px-1">https://github.com/p-org/P
EDIT: It looks like it's also being used in AWS.
(Another interesting approach in this space is P, which is lower-level than TLA+ but also can compile to C#: px-1">https://github.com/p-org/P)
My approach when learning new protocols like Raft or Paxos is to implement them in Pluscal (TLA+'s higher-level language) or P (px-1">https://github.com/p-org/P). I've found that helps separate the protocol-level concerns from the implementation-level concerns (sockets? wire format?) in a way that reduces the difficulty of learning the protocol.
“P is a language for asynchronous event-driven programming. P allows the programmer to specify the system as a collection of interacting state machines, which communicate with each other using events. P unifies modeling and programming into one activity for the programmer. Not only can a P program be compiled into executable code, but it can also be systematically tested using Model Checking. P has been used to implement and validate the USB device driver stack that ships with Microsoft Windows 8 and Windows Phone. P is currently being used extensively inside Amazon (AWS) for model checking complex distributed systems.”
px-1">https://github.com/p-org/P
I found the link interesting because I have at times wondered what it would look likes if FSM were first class control flow features, akin to `if` and `while`.
Latest examples, Windows 10 secure kernel and Device Driver protection.
https://myignite.microsoft.com/sessions/36925
Or the new Windows USB stack, written in the P language.
px-1">https://github.com/p-org/P
UNIXes, not so much beyond patching C exploits.
There have been lot of other work going on for verifiability for realtime firmware code. For example P programming language: px-1">https://github.com/p-org/P. But still it doesn't tackle the issues mentioned above that causes majority of crashes.