Since you asked about TLA+ specifically...<p><a href="http:&#x2F;&#x2F;cacm.acm.org&#x2F;magazines&#x2F;2015&#x2F;4&#x2F;184701-how-amazon-web-services-uses-formal-methods&#x2F;fulltext" rel="nofollow">http:&#x2F;&#x2F;cacm.acm.org&#x2F;magazines&#x2F;2015&#x2F;4&#x2F;184701-how-amazon-web-s...</a><p>Amazon notes many kinds of problems that lead to reliability and security failures that TLA+ helped knock out. Their engineers are sold on it now and have no intention of dropping it. Certain sentences in that article are nearly identical to those I read in ancient papers using ancient methods. The benefits of precise, easy-to-analyze specifications are apparently timeless.<p>Here&#x27;s it done in Z via Altran&#x27;s Correct by Construction methodology:<p><a href="http:&#x2F;&#x2F;www.adacore.com&#x2F;uploads&#x2F;downloads&#x2F;Tokeneer_Report.pdf" rel="nofollow">http:&#x2F;&#x2F;www.adacore.com&#x2F;uploads&#x2F;downloads&#x2F;Tokeneer_Report.pdf</a><p>They apply about every lesson learned in high assurance in their work. Defect rate, from this demo to old Mondex CA, is usually around 0.04 per 1,000 lines of code. That&#x27;s better than the Linux kernel.<p>Rockwell-Collins formalized a separation architecture, HW, microcode, etc then integrated it into a CPU:<p><a href="http:&#x2F;&#x2F;www.ccs.neu.edu&#x2F;home&#x2F;pete&#x2F;acl206&#x2F;papers&#x2F;hardin.pdf" rel="nofollow">http:&#x2F;&#x2F;www.ccs.neu.edu&#x2F;home&#x2F;pete&#x2F;acl206&#x2F;papers&#x2F;hardin.pdf</a><p>NICTA, who did seL4 verification, use tools to model stuff in the language that causes security errors then use provers to verify they&#x27;re used correctly. Example tool:<p><a href="https:&#x2F;&#x2F;ssrg.nicta.com.au&#x2F;projects&#x2F;TS&#x2F;autocorres&#x2F;" rel="nofollow">https:&#x2F;&#x2F;ssrg.nicta.com.au&#x2F;projects&#x2F;TS&#x2F;autocorres&#x2F;</a><p>Lots of groups using lots of different tools with great results. The difficulty and impact on time-to-market varies. The use of compositional, functions or state-machine models with subsets of safe languages, design-by-contract (or just interface checks), static analysis, design&#x2F;code review, testing, and compilation with conservative optimization seem to be the winning combo. There&#x27;s free tools for all of that. It takes about the same time to code as usual while preventing lots of debugging during testing and integration.