Promela and Model Description
10) End state
    It’s common that some system process may linger in an idle state or loop     while the others will reach the end of predefined program. To make spin     distinguish normal end state and abnormal ones, Promela introduces End-     State-Label. (labels with 3 prefix letters as “end” are end state labels)
    ex1:  proctype dijkstra() {
byte count = 1;
end: do // it’s normal the process is here at the end.
   :: (count == 1) -> sema!p;  count = 0
   :: (count == 0) -> sema?v; count = 1
od
}