module StateMachineChecker::CTL