Abstract. Internet protocols encapsulate a significant amount of state, making implementing the host software complex. In this paper, we define the Statecall Policy Language (SPL) which provides a usable middle ground between ad-hoc coding and formal reasoning. It enables programmers to embed automata in their code which can be statically modelchecked using SPIN and dynamically enforced. The performance overheads are minimal, and the automata also provide higher-level debugging capabilities. We also describe some practical uses of SPL by describing the automata used in an SSH server written entirely in OCaml/SPL.Constructing modern Internet servers is a difficult proposition, since the software must encapsulate a significant amount of state and deal with a variety of incoming packet types, complex configurations and versioning inconsistencies. Network applications are also expected to be liberal in interpreting received data packets and must reliably deal with timing and ordering issues arising from the "best-effort" nature of Internet data traffic.Due to this complexity, mechanical verification techniques are very useful to guarantee safety, security and reliability properties. One mature formal method used to verify properties about systems is model checking. Software modelchecking involves: (i ) creating an abstract model of a complex application; (ii ) validating this model against the application; and (iii ) checking safety properties against the abstract model. To non-experts, steps (i ) and (ii ) are often the most daunting. How does one decide which aspects of the application to include in the abstract model? How does one determine whether the abstraction inadvertently "hides" critical bugs? If a counter-example is found, how does one determine whether this is a genuine bug or just a modeling artifact?In this paper, we present the Statecall Policy Language (SPL) which simplifies the model specification and validation tasks with a view to making model checking more accessible to regular programmers. SPL is a high-level modelling language which enables developers to specify models in terms of allowable program events (e.g. valid sequences of received network packets). We have implemented a compiler that translates SPL into both Promela and a generalpurpose programming language (e.g. OCaml). The generated Promela can be used with SPIN [1] in order to check static properties of the model. The OCaml code provides an executable model in the form of a safety monitor . A developer