A system has two modes which protect it from freezing of water while a fuel cell stack has stopped. An effective protection mode from the viewpoint of energy consumption is selected based on the estimated restart time and outside air temperature shift, and used to protect the system. The protection modes are: a first protection mode which prevents freezing by heating the water supplied to the fuel cell, and a second protection mode which avoids freezing of water in the fuel cell by discharging the water in the fuel cell to outside the fuel cell, and freezing the water outside the fuel cell.