An internal combustion engine is controlled by a plurality of partially reliability-relevant functional units. Every reliability-relevant functional unit comprises at least one functional module and at least one monitoring module. The monitoring module is separate from the functional module associated therewith and monitors the functioning of the functional module. The control device also comprises a higher order monitoring functional group. The monitoring module has an entry point for communication with the higher order monitoring functional group. When an error is detected, the monitoring module signals the error to the higher order monitoring functional group using the entry point.