Model Checking, Tla Plus, TLC, Java, Concurrency.
parameter E in the java class). For the module to make any sense, we need to assume that the sets of threads are disjoint and nonempty, the buffer capacity is at least one, and there is at least one piece of data that can be sent through the buffer. The module then introduces variables for the