CSC 2108F : Automated Verification

Assignment 2

Due: Friday October 31, classtime (extended upon request)

You are to specify and verify the behavior of a controller for an elevator system for an appartment building. The system consists of two elevators that service 10 floors of the building. Each floor has a request button that a user presses to get the elevator to come to that floor and open its doors. Inside the elevator, there is one request button for each of the 10 floors; passengers press these buttons to get the elevator to go to a particular floor and open its doors. Each elevator takes one time unit to go between floors n and n-1. If there are no requests to service, each elevator stays at a floor with its doors open. As passengers press buttons, the controller schedules elevators to service the requests, trying to minimize the waiting time. If a button is pressed on a floor (as opposed to inside the elevator), only one elevator will be scheduled to service it. Each elevator as a "passenger present" detector and a "door open" button. When someone steps into the elevator, the doors should close within one time unit and remain closed unless the "door open" button is pressed. Since we do not want the passenger to keep doors open, the elevator can react to the "door open" button at most twice. As passengers leave the elevator, the "passenger present" detector is reset.

You will specify the behavior of your elevator system using Promela. The following properties need to be re-written as LTL formulae and/or using Promela's assert statements.

• Requests to use the elevator are eventually serviced.
• Requests to be delivered to a particular floor are eventually serviced.
• The elevator never moves with its doors open.
• Two elevators are never scheduled to service the same floor, unless the request can from within the elevator.
• Doors will close within 1 time unit after someone enters an elevator unless the "door open" button is pressed.
• "door open" button keeps the doors open with a passenger present for at most 2 time units.

Note that some of the properties can only be expressed in LTL. However, the list of the above properties may be incomplete. If you can think of other properties vital to the correct operation of your elevator system, please add them to this list. Using the SPIN model checker, verify that your specification satisfies the above properties.

General questions After you have completed the assignment, try to answer the following questions:

• Which modeling language (SMV or Promela) easier and more natural to use? Which features of the language make it so?
• SMV had a "catch" to it - verification is valid only subject to fairness conditions. These supposedly represent assumptions of the environment, but users can easily add to them assertions about their system to get their specification to check. SMV had another "catch" - reordering declaration of variables can significantly affect the size of BDDs and thus the performance of the tool (try this with your specification for assignment 1). Are there such "catches" in Promela/SPIN?

Presentation You may work by yourself or in groups of 2. Warning: It will take you much longer to complete the assignment if you work on your own.

In one of your group's accounts, leave a working copy of the Promela specification including all of the LTL formulae and asserts you attempted to verify. Bring to class (to hand in) one hardcopy of your group's Promela specification. Please indicate on your assignment the members of your group, the account in which your group's assignment resides, and the name of the file(s) containing your assignment.

It would be nice if we could hear presentations of specifications for the elevators on October 31. If you are interested in presenting, let me know. I am looking for a 10-15-minute presentation of each specification.

People who are not taking the course for credit are still required to participate in the assignment. The goal of this course is to gain practical experience with specification and verification tools, and you can achieve this goal only by doing the assignments.