model checker works (not efficient yet)