A generator controller (4) is provided which is able to detect and respond to failure of a generator output voltage sensor, whilst being able to distinguish voltage sensor failure from output voltage collapse due to the presence of an overload or short circuit condition. The presence of a voltage sensor failure is indicated by the measured output voltage being below a first voltage threshold whilst the output current is also below a current threshold.