Éclair: An elevator group controller model checking system based on S-ring and SPIN

We developed a model checking system for elevator group controllers, named Éclair. Éclair can perform model checking of a given S-ring model by invoking SPIN. In this paper, we described how to convert the S-ring model into a SPIN's input model. We also showed the test capability of Éclair from the viewpoint of scalability.