Promela models for spin model checker