symbolic-model-checking-without-bdds