ivory model-check: loops and branches.