doubly linked list in alloy -

I was trying to reverse a double link list in alloy, I made a signature for it. This sign is

  sig node {} / / defines each region as a separate subset of node sign first node {} sig last extended node {} sig element extended node {} Sig doublylinkedlist {head: First of all, // define a head pointer tap: one last, // define a null pointer object: set element, elements of linked links link: ele- & gt; Ele, // path between the elements of a link list headpoint: head-> An ele, // head link indicates an element of the list nullpoint: ele- & gt; Null // link to an element of the list of links to zero} {a link & amp; IDE // A self-clarification indicates a nullpoint // only one element for zero links = links + can be used to link / element elements / all elements E: ele | E. (^ (Link)) = ele // element all are connected e: elephants | A R: head, N: empty. (R-> E) in headpoint = & gt; (E-> N) can not be pointed by the head in the answerpoint / element. All E: Eel can not be pointed out. # (E. (links)) and (3) link (A link). & Lt; 3/3 elements can not draw more than 3 drawings and more than 3 audiogies all. A R: Head | (R-> E) in headpoint = & gt; # (Link). E) = 1 & amp; Amp; # (E. (Links) = 1/1 The element is pointed out by the head, involuntary and unbiased 1 All E: elephants | An N: Empty | (E-> N) in nullpoint = & gt; # (Link). E) = 1 & amp; Amp; # (E. (links) = 1 // is inductive and pointless to pointing to the principle 1} Reverse the reverse for {1} double linklist, actually 4 elements, exactly 1 before, exactly 1 last, fine 0 node   
 The problem is that when I actually run for 8 elemnts, returns the desired result. After that it shows examples where there is more than 3 indecisive and 3 titles in one element.   
 
 
 My first impression is that this problem is very complex for this problem, and I want to debug it Instead, I suggest writing again.  
 There are some unrelated comments about your model here  
 
 
 Instead of using  exactly 1  in a particular statement, you   
      
 In a definitive description , you can use the  abstract sig  in the same SIG declaration (for example,  abstract sig node   Absolutely 0 nodes    
 
 I actually use "first", "last", and "element" to separate a The type of nodes that do not look good cause; I will use a  node  signature instead;   
 
 both  head: one first  And  headquarters: head -> one ele  seems unnecessary. If the same head node is intended, then you should only  head: one node ;   
 
 Similarly, using  one r: head  in one of your attached FAs, CTS is also unnecessary, because you know that the  head  Absolutely a node (which is your mother Always  that is going to be a nuclear first ) to point to, so  r  is always going to be that node.    
 I do not know that there is a strong reason to model your list in this way. My first approach will be something more in object-oriented style, e.g.,  
  sig node {next: alone node, ex: alone node} sig DLinkedList {head: lone node} ...   
 If you want your nodes to exist independently from the list of double links (i.e., define all the necessary relationships in  DLinkedList  sig, which is exactly BTW Is okay), I still do not use special  before  and  last  sub-messages Reggae maybe something like  
  sig node {} sig DLinkedList {head: single node, tail: single node, nxt: node - & gt; Single node, prv: node - & gt; Single node, nodes: set node} {nodes = head * Nxt = some nodes = & gt; Not a tail ^ nxt & amp; Iden // no cycles nxt = ~ prv // symetric no prv [head] // head has no prv no nxt [tail] // tail has no nxt near. ^ Nxt = Node. ^ All nodes in nxt // nxt are accessible from head} predecessor [DL, DL ']: DLinkedList] {dl'.head = dl.tail dl'.tail = dl.head dl'.nxt = dl.prv} { Some DL, DL 'play DLinkedList} reverse [DL, DL] / / / any other lists or nodes #DLinkedList = 2 nodes = DLinkedList.nodes}     Do not make