system based on an output signal from the detection sensor ( 24d, 26b1; 26b2, 32b, 32c, 32d, 41b, 42c, 44b, 42b, 41c; 44c), characterized in that the control device includes a sensor malfunction determination device ( step 106, step 108, 61) determining whether or not the output signal of the detection sensor ( 24d, 26b1, 26b2, 32b, 32c, 32d, 41b, 42c, 44b, 42b, 41c, 44c) is out of a first determination range serving as a range exceeding a normal operating range of the detection sensor ( 24d, 26b1, 26b2, 32b, 32c, 32d, 41b, 42c, 44b, 42b, 41c, 44c) for a first determination time or longer, and a state error determination device ( steps 112 to 118, 62) determining whether or not the state of the physical quantity serving as a detection target of the detection sensor ( 24d, 26b1, 26b2, 32b, 32c, 32d, 41b, 42c, 44b, 42b, 41c, 44c) is in an error state on a basis of whether or not the output signal of the detection sensor ( 24d, 26b1, 26b2, 32b, 32c, 32d, 41b, 42c, 44b, 42b, 41c, 44c) is out of a second determination range serving as a range inhibited from exceeding the normal operating range of the detection sensor ( 24d, 26b1, 26b2, 32b, 32c, 32d, 41b, 42c, 44b, 42b, 41c, 44c) for a second determination time or longer, the second determination range being narrower than the first determination range and fully included in the first determination range, the second determination time being longer than the first determination time, and the control device includes a storage device (step 120, 65) storing a determination result from each of the sensor malfunction determination device ( step 106, step 108, 61) and the state error determination device ( steps 112 to 118, 62). a fuel cell generating an electric power by a fuel and an oxidant gas; a reforming portion generating the fuel by a source material and water; a combusting portion burning an anode-off gas of the fuel cell to heat the reforming portion; an exhaust heat recovery system recovering an exhaust heat of the fuel cell system; a detection sensor (24d, 26b1, 26b2, 32b, 32c, 32d, 41b, 42c, 44b, 42b, 41c, 44c) detecting a state of a physical quantity of at least one of the fuel cell, the reforming portion, the combusting portion, the exhaust heat recovery system, and a fluid flowing in and out of each of the fuel cell, the reforming portion, the combusting portion, and the exhaust heat recovery system, the fluid including the fuel, the oxidant gas, the source material, the water, and the anode-off gas; and a control device controlling the fuel cell system based on an output signal from the detection sensor ( 24d, 26b1; 26b2, 32b, 32c, 32d, 41b, 42c, 44b, 42b, 41c; 44c), characterized in that the control device includes a sensor malfunction determination device ( step 106, step 108, 61) determining whether or not the output signal of the detection sensor ( 24d, 26b1, 26b2, 32b, 32c, 32d, 41b, 42c, 44b, 42b, 41c, 44c) is out of a first determination range serving as a range exceeding a normal operating range of the detection sensor ( 24d, 26b1, 26b2, 32b, 32c, 32d, 41b, 42c, 44b, 42b, 41c, 44c) for a first determination time or longer, and a state error determination device ( steps 112 to 118, 62) determining whether or not the state of the physical quantity serving as a detection target of the detection sensor ( 24d, 26b1, 26b2, 32b, 32c, 32d, 41b, 42c, 44b, 42b, 41c, 44c) is in an error state on a basis of whether or not the output signal of the detection sensor ( 24d, 26b1, 26b2, 32b, 32c, 32d, 41b, 42c, 44b, 42b, 41c, 44c) is out of a second determination range serving as a range inhibited from exceeding the normal operating range of the detection sensor ( 24d, 26b1, 26b2, 32b, 32c, 32d, 41b, 42c, 44b, 42b, 41c, 44c) for a second determination time or longer, the second determination range being narrower than the first determination range and fully included in the first determination range, the second determination time being longer than the first determination time, and the control device includes a storage device (step 120, 65) storing a determination result from each of the sensor malfunction determination device ( step 106, step 108, 61) and the state error determination device ( steps 112 to 118, 62).