Semantics and verification of object-role models