When a microcomputer is automatically reset due to uncontrollable process and recovers from reset, a cancel pulse signal is outputted from the microcomputer to a hold circuit to stop supply of a driving current to a relay. This pulse is generated, when a predetermined condition indicative of possibility of battery rundown lasts for a predetermined time. The predetermined condition includes that a hold set condition is detected based on a status signal inputted from the hold circuit; a card key is present in a key slot; a key verification inputted from an immobilizer ECU is not available; a vehicle speed is zero; and an engine revolution is zero.