Apparatus (202; 302; 402) for securely executing a program which comprises a sequence of program instructions, the program instructions comprising useful instructions (110, 112, 114, 116) and checking instructions (120, 122, 124), the checking instructions being arranged between the useful instructions, with the result that an order in which the checking instructions are executed is stipulated according to a specified execution path of the program, having the following features: a device (203; 303; 403) for executing the sequence of program instructions, the executing device being configured to provide a checking value (130, 132, 134; 230; 330; 430) generated according to a creation rule during execution of a checking instruction; a device (205; 512) for separately generating a control value (250; 550) in a concurrent manner with the execution of the program, the control value being derived from a previous control value according to the creation rule; a device (206; 514) for comparing the checking value with the control value in a concurrent manner with the execution of the program; and a device (207; 514) for providing an indication (262; 562) of a disturbance in the execution of the specified execution path of the program if the checking value and the control value do not match, the device (205; 512) for separately generating the control value (250; 550), the device (206; 514) for comparing and the device (207; 514) for providing an indication (262; 562) being implemented in hardware separately from the device for executing the sequence of program instructions, the device for separately generating the control value comprising a register, an up-counter and a shift register, the device for comparing being designed to compare the checking value with a control value stored in the register in response to an active control signal which indicates the presence of a valid checking value, the shift register being designed to delay the control signal, and the up-counter being designed to increase the control value in the register in response to the control signal delayed by the shift register. a device (203; 303; 403) for executing the sequence of program instructions, the executing device being configured to provide a checking value (130, 132, 134; 230; 330; 430) generated according to a creation rule during execution of a checking instruction; a device (205; 512) for separately generating a control value (250; 550) in a concurrent manner with the execution of the program, the control value being derived from a previous control value according to the creation rule; a device (206; 514) for comparing the checking value with the control value in a concurrent manner with the execution of the program; and a device (207; 514) for providing an indication (262; 562) of a disturbance in the execution of the specified execution path of the program if the checking value and the control value do not match, the device (205; 512) for separately generating the control value (250; 550), the device (206; 514) for comparing and the device (207; 514) for providing an indication (262; 562) being implemented in hardware separately from the device for executing the sequence of program instructions, the device for separately generating the control value comprising a register, an up-counter and a shift register, the device for comparing being designed to compare the checking value with a control value stored in the register in response to an active control signal which indicates the presence of a valid checking value, the shift register being designed to delay the control signal, and the up-counter being designed to increase the control value in the register in response to the control signal delayed by the shift register.