Model Checking, Tla Plus, TLC, Java, Concurrency.
potential deadlocks. (Actually, further study would show that the deadlock remains possible even if notify is made FIFO, so it is really the second source of nondeterminism, the scheduling of threads and the contention on locks, that is the reason for all our trouble here.) The TLA+ module ends