Office Elevator: System Report

Office Elevator model, compiled 2026-09-27T22:48:31 with SBDL 1.27.12 (DSL 26.6). Generated from the SBDL model; every element links to its definition in the materials the model is spread across.

Requirements

Identifier	Requirement	Aspect	Verified by	Failure modes
sys_req_1 model/generated/requirements.sbdl:2	The elevator system shall transport passengers between floors safely and efficiently	elevator_system
req_capacity refines sys_req_1 model/generated/requirements.sbdl:3	The cabin shall carry a rated load of 630 kg (8 persons)	cabin
req_door_obstruction refines sys_req_1 model/generated/requirements.sbdl:4	The door system shall detect an obstruction and reopen within 250 ms	door_system	function: func_door_reopen	fm_door_no_open
req_levelling refines sys_req_1 model/generated/requirements.sbdl:5	The cabin shall level within 10 mm of the floor sill	drive_system
req_dispatch refines sys_req_1 model/generated/requirements.sbdl:6	The dispatcher shall minimise average waiting time using collective control	dispatcher	UT::test_call_order
sys_req_3 model/generated/requirements.sbdl:7	The elevator system shall provide accessible and intuitive passenger interaction	user_interface
req_door_hold refines sys_req_3 model/generated/requirements.sbdl:8	The doors shall stay open for a configurable dwell time (default 4 s) after a call	door_system
req_display refines sys_req_3 model/generated/requirements.sbdl:9	The cabin display shall show the current floor and direction of travel at all times	display
sys_req_2 model/safety.sbdl:11	The elevator system shall comply with EN 81-20 EN 81-20 SafetyRequirement	elevator_system
req_safety_brake refines sys_req_2 model/safety.sbdl:17	The safety brake shall engage within 100 ms of an overspeed or free-fall detection EN 81-20 5.6.2 SafetyRequirement	brake	UT::test_stop_sequence function: func_emergency_stop	fm_overspeed
req_limit_switch refines sys_req_2 model/safety.sbdl:24	Limit switches shall cut drive power on overtravel in either direction EN 81-20 5.12.2 SafetyRequirement	limit_switches	UT::test_fault_cleared function: func_emergency_stop
req_emergency_power refines sys_req_2 model/safety.sbdl:31	The UPS shall sustain safety-critical functions for at least 1 hour after a mains failure EN 81-20 5.10.4 SafetyRequirement	ups		fm_power_loss
req_overload refines sys_req_2 model/safety.sbdl:38	The cabin shall not depart when the load exceeds the rated capacity EN 81-20 5.12.1.2 SafetyRequirement	load_sensor

Architecture

Aspect	Description	Part of	Interfaces	Properties
elevator_system doc/Architecture.docx:7	The office elevator serves eight floors with a single cabin and a traction drive. It is decomposed into six subsystems, described below.	elevator_model
cabin doc/Architecture.docx:10	The cabin carries up to eight passengers. It holds the doors, the lighting, the display and the emergency phone, and rests on a load cell.	elevator_system
drive_system doc/Architecture.docx:12	The traction motor, counterweight, holding brake and speed governor move the cabin and hold it in place.	elevator_system
control_system «software» doc/Architecture.docx:16	A software controller with two independent parts: the dispatcher that schedules calls, and the safety monitor that supervises every sensor and can stop the cabin on its own.	elevator_system	can_bus
shaft doc/Architecture.docx:19	The shaft structure with its guide rails, overtravel limit switches and the absolute position encoder.	elevator_system
user_interface doc/Architecture.docx:22	All passenger-facing controls and indicators: hall call panels on each landing, the cabin panel and the overload indicator.	elevator_system
power_supply «electrical» doc/Architecture.docx:25	Mains distribution and the uninterruptible supply that keeps the safety functions and lighting alive when the mains fail.	elevator_system
door_system model/elevator.sbdl:42	Cabin door mechanism and sensors	cabin		custom:rated_cycles = 2000000 cycles
door_motor «electrical» model/elevator.sbdl:47	Door drive motor and belt	door_system
door_obstruction_sensor Sensor model/elevator.sbdl:48	Infrared light curtain across the door opening	door_system		types = Sensor aspect accuracy = 5 mm range = 2000 mm
lighting «electrical» model/elevator.sbdl:55	Cabin interior lighting	cabin
emergency_phone «safety» model/elevator.sbdl:56	In-cabin emergency communication device	cabin
display «electrical» model/elevator.sbdl:57	Floor indicator display inside cabin	cabin
load_sensor Sensor model/elevator.sbdl:58	Load cell under the cabin floor	cabin		types = Sensor aspect range = 1000 kg
motor «electrical» model/elevator.sbdl:64	Traction motor unit	drive_system
counterweight model/elevator.sbdl:65	Counterweight assembly balancing the cabin	drive_system
brake «safety» model/elevator.sbdl:66	Electromechanical holding and safety brake	drive_system	brake_circuit
speed_governor «safety» model/elevator.sbdl:71	Centrifugal governor that trips the safety gear on overspeed	drive_system
dispatcher «software» model/elevator.sbdl:77	Floor call scheduling and cabin dispatch logic	control_system
safety_monitor «software» model/elevator.sbdl:78	Real-time safety interlock monitoring	control_system	brake_circuit, can_bus
guide_rails model/elevator.sbdl:85	Vertical guide rails for cabin travel	shaft
limit_switches «safety» model/elevator.sbdl:86	Top and bottom overtravel limit switches	shaft
position_sensor Sensor model/elevator.sbdl:87	Absolute cabin position encoder on the guide rail	shaft	can_bus	types = Sensor aspect accuracy = 1 mm range = 60000 mm
floor_call_panel model/elevator.sbdl:95	Hall call buttons on each floor landing	user_interface
cabin_panel model/elevator.sbdl:96	Destination floor selection buttons inside the cabin	user_interface
overload_indicator «safety» model/elevator.sbdl:97	Passenger overload warning indicator	user_interface
ups «electrical» model/elevator.sbdl:99	Uninterruptible power supply for safety functions	power_supply

Design decisions

Definition	Decision	Concerns	Realised by
arch_doc doc/Architecture.docx:3	This document describes the subsystems of the office elevator. The SBDL statements in it define the subsystems for the model; their descriptions are taken from the prose around them, so the document and the model cannot disagree.	elevator_system, cabin, drive_system, control_system, shaft, user_interface, power_supply
brake_independence doc/Architecture.docx:29	The dispatcher never commands the brake: only the safety monitor does, over a hard-wired circuit. This keeps the safety function independent of scheduling software.	safety_monitor, dispatcher req_safety_brake
maintenance_manual README.md:72	Maintenance manual, section 4: periodic tests	door_system
safety_monitor_design model/elevator.sbdl:113	The safety monitor evaluates every sensor frame independently of the dispatcher and can command the brake circuit on its own	safety_monitor req_safety_brake	SafetyMonitor

Use Cases

uc_normal_ride actor: Passenger

Passenger calls the elevator, boards, selects a floor and is transported
Aspect: elevator_system; requirement: sys_req_1; functions: func_normal_ride, func_door_reopen model/behaviour.sbdl:19

uc_emergency_stop actor: Safety Monitor

The safety monitor detects a fault and brings the cabin to a safe stop
Aspect: safety_monitor; requirement: sys_req_2; functions: func_emergency_stop model/behaviour.sbdl:43

Behaviour

Each function is a sequence of events; the diagrams are generated per function with --diagram-root.

func_normal_ride

End-to-end passenger transport cycle in: hall call out: passenger at destination floor model/behaviour.sbdl:26

evt_call_registered: A hall call is registered by the dispatcher out: target floor (dispatcher)
evt_doors_open: Cabin doors open at the call floor (door_system)
evt_passenger_boards: Passenger enters; the load sensor confirms boarding (load_sensor)
evt_destination_selected: Passenger presses a destination button out: destination floor (cabin_panel)
evt_close_doors «condition»: Doors close after the dwell time while/if: door opening clear else: evt_door_reopen (door_system)
- evt_doors_locked: Door lock confirmed (door_obstruction_sensor)
evt_cabin_dispatched «parallel»: Dispatcher commands the cabin towards the target floor (dispatcher)
- evt_brake_released: Holding brake released (brake)
- evt_motor_energised: Traction motor energised (motor)
evt_cabin_travels «loop»: Cabin moves along the shaft while/if: target floor not reached (drive_system)
- evt_position_monitored: Position sensor reports the cabin location to the safety monitor (position_sensor)
evt_cabin_arrives: Cabin decelerates and levels at the destination floor out: floor reached (drive_system)
evt_doors_open_arrival: Cabin doors open at the destination floor (door_system)
evt_passenger_exits: Passenger leaves the cabin (load_sensor)

func_door_reopen

Obstruction handling while the doors close model/behaviour.sbdl:36

evt_obstruction_detected: The light curtain reports an obstruction while closing (door_obstruction_sensor)
evt_door_reopen: Doors reopen and the dwell time restarts (door_system)

func_emergency_stop

Safety interlock: bring the cabin to a safe stop src/controller.cpp:31

fault_detected: Safety monitor detects an out-of-tolerance condition (overspeed, overload, overtravel) out: fault reason (safety_monitor)
engage_brake: Brake circuit is opened: the electromechanical brake engages (brake, safety_monitor)
cut_power: Drive power is cut; the UPS sustains the safety and lighting circuits (power_supply, safety_monitor)
halt_cabin: Cabin comes to a full stop (drive_system, safety_monitor)
raise_alarm: Audible and visual alarm; the emergency phone is enabled (emergency_phone, safety_monitor)

func_return_to_service

Return to service after a fault src/controller.cpp:78

fault_cleared: Maintenance clears the fault and returns the system to service (safety_monitor)

Process view

States

Transition	From	To	On event	Description
tr_idle_to_opening model/behaviour.sbdl:156	state_idle	state_doors_opening	evt_call_registered	Call received
tr_opening_to_boarding model/behaviour.sbdl:157	state_doors_opening	state_boarding	evt_doors_open	Doors fully open
tr_boarding_to_closing model/behaviour.sbdl:158	state_boarding	state_doors_closing	evt_close_doors	Dwell time elapsed
tr_closing_to_boarding model/behaviour.sbdl:159	state_doors_closing	state_boarding	evt_door_reopen	Obstruction: doors reopen
tr_closing_to_travelling model/behaviour.sbdl:160	state_doors_closing	state_travelling	evt_cabin_dispatched	Doors locked, cabin dispatched
tr_travelling_to_levelling model/behaviour.sbdl:161	state_travelling	state_levelling	evt_cabin_arrives	Approaching the floor
tr_levelling_to_opening model/behaviour.sbdl:162	state_levelling	state_doors_opening	evt_doors_open_arrival	Levelled: open the doors
tr_motion_to_fault model/behaviour.sbdl:163	state_in_motion	state_fault	fault_detected	Fault while in motion
tr_fault_to_idle model/behaviour.sbdl:164	state_fault	state_idle	fault_cleared	Fault cleared by maintenance

FMEA

Rows are generated from the failure modes, their effects, causes, controls and detections. RPN = severity × occurrence × detectability, before and after the planned actions.

Aspect	Failure mode	Effect	S	Cause	O	Controls	Detection	D	RPN	Actions	RPN after
Cabin door mechanism and sensors	Cabin door fails to open at a floor	Passenger is unable to leave or enter the cabin	8	Door drive motor failure or mechanical jam	3	Scheduled preventive maintenance on the door drive motor; Monthly door obstruction test: block the light curtain while closing and confirm the doors reopen	Door position sensor confirms open/closed status on every cycle (The door system shall detect an obstruction and reopen within 250 ms)	3	72	Add a redundant door position sensor to detect a motor stall; Report a door-open timeout alarm to the building management system	8
Electromechanical holding and safety brake	Cabin exceeds its rated speed during travel	Risk of cabin impact at the shaft end; potential passenger injury	10	Electromechanical brake fails to hold under regenerative conditions	2	Annual brake inspection and load test per the EN 81-20 schedule	Centrifugal speed governor trips the safety gear on overspeed	2	40	Introduce a dual-redundant brake circuit with independent power supplies; Continuous speed logging with anomaly alerts to the maintenance system	10
Uninterruptible power supply for safety functions	Mains power lost while the cabin is between floors	Cabin halts between floors; passengers may be trapped until rescue (UPS sustains a controlled descent to the nearest floor)	6	Unplanned mains supply interruption	4	UPS sustains a controlled descent to the nearest floor	UPS self-test and mains voltage monitoring with continuous reporting	1	24	Automatic rescue drive: on power loss the UPS moves the cabin to the nearest floor and opens the doors	12

Improvement actions

Action	Description	Owner	Due	Addresses
fa_ctrl_redundant_door_sensor model/safety.sbdl:87	Add a redundant door position sensor to detect a motor stall	Mechanical engineering	2027-Q1	fc_door_motor_failure
fa_det_door_timeout model/safety.sbdl:99	Report a door-open timeout alarm to the building management system	Controls engineering		fm_door_no_open
fa_ctrl_dual_brake model/safety.sbdl:137	Introduce a dual-redundant brake circuit with independent power supplies	Electrical engineering	2027-Q3	fc_brake_failure
fa_det_speed_log model/safety.sbdl:150	Continuous speed logging with anomaly alerts to the maintenance system	Controls engineering		fm_overspeed
fa_ctrl_auto_rescue model/safety.sbdl:187	Automatic rescue drive: on power loss the UPS moves the cabin to the nearest floor and opens the doors	Systems engineering	2026-Q4	fc_mains_interruption

Verification

Tests

Test	Checks that	Requirements	Detections
UT::test_stop_sequence src/controller_test.cpp:16	The brake engages before power is cut and the cabin halts	req_safety_brake	fd_speed_governor
UT::test_fault_cleared src/controller_test.cpp:23	A cleared fault returns the monitor to service	req_limit_switch
UT::test_call_order src/controller_test.cpp:31	Calls are served in the order received	req_dispatch

Realisations in code

Realisation	Description	Carries out
SafetyMonitor src/controller.cpp:27	The safety monitor realises the design decision recorded in model/elevator.sbdl	safety_monitor_design func_emergency_stop
Dispatcher_register_call src/controller.cpp:98	The dispatcher's call registration realises the first step of the normal ride	func_normal_ride

Captured runs of the controller (logs/) are checked against the functions and the state machine by sbdl -m trace:verify as part of the build; a run that deviates from the model fails the build.

Model Overview

24 aspect3 customtype4 definition22 event3 fmea:cause4 fmea:control3 fmea:detection3 fmea:effect3 fmea:mode4 function1 group2 interface2 realisation8 requirement5 SafetyAction5 SafetyRequirement3 Sensor8 state3 test9 transition2 usecase