A fuel cell system comprising: a fuel cell and a secondary battery, each acting as a power supply source; a first converter and a second converter provided between the fuel cell and the secondary battery and first and second loads (13, 14); a first inverter provided between the first and second converters (15, 22) and the first load and a second inverter provided between the first and second converters (15, 22) and the second load; a first controller that controls an output of the fuel cell by controlling the first converter; and a second controller configured separately from the first controller, the second controller controlling the second converter, the first inverter and the second inverter to thereby control outputs supplied to the first inverter and the second inverter, including an output from the secondary battery, wherein: the first controller and the second controller are connected so as to be able to communication with each other regarding failure information on respective control targets, and if one of the first controller and the second controller receives the failure information sent from the other, operation of the control target of the first controller or the second controller that has received the failure information is stopped, characterised in that, if a failure is detected in any of the first converter, the second converter, the first inverter or the second inverter, the first controller and the second controller: stop the operation of the first converter, the second converter, the first inverter and the second inverter if the failure is detected in the second converter; and stop the operation of the first converter, the first inverter and the second inverter if the failure is detected in any of the first converter, the first inverter or the second inverter, and then stop the operation of the second converter after a predetermined time has passed from the stop of the operation of the first converter, the first inverter and the second inverter. a fuel cell and a secondary battery, each acting as a power supply source; a first converter and a second converter provided between the fuel cell and the secondary battery and first and second loads (13, 14); a first inverter provided between the first and second converters (15, 22) and the first load and a second inverter provided between the first and second converters (15, 22) and the second load; a first controller that controls an output of the fuel cell by controlling the first converter; and a second controller configured separately from the first controller, the second controller controlling the second converter, the first inverter and the second inverter to thereby control outputs supplied to the first inverter and the second inverter, including an output from the secondary battery, wherein: the first controller and the second controller are connected so as to be able to communication with each other regarding failure information on respective control targets, and if one of the first controller and the second controller receives the failure information sent from the other, operation of the control target of the first controller or the second controller that has received the failure information is stopped, characterised in that, if a failure is detected in any of the first converter, the second converter, the first inverter or the second inverter, the first controller and the second controller: stop the operation of the first converter, the second converter, the first inverter and the second inverter if the failure is detected in the second converter; and stop the operation of the first converter, the first inverter and the second inverter if the failure is detected in any of the first converter, the first inverter or the second inverter, and then stop the operation of the second converter after a predetermined time has passed from the stop of the operation of the first converter, the first inverter and the second inverter. the first controller and the second controller are connected so as to be able to communication with each other regarding failure information on respective control targets, and if one of the first controller and the second controller receives the failure information sent from the other, operation of the control target of the first controller or the second controller that has received the failure information is stopped, characterised in that, if a failure is detected in any of the first converter, the second converter, the first inverter or the second inverter, the first controller and the second controller: stop the operation of the first converter, the second converter, the first inverter and the second inverter if the failure is detected in the second converter; and stop the operation of the first converter, the first inverter and the second inverter if the failure is detected in any of the first converter, the first inverter or the second inverter, and then stop the operation of the second converter after a predetermined time has passed from the stop of the operation of the first converter, the first inverter and the second inverter. stop the operation of the first converter, the second converter, the first inverter and the second inverter if the failure is detected in the second converter; and stop the operation of the first converter, the first inverter and the second inverter if the failure is detected in any of the first converter, the first inverter or the second inverter, and then stop the operation of the second converter after a predetermined time has passed from the stop of the operation of the first converter, the first inverter and the second inverter.