Automating first-order relational logic
Alcoa: the alloy constraint analyzer