  Until recently, cyber-physical systems, especially those with safety-critical
properties that manage critical infrastructure (e.g. power generation plants,
water treatment facilities, etc.) were considered to be invulnerable against
software security breaches. The recently discovered 'W32.Stuxnet' worm has
drastically changed this perception by demonstrating that such systems are
susceptible to external attacks. Here we present an architecture that enhances
the security of safety-critical cyber-physical systems despite the presence of
such malware. Our architecture uses the property that control systems have
deterministic execution behavior, to detect an intrusion within 0.6 {\mu}s
while still guaranteeing the safety of the plant. We also show that even if an
attack is successful, the overall state of the physical system will still
remain safe. Even if the operating system's administrative privileges have been
compromised, our architecture will still be able to protect the physical system
from coming to harm.
