refactoring consistency checking -> model checking