Using model checking to help discover mode confusions and other automation surprises

Source page