How Amazon web services uses formal methods

Abstract
Engineers use TLA+ to prevent serious but subtle bugs from reaching production.

This publication has 11 references indexed in Scilit: