Promela model for do_event()