Promela model for pThread