基于《Software Abstraction》附录C，如何推导Alloy Kernel的`one`约束？

Great question—this is a classic "aha!" moment when working through Daniel Jackson's Software Abstractions (2nd Ed.) Appendix C. Let's break this down step by step, building on what you already know.

First, let's recap what you've got so far:

• no expr maps directly to the kernel construct expr = none (the expression evaluates to the empty set)
• some expr is the negation of that: ¬(expr = none) (the expression is non-empty)

Deriving one expr #

The one constraint means "the expression evaluates to a set with exactly one element". To express this using kernel constructs, we need to combine two conditions:

1. The set is non-empty (we already know this is ¬(expr = none) or some expr)
2. All elements in the set are identical (there are no distinct elements)

Putting these together, the kernel equivalent of one expr is:

some expr ∧ (all x, y: expr | x = y)

Or, using the no definition you already know:

¬(expr = none) ∧ (all x, y: expr | x = y)

Another way to frame this is using existential uniqueness: "there exists some element in expr, and every element in expr is that same element". That translates to:

some x: expr | all y: expr | y = x

This is logically equivalent to the first formulation, and both rely solely on kernel constructs (negation, conjunction, universal/existential quantification, set membership, equality).

Deriving lone expr #

The lone constraint means "the expression evaluates to a set with 0 or 1 elements". We can build this directly from no and one:

no expr ∨ one expr

Substituting the kernel equivalents we have:

(expr = none) ∨ (¬(expr = none) ∧ (all x, y: expr | x = y))

But we can simplify this! A handy quirk: the universal quantifier all x, y: expr | x = y is vacuously true when expr is empty (since there are no elements to violate the condition). So lone expr can be written more concisely as:

all x, y: expr | x = y

This single expression covers both the empty set (vacuous truth) and the single-element set (all elements are identical).

Key Point You Might Have Missed #

The critical piece here is that the kernel doesn't include a direct "cardinality = 1" operator—you have to combine existence (via some/negation of no) with uniqueness (via universal quantification to enforce all elements are the same). It's easy to overlook that the uniqueness condition alone covers the "at most one" case (for lone), and adding the non-empty condition gives you "exactly one" (for one).

内容的提问来源于stack exchange，提问作者Jouke Stoel