Simulation-Based Debugging of Formal Environment Models*