A Promela Model for Contiki's scheduler