Promela model for exit_process()