Add a TODO: need to signal termination to the model checker