Your TLA+ comment isn&#x27;t relevant to this discussion and seems to only promote TLA+. The topic is verification of compilers or imperative programs in C language. I don&#x27;t know of anyone using TLA+ for that or advocating for it. It&#x27;s mainly used as a lightweight approach in protocol verification. So, distributed apps not C code or compilers.<p>Now, Coq has <i>plenty</i> of history in certified programming and compilation. There exists formalisms and models of most pieces of the puzzle. There are worked examples of certified compilers whose details and sometimes source are available for re-use. There&#x27;s even already a verified C compiler other works are building on. It was used in EAL7-class JavaCard interpreters, database structures I believe, web services, and so on. Even outputs to robust Ocaml code. People needing to learn this stuff even have free books like Chlipala&#x27;s:<p><a href="http:&#x2F;&#x2F;adam.chlipala.net&#x2F;cpdt&#x2F;" rel="nofollow">http:&#x2F;&#x2F;adam.chlipala.net&#x2F;cpdt&#x2F;</a><p>So, anyone trying to specify or formally verify compilers or algorithms have plenty of reason to choose Coq. It&#x27;s actually one of the best tools for the job with HOL or Isabelle the other style. Field kind of diverges doing parallel work with them in imperative verification. Coq is possibly easier to use and seems to have more prior work to draw on in this. So, it&#x27;s either the best or one of best tools for the job.<p>TLA+ is for totally different jobs. Not relevant here.