You are on page 1of 16

Enforcing Cardinality Constraints in the ER Model With Integrity Methods 9

3.
4.

E.retrieve ( A : v )–Retrieves from ED the entity e identified by e.A = v, if any. The return
value is either e, or NULL, if there is no such entity.
E.retrieve_all()–Retrieves all entities in ED.

Primitive Methods for a Relationship Type Symbol R
1.

2.

3.
4.

Let r = { RN1 : e1 , ... , RNn : en } be a legal relationship for R in D.
R.insert( r )–Creates an RD relationship r with r.RNi = ei (1 ≤ i ≤ n). The return value is
r. The entities ei (1 ≤ i ≤ n) are updated as follows: ei.no_of_relationships( [R, RNi ]) is
increased by one, and r is added to ei.relationships( [R, RNi ]).
R.delete}( r )–Deletes from RD the specified relationship, if any. If there is a deletion,
the entities ei (1 ≤ i ≤ n) are updated to decrease ei.no_of_relationships( [R, RNi ]) by
one, and remove r from ei.relationships( [R, RNi ]).
R.retrieve ( r )–Retrieves r from RD, if any. The return value is either r, or NULL, if there
is no such relationship.
R.retrieve_all}()–Retrieves all relationships in RD.

Primitive Methods for Attribute Modifications
These methods perform modification, removal, and retrieval of a value of an attribute
of an instance of a type. Simultaneous modification of multiple attributes can be handled by
introducing compound update methods. Let T be a type symbol (entity or relationship). If T
is an entity type symbol, let v be a legal key value for T in D. If T is a relationship type symbol,
let v be a legal relationship for T in D. Let A be an attribute symbol associated with T, and
val a legal attribute value for (A, T) in D, i.e., val belongs to dom(A, T).
1.
T.modify( v, A, val )–If A is a single-valued attribute symbol, val is substituted for any
previous value of the attribute (A, T)D on the instance (entity or relationship) identified
by v. If A is a multi-valued attribute symbol, val is added to any previous value of the
attribute (A, T)D on the instance identified by v.
2.
T.remove( v, A, val )–If A is a single-valued attribute symbol, and the value of the
attribute (A, ,T)D on the instance identified by v, is val, it is replaced by NULL. If A is
a multi-valued attribute symbol, val is removed from the value of the attribute (A, T)D
of the instance identified by v.
3.
T.get( v, A )–Retrieves the value of attribute (A, T)D of the instance identified by v.

Integrity-Preserving Policies
In order to preserve the consistency of the database, an integrity update method
might invoke associated update methods or be refused. We distinguish four integritypreserving policies:
1.
Reject–the update operation is refused. This is in some sense a brute force action for
integrity preservation. It should only be used with caution, in order to not block
database updates.
2.
Propagate (also termed Cascade)–an insertion or deletion of an instance violates a
cardinality constraint, and invokes appropriate deletion or insertion actions. Propagation is achieved by dispatching the impact of a newly inserted or deleted entity or
relationship to its neighbouring relationships. Among the four integrity-preserving
actions, Propagate is the most faithful to the policy of integrity preservation. But it
is also the most expensive, and one should be careful not to embark on an unlimited
sequence of update operations. Since the schema is consistent, it has consistent (finite)

city : City[3. RNn : En[minn. • From the point of view of Specialization: a certain physician acquires from a certain school at least two specializations. and mini and maxi are natural numbers or the special symbol ∞. ∞]. That is.Enforcing Cardinality Constraints in the ER Model With Integrity Methods 5 Figure 1: An EER diagram for a medical clinic information system an associated role-name symbol. product : Product[1. if they are not provided . ∞]. In practice. 5]) Another example is the ternary relationship study (see Figure 1). max1]. for 1 ≤ i ≤ n. …. the above look-across constraint on the relationship type sale: “Every Salesperson entity that already sells a product in some city is constrained to sell that product in at least three cities and at most five” is captured by the relationship construct: sale(Salesperson : Salesperson[1. role names are optional. RNi (1 ≤ i ≤ n) are role names. This complex association is captured by the syntactic relationship construct R(RN1 : E1[min1. maxn]) where Ei (1 ≤ i ≤ n) are entity type symbols. The meaning of the constraints on that relationship type is as follows: • From the point of view of School: a certain physician obtains a certain specialization in at least one school. but not more than three. The role names RNi are used to identify the components of the relationship constructs. RNi(R) = Ei. For example. • From the point of view of Physician: a certain school provides a certain specialization to at least one physician. but he/she can obtain that specialization in no more than two schools. and minimum and maximum cardinality constraints.

and a meaning assignment for the symbols of the schema. The application of the meaning assignment to a symbol s of ER is denoted sD. Each entity type symbol owneri(E) is termed an owner entity type of E for Ri. namely: a certain physician may supervise any number of other physicians (including none). 1] ).e.. 1:1.6 Balaban & Shoval within the schema. An. . A key of a type is a means for identifying the instances of the type via their attributes. . and the associated entity type symbols are called its subtypes.T). The key of E consists of the keys of its owners.. dom is a partial mapping that associates a pair (A.. they are viewed as sets of labelled components.. and must not have a partial key. In Figure 1. in at most a single specialization.g. n) for mini ≥ 0. A ). i. × dom(An.. which is one of three values X... The super-type and subtype relations are extended to include their transitive closure.. then they are schema-created. and possibly also its own partial key. ED is an entity type. and the kind XT marks both. (Note that if a weak entity has two or more owners. The sets of attributes of an entity type and of any of its super-types are disjoint (no over-writing). It is defined as follows: For an entity type symbol E. and may be supervised by at most one other physician. (Note: in ER diagrams the letter N is usually used to signify ∞. The elements of D E are entities. The specialization has a kind. Every weak entity type symbol E is associated with one or more binary relationship type symbols R1 . the EER schema includes a relationship construct: Ri( RN : E[n. . an n-ary relation over D.. If the role names in the relationship construct of R are RN1. RNn.. T.T). which is any of its attributes. and their components are labelled with role names.e. maxi = ∞. key(ownerk(E)). it can be identified by their keys only.. . In Figure 1.. termed the identifying relationship types of E. supervises and supervised-by are the two role names of Physician in the supervision relationship. that is. The kind X marks disjointness of the specialization subtypes. as a subtype. for every identifying relationship. That is.. The elements of RD are relationships.T) × . So we get cardinality constraints such as 1:n:m.T) = dom(A1. The entity type symbol is called the super-type of the specialization. . . such that for each identifying relationship type Ri of E. i. key(E) = (key(owner1(E)). a domain assignment dom for the attributes. instead of viewing relationships as ordered tupels. RD is a relationship type.. a subset of D. dom is extended to composite attributes by defining dom(A. For a relationship type symbol R with arity n. Rk. where A is an attribute of E.) An entity type symbol may be associated with a set of entity type symbols (other than itself) that form its specialization or sub-typing. The cardinality constraints for E in the relationship constructs for its identifying relationships mean that every entity of E is associated with a single owner entity. . A key of a strong entity type symbol and of a relationship type (if any) is an attribute of the type. A conventional simplified cardinality notation uses 1 for mini = maxi = 1. Visit is identified by Patient ID plus Visit date. A key of a weak entity type symbol is defined through related owner entity type symbols. In our example (Figure 1). XT. RN’ : owneri(E)[1. etc..T) of a simple attribute symbol A and a type symbol T (entity or relationship) with a value domain dom(A.) A database instance D of an EER schema ER is defined by a non-empty finite domain of entities D. The legal values of an attribute A of a type T are the values in dom(A. An entity type symbol may participate. Physician and Nurse are subtypes of Employee. the kind T marks that the specialization covers the whole super-type. m] . and a letter (e.T) for a composite attribute symbol A that is associated with the attribute symbols A1. 1:n.

. .1. for every saleD relationship with a Salesperson s and a product p. 2. . RNi+1 = ei+1. RNn : En[minn. The role name symbols RN1. supervised-by : Physician[0. then both constraints hold. 1]. and sub-typing relationships... in Figure 1 the constraint supervision(supervises : Physician[0. .if A is single-valued. × EnD. their owner entities and their key attribute values uniquely identify them. RNn = en} ( RD) ) ≤ max_i. selection of p on the role name supervised-by in the relationship type supervisionD. the constraint: sale(Salesperson : Salesperson[1.2 and j = 2. then the sets EiD cover the set ED. Note that these constraints imply inheritance of attributes and relationships through specialization relationships..T)D is an attribute D of T . max1]. then the sets EiD are disjoint. constrains EiD to be a subset of ED (1 ≤ i ≤ n).e.if A is multi-valued. 5]) means that in every consistent database instance D. respectively. …. .Enforcing Cardinality Constraints in the ER Model With Integrity Methods 7 then we refer to the relationships in RD as sets of the form r = {RN1 : e1. A relationship construct R(RN1 : E1[min1. The rational . For example. The meaning for binary and non-binary relationship types is different: In binary relationship types the cardinality constraints in one entity type apply to every entity of the other entity type. while in non-binary relationship types the cardinality constraints in the i-th component apply only to every RD-related combination of entities from the other entity types... city : City[3. . for every PhysicianD entity p.. . . if the kind is XT. yields between three to five relationships. RNn : en}. ∞]. ∞].. which are integrity insensitive. that the key attribute values uniquely identify the instances of the types. respectively: For all ej in EjD .RNi-1 = ei-1.. If the kind of the specialization is X. in the relationship type saleD. RD ⊆ E1D × . EER EXTENDED WITH INTEGRITY METHODS We suggest extending the EER schema with integrity methods. . An EER schema is consistent if it has a consistent database instance. . a partial function from TD into either dom(A. Binary relationship types: For i = 1. . relationship constructs.. i. product : Product[1. for strong entity types and for relationship types. yields at most a single relationship. mini ≤ cardinality( sRNj = ej ( RD) ) ≤ maxi... A database instance of a schema ER is consistent if it satisfies the intended meaning of keys. which are update methods that are sensitive to the cardinality constraints. En in ER. RNn are referred to as the roles of RD. mini ≤ cardinality(s{RN1 = e1 . if the kind is T.. (1 ≤ i ≤ n). RNn : en } in RD: For all 1 ≤ i ≤ n.T) . For an attribute symbol A of a type symbol T (entity or relationship)..T) .. ∞]) means that in every consistent database instance D. selection of s and p on the role names Salesperson and product.. cardinality constraints. a. The cardinality bounds on the i-th component delimit the number of elements in EiD that can be related to given elements of the other entity types. We define RNi(r) = ei . or into the power set of dom(A. maxn]) in ER imposes the following constraints: 1. The constraints set by keys mean. b. The integrity methods should be defined on top of primitive update methods. A sub-typing of E by E1 . (A. For example. Non-binary relationship types: For all {RN1 : e1 . For weak entity types.

For a relationship r of RD.RN retrieves the RN entity component of r. 2. E. The entity e is added to all super entity types of ED. . These operations can be denoted as follows: 1. and of the information associated with instances in a database instance of a schema. b. A legal key value for A of E in D is a value in the domain that D assigns to a key attribute symbol A of E. RN] ) are the RD relationships whose RN component is e. r. Database level operations: a. e. the relationship type symbols that their constructs involve E or a super-type symbol of E. . For a relationship type symbol R. E’)D.delete ( A : v )–Deletes from ED and from all entity types E’D such that E’ in E. Insertions always involve the creation of a new entity or relationship. for every role name RN in R. where E’ is either E or a super-type of E). . R)D on r..relationships( [R .role_names. . the advantage is clear.. e. Similarly. v is a legal key value for A of E in D. in a database instance created only with the primitive methods. deletion. entity types that are not related by the subtype/super-type relation have no entities in common.no_of_relationships( [R. and e.role_names = {RN1 . Schema level operations: For an entity type symbol E. E)D (i. They are associated with the entity and the relationship type symbols of the schema.role_names. For an entity e of ED. such that e. r. The integrity methods stay intact. RN ] in E. Similarly.rels = { [R .subs. RN] in E. and the corresponding role names.insert ( A : v )–Creates a new ED entity e. RNn}. such that R... Every such implementation can be defined in terms of the primitive update methods alone. Primitive Methods The primitive methods perform insertion. RN ]) = φ. if any. Consequently.A retrieves the value of attribute (A.8 Balaban & Shoval behind this separation is that of the Abstract Data Types (ADT) approach: the primitive update methods serve as an abstraction barrier between the integrity methods and a logical database implementation of the EER schema. A legal relationship for R in D is a labeled set {RN1 : e1 . and their properties are proved. RNn : en }. The advantage of this approach is that the integrity methods are defined. are given by E. The return value is e. 2. once and for all. . Primitive Methods for an Entity Type Symbol E 1. all relationship types are mutually disjoint. retrieval and attribute modification in a database instance D of an EER schema ER. and e. The primitive methods should be sensitive to the subtype and super-type relations in the sense that an insertion of an entity to the entity type ED inserts it also to all super-entity types of ED .rels.no_of_relationships( [R . deletion of an entity from ED deletes it also from all sub-entity types of ED. RN ]) = 0. and for every [R.. For every [R .A = v. E. e. on the EER level. The addition of methods requires operations for retrieving the components of an EER schema.rels. the role names are given by R. the entity e identified by the value v of (A.A is uniquely defined since the sets of attribute symbols associated with E and its super-types are mutually disjoint.e. E’ = E or is a super-type symbol of E }.A = v).relationships( [R.A retrieves the value on e of attribute (A. e. RN] ) is their number. e. and ei is an entity in an entity type identified by the role name RNi. Since the definitions and proofs are rather complex. RN] | RN(R) = E’.

If there is a deletion. Simultaneous modification of multiple attributes can be handled by introducing compound update methods. Propagate is the most faithful to the policy of integrity preservation. 3. T). val )–If A is a single-valued attribute symbol. If A is a multi-valued attribute symbol.retrieve_all()–Retrieves all entities in ED. Integrity-Preserving Policies In order to preserve the consistency of the database. Primitive Methods for Attribute Modifications These methods perform modification. or NULL. T) in D. We distinguish four integritypreserving policies: 1. R. in order to not block database updates.RNi = ei (1 ≤ i ≤ n).no_of_relationships( [R. E. and val a legal attribute value for (A. 2. is val. R. T)D of the instance identified by v. But it is also the most expensive. T)D on the instance identified by v. it has consistent (finite) . If T is an entity type symbol. val belongs to dom(A. if any. val )–If A is a single-valued attribute symbol.retrieve ( A : v )–Retrieves from ED the entity e identified by e. Primitive Methods for a Relationship Type Symbol R 1. RNi ]) is increased by one.delete}( r )–Deletes from RD the specified relationship. The return value is r.insert( r )–Creates an RD relationship r with r. if any. 4. let v be a legal relationship for T in D. E. The return value is either e. The return value is either r. Let r = { RN1 : e1 . T. and remove r from ei. the entities ei (1 ≤ i ≤ n) are updated to decrease ei. . let v be a legal key value for T in D.no_of_relationships( [R. Propagate (also termed Cascade)–an insertion or deletion of an instance violates a cardinality constraint.retrieve_all}()–Retrieves all relationships in RD.e.modify( v.remove( v.relationships( [R. A. R. and the value of the attribute (A. This is in some sense a brute force action for integrity preservation. it is replaced by NULL. 2. RNi ]).. Since the schema is consistent. removal. and r is added to ei.A = v. if there is no such entity. and retrieval of a value of an attribute of an instance of a type. Let A be an attribute symbol associated with T. or NULL. i. Let T be a type symbol (entity or relationship). RNn : en } be a legal relationship for R in D. 2. 3. an integrity update method might invoke associated update methods or be refused. 4. val is removed from the value of the attribute (A. 1. val is added to any previous value of the attribute (A. R.T)D on the instance identified by v. RNi ]). val is substituted for any previous value of the attribute (A. Reject–the update operation is refused. if there is no such relationship. Among the four integrity-preserving actions. . If T is a relationship type symbol. T. If A is a multi-valued attribute symbol. RNi ]) by one. T)D of the instance identified by v. if any.retrieve ( r )–Retrieves r from RD. A )–Retrieves the value of attribute (A. T)D on the instance (entity or relationship) identified by v. and invokes appropriate deletion or insertion actions.get( v.Enforcing Cardinality Constraints in the ER Model With Integrity Methods 9 3.. Propagation is achieved by dispatching the impact of a newly inserted or deleted entity or relationship to its neighbouring relationships. . A. and one should be careful not to embark on an unlimited sequence of update operations. It should only be used with caution. T.relationships( [R. The entities ei (1 ≤ i ≤ n) are updated as follows: ei..

Example: Consider the EER schema from Figure 1. we need to check that this physician is not already in the database. the cardinality constraints. or emerges from new definition of the domain. Nullify is a compromise between the desire to preserve integrity. and not be fixed in advance for the different types of the schema (as suggested in Lazarevic & Misic. involves the following operations: If A : v does not identify an already existing entity in ED. Schema revision–integrity violation is removed by revising. Second. Maximum constraints are not violated by insertions or deletions of entities. it is worthwhile that the user can guarantee full propagation before actual updates are applied. Propagation for insertion is caused by non-zero minimum constraints in binary relationship constructs. a new entity with the key value v for A is inserted into ED. This way the insertion is propagated from E to its related relationship type symbols. Integrity Methods of Entity Types The integrity_insert and integrity_delete operations might invoke the Propagate policy for integrity preservation. since they apply only to already existing relationships. It seems that one should be careful not to abuse this intention by using this action as a replacement for simple Propagate or for Nullify so to temporarily preserve all constraints. by reconnecting its related entities to a real entity. and the insertion effect is propagated. Nullify–violation of a cardinality constraint is relaxed by the insertion of a new null entity. then the involved relationship types are asked to provide the missing relationships with the new entity.10 Balaban & Shoval database instances. The propagation involves observation of all binary relationship symbols with which E or any ancestor of E is associated. The revision can only decrease a minimum cardinality constraint. Propagation for deletion is caused by relationships in which the deleted entity participates. and the inability or unwillingness to propagate. If the minimum cardinality constraints that they set on an entity in ED are not met by the new entity. but should be considered when an already existing entity is connected to a new relationship (see next subsection). or re-defining. In order to insert a Physician entity with a license number ph12345 to a database instance. Integrity preservation requires that several constraints be checked before the real insertion takes place. 4. A null entity can be replaced by a real one. The Integrity_Insert Method The integrity_insert method for an entity type symbol E. Schema revision is intended to resolve impossible cardinality constraints. 1991). The assumption is that cardinality constraints do not apply to null entities. since they imply that a newly added entity must be related to another entity. In a Nullify operation.integrity_insert (license-no: ph12345) is applied. First. we need to observe all binary relationship type symbols . Physician. These integrity-preserving policies represent conventional approaches for integrity maintenance (Etzion & Dahav. and from there it can further propagate to new entity type symbols. Minimum constraints in non-binary relationship constructs do not pose any restriction on a new entity. or increase a maximum cardinality constraint. In general. We suggest that these policies should be determined in an interactive mode. 3. and a legal key value v for A of E in a database instance D. so that their integrity is preserved. a “fictional” entity is inserted to an entity type and connected to “real” entities. 1998). and including it in a relationship.

and must work for some department. Note that it may not be possible to avoid propagation by deleting the relationships before the entities. Integrity preservation requires that several constraints be checked before the real deletion takes place. The binary relationship type symbols treating and works-for provide minimum requirements on the number of relationships involving each physician instance. the process of integrity preservation has to repeat itself. new or old. and connect it to the new physician in a works-for relationship. Example (see Figure 1): In order to delete the Physician entity with license number ph12345 from the database. The new visit might not be related to a Medicine entity through prescriptions. every physician must have at least one visit. nor must he/she have any schedule or manage any department). we need to check that this physician is indeed in the database. Second. Similarly. Physician. or Delete the relationship. when the new physician treats his/her first patient. Nullify the references to the removed entity.. then the entity is deleted. we .Enforcing Cardinality Constraints in the ER Model With Integrity Methods 11 whose constructs involve Physician or any ancestor of Physician. since the deletion of a binary relationship is sanctioned if it violates the minimum constraints set on the related entities.rels. who in this case can be an existing or a new patient. Once the user provides a new Visit entity. Indeed. and a legal key value v for A of E in a database instance D. Later on. we have to ask the user for a candidate visit to be related to the new physician through the treating relationship type. when the missing department is inserted (or determined). For example. Later on. and the effect may propagate. Insertion of a new entity might propagate as above. if the new physician has no visit yet. i. since for any visit there is exactly one physician. So. So. the user can choose one of four possibilities: Reject the update. the relationship is deleted. the user can insert a new null entity to the Visit entity type and connect it to the physician in the treating relationship. In any case. In order to avoid or terminate propagation. to see whether their cardinality constraints are not violated. for R in E.integrity_delete (license-no : ph12345) is applied. the user can insert a new null entity to the Department entity type. In the Reconnect option. These relationships can be instances of relationship types RD. The Integrity_Delete Method The integrity_delete method for an entity type symbol E. the user is asked to replace the deleted entity with another one. and the deletion effect is propagated. First.) Again we need to ask the user for a candidate patient. if the department of the new physician does not exist in the database yet (or cannot be determined). every visit entity existing in the database already has its physician related to it through treating. the propagation stops.e. the user can reconnect the current physician entity to it. involves the following operations: If A : v indeed identifies an existing entity in ED. but it must have a Patient entity through patient-visits. either to further deletion of the related entity (for a binary relationship) or to further deletions of other relationships in the same relationship type (for a non-binary relationship). The user might provide an existing entity or suggest a new one. the user might decide to nullify missing entities in relationships. the required department entity may be an existing one. physician-schedules and manages do not constrain the new entity since they have zero minimum constraints (namely. For each such relationship. The binary relationship type symbols supervision. and for a candidate department entity as well. a new physician must not supervise any other physician. The propagation involves observation of all relationships that include the removed entity. but the required visit must be a new entity. the user will reconnect that treating relationship to the proper patient’s visit. In the Delete option. (Note that Visit is a weak entity type of Patient. since there are no minimal restrictions on patient-visits relationships. Reconnect the relationship.

connect( {treating. If we decide to delete the treating relationship. If both entities do exist in the database instance and can be connected without violating the maximum cardinality constraints set on treating.connect operation was invoked from within Visit. For example. Our recommended policy is to restrict the Connect and Disconnect operations so that they do not propagate outside the relationship type under consideration.physician : p. This propagation cannot be avoided. it should be inserted. involves the following operations: If r does not already exist in RD.ID : p123. For a new physician. . In general. date : 3. the new relationship is tested not to violate the cardinality constraints set on R. the physician entity must have at least one treating relationship. Hence. since the database integrity might block the independent insertion of the new entity. the Disconnect operation deletes a relationship.visit are the schema provided role names for the treating relationship type). such as reconnect. In order to avoid or terminate the propagation. That means that for the connection to be performed. . if these operations violate the integrity of the related entities (for binary relationship types only) they are rejected and can be replaced by other operations. the relationship is inserted to the treating relationship type. The Reconnect operation. if the current treating. the user might decide to Nullify the Physician entity in the treating relationship of that visit.integrity_insert(Patient. This can be the case. .. date : 3. treating. As explained above. For an existing physician. Note that the maximum constraint on the visit entity v is 1. the new relationship is inserted to RD. Nullify. can propagate to the related entity types. and if all entities ei (1 ≤ i ≤ n) already exist. Reconnect or Delete.9. Example (see Figure 1): In order to connect a Physician entity p to a Visit entity v. or integrity_insert or integrity_delete. treating.01).12 Balaban & Shoval need to decide what to do with each relationship in which this entity participates.) Integrity Methods of Relationship Types The operations are Connect. on the other hand. RNn : en } for R in a database instance D.9. and the Reconnect operation replaces an entity in a relationship. here. for example. connected. we can choose among Reject. and Reconnect. assuming that v is identified by the key value (Patient.visit : v} ) is applied. (Note that in our example all possible solutions are problematic because of the requirement that a physician must have at least one visit–an unrealistic constraint. the minimum cardinality constraints on the Visit entity type should be checked.ID : p123. The Connect operation inserts a new relationship between existing entities. it might be to an existing physician or to a new physician. and a legal relationship r = { RN1 : e1 . The Connect Method The Connect method for a relationship type symbol R..01 ). However. and the effect of the insertion propagated. due to the cardinality constraints on the treating relationship type. since every visit must be related to exactly one physician. No further updates are invoked since treating is binary. when an entity in a relationship is replaced by a new entity. if a Visit entity could be related to several Physician entities. deletion of the relationship violates the database integrity and must invoke propagation of the deletion to the related visit. then it might have been possible to delete the relationship without violating the cardinality constraints. Disconnect. we need to check whether it does not exceed the maximum of 20 visits. If the test succeeds. If we decide to reconnect the relationship.physician and treating. v must have been inconsistent prior to the connection. (treating.

study.disconnect( {study.specialization : f.disconnect( {treating. disconnect should be rejected.specialization : f. Then the user can be asked to choose among Reject.e. study. study. If the Specialization entity is new. The method should treat differently binary relationship types and non-binary ones.school : s) should be applied.physician : p. no further updates are invoked. study.physician : p.. Connect or Schema revision. it is more reasonable to start with the deletion of the related entities and not with their relationship. If the entities do exist in the database instance and can be connected without violating the maximum cardinality constraints set on study. study.. First.school : s} ) is applied. and a School entity s. and a legal relationship r = { RN1 : e1. involves the following operations: If r exists in RD. and the effect is propagated to other relationships in RD. an existing or a new Specialization entity is connected to p and s to yield a new study relationship. then a new null entity is inserted to the Specialization entity type. study. treating. since treating is binary.school : s}. since it violates the minimum cardinality constraints set on Visit.specialization : f. the relationship should be deleted from the study relationship type. RNn : en } for R in a database instance D.specialization : f. Disconnect is applied to every selection of n-1 entities from r. In any case. in such cases. it should also be made consistent (by invoking Specialization. Since study is non-binary. . there were exactly two study relationships with the physician p and the school s. one such study relationship is still missing (there should be at least 2. to see whether they still meet the minimum cardinality specified for the n-th entity type symbol. or Schema revision.make_deleted_relationship_consistent (study. study. that prior to the disconnection. the method study. study. study. Assume. violation of its cardinality constraints might require reconnection or disconnection of other relationships in RD. Then. v is related only to the Physician entity p). violation of the cardinality constraints for a binary R should lead to rejection.visit : v} ) is applied. if needed. treating. Assume. If the Visit entity is maximally consistent (i.Enforcing Cardinality Constraints in the ER Model With Integrity Methods 13 In order to connect a Physician entity p to a Specialization entity f. For a non-binary R.specialization : f. for example. The user can be asked to choose among Reject. If Connect is chosen. study.physician : p. study. Hence. one such relationship is missing.school : s} ) is applied. We feel that. Disconnect. the method treating.physician : p.make_consistent on it). If Connect is chosen. For a binary R. an auxiliary method study. then the relationship is disconnected.physician : p. Example (see Figure 1): In order to disconnect the treating relationship {treating. Then.visit : v}.school : s}) should be applied. following the disconnection. If Nullify is chosen. The Disconnect Method The Disconnect method for a relationship type symbol R.make_consistent ({study. . for example.physician : p. an existing or . and if the deletion of the relationship does not violate minimum cardinality constraints set on the participating entity types in R (possible only if R is binary). an auxiliary method study. then a new null entity is inserted to the Specialization entity type and connected to the entities p and s to yield a new study relationship. Since study is non-binary.connect( {study. preserving the integrity of its cardinality constraints might require deletion of the related entities (since the constraints are imposed on the related entities). Nullify. the relationship is inserted to the study relationship type. and connected to the entities p and s instead of the study relationship that was just deleted. If Nullify is chosen.physician : p.. that there are no other study relationships with the physician p and the school s. Nullify. and at most 3). In order to disconnect a study relationship {study. Connect.

specialization : f. accepts three parameters: a legal relationship for R in a database instance D.E_of_RN)D. if Fred is an employee that moves from the Pediatric Department to the Internal Department. .visit : v} to a new physician. the effect is propagated to other relationships in RD. . After that. the physician p’. treating.specialization : f. a role name RN for R.physician : p.. study. For example.physician. where RN is the role name whose entity e should be replaced by the new entity that is identified by A : v. and if the deletion of the relationship does not violate minimum cardinality constraints on the replaced entity e (possible only if R is binary). Pediatric Department) relationship is rejected due to the mandatory participation of Employee in the works-for relationship type.school : s} to a new physician identified by the key value license_no : ph5678 of Physician. the new relationship is inserted to RD. there would be no way to reconnect a relationship that includes an entity with mandatory participation. we denote the relationship r = { RN : e. The Reconnect method for a relationship type symbol R. license_no : ph5678 ) is applied. the move cannot be achieved as a sequence of Disconnect and Connect. treating. and the effect of the entity insertion is propagated in D. Reconnect is essential since otherwise.visit : v}. The user can be asked to compensate for the missing treating relationship of p either by connecting it to a Visit entity (a new one–real or null.E_of_RN)D. license_no : ph5678 ) is applied. treating. or by deleting p. then the minimum bound on the study. it should also be made consistent (by invoking Specialization. r’ is inserted to RD. First. identified by the key value license_no : ph5678 of Physician. . If Schema revision is chosen. In order to reconnect the study relationship {study. the user is asked to replace A : v by another legal key value.. that participates in no other relationship.reconnect( {treating. it is checked whether A : v identifies an existing entity in (R.school : s}.. then the relationship is disconnected. treating.physician : p’ .E_of_RN). ek to form a new relationship r’ in RD. The Reconnect method involves the following operations: If r exists in RD. Hence. The Reconnect Method This operation stands for a Disconnect operation that is followed by a Connect operation. . For simplicity. study. study.physician. Since study is . In that case.14 Balaban & Shoval a new Specialization entity is connected to p and s to yield a new study relationship. a new entity with the key value A : v is inserted to (R.physician : p.physician : p. treating.make_consistent on it). If A : v does not identify an entity in (R. and a legal key value A : v for the super-entity type symbol identified by RN in R given by R. with respect to D. then the remaining study relationship with physician p and school s is disconnected. RNk : ek } . If the Specialization entity is new. the method study. However.visit : v } can be connected. p becomes inconsistent as it must have at least one visit. under the integrity preservation policy.physician : p.specialization role of the study relationship type is decreased (from 2 to 1). and p’ should also be made consistent if it is new. This last test refers to the super-entity type symbol identified by the role name RN in R (given by R. the method treating.E_of_RN. the new treating relationship {treating. or an already existing one). If not. If v is the only visit of the physician entity p. then after the deletion of {treating. if this entity can be connected to the entities e1 . and if the insertion of the new relationship does not violate maximum cardinality constraints set on R. If Disconnect is chosen. RN1 : e1 . study. Example (see Figure 1): In order to reconnect the treating relationship {treating. study. disconnecting the (Fred. the relationship is reconnected.reconnect( {study..E_of_RN)D.visit : v }.physician : p. identified by the license number ph5678 can be inserted to Physician (if it is not already there).

D’ satisfies all key relationship construct and sub-typing constraints and all cardinality constraints set on real entities.specialization : f. then it is a consistent instance of ER. we first classified the cardinality constraints and formalized their semantics. they can be extended to accept any number of attribute-value pairs.physician : p’ . val ). and D’ results from D by the application of an integrity method. Alternative mappings of the EER schema into different logical database schemas can be extended similarly by faithful translation of the primitive methods. The contribution of this research is in capturing the intended meaning of the cardinality constraints as an integral part of the EER schema. study. study. The mapping of the more complicated integrity methods is directly obtained from the primitive methods mapping. ). we briefly described an extension of the EER data model with integritysensitive update methods. The data-model independence of our approach is.Integrity_get( v. our approach enables the development of a tool that automatically creates the integrity methods for a given EER diagram. The method mapping is defined in terms of the primitive methods alone. study. val ). the effect of the deleted study relationship should also propagate to the rest of the study relationships. INTEGRITY METHODS OF ATTRIBUTES The attribute operations are defined for an entity or a relationship type symbol T. That is. and T. If D’ includes no null entities. SUMMARY In this study. Consistency Preserving Property of the Integrity Methods The integrity methods suggested in this study are valuable since they can preserve the integrity of a consistent database instance. They accept the same parameters as their corresponding primitive methods. Since study is non-binary. The attribute operations that we suggest are: T. The integrity methods can be fully defined by the cardinality constraints. Then the physician p’.physician : p.Integrity_remove( v. and since the latter does not account for active integrity maintenance of the associated constraints. the new study relationship {study. That is. We are currently extending the conventional EER-to-OO schema mappings to map the newly added methods.Integrity_modify( v. and p’ should also be made consistent if it is new.specialization : f.school : s} does not affect any entity inconsistency. . since a UML conceptual schema should not be hard-wired to a specific logical database model. In principle.school : s} can be connected. For that purpose. therefore. A. A. Moreover. T. and an attribute A of T. We have proved that the method mapping preserves their semantics. study. if D is a consistent data base instance of an EER schema ER.Enforcing Cardinality Constraints in the ER Model With Integrity Methods 15 non-binary. since the EER schema language is an integral part of the UML language. the suggested enhancement actually extends the static part of UML with integrity-preserving methods. identified by the license number ph5678 is inserted to Physician (if it is not already there). using the primitive update methods. the deletion of the relationship {study. Hence. then D’ is a consistent up to null entities instance of ER. essential. A.

. Fundamentals of Entity-Relationship Modeling. P. MA: Addison-Wesley. Shoval. Calvanese. Data & Knowledge Engineering. E. London: Kluwer Academic Publishers. (2000). and Shoval. 1999. Cardinality constraints in the entity-relationship model. (1991). Reading. 1(2). P. (1991). Etzion. (Eds. Reading. B. Booch. ACM Transactions on Database Systems. and Jacobson. Reading. and Shiran.an experimental comparison of design quality.). and Ryan. T. 5(4). Entity-Relationship Approach. New York: Elsevier Science Publishers. Data and Knowledge Engineering. 51-66. M. The entity-relationship model: toward a unified view of data. Dittrich K. Ferg. 95-106. In Spaccapietra. R. R. In Teorey. P. (1999). and Nardi D. New York: SpringerVerlag. (1987). Accuracy in modeling with extended entity relationship and object oriented data models. Lenzerini. G. G. Information Systems (forthcoming). Thalheim. 11(4). 297315. and Frumermann. I. Fundamentals of cardinality constraints. and Dahav. and Saake. (1983). (1994). The Unified Modeling Language User Guide. Lenzerini. Lenzerini. B. Ng. Chen P. Patterns of self-stabilazation in database consistency maintenance. Object-oriented database systems. (Ed. Bock. In Chomicki. (1994). On the satisfiability of dependency constraints in entityrelationship schemata. (1976). J. V. Entity-relationship and object-oriented data modeling . MA: Addison-Wesley. Information Systems.. (1994). Shoval. Conceptual design of object-oriented database schemas using the binary-relationship model. Lazarevic. P. O. 15(4). 14. D. and Navathe. MEER–An EER model enhanced with structure methods. pp. M. MA: Addison-Wesley. 265-288. Journal of Database Management. (1999). 28-38. Logics for Databases and Information Systems. European Journal of Information Systems. Booch. and Yeh. M. (1998). 14-23. (1997). Y. M. Object-Oriented Analysis and Design with Applications (second edition). REFERENCES Balaban. P.). (1990. OO and EER conceptual schemas: A comparison of user comprehension. Fundamentals of Database Systems. M. 9-36. G. 7-23. P. 28(3). (1998). EntityRelationship Approach. (1998). (1992). Entity-Relationship Approach. D. S. 14-23. Balaban. Extending the entity-relationship model to capture dynamic behavior. M.16 Balaban & Shoval ENDNOTE 1 An earlier version of this paper appeared in Journal of Database Management. (Eds.. 10(4). 299-319. P. B. (2001). and Shoval.Wesley. S. UML Distilled. G. Kornatzky. S. I. 453-461. B. 1(1). and Nobili. and Misic. Enhancing the ER model with integrity methods. MA: Addison. Journal of Database Management. 21. Jejodia. Entity-Relationship Approach. Cardinality concepts in entity-relationship modeling. S.). and Shoval. (Ed. Thalheim.). Rumbaugh. Data and Knowledge Engineering. Elmasri. Journal of Database Management. (1997). Reading. In Davis. (1993). Description logics for conceptual data modeling. J. 4(4). and Santucci. Fowler. 30-39.

Minimum constraints in non-binary relationship constructs do not pose any restriction on a new entity. First. the cardinality constraints. and from there it can further propagate to new entity type symbols. by reconnecting its related entities to a real entity. In general.10 Balaban & Shoval database instances. Maximum constraints are not violated by insertions or deletions of entities. 4. The propagation involves observation of all binary relationship symbols with which E or any ancestor of E is associated. Example: Consider the EER schema from Figure 1. and a legal key value v for A of E in a database instance D. since they imply that a newly added entity must be related to another entity. it is worthwhile that the user can guarantee full propagation before actual updates are applied. A null entity can be replaced by a real one. Integrity preservation requires that several constraints be checked before the real insertion takes place. 1991). or increase a maximum cardinality constraint. Nullify is a compromise between the desire to preserve integrity. involves the following operations: If A : v does not identify an already existing entity in ED. Propagation for insertion is caused by non-zero minimum constraints in binary relationship constructs. Integrity Methods of Entity Types The integrity_insert and integrity_delete operations might invoke the Propagate policy for integrity preservation. In order to insert a Physician entity with a license number ph12345 to a database instance. This way the insertion is propagated from E to its related relationship type symbols. 3. Nullify–violation of a cardinality constraint is relaxed by the insertion of a new null entity. but should be considered when an already existing entity is connected to a new relationship (see next subsection). In a Nullify operation.integrity_insert (license-no: ph12345) is applied. We suggest that these policies should be determined in an interactive mode. then the involved relationship types are asked to provide the missing relationships with the new entity. or emerges from new definition of the domain. we need to check that this physician is not already in the database. we need to observe all binary relationship type symbols . Schema revision is intended to resolve impossible cardinality constraints. 1998). since they apply only to already existing relationships. and including it in a relationship. The assumption is that cardinality constraints do not apply to null entities. The Integrity_Insert Method The integrity_insert method for an entity type symbol E. Second. Schema revision–integrity violation is removed by revising. and the inability or unwillingness to propagate. and not be fixed in advance for the different types of the schema (as suggested in Lazarevic & Misic. a new entity with the key value v for A is inserted into ED. and the insertion effect is propagated. These integrity-preserving policies represent conventional approaches for integrity maintenance (Etzion & Dahav. It seems that one should be careful not to abuse this intention by using this action as a replacement for simple Propagate or for Nullify so to temporarily preserve all constraints. Propagation for deletion is caused by relationships in which the deleted entity participates. a “fictional” entity is inserted to an entity type and connected to “real” entities. The revision can only decrease a minimum cardinality constraint. or re-defining. Physician. so that their integrity is preserved. If the minimum cardinality constraints that they set on an entity in ED are not met by the new entity.

Example (see Figure 1): In order to delete the Physician entity with license number ph12345 from the database. In the Reconnect option. the process of integrity preservation has to repeat itself. the user is asked to replace the deleted entity with another one. we need to check that this physician is indeed in the database.integrity_delete (license-no : ph12345) is applied. the user can choose one of four possibilities: Reject the update.e. First. but the required visit must be a new entity. and a legal key value v for A of E in a database instance D. physician-schedules and manages do not constrain the new entity since they have zero minimum constraints (namely. Reconnect the relationship. In order to avoid or terminate propagation. So. if the department of the new physician does not exist in the database yet (or cannot be determined).. Indeed. For each such relationship. a new physician must not supervise any other physician. Similarly.) Again we need to ask the user for a candidate patient. i. the user can insert a new null entity to the Department entity type. who in this case can be an existing or a new patient. the user can insert a new null entity to the Visit entity type and connect it to the physician in the treating relationship. since the deletion of a binary relationship is sanctioned if it violates the minimum constraints set on the related entities. every visit entity existing in the database already has its physician related to it through treating. For example. and must work for some department. Integrity preservation requires that several constraints be checked before the real deletion takes place. and the effect may propagate. Nullify the references to the removed entity. then the entity is deleted. the required department entity may be an existing one. In any case. we . but it must have a Patient entity through patient-visits. (Note that Visit is a weak entity type of Patient. we have to ask the user for a candidate visit to be related to the new physician through the treating relationship type. Once the user provides a new Visit entity. the user can reconnect the current physician entity to it. since there are no minimal restrictions on patient-visits relationships. Note that it may not be possible to avoid propagation by deleting the relationships before the entities. and connect it to the new physician in a works-for relationship. new or old.Enforcing Cardinality Constraints in the ER Model With Integrity Methods 11 whose constructs involve Physician or any ancestor of Physician. the propagation stops. The Integrity_Delete Method The integrity_delete method for an entity type symbol E. every physician must have at least one visit. involves the following operations: If A : v indeed identifies an existing entity in ED. So.rels. The new visit might not be related to a Medicine entity through prescriptions. or Delete the relationship. when the missing department is inserted (or determined). Later on. the user might decide to nullify missing entities in relationships. nor must he/she have any schedule or manage any department). if the new physician has no visit yet. In the Delete option. Physician. These relationships can be instances of relationship types RD. the user will reconnect that treating relationship to the proper patient’s visit. when the new physician treats his/her first patient. The propagation involves observation of all relationships that include the removed entity. and the deletion effect is propagated. The binary relationship type symbols supervision. Later on. for R in E. since for any visit there is exactly one physician. Insertion of a new entity might propagate as above. to see whether their cardinality constraints are not violated. The user might provide an existing entity or suggest a new one. The binary relationship type symbols treating and works-for provide minimum requirements on the number of relationships involving each physician instance. and for a candidate department entity as well. Second. either to further deletion of the related entity (for a binary relationship) or to further deletions of other relationships in the same relationship type (for a non-binary relationship). the relationship is deleted.

In principle. A. they can be extended to accept any number of attribute-value pairs. D’ satisfies all key relationship construct and sub-typing constraints and all cardinality constraints set on real entities. Alternative mappings of the EER schema into different logical database schemas can be extended similarly by faithful translation of the primitive methods.Integrity_remove( v. Since study is non-binary. study. identified by the license number ph5678 is inserted to Physician (if it is not already there). and T. then D’ is a consistent up to null entities instance of ER. and since the latter does not account for active integrity maintenance of the associated constraints. Hence. since a UML conceptual schema should not be hard-wired to a specific logical database model.physician : p’ .physician : p. using the primitive update methods. The data-model independence of our approach is. SUMMARY In this study. That is. study. The contribution of this research is in capturing the intended meaning of the cardinality constraints as an integral part of the EER schema. We have proved that the method mapping preserves their semantics. we first classified the cardinality constraints and formalized their semantics. therefore. The mapping of the more complicated integrity methods is directly obtained from the primitive methods mapping. since the EER schema language is an integral part of the UML language. val ). and an attribute A of T. the suggested enhancement actually extends the static part of UML with integrity-preserving methods.specialization : f. our approach enables the development of a tool that automatically creates the integrity methods for a given EER diagram. The integrity methods can be fully defined by the cardinality constraints. We are currently extending the conventional EER-to-OO schema mappings to map the newly added methods. essential.Enforcing Cardinality Constraints in the ER Model With Integrity Methods 15 non-binary. T. study. the new study relationship {study.school : s} does not affect any entity inconsistency. ).Integrity_modify( v. A. For that purpose. Then the physician p’. Consistency Preserving Property of the Integrity Methods The integrity methods suggested in this study are valuable since they can preserve the integrity of a consistent database instance. INTEGRITY METHODS OF ATTRIBUTES The attribute operations are defined for an entity or a relationship type symbol T. the deletion of the relationship {study. study. we briefly described an extension of the EER data model with integritysensitive update methods. If D’ includes no null entities. That is. and p’ should also be made consistent if it is new. Moreover. val ). . then it is a consistent instance of ER. The method mapping is defined in terms of the primitive methods alone. and D’ results from D by the application of an integrity method. the effect of the deleted study relationship should also propagate to the rest of the study relationships. if D is a consistent data base instance of an EER schema ER.specialization : f.Integrity_get( v. They accept the same parameters as their corresponding primitive methods. A. The attribute operations that we suggest are: T.school : s} can be connected.