## 1 Introduction
It should be noted that, if two or more embedded systems are connected through an on-board bus or a network, the system is still considered to be an embedded system (distributed embedded system to be precise), as shown by the on-board interconnection of several embedded systems in Figure 1.  
The CPS in the above example is a time- and safety-critical system. The system is required to provide a logically correct response (or output) within a given amount of time that corresponds to the specified timing predictability requirement. Failing to meet a timing predictability requirement in a time-critical system can result in the system failure. Failing to meet a timing predictability requirement in a safety-critical system can have catastrophic consequences such as endangerment of human life or the environment. Assume that the car in which the CPS is deployed is an autonomous vehicle that cooperates with other vehicles and road-side units (RSUs) to perform a certain cooperative functionality, e.g., navigate collaboratively while avoiding accidents with other cars, pedestrians and stationary objects. The above-mentioned CPS in the car together with the corresponding CPSs inside the other vehicles or RSUs provide an example of a safety-critical CPS. Industrial environment of safety-critical CPSs often brings tighter timing requirements together with an assumed infrastructure that provides connectivity and can play a role of fog nodes. Generally speaking, a system is said to be predictable if its state/behaviour can be forecasted at any point in time, given a known execution environment or a set of assumptions. The prediction can be made either quantitatively or qualitatively, and at different stages during the system lifecycle. Predictability of a system is related to proving, demonstrating or verifying the fulfillment of the functional or extra-functional requirements that are specified on the system. The focus of this paper is on the system development stage or the so-called design time and on two extra-functional requirements that affect the predictability of a safety-critical CPS: timing and security. The term predictability has also been used lately in the artificial intelligence (AI) community, where a system is capable of predicting the future state changes and executing appropriate actions beforehand (e.g., for predictive maintenance). Triggered by this usage of the term,we include a brief discussion on how AI can be used as a tool for addressing challenges in the light of system predictability. There is a plethora of existing research and initiatives that define and study timing predictability [6; 7; 8; 9; 10] and security [11; 12; 13] in the embedded systems community. Security in a broad sense can be defined as a system property that allows it \"to perform its mission or critical functions despite risks posed by threat\" [14], where a threat can be defined as \"the potential source of an adverse event\" [14]. A threat is realised by an attack that exploits a vulnerability, i.e., a flaw in the system, and targets one of the system assets. A concrete threat realisation is an attack. One of the main security objectives in embedded systems is to consider data integrity and authenticity, as it is crucial to have enough confidence that the data received from the sensors represents the physical process correctly. That is, the data are not modified by an adversary or injected by an adversary masking the real data. To ensure that the input data is correct and not modified maliciously, we can as well use prediction algorithms (extrapolation) and also security mechanisms for integrity and authentication checks. In this paper, we focus only on the two security objectives mentioned above as being most common for the time- and safety-critical CPSs; however, depending on the particular use-case, the relevant security objectives for industrial CPSs can include confidentiality, anonymity, availability, auditability, non-repudiability, third-party protection and conformance [15].