Nested invokers and delayed events for PROMELA model checking