Formal methods such as automated model checking are used commercially for digital circuit design verification. These techniques find errors early in the product cycle, which improves development time and cost. By contrast, the current practice in complex system design is to specify system functions and protocol details in natural language. Some errors are found early by manual inspections, but others are only revealed during implementation testing or by costly field failures. We describe our application of formal specification and model checking to real telecom product development, and enumerate the classes of specification errors that these formal techniques revealed at an early stage of the development cycle.