iTechGuides is reader-supported. When you buy through links on our site, we may earn an affiliate commission. As an Amazon Associate I earn from qualifying purchases. Learn more
Rewrite a phase-change rule in Alloy by separating three jobs: represent the current phase with mutable state, define a legal transition from the current state to the next state, and constrain the resulting trace with temporal operators. In Alloy 6, a var declaration makes a signature or field mutable, and a prime (') refers to its value in the next state. Predicates and facts supply the semantics that the Analyzer checks; a macro only reuses syntax.
This distinction matters when a model appears to “rewrite” a rule. Replacing a predicate with a macro can make a specification shorter, but it does not create a new transition semantics or make the Analyzer search a larger space. Alloy explores finite traces under the scope and step limit you choose, so every conclusion must be read in that bounded context.
What a phase-change rewrite means in Alloy
Alloy is both a relational modeling language and an exploration tool. A phase transition is therefore not an assignment in an imperative program. It is a relation between two adjacent states in a trace. The model says which combinations of atoms and field values are allowed now and which combinations are allowed next; the Analyzer searches for traces satisfying those constraints.
For a phase model, a rewrite normally means one of two things:
#1 Best Overall
- Read Before You Buy — No Video Output: These adapters support charging and USB 2.0 data transfer, but cannot transmit video signals. Except for standard USB webcams (which use USB data only), they are not compatible with HDMI/DisplayPort cables, video-capable USB-C hubs, or docking stations with video output.
- Convert USB-A Ports to USB-C: Designed to connect USB-C earphones, cables, flash drives, card readers, and other USB-C accessories to standard USB-A ports. Plug-and-play with no drivers or software required.
- Aluminum Alloy Housing: Built with a sturdy aluminum alloy shell that aids in heat dissipation and protects against daily wear and scratches. Designed to maintain a stable and secure connection.
- Compact & Travel-Friendly: The ultra-compact design allows the adapter to stay plugged into your device without blocking adjacent ports or adding bulk, reducing wear and tear on your original USB ports.
- 12-Month Warranty: Backed by a 12-month manufacturer warranty for peace of mind. Designed to meet strict quality control standards for reliable everyday performance.
- Refactoring a transition expression into a predicate so it can be named, reused, and tested.
- Factoring repeated text, such as frame conditions, into a macro.
The first changes how the semantic rule is organized while retaining an explicit predicate invocation. The second is textual substitution with fewer safeguards than a predicate or function. The actual behavior still comes from relational and temporal constraints.
Represent phases and mutable state
Alloy 6 extends earlier versions with var. A mutable signature or field may have a different value in each state of a trace; declarations without var remain constant throughout that trace. Phase names are usually static atoms, while the system’s current phase is mutable.
abstract sig Phase {}
one sig Solid, Liquid, Gas extends Phase {}
one sig System {
var phase: one Phase
}The three phase atoms are fixed members of Phase. The field System.phase is mutable and always contains exactly one phase. Using a singleton system avoids accidentally modeling several independent machines when the intent is one machine.
Recommended Free Tools
Use a stable initial condition
An initial condition is a formula about the first state. Keep it separate from transition rules so that you can run scenarios from different starting phases.
pred startsSolid {
System.phase = Solid
}This predicate does not force later states. It can be supplied to a run command together with temporal requirements.
Write the legal transition relation
A transition predicate describes the current state and the next state simultaneously. The unprimed expression is the current value; the primed expression is the value after one step.
Rank #2
- 5-in-1 USB-C Hub: Experience comprehensive connectivity featuring a Power Delivery input, two USB-A 2.0 ports, a USB-A 3.0 port, and an HDMI port. (Note: The USB-C power delivery input port is only for connecting an external wall charger to power your laptop and cannot power peripheral devices.)
- 90W Pass-Through Charging: Achieve optimal charging with 90W pass-through power to your laptop, supported by a total input of 100W, with the hub reserving 10W for operational efficiency. (Note: Wall charger not included.)
- Quick Data Transfers: Accelerate your productivity with rapid data transfers using a high-speed 5Gbps USB 3.0 port and two 480Mbps USB 2.0 ports.
- 4K HDMI Display: Enhance your visual experience with a hub capable of delivering 4K resolution at 30Hz in both mirror and extend modes. Please note that this hub is compatible with MacBook (macOS 12 and newer), Windows 10 and 11, ChromeOS, and laptops equipped with DP Alt Mode and Power Delivery. Note: This device is not compatible with Linux.
- What You Get: Anker USB-C Hub (5-in-1, 4K HDMI), welcome guide, 18-month warranty, and our friendly customer service.
pred melt {
System.phase = Solid
System.phase' = Liquid
}
pred vaporize {
System.phase = Liquid
System.phase' = Gas
}
pred condense {
System.phase = Gas
System.phase' = Liquid
}
pred freeze {
System.phase = Liquid
System.phase' = Solid
}
pred hold {
System.phase' = System.phase
}These predicates are deliberately explicit. melt, for example, is false unless the current phase is Solid and the next phase is Liquid. hold is a frame transition that leaves the phase unchanged.
Do these 3 things before closing this tab:
1Repair Windows errors before they cause bigger problems2Scan for outdated or missing drivers - takes under a minute3Clear out junk files and repair common Windows errorsAllow only legal events
A transition predicate by itself does not constrain the trace. Put the allowed events under always in a fact, or invoke an equivalent temporal formula in a command.
fact LegalTransitions {
always (melt or vaporize or condense or freeze or hold)
}Without this fact, Alloy may choose arbitrary next values for System.phase, including transitions that were never intended. Conversely, if you omit hold, every step must change phase; that can make an otherwise reasonable scenario unsatisfiable.
Make events mutually exclusive when needed
The example events are mutually exclusive because their current-phase guards differ. If two events can be true in the same state, Alloy may choose either one at a step. Add an explicit exclusivity condition when the domain requires exactly one event:
fact ExactlyOneEvent {
always one e: Event | e.enabled
}If you do not have an event signature, an equivalent Boolean-style formulation is to state that one and only one named transition holds. Do not add exclusivity merely for style; nondeterministic choice is often the correct model of an underspecified environment.
State invariants and temporal requirements
Use temporal operators for obligations over the whole trace. always requires a formula in every state, eventually requires it at some future point, after shifts evaluation to the next state, and until relates a continuing condition to a future event.
Rank #3
- Sleek 7-in-1 USB-C Hub: Features an HDMI port, two USB-A 3.0 ports, and a USB-C data port, each providing 5Gbps transfer speeds. It also includes a USB-C PD input port for charging up to 100W and dual SD and TF card slots, all in a compact design.
- Flawless 4K@60Hz Video with HDMI: Delivers exceptional clarity and smoothness with its 4K@60Hz HDMI port, making it ideal for high-definition presentations and entertainment. (Note: Only the HDMI port supports video projection; the USB-C port is for data transfer only.)
- Double Up on Efficiency: The two USB-A 3.0 ports and a USB-C port support a fast 5Gbps data rate, significantly boosting your transfer speeds and improving productivity.
- Fast and Reliable 85W Charging: Offers high-capacity, speedy charging for laptops up to 85W, so you spend less time tethered to an outlet and more time being productive.
- What You Get: Anker USB-C Hub (7-in-1), welcome guide, 18-month warranty, and our friendly customer service.
Invariants with always
fact PhaseIsAlwaysValid {
always (System.phase in Phase)
}The field’s type and multiplicity already enforce this invariant in the simple model, but writing important domain rules explicitly can make counterexamples easier to understand. For a richer model, an invariant might say that a heater can be on only while the system is solid or liquid.
Progress with eventually
pred reachesGas {
startsSolid
eventually System.phase = Gas
}
run reachesGas for 3 but 8 stepsThe scope bounds the number of atoms; the step bound limits the trace length explored. A satisfying instance demonstrates one trace meeting these constraints. It does not show that every solid eventually becomes gas.
Ordering with until and after
pred solidUntilMelt {
System.phase = Solid until System.phase = Liquid
}
pred liquidThenGas {
System.phase = Liquid and after System.phase = Gas
}Choose the temporal operator that matches the requirement. “The system remains solid until it melts” is different from “it is solid now and will be liquid in the next state.” If a requirement is safety-critical, express both the trigger and the permitted response rather than relying on an informal reading of a transition predicate.
When a macro is the right rewrite
A macro is useful for repeated syntax, especially frame conditions that would otherwise be copied into every event. Macros are textual and have fewer safeguards than predicates and functions: they do not provide the same semantic boundary, and mistakes can be harder to localize.
macro keepPhase[] {
System.phase' = System.phase
}
pred idle {
@keepPhase[]
}The @ invocation marks a macro expansion. Treat the expanded result as if its body had been written at the call site. A macro should not hide a domain decision such as whether a transition is legal; keep that decision in a named predicate or fact.
Macro for a multi-field frame condition
one sig Machine {
var phase: one Phase,
var temperature: one Int,
var pressure: one Int
}
macro keepEnvironment[] {
Machine.temperature' = Machine.temperature
Machine.pressure' = Machine.pressure
}
pred holdPhase {
Machine.phase' = Machine.phase
@keepEnvironment[]
}This reduces duplication, but it also introduces coupling: every event that invokes the macro inherits both frame constraints. If a future event is allowed to change pressure, using this macro there would silently over-constrain the model. Prefer several small macros or an explicit predicate when different events have different frame policies.
Rank #4
- Dual Converters, Infinite Potential：Includes 2× USB C male to USB A female adapters and 2× USB A male to USB C female adapters. Perfect for a wide range of uses—tablets with Bluetooth keyboards, expand USB ports on macbook, and more. Two different converters for all your daily needs
- Next-Level 10Gbps & 3A Charging: No more slow 480Mbps, this usb to usb c adapter has a transfer speed of up to 10Gbps, allowing you to do more transferring in less time. This usb adapter fits both USB A and USB C charger, supporting up to 3A fast charging
- Upgraded Exquisite Craftsmanship: With an aluminum alloy housing and metal connector, the usbc to usb adapter is extremely durable and sturdy. Rigorously tested to withstand more than 10,000 times of plugging and unplugging, ensuring long-lasting performance
- Broad Compatible: The usb c to usb adapter widely supports all USB C/ USB A devices like laptops, tablets, cellphones, car chargers, and phone chargers. Such as compatible with MacBook Pro/Air 2023/2022, Thunderbolt 4/3 Devices,Apple MagSafe Watch 9/8/7/SE/Ultra, iPad Pro 2022/2021, Samsung Galaxy S23/S20/S10, and iPhone 17/16/15 Pro. Plug and play
- Please Note: To reach 10Gbps speed, keep the cable under 3.3 ft. For USB A Male to USB C adapters, try flipping the USB C connector. USB C Male to USB A adapters support bidirectional 10Gbps transfer within 3.3 ft
Fact, predicate, assertion, function, or macro?
| Construct | Best use for phase rules | What the Analyzer does | Main caution |
|---|---|---|---|
| Predicate | Name a transition or scenario and invoke it where needed. | Checks the relational and temporal constraints in its body when invoked. | An unused predicate imposes no restriction. |
| Fact | State constraints that must hold in every analyzed instance or every state when wrapped in always. |
Automatically includes the constraint in commands. | A broad fact can make every command unsatisfiable and is harder to disable for experiments. |
| Assertion | State a property that should follow from the model, such as “gas is never reached directly from solid.” | Searches for a counterexample to the assertion. | A checked assertion is bounded by the selected scopes and steps. |
| Function | Compute a reusable relational expression, such as the set of allowed successors. | Substitutes the returned relation into constraints. | A function does not itself impose a transition. |
| Macro | Reuse repeated text or frame-condition syntax. | Expands the text before semantic analysis. | Fewer safeguards; expansion can obscure errors and over-constraints. |
Rewrite the model without changing its meaning
To refactor safely, preserve the same current-state guards, next-state assignments, frame conditions, and temporal placement. For example, these two formulations express the same one-step melt relation:
Free tools Windows power users keep installed
One-click scans. No signup required.
pred melt {
System.phase = Solid
System.phase' = Liquid
}
fact Allowed {
always (melt or hold)
}pred nextPhase[p, q: Phase] {
System.phase = p
System.phase' = q
}
fact Allowed {
always (nextPhase[Solid, Liquid] or hold)
}The parameterized version is more reusable, but it may be too permissive if it allows combinations that the physical process forbids. A generic successor predicate should be paired with an explicit allowed-transition relation, not treated as a complete model merely because it compiles.
Preserve frame conditions
When a model has additional mutable fields, every event must say what happens to fields it does not change. Otherwise Alloy is free to alter them between states.
pred melt {
System.phase = Solid
System.phase' = Liquid
System.temperature' > System.temperature
System.pressure' = System.pressure
}Here temperature is intentionally changed and pressure is intentionally held. If pressure should be unconstrained, omit the equality deliberately and document that nondeterminism; do not assume Alloy will preserve it automatically.
Run commands and inspect traces
Start with small scopes and short traces, then increase them when the model is stable.
Windows Errors? Fix Them Before They Spread
Repair common Windows errors and clear accumulated junk for a smoother, more stable PC - no reinstall needed.Free scan · no reinstallCrashes, No Sound, or Screen Glitches?
Random freezes, missing sound and display glitches usually trace back to one bad driver. Find and replace yours safely.Free scan · under a minute- Run a scenario with an initial phase and a required future phase:
run { startsSolid and eventually System.phase = Gas } for 3 but 8 steps - Run a predicate for a single transition when debugging guards:
run { startsSolid and melt } for 3 but 1 steps - Check a claimed invariant with an assertion:
assert NoDirectSolidGas { always not (System.phase = Solid and System.phase' = Gas) } check NoDirectSolidGas for 3 but 8 steps - Use the visualizer to move through the trace one state at a time. Compare the unprimed values in one state with the primed values implied for the next state.
Keep solver settings, scopes, and step bounds fixed when comparing two rewrites. Runtime differences are meaningful only under otherwise identical conditions; there is no general, evidence-based speedup from replacing a predicate with a macro.
Best Value
- 5-in-1 Connectivity: Equipped with a 4K HDMI port, a 5 Gbps USB-C data port, two 5 Gbps USB-A ports, and a USB C 100W PD-IN port. Note: The USB C 100W PD-IN port supports only charging and does not support data transfer devices such as headphones or speakers.
- Powerful Pass-Through Charging: Supports up to 85W pass-through charging so you can power up your laptop while you use the hub. Note: Pass-through charging requires a charger (not included). Note: To achieve full power for iPad, we recommend using a 45W wall charger.
- Transfer Files in Seconds: Move files to and from your laptop at speeds of up to 5 Gbps via the USB-C and USB-A data ports. Note: The USB C 5Gbps Data port does not support video output.
- HD Display: Connect to the HDMI port to stream or mirror content to an external monitor in resolutions of up to 4K@30Hz. Note: The USB-C ports do not support video output.
- What You Get: Anker 332 USB-C Hub (5-in-1), welcome guide, our worry-free 18-month warranty, and friendly customer service.
What an Alloy counterexample proves
When check finds a counterexample, it has found a concrete trace within the selected bounds that satisfies the model and violates the assertion. The trace is evidence that the assertion does not follow from those constraints at that scope and length. Inspect the first state where the property fails, then identify which event predicate allowed the transition.
A counterexample does not automatically identify a real-world failure. It may expose an omitted guard, a missing frame condition, an overly broad fact, or simply a behavior outside the intended scope. Conversely, when Alloy finds no counterexample, that is not unrestricted proof: the search covered only the chosen finite bounds. Increase atom scopes and step limits, and strengthen the model with domain assumptions when the result must support a broader claim.
Common phase-modeling failures and fixes
The phase changes without an event
Cause: no fact constrains the next state, or the event disjunction omits a frame rule. Fix: add always (event1 or event2 or hold) and ensure every event specifies the relevant next-state fields.
Quick wins for a faster PC:
Repair Windows errors before they cause bigger problemsFix Now →Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →No trace can reach the target phase
Cause: an initial guard conflicts with the first transition, a required event is missing, or the step bound is too short. Run the transition predicate alone, then increase the step bound gradually.
The assertion passes suspiciously quickly
Cause: the scope or step limit is too small, or a fact accidentally rules out all interesting states. Run a satisfiability command for the same model and inspect whether nontrivial traces exist.
A macro makes unrelated events fail
Cause: the macro expands frame conditions that are not valid for every caller. Split the macro, replace it with a predicate, or write the exceptional field update explicitly.
A rewrite appears faster
Do not infer a universal performance benefit. Measure both versions with the same command, scope, solver, symmetry settings, and step bound. Readability, reuse, explicitness, and counterexample quality are often more important than an unverified timing difference.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
A practical decision checklist
- Declare phase atoms as static signatures and the current phase as a
varfield. - Write one predicate per meaningful transition, including current-state guards and next-state values.
- Add explicit frame conditions for mutable fields that must not change.
- Use
alwaysfor invariants and legal-event scheduling; useeventuallyoruntilonly for genuine progress or ordering requirements. - Use macros for short, repeated syntax whose expansion is safe for every caller.
- Use predicates for semantic rules and assertions for properties you want the Analyzer to challenge.
- Record the atom scope and step bound with every result.
- Interpret satisfying traces as witnesses and counterexamples as bounded violations, never as unrestricted proofs.
The reliable rewrite pattern is therefore: mutable state, explicit current-to-next transition predicates, temporal facts, and carefully bounded commands. A macro can make that pattern easier to maintain, but it cannot replace the constraints that give a phase-change model its meaning.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
