BROKEN: restructure much of ModelChecker as ModelExecution class