Method for the secure execution of control applications, in which - for at least one control application (113, 123), at least one event is defined which is triggered in the event of potential manipulation of program code assigned to the control application and/or of at least one peripheral device which is connected to a program flow control device (101, 102) processing the program code, - the program flow control device monitors a flow of the control application for deviations from an expected flow behaviour and triggers the defined event in the event of a deviation, - following triggering of the defined event, the program code continues to be processed by the program flow control device and the event is signalled to an inspection device separate from the program flow control device, - upon the signalling (201, 202) of the event, the inspection device analyses the flow behaviour of the control application and control components in a dependency relationship thereto using updatable inspection rules, the inspection rules being updated independently of the flow of the control application, - the inspection device transfers the control application and the control components in a dependency relationship thereto to a predefined safe operating state (401, 402) on detection of a flow behaviour of the control application contravening the inspection rules, - the program code of the control application is created by means of a first compile flag which activates at least one code sequence in the program code to carry out inspections for indirect function jumps, - the inspections, which are each used to inspect a function prototype of a called function during function calls, are carried out during each run of the control application. - for at least one control application (113, 123), at least one event is defined which is triggered in the event of potential manipulation of program code assigned to the control application and/or of at least one peripheral device which is connected to a program flow control device (101, 102) processing the program code, - the program flow control device monitors a flow of the control application for deviations from an expected flow behaviour and triggers the defined event in the event of a deviation, - following triggering of the defined event, the program code continues to be processed by the program flow control device and the event is signalled to an inspection device separate from the program flow control device, - upon the signalling (201, 202) of the event, the inspection device analyses the flow behaviour of the control application and control components in a dependency relationship thereto using updatable inspection rules, the inspection rules being updated independently of the flow of the control application, - the inspection device transfers the control application and the control components in a dependency relationship thereto to a predefined safe operating state (401, 402) on detection of a flow behaviour of the control application contravening the inspection rules, - the program code of the control application is created by means of a first compile flag which activates at least one code sequence in the program code to carry out inspections for indirect function jumps, - the inspections, which are each used to inspect a function prototype of a called function during function calls, are carried out during each run of the control application.