Formal methods in the evaluation of a safe driver-machine interface