Removing redundant multiplicity constraints in UML class models

Abstract

Models are central for the development and management of complex systems. In order to be useful along the entire life cycle of software they must provide reliable support and enable automatic management. For that purpose, they must be precise, consistent, correct, and be subject to stringent quality verification and control criteria. Model automation calls for deep formal study of models, so that tools can provide inclusive support to users. This paper deals with optimization of multiplicity constraints in Class Models, i.e., models that provide abstraction on the static structure of software. The paper introduces an in-depth analysis of redundancy of multiplicity constraints, i.e., multiplicities that cannot be realized in any legal instance. The analysis includes: (1) a formal study of gaps of redundancies in multiplicity intervals; (2) algorithmic and rule-based methods for removing redundancies in multiplicity constraints; (3) a formal study of completeness of the algorithmic procedures, with respect to most UML class model constraints. The algorithmic procedures are implemented in our FiniteSatUSE tool. To the best of our knowledge, there is no previous study of properties of multiplicity redundancy, no completeness analysis of tightening methods, and no systematic study of these features with respect to most UML class model constraints.

Appendices

Appendix: Correspondence between the class model definition and the UML 2.5.1

The correspondence between the formal definition of the class model as provided in Section 2 and the definition of the UML 2.5.1 can be shown by mapping elements of the formal definition to clauses in the UML definition:

• Class symbols (the set $\mathcal {C}$) correspond to classes of the UML (clause 11.8.3 in [7]);

• Property symbols (the set $\mathcal {P}$) correspond to properties that are owned by associations in the UML (clause 9.9.17 in [7]);

• Association symbols (the set $\mathcal {A}$) correspond to associations in the UML (clause 11.8.1 in [7]);

• Multiplicity symbols (the set $\mathcal {M}$) correspond to multiplicity elements in the UML (clause 7.5.3.2 in [7]), and the min, max mappings correspond to the lower, upper multiplicity descriptors in the UML;

• Qualifier symbols (the set $\mathcal {Q}{att}$) correspond to properties that are owned by association properties in the UML and attribute symbols (the set $\mathcal {A}{tt} - \mathcal {Q}{att}$) correspond to properties that are owned by classes in the UML (clause 9.9.17 in [7]);

• Data type symbols (the set $\mathcal {D}T$) correspond to data types in the UML (clause 10.5.2 in [7]);

The constraints in our formal specification present some syntactic and semantic deviations from the UML 2.5.1 specification. The syntactic specification reflect the different goals of the two definitions. While the UML 2.5.1 specification allows for empty GS or union constraints, we require at least two subclasses in a GS constraint and at least two properties in a union constraint, since otherwise the constraint does not impose any semantic restriction.

For subsetting and redefinition constraints, we do not require symmetric syntactic specifications, although, as shown in [3], the symmetric constraints must hold in every legal instance, and therefore, are derived. The xor constraint is introduced due to its high frequency in UML modeling, although it is not an official constraint in the UML 2.5.1.

The semantics of aggregation/composition constraints as defined in the next “Appendix B,” is more restrictive than that of the UML 2.5.1. Aggregation in this paper corresponds to shared aggregation from UML 2.5.1, with the additional restriction that there are no cycles of aggregated objects. Composition in this paper corresponds to aggregation in this paper restricted to composite aggregation from UML 2.5.1. The more restrictive semantics is motivated by the part-whole semantics in the theory of Mereology.

Appendix: Formal set-theoretic semantics of class models

1.1 Symbol denotation

• 1. Classes For $C \in \mathcal {C}$, $C^I$, the extension of C in I, is a set of elements in the semantic domain. The elements of class extensions are called objects.

• 2. Attributes (non-qualified) The denotation of an attribute is a higher-order function that maps a class symbol to a function from the class extension to the domain of the data type of the attribute. That is, for class $C \in \mathcal {C}$ and attribute $a \in att(C)$, $a^I(C) :C^I \rightarrow domain(dt_C(a))$ is a multi-valued function that satisfies: For every object $o \in C^I$, $min_C(a) \le |a^I(C)(o)| \le max_C(a)$.

• 3. Properties For $p \in \mathcal {P}$, $p^I$ is a multi-valued function from its source class to its target class: $p^I :{source(p)}^I \rightarrow {target(p)}^I$. Restriction: Inverse properties denote inverse functions: $(p^{-1})^I = (p^I)^{-1}$.

• 4. Associations For $a \in \mathcal {A}$, $a^I$ is a binary relationship on the extensions of the classes of a. If $props(a) = \langle p_1 , p_2 \rangle$, then since $p_1 = (p_2)^{-1}$, their denotations are inverse functions of each other: $p_1^I = (p_2^I)^{-1}$, and vice versa. The association denotes all object pairs that are related by its properties: $a^I = \{(e, e') \mid e \in {target(p_1)}^I, ~e' \in {target(p_2)}^I,~ p_2^I(e)=e'\}$. Elements of association extensions are links.

Fig. 32

An instance model for the class model in Fig. 5a

1.2 Constraints

• 1. Multiplicity constraints on properties

  • (a) Non-qualified properties For every $\texttt {\texttt {e}} \in {source(p)}^I$, $min(p) \le |p^I( \texttt {e})| \le max(p)$. The upper bound is ignored if $max(p) = *$.

  • (b) Qualified properties A qualified property denotes a mapping that refines the denotation mapping of the property. If $q_{att}(p) = \{q_1, \ldots , q_n\}$ and $q_{dt} (q_i ) = T_i ,~ i = 1\ldots n$, and $domain(T_i) = D_i$, then the mappings of $p^I$ are partitioned by a semantic function $q_p: {source(p)}^I \times D_1 \times \ldots \times D_n \rightarrow {target(p)}^I$ that satisfies:

    • i. For every $e \in {source(p)}^I$ and $d_i \in D_i ,~ i=1\ldots n$: $q_p(e, d_1, \ldots ,d_n) \subseteq p^I (e)$.

    • ii. For every $e \in {source(p)}^I$ and $d_i , d'_i \in D_i ,~ i=1\ldots n$, if for some $1 \le j \le n$, $d_j \ne d'_j$, then: $q_p(e, d_1, \ldots ,d_n) \cap q_p(e, d'_1, \ldots ,d'_n) = \emptyset$.

    • iii. For every $e \in {source(p)}^I$ and $d_i \in D_i ,~ i=1\ldots n$:

      $min(p, q_1, \ldots , q_n ) \le |q_p(e, d_1,\ldots ,d_n)| \le max(p, q_1, \dots , q_n )$. The upper bound is ignored if $max(p) = *$. Recall that if the domain of some $q_i$ is infinite, i.e., $cardinality(T_i) = \infty$, then $min(p, q_1, \ldots , q_n ) = 0$. In Fig. 5a, $p_8^I$ is partitioned by the function $q_{p_8} : A^I \times T \rightarrow E^I$, and $q_{p_8}(a_1, t_1)=e_2, q_{p_8}(a_1, t_2)=e_1$.

• 2. Association class For an association class C, $C^I$ is a set of elements in I and $pairs_C :C^I \rightarrow {(assoc_{ac}(C))}^I$ is a 1:1 and onto semantic mapping that maps every object in $C^I$ to a single link in the relation $(assoc_{ac}(C))^I$. In Fig. 32, $pairs_D(d_1)= (c_1,c_2)$.

• 3. Aggregation constraints Aggregation denotes part-whole relationships. Therefore, aggregation properties impose the no aggregate-object cycles constraint, i.e., cycles of aggregated objects are not allowed¹²:

  For aggregation properties $p_1^a,\ldots ,p_n^a$, and an object $\texttt {e}$, if ${p_n^a}^I({{p_{n-1}}^a}^I(\ldots ({{p_1^a}}^I(\texttt {e}))))$ is defined, then $\texttt {e}\notin {p_n^a}^I({{p_{n-1}}^a}^I(\ldots ({{p_1^a}}^I(\texttt {e}))))$.¹³

  Figures 33 and 34a present a class model and an illegal instance that includes an object cycle of aggregation/composition properties.

• 4. Composition constraints A composition property is also an aggregation property, and therefore composition constraints impose the no aggregate-object cycles constraint. In addition, a composition is a physical aggregation in which an object cannot be part of two different wholes. Indeed, a composition property is syntactically constraint to be single-valued. More generally, a composition property imposes the no multi-object-composition constraint, which states that if an object is a physical part (composition) of two wholes, then these wholes must be components of a single whole:

  For two composition properties $p_1^c, q_1^c$ and an object $\texttt {e}$ such that ${p_1^c}^I( \texttt {e}),~ {q_1^c}^I( \texttt {e})$ are defined, there are composition properties $p_2^c,\ldots ,p_n^c$, and $q_2^c,\ldots ,q_m^c$, such that ${p_n^c}^I ({{p_{n-1}}^c}^I (\ldots ({{p_1^c}}^I (\texttt {e})))) = {q_m^c}^I ({{q_{m-1}}^c}^I (\ldots ({{q_1^c}}^I (\texttt {e}))))$.¹⁴

  Figure 34b presents an illegal instance of the class model in Fig. 33, due to violation of the no multi-object-composition constraint.

• 5. Class hierarchy constraints A constraint $C_1 \prec C_2$ denotes a subset relations between the class extension: ${C_1}^I \subseteq {C_2}^I$.

• 6. Generalization-set constraints A GS constraint $GS(C, C_1, \ldots , C_n;$Const) imposes class hierarchy constraints among the subclasses and the superclass, and set constraints among the subclasses. That is:

  • (a) Class hierarchy For $i = 1 \ldots n$, $C_i \prec C$;

  • (b) Set constraints

    • i. $Const =$disjoint:$C_i^I \cap C_j^I = \emptyset , \forall i,j = 1 \ldots n$;

    • ii. $Const =$overlapping: For some $i,j = 1 \ldots n$, it might be $C_i^I \cap C_j^I \not = \emptyset$;

    • iii. $Const =$complete:$C^I = \bigcup \nolimits _{i=1}^{n} {C_i^I}$;

    • iv. $Const =$incomplete: $\bigcup \nolimits _{i=1}^{n} {C_i^I} \subseteq C^I$.

• 7. Subsetting constraint For $p_1, p_2 \in \mathcal {P}$, $p_1 \prec p_2$ states that $p_1$ is a sub-mapping of $p_2$, i.e., for $\texttt {e}\in source(p_1)^I$, ${p_1}^I ( \texttt {e}) \subseteq {p_2}^I ( \texttt {e})$. The semantics of subsetting requires the syntactic restrictions that for $p_1 \prec p_2$, the source and target classes of $p_1$ are descendant subclasses of the source and target classes of $p_2$, respectively, and the maximum cardinality of $p_1$ can only restrict that of $p_2$. Moreover, in [3] we show that the subsetting constraint is symmetric with respect to the inverse properties. That is, if $p_1 \prec p_2$ then also $p_1^{-1} \prec p_2^{-1}$.

• 8. Redefinition constraint Redefinition strengthens subsetting with a requirement that the redefining property overrides the redefined property [3]. That is, for $p_1, p_2 \in \mathcal {P}$,  $p_1 \vartriangleleft p_2$ states that for objects in the source class of the redefining property $p_1$, the redefined property $p_2$ is equal to $p_1$. Formally, for $\texttt {e}\in source(p_1)^I$,  ${p_2}^I ( \texttt {e}) = {p_1}^I (e)$. This definition implies the following constraints:

  • (a) Type redefinition For object $\texttt {e}\in source(p_1)^I,~$${p_2}^I(\texttt {e}) \subseteq target({p_1})^I$.

  • (b) Multiplicity redefinition For object $\texttt {e}\in source(p_1)^I, min(p_1) \le |{p_2}^I(\texttt {e})| \le max(p_1)$, which implies the syntactic restriction that the multiplicity interval of $p_1$ is included in that of $p_2$.

• 9. Union constraint Property union means that the union property combines all the union component properties. That is, for $p, p_1, \ldots , p_n \in \mathcal {P}$, $p = union(p_1, \ldots , p_n)$, means that for every object $\texttt {e}\in source(p)^I$, $p^I(\texttt {e}) = \bigcup \nolimits _{i=1, \texttt {e}\in source(p_i)^I}^n p_i^I(\texttt {e})$.

• 10. Association hierarchy Association hierarchy means link inclusion, following the property ordering as specified in the constraint. That is, for $a_1, a_2 \in \mathcal {A}$, $\langle a_1, p_1, q_1 \rangle \preceq \langle a_2, p_2, q_2 \rangle$ requires that for every object $\texttt {e}\in source(p_1)^I$, $p_1^I(\texttt {e}) \subseteq p_2^I(\texttt {e})$, and for every object $\mathtt{d} \in \mathtt{source}{} \mathtt{(q}_\mathtt{1)}^\mathtt{I}$, $q_1^I(\mathtt{d}) \subseteq q_2^I(\mathtt{d})$. In [3] it is shown that association hierarchy is equivalent to subsetting.

• 11. Association-class hierarchy Association-class hierarchy is a regular class hierarchy, but also implies hierarchy of the associated associations. That is, for $C_1, C_2 \in \mathcal {C}$, $\langle C_1, p_1, q_1 \rangle \preceq \langle C_2, p_2, q_2 \rangle$ means $C_1 \prec C_2$, and if for $i=1,2$, $assoc_{ac}(C_i) = a_i$, then $\langle a_1, p_1, q_1 \rangle \preceq \langle a_2, p_2, q_2 \rangle$.

• 12. xor A xor constraint restricts the extensions of the xored properties, so that they are not defined on common objects. That is, for xor(p, q), an instance I, and an object $e \in base(xor(p,q))^I$, if $p^I (e) \ne \emptyset$ then $q^I (e) = \emptyset$, or vice-versa.

Fig. 33

A class model with aggregation and composition constraints

Fig. 34

Illegal instances of aggregation and composition constraints. a An illegal instance of Fig. 33 that violates the no aggregate-object cycles constraint; b an illegal instance of Fig. 33 that violates the multi-object-composition constraint

1.3 Existential constraints

The existential GS constraints impose the following restriction on the overall set of legal instances of a class model:

• 1. OverlappingGSconstraint$GS(C, C_1, \ldots , C_n; Const)$: There exists a legal non-empty finite instance I such that for some i, j, $C_i^I \cap C_j^I \not = \emptyset$;

• 2. IncompleteGSconstraint$GS(C, C_1, \ldots , C_n; Const)$: There exists a legal non-empty finite instance I such that $\bigcup \nolimits _{i=1}^{n} {C_i^I} \ne C^I$.

Appendix: Proofs

1.1 Proofs for Sect. 4.1

Lemma 1

Given a class model CM with an association $~ a(p_1 : C_1 [min_1 , max_1 ],~$${p_2 : C_2 [min_2 , max_2 ]})$ and a non-empty finite legal instance I such that $|C_2^I | \cdot min_1 < | C_1^I | \cdot max_2$. Then, the boundary cardinalities $min_2$ and $max_1$ are tight. Moreover,

• 1. There is a legal instance $I'$, with $|C_1^{I'} |= k \cdot |C_1^I|, |C_2^{I'} |= k \cdot |C_2^I |$, for some integer $k \ge 1$, such that for some $e \in C_1^{I'}$, $| p_2^{I'}(e) | = min_2$

• 2. There is a legal instance $I''$, with $|C_1^{I''} |= k \cdot |C_1^I|, |C_2^{I''} |= k \cdot |C_2^{I''} |$, for some integer $k \ge 1$, such that for some $e \in C_2^{I''}$, $| p_1^{I''}(e) | = max_1$

Proof

The proof of Claim 3.5 in [2] includes a procedure named Instance Construction that constructs a legal instantiation for known class and association sizes $|C_1^I |, |C_2^I |, |a^I |$ that satisfy

$$\begin{aligned} min_2 \cdot | C_1^I |\le & {} | a^I | \le max_2 \cdot | C_1^I |\\ min_1 \cdot | C_2^I |\le & {} | a^I | \le max_1 \cdot | C_2^I | \end{aligned}$$

These inequalities hold for I since it is a legal instance of CM. We know that if I is a finite legal instance of CM then its duplication by any positive integer number is also a finite legal instance. Furthermore, we know that in order to be legal, an instance needs only to satisfy the above inequalities. Therefore, if in a duplicated instance kI, $a^{kI}$ is reconstructed in a way that satisfies these inequalities, the resulting instance is still legal. We now select duplication integers, and reconstruct the extension of a in two different ways that realize the $min_2$ and $max_1$ cardinalities.

$\mathbf min _2$ :

If $min_2 = max_2$ then $min_2$ is boundary tight. Assume that $max_2 > min_2$. Let kI be a k duplicate of I. We now show how to choose k, and how to reconstruct $a^{kI}$ in this duplicate. The resulting instance is denoted $I'$, and the new association extension is $a^{I'}$. Connect one object from $C_1^{kI}$ to $min_2$ links of $a^{I'}$. We have to connect the remaining $|C_1^{kI}| -1$ objects to the remaining $a^{I'} - min_2$ links. By the Instance Construction procedure of [2] we know that there is a construction, provided that the inequalities are satisfied, i.e.,

$$\begin{aligned} min_2 \cdot ( k \cdot | C_1^I | - 1)\le & {} | a^{I'} | - min_2\\\le & {} max_2 \cdot (k \cdot | C_1^I | - 1) \end{aligned}$$

The other inequality stays intact as the whole set of links $a^{I'}$ has to be connected to the elements of $C_2^{I'}$. The resulting inequalities:

$$\begin{aligned} min_2 \cdot k \cdot | C_1^I |\le & {} | a^{I'} | \le max_2 \cdot k \cdot | C_1^I| - (max_2 - min_2 )\\ min_1 \cdot k \cdot | C_2^I |\le & {} | a^{I'} | \le max_1 \cdot k \cdot | C_2^I | \end{aligned}$$

Since $|C_2^I | \cdot min_1 < | C_1^I | \cdot max_2$, it is possible to select an integer $k>0$ and a size $| a^{I'} |$, such that the inequalities hold (for example, $k = max_2 - min_2 +1$). Then, let $I'$ be a k duplicate of I, with $a^{I'}$ being constructed as above. $I'$ is a legal instance of CM with $|C_1^{I'} |= k \cdot |C_1^I|, |C_2^{I'} |= k \cdot |C_2^I |$, in which $min_2$ is realized. Therefore, $min_2$ is boundary tight.

$\mathbf max _1$ :

If $min_1 = max_1$ then $max_1$ is boundary tight. Assume that $max_1 > min_1$. Let kI be a k duplicate of I. The new instance is denoted $I''$. For the $max_1$ case we start the construction from $C_2$. Connect one object from $C_2^{kI}$ to $max_1$ links of $a^{I''}$. We have to connect the remaining $|C_2^{kI}| -1$ objects to the remaining $a^{I''} - min_2$ links. By the Instance Construction procedure of [2] we know that there is a construction, provided that the inequalities are satisfied, i.e.,

$$\begin{aligned} min_1 \cdot ( k \cdot | C_2^I | - 1)\le & {} | a^{I''} | - max_1\\\le & {} max_1 \cdot (k \cdot | C_2^I | - 1) \end{aligned}$$

The other inequality stays intact as the whole set of links $a^{I''}$ has to be connected to the elements of $C_1^{I''}$. The resulting inequalities:

$$\begin{aligned}&min_2 \cdot k \cdot | C_1^I | \le | a^{I''} | \le max_2 \cdot k \cdot | C_1^I|\\&min_1 \cdot k \cdot | C_2^I | + (max_1 - min_1 ) \le | a^{I''} |\\&\quad \le max_1 \cdot k \cdot | C_2^I | \end{aligned}$$

Since $|C_2^I | \cdot min_1 < | C_1^I | \cdot max_2$, it is possible to select an integer $k>0$ and a size $| a^{I''} |$, such that the inequalities hold (for example, $k = max_2 - min_2 -1$). Then, let $I''$ be a k duplicate of I, with $a^{I''}$ being constructed as above. $I''$ is a legal instance of CM with $|C_1^{I''} |= k \cdot |C_1^I|, |C_2^{I''} |= k \cdot |C_2^I |$, in which $max_1$ is realized. Therefore, $max_1$ is boundary tight. $\square$

Claim 2

A finitely satisfiable class model $CM \in \mathcal {C}\mathcal {M}_{mul}$ is boundary tight if for every property p with $min(p) < max(p)$ there is no weight 1 cycle in graph(CM) through an edge labeled $\langle p, \_ \rangle$ or $\langle \_, p \rangle$ ($\_$ being a wild card).

Proof

Since CM is finitely satisfiable, all properties p for which $min(p) = max(p)$ are boundary tight. Let p be a property such that $min(p) < max(p)$, and assume that it is not boundary tight. We have to show that in graph(CM) there exists a cycle whose weight is 1 through an edge labeled with p. Let the association of p be $~ a(p_1 : C_1 [min_1 , max_1 ],~ {p_2 : C_2 [min_2 , max_2 ]})$, with p being $p_1$, and assume, without loss of generality that $max_1$ is not boundary tight. Consider the edge e from $n(C_1)$ to $n(C_2)$, labeled $\langle p_1, p_2 \rangle$ in graph(CM). Consider all cycles through this edge (there is at least one cycle, formed by the opposite edge labeled $\langle p_2, p_1 \rangle$). By Lemma 3 in [21], there is a path $\pi$ from $n(C_2)$ to $n(C_1)$ and a finite legal instance I such that $\frac{|C_1^I | }{|C_2^I | } = weight(\pi )$. Let $\gamma$ be the cycle that consists of $\pi$ and e. Then,

$$\begin{aligned} weight(\gamma ) = weight(\pi ) \cdot \frac{max_2}{min_1} = \frac{|C_1^I | }{|C_2^I | } \cdot \frac{max_2}{min_1} \end{aligned}$$

Assume that $weight(\gamma ) > 1$. Then

$$\begin{aligned} \frac{|C_2^I | }{|C_1^I | } < \frac{max_2}{min_1} \end{aligned}$$

By Lemma 1, $max_1$ is realized in an instance with class sizes $k \cdot |C_1^I |$ and $k \cdot |C_2^I |$, for $C_1, C_2$, respectively, for some integer $k \ge 0$. Create a new legal instance by duplicating I by that k, and replacing $a^I$ by the association that is constructed in the proof to the lemma. We get a new legal instance to CM, in which $max_1$ is realized, implying that it is boundary tight, in contradiction to the assumption. Since $weight(\gamma ) \ge 1$ (otherwise the class model is not finitely satisfiable), we conclude that $weight(\gamma ) = 1$. The case for $min_1$ is proved in the same way. $\square$

1.2 Proofs for Sect 4.2

Claim 4.  (Class hierarchy tightening)

For a class model CM in $\mathcal {C}\mathcal {M}_{mul,\prec }$, $remove_{CH}^{-1}({{\varvec{BT}}}( remove_{CH}(CM) ) ) \equiv CM$, and is boundary tight.

Proof

The proof is based on two inverse instance mappings defined in [2], where they are described in detail: A 1 : 1 mapping Tr from instances of CM to instances of $CM'$, and an inverse 1 : 1 mapping $Tr^{-1}$ from instances of $CM''$ to instances of $CM'''$.

Tr: For an instance I of CM, $I' = Tr(I)$ is defined as follows:

• 1. $I'$ includes all objects and links of I

• 2. For every class hierarchy $C_i \prec C_j$ in CM, and an object $\mathtt{o}_\mathtt{i} \in \mathtt{C}_\mathtt{i}^\mathtt{I}$ (and also $\mathtt{o}_\mathtt{i} \in \mathtt{C}_\mathtt{j}^\mathtt{I}$), add a new link $\langle \mathtt{o}_\mathtt{i} , \mathtt{o}_\mathtt{i}' \rangle \in \mathtt{isa}_{\mathtt{i,j}}^{\mathtt{I'}}$.

In [2] it is shown that Tr maps legal instances of CM to legal instances of $CM'$.

$Tr^{-1}$: For an instance $I''$ of $CM''$, $I''' = Tr^{-1}(I'')$ is defined as follows:

• 1. Insert into $I'''$ all objects and non-isa links of $I''$

• 2. Collapse every isa-connected structure of objects in $I''$, i.e., objects that are linked by the new isa links into a single object that belongs to the extensions of all classes in this hierarchy structure

Based on [2] we know that for a legal instance $I''$ of $CM''$ that satisfies the single class property, i.e., every isa object structure in $I''$ does not include two objects from the same class, $Tr^{-1}(I'')$ is a legal instance of $CM'''$. Moreover, it is also shown that every legal instance of $CM''$ that does not satisfy the single class property can be transformed into a legal instance that satisfies the single class property and preserves the sizes of class and association extensions.

• 1. Equivalence In order to show $CM \models CM'''$, i.e., every legal instance of CM is a legal instance of $CM'''$, we note that $Tr^{-1}(Tr(I)) = I$, since the mappings are inverse and 1 : 1. Let I be a legal instance of CM. Then Tr(I) is a legal instance of $CM'$, and since by Claim 3$CM' \equiv CM''$, Tr(I) is also a legal instance of $CM''$, and by the inverse equality, I is also a legal instance of $CM'''$. The other direction $CM''' \models CM$ is symmetric.

• 2. Boundary tightness$CM''$ is boundary tight. Therefore, every boundary cardinality of a property p is realized in some legal instance $I''$. If $I''$ satisfies the single class property, then by  [2] we know that $Tr^{-1}(I'')$ is a legal instance of $CM'''$, and by the definition of $Tr^{-1}$, it preserves the sizes of class and association extensions. Therefore, the boundary cardinality is also realized in $Tr^{-1}(I'')$, implying that p is tight in $CM'''$. If $I''$ does not satisfy the single class property, then by [2] we know that there is another legal instance of $CM''$ that does satisfy the property, and in which the boundary cardinality of p is realized. $\square$

Claim 5. (Qualifier tightening)

For a class model CM in $\mathcal {C}\mathcal {M}_{mul,qual}$,

$remove_{qualifier}^{-1}({{\varvec{BT}}}( remove_{qualifier}(CM) ) ) \equiv CM$, and is boundary tight.

Proof

Every instance of $CM'$ is also an instance of CM in which the set of $p'$ links (for an added property $p'$) are partitioned by the removed qualifier. Therefore, apart of qualifier partitions, the two class models are equivalent. The application of ${{\varvec{BT}}}$ to $CM'$ might tighten the new multiplicities, so that a maximum multiplicity of a property p is set to its minimum, or vice versa. In any case, the resulting multiplicity is a factor of $cardinality(q_{dt}(p))$. Therefore, the application of $remove_{qualifier}^{-1}$ to $CM''$ yields a well defined qualified property, which preserves all instances. Consequently, $CM'''$ is equivalent to CM, and is boundary tight. $\square$

Claim 6 (Association-class tightening)

For a class model CM in $\mathcal {C}\mathcal {M}_{mul,AC}$, $remove_{AC}^{-1}({{\varvec{BT}}}( remove_{AC}(CM) ) ) \equiv CM$, and

• 1. $CM''' = remove_{AC}^{-1}({{\varvec{BT}}}( remove_{AC}(CM) ) )$ is at least as boundary tight as CM, i.e., might have less boundary redundant properties.

• 2. If every association class AC in $CM'''$ has an association with point multiplicity intervals, i.e., $assoc_{ac}(AC) = a$, with $~ a(p_1 : C_1 [m_1],~ p_2 : C_2 [m_2])$, then $CM'''$ is boundary tight.

Proof

Equivalence$CM'$ is less constrained than CM, since for an association class in CM, the added associations in $CM'$ are derived in CM, while $CM'$ does not include the association-class constraint. Therefore, $CM \models CM'$. $CM''$ is equivalent to $CM'$, and $CM'''$ includes all the removed association-class constraints. Therefore, prior to the setting of the multiplicity constraints of associations of association classes, $CM'''$ is equivalent to CM.

For an association class AC, where $assoc_{ac}(AC) = a,~ props(a) = \{p_1, p_2 \}$, the added associations in $CM'$ and $CM''$ are derived from the association-class constraint. That is, if c is a non-redundant cardinality of $p_1$ ($p_2$), then it is also not redundant for $p_1'$ ($p_2'$), respectively. Therefore, if $p_1'$ ($p_2'$) is tightened by the BT algorithm, then setting the multiplicity of $p_1$ ($p_2$) to that of $p_1'$ ($p_2'$) does not affect the semantics. Alternatively, if $p_1$ ($p_2$) is tightened by the BT algorithm, then setting its multiplicity to that of $p'_1$ ($p'_2$) might just restore the original multiplicities (but this never happens – see below). In any case, the multiplicity setting does not affect equivalence.

Boundary tightness$CM''$ might include more boundary tight properties, due to the ${{\varvec{BT}}}$ algorithm. Therefore, if $p'_1$ ($p'_1$) in $CM''$ is tightened, then the setting of the multiplicity of $p_1$ ($p_2$) in $CM'''$ tightens $p_1$ (i.e., removes some boundary redundancy). If $p_1$ and $p_2$ in $CM''$ are tightened, then the derived properties $p'_1$ and $p'_2$ are also tightened in the same way. The reason is that if there is a simple cycle through the association of $p_1$ and $p_2$, then there is also a simple cycle through the two derived associations, with the same weight.

If all multiplicity intervals in associations of association classes are point intervals, then they are boundary tight (since $CM'''$ is finitely satisfiable), and therefore the addition of association class constraints in $CM'''$ does not create new cardinality redundancies. However, if some multiplicity interval in an association of an association class is not a point interval, it is possible that although the boundary cardinalities are realized in $CM''$, this might happen in instances that violate the association class constraint, and therefore, the boundary cardinalities are redundant in $CM'''$. $\square$

Proposition 5 (Breakable object cycles)

Given a class model CM with an association cycle $\alpha = a_1, \ldots , a_n$, i.e., $a_i(q_i:C_i, ~ p_i:C_{i+1})$ for $i = 1, n-1$, $a_n(q_n:C_n, ~ p_n:C_1)$, such that the following conditions hold:

• 1. properties $p_1, q_k, 1 \le k \le n$ in opposite directions have zero-minimum multiplicity, $min(p_1) = min(q_k) = 0$ with no zero minimum in between along the path $q_1, q_n, \ldots , q_{k+1}$, i.e., $min(q_i) > 0$ for $i = 1, n, n-1, \ldots , k+1$ (in Fig. 24$k=3$)

• 2. All inverse properties along the path $q_n, \ldots , q_{k+1}$ have 1 minimum multiplicity: $min(p_i) = 1$ for $i = n, n-1, \ldots , k+1$

• 3. Classes $C_1, C_n, \ldots , C_{k+1}$ along the path $q_1, q_n, \ldots , q_k$ do not participate in additional associations, beyond $a_1, a_n, \ldots , a_k$

Then, if CM has a legal instance I with an object cycle $\theta$ of $\alpha$, then it also has a legal instance $I'$ that breaks $\theta$ and preserves all other links of I.

Proof

Let $\theta = \mathtt{o_1}, \mathtt{o_2}, \ldots , \mathtt{o_1}$ be an object cycle of $\alpha$ in I. We construct $I'$ by initializing it with I, and applying the following transformation steps:

• 1. Remove link $\langle \mathtt{o_1}, \mathtt{o_2} \rangle$ from $\theta$. Removing a link from $o_1$ does not violate the multiplicity constraints of $p_1$ since $min(p_1) = 0$. If $k=1$, i.e., $min(q_1) = 0$, construction is finished since $I'$ is legal. Otherwise, continue with the next step.

• 2. Add a new object $\mathtt{e_1} \in \mathtt{C}_\mathtt{1}^{\mathtt{I'}}$ and a new link $\langle \mathtt{e_1}, \mathtt{o_2} \rangle \in \mathtt{a}_\mathtt{1}^{\mathtt{I'}}$, to compensate for the removed link. The multiplicity constraints of $a_1$ are satisfied.

• 3. For $i = n, n-1, \ldots k+1$, repeat the following step:

  For every new object $\mathtt{o}$ in $C_{i-1}^{I'}$ (for $i = n$ use $C_1^{I'}$):

  add new $min(q_i)$ objects to $C_i^{I'}$, and connect each new object $\mathtt{e}$ with a new link $\langle \mathtt{e}, \mathtt{o} \rangle \in a_i^{I'}$.

  The multiplicity constraints of $a_i$ are satisfied since every new object of $C_{i-1}^{I'}$ ($C_1^{I'}$ for $i = n$) is linked with $min(q_i)$ new objects of $C_i^{I'}$, and since $min(p_i) = 1$, every new object of $C_i^{I'}$ is already linked by $p_i$ to a single object.

At the end of the construction, $C_{k+1}^{I'}$ (or $C_1^{I'}$ if $q_k = q_n$) has multiple new objects that are not linked in $a_k^{I'}$. Since $min(q_k) = 0$ they satisfy the multiplicity constraints of $a_k$. In sum, every addition of new objects to the extension of a class C satisfies the multiplicity constraints imposed on C in $\alpha$. Since C does not participate in any association besides $\alpha$ the new objects satisfy all multiplicity constraints. Therefore, $I'$ is a legal instance. $\square$