You might be surprised by how much safety critical software is built by code generation tools like SCADE. It's not entirely the same thing, but the programmer is pretty removed from the final product and it is very spec driven.