[5], which are also the subject of this paper. At the time, the three languages were well defined and had seen some industrial use, but were still under development. In the intervening years, the languages have been improved, gained a much larger user community, and have been successfully commercialized. Today, synchronous languages have been established as a technology of choice for modeling, specifying, validating, and implementing real-time embedded applications. The paradigm of synchrony has emerged as an engineer-friendly design method based on mathematically sound tools. This paper discusses the improvements, difficulties, and successes that have occured with the synchronous languages since 1991. It begins with a discussion of the synchronous philosophy and the challenge of maintaining functional, deterministic system behavior when combining the synchronous notion of instantaneous communication with deterministic concurrency. Section II describes successful uses of the languages in industry and how they have been commercialized. Section III discusses new technology that has been developed for compiling these languages, which has been substantially more difficult than first thought. Section IV describes some of the major lessons learned over the last 12 years. Section V discusses some future challenges, including the limitations of synchrony. Finally, Section VI concludes the paper with some discussion of where the synchronous languages will be in the future. Throughout this paper, we take the area of embedded control systems as the central target area of discussion, since this has been the area in which synchronous languages have best found their way today. These systems are typically safety critical, such as flight control systems in flight-by-wire avionics and antiskidding or anticollision equipment on automobiles. I. THE SYNCHRONOUS APPROACHThe synchronous languages Signal, Esterel, and Lustre are built on a common mathematical framework that combines synchrony (i.e., time advances in lockstep with one or more clocks) with deterministic concurrency. This section explores the reasons for choosing such an approach and its ramifications. A. Fundamentals of SynchronyThe primary goal of a designer of safety-critical embedded systems is convincing him-or herself, the customer, and certification authorities that the design and its implementation is correct. At the same time, he or she must keep development and maintenance costs under control and meet nonfunctional constraints on the design of the system, such as cost, power, weight, or the system architecture by itself (e.g., a physically distributed system comprising intelligent sensors and actuators, supervised by a central computer). Meeting these objectives demands design methods and tools that integrate seamlessly with existing design flows and are built on solid mathematical foundations.

Rising complexities and performances of integrated circuits and systems, shortening time-to-market demands for electronic equipments, growing installed bases of intellectual property (IP), requirements for adapting existing IP blocks with new services, all stress high-level design as a prominent research topic and call for the development of appropriate methodological solutions. In this aim, system design based on the so-called "synchronous hypothesis" consists of abstracting the nonfunctional implementation details of a system and lets one benefit from a focused reasoning on the logics behind the instants at which the system functionalities should be secured. With this point of view, synchronous design models and languages provide intuitive (ontological) models for integrated circuits. This affinity explains the ease of generating synchronous circuits and verify their functionalities using compilers and related tools that implement this approach. In the relational mathematical model behind the design language SIGNAL, this affinity goes beyond the domain of purely synchronous circuits, and embraces the context of complex architectures consisting of synchronous circuits and desynchronization protocols: globally asynchronous and locally synchronous architectures (GALS). The unique features of the relational model behind SIGNAL are to provide the notion of polychrony: the capability to describe circuits and systems with several clocks; and to support refinement: the ability to assist and support system design from the early stages of requirement specification, to the later stages of synthesis and deployment. The SIGNAL model provides a design methodology that forms a continuum from synchrony to asynchrony, from specification to implementation, from abstraction to concretization, from interfaces to implementations. SIGNAL gives the opportunity to seamlessly model circuits and devices at multiple levels of abstractions, by implementing mechanisms found in many hardware simulators, while reasoning within a simple and formally defined mathematical model. In the same manner, the flexibility inherent to the abstract notion of signal, handled in the synchronous-desynchronized design model of SIGNAL, invites and favors the design of correct by construction systems by means of well-defined transformations of system specifications (morphisms) that preserve the intended semantics and stated properties of the architecture under design. The aim of the present article is to review and summarize these formal, correct-by-construction, design transformations. Most of them are implemented in the POLYCHRONY tool-set, allowing for a mixed bottom-up and top-down design of an embedded hardware-software system using the SIGNAL design language.

No abstract