Elevator control software can be model-checked to verify both safety properties, like "The cabin never moves with its door open", and liveness properties, like "Whenever the nth floor's call button is pressed, the cabin will eventually stop at the nth floor and open the door".