A method includes receiving a circuit design and a specification for the circuit design and determining a first hypothesized change to the circuit design. Making the first hypothesized change to the circuit design produces a first changed circuit design. The method also includes determining a first counterexample input that causes the first changed circuit design to produce an output that departs from the specification and determining a second hypothesized change to the circuit design based at least in part on the first hypothesized change. Making the second hypothesized change to the circuit design produces a second changed circuit design. The method further includes, in response to determining that the second changed circuit design has no counterexample input that causes the second changed circuit design to produce an output that departs from the specification, making the second hypothesized change to the circuit design.