Symbolic Model Checking of OCL Safety Properties