Question

I am really confused over why there is always a counter example to my following assertion.

//assertions must NEVER by wrong
assert Symmetric{
all r: univ -> univ | some ~r iff (some x, y: univ | x not in y and y not in x and 
                                  (x->y in r) and (y->x in r))
}

check Symmetric

The counter-example always shows 1 element in univ set. However, this should not be the case since I specified that there will be some ~r iff x not in y and y not in x. The only element should not satisfy this statement.

Yet why does the model keep showing a counterexample to my assertion?

---INSTANCE---
integers={}
univ={Univ$0}
Int={}
seq/Int={}
String={}
none={}
this/Univ={Univ$0}
skolem $Symmetric_r={Univ$0->Univ$0}

Would really appreciate some guidance!

Answer 1

In Alloy, assertions are used to check the correctness of logic sentences (properties of your model), not to specify properties that should always hold in your model. So you didn’t specify that

there will be some ~r iff x not in y and y not in x

you instead asked Alloy whether it is true that for all binary relations r, some ~r iff x not in y and y not in x [...], and Alloy answered that it is not true, and gave you a concrete example (counterexample) in which that property doesn’t hold.

A couple other points

• some ~r doesn’t mean “r is symmetric”; it simply means that the transpose of r is non-empty, which is not the same. A binary relation is symmetric if it is equal to its transpose, so you can write r = ~r to express that;

• instead of some x, y: univ | x not in y and y not in x and [...] you can equivalently write some disj x, y: univ | [...];

• however, that some expression doesn’t really express the symmetry property, because all it says is that “there are some x, y such that both x->y and y->x are in r”; instead, you want to say something like “for all x, y, if x->y is in r, then y->x is in r too”.