Why elevator design tests state machines in LLD - Why This Architecture

Problem Statement

Elevator systems often fail when unexpected sequences of button presses or sensor inputs cause the elevator to behave erratically or get stuck. Without a clear model of states and transitions, it is hard to predict or test all possible behaviors, leading to safety risks and poor user experience.

Solution

Modeling the elevator as a state machine breaks down its behavior into clear states (like moving up, moving down, idle, door open) and defines allowed transitions triggered by events (like button press or arrival at a floor). Testing this state machine ensures all transitions work correctly and unexpected states are avoided.

Architecture

Idle

→Moving Up

↓

Door Open

This diagram shows the elevator states and how button presses or floor arrivals cause transitions between Idle, Moving Up, Moving Down, and Door Open states.

Trade-offs

✓ Pros

→

Provides a clear, testable model of elevator behavior.

→

Helps catch edge cases and invalid transitions early.

→

Improves safety by preventing undefined states.

→

Simplifies debugging by tracing state transitions.

✗ Cons

→

Requires upfront design effort to define all states and transitions.

→

Can become complex if too many states or events exist.

→

May need updates if elevator features change.

Use when designing any system with distinct modes and event-driven transitions, especially for safety-critical or user-interactive systems like elevators.

Avoid if the system is extremely simple with no complex state changes or if the overhead of modeling states outweighs benefits, such as a single-button device with no modes.

Real World Examples

Otis Elevator Company

Uses state machines to model elevator control logic ensuring safe door operations and movement sequencing.

Thyssenkrupp

Implements state machine testing in their elevator software to handle complex scenarios like emergency stops and priority overrides.

Schindler Group

Employs state machine models to simulate and verify elevator behavior before deployment to reduce field failures.

Code Example

The before code uses simple flags and conditions without clear states, which can lead to inconsistent behavior. The after code defines explicit states and transitions, making the elevator's behavior predictable and easier to test.

LLD

### Before: No state machine, simple conditional logic
class Elevator:
    def __init__(self):
        self.floor = 0
        self.moving = False
        self.direction = None

    def press_button(self, target_floor):
        if target_floor > self.floor:
            self.direction = 'up'
            self.moving = True
        elif target_floor < self.floor:
            self.direction = 'down'
            self.moving = True
        else:
            self.moving = False

    def arrive_floor(self, floor):
        self.floor = floor
        self.moving = False
        self.direction = None


### After: Using state machine
from enum import Enum, auto

class State(Enum):
    IDLE = auto()
    MOVING_UP = auto()
    MOVING_DOWN = auto()
    DOOR_OPEN = auto()

class Elevator:
    def __init__(self):
        self.state = State.IDLE
        self.floor = 0

    def press_button(self, target_floor):
        if self.state == State.IDLE:
            if target_floor > self.floor:
                self.state = State.MOVING_UP
            elif target_floor < self.floor:
                self.state = State.MOVING_DOWN

    def arrive_floor(self, floor):
        self.floor = floor
        if self.state in (State.MOVING_UP, State.MOVING_DOWN):
            self.state = State.DOOR_OPEN

    def close_door(self):
        if self.state == State.DOOR_OPEN:
            self.state = State.IDLE

Alternatives

Event-driven programming without explicit state machines

Handles events directly without modeling states explicitly, relying on conditional logic.

Use when: Choose when system states are simple and event handling logic is straightforward without complex transitions.

Rule-based systems

Uses rules to trigger actions based on conditions rather than explicit states and transitions.

Use when: Choose when behavior depends on many independent conditions rather than sequential states.

Summary

Elevator failures often come from unclear or untested sequences of states and events.

Modeling elevators as state machines clarifies behavior and enables thorough testing of all transitions.

State machines improve safety, predictability, and maintainability of elevator control software.