model Computation Tree Logic with Alloy