first Promela models for arinc