Model Checking, Tla Plus, TLC, Java, Concurrency.
straightforward: Put(t, m): if the buffer is not full, add m at the end and notify; otherwise, thread t waits, and the buffer is left unchanged. Since the Java method is synchronized, it can be modelled as a single TLA+ transition. Finally, the module specifies the acceptable initial states (in