Formal Methods in System Design: A Case Study