I used it to debug the design of a bidirectional message-passing system with checksums, acknowledgements, retransmissions and message-order-maintenance guarantees.
Here is the good:
* A high level of confidence in the design - useful for systems you need to be reliable, or where a bug could create hard-to-diagnose problems.
* The satisfaction of having done a really good job for once, like the great programmers of yore who couldn't patch after release and had to get it right the first time.
* Interesting in an academic sense.
Here is the bad:
* You can still make a mistake when translating the design into code.
* The tools are sometimes baffling, both in their design decisions and their performance. Be prepared for some frustrations.
* With the tools complex and the design proven, your colleagues might not take over the TLA portion of your work and carry it forward.
Here is the good:
* A high level of confidence in the design - useful for systems you need to be reliable, or where a bug could create hard-to-diagnose problems.
* The satisfaction of having done a really good job for once, like the great programmers of yore who couldn't patch after release and had to get it right the first time.
* Interesting in an academic sense.
Here is the bad:
* You can still make a mistake when translating the design into code.
* The tools are sometimes baffling, both in their design decisions and their performance. Be prepared for some frustrations.
* With the tools complex and the design proven, your colleagues might not take over the TLA portion of your work and carry it forward.