CTL model checker