A fuel cell system is disclosed, which includes a fuel cell stack coupled to a load for providing power, a gas delivery system coupled to the fuel cell stack for providing fuel and oxygen to the fuel cell stack and a control system. The control system includes a forward controller for generating a desired control instruction signal based on a command from the load, and a correction controller for generating a control correction signal to avoid violating operational constraints of the fuel cell stack based on at least one measured signal from the fuel cell system. The control system generates a control signal based on the desired control instruction signal and the control correction signal, and controls the gas delivery system based on the generated control signal to ensure the fuel cell stack is operated within safe operating limits. A method for controlling the fuel cell system is also disclosed.