Saving this one for a later read. How Amazon uses formal methods when building AWS: How-Amazon-Web-Services-Uses-Formal-Methods.pdf speficially mentions The TLA+ Home Page