Model Checking, Tla Plus, TLC, Java, Concurrency.
with a formalization of the expected property of the system, namely that it is free of deadlock. The NoDeadlock formula says that there is always at least one thread running (the ◻ temporal operator makes it apply to all the states of the system), and the theorem expresses that the system is