alternating mutex as promela model