\section{Object centered approach}
We define:
All boxes $B=\{b^0, b^1, \ldots, b^k\}$ and all targets $T=\{t^0, t^1, \ldots,
t^k\}$.
\subsection{Objects}
We define the set $lex$ as being the set containing all legal $x$ values and
the function $ley(x)$ that for a given $x$ returns the set of all legal $y$
values for that $x$.

To reduce size of the encoding we introduce a module called \texttt{ob}
representing an object in the screen. The module contains two integer variables
$x$ and $y$ that contains the position of the object in the field. The $x$ and
$y$ values are bounded by the level size through their domain and restricted to
the non-wall positions with the following invariant:
$$\bigvee_{i\in lex}\left(x=i\wedge\bigvee_{j\in ley(x)}y=j\right)$$

The initial values are determined by the values passed to it in the
\texttt{main} module.

In the \texttt{main} module we define for all boxes and the agent such an
\texttt{ob} that stores the position of that object in that particular state.

\subsection{Movement}
We define a variable $movement=\{left,up,right,down,finished\}$ which describes
the move in that state. From the movement variable new positions of objects are
calculated using delta variables.
$$\Delta_x=\left\{\begin{array}{ll}
	-1 & movement=left\\
	1 & movement=right\\
	0 & \text{otherwise}
\end{array}\right.
\Delta_y=\left\{\begin{array}{ll}
	-1 & movement=up\\
	1 & movement=down\\
	0 & \text{otherwise}
\end{array}\right.$$

The next position of the agent is defined by the following invariant:
$$next(agent_x)=agent_x+\Delta_x\wedge
next(agent_y)=agent_y+\Delta_x$$

Determining the next position of the boxes depends on the position of the
agent. This is described for the $x$ coordinate and analogous for the $y$
value.
$$next(b^i_x)=\left\{\begin{array}{ll}
	b^i_x+\Delta_x & next(agent_x)=b^i_x \wedge next(agent_y)=b^i_y\\
	b^i_x & \text{otherwise}
\end{array}\right.$$

To restrict the boxes to being on top of each other we define the following
invariant:
$$\bigwedge_{i=0}^{k-1}\bigwedge_{j=i+1}^k\neg(b^i_x=b^j_x \wedge b^i_y=b^j_y)
$$

\subsection{Goal}
When the goal state is reached the $movement$ variable should be set to
$finished$ to be able to specify the CTL specification more easily. Via the
following invariant the goal state is tied to the $movement$ variable:
$$\left(\bigvee_{B`\in perm(B)}
	\bigwedge_{b\in B`, i\in 0\ldots k}\left(
		b_x=t^i_x \wedge b_y=t^i_y
\right)\right)\leftrightarrow movement=finished$$

And a counterexample for the following CTL specification can then be seen as an
example solution:
$$\nexists\lozenge(movement=finished)$$
