Fixed error in promela