I was involved in writing the short term collision alert system for the New En Route Centre down in Swanwick, UK. Basically proving something won't kill is extremely important in this environment. The language is almost irrelevant. Proving every single piece of logic has been exercised (an OR statement had to have true true, false true, true false and false false tests...now add multiple ORs to that). Mission critical software is another world.
First real success was Meteor line 14
driverless metro in Paris: Over 110 000 lines of B models were written, generating 86 000 lines of
Ada. No bugs were detected after the proofs, neither at the functional validation, at the integration
validation, at on-site test, nor since the metro lines operate (October 1998). The safety-critical
software is still in version 1.0 in year 2007, without any bug detected so far.
Pure languages are also great for this kind of thing, because of the lack of side-effects (aka Haskell's moto). OCaml manages its imperative parts in a way that isn't as good had Haskell does, but it's probably possible to get a very clean code that is mostly pure, allowing a mathematical proof of safety.
It'll give an execution count on each statement, and logical expression operands count as separate statements. I've found that when this is used in conjunction with a test suite to ensure that the tests cause every code path to be executed, the code becomes remarkably free of bugs.
Probably rather alien to the HN crowd ;)