Verification of model transformation