Example Clarke Model Checking page 16