Formal Why-Why Analysis