 rounding on numerical results, to determine pass/fail criteria. The control aspect includes checks on the execution flow from entry point to exit points in algorithm blocks, and only valid paths between the algorithm blocks are permitted. One approach to establishing the correctness of high-level control flow uses information (structure labels) embedded in the syntax of the program text. The introduction of path tags to check the validity of the sequencing of blocks and block tags to verify that execution of blocks proceeded properly from entry to exit points are examples of such structure labels. Each block contains a unique number called its signature, and upon entry the block tag is set to the value of the signature. The block tag is verified upon exit from the routine to confirm that the block was not entered in any manner except the valid entry point. The path tag is then set to the value of the next block signature, which is checked on entry into all blocks. Placement of these locks at entry and exit points verify that only processes presenting the correct key can progress; all other attempts at entry or exit are flagged as indication of the loss of program branching or sequence control. Similar control checking of program iterative execution loops for illegal entry, completion and branch related loop termination may be utilized. Range checks on loop indexing and range testing of address pointers are also utilized to detect loss of proper execution sequencing. The use of a memory management unit (MMU) which grants specific access rights to segments of memory by various software routines provides effective detection of errors which result in software accessing locations out of normal use bounds. The insertion of error capturing instructions in locations which do not contain valid executable code also may be used in the detection of control errors. The recovery block approach uses acceptance tests in the form of checksums and other bounds checking on computation results to detect the presence of errors. The 