K. Rustan M. Leino Todd D. Millstein James B. Saxe Generating error traces from verification-condition counterexamples. 209-226 2005 55 Sci. Comput. Program. 1-3 http://dx.doi.org/10.1016/j.scico.2004.05.016 db/journals/scp/scp55.html#LeinoMS05