> The cost of dead people is a lot higher than the cost of developer time.
So you're using proof on every line of code you produce?
So you're using proof on every line of code you produce?
No, except for trivially (the code is statically and strongly typed, which is a proof mechanism). The set of activities chosen to give confidence in defect rate is varied, but only a few of them would fit either a traditional or formal verification definition of a proof. See DO-178C for more.