Probably... many of the people behind MirageOS are Cambridge-educated people. I have no university degree and I&#x27;m picking up TLA+ as my first foray into formal methods quite well. The amazing thing is that for <i>correctness</i> the maths behind TLA+ is really easy to understand. I think many people involved in systems-level programming could pick it up with just a couple of weeks&#x27; training.<p>I don&#x27;t think they have done it though... which makes reading through their TLS implementation rather difficult, IMO. The type system of OCaml will give some guarantees but it has a hard time catching high-level design errors that TLA+ and formal methods will.<p><i>update</i> This also doesn&#x27;t preclude them, or anyone with an interest, in creating specifications for these systems. Amazon started using formal methods and found bugs in several AWS services after the fact.<p><i>update update</i> s&#x2F;SSL&#x2F;TLS&#x2F;