Relational Specification As A Testing Oracle