From Database Repair Programs to Consistent Query Answering in Classical Logic (extended abstract)

Abstract

Consistent answers to a query from an inconsistent database are answers that can be simultaneously retrieved from every possible repair; and repairs are consistent instances that minimally differ from the original instance. Database repairs can be specified as the stable models of a disjunctive logic program. In this paper we show how to use the repair programs to transform the problem of consistent query answering into a problem of reasoning wrt a concrete theory written in second-order predicate logic. It also investigated how a first-order theory can be obtained instead, by applying second-order quantifier elimination techniques.

1 Introduction

Integrity constraints (ICs) are conditions that come with a relational schema S, and should be satisfied by the instances of S. In this way, database instances stay in correspondence with the outside reality they intend to model. If an instance D of S does not satisfy the ICs, it is said to be inconsistent. For several reasons a database instance may become inconsistent, and in consequence, it is only partially semantically correct.

Consistent query answering (CQA) in databases is about characterizing and computing answers to a query that are consistent wrt to a given set of integrity constraints. The database instance being queried may be inconsistent as a whole. However, via CQA only locally consistent information is extracted from the database. These problems have been investigated by the database community at least since the notion of consistent query answer was explicitly introduced in [ 4 ]. (Cf. [ 10, 17 ] for recent surveys of CQA.)

Informally, a tuple of constants t¹ is a consistent answer to a query Q(x¹) from D wrt a set of ICs IC if t¹ can be obtained as a usual answer to Q from every repair of D wrt IC, where a repair is a consistent instance of the schema S that differs from D by a minimal set of database atoms under set inclusion [ 4 ].

In [ 6 ] it was shown how repairs of a database D wrt a set of ICs can be specified as the stable models of a disjunctive Datalog program ¦ [ 27, 38, 21 ], a so-called repair program, whose set of facts corresponds to the original instance D. In this way, obtaining consistent answers becomes reasoning over the class of stable models of ¦. Example 1. Schema S contains a predicate P (X; Y ) and the functional dependency (FD), X ! Y , of attribute Y upon attribute X. It can be expressed in the first-order (FO) language L(S) associated to S, as the sentence 8x8y8z(P (x; y) ^ P (x; z) ! y = z). D = fP (a; b); P (a; c); P (d; e)g is inconsistent, and has two repairs: D1 = fP (a; b); P (d; e)g and D2 = fP (a; c); P (d; e)g. The only consistent answer to the query Q1(y) : 9xP (x; y) is (e), whereas those to Q2(x) : 9yP (x; y) are (a); (d).

The repairs can be specified by a logic program that contains, among other rules, a main rule that takes care of restoring consistency: P (x; y; f ) _ P (x; z; f ) Ã P (x; y);

P (x; z); y 6= z. It specifies that whenever the FD is violated by two tuples, which is captured by the body, then, as captured by the head, one (and only one if possible) of the tuples has to be deleted (made false, as indicated by the annotation constant f ).

Repair programs can always be used for CQA. However, as shown in [ 4 ], it is sometimes possible to obtain CQA by posing a new query to the inconsistent database. For example, the consistent answers to the query Q3 : P (x; y) can be obtained by rewriting Q3 into Q03 : P (x; y) ^ :9z(P (x; z) ^ z 6= y), and posing it to D, obtaining (d; e). ¥ Ideally, consistent answers to Q(x¹) 2 L(S) from D should be obtained by posing a new query Q0(x¹) 2 L(S) to D, as an ordinary query: D j= Q0(x¹)?. This can be done in polynomial time in jDj. Classes of queries and ICs with this property have been identified [ 4, 16, 26, 40 ]. Unfortunately, FO query rewriting has limited applicability: Even for conjunctive queries and FDs, CQA can be coNP -complete (in data) [ 16, 26 ].

Repair programs provide a general mechanism for CQA. Actually, the data complexity of CQA can be as high as the data complexity of cautious query evaluation from disjunctive logic programs under the stable model semantics, namely ¦2P -complete [ 18, 16 ]. However, repair programs may be expensive for queries that can be answered more efficiently. It turns out that the complexity landscape between FO rewritable cases and ¦2P -completeness for CQA is still not quite clear.

Those cases with FO rewritable CQA transform the problem into reasoning in classical predicate logic, because the original database can be “logically reconstructed” as a FO theory [ 39 ]. In this work we investigate how repair programs can be used to generate a theory written in classical logic from which CQA can be captured as logical entailment. We provide concrete specifications of database repairs in second-order (SO) classical logic. They are obtained by applying recent results on the specification in SO logic of the stable models of a logic program [ 23 ], and on their characterization as the models of a circumscription theory [ 36 ] in the stratified cases [ 37, 38 ]. Circumscription can be specified in SO classical logic [ 30 ].

In the case of FDs, we apply techniques for SO quantifier elimination introduced in [ 19 ], obtaining a FO specification of the database repairs. This transforms the problem of CQA into a problem of logical reasoning in FO logic. We illustrate by means of an example how to obtain a FO rewriting for CQA from this specification. In this work we concentrate mostly on FDs. Most of the complexity results in CQA have been obtained for FDs, but their complexity is not fully understood yet. We expect that the kind of results obtained in this work will help shed more light on this picture, in particular with respect to rewritability for CQA. These applications and others, like a better understanding of “the logic of CQA”, are still to be developed.

In the Appendix we provide some basic notions related to disjunctive logic programs, stable model semantics, stratified disjunctive programs, and circumscription. We refer to [ 11 ] for the extended presentation of this work.

2 The Framework

The relational schema S contains a possible infinite domain U without nulls. S determines a language L(S) of FO predicate logic, and ICs will be universal sentences in L(S). (Cf. [ 12 ] for extensions to existential ICs and instances with nulls.) An instance D for S is a finite set of ground atoms of the form R(a¹), with R 2 S and a¹ is a tuple of constants in U .1 D can be seen as a Herbrand structure [ 32 ] for interpreting L(S), 1 When we write something like R 2 S, we understand that R is a database predicate, not a built-in. For a tuple of constants a¹ = (a1; : : : ; ak), a¹ 2 U denotes ai 2 U for i = 1; : : : ; k. namely hU ; (RD)R2S ; (u)u2U i, with RD = fR(a¹) j R(a¹) 2 Dg. The database D can also be logically reconstructed as a first-order sentence R(D), as done by Reiter in [ 39 ]. Example 2. If S has domain U = fa; b; c; d; e; f; gg and predicate P (¢; ¢), then D = fP (a; b); P (a; c); P (d; e)g is an instance for S. In this case, R(D) is the conjunction of the following sentences: (a) Domain Closure Axiom (DCA): 8x(x = a _ x = b _ x = c _ x = d _ x = e _ x = f _ x = g). (b) Unique Names Axiom (UNA): (a 6= b ^ ¢ ¢ ¢ ^ f 6= g). (c) Predicate Completion Axiom (PCA): 8x8y(P (x; y) ´ (x = a ^ y = b) _ (x = a ^ y = c) _ (x = d ^ y = e)). The theory R(D) is categorical, i.e. D is essentially its only model. ¥ In the previous example, the domain is finite, which makes it possible to use a domain closure axiom. If the domain U is infinite, the domain closure axiom (DC) is applied to the active domain, Ac(D), of the database, i.e. to the set of constants appearing in the relations of the database instance. Since the extensions of the predicates are always finite, we can always build a DCA and PCAs. For static databases and CQA wrt universal ICs, the active domain suffices to restore consistency and define repairs. If we restrict ourselves to Herbrand structures, we do not need the DCA or the UNA.

2.1 Database repairs

A repair of D wrt a set IC of ICs is an instance D0 over S that satisfies IC , i.e. D0 j= IC , and makes the symmetric set-difference ¢(D; D0) minimal wrt set inclusion [ 4 ]. Rep(D; IC ) denotes the set of repairs of D wrt IC.

Given D and IC, a disjunctive logic repair program ¦(D ; IC ) with stable model semantics [ 27 ] can be used to specify Rep(D; IC ). More precisely, (all and only) the repairs of D can be read-off from the stable models of ¦(D ; IC ). Because of their simplicity and scope, we will use the repair programs introduced in [ 6 ] in their slightly modified version in [ 13 ]. Earlier forms of repair programs can also be found in [ 5, 28 ]. Repair programs use annotation constants in an extra argument of each of the database predicates. More precisely, for each n-ary Annotation Atom The tuple P (a¹) is: P 2 S, we make a copy P , which is t P (a¹; t) made true/inserted (n+1)-ary. The intended semantics of the f P (a¹; f ) made false/deleted annotations is indicated in the following t? P (a¹; t?) true or made true table. t?? P (a¹; t??) true in the repair Example 3. Consider IC : 8xy(P (x; y) ! Q(x; y)); and the inconsistent database instance D = fP (c; l); P (d; m); Q(d; m); Q(e; k)g. The repair program ¦(D; IC ) has the following rules (and facts): 1. Original database facts: P (c; l); etc. 2. Whatever was true or becomes true, is annotated with t?:

P (x¹; t?) Ã P (x¹): P (x¹; t?) Ã P (x¹; t): (the same for Q) 3. There may be interacting ICs (not here), and the repair process may take several steps, changes could trigger other changes: P (x¹; f ) _ Q(x¹; t) Ã P (x¹; t?); Q(x¹; f ): P (x¹; f ) _ Q(x¹; t) Ã P (x¹; t?); not Q(x¹): Two rules per IC that say how to repair the satisfaction of the IC (cf. the head) in case of a violation (cf. the body). Passing to annotation t? allows to keep repairing the database wrt to all the ICs until the process stabilizes. 4. Program constraints: Ã P (x¹; t); P (x¹; f ): (similarly for Q) 5. Annotations constants t?? are used to read off the atoms in a repair:

P (x¹; t??) Ã P (x¹; t): P (x¹; t??) Ã P (x¹; d); not P (x¹; f ): (similarly for Q) The program constraints in 4. are used to filter out incoherent models, with some both inserted and deleted tuple. In this example, we do not need them, because this never happens. However, they may be necessary when there are interacting ICs [ 14 ]. ¥ General repair programs can be found in [ 11 ]. From now on, we use, for simplicity, Pf ( ; ) for P ( ; ; f ), P??( ; ) for P ( ; ; t??), etc. That is, annotations are “predicated” using new predicates. Repairs are in one-to-one correspondence with the restriction of the stable models to their atoms that use predicates of the form P?? [ 12 ].

2.2 Queries and consistent answers

A tuple a¹ 2 U is a consistent answer to a query Q(x¹) from D wrt IC , denoted D j=c Q(a¹), iff D0 j= Q(a¹) for every D0 2 Rep(D; IC ) [ 4 ]. In this paper, Q will usually be a safe query [ 1 ] in L(S), e.g. a conjunctive query with built-ins. In order to pose this query to the (models of the) repair program, i.e. to the repairs, it has to be reformulated as a query Q?? that is obtained from Q by replacing each database predicate P by P??. For example, for Q(y) : 9x(P (x; y) ^ :Q(x; y) ^ x 6= y), Q??(y) is 9x(P??(x; y) ^ :Q??(x; y) ^ x 6= y). The query Q could also be given as a (safe) Datalog query (or in any of its extensions) [ 1 ]. In this case, Q?? is obtained from Q by replacing every extensional predicate P by P??.

Repair programs can be used to obtain consistent answers to Q as cautions (or skeptical) answers from the combined program consisting of the repair program and a query program ¦Q. Given a FO query Q(x¹), Q??(x¹) is rewritten as a Datalog query ¦Q, possibly containing weak negation, not . ¦Q contains a predicate, AnsQ(x¹), appearing only in heads, to collect the query answers. If Q is given directly as a Datalog program with negation, then ¦Q is simply Q??. According to the usual conventions, we will assume that such Datalog queries Q are stratified normal programs, most usually, a non-recursive Datalognot query [ 1 ], that is obtained as a translation of a FO query. It holds:

D j=c Q(a¹) ()

D0 j= Q(a¹); for every D0 2 Rep(D; IC ) (1) () ¦(D; IC ) [ ¦Q j=cs AnsQ(a¹); (2) where j=cs stands for cautious, i.e. being true in all stable models. If on the LHS of (1) Q is already a Datalog program, D0 j= Q(a¹) means that a¹ is an answer to the Datalog query when using D0 as the underlying extensional database of program facts.

2.3 Functional dependencies

For some classes of FDs and conjunctive queries there are efficient algorithms for CQA based on FO query rewriting [ 4, 16, 26, 40 ]. In [ 25, 40 ] there are examples of conjunctive queries for which CQA wrt certain FDs is in PTIME , but there is no consistent FO rewriting of the query. FDs are particular cases of denial constraints, i.e. sentences of the form 8¹:(A1 ^ ¢ ¢ ¢ ^ Am), where the Ai are database or built-in atoms, and 8¹ denotes the universal closure of the formula.

In [ 7 ], it is proved that for certain classes of ICs, that include all denial constraints, the repair programs become head-cycle free (HCF). For this class of programs cautious query evaluation becomes coNP -complete [ 8, 18 ]. It follows that CQA of conjunctive queries wrt functional dependencies belongs coNP [ 7 ]. For conjunctive queries and certain functional dependencies (actually, a single key dependency suffices), CQA turns out to be coNP -complete [ 16, 26, 40 ], matching the upper bound provided by the repair program.

Example 4. (example 1 continued) The repair program ¦(D; IC ) is:

Pf (x; y) _ Pf (x; z) Ã P (x; y); P (x; z); y 6= z: P??(x; y) Ã P (x; y); not Pf (x; y): P (a; b): P (a; c): P (d; e): (3) (4) (5) The first rule solves conflicts between two tuples by deleting one of them from the database. The second rule collects the tuples that remain after all conflicts have been solved. For FDs we do not need the annotation t or program constraints, because inconsistencies are resolved by deletions. The repairs are obtained as restrictions of the two stable models to predicate P??: D1 = fP??(a; b); P??(d; e)g and D2 = fP??(a; c); P??(d; e)g. In the former, the tuple P (a; c) is deleted from the database; in the latter, the tuple P (a; b).

The query Q(x; y) : P (x; y) can be represented as the program ¦Q: Ans(x; y) Ã P??(x; y). If ¦ is the program consisting of this query plus (3)-(5), the consistent answers to query Q are those tuples a¹, such that ¦ j=cs Ans(a¹). ¥ We can see that repair programs for FDs are stratified disjunctive programs [ 37 ]. They are also HCF programs, which makes it possible to translate them into equivalent normal (non-disjunctive) programs [ 8, 18 ]. However, they are not stratified as normal programs. 3

SO Specification of Repairs

In [ 23 ], the stable model semantics of logic programs introduced in [ 27 ] is reobtained via a concrete and explicit form of specification in classical SO predicate logic: First, the program ¦ is transformed into (or seen as) a FO sentence Ã(¦). Next, the latter is transformed into a SO sentence ©(¦), the stable sentence of the program.

Ã(¦) is obtained from ¦ as follows: (a) Replace every comma by ^, and every not by :. (b) Turn every rule Head à Body into the formula Body ! Head . (c) Form the conjunction of the universal closures of those formulas.

Now, given a FO sentence à (e.g. the Ã(¦) above), a SO sentence © is defined as Ã^:9X¹ ((X¹ < P¹)^ñ(X¹ )), where P¹ is the list of all non-logical predicates P1; :::; Pn in Ã, and X¹ is a list of distinct predicate variables XP1 ; :::; XPn , with Pi and XPi of the same arity. Here, (X¹ < P¹) means (X¹ · P¹) ^ (X¹ 6= P¹), i.e. Vin 8x¹(XPi (x¹) ! Pi(x¹)) ^ Win(XPi 6= Pi). XPi 6= Pi stands for 9x¹i(Pi(x¹i) ^ :XPi (x¹i)).

ñ(X¹ ) is defined recursively as follows: (a) Pi(t1; :::; tm)± := XPi (t1; :::; tm). (b) (t1 = t2)± := (t1 = t2). (c) ?±:=?. (d) (F ¯ G)± := (F ± ¯ G±) for ¯ 2 f^; _g. (e) (F ! G)± := (F ± ! G±) ^ (F ! G). (f) (QxF )± := QxF ± for Q 2 f8; 9g.

The Herbrand models of the SO sentence ©(¦) associated to Ã(¦) correspond to the stable models of the original program ¦ [ 23 ]. We can see that ©(¦) is similar to a parallel circumscription of the predicates in program ¦ wrt the FO sentence Ã(¦) associated to ¦ [ 36, 31 ]. In principle, the transformation rule (e) above could make formula ©(¦) differ from a circumscription.

Now, let ¦r be the repair program without the database facts, and Q(x¹) a query represented by a non-recursive normal Datalognot query ¦Q with answer predicate AnsQ(x¹). From now on, ¦ = D [ ¦r [ ¦Q denotes the program for consistently answering Q. That is, ¦ = ¦(D; IC ) [ ¦Q. Notice that ¦r depends only on the ICs, and it includes definitions for the annotation predicates. The only predicates shared by ¦r and ¦Q are those of the form P??, with P 2 S, and they appear only in bodies in ¦Q. These predicates produce a splitting of the combined program, whose stable models are obtained as extensions of the stable models for ¦(D; IC ) [ 34 ]. In Example 4, ¦r is formed by rules (3) and (4); D is the set of facts in (5); and ¦Q is Ans(x; y) Ã P??(x; y).

The just mentioned splitting of ¦ allows us to analyze separately ¦r and ¦Q. Since the latter is a non-recursive normal program, it is stratified, and its only stable model (over a give extension for its extensional predicates) can be obtained by predicate completion, or a prioritized circumscription [ 37 ]. Actually, if the query is given directly as FO query, we can use instead of the completion (or circumscription) of its associated program, the FO query itself. In consequence, in the rest of this section we concentrate mostly on the facts-free repair program ¦r.

In the following, we will omit the program constraints from the repair programs, because their transformation via the SO sentence of the program is straightforward: We obtain as a conjunct of the SO sentence, the sentence 8x¹:(Pt(x¹) ^ Pf (x¹)) [24, Prop. 2] for a program constraint of the form à Pt(x¹); Pf (x¹).

Example 5. (example 4 continued) We first obtain the FO sentence Ã(¦): P (a; b) ^ P (a; c) ^ P (d; e) ^ 8xyz(((P (x; y) ^ P (x; z) ^ y 6= z) ! (Pf (x; y) _ Pf (x; z))) ^ 8xy((P (x; y) ^ :Pf (x; y)) ! P??(x; y)) ^ 8xy(P??(x; y) ! Ans(x; y)): (7) The second-order formula ©(¦) that captures the stable models of the original program is the conjunction of (7) and (with < below being the “parallel” pre-order [ 30 ]) :9XP XPf X?P?XAns [ (XP ; XPf ; X?P?; XAns ) < (P; Pf ; P??; Ans) ^ XP (a; b) ^ XP (a; c) ^ XP (d; e) ^ 8xyz(XP(x; y) ^ XP(x; z) ^ y 6= z ! XPf (x; y) _ XPf (x; z)) ^ 8xyz(P (x; y) ^ P (x; z) ^ y 6= z ! Pf (x; y) _ Pf (x; z)) ^ 8xy(XP (x; y) ^ (:Pf (x; y))± ! XP??(x; y)) ^ 8xy(P (x; y) ^ :Pf (x; y)) ! P??(x; y)) ^ 8xy(XP??(x; y) ! XAns (x; y)) ^ 8xy(P??(x; y) ! Ans(x; y))]: (8) (9) (10) (11) From this sentence, the conjuncts (8), (10) and (11), that already appear in (7), can be eliminated. The formula (:Pf (x; y))± in (9) has to be expressed as (Pf (x; y) ! ?)±. It turns out that, being the ±-transformation of a negative formula, it can be replaced by its original version without predicate variables, i.e. by :Pf (x; y) [23, Prop. 2]. We obtain that ©(¦) is logically equivalent to the conjunction of the UNA and DCA2 and 2 From now on, unless stated otherwise, the UNA and DCA will be always implicitly considered. (modulo some standard simplification techniques for SO quantifiers [ 30, 31 ]): 8xy(P (x; y) ´ (x = a ^ y = b) _ (x = a ^ y = c) _ (x = d ^ y = e)) ^ (12) 8xy(P??(x; y) ´ Ans(x; y)) ^ 8xy((P (x; y) ^ :Pf (x; y)) ´ P??(x; y)) ^ 8xyz(P (x; y) ^ P (x; z) ^ y 6= z ! (Pf (x; y) _ Pf (x; z))) ^ (13) (14) (15) :9Uf ((Uf < Pf ) ^ 8xyz(P (x; y) ^ P (x; z) ^ y 6= z ! (Uf (x; y) _ Uf (x; z))): (16) Here, Uf < Pf stands for the formula 8xy(Uf (x; y) ! Pf (x; y)) ^ 9xy(Pf (x; y) ^ :Uf (x; y)). In this sentence, the minimization of predicates P; P?? and Ans are expressed by their predicate completions. Predicate Pf is minimized via (16). ¥ In this example we have obtained the SO sentence for program ¦ as a parallel circumscription of the predicates in the repair program seen as a FO sentence. Actually, the circumscription becomes a prioritized circumscription [ 30 ] given the stratified nature of the repair program: first the database predicate is minimized, next Pf , next P??, and finally Ans. As we state in Proposition 1, repair programs in their predicated-annotation version and without their program constraints become stratified disjunctive Datalog programs [ 21, 37 ].3 Proposition 1. [ 15 ] For universal integrity constraints, repairs programs without their program constraints are stratified, and the upwards stratification is as follows: 0. Extensional database predicates P 2 S; 1. Predicates of the form Pf ; Pt; P?; and 2. Predicates of the form P??. ¥ If a stratified query program is run on top of the repair program, the combined program becomes stratified, with the stratification of the query on top of the one of the repair program. It is worth noticing that the data complexity of cautious query evaluation from disjunctive logic programs with stratified negation is the same as for disjunctive logic programs with unstratified negation and stable model semantics, namely ¦2P -complete [ 21 ] The stable models of the combined (stratified and disjunctive) program ¦ coincide with the perfect models of the program [ 38 ], and the latter can be obtained as the (Herbrand) models of a prioritized circumscription that follows the stratification of the program [ 37 ]. Program constraints can be added at the end, after producing a circumscription (or the SO stable sentence of ¦). In consequence, we obtain the following Proposition 2. For a set of universal ICs, the SO sentence © associated to a repair program ¦(IC ; D) is logically equivalent to

R(D) ^ ^ 8x¹((P (x¹) _ Pt(x¹)) ´ P?(x¹)) ^ ^ 8x¹(P?(x¹) ^ :Pf (x¹) ´ P??(x¹)) ^

P 2S P 2S ^ 8x¹:(Pt(x¹) ^ Pf (x¹)) ^ Circ(£; fPt; Pf j P 2 Sg; fP? j P 2 Sg): (17) P 2S Here, the last conjunct is the parallel circumscription [ 30 ] of the predicates in the second argument (with variable P? predicates) wrt the theory £ obtained from the conjunction rules in the repair program that are relevant to compute the Pt; Pf ’s, seen as FO sentences.4 ¥ 3 Program constraints spoil the stratification, because they have to be replaced by rules of the form p à Pt(x¹); Pf (x¹); not p. 4 They are rules 1.- 3. in Example 3. This result has been obtained from the stratification of the repair programs. However, it is possible to obtain the same result by simplifying the SO sentence associated to it, as done in Example 5. Notice that the more involved repair program in Example 3 already contains the relevant features of a general repair program for universal ICs, namely the negations in the rule bodies affect only base predicates and the predicates P? in the definitions of the P?? [ 35 ]. In any case, we obtain a SO specification of the program for CQA ¦ in (6). Combining with (1), we obtain

D j=c Q(a¹) () ©(¦) j= AnsQ(a¹); where ©(¦) is the SO sentence which captures the stable models of ¦.5 Actually, ©(¦) can be decomposed as the conjunction of three formulas: Proposition 3. Let © be the SO sentence for the program ¦ in (6) for CQA. It holds:

D j=c Q(a¹) () fR(D); ©(¦r); ©(¦Q)g j= Ans(a¹): Here, ©(¦r) is a SO sentence that specifies the repairs for fixed extensional predicates, and ©(¦Q)g a SO sentence that specifies the models of the query, in particular predicate AnsQ, for fixed predicates P??. ¥ Example 6. (example 5 continued) R(D) is captured by the DCA, UNA plus (12); ©(¦r) by (14)-(16); and ©(¦Q) by (13). Actually, what we have obtained is that for consistent answers (t1; t2), it holds

ª ^ 8x8y(Ans(x; y) ´ P??(x; y)) j= Ans(t1; t2); where ª is the SO sentence that is the conjunction of (12), (14)-(16). (18) (19) ¥ We have transformed CQA into a problem of reasoning in classical SO predicate logic. Most commonly the query Q will be given as a FO query or as a safe and non-recursive Datalognot program. In these cases, ©(¦Q) is obtained by predicate completion and will contain as a conjunct an explicit definition of predicate AnsQ. The definition of AnsQ will be of the form 8x¹(AnsQ(x¹) ´ ª (x¹)), where ª (x¹) is a FO formula containing only predicates of the form P??, with P 2 S, plus possibly some built-ins and auxiliary predicates. For example, in (19) we have an explicit definition of Ans. 4

Scaling-Down Repair Programs for CQA under FDs

We discuss in this section the possibility of using a program for CQA ¦ of the form (6) to obtain a FO theory from which to do CQA as classical entailment. In particular, exploring the possibility of obtaining a FO rewriting of the original query. The idea is to do it through the analysis of the SO sentence associated to the program. In order to explore the potentials of this approach, we restrict ourselves to the case of FDs, the most studied case in the literature wrt complexity of CQA [ 16, 26, 40 ].

We start with a schema with a predicate P (X; Y ), with the FD : X ! Y , as in Example 1. In this case, the repair program ¦(D; FD ) is associated to the circumscription of Pf given by the conjunction of (12), (14)-(16). We concentrate on the last conjunct, (16), which can be expressed as :9Uf ((Uf < Pf ) ^ 8xyz(·(x; y; z) ! (Uf (x; y) _ Uf (x; z))); (20) 5 If we omit the DCA and UNA axioms, on the RHS the logical consequence is relative to Herbrand models. where ·(x; y; z) is the formula P (x; y) ^ P (x; z) ^ y 6= z, that captures the inconsistencies wrt FD.

We will apply to (20) the techniques for elimination of SO quantifiers developed in [ 19 ] on the basis of Ackerman’s Lemma [ 2, 3 ]. First of all, we express (20) as an equivalent universally quantified formula (for simplicity, we use U instead of Uf ): 8U (8xyz(·(x; y; z) ! U (x; y) _ U (x; z)) ^ U · Pf ! Pf · U ): Its negation produces the existentially quantified formula

9U (8xyz(·(x; y; z) ! U (x; y) _ U (x; z)) ^ U · Pf ^ :Pf · U ): We obtain the following logically equivalent formulas 9U ( 8xyz(:·(x; y; z) _ U (x; y) _ U (x; z)) ^ 8uv(:U (u; v) _ Pf (u; v)) ^ 9st(Pf (s; t) ^ :U (s; t))): (21) (22) (23) 9st9U ( 8xyz(:·(x; y; z) _ U (x; y) _ U (x; z)) ^

8uv(:U (u; v) _ Pf (u; v)) ^ (Pf (s; t) ^ :U (s; t))): The first conjunct in (23), with w = _(y; z) standing for (w = y _ w = z), can be written as (cf. [ 11 ] for all the details): 8xyz(:·(x; y; z) _ 9w(w = _(y; z) ^ U (x; w))). Equivalently, 9f 8r(8x1y1z1(:·(x1; y1; z1) _ f (x1; y1; z1) = _(y1; z1))^ 8xyz(:·(x; y; z)_r 6= f (x; y; z)_U (x; r))): Here, 9f is a quantification over functions. Thus, formula (23) becomes 9st9f 9U 8x8r((8x1y1z1(:·(x1; y1; z1) _ f (x1; y1; z1) = _(y1; z1))^ 8yz(:·(x; y; z) _ r 6= f (x; y; z) _ U (x; r)))^

8uv(:U (u; v) _ Pf (u; v)) ^ (Pf (s; t) ^ :U (s; t))): Now we are ready to apply Ackermann’s lemma. The last formula can be written as 9st9f 9U 8x8r((A(x; r) _ U (x; r)) ^ B(:U 7! U )): (24) B(:U 7! U ) denotes the formula B where predicate U has been replaced by :U . Here, formulas A; B are as follows A(x; r) : 8yz(8yz(:·(x; y; z) _ r 6= f (x; y; z)): B(U ) : 8x1y1z1(:·(x1; y1; z1) _ f (x1; y1; z1) = _(y1; z1)) ^

8uv(U (u; v) _ Pf (u; v)) ^ (Pf (s; t) ^ U (s; t))): Formula B is positive in U . In consequence, the whole subformula in (24) starting with 9U can be equivalently replaced by B(A(x; r) 7! U ) [19, lemma 1], getting rid of the SO variable U , and thus obtaining (modulo simple syntactic steps) 9st9f 8xyz((:·(x; y; z)_f (x; y; z) = _(y; z))^(:·(x; y; z)_Pf (u; f (x; y; z)))^ (Pf (s; t) ^ (x 6= s _ :·(x; y; z) _ t 6= f (x; y; z)))): Now we unskolemize, getting rid of the function variable f , obtaining 9st8xyz9w((:·(x; y; z) _ w = _(y; z)) ^ (:·(x; y; z) _ Pf (u; w))^ (Pf (s; t) ^ (x 6= s _ :·(x; y; z) _ t 6= w))): This formula is logically equivalent to the negation of (21). Negating again, we obtain a formula that is logically equivalent to (21), namely 8st(Pf (s; t) ! 9xyz(·(x; y; z) ^ 8w[(w 6= y ^ w 6= z)_

:Pf (x; w) _ (x = s ^ t = w)]).

The subformula inside the square brackets can be equivalently replaced by ((w = y _ w = z) ^ Pf (x; w)) ! (s = x ^ t = w). So, we obtain 8st(Pf (s; t) ! 9xyz(·(x; y; z) ^ (Pf (x; y) ! s = x ^ t = y) ^ (Pf (x; z) ! s = x ^ t = z))).

Due to the definition of ·(x; y; z), it must hold y 6= z. In consequence, we obtain 8st(Pf (s; t) ! 9z(·(s; t; z) ^ :Pf (s; z))).

Proposition 4. Let FD be 8xyz(P (x; y) ^ P (x; z) ! y = z). The SO sentence for the repair program ¦(D; FD ) is logically equivalent to a FO sentence, namely to the conjunction of (12), (14) (i.e. the completions of the predicates P; P??, resp.), (15), and 8st(Pf (s; t) ! 9z(·(s; t; z) ^ :Pf (s; z))); where ·(x; y; z) is the formula that captures a violation of the FD, i.e. (P (x; y) ^ P (x; z) ^ y 6= z). ¥ This is saying, in particular, that whenever there is a conflict between two tuples, one of them must be deleted, and for every deleted tuple due to a violation, there must be a tuple with the same key value that has not been deleted. Thus, not all mutually conflicting tuples can be deleted.

Now, reconsidering CQA, if we have a query Q, we can obtain the consistent answers a¹ as entailments in classical predicate logic: à ^ 8x¹(AnsQ(x¹)) ´ Â(x¹)) j= AnsQ(a¹); (25) (26) where à is the FO sentence that is the conjunction of (12), (14), (15) and (25); and  is the FO definition of AnsQ in terms of P??.

For example, for Q : P (x; y), we have, instead of (19):

à ^ 8x8y(Ans(x; y) ´ P??(x; y)) j= Ans(t1; t2): From here we obtain, using (14), that (t1; t2) is a consistent answer iff à j= P??(t1; t2) iff à j= (P (t1; t2) ^ :Pf (t1; t2)). That is, fR(D); 8xyz(·(x; y; z) ! (Pf (x; y) _ Pf (x; z)));

8xy(Pf (x; y) ! 9z(·(x; y; z) ^ :Pf (x; z)))g j= P (t1; t2) ^ :Pf (t1; t2): (27) This requires P (t1; t2) to hold in R(D), and the negation of :Pf (t1; t2) to be inconsistent with the theory on the LHS of (27). This happens iff 8z:·(t1; t2; z) follows from R(D). In consequence, (t1; t2) is a consistent answer iff R(D) j= P (t1; t2) ^ 8z:·(t1; t2; z), which is equivalent to

D j= P (t1; t2) ^ :9z(P (t1; z) ^ z 6= t2): (28) The rewriting in (28), already presented in Example 1, is one of those obtained in [ 4 ] using a more general rewriting methodology for queries that are quantifier-free conjunctions of database literals and classes of ICs that include FDs. The technique in [ 4 ] is not based on explicit specification of repairs. Actually, it relies on an iteration of resolution steps between ICs and intermediate queries, and is not defined for queries or ICs with existential quantifiers. Rewriting (28) is also a particular case of a result in [16, theo. 3.2] on FO rewritability of CQA for conjunctive queries without free variables.6

Notice that (26), in spite of being expressed as entailment in FO logic, does not necessarily allow us to obtain a FO rewriting to consistently answering query Q(x¹). 6 That result can be applied with our query Q(x; y) : P (x; y), by transforming it first into 9x9y(P (x; y) ^ x = t1 ^ y = t2), with generic, symbolic constants t1; t2, as above. A FO rewriting, and the subsequent polynomial-time data complexity, are guaranteed when we obtain a condition of the form D j= '(t¹) for consistent answers t¹, and ' is a FO formula expressed in terms of the database predicates in D. This is different from we could naively obtain from (26), namely a sentence containing possibly complex and implicit view definitions, like the derived definition of Pf above. A finer analysis from (26) is required in order to obtain a FO rewriting, whenever possible.

The particular case considered in Proposition 4 has all the features of the case of FDs most studied in the literature, namely where there is one FD per database predicate [ 16, 26, 40 ]. Under this assumption, if we have a class of FDs involving different predicates, we can treat each of the FDs separately, because there is no interaction between them. So, each predicate Pf can be circumscribed independently from the others, obtaining results similar to those for the particular case.

5 Conclusions

Repair programs for CQA have been well studied in the literature. They specify the database repairs as their stable models. On their basis, and using available implementations for the disjunctive stable model semantics for logic programs, we have the most general mechanism for CQA [ 14 ]. As expected, given the nature of CQA, its semantics is non-monotonic, and its logic is non-classical. In this work we have presented the first steps of an ongoing research program that aims to take advantage of specifications of database repairs in classical logic, from which CQA can be done as logical entailment.

That stable models, and in particular database repairs, can be specified in SO logic can be obtained from complexity-theoretic results. The decision problem of stable model checking (SMC) consists in deciding if, for a fixed program, a certain finite input set of atoms is a stable model of the program. The repair checking problem (RC) consists, for a fixed set of ICs IC , if D0 if a repair of D wrt to IC. Here, D; D0 are inputs to the problem. Both SMC and RC are coNP -complete (cf. [ 21 ] and [ 16 ], resp.). Since by Fagin’s theorem (cf. [ 22 ] and [29, chapter 9]), universal SO logic captures the class coNP , there is a a universal SO sentence that specifies the repairs. For the same reason, the stable models of a fixed program can be specified in universal SO classical logic. (Cf. also [ 20 ] for applications of such representation results.)

In this work we have shown concrete specifications of repairs in SO classical logic. They have been obtained from the results in [ 23 ], that presents a characterization of the stable models as models of a theory in SO predicate logic. However, due to the nature of repair programs, we are able to provide a circumscriptive SO characterization of them. A first and preliminary circumscriptive approach to the specification of database repair was presented in [ 9 ].

Furthermore, we have shown, starting from the SO specification of stable models in [ 23 ], that, in the case of repair programs wrt functional dependencies, it is possible to obtain a specification in first-order classical logic. The FO theory can be obtained from the circumscriptive theory by newer quantifier elimination techniques that have their origin in the work of Herbrand on decidable classes for the decision problem. In particular, we have shown that it is possible to obtain FO rewritings for CQA of the kind presented in [ 4 ].

Many problems are open for ongoing and future research. For example, and most prominently, the natural question is as to whether the combination of a repair program and a query program can be used, through their transformation, to obtain more efficient algorithms that the standard way of evaluating disjunctive logic programs under the stable model semantics. We know that, in the worst cases of CQA, this is not possible, but it should be possible for easier classes of queries and ICs.

More specifically, the following are natural problems to consider: (a) Identification of classes of ICs and queries for which repair programs can be automatically “simplified” into queries of lower complexity. In particular, reobtaining previously identified classes, and identifying new ones. (b) More generally, we would like to obtain new complexity results for CQA. (c) Shed more light on those cases, possibly classes, where CQA can be done in polynomial time, but not via FO rewriting.

Furthermore, the “logic” of CQA is not fully understood yet. We should be able to better understand the logic of CQA through the analysis of repair programs. However, their version in classical logic as presented in this work seems more appropriate for this task. For example, we would like to obtain results about compositionality of CQA, i.e. computing consisting answers to queries on the bases of consistent answers to subqueries or auxiliary views. Techniques of this kind are important for the practice of CQA. We know how to logically manipulate and transform a specification written in classical FO or SO logic, which is not necessarily the case for logic programs. It seems to be easier to (meta)reason about the specification if it is written in classical logical than written as a logic program, which is mainly designed to compute from it.

Also dynamic aspects of CQA have been largely neglected (cf. [ 33 ] for some initial results). Computational complexity results and incremental algorithms for CQA are still missing. Results on updates of logic programs and/or theories in classical logic might be used in this direction.

Acknowledgements: Useful comments from anonymous reviewers are much appreciated.

Appendix: Basic Notions

Disjunctive logic programs

We consider disjunctive Datalog programs ¦ [ 21 ] with a finite number of rules of the form

A1 _ : : : An à P1; : : : ; Pm; not N1; : : : ; not Nk; with 0 · n; m; k, and the Ai; Pj ; Ns are positive FO atoms. The terms in these atoms are constants or variables. The variables in the Ai; Ns appear all among those in the Pj . The constants in the program ¦ form the (finite) Herbrand universe U of the program. The ground version of program ¦, gr (¦), is obtained by instantiating the variables in ¦ in all possible combinations using values from U . The Herbrand base HB of ¦ consists of all the possible atomic sentences obtained by instantiating the predicates in ¦ in U . A subset M of HB is a model of ¦ it is satisfies gr (¦), that is: For every ground rule A1 _ : : : An à P1; : : : ; Pm; not N1; : : : ; not Nk of gr (¦), if fP1; : : : ; Pmg µ M and fN1; : : : ; Nkg \ M = ;, then fA1; : : : ; Ang \ M 6= ;. M is a minimal model of ¦ if it is a model of ¦, and ¦ has no model that is properly contained in M . MM (¦) denotes the class of minimal models of ¦.

Now, take S µ HB (¦), and transform gr (¦) into a new, positive program gr (¦) # (i.e. without not ), as follows: Delete every rule A1 _ : : : An à P1; : : : ; Pm; not N1; : : : ; not Nk for which fN1; : : : ; Nkg \ S 6= ;. Next, transform each remaining rule A1 _ : : : An à P1; : : : ; Pm; not N1; : : : ; not Nk into A1 _ : : : An à P1; : : : ; Pm. Now, S is a stable model of ¦ if S 2 MM (gr (¦) #).

A disjunctive Datalog program is stratified if its set of predicates P can be partitioned into a sequence P1; : : : ; Pk in such a way that, for every P 2 P: 1. If P 2 Pi and predicate Q appears in a head of a rule with P , then Q 2 Pi. 2. If P 2 Pi and Q appears positively in the body of a rule that has P in the head, then Q 2 Pj , with j · i. 3. If P 2 Pi and Q appears negatively in the body of a rule that has P in the head, then Q 2 Pj , with j < i.

If a program is stratified, then its stable models can be computed bottom-up by propagating data upwards from the underlying extensional database, and making sure to minimize the selection of true atoms from the disjunctive heads. Since the latter introduce a form of non-determinism, a program may have several stable models.

References

[1] Abiteboul , S. , Hull , R. and Vianu , V. Foundations of Databases. Addison-Wesley, 1995 .

[2] Ackermann , W. Untersuchungen u¨ber das Eliminationsproblem der mathematischen Logik . Mathematische Annalen , 1935 , 110 : 390 - 413 .

[3] Ackermann , W. Solvable cases of the Decision Problem. North-Holland Pub . Co., 1954 .

[4] Arenas , M. , Bertossi , L. and Chomicki , J. Consistent Query Answers in Inconsistent Databases. Proc. ACM Symposium on Principles of Database Systems , ACM Press, 1999 , pp. 68 - 79 .

[5] Arenas , M. , Bertossi , L. and Chomicki , J. Answer Sets for Consistent Query Answering in Inconsistent Databases . Theory and Practice of Logic Programming , 2003 , 3 ( 45 ): 393 - 424 .

[6] Barcelo , P. and Bertossi , L. Logic Programs for Querying Inconsistent Databases . Proc. Practical Aspects of Declarative Languages , Springer LNCS 2562, 2003 , pp. 208 - 222 .

[7] Barcelo , P. , Bertossi , L. and Bravo , L. Characterizing and Computing Semantically Correct Answers from Databases with Annotated Logic and Answer Sets . In Semantics of Databases , Springer LNCS 2582, 2003 , pp. 1 - 27 .

[8] Ben-Eliyahu , R. and Dechter , R. Propositional Semantics for Disjunctive Logic Programs . Annals of Mathematics and Artificial Intelligence , 1994 , 12 ( 1-2 ): 53 - 87 .

[9] Bertossi , L. and Schwind , C. Database Repairs and Analytic Tableaux . Annals of Mathematics and Artificial Intelligence , 2004 , 40 ( 1-2 ): 5 - 35 .

[10] Bertossi , L. Consistent Query Answering in Databases . In ACM Sigmod Record , June 2006 , 35 ( 2 ): 68 - 76 .

[11] Bertossi , L. From Database Repair Programs to Consistent Query Answering in Classical Logic . Extended version: http://www.scs.carleton.ca/»bertossi/papers/FrRP2CQAext2.pdf

[12] Bravo , L. , Bertossi , L. Semantically Correct Query Answers in the Presence of Null Values . Proc. EDBT WS on Inconsistency and Incompleteness in Databases , Springer LNCS 4254, 2006 , pp. 336 - 357 .

[13] Caniupan , M. , Bertossi , L. Optimizing Repair Programs for Consistent Query Answering . Proc. International Conference of the Chilean Computer Science Society , IEEE Computer Society Press, 2005 , pp. 3 - 12 .

[14] Caniupan , M. , Bertossi , L. The Consistency Extractor System: Querying Inconsistent Databases using Answer Set Programs . Proc. of the Scalable Uncertainty Management Conference , Springer LNCS 4772, 2007 , pp. 74 - 88 .

[15] Caniupan , M. and Bertossi , L. The Consistency Extractor System: Answer Set Programs for Consistent Query Answering in Databases . Journal submission , 2009 .

[16] Chomicki , J. and Marcinkowski , J. Minimal-Change Integrity Maintenance using Tuple Deletions . Information and Computation , 2005 , 197 ( 1-2 ): 90121 .

[17] Chomicki , J. Consistent Query Answering: Five Easy Pieces . Proc. International Conference on Database Theory , Springer LNCS 4353, 2007 , pp. 1 - 17 .

[18] Dantsin , E. , Eiter , T. , Gottlob , G. and Voronkov, A. Complexity and Expressive Power of Logic Programming . ACM Computing Surveys , 2001 , 33 ( 3 ): 374 - 425 .

[19] Doherty , P. , Lukaszewicz , W. and Szalas , A. Computing Circumscription Revisited . A Reduction Algorithm . Journal of Automated Reasoning , 1997 , 18 ( 3 ): 297 - 336 .

[20] Eiter , T. and Gottlob , G. Expressiveness of Stable Model Semantics for Disjunctive Logic Programs with Functions . Journal of Logic Programming , 1997 , 33 ( 2 ): 167 - 178 .

[21] Eiter , T. , Gottlob , G. and Mannila , H. Disjunctive Datalog . ACM Transactions on Database Systems , 1997 , 22 ( 3 ): 364 - 418 .

[22] Fagin , R. Generalized First-Order Spectra and Polynomial-Time Recognizable Sets . In Complexity of Computation, R. Karp (ed.), SIAM-AMS Proceedings 7 , 1974 , pp. 43 - 73 .

[23] Ferraris , P. , Lee , J. and Lifschitz , V. A New Perspective on Stable Models . In Proc. International Joint Conference on Artificial Intelligence , 2007 , pp. 372 - 379 .

[24] Ferraris , P. , Lee , J. and Lifschitz , V. Stable Models and Circumscription. Artificial Intelligence (to appear). http://www.cs.utexas.edu/users/vl/papers/smcirc.ps

[25] Fuxman , A. and Miller , R. Towards Inconsistency Management in Data Integration Systems . Proc. Workshop on Information Integration on the Web (IIWeb) , 2003 .

[26] Fuxman , A. and Miller , R. First-Order Query Rewriting for Inconsistent Databases . J. Computer and Systems Sciences , 2007 , 73 ( 4 ): 610 - 635 .

[27] Gelfond , M. , Lifschitz , V. Classical Negation in Logic Programs and Disjunctive Databases . New Generation Computing, 1991 , 9 ( 3 /4): 365 - 385 .

[28] Greco , G. , Greco , S. and Zumpano , E. A Logical Framework for Querying and Repairing Inconsistent Databases . IEEE Transactions on Knowledge and Data Engineering , 2003 , 15 ( 6 ): 13891408 .

[29] Libkin , L. Elements of Finite Model Theory . Springer, 2004 .

[30] Lifschitz , V. Computing Circumscription . Proc. International Joint Conference on Artificial Intelligence , Morgan Kaufmann, 1985 , pp. 121 - 127 .

[31] Lifschitz , V. Circumscription . In Handbook of Logic in Artificial Intelligence and Logic Programming , Vol. 3 . Oxford University Press, 1994 , pp. 297 - 352 .

[32] Lloyd , J.W. Foundations of Logic Programming . Springer Verlag, 1987 .

[33] Lopatenko , A. and Bertossi , L. Complexity of Consistent Query Answering in Databases under Cardinality-Based and Incremental Repair Semantics . Proc. International Conference of Database Theory , Springer LNCS 4353, 2007 , pp. 179 - 193 .

[34] Lifschitz , V. and Turner , H. Splitting a Logic Program . Proc. International Conference on Logic Programming , MIT Press, 1994 , pp. 23 - 37 .

[35] Lifschitz , V. Twelve Definitions of Stable Model . Proceedings International Conference on Logic Programming . Springer LNCS 5366 , 2008 , pp. 37 - 51 .

[36] McCarthy , J. Circumscription - A Form of Non-Monotonic Reasoning . Artificial Intelligence , 1980 , 13 ( 1-2 ): 27 - 39 .

[37] Przymusinski , T. On the Declarative Semantics of Deductive Databases and Logic Programs . In Foundations of Deductive Databases and Logic Programming , J. Minker (ed.), Morgan Kaufmann Publishers Inc., 1988 , pp. 193 - 216 .

[38] Przymusinski , T. Stable Semantics for Disjunctive Programs . New Generation Computing, 1991 , 9 ( 3 /4): 401 - 424 .

[39] Reiter , R. Towards a Logical Reconstruction of Relational Database Theory . In On Conceptual Modelling, M.L. Brodie , J. Mylopoulos and J.W. Schmidt (eds.), Springer, 1984 , pp. 191 - 233 .

[40] Wijsen , J. On the Consistent Rewriting of Conjunctive Queries Under Primary Key Constraints . Proc. International Symposium on Database Programming Languages , Springer LNCS 4797, 2007 , pp. 112 - 126 .

Let P ¹ ; Q¹ be disjoint tuples of FO predicates. The circumscription of P¹ wrt ¹ in the FO sentence §(P¹; Q¹) with variable Q¹ can be expressed by means of the SO sentence [30] Circ(§(P¹; Q¹); P¹; Q¹): §(P¹; Q ¹) ^ :9X¹ Y ¹ (§(X¹ ; Y¹ ) ^ X¹ ¹ P¹ ^ X¹ 6= P¹); where X¹ ; Y¹ are tuples of SO variables that replace P¹, resp. Q¹ in §(P¹; Q¹), producing §(X¹ ; Y¹ ) . Here, ¹ stands for a FO definable pre-order relation (reflexive and transitive) between tuples of predicate extensions. All the other predicates in §(P¹; Q¹) are left untouched and they are kept fixed during the minimization of those in P¹, while those in Q¹ become flexible . By appropriately choosing the relation ¹, different forms of circumscription can be captured. Prioritized circumscription is based on a prioritized partial order relation between tuples S¹ = (S1; : : : ; Sm) , and T¹ = (T1; : : : ; Tm) of similar predicates (i.e. same length and corresponding arities). It can be defined by S¹ ¹pri T¹ ´ Vim=1(Vij¡=11 Si = Ti ! Si · Ti) . Here, · stands for the subset relation. The parallel circumscription of the predicates in P¹ can be obtained by means of the relation: S¹ ¹par T¹ ´ Vim=1 Si · Ti.