"Is Proof More Cost-effective than Testing?" a paper on CleanroomSoftwareEngineering atwww.sparkada.com: http://www.praxis-his.com/pdfs/cost_effective_proof.pdf
This paper describes the use of CleanroomSoftwareEngineering practice on an industrial safety-critical application, where formal methods are required by UK law (?).
[This paper referenced in CleanroomSoftwareEngineering discussion on CleanRoomSoftwareEngineeringIsNotDead page.]