Verifying the Operational Correctness of ATL Transformations through a Formal Semantics for the ATL Virtual Machine