Explaining counterexamples using causalityIlan BeerShoham Ben-Davidet al.2011Formal Methods in System Design