Formal methods in practice