1. Encapsulation in Alloy
Roger L. Costello
March 10, 2018

2. How to implement encapsulation in Alloy?
The util/ordering module uses encapsulation: you call the module with a set and then you suddenly have all these functions available on the set: first, last, next, prev, etc.
You are shielded from how the ordering module implemented those functions.
That’s encapsulation.

3. Benefits of encapsulation
Use encapsulation when creating Alloy models.
A benefit of encapsulation is that you can redesign an encapsulation module without impacting other parts of the model.

4. Here’s how to implement encapsulation
Create a module.
Either have users pass in a set via a module parameter, or, create the set within the module.
Create an internal representation, using the private keyword.
Create operations (pred and fun) on the set.
Then, users operate on the set through the operations provided by the module.

5. Example that illustrates encapsulation in Alloy
Create a module for the colors of a traffic light.
The set of colors (red, yellow, green) are defined in the module and are public.
The sequence in which the colors change (e.g., a red light changes to a yellow light which changes to a green light which changes back to a red light) is private.
The module provides a function (fun) that users call to get the next color.

6. Here is a module that implements encapsulation
module traffic_light_color
private one sig Color_Sequence { Next: Color -> Color } { Next = red -> yellow + yellow -> green + green -> red }
fun next : Color -> Color { Color_Sequence.Next }
abstract sig Color {} one sig red extends Color {} one sig yellow extends Color {} one sig green extends Color {}

7. Here is a sample use of the module
open traffic_light_color open util/ordering[Time]
sig Time {}
sig Traffic_Light { color: Color one -> Time } { all t: Time - first | color.t = traffic_light_color/next[color.(t.prev)] }
run {}

8. open traffic_light_color open util/ordering[Time] sig Time {}
sig Traffic_Light { color: Color one -> Time } { all t: Time - first | color.t = traffic_light_color/next[color.(t.prev)] }
run {}
This qualifies “next” to indicate that we want the “next relation” in the traffic_light_color module, not the “next relation” in the ordering module.