Evaluating a Specification for its Support of Mode Awareness using Discrete and Continuous Model Checking

In situations where humans and computers cooperate, mode confusion on the part of the human can be dangerous. We present a methodology to evaluate a semi-autonomous system for its support of mode awareness. The methodology uses discrete-state model checking of the specification and real-valued model checking of the system in operation. Using the ISO standard for adaptive cruise control as a case study, we exhaustively enumerate the instances of four design flaws known to contribute to mode confusion. We then build a real-valued model of eight driving scenarios to find which of those instances of possible mode confusion may lead to a dangerous situation. We find 116 property violations, and determine 62 of them to be potentially dangerous.