Model checking for fault explanation