A method for verifying program flow during execution of a software program in a computer system is disclosed. Program code of the software program includes multiple program instructions and checkpoint data structures, where a given checkpoint data structure is associated with a given program instruction and is linked to at least one other checkpoint data structure. A fault monitor circuit may receive a particular checkpoint data structure and compare the particular checkpoint data structure to a previously received checkpoint data structure that is associated with another program instruction. Based on results of the comparison, the software fault monitor circuit may signal a program flow error.