When fail signals from first and second inverters are rendered inactive, i.e., when all inverters are proper, an ECU renders first and second shut down permit signals active for output to first and second AND gates regardless of the operating state of motor generators. The first AND gate takes an AND operation of the fail signal from the second inverter and the first shut down permit signal to output a shut down signal to the first inverter. The second AND gate takes an AND operation of the fail signal from the first inverter and the second shut down permit signal to provide a shut down signal to the second inverter.