A method for fail-safe monitoring of the speed of a drive that includes at least a converter, a motor, and a rotational speed sensor, wherein a target rotational speed is specified to the drive and an actual rotational speed is sensed via the sensor, where a substitute rotational speed is calculated and three plausibility checks are performed in a safety program of a safety CPU, the substitute rotational speed being determinable, for example, from the initial frequency of a converter or from the quotient of EMF and magnetic flux, in each case two of the following three values being checked: target rotational speed, actual rotational speed and substitute rotational speed to achieve a high safety integrity level while avoiding disadvantages of conventional solutions, and because the calculated substitute rotational speed is independent of the sensor, even sensor errors that are difficult or impossible to detect via conventional solutions become detectable.