What works (and doesn't) selling formal methods