To make a vehicle at least run even in the case of causing a trouble in any of each component element, in a fail-safe system applied for the vehicle performing integrated control of a plurality of on-vehicle component elements.

In this fail-safe system of this invention, when a manager ECU10 detects a trouble in any of an engine ECU1 which is an ECU required for running of a vehicle by a minimum limit, a transmission ECU2, and a running control ECU3, in accordance with a preset order of priority, of the other ECU in no trouble, an ECU having prescribed performance (processing speed and memory capacity) is selected, and a basic program of the ECU in trouble is downloaded. The ECU downloaded with the basic program takes over the ECU in trouble, drives and controls a corresponding actuator.