Introduction to Alloy

• all (F holds for every x in E — cf. ∀)
• some (F holds for some x in E — cf. ∃)
• no (F holds for no x in E)
• lone (F holds for at most one x in E)
• one (F holds for exactly one x in E — cf. ∃¹)

sig Element {}
sig Set { elements : set Element }
assert Closed {
  all s0, s1 : Set | some s2 : Set |
    s2.elements = s0.elements + s1.elements
}
check Closed

(∃ x)(king-of-france(x)
∧ (∀ y)(king-of-france(y) ⇒ x = y)
∧ bald(x))

(∃¹ x)(king-of-france(x) ∧ bald(x))

(℩ x)(king-of-france(x) ∧ bald(x))

one x | king-of-france[x] and bald[x]

• x = s₁ -> s₂ -> ... -> s_n
• y = t₁ -> t₂ -> ... -> t_n

• x . y = s₁ -> s₂ -> ... -> s_{n - 1} -> t₂ -> ... -> t_n

• x . y = none (i.e. the empty set)

• For each pair x -> y | x in r and y in s,
• include x . y if it exists.

• r . s = { z | some x : r, some y : s | z = x . y }

• Dot-join is position, natural join works by name.
• Dot-join drops the matching atoms, natural join keeps one.

• ~R = {x, y | y -> x in R}
• i.e. ~R = inverse of R (often written R^-1)

• S.~R = R.S (image of set S, back through R)
• (x -> y) ∈ R.~R iff ∃ z | x -> z + y -> z in R
• So child_parent . ~child_parent = sibling relation
• R.~R in iden: R is injective*
• ~R.R in iden: R is a function*

all x, y, z : univ | 
    ( (x -> y in R)
      and (y -> z in R))
    implies
    (x -> z in R)

^R = R + R.R + R.R.R + R.R.R.R + ...

ancestor = ^parent
descendant = ^child

all a : univ | a -> a in R

iden in R

*R = ^R + iden

*R = iden + R + R.R + R.R.R + ...

• S <: R = tuples in R beginning with a member of S
• R :> S = tuples in R ending with a member of S

• every member of R that does not match a member of S
• every member of S

• work number, if we have it
• home number, if we have no work number

single = {p : Person | no p.spouse}
childless = {p : Person | no p.children}
descendants = { a, d : Person | d in a.^children }

sig Person {
  mother : lone Person,
  father : lone Person
}
fun children [p : Person] : set Person {
  let parent = mother + father | parent.p
}
fun descendants[p : Person] : set Person {
 let parent = mother + father | ^parent.p
}
fun descendants2[p : Person] : set Person {
 let ch = {p, ch : Person | ch in children[p]} | 
     p.^ch
}
assert desc_equiv { all p : Person | 
  descendants[p] = descendants2[p]
}

abstract sig person {}
sig Man, Woman extends Person {
  mother : lone Woman,
  father : lone Man
}
fact biology {
  all p : Person | 
    { (some p.mother iff some p.father)
      (some p.(mother + father) 
       implies
       p.mother != p.father)
}
fact ancestry {
  no p : Person | p in p.^(mother + father)
}
fact adam_eve {
  one adam : Man | no adam.mother and no adam.father
  one eve : Woman | no eve.mother and no eve.father
}

abstract sig person {}
sig Man, Woman extends Person {
  mother : lone Woman,
  father : lone Man
}{
  (some mother iff some father)
  (some (mother + father) 
   implies
   mother != father)
   not (p in ^(@mother + @father)
}
fact adam_eve {
 one adam : Man | no adam.mother and no adam.father
 one eve : Woman | no eve.mother and no eve.father
}

sig A { ... } { F }

sig A { ... }
fact { all this : A | F′ }

• F′ is just like F except:
• each field f declared in A or a subtype is expanded to “this.f”
• unless it is written @f

sig person {
  mother : lone Woman,
  father : lone Man
}
pred fatherless [ p : person ] {
  no p.father
}

pred fatherless [ p : person ] {
  no p.father
}
run fatherless for 3
run fatherless for 10

sig Person {
  mother : lone Person,
  children : set Person
}{
  not (this in this.^@mother)
}
// Check that that signature fact means what we think:
assert no_self_ancestor {
  no p : Person | p in p.^mother
}
check no_self_ancestor for 10

fact mother_and_child {
  all m, c : Person | c in m.children iff m in c.mother
}
// That means that 'mother' = 'children' ** -1
assert mother_child_inverse {
  mother = ~children
  children = ~mother
}
assert no_self_descendant {
  no p : Person | p in p.^children
}
check mother_child_inverse for 10
check no_self_descendant for 10

sig element {
  r, s : set element
}
assert transpose { r = ~s iff s = ~r }
check transpose for 10

• arguments
• a bounding expression for result
• an expression to evaluate

sig Person {
  mother : lone Person,
  father : lone Person
}

fun children [p : Person] : set Person {
  mother.p + father.p
}
assert children_alternatives {
  all p : Person | children[p] = (mother + father).p
  all p : Person | children[p] = p.~(mother + father)
}
check children_alternatives for 10
fun descendants[p : Person] : set Person {
  ^(mother + father).p
}

• relation names (used as predicates)
• tuples from quantified variables

all n : Name, d, d' : Address |
  n -> d i address and n -> d' in address
  implies 
  d = d'

all n : Name | lone n.address

no ~address.address - iden

address in Name -> lone Address

sig AddressBook {
  address : Name -> lone Address
}