Using TLA+ to Model Cascading Failures
Modeling Zero-downtime Deployments with TLA+
Formal Methods in Practice: Using TLA+ at eSpark Learning
Use of Formal Methods at Amazon Web Services
Introduction to TLA+ Model Checking in the Command Line - HN Comments