This paper discusses the use of formal methods for analysing human-computer interaction. We focus on the mode confusion problem that arises whenever the user thinks that the system is doing something while it is in fact doing another thing. We consider two kinds of models: the system model describes the actual behaviour of the system and the mental model represents the user’s knowledge of the system. The user interface is modelled as a subset of system transitions that the user can control or observe. We formalize a full-control property which holds when a mental model and associated user interface are complete enough to allow proper control of the system. This property can be verified using model-checking techniques on the parallel composition of the two models. We propose a bisimulation-based equivalence relation on the states of the system and show that, if the system satisfies a determinism condition with respect to that equivalence, then minimization modulo that equivalence p...