Higher assurance from the start requires something functionally similar to Ada's Spark. I've never seen that used in the wild (though I'm in the wrong domain (

Higher assurance from the start requires something functionally similar to Ada's Spark. I've never seen that used in the wild (though I'm in the wrong domain (web) these days).