Testing software in air traffic control systems costs much more than building them. This is basically true in every domain producing software-intensive critical systems. Software engineers strive to find methodological and process-level solutions to balance these costs and to better distribute verification efforts among all development phases. There's considerable interest in applying model-driven engineering (MDE) approaches in the critical systems engineering field. This article reports the experience of an ATC systems producer in applying MDE into its industrial context.