This paper proposes EventCJ, a context-oriented programming (COP) language that can modularly control layer activation based on user-defined events. In addition to defining context-specific behaviors by using existing COP constructs, the EventCJ programmer declares events to specify when and on which instance layer switching should happen, and layer transition rules to specify which layers should be activated/deactivated upon events. These constructs enable controlling layer activation on a per-instance basis, separately from a base program. We also demonstrate an approach to verify safety properties of layer transitions by using a model checker. With these advantages, EventCJ enables more modular descriptions of context-aware programs, especially when layer switching is triggered in many places of a program, or by activities external to the base program. We implemented a prototype EventCJ compiler with Eclipse IDE support. Categories and Subject Descriptors