Java Path checkers track data through the program code, finding execution paths containing the issues, or more specifically Java Path checkers track data flow from source to sink.

To create a Java Path checker, you must decide what data will be tracked by the analysis engine. Once you identify your criteria, you must then communicate your criteria to the engine in the form of a Java knowledge base file, which uses a Java-like declarative language called JKB.

In the Java knowledge base, you must identify which calls:

create data that is potentially dangerous; these are the sources . For NPE (for example, NPE.RET), the source would be a call returning null.
can convert the potential danger coming from sources into the real issue; these are the sinks. For NPE, the sink would be a call dereferencing a parameter.

If you have two calls, with one returning null and another dereferencing it, then you have an NPE issue.

Optionally, you can identify which calls:

guarantee that the potentially dangerous data was checked and it is safe; these are the checks.
propagate the dangerous state of one object onto other objects; these are the props.

Note: Klocwork has the same capability to tune existing checkers to reduce false positives. See Tuning Java analysis.