REMERCIEMENTS

Je tiens à remercier tous ceux qui ont permis que ce travail de thèse se déroule dans de bonnes conditions.

En premier lieu, un très grand merci à Meghyn et François pour avoir été d'excellents directeurs de thèse. Merci pour votre confiance et votre disponibilité. Vos conseils et votre aide ont été précieux. Je suis consciente de la chance que j'ai eu de travailler avec vous et espère en avoir encore l'occasion.

Je remercie vivement Maurizio

Lenzerini et Marie-Laure Mugnier d'avoir accepté d'être rapporteurs et pour leur relecture attentive de ce manuscrit. Merci également à Christine Froidevaux et Marie-Christine Rousset d'avoir accepté de faire partie de mon jury.

Merci aussi à tous ceux que j'ai rencontrés dans le cadre de cette thèse: mes collègues du LRI, membres de l'équipe LaHDAK, des équipes pédagogiques dans lesquelles j'ai effectué mon enseignement, ou des équipes administratives et techniques; ceux de l'équipe Inria CEDAR, en particulier ceux qui m'ont aidée pour les expérimentations, et ceux de l'équipe GraphIK du LIRMM qui m'a accueillie pendant trois mois. Je remercie en particulier les membres du projet PAGODA pour les discussions enrichissantes que nous avons eues.

Enfin, merci à mes proches qui m'ont accompagnée durant ces trois ans. Merci pour votre soutien et les bons moments partagés.

INTRODUCTION

Ontology-mediated query answering

With the increase of the volume of available data comes the problem of being able to exploit it. Querying data in an accurate and efficient way is a complex task and has attracted a lot of interest. Among the challenges to address in this context, it is necessary to allow the integration of data coming from different sources using different vocabularies and the formulation of queries in a simple and intuitive way, with a vocabulary that closely matches the user's conceptualization of the world. For instance, suppose that someone needs to find the professors of a university department who teach a course related to the topic of artificial intelligence. Suppose that he has got a record of the department members with their positions, and a list of courses with their instructors. If he simply integrates this data into a traditional database and queries it in the straightforward way, asking "select every professor who teaches artificial intelligence", he may encounter two problems: first, the positions of the department members will not be recorded simply as "professor" but rather with their degree of seniority ("full professor", "associate professor" and "assistant professor" for instance), second many courses that concern a subfield of artificial intelligence will be missed by such a query (for instance courses recorded as "machine learning", "knowledge representation", or "description logics" will not be recognized as artificial intelligence courses). He therefore has to find first the different denominations that correspond to a professor position and the different fields and subfields of artificial intelligence, and reformulate his query accordingly, which may become quite complex. Ontology-mediated query answering is a recent paradigm that adds a semantic layer on top of the data by the means of a logical theory called an ontology, which formalizes knowledge about a particular domain and is used to reason about the data in order to provide more complete answers to queries. In our example, adding to the dataset an ontology that provides knowledge about the fields and subfields of computer science as well as about the university organization will allow the user to get every relevant answer while posing his question in the way which is natural for him.

Description logics [Baader et al. 2003] are a family of fragments of classical first-order logics which are widely used as ontology languages. A description logic knowledge base consists in an ontology, called a TBox, which expresses general knowledge and rules about the domain of interest, and a dataset, called an ABox, which provides information about Introduction specific individuals. For instance, the TBox of a knowledge base about the university domain could indicate that courses are taught by faculty members and followed by students, and its ABox could state that an individual named Ann gives a database course which is taken by another individual Bob.

Enriching the data with an ontology comes at a price: using an ontology increases the computational complexity of query answering. Since scalability is essential for datarich applications, there has been an increasing interest in lightweight description logics, which offer a good trade-off between the expressivity of the language and the computational complexity of the associated reasoning problems. In particular, the DL-Lite family [Calvanese et al. 2007] has been especially tailored for ontology-mediated query answering and allows it to be reduced, via query rewriting, to standard database query evaluation. In this thesis we adopt the language DL-Lite R , which is the dialect of the DL-Lite family that underlies OWL 2 QL [Motik et al. 2012], i.e. the OWL2 profile devoted to query answering of the standard for the Semantic Web.

Inconsistency handling

An important issue that arises in the context of ontology-mediated query answering is how to handle the case in which the data is inconsistent with the ontology. Indeed, while the TBox is generally rather small and extensively debugged by experts of the domain, the ABox is typically large, subject to frequent modifications, and may results from the integration of different data sources, which make errors likely. The problem is that an inconsistent knowledge base implies any logical sentence, so posing a query over such a knowledge base will result in getting every possible answer formed with the individuals of the knowledge base as an answer. For instance, if a knowledge base indicates that it is not possible to be a full professor and an assistant professor at the same time, and that an individual Ann is said to be both, the knowledge base will allow us to derive not only that Ann is a full and an assistant professor, but also that Ann is a course for example, which is clearly undesirable.

There are two possible attitudes in this context. The first one is to restore the consistency, for instance by dropping one or both assertions about the seniority of Ann in our example, but it may be impossible to do that in a satisfying way. Indeed, we often do not know how to repair the data (is Ann an assistant, or a full professor?), and removing every piece of information that is doubtful because involved in some contradiction will often lead to an unacceptable loss of information. Moreover, examining manually every conflict in the data will be too costly when repairing a large dataset. The second option is to decide to live with the inconsistencies, by trying to get meaningful answers to queries from inconsistent knowledge bases. For instance, it may be acceptable to derive that Ann is a professor, but not that she is a course. Several inconsistency-tolerant semantics have been defined to achieve this goal. The most well-known is the AR semantics [START_REF] Lembo | [END_REF]], which retrieves the answers which hold in each of the maximal consistent subsets of the data, called repairs. This semantics amounts to considering true the answers that hold no matter which possible world is chosen. For instance, it will allow us to find that Ann is a professor, without any information on her degree of seniority. The drawback of this semantics is that it is computationally hard. Indeed, over DL-Lite knowledge bases, conjunctive query entailment under AR semantics is intractable, even when the complexity is measured only w.r.t. the size of the data. To overcome this difficulty, a data-tractable sound approximation of AR, called the IAR semantics, has been introduced in [START_REF] Lembo | [END_REF]]. The IAR-answers are obtained by querying the intersection of the repairs. This semantics is also interesting by itself, because it retains only the "surest" answers, whose supports are not involved in any contradiction. Under this semantics, no information about Ann will be retrieved, because the reasons for thinking that Ann is a professor are both contradicted, so not completely reliable. At the other end of the scale, the brave semantics provides every answer that holds in some repair [START_REF] Bienvenu | [END_REF]. It may indeed be important for some applications not to miss any possible answer that has some consistent reason to hold. Using the brave semantics allows us to find that Ann may be a full professor as well as she may be an assistant professor.

Contributions

This thesis aims at developing methods to practically deal with inconsistent knowledge bases. In particular, we defend the idea that even if the AR semantics is intractable, it can be used in practice.

Our first contribution is indeed an approach for classifying the answers into classes of increasing reliability, depending on they are entailed under IAR, AR or brave semantics. For the AR semantics, the brave and IAR semantics provide tractable upper and lower bounds and a translation into propositional satisfiability allows us to decide whether the brave and non-IAR answers are entailed under AR.

Beyond efficient query answering, it is important to be able to provide explanations of the query results under inconsistency-tolerant query answering. Indeed, a user may naturally wonder why an answer belongs to one of these classes (e.g. why Ann is said to be a professor under AR semantics but not under IAR semantics?). That is why our second contribution is a framework for explaining positive and negative answers of a query under AR, IAR or brave semantics (e.g. Ann is probably a professor because she is either an assistant professor or a full professor in every possible world, but none of these reasons is beyond doubt since they contradict each other). We believe that such facilities are essential to make inconsistency-tolerant semantics really usable.

Our third contribution is a query-driven approach for partially repairing the data. Indeed, while alternative semantics are necessary to deal with inconsistent knowledge bases, they cannot replace the need for improving the data quality. We propose to exploit the feedback of the user at query time about the answers that are correct or incorrect to clean the dataset, focusing on the part which is useful for the user needs and that he knows well enough to repair (e.g. if the user knows that Ann is actually an assistant professor, we can delete the data asserting that she is a full professor, since we know that she cannot be both).

The last contribution of the thesis is the investigation of variants of AR, IAR and brave semantics obtained by replacing the classical notion of a repair by preferred repairs. This allows us to take into account the information about the reliability of the data (e.g. if the piece of information that Ann is an assistant professor comes from a more reliable source than those that Ann is a full professor, we can keep only the repairs that contain the former, and conclude that Ann is a professor even under IAR semantics).

Introduction

For each of the issues we consider, we analyze the computational complexity of the related problems, and propose algorithms to solve them, relying on performances of modernday SAT solvers to practically handle those which are hard. We implemented most of these algorithms in our CQAPri1 prototype and empirically study their properties using a benchmark we built upon the well-known DL-Lite R benchmark LUBM 9 20 .

Organization of the thesis

The thesis is organized as follows:

Chapter 2 This chapter introduces the framework of ontology-mediated query answering in the setting of description logics, focusing on the lightweight description logic DL-Lite R that we adopt in this work. In the second half of chapter, we review the alternative semantics that have been proposed to deal with inconsistent data in this context.

Chapter 3 In this chapter, we present the algorithms implemented in our CQAPri prototype system for query answering under AR, IAR and brave semantics over DL-Lite R knowledge bases. Then, we describe the experimental setting we built to evaluate it, as well as the results we obtained, and briefly discuss other existing systems and benchmarks for inconsistencytolerant query answering.

Chapter 4 We address in this chapter the problem of explaining why a tuple is or is not an answer to a query under the IAR, AR or brave semantics. We define data-centric explanations for positive and negative answers, study their computational complexity in DL-Lite R , and propose algorithms to compute them by exploiting solvers for Boolean satisfaction and optimization problems. We also present our implementation within CQAPri and the experiments we conducted.

Chapter 5 This chapter addresses the problem of query-driven repairing of inconsistent DL-Lite R knowledge bases. The scenario we consider is the following: a user receives query answers under inconsistency-tolerant semantics, and provides feedback about which answers are erroneous, or are indeed answers and should hold under a stronger semantics.

The aim is to find a set of ABox modifications (deletions and additions), called a repair plan, that addresses as many of the defects as possible. After formalizing this problem and introducing different notions of optimality, we investigate the computational complexity of reasoning about optimal repair plans and propose interactive algorithms for computing such plans. For deletion-only repair plans, we propose an improved algorithm and present the implementation of its core components in our CQAPri system.

Chapter 6 In this chapter, we investigate variants of the AR, IAR and brave semantics obtained by replacing the classical notion of repair by one of four different types of preferred repairs (e.g. cardinality-maximal repairs, or repairs based on priority levels that distinguish more or less reliable assertions). We analyze the complexity of query answering under the resulting semantics, and propose an approach exploiting a SAT encoding for the semantics based on repairs using priority levels, whose data complexity is "only" coNP-complete, as for plain AR semantics. We then present our implementation of these semantics and its experimental evaluation.

Chapter 7 In this chapter, we position our work in a more general context and provide more details on some topics mentioned in the other chapters.

Chapter 8 This chapter summarizes our contributions and indicates some possible extensions of this work.

Appendix A The appendix provides basics elements of computational complexity theory and of propositional logic, and recalls the definitions of the different complexity classes appearing in this thesis and of the problems used in the complexity proofs.

PRELIMINARIES

In this chapter, we first introduce the framework of ontology-mediated query answering in the setting of description logics. We focus in this thesis on the lightweight description logic DL-Lite that has been especially designed for scalable query answering, and in particular on its dialect DL-Lite R . In the second half of chapter, we review the alternative semantics that have been proposed to deal with inconsistent data in the context of ontology-mediated query answering.

Ontology-mediated query answering in DL-Lite

Ontologies are logical theories that formalize the knowledge about a domain of interest. Using such formalism makes information sharing easier by providing a standardized terminology with an unambiguous semantics. Moreover, by making knowledge processable by computers, ontologies support complex automatic reasoning to infer new knowledge from that originally formulated by some experts of the domain. Recent years have seen an increasing interest in ontology-mediated query answering (OMQA) in which conceptual knowledge provided by an ontology is exploited when querying incomplete data (cf. [Bienvenu & Ortiz 2015] for a survey). The ontology provides an enriched vocabulary that may help users to formulate queries in a terminology that is closer to the one they are familiar with, without having to take into account the way the data is stored and the vocabulary of the database schema. It also allows the integration of different data sources using different vocabularies in one single conceptual model. Moreover, OMQA provides more complete answers to queries by taking into account implicit consequences of the facts stored in the data that follow from the rules formalized in the ontology.

Description logic basics

Description logics (DLs) [Baader et al. 2003] are a family of decidable fragments of classical first-order predicate logic, which are popular ontology languages. They provide the basis for the web ontology language (OWL) [Motik et al. 2012], which is the standard of the World Wide Web Consortium (W3C) for the Semantic Web.

Preliminaries Syntax

A DL knowledge base is built using a DL vocabulary consisting of three countably infinite, pairwise disjoint sets of symbols:

• N I is the set of individuals, which are constants referring to specific objects of the domain of interest • N

C is the set of concept names, which are unary predicates representing sets of objects sharing some common characteristics. Concepts are called classes in OWL terminology.

• N R is the set of role names, which are binary predicates representing relationships between objects. Roles are OWL properties.

In this thesis, we will use the university domain for examples.

Example 2.1.1. To build a knowledge base about the university domain, we need to refer to specific university employees, students, courses, and departments like ann, bob, carl, DBcourse, AIcourse, CSdepartment: they are individuals of N I . To represent sets of individuals like professors, students, courses, or departments, we need concept names: Prof, Student, Course, Department are in N C . To talk about relations between them, for instance to express that someone teaches a course, advises a student, or is member of a department, we use role names: Teach, Advise, MemberOf are in N R . /

This vocabulary is used to represent the knowledge about the domain of interest with two kinds of axioms. Terminological axioms express properties of concepts and roles and relations between them, thus specify intensional knowledge, that concern whole groups of individuals (e.g. all professors are PhD holders, what is taught is a course). Assertions are facts about specific individuals which express that an individual belongs to some concept or that a role links two given individuals (e.g. Ann is a professor, Ann teaches the database course), thus specify extensional knowledge.

Definition 2.1.2 (Knowledge base). A TBox is a finite set of terminological axioms and an ABox is a finite set of assertions. A knowledge base (KB) K = hT , Ai is composed of a TBox T and an ABox A. The set of individuals that appear in assertions of A is denoted by Ind(A).

Terminological axioms can involve complex concepts and roles built from the symbols in the vocabulary using constructors. Each particular DL is distinguished by the constructors it offers and restrictions on how to use them in terminological axioms, that allow more or less expressivity. Tables 2.1 and 2.2 show common constructors.

Example 2.1.3. Assertions can state that Ann is a professor (Prof(ann)) that teaches the database course (Teach(ann, DBcourse)) and advises Bob (Advise(ann, bob)).

Terminological axioms can express that every professor is a member of some department (Prof v 9MemberOf.Department), that what is taught is a course (9Teach v Course), or that every professor is either a full professor or an associate professor (Prof v FProf t AProf), but that a full professor cannot be also an associate professor (FProf v ¬AProf). /

Ontology-mediated query answering in DL-Lite

Table 2.1 Syntax and semantics of DL concept constructors: a denotes an individual name, C, C 1 and C 2 (complex) concepts, R a (complex) role, and n a natural number.

Name Syntax Semantics

Top concept

> I Bottom concept ? ; Nominal {a} {a I } Negation ¬C I \C I Conjunction C 1 u C 2 C I 1 \ C I 2 Disjunction C 1 t C 2 C I 1 [ C I 2 Existential restriction 9R {d 1 | there exists (d 1 , d 2 ) 2 R I } Qualified existential restriction 9R.C {d 1 | there exists (d 1 , d 2 ) 2 R I with d 2 2 C I } Qualified universal restriction 8R.C {d 1 | d 2 2 C I for all (d 1 , d 2 ) 2 R I } Unqualified number restrictions nR {d 1 | |{d 2 | (d 1 , d 2 ) 2 R I }| n}  nR {d 1 | |{d 2 | (d 1 , d 2 ) 2 R I }|  n} = nR {d 1 | |{d 2 | (d 1 , d 2 ) 2 R I }| = n} Qualified number restrictions nR.C {d 1 | |{d 2 | (d 1 , d 2 ) 2 R I and d 2 2 C I }| n}  nR.C {d 1 | |{d 2 | (d 1 , d 2 ) 2 R I and d 2 2 C I }|  n} = nR.C {d 1 | |{d 2 | (d 1 , d 2 ) 2 R I and d 2 2 C I }| = n}
Table 2.2 Syntax and semantics of DL role constructors: R and S are (complex) roles.

Name Syntax Semantics

Role negation

¬R ( I ⇥ I )\R I Inverse R {(d 2 , d 1 ) | (d 1 , d 2 ) 2 R I } Composition R S {(d 1 , d 3 ) | (d 1 , d 2 ) 2 R I and (d 2 , d 3 ) 2 S I }
Table 2.3 Syntax and semantics of TBox axioms: C 1 , C 2 denote concepts and R and S roles.

Name Syntax Semantics

Concept inclusion

C 1 v C 2 C I 1 ✓ C I 2 Role inclusion R v S R I ✓ S I Transitivity axiom (trans R) R I R I ✓ R I Functionality axiom (funct R) If (d 1 , d 2 ) 2 R I and (d 1 , d 3 ) 2 R I , then d 2 = d 3 Table 2.

Preliminaries Semantics

One key feature of DLs is the open world assumption. This means that they deal with incomplete information by considering all the possible worlds that would satisfy the axioms of the knowledge base rather than making default assumptions about unspecified information.

It is a difference with the database setting that uses the closed world assumption, where the facts that are not present in the database are considered to be false. The semantics of DLs is therefore given through interpretations. In this thesis, we will make the unique name assumption, assuming that different individual names refer to different individuals.

Definition 2.1.4 (Interpretation). An interpretation is a pair I = ( I , • I ), where I is a non-empty set called the domain and • I is a function that maps each a 2 N I to some a I 2 I , in such a way that a I 6 = b I whenever a 6 = b (unique name assumption), each A 2 N C to a set A I ✓ I , and each R 2 N R to a set of pairs R I ✓ I ⇥ I . The interpretation function is extended to complex concepts and roles as specified in Tables 2.1 and 2.2. Definition 2. 1.5 (Model,entailment). The satisfaction of a TBox axiom or an ABox assertion ⇠ in an interpretation I, denoted I |= ⇠, is defined in Tables 2.3 and 2.4. An interpretation is a model of a TBox T , written I |= T if it satisfies every TBox axiom. It is a model of an ABox A, written I |= A, if it satisfies every ABox assertion. Finally, it is a model of a KB K, written I |= K, if it is a model of the ABox and of the TBox of K.

A TBox is satisfiable, or consistent, if it has at least one model. A KB is satisfiable, or consistent, if it has at least one model. An ABox A is T -consistent if the KB hT , Ai is consistent. We often simply say that A is consistent when there is no ambiguity on the TBox considered.

A TBox axiom or ABox assertion ⇠ is entailed from a KB K, written K |= ⇠, if I |= ⇠ for every I model of K.

Query answering over description logic knowledge bases

Classical reasoning tasks over DL KBs include TBox reasoning, with subsumption (does T |= C 1 v C 2 ?) and classification (find all atomic concepts A, B such that T |= A v B), as well as satisfiability, or consistency checking, (is K = hT , Ai satisfiable?) and instance checking (does hT , Ai |= C(a)?). In this thesis, we study the task of query answering, and focus on the most common query language for OMQA, namely conjunctive queries.

Definition 2.1.6 (Query). A first-order logic (FOL) query over a KB is a first-order logic formula over the KB vocabulary and a set of variables. A query is called Boolean if it has no free variables. Given a query q(x) with free variables x = (x 1 , . . . , x k ) and a tuple of individuals ã = (a 1 , . . . , a k ), we use q(ã) to denote the Boolean query resulting from replacing each x i by a i . Definition 2.1.7 (Conjunctive query). A conjunctive query (CQ) is a FOL query of the form q(x) = 9ỹ (x, ỹ), where is a conjunction of atoms of the forms A(t) or R(t, t 0 ), with t, t 0 individuals or variables from x [ỹ. The free variables x are distinguished, or answer variables. A union of conjunctive queries (UCQ) is a FOL query of the form q(x) = W n i=1 9ỹ i i (x, ỹi ) 2.1 Ontology-mediated query answering in DL-Lite such that each 9ỹ i i (x, ỹi ) is a CQ. A UCQ can be seen as a set of CQs. It is convenient to define the function atoms which gives the set of atoms occurring in a conjunction. Definition 2.1.8 (Boolean query entailment). A Boolean query q is satisfied in an interpretation I, written I |= q, iff q evaluates to true in I. A Boolean query q is entailed by a KB K, written K |= q, iff q is satisfied in every model of K.

The answers of a query are defined through entailment of Boolean queries.

Definition 2.1.9 (Answers in an interpretation). A tuple ã is an answer to a query q(x) in an interpretation I, written I |= q(ã), iff q(ã) is satisfied in I. The set of answers for q(x) in I is written ans(q, I).

Definition 2.1.10 (Certain answers). A tuple ã is a certain answer to a query q(x) over a KB K, written K |= q(ã), iff ã is an answer to q(x) in every model of K. The set of certain answers for q(x) over K is written cert(q, K).

It follows from the definition of certain answers that query answering over DL knowledge bases reduces straightforwardly to Boolean query entailment, since answering q(x) can be done by deciding whether the Boolean query q(ã) is entailed by K for every tuple ã of the same arity as x.

For Boolean CQs (BCQs), we can give a finer definition of answers through the notion of match. A Boolean CQ q = 9ỹ (ỹ) is satisfied in an interpretation I, iff there exists a function ⇡, called a match, from ỹ to I such that I |= ⇠ for every assertion ⇠ 2 atoms( (⇡(ỹ))). A match for a CQ q(x) = 9ỹ (x, ỹ) in an interpretation I is therefore a function ⇡ from the variables in x [ ỹ to objects in I such that I |= (⇡(x), ⇡(ỹ)). By definition, ã 2 ans(q, I) just in the case where there exists a match for q(x) in I that maps each x i 2 x to a i 2 ã.

When we use the generic term query in the following, we mean a CQ.

Complexity measures

There are different complexity measures for the problem of query answering over knowledge bases, depending on what parameters of the problem are regarded as the input. Data complexity considers only the size of the ABox, denoted |A|, whereas KB complexity considers the size of the whole KB (|K| = |A| + |T |), and combined complexity considers the size of the whole problem, i.e. the size of the KB and the size of the query |q|, which is the number of atoms in the query. Data complexity is preferred when the size of the TBox and the size of the query are negligible compared to the size of the ABox, which is the case in the context of OMQA.

The following classes are utilized in this work (cf. Appendix A.1 for more details):

• AC 0 : problems that can be solved by a uniform family of cicuits of constant depth and polynomial-size, with unbounded-fanin AND and OR gates. • P: problems which are solvable in polynomial time in the size of the input.

• NP: problems which are solvable in non-deterministic polynomial time.

Preliminaries

• coNP: problems whose complement is in NP.

• BH 2 : problems that are the intersection of a problem in NP and a problem in coNP. • p 2 : problems which are solvable in polynomial time with an NP oracle. • p 2 [O(log n)]: problems which are solvable in polynomial time with at most logarithmically many calls to an NP oracle. • ⌃ p 2 : problems which are solvable in non-deterministic polynomial time with an NP oracle.

• ⇧ p 2 : problems whose complement is in ⌃ p 2 . These classes are related as follow: AC 0 ⇢ P, P ✓ NP ✓ p 2 ✓ ⌃ p 2 and P ✓ coNP ✓ p 2 ✓ ⇧ p 2 , and it is widely believed that all these inclusions are proper.

Query answering over DL-Lite knowledge bases

As efficiency is a primary concern in OMQA, significant research efforts have been made to identify ontology languages with favorable computational properties to allow querying of large datasets. We focus on the DL-Lite family of description logics [Calvanese et al. 2007], and in particular on the DL-Lite R dialect that underlies the OWL 2 QL profile, which is the OWL profile devoted to query answering. This family is especially interesting because query answering can be reduced to evaluation of standard database queries via query rewriting, thus benefiting from performances of modern database management systems. Example 2.1.11. We will illustrate the definitions and algorithms of the next subsections over the following DL-Lite R KB about the university domain. The TBox expresses that assistant and full professor are two kinds of professors, who are persons, that those who teach are persons and that which are taught are courses, that every professor works for some entity and that working for something implies being member of that thing. Moreover, it states that assistant professors and full professors are disjoint, as are persons and courses. The ABox gives information about different individuals. WorksFor(carl, dpt), Teach(carl, carl)}

Syntax of DL-Lite

Ontology-mediated query answering in DL-Lite

/

There exist several other dialects of the DL-Lite family. In particular, DL-Lite core is the core language of the family and amounts to DL-Lite R without role inclusions; DL-Lite F extends DL-Lite core with functionality axioms on roles or on their inverses of the form (funct S); and DL-Lite A extends DL-Lite core with both role inclusions and functionality with the restriction that functional roles cannot be specialized, i.e. used positively on the right-hand side of a role inclusion.

Most of the results of this thesis can be extended to these other dialects, as we will see in Chapter 8. For this reason, we formulate the preliminary properties for "DL-Lite", which we will use to refer to any of the dialects DL-Lite core , DL-Lite R , DL-Lite F or DL-Lite A .

Query answering through rewriting

A prominent approach for OMQA is query rewriting, where the query is reformulated independently from the ABox to take into account the TBox, then the reformulated query is evaluated over the ABox seen as a database. This technique allows query answering to be reduced to standard database query evaluation. However, it is not guarantee for every DL that it is possible to find such a rewriting. We will denote by I A = ( I A , • I A ) the database-like interpretation of A defined as follows:

• I A = Ind(A) • a I A = a for every a 2 Ind(A)

• A I A = {a | A(a) 2 A} for every A 2 N C • R I A = {(a, b) | R(a, b) 2 A} for every R 2 N R
Definition 2.1.12 (FOL rewriting of a query). A FOL rewriting of a query q w.r.t. a TBox T is a FOL query q 0 such that cert(q, hT , Ai) = ans(q 0 , I A ) for all ABoxes A. When q 0 is a UCQ, we call it a UCQ rewriting.

The DL-Lite family has been especially tailored to be FOL-rewritable, which means that for any satisfiable DL-Lite TBox T and query q, there exists a FOL-rewriting of q w.r.t. T .

Proposition 2.1.13 (FOL-rewritability of DL-Lite). Let T be a satisfiable DL-Lite TBox and q a CQ. It is possible to compute a FOL rewriting q 0 of q in polynomial time w.r.t. the size of the TBox.

Proposition 2.1.14 (UCQ rewriting). Let T be a satisfiable DL-Lite TBox and q a CQ. It is possible to compute a UCQ rewriting of q such that the size of distinct CQs in the rewriting is bounded by O(|T | |q| ).

Many algorithms have been proposed to compute FOL rewritings of CQ in DL-Lite [START_REF] Pérez-Urbina | [END_REF][START_REF] Rosati | [END_REF], Calvanese et al. 2011, Chortaras et al. 2011, Venetis et al. 2012, Rodriguez-Muro et al. 2013, Gottlob et al. 2014],

Preliminaries most of them producing UCQ rewritings. In the following, we assume that UCQRef is such an algorithm that produces a UCQ rewriting of a query w.r.t. a DL-Lite KB.

We illustrate rewriting algorithms with the pioneer algorithm for DL-Lite R , PerfectRef as it is presented in [Calvanese et al. 2007] (Algorithm 2.1). The general idea of the algorithm is to rewrite each atom of the query by applying the positive inclusions of the TBox, and to unify atoms when it is possible.

Definition 2. 1.15 ([Calvanese et al. 2007]). The symbol " " represents non-distinguished non-shared variables. A positive inclusion I is applicable to an atom A(x) if I has A in its right-hand side. A positive inclusion I is applicable to an atom R(x, y) if (i) x = and the right-hand side of I is 9R, or (ii) y = and the right-hand side of I is 9R , or (iii) I is a role inclusion and its right-hand side is either R or R .

Let g be an atom and I be a positive inclusion that is applicable to g. The atom obtained from g by applying I, denoted by gr(g, I), is defined as follows:

• if g = A(x) and I = A 1 v A, then gr(g, I) = A 1 (x) • if g = A(x) and I = 9R v A, then gr(g, I) = R(x, ) • if g = A(x) and I = 9R v A, then gr(g, I) = R( , x) • if g = R(x, ) and I = A v 9R, then gr(g, I) = A(x) • if g = R(x, ) and I = 9R 1 v 9R, then gr(g, I) = R 1 (x, )

• if g = R(x, ) and I = 9R 1 v 9R, then gr(g, I) = R 1 ( , x) • if g = R( , x) and I = A v 9R , then gr(g, I) = A(x) • if g = R( , x) and I = 9R 1 v 9R , then gr(g, I) = R 1 (x, )

• if g = R( , x) and I = 9R 1 v 9R , then gr(g, I) = R 1 ( , x) • if g = R(x, y) and I = R 1 v R or I = R 1 v R , then gr(g, I) = R 1 (x, y) • if g = R(x, y) and I = R 1 v R or I = R 1 v R, then gr(g, I) = R 1 (y, x)

Example 2.1.16 (Example 2.1.11 cont'd). Consider the following query that retrieves every person that is member of something: q(x) = 9yPerson(x) ^MemberOf(x, y).

PerfectRef(q(x), T ) = { 9yPerson(x) ^MemberOf(x, y), Person(x) ^Prof(x), Person(x) ^FProf(x), 9yProf(x) ^MemberOf(x, y), Prof(x), Prof(x) ^FProf(x) , 9yAProf(x) ^MemberOf(x, y), AProf(x) ^Prof(x), AProf(x) ^FProf(x), 9yFProf(x) ^MemberOf(x, y), FProf(x) ^Prof(x), FProf(x), 9yzTeach(x, z) ^MemberOf(x, y), 9zTeach(x, z) ^Prof(x), 9zTeach(x, z) ^FProf(x)} 9yPerson(x) ^WorkFor(x, y), Person(x) ^AProf(x), 9yProf(x) ^WorkFor(x, y), Prof(x) ^AProf(x), 9yAProf(x) ^WorkFor(x, y), AProf(x), 9yFProf(x) ^WorkFor(x, y), FProf(x) ^AProf(x), 9yzTeach(x, z) ^WorkFor(x, y), 9zTeach(x, z) ^AProf(x), 2.1 Ontology-mediated query answering in DL-Lite Algorithm 2.1 PerfectRef [Calvanese et al. 2007] Input: a conjunctive query q, a TBox T Output: a union of conjunctive queries P R 1: P R {q}, P R 0 ; 2: while P R 0 6 = P R do

3: P R 0 P R 4:
for all q 2 P R 0 do 5: for all g 2 q do 6: for all I 2 T applicable to g do for all g 1 , g 2 2 q do 11:

if g 1 and g 2 unify then 12: P R P R [ {reduce(q, g 1 , g 2 )} end for 16: end while 17: Output P R where reduce applies to q the most general unifier between g 1 and g 2 and replaces each unbound variable with Preliminaries PerfectRef(q(x), T ) contains a lot of redundant queries. Only minimal queries, that are not contained in any other, are actually taken into account: {9yPerson(x) ^MemberOf(x, y), 9yPerson(x) ^WorkFor(x, y), Prof(x), FProf(x), 9yzTeach(x, z) ^MemberOf(x, y), 9yzTeach(x, z) ^WorkFor(x, y), AProf(x)}

We detail the steps needed to produce the rewriting Prof(x):

1. Person(x) ^MemberOf(x, ) 2. Prof(x) ^MemberOf(x, ) 3. Prof(x) ^WorkFor(x, ) 4. Prof(x) ^Prof(x) 5. Prof(x) apply I = Prof v Person apply I = WorkFor v MemberOf apply I = Prof v 9WorkFor unification step

/

Answering a CQ q over a consistent DL-Lite KB hT , Ai amounts to searching for matches for the CQs in the UCQ rewriting of q in I A . An image of a CQ q

(x) = 9ỹ (x, ỹ) in A is a set of assertions B ✓ A such that there is a match ⇡ : x [ ỹ 7 ! Ind(B) for q in I B such that atoms( (⇡(x), ⇡(ỹ))) is equal to B.
Since the first-order rewriting of the query is obtained in polynomial time in the size of the TBox, and evaluating first-order formulas over a finite interpretation is in AC 0 in the size of the interpretation, the next theorem follows:

Theorem 2.1.17 ([Calvanese et al. 2007, Artale et al. 2009]). Answering UCQs in DL-Lite is in AC 0 in the size of the ABox (data complexity), and in P in the size of the TBox (so in P w.r.t. KB complexity).

Since conjunctive query entailment in databases is known to be NP-complete w.r.t. combined complexity, query answering in DL-Lite is NP-hard. Membership in NP is shown in [Calvanese et al. 2007] by considering the non-deterministic version of PerfectRef, which non-deterministically returns only one of the conjunctive queries belonging to the reformulation of the input query. They show that this algorithm runs in NP because every query returned by PerfectRef can be generated after a polynomial number of transformations of the initial query.

Theorem 2. 1.18 ([Calvanese et al. 2007, Artale et al. 2009]). Answering UCQs in DL-Lite is NP-complete in combined complexity.

Because of DL-Lite syntax, the rewriting of an instance query consists in a disjunction of instance queries, which can be evaluated in polynomial time by testing every possible matches.

Theorem 2.1.19. Instance checking in DL-Lite is in P w.r.t. combined complexity.

Ontology-mediated query answering in DL-Lite

ABox consistency

We will assume throughout this thesis that the TBoxes of the KBs we consider are consistent. Indeed, the TBox is usually developed by experts and subject to extensive debugging, so it is often reasonable to assume that its content is correct, while the ABox is typically large and subject to frequent modifications, which makes errors likely.

In this case, satisfiability amounts to check whether the ABox is consistent with the TBox. In DL-Lite, ABox consistency checking reduces to answering the union of conjunctive queries corresponding to each possible violation of the TBox constraints: we can build a Boolean query q T unsat that looks for a counterexample to one of the negative inclusions or functional axioms that follow from T , and that evaluates to true over I A just in the case that A is T -inconsistent.

Example 2.1.20 (Example 2.1.11 cont'd). Since T contains the two negative inclusions AProf v ¬FProf, and Person v ¬Course,

q T unsat =UCQRef(9xAProf(x) ^FProf(x), T ) _ UCQRef(9xPerson(x) ^Course(x), T ) =(9xAProf(x) ^FProf(x)) _ (9xPerson(x) ^Course(x))_ (9xProf(x) ^Course(x)) _ (9xAProf(x) ^Course(x))_ (9xFProf(x) ^Course(x)) _ (9xyTeach(x, y) ^Course(x))_ (9xyPerson(x) ^Teach(y, x)) _ (9xyProf(x) ^Teach(y, x))_ (9xyAProf(x) ^Teach(y, x)) _ (9xyFProf(x) ^Teach(y, x))_ (9xyzTeach(x, y) ^Teach(z, x)).
The query q T unsat evaluates to true over I A because A contains AProf(bob) and FProf(bob), so x 7 ! bob is a match for the first CQ of q T unsat in I A . /

Consistency checking has therefore the same complexity as query answering.

Theorem 2.1.21. In DL-Lite, consistency checking is AC 0 w.r.t. data complexity, and in P w.r.t. KB complexity.

Conflicts and causes

When ABoxes are inconsistent, it is important to be able to find the reasons of the inconsistency. We define the notion of conflicts, that are the minimal sets of assertions responsible for the inconsistency:

Definition 2.1.22 (Conflict). A conflict of K = hT , Ai is a minimal T -inconsistent subset of A.
The set of conflicts of K is denoted conflicts(K). It can be represented as a conflict graph, whose vertices are assertions and which is such that there is an edge between two assertions iff they form a conflict, and a self-loop on an assertion iff it is inconsistent.

An ABox is inconsistent just in the case that its set of conflicts is non-empty. The conflicts of a DL-Lite KB can be computed while checking the consistency of the ABox with q T unsat , as

Preliminaries

shown in Algorithm 2.2. Indeed, the conflicts of hT , Ai are exactly the images of the CQs in the rewriting of q T unsat in A that do not contain any other image of such a CQ (e.g. if the query 9xyzR(x, y) ^R(y, z) has two images {R(a, a), R(a, b)} and {R(a, a)}, only {R(a, a)} is a conflict). The query q T unsat is constructed in lines 1 to 10 of the algorithm: for each negative (concept or role) inclusion, and each functionality axiom of T , the conjunctive query looking for a counterexample is constructed, then rewritten with UCQRef, and the rewriting is added to q T unsat . Then the CQs of q T unsat are evaluated, with all their variables considered free, so that their images can be obtained by taking for each answer the atoms of the corresponding Boolean query (lines 12 to 16). Finally, the non-minimal images are removed in order to keep only the conflicts (lines 17 to 23).

Example 2.1.23 (Example 2.1.11 cont'd). The KB K has the following conflicts:

conflicts(K) = {{AProf(bob), FProf(bob)}, {Teach(carl, carl)}}

/

The fact that the CQs in q T unsat are of size two and Theorem 2.1.17 yield the following result:

Proposition 2.1.24. Computing the conflicts of a DL-Lite KB is in P in data and KB complexity.

Since in DL-Lite conflicts are of size at most two, we can define the set of conflicts of a set of assertions as follows:

Definition 2.1.25 (Conflicts of a set of assertions). Let K = hT , Ai be a DL-Lite KB and B ✓ A. The set of conflicts of B, denoted confl(B, K), is:

confl(B, K) = { | 9↵ 2 B, {↵, } 2 conflicts(K)} [ {↵ | ↵ 2 B, {↵} 2 conflicts(K)}.
Since an inconsistent KB has no model, it entails every Boolean query, and every tuple of the same arity as x is an answer to the query q(x). However, only some of these answers have actually some consistent reason to hold, which is captured by the notion of causes of a query.

Definition 2.1.26 (Cause). A cause for a Boolean query q in a KB K = hT , Ai is an inclusion minimal T -consistent subset C ✓ A such that hT , Ci |= q. We use causes(q, K) to refer to the set of causes for q in K.

The causes for a query q in a DL-Lite KB hT , Ai correspond to the images of the CQs of the rewriting of q in A that are consistent and do not contain any other image of such a CQ. Algorithm 2.3 computes the causes of a Boolean query over a DL-Lite KB. It first compute the conflicts of the KB (line 1) that will be used to check consistency of the images. The query is rewritten and evaluated over A with all its variables free to construct the images 2.1 Ontology-mediated query answering in DL-Lite Algorithm 2.2 ComputeConflicts Input: a TBox T , an ABox A Output: the conflicts of hT , Ai

1: q T unsat ? 2: for all B 1 v ¬B 2 2 T do 3: q T unsat q T unsat _ UCQRef(prenex(9x (at(B 1 , x) ^at(B 2 , x))), T ) 4: end for 5: for all S 1 v ¬S 2 2 T do 6: q T unsat q T unsat _ UCQRef(prenex(9x 1 x 2 (at(S 1 , x 1 , x 2 ) ^at(S 2 , x 1 , x 2 )
)), T ) 7: end for 8: for all (funct S) 2 T do 9:

q T unsat q T
unsat _ UCQRef(prenex(9xx 1 x 2 (at(S, x, x 1 ) ^at(S, x, x 2 ) ^x1 6 = x 2 )), T ) 10: end for 11: Conf licts ; 12: for all 9ỹ (ỹ) 2 q T unsat do // compute images of q T unsat 13:

for all ã 2 ans( , I A ) do // all variables in ỹ are free here end for 23: end for 24: Output Conf licts where at is defined as follows:

at(A, x) = A(x) at(9R, x) = 9yR(x, y) at(9R , x) = 9yR(y, x) at(R, x 1 , x 2 ) = R(x 1 , x 2 ) at(R , x 1 , x 2 ) = R(x 2 , x 1 )
and prenex is defined by: prenex(9x (9ỹ g(x, ỹ) ^9ỹ0 g(x, ỹ0 ))) = 9x 9ỹ 9z (g(x, ỹ) ^g(x, z)) with z \ ỹ = ; Preliminaries Algorithm 2.3 ComputeCauses Input: a Boolean conjunctive query q, a TBox T , an ABox A Output: the causes for q in hT , Ai

1: Conf licts ComputeConflicts(T , A) 2: Q UCQRef(q, T ) 3: Images ; 4: for all 9ỹ (ỹ) 2 Q do // compute images of Q 5:
for all ã 2 ans( , I A ) do // all variables in ỹ are free here 6:

Images Images [ {atoms( (ã))} (lines 4 to 8). The inconsistent or non-minimal images are then discarded (lines 10 to 21). To check the consistency of images, the algorithm simply checks that they do not contain any of the precomputed conflicts.

Example 2.1.27 (Example 2.1.11 cont'd). If we call q 0 (x) the rewriting UCQRef(q(x), T ), then q 0 (ann) has one image {AProf(ann)} in A; q 0 (bob) has three images {AProf(bob)}, {FProf(bob)}, and {Teach(bob, c b ), MemberOf(bob, dpt)} in A; and q 0 (carl) has one image {Teach(carl, carl), MemberOf(carl, dpt)}.

Since {Teach(carl, carl), MemberOf(carl, dpt)} is inconsistent because Teach(carl, carl) implies that carl is both a person and a course that are disjoint, only q(ann) and q(bob) have causes in K:

causes(q(ann), K) ={{AProf(ann)}} causes(q(bob), K) ={{AProf(bob)}, {FProf(bob)}, {Teach(bob, c b ), MemberOf(bob, dpt)}}

/

Because of DL-Lite syntax, a cause for an atom consists of only one assertion, so the size of a cause for a query q is bounded by the size of the query |q|. It follows that there are at most

 |q| j=1 |A|...(|A| j+1) j! = O(|A| |q|
) causes, since the potential causes are the subsets of |q| or fewer assertions of A. Hence the number of potential causes and thus the number of actual causes are both polynomial in the size of A.

Proposition 2.1.28. Computing the causes for a query over a DL-Lite KB is in P w.r.t. data complexity.

Inconsistency-tolerant semantics

When the ABox is inconsistent with the TBox, it may be impossible to clean the data to make it consistent, either for lack of time because the data is too large, or for lack of information on how to resolve the conflicts. It is therefore crucial to be able to retrieve meaningful answers from inconsistent data. However, since every query is entailed by an inconsistent KB under the classical semantics presented in the previous section, this semantics is useless in the inconsistent case, as it fails to provide any relevant information. In this section, we present inconsistency-tolerant semantics that have been proposed in the literature to query inconsistent KBs, focusing in particular on the AR, IAR, and brave semantics that we study in this thesis.

Example 2.2.1. The following inconsistent DL-Lite R knowledge bases and query will be used to illustrate the different semantics. The TBox expresses relationships between concepts for professors (Prof) of two levels of seniority (AProf, FProf), PhD holders (PhD), postdoctoral researchers (Postdoc), persons (Person), students (Student) and courses (Course), and roles to link instructors to their courses (Teach), and members or employees to their organizations (MemberOf, WorkFor). The ABoxes provide information about different individuals.

Preliminaries

The TBox and ABoxes are designed to illustrate the properties of all the different semantics on a small example, that is why some axioms seem not very accurate from a modelling perspective.

T ={AProf v Prof, FProf v Prof, Prof v PhD, Postdoc v PhD, PhD v Person, 9Teach v Person, 9Teach v Course, Prof v 9WorkFor, Student v 9MemberOf, WorkFor v MemberOf, AProf v ¬FProf, Prof v ¬Postdoc, Student v ¬Prof, Person v ¬Course, 9MemberOf v ¬Postdoc} A ann ={AProf(ann), FProf(ann), Prof(ann), Teach(ann, c a ), Teach(ann, ann)} A bob ={AProf(bob), FProf(bob), Postdoc(bob), MemberOf(bob, dpt), Teach(bob, c b )} A carl ={AProf(carl), Teach(carl, c c1 ), Teach(carl, c c2 ), Teach(c c1 , c c2 ), Teach(c c2 , c c1 )} A dan ={AProf(dan), Teach(dan, c d1 ), Teach(dan, c d2 ), AProf(c d1 ), AProf(c d2 )} A eva ={Student(eva), AProf(eva), Prof(eva), Teach(eva, c e )} A fred ={Postdoc(fred), MemberOf(fred, fred), Teach(fred, c f )} q(x) =9yzPhD(x) ^MemberOf(x, y) ^Teach(x, z)
All these KBs are inconsistent. Their sets of conflicts are:

conflicts(hT , A ann i) ={{AProf(ann), FProf(ann)}, {Teach(ann, ann)}} conflicts(hT , A bob i) ={{AProf(bob), FProf(bob)}, {AProf(bob), Postdoc(bob)}, {FProf(bob), Postdoc(bob)}} conflicts(hT , A carl i) ={{Teach(carl, c c1 ), Teach(c c1 , c c2 )}, {Teach(carl, c c2 ), Teach(c c2 , c c1 )}, {Teach(c c1 , c c2 ), Teach(c c2 , c c1 )}} conflicts(hT , A dan i) ={{Teach(dan, c d1 ), AProf(c d1 )}, {Teach(dan, c d2 ), AProf(c d2 )}} conflicts(hT , A eva i) ={{Student(eva), AProf(eva)}, {Student(eva), Prof(eva)}} conflicts(hT , A fred i) ={{Postdoc(fred), MemberOf(fred, fred)}} / 2.2.

The AR semantics

The AR semantics (ABox Repair semantics) [START_REF] Lembo | [END_REF] adapts the consistent query answering framework used in the database arena (cf. Chapter 7 for details and references) to DL KBs. Consistent query answering amounts to considering those answers that hold in every repair, defined as consistent subsets of the database that are "as close as possible" to the actual database instance. While in database setting, due to the closed world assumption and the types of constraints, repairs can be obtained from the actual database by deletion or insertion of tuples and changes of attributes values, in DL setting the inconsistency can only 2.2 Inconsistency-tolerant semantics stem from the presence of several incompatible assertions, leading to a simpler notion of repair: Definition 2.2.2 (Repair). An ABox repair of a KB K = hT , Ai, or repair for short, is an inclusion-maximal subset of the ABox A which is consistent with the TBox T . The set of all repairs of K is written Rep(T , A).

The repairs are all the possible ways of repairing the ABox while preserving as much information as possible (in the sense of set inclusion) and can be seen as the different possible worlds. If the quality of the data is relatively good, we can assume that one of the repairs corresponds to the real world, but we cannot know which one.

Example 2.2.3 (Example 2.2.1 cont'd).

Rep(T , A ann ) ={{AProf(ann), Prof(ann), Teach(ann, c a )}, {FProf(ann), Prof(ann), Teach(ann, c a )}} Note that the assertion Teach(ann, ann) does not appear in any repair of hT , A ann i because this assertion is inconsistent. / Definition 2.2.4 (AR semantics). A tuple ã is an answer for a query q over a KB K = hT , Ai under AR semantics, written hT , Ai |= AR q(ã), if and only if hT , Ri |= q(ã) for every repair R 2 Rep(T , A). We call ã a (positive) AR-answer.

Rep(T , A bob ) ={{AProf(bob), MemberOf(bob, dpt), Teach(bob, c b )}, {FProf(bob), MemberOf(bob, dpt), Teach(bob, c b )}, {Postdoc(bob), MemberOf(bob, dpt), Teach(bob, c b )}} Rep(T , A carl ) ={{AProf(carl), Teach(carl, c c1 ), Teach(carl, c c2 )}, {AProf(carl), Teach(carl, c c1 ), Teach(c c2 , c c1 )}, {AProf (carl)
Example 2.2.5 (Example 2.2.1 cont'd). The two repairs of A ann contain the cause for q(ann) {Prof(ann), Teach(ann, c a )}, so hT , A ann i |= AR q(ann). Every repair of A bob contains a cause for q(bob), and corresponds to a choice between three incompatible possibilities for bob being a person: he is either an associate professor Preliminaries ({AProf(bob), Teach(bob, c b )}), or a full professor ({FProf(bob), Teach(bob, c b )}), or a postdoctoral researcher ({Postdoc(bob), MemberOf(bob, dpt), Teach(bob, c b )}). It follows that hT , A bob i |= AR q(bob).

We have also hT , A carl i |= AR q(carl) because every repair contains one or both of the causes {AProf(carl), Teach(carl, c c1 )} and {AProf(carl), Teach(carl, c c2 )} for q(carl).

Here the assertions Teach(c c1 , c c2 ) and Teach(c c2 , c c1 ) implies that c c1 or c c2 may be persons and not courses, disqualifying either the first or the second cause for q(carl), but not both since Teach(c c1 , c c2 ) and Teach(c c2 , c c1 ) are incompatible.

Finally, hT , A dan i 6 |= AR q(dan) because the last repair of A dan does not contain any cause for q(dan) (there is no reason for dan teaching anything in that repair), hT , A eva i 6 |= AR q(eva) because q(eva) does not hold in the first repair where there is no reason for eva being a PhD holder, and hT , A fred i 6 |= AR q(fred) because q(fred) does not hold in any repair of A fred . /

The AR semantics is arguably the most natural inconsistency-tolerant semantics. Unfortunately, query answering over DL-Lite KBs under AR semantics is intractable, even for instance queries, because the number of repairs may be exponential in the size of the ABox. However, it is possible to show that a query does not hold under AR semantics by non-deterministically finding a repair that does not entail it.

Theorem 2.2.6 ( [START_REF] Lembo | [END_REF]). Conjunctive query answering and instance checking under AR semantics over DL-Lite knowledge bases is coNP-complete w.r.t. data complexity.

Proof. We present the proof, which inspires proofs for several of our results.

Showing that a query q is not entailed under AR semantics by a KB K = hT , Ai can be done by guessing a repair R of K such that hT , Ri 6 |= q. Checking that R is consistent, that for every ↵ 2 A\R, R [ {↵} is inconsistent, and that hT , Ri 6 |= q is in P w.r.t. data complexity. Thus, query answering is in coNP.

For the lower bound, a proof for hardness by reduction from SAT is presented in [Bienvenu 2012]. Let ' = {C 1 , ..., C k } be a set of clauses over a set of propositional variables X = {x 1 , ..., x n }. This problem is encoded in polynomial time as an AR entailment problem as follows:

T ={9P v ¬9N , 9P v ¬9U , 9N v ¬9U , 9U v A} A ={P (c j , x i ) | x i 2 C j } [ {N (c j , x i ) | ¬x i 2 C j } [ {U (a, c j ) | 1  j  k} q =A(a)
Figure 2.1 illustrates this reduction on an example. Individuals are seen as vertices and role assertions as edges.

We show that the formula ' is satisfiable if and only if hT , Ai 6 |= AR q, i.e. there exists a repair that does not contain any cause for q. These causes are the U (a, c j ) (1  j  k).

If ' is satisfiable, there exists a valuation ⌫ of X such that ⌫(') = true. Thus, for every C j 2 ', there exists

x i 2 C j such that ⌫(x i ) = true or ¬x i 2 C j such that ⌫(x i ) = false. Let B = {P (c j , x i ) | ⌫(x i ) = true} [ {N (c j , x i ) | ⌫(x i ) = false}.
By construction, B is a consistent subset of A such that every individual c j has an outgoing P -or N -edge. Therefore,

Inconsistency-tolerant semantics

= {C 1 = x 1 _ ¬x 2 , C 2 = ¬x 1 _ x 2 _ ¬x 3 }. x 1 x 2 x 3 c 1 c 2 Q Q Q Q Q Q Q Q k X X X X X X X X y X X X X X X X X y ⇠ ⇠ ⇠ ⇠ ⇠ ⇠ ⇠ ⇠ 9 ⇠ ⇠ ⇠ ⇠ ⇠ ⇠ ⇠ ⇠ 9 a X X X X X X X X y ⇠ ⇠ ⇠ ⇠ ⇠ ⇠ ⇠ ⇠ 9 P N N P N U U
there exists a repair that extends B that does not contain any assertion of the form U (a, c j ), since such an assertion would be in conflict with the edge outgoing from c j . Since every cause for q in K is of that form, it follows that hT , Ai 6 |= AR q.

In the other direction, if hT , Ai 6 |= AR q, then there exists a repair R such that hT , Ri 6 |= q. It follows that R does not contain any cause for q, so does not contain any assertion of the form U (a, c j ). By definition of a repair, R is a maximal consistent subset of A, so for each c j , if R does not contain U (a, c j ), it contains an assertion which is in conflict with U (a, c j ), so c j has an outgoing P -or N -edge in R. Let ⌫ be the valuation of X defined as follows: ⌫(x i ) = true if there exists c j such that P (c j , x i ) 2 R, ⌫(x i ) = false otherwise. For every C j 2 ', if there exists x i such that P (c j , x i ) 2 R, ⌫(C j ) = true since x i 2 C j and ⌫(x i ) = true, otherwise there exists x i such that N (c j , x i ) 2 R, and ⌫(C j ) = true because ¬x i 2 C j and ⌫(x i ) = false (since x i cannot have an ingoing P -edge in R, otherwise R would be inconsistent).

It has been shown in [Bienvenu 2012] that coNP-completeness of AR conjunctive query answering holds even for simple ontologies consisting of axioms of the forms

A 1 v A 2 and A 1 v ¬A 2 , where A 1 , A 2 2 N C .
As in the case of classical semantics, where considering combined complexity instead of data complexity makes query answering NP-complete instead of in P, the combined complexity of CQs entailment under AR semantics is one level higher in the polynomial hierarchy than its data complexity.

Theorem 2.2.7 ( [START_REF] Bienvenu | [END_REF]). Conjunctive query answering under AR semantics over DL-Lite knowledge bases is ⇧ p 2 -complete w.r.t. combined complexity, and instance checking is coNP-complete w.r.t. combined complexity.

Proof. Showing that a query q is not entailed under AR semantics can be done by guessing a repair that does not entail q. Since checking that a subset of the ABox is a repair and does not entail q is in coNP (resp. in P for instance queries) w.r.t. combined complexity, membership in ⇧ p 2 (resp. in coNP for instance queries) follows.

The lower bound for instance queries follows from Theorem 2.2.6. For CQs, ⇧ p 2 -hardness is shown in [START_REF] Bienvenu | [END_REF]] by the following reduction from validity of QBF 2,8 Preliminaries formulas. Let ' = 8x 1 , ..., x n 9y 1 , ..., y m V k j=1 C j where V k j=1 C j is a 3-CNF formula over the variables x 1 , ..., x n , y 1 , ..., y m , where every C j is a clause of the form `1 j _ `2 j _ `3 j . The variable of literal `p j is denoted by v(`p j ). For example for the clause ¬x 1 _ y 2 _ ¬y 1 , v(¬x 1 ) = x 1 , v(y 2 ) = y 2 , and v(¬y 1 ) = y 1 .

The problem of deciding if ' is valid is encoded in polynomial time as an AR entailment as follows:

T ={9GX i v ¬9GX i | 1  i  n} A = k [ j=1 {L 1 j (c V j , V (v(`1 j ))), L 2 j (c V j , V (v(`2 j ))), L 3 j (c V j , V (v(`3 j ))) | V is a valuation of v(`1 j ), v(`2 j ), v(`3 j ) satisfying C j }[ {GX i (0, 1), GX i (1, 0) | 1  i  n} q =9w 1 , ..., w k , x 1 , ..., x n , z 1 , ..., z n , y 1 , ..., y m k ĵ=1 3 ĥ=1 L h j (w j , v(`h j )) ^n î=1 GX i (x i , z i )
It is shown that ' is valid if and only if hT , Ai |= AR q. Intuitively, GX i (0, 1) means that x i = 0, and the repairs of hT , Ai correspond to the valuations of x 1 , ..., x n since the conflicts of the KB are the {GX i (0, 1), GX i (1, 0)}. The query q looks for a valuation of x 1 , ..., x n , y 1 , ..., y m that satisfies

V k j=1 C j : the variables w 1 , ..., w k correspond to partial valuations that satisfy C 1 , ..., C k respectively and will be mapped to some c

V 1 1 , ..., c V k k
, and the value of v(`h j ) is some x i or y i that will be mapped to 0 or 1.

The IAR and brave semantics

The negative complexity results for AR semantics led [START_REF] Lembo | [END_REF] to propose a tractable approximation of AR obtained by querying the intersection of the repairs: the IAR semantics (Intersection ABox Repair semantics). Definition 2.2.8 (IAR semantics). A tuple ã is an answer for a query q over a KB K = hT , Ai under IAR semantics, written hT , Ai |= IAR q(ã), if and only if hT , R \ i |= q(ã) where R \ is the intersection of the repairs of K. We call ã a (positive) IAR-answer.

This semantics follows the "when in doubt throw it out" principle, proposed in the area of belief revision and update, and provides thus a more conservative semantics than AR. The answers holding under IAR semantics can be considered as the surest answers over the KB.

A query is entailed under IAR semantics just in the case that there exists a cause for the query in the intersection of the repairs. This condition is equivalent to the existence of a cause whose assertions do not belong to any conflict. Indeed, such a cause can be added to any consistent subset of the ABox while preserving consistency, so belongs to every repair of the ABox. In the other direction, since the conflicts are minimal inconsistent subsets of the ABox, if an assertion of a cause belongs to some conflict, the other assertions of the conflict form a consistent subset of the ABox, that can be extended to a repair that cannot contain 2.2 Inconsistency-tolerant semantics this assertion, so does not contain this cause, which is therefore not in the intersection of the repairs.

Example 2.2.9 (Example 2.2.1 cont'd). The intersections of the repairs of our examples KBs are as follows:

\ R2Rep(T ,Aann) R = {Prof(ann), Teach(ann, c a )} \ R2Rep(T ,A bob ) R = {MemberOf(bob, dpt), Teach(bob, c b )} \ R2Rep(T ,A carl ) R = {AProf(carl)} \ R2Rep(T ,A dan ) R = {AProf(dan)} \ R2Rep(T ,Aeva) R = {Teach(eva, c e )} \ R2Rep(T ,A f red ) R = {Teach(fred, c f )}
For the query q, we have only hT , A ann i |= IAR q(ann), since T R2Rep(T ,Aann) R is the only one which contains a cause for q. / FOL rewritings have been proposed for querying DL-Lite KBs under IAR semantics [START_REF] Lembo | [END_REF], Lembo et al. 2015]. The general idea is to add to the classical rewriting expressions that ensure that the assertions used to derive the query are not contradicted by other assertions by enumerating the possible conflicts. For instance, using the TBox of Example 2.2.1, for the query q(x) = Prof(x), the standard rewriting is

q 0 (x) = Prof(x) _ AProf(x) _ FProf(x),
and the consistent rewriting will be:

q 00 (x) =(Prof(x) ^¬Postdoc(x) ^¬Student(x))_ (AProf(x) ^¬FProf(x) ^¬Postdoc(x) ^¬Student(x))_ (FProf(x) ^¬AProf(x) ^¬Postdoc(x) ^¬Student(x)).
It follows that querying DL-Lite KBs under IAR semantics is in AC 0 w.r.t. data complexity and in NP w.r.t. combined complexity. Another approach consists in computing the intersection of ABox repairs in polynomial time by removing from A every assertion that is involved in some conflict (cf. Algorithm 2.2 for the computation of the conflicts) before querying it in a standard way. Alternatively, [START_REF] Rosati | [END_REF] proposes to annotate the ABox, marking the assertions involved in some contradiction or self-inconsistent, and modify the standard rewriting to avoid using assertions that are not in the intersection of the repairs.

Preliminaries

Since query answering under IAR semantics can be done through FOL rewritings, it is of the same complexity as standard query answering.

Theorem 2.2.10 ( [START_REF] Lembo | [END_REF], Lembo et al. 2011]). Conjunctive query answering under IAR semantics over DL-Lite knowledge bases is in AC 0 w.r.t. data complexity, NPcomplete w.r.t. combined complexity. Instance checking is in P w.r.t. combined complexity.

While the IAR semantics is the most cautious inconsistency-tolerant semantics, the brave semantics [START_REF] Bienvenu | [END_REF] at the other end of the scale considers every answer that holds in some repair.

Definition 2.2.11 (Brave semantics). A tuple ã is an answer for a query q over a KB K = hT , Ai under brave semantics, written hT , Ai |= brave q(ã), if and only if hT , Ri |= q(ã) for some repair R 2 Rep(T , A). We call ã a (positive) brave-answer.

Example 2.2.12 (Example 2.2.1 cont'd). Three of the repairs of A dan contain some causes for q(dan) (that are {AProf(dan), Teach(dan, c d1 )} and {AProf(dan), Teach(dan, c d2 )}), so hT , A dan i |= brave q(dan).

The second repair of A eva , {AProf(eva), Prof(eva), Teach(eva, c e )}, contains two causes for q(eva), so hT , A eva i |= brave q(eva).

None of the repairs of A fred entails q(fred), so hT , A fred i 6 |= brave q(fred). Indeed, the image of q(fred) in A fred , {Postdoc(fred), MemberOf(fred, fred), Teach(fred, c f )} is inconsistent so q(fred) has no cause. /

A query is entailed under brave semantics just in the case that it is supported by some internally consistent set of facts, i.e. has at least one cause in the KB. Therefore, deciding if an answer holds under brave semantics can be done in polynomial time w.r.t. data complexity by checking if the output of Algorithm 2.3 is not empty. It is shown in [START_REF] Bienvenu | [END_REF]] that query answering under brave semantics can actually be done with FOL rewritings.

Theorem 2.2.13 ( [START_REF] Bienvenu | [END_REF]). Conjunctive query answering under brave semantics over DL-Lite knowledge bases is in AC 0 w.r.t. data complexity, NP-complete w.r.t. combined complexity. Instance checking is in P w.r.t. combined complexity.

The relations between the three previously introduced semantics have been shown in [START_REF] Lembo | [END_REF][START_REF] Bienvenu | [END_REF]: the IAR semantics is a sound approximation of the AR semantics, i.e. every query entailed under IAR is also entailed under AR semantics, whereas brave semantics can be seen as a complete approximation of AR: every query entailed under AR semantics is entailed under brave semantics.

Proposition 2.2.14. The IAR, AR and brave semantics are related as follows, and none of the reverse implications holds:

K |= IAR q(ã) =) K |= AR q(ã) =) K |= brave q(ã)
Our examples illustrate that the reverse implications do not hold.

Inconsistency-tolerant semantics

Example 2.2.15 (Example 2.2.1 cont'd). We have seen that hT , A bob i |= AR q(bob) while hT , A bob i 6 |= IAR q(bob), and that hT , A dan i |= brave q(dan) while hT , A dan i 6 |= AR q(dan). / Note that contrary to the AR semantics, that cannot derive contradictory statements since they have to hold in all repairs, which are consistent and can therefore not have inconsistent consequences, the answers that hold under brave semantics may be inconsistent (if they hold in different repairs).

Other inconsistency-tolerant semantics

The families of k-support and k-defeater semantics Two families of inconsistency-tolerant semantics, called k-support and k-defeater semantics, have been proposed in [START_REF] Bienvenu | [END_REF]]. The k-support semantics approximate the AR semantics from below and the k-defeater semantics from above.

Definition 2.2.16 (k-support semantics). A tuple ã is an answer for a query q over a KB K = hT , Ai under k-support semantics, written hT , Ai |= k supp q(ã), if and only if there exists k causes C 1 , ..., C k 2 causes(q(ã), K) such that every repair R 2 Rep(T , A) contains some C i .

Example 2.2.17 (Example 2.2.1 cont'd). Since the cause {Prof(ann), Teach(ann, c a )} belongs to every repair of A ann , hT , A ann i |= 1 supp q(ann).

The three causes for q(bob) {AProf(bob), Teach(bob, c b )}, {FProf(bob), Teach(bob, c b )} and {Postdoc(bob), MemberOf(bob, dpt), Teach(bob, c b )} are such that each repair of A bob contains one of them, and there is no pair of causes for q(bob) that fulfills this condition, so it yields hT , A bob i |= 3 supp q(bob), but hT , A bob i 6 |= 2 supp q(bob).

In the same way, {AProf(carl), Teach(carl, c c1 )} and {AProf(carl), Teach(carl, c c2 )} are sufficient and necessary to cover every repair of A carl , so hT , A carl i |= 2 supp q(carl), but hT , A carl i 6 |= 1 supp q(carl).

/

The 1-support semantics coincides with the IAR semantics, since it requires that a cause belongs to every repair, so to their intersection. An answer holds under AR semantics just in the case where it holds under k-support semantics for some k (in particular for k = |causes(q(ã), K)|).

Definition 2.2.18 (k-defeater semantics). A tuple ã is an answer for a query q over a KB K = hT , Ai under k-defeater semantics, written hT , Ai |= k def q(ã), if and only if there does not

exist a T -consistent subset B ✓ A with |B|  k such that for every cause C 2 causes(q(ã), K), B [ C is T -inconsistent.
Example 2.2.19 (Example 2.2.1 cont'd). The set {AProf(c d1 ), AProf(c d2 )} is consistent and contradicts the two causes for q(dan) in A dan , and no assertion contradicts both causes, so hT , A dan i |= 1 def q(dan), but hT , A dan i 6 |= 2 def q(dan).

The set {Student(eva)} is consistent and contradicts the two causes for q(eva), so hT , A eva i |= 0 def q(eva), but hT , A eva i 6 |= 1 def q(eva).

Finally, since there is no cause for q(fred), hT , A fred i 6 |= 0 def q(fred). /

The 0-defeater semantics coincides with the brave semantics, since it only requires that the query has some cause. An answer holds under AR semantics if and only if it holds under k-defeater for every k: indeed, an answer does not hold under k-defeater for some k just in the case where there exists a T -consistent subset B ✓ A such that for every cause C 2 causes(q(ã), K), B [ C is T -inconsistent, and such a subset B can be extended to a repair that does not contain any cause for q(ã).

Both semantics are monotone: for every k 0, if K |= k supp q, then K |= k+1 supp q, and if K |= k+1 def q, then K |= k def q.

In DL-Lite, query answering under k-support and k-defeater semantics can be done via FOL-rewriting.

Theorem 2.2.20 ( [START_REF] Bienvenu | [END_REF]). Conjunctive query answering under k-support and k-defeater semantics over DL-Lite knowledge bases is in AC 0 w.r.t. data complexity, NP-complete w.r.t. combined complexity. Instance checking is in P w.r.t. combined complexity.

The ICR semantics

Another sound approximation of AR is the ICR semantics (Intersection of Closed Repairs semantics) of [Bienvenu 2012]. It achieves to be a finer approximation of AR than IAR by closing repairs with respect to the TBox before intersecting them. Definition 2.2.21 (ICR semantics). Given a KB hT , Ai, the logical closure of a set of assertions B consists in all the assertions that are entailed by hT , Bi.

A tuple ã is an answer for a query q over a KB K = hT , Ai under ICR semantics, written hT , Ai |= ICR q(ã), if and only if hT , R cl \ i |= q(ã) where R cl \ is the intersection of the logical closures of the repairs of K.

The relation of ICR to AR and IAR has been shown in [Bienvenu 2012]. The intersection of the repairs clearly belongs to the intersection of their logical closures, so every IAR-answer is also an ICR-answer. Regarding AR, if an answer holds under ICR semantics, it has a cause in the intersection of the logical closures of the repairs. Every assertion of such a cause has a cause in each repair, and since the repairs are consistent, in each repair, the union of these causes is consistent. It follows that every repair contains a cause for the answer, which therefore holds under AR semantics. Actually, ICR semantics amounts to standard query answering over the assertions that hold under AR semantics.

Proposition 2.2.22. The ICR semantics relates with IAR and AR as follows, the reverse implications do not hold:

K |= IAR q(ã) =) K |= ICR q(ã) =) K |= AR q(ã)
The following example illustrates that an answer can hold under the ICR semantics but not under IAR, or under AR but not under ICR. Their intersection contains {PhD(bob), MemberOf(bob, dpt), Teach(bob, c b )} that is a cause for q(bob), so hT , A bob i |= ICR q(bob). However hT , A bob i 6 |= IAR q(bob), since none of the causes for PhD(bob) is in the intersection of the repairs.

We have seen that hT , A carl i |= AR q(carl), but the intersection of the logical closures of the repairs ({AProf(carl), Prof(carl), PhD(carl), Person(carl)}) does not contain any cause for q(carl), so hT , A carl i 6 |= ICR q(carl). /

Query answering under ICR semantics can be done by query rewriting for simple ontologies (consisting of axioms of the forms A 1 v A 2 and A 1 v ¬A 2 , where A 1 , A 2 2 N C ) and even for DL-Lite without inverse roles, but it is still intractable for DL-Lite with inverse roles. Indeed, we can use the same reduction as for the proof of Theorem 2.2.6 for AR coNP-hardness.

Theorem 2.2.24 ( [Bienvenu 2012, Lukasiewicz et al. 2013] [Gottlob 1995]).

For the lower bound, the proof is by reduction from the Parity(3SAT) problem, cf. [Wagner 1987, Eiter & Gottlob 1997]. A Parity(3SAT) instance is given by a sequence ' 1 , . . . , ' m of propositional formulas in 3CNF, and the problem is to decide whether the number of satisfiable formulas is odd. It is known that it can be assumed w.l.o.g. that the formulas are such that ' i+1 is unsatisfiable whenever ' i is unsatisfiable. Consequently, the Preliminaries problem reduces to deciding existence of an odd integer p such that ' p is satisfiable and ' p+1 is unsatisfiable.

Consider a Parity(3SAT) instance given by ' 1 , . . . , ' m . For each i,

' i = V k(i) j=1 C i,j
, where every C i,j is a clause of the form `1 i,j _ `2 i,j _ `3 i,j over variables X i = {x i,1 , ..., x i,n(i) }. The variable of literal `p i,j is denoted by v(`p i,j ). Let k = max 1im (k(i)) and n = max 1im (n(i)) + 1. We can assume that k(i) = k and n(i) = n for every i by adding k k(i) clauses of the form x i,n _ x i,n _ x i,n to each ' i without changing ' i (un)satisfiability. We define an ICR entailment problem as follows:

T ={9P v ¬9N , 9P v ¬9U , 9N v ¬9U , 9U v A} A o (i) ={ k [ j=1 {R i (' i , c V i,j ), L 1 j (c V i,j , V (v(`1 i,j ))), L 2 j (c V i,j , V (v(`2 i,j ))), L 3 j (c V i,j , V (v(`3 i,j ))) | V is a valuation of v(`1 i,j ), v(`2 i,j ), v(`3 i,j ) satisfying C i,j } A e (i) ={P (c i,j , x i,l ) | x i,l 2 C i,j } [ {N (c i,j , x i,l ) | ¬x i,l 2 C i,j } [ {U (' i , c i,j ) | 1  j  k} A 0 e (i) ={E(a i , ' i )} [ {R f (a i , b i ) | 1  f  m, f odd , f 6 = i 1}[ {L 1 j (b i , c i ), L 2 j (b i , c i ), L 3 j (b i , c i ) | 1  j  k} A = [ 1im,i even (A e (i) [ A 0 e (i)) [ {E(' i , ' i+1 ) | 1  i  m 1, i odd} [ [ 1im,i odd A o (i) [ {A(' m+1 ), E(' m , ' m+1 ) | if m is odd} [ A 0 e (m + 1) q =A(x) ^m î=1,odd (E(y i , x) ^k ĵ=1 (R i (y i , w i,j ) ^3 ĥ=1 L h j (w i,j , v(`h i,j )))),
every variable of q being existentially quantified. Figure 2.2 illustrates the ABox of this reduction. We show that hT , Ai |= ICR q iff there is some odd p such that ' p is satisfiable and ' p+1 is unsatisfiable (or if ' m is satisfiable and m is odd).

For the first direction, suppose that hT , Ai |= ICR q. This means that there exists a match ⇡ for q in the intersection of the logical closures of the repairs. By construction, ⇡(x) = ' p+1 for some odd p, since only ' i with even i can belong to A.

If p 6 = m, for the same reasons as in the proof of Theorem 2.2.6, A(' p+1 ) is entailed under ICR semantics iff ' p+1 is unsatisfiable, so ' p+1 is unsatisfiable. Since ' p+1 is linked by incoming E-edges to ' p and a p+1 , and ' p has outgoing R p -edges while a p+1 has outgoing R i -edges for every odd i 6 = p, then for every odd i 6 = p, ⇡(y i ) = a p+1 , ⇡(w i,j ) = b p+1 and ⇡(x i,l ) = c p+1 for every 1  j  k and 1  l  n, and ⇡(y p ) = ' p . Then for every 1  j  k, we have R p (' p , ⇡(w p,j )) 2 A, so there is a valuation V j of v(`1 p,j ), v(`2 p,j ), v(`3 p,j ) satisfying C p,j such that ⇡(w p,j ) = c V j p,j . Note that for every x p,l , either ⇡(x p,l ) = 0 or ⇡(x p,l ) = 1, so for every 1  j, j 0  k, V j and V j 0 must agree on the value of x p,l . It follows that the V j together define a valuation of the x p,l which satisfies ' p . Thus there is an odd p such that ' p is satisfiable and ' p+1 is unsatisfiable.

Inconsistency-tolerant semantics

In the case where p = m, A(' m+1 ) has no conflicts so belongs to every repair. Then as in the case p 6 = m, ' m is satisfiable. Thus there is an odd number of satisfiable formulas.

In the other direction, suppose that there is an odd p 6 = m such that ' p is satisfiable and ' p+1 is unsatisfiable. Let ⌫ be a valuation of x p,1 , ..., x p,n that satisfies ' p . Let ⇡ be the function defined by: ⇡(y p ) = ' p , ⇡(x) = ' p+1 , for every 1  j  k, ⇡(w p,j ) = c V j p,j , where V j is the restriction of ⌫ to the variables in clause c p,j , for every 1  l  n, ⇡(x p,l ) = ⌫(x p,l ), and for every odd i 6 = p: ⇡(y i ) = a p+1 , for every 1  j  k, ⇡(w i,j ) = b p+1 , for every 1  l  n, ⇡(x i,l ) = c p+1 . Then ⇡ is a match for q in the intersection of the logical closures of the repairs. Indeed, the only assertion of the query obtained by replacing the variables by their images by ⇡ which has some conflicts so is not already in the intersection of the repairs is A(' p+1 ), which is ICR because ' p+1 is unsatisfiable. It follows that q is entailed under ICR semantics.

Finally, if ' m is satisfiable and m is odd, we can find a match for q using a valuation that satisfies ' m as in the case p 6 = m. In this case, since A(' m+1 ) has no conflicts, it is also in the intersection of the repairs and q holds under ICR semantics (actually it holds under IAR semantics).

The CAR and ICAR semantics

The idea of logically closing part of the data w.r.t. the TBox has also been considered in [START_REF] Lembo | [END_REF], with the CAR (Closed ABox Repair) and ICAR semantics (Intersection Closed ABox Repair semantics). Contrary to the ICR semantics which closes the repairs, the CAR and ICAR semantics close directly the ABox by adding every assertion that is entailed by a consistent subset of the ABox, i.e. which has some cause. CAR and ICAR are then defined similarly to AR and IAR.

Definition 2.2.26 (CAR and ICAR semantics). The consistent logical consequences of K is the set clc(K) = {↵ | there exists B ✓ A such that B is T -consistent and hT , Bi |= ↵}.

A closed ABox repair R clc is a consistent subset of clc(K) such that there exists no consistent subset

R clc 0 of clc(K) such that R clc \ A ⇢ R clc 0 \ A or R clc \ A = R clc 0 \ A and R clc ⇢ R clc 0
. A tuple ã is an answer for a query q over a KB K = hT , Ai under CAR semantics, written hT , Ai |= CAR q(ã), if and only if hT , R clc i |= q(ã) for every closed ABox repair R clc of K.

A tuple ã is an answer for a query q over a KB K = hT , Ai under ICAR semantics, written hT , Ai |= ICAR q(ã), if and only if hT , R clc \ i |= q(ã) where R clc \ is the intersection of the closed ABox repairs of K.

Remark 2.2.27. It is equivalent to define the ICAR semantics with the intersection of the repairs of clc(K): indeed, every closed ABox repair is a repair of clc(K), so the intersection of the repairs of clc(K) is included in R clc \ , and in the other direction, if ↵ 2 R clc \ , then ↵ is in the intersection of the repairs of clc(K), otherwise there would be 2 clc(K) that conflicts ↵, and ↵ would also be in a conflict with a cause 2 A of , so some closed ABox repair would contain , that would yield ↵ / 2 R clc \ .

Preliminaries Fig. 2.2 Reduction from Parity(3SAT) for p 2 [O(log n)]-hardness of ICR query answering. Graphical representation for the case where m is odd.

A ' 1 ' 2 ' 3 ' 4 ... ' m ' m+1 - - - E E E A A A A A A A A o (1) A A A A A A A e (2) A A A A A A A 0 e (2) A A A A A A A o (3) A A A A A A A e (4) A A A A A A A 0 e (4) A A A A A A A o (m) A A A A A A A 0 e (m + 1) A o (i) ' i A A A A A A K R i ... 6 ✓ L h j 6 @ @ @ @ @ @ I 0 1 A e (i) ' i A A A A A A K U ... A A A A A A K ✓ P/N A A A A A A K @ @ @ @ @ @ I A 0 e (i) ' i a i b i c i ? 6 6 E R f (f 6 = i 1) L h j

Inconsistency-tolerant semantics

This is not true for the CAR semantics since some repairs of clc(K) may not be closed ABox repairs. For instance, let T = {R v S, 9R v ¬9R , 9S v ¬9R , 9R v ¬9S }, A = {R(a, b), R(b, c)} and q = 9xyR(x, y). The set {S(a, b), S(b, c)} is a repair of clc(hT , Ai) such that hT , {S(a, b), S(b, c)}i 6 |= q, but hT , Ai |= CAR q because it is not a closed ABox repair, since contrary to the other repairs of clc(hT , Ai) it does not contain any assertion of A.

The CAR and ICAR semantics are not sound approximations of the AR semantics: some queries may hold under CAR or ICAR and not under AR semantics. [START_REF] Lembo | [END_REF] motivates these semantics arguing that if K = hT , Ai and K 0 = hT , A 0 i differ only because A 0 contains assertions that are logical consequences of consistent subsets of A, they should yield the same query answers, which is not true under AR semantics. These semantics enforce the consistency of the set of answers retrieved, but query answers may have no cause in the initial knowledge base.

The relations between ICAR, CAR and AR have been shown in [START_REF] Lembo | [END_REF]]. ICAR and CAR relate similarly to IAR and AR, and every AR-answer holds under CAR semantics because by definition, every closed ABox repair contains a repair.

Proposition 2.2.28. The CAR and ICAR semantics relate with ICR and AR as follows, the reverse implications do not hold:

K |= ICR q(ã) =) K |= ICAR q(ã) =) K |= CAR q(ã) and K |= AR q(ã) =) K |= CAR q(ã) Proof of K |= ICR q(ã) =) K |= ICAR q(ã).
The relation between ICR and ICAR semantics follows from the fact that the intersection of the logical closure of the repairs of K is included in the intersection of the repairs of the consistent logical consequences of K: R cl \ ✓ R clc \ . Indeed, suppose for a contradiction that ↵ 2 R cl \ and ↵ / 2 R clc \ . Since ↵ is in the logical closure of every repair, ↵ is a consistent consequence of K, so if ↵ / 2 R clc \ , that means that there exists 2 clc(K) such that {↵, } is inconsistent. Since is entailed by a consistent subset of A, which can be extended to a repair, is in the logical closure of a repair R cl . The logical closure of a repair is consistent, so ↵ / 2 R cl , so ↵ / 2 R cl \ . These relations can be observed in our example KBs.

Example 2.2.29 (Example 2.2.1 cont'd). For the KB hT , A eva i, we have clc(hT , A eva i) ={Student(eva), AProf(eva), Prof(eva), PhD(eva), Person(eva), Teach(eva, c e ), Course(c e )} So the closed ABox repairs of hT , A eva i are:

{{Student(eva), PhD(eva), Person(eva), Teach(eva, c e ), Course(c e )}, {AProf(eva), Prof(eva), PhD(eva), Person(eva), Teach(eva, c e ), Course(c e )}} Since Student v 9MemberOf and Prof v 9WorkFor, hT , A eva i |= CAR q(eva). The intersection of the closed ABox repairs does not contain any cause for q(eva), so hT , A eva i 6 |= ICAR q(eva). We have seen that hT , A eva i 6 |= AR q(eva).

Preliminaries

For the KB hT , A fred i, we have clc(hT , A fred i) ={Postdoc(fred), PhD(fred), Person(fred), MemberOf(fred, fred), Teach(fred, c f ), Course(c f )} So the closed ABox repairs of hT , A fred i are:

{{Postdoc(fred), PhD(fred), Person(fred), Teach(fred, c f ), Course(c f )}, {PhD(fred), Person(fred), MemberOf(fred, fred), Teach(fred, c f ), Course(c f )}}
It follows that hT , A fred i |= ICAR q(fred). Note that hT , A fred i 6 |= brave q(fred). ICAR semantics considers as true every consequence of the data that is not contradicted, so allows to retrieve such answers that can only be derived from inconsistent images in the original ABox as long as nothing contradicts them.

Finally, we can note that hT , A dan i 6 |= CAR q(dan) because the closed ABox repair that contains AProf(c d 1 ), AProf(c d 2 ) and their consequences does not contain any cause for q(dan).

/ [START_REF] Lembo | [END_REF]] describes how to query DL-Lite KBs under ICAR semantics using FOL-rewriting. Moreover, instance checking under CAR semantics reduces to checking if the assertion belongs to the intersection of the closed repairs, i.e. to ICAR semantics.

Theorem 2.2.30 ( [START_REF] Lembo | [END_REF], Lembo et al. 2011] Proof. Computing clc(K) is in P w.r.t. combined complexity and checking that a subset of clc(K) is a closed ABox repair that does not entail q is in p 2 : check in P that it is consistent, in coNP that it is maximal, and in coNP that it preserves a maximal subset of the ABox, then check that it does not entail q in coNP. It follows that CQ answering under CAR is in ⇧ p 2 . The reduction given for ⇧ p 2 -hardness of AR CQ entailment in proof of Theorem 2.2.7 can be used to show ⇧ p 2 -hardness. Indeed, since T does not contain any positive inclusion, clc(K) = K and q is entailed under CAR semantics if and only if it is entailed under AR semantics.

The family of k-lazy semantics

A family of inconsistency-tolerant semantics, the k-lazy semantics, has been introduced in [START_REF] Lukasiewicz | [END_REF]. They are based on the notion of k-lazy repairs that are obtained 2.2 Inconsistency-tolerant semantics from the ABox by removing for each cluster of conflicts, i.e. sets of assertions that belong to some conflict that share assertions, either a minimal subset of at most k assertions that restores the consistency of the cluster, or the whole cluster if there is no such subset. Note that not every lazy repair is a repair because of the possible removal of some entire clusters.

Definition 2.2.32 (k-lazy semantics). The clusters are the connected components of the conflict graph that contain at least one edge.

A k-lazy repair of K = hT , Ai is obtained by removing from A for each cluster: (i) either an inclusion minimal set that restores the consistency of the cluster and is of size at most k, (ii) or the whole cluster if there does not exist such a set.

A tuple ã is an answer for a query q over a KB K = hT , Ai under k-lazy semantics, written hT , Ai |= k lazy q(ã), if and only if hT , R k i |= q(ã) for every k-lazy repair R k of K.

Example 2.2.33 (Example 2.2.1 cont'd). There is only one 0-lazy repair for hT , A ann i, obtained by removing every cluster, so every assertion that belongs to some conflict. It follows that it corresponds to the intersection of the repairs, so hT , A ann i |= 0 lazy q(ann).

To restore the consistency of the cluster {AProf(bob), FProf(bob), Postdoc(bob)}, it is sufficient and necessary to remove two assertions. There are three 2-lazy repairs, that all contain some cause for q(bob). It follows that hT , A bob i |= k lazy q(bob) for k 2, but hT , A bob i 6 |= 1 lazy q(bob) since the 1-lazy repair is obtained by removing the whole cluster, so there is no cause left in this repair.

Similarly, to restore the consistency of the cluster {Teach(carl, c c1 ), Teach(carl, c c2 ), Teach(c c1 , c c2 ), Teach(c c2 , c c1 )} it is sufficient and necessary to remove two assertions and the obtained 2-lazy repairs contain causes for q(carl), whereas there is no cause in the 1-lazy repair. It follows that hT , A carl i |= k lazy q(carl) for k 2, and hT , A carl i 6 |= 1 lazy q(carl).

Finally, for hT , A eva i, the only way of repairing the cluster {Student(eva), AProf(eva), Prof(eva)} by removing one assertion is to remove Student(eva), and the 1-lazy repair contains causes for q(eva), so hT , A eva i |= 1 lazy q(eva), but there are two k-lazy repairs for k 2: {AProf(eva), Prof(eva), Teach(eva, c e )} and {Student(eva), Teach(eva, c e )}, and the second one does not contain any cause for q(eva), so hT , A eva i 6 |= k lazy q(eva) for k 2. /

An answer holds under IAR semantics if and only if it holds under 0-lazy semantics, that implies that it also hold under every k-lazy semantics. The k-lazy semantics are not a sound approximation of AR but a compromise between IAR and brave, and it is notable that these semantics are not monotone in k as shown in the preceeding example (eva case). However, for every KB K and query q, there exists k such that K |= AR q iff K |= k lazy q.

Theorem 2.2.34 ( [START_REF] Lukasiewicz | [END_REF], Bienvenu 2012]). Conjunctive query answering under k-lazy semantics over DL-Lite knowledge bases is coNP-complete w.r.t. data complexity for every k 1. Instance checking is in P w.r.t. data complexity.

Theorem 2.2.35. Conjunctive query answering under k-lazy semantics semantics is ⇧ p 2complete w.r.t. combined complexity for every k 1.

Preliminaries

Proof. Checking that a subset of A is k-lazy repair that does not entail q is in p 2 : check consistency in P, check in coNP that it is impossible to add an assertion of a cluster that has not be fully removed without loosing the consistency, and check in coNP that it is not possible to add one of the fully removed cluster except k assertions, then check that it does not entail q in coNP. It follows that CQ answering under k-lazy semantics is in ⇧ p 2 . The reduction given for ⇧ p 2 -hardness of AR CQ entailment in proof of Theorem 2.2.7 can be used to show ⇧ p 2 -hardness. Indeed, the clusters of conflicts are exactly the conflicts (the {GX i (0, 1), GX i (1, 0)}, for 1  i  n), so are of size two and can be repaired by removing exactly one assertion, so the repairs correspond to the k-lazy repairs for every k 1, and q is entailed under the k-lazy semantics for k 1 if and only if it is entailed under AR semantics.

The general modifier-based framework for inconsistency-tolerant query answering

Recently, [START_REF] Baget | [END_REF]] introduced a general framework that captures many of the preceeding semantics and creates new ones. An inconsistency-tolerant semantics is defined as a pair composed of a modifier, that creates a set of ABoxes from the original ABox, and an inference strategy to derive queries from these ABoxes. The paper studies in particular the semantics that use complex modifiers build from the three basic modifiers positive closure (C) that adds to each ABox all assertions that can be derived by applying the positive inclusions of the TBox, splitting into repairs (R) of each ABox, and selecting the cardinality-maximal (M ) ABoxes, and one of the four inference strategies universal (8) that considers true the conclusions that are entailed by every ABox, safe (\) that considers true the conclusions that are entailed by the intersection of the ABoxes, majority-based (maj) that considers true the conclusions that are entailed by the majority of the ABoxes, and existential (9) that considers true the conclusions that are entailed by some ABox. This framework can be extended with other modifiers or inference strategies to cover more semantics.

The AR semantics corresponds to the so-called hR, 8i, that is, using the modifier splitting into repairs and the universal inference strategy. The IAR semantics corresponds to hR, \i, and the brave semantics to the hR, 9i. The ICR semantics corresponds to hCR, \i, the modifier being the composition of positive closure with splitting into repairs. The ICAR, CAR and k-lazy semantics can be included in this general framework by defining other modifiers (adding consistent closure is sufficient to capture ICAR, whereas CAR needs a modifier that builds closed ABox repairs, and k-lazy needs splitting into k-lazy repairs).

We can note that the "natural instantiation of expansion" considered in [START_REF] Baget | [END_REF]], positive closure, that amounts to forgetting the negative inclusions to expand the ABox, differs from that proposed by [START_REF] Lembo | [END_REF] for defining the CAR and ICAR semantics and leads to different semantics (for instance if T = {9R v ¬9R , 9R v A} and A = {R(a, a)}, A(a) is not entailed under the CAR and ICAR semantics but is entailed under hRC, \i). This shows that defining how to expand an inconsistent ABox is not completely clear: CAR and ICAR semantics avoid deriving facts that have only inconsistent reasons to hold but do derive conjunctive queries from inconsistent sets of ABox assertions.

Inconsistency-tolerant semantics

Summary

In this section, we reviewed the main inconsistency-tolerant semantics that have been proposed in the literature for querying DL KBs. Some other inconsistency-tolerant semantics based on preferences over assertions or repairs are presented in Chapter 6, and some related works in the arena of database or existential rules are reviewed in Chapter 7. Figure 2.3 summarizes the relationships between inconsistency-tolerant semantics presented in this section, and Table 2.5 the complexity results for these semantics.

In this thesis, the main focus is on the AR semantics which it is the most widely accepted semantics for querying inconsistent data. We also consider the IAR and brave semantics which correspond to the most and less safe inference strategies over repairs and provide natural lower and upper bounds to AR. These two semantics are also interesting by themselves since they have a clear meaning and it may be important in some applications to know the surest answers that can be retrieved from the knowledge base, or all answers that have some consistent reason to hold, when only very reliable answers should be taken into account, or when missing a possible answer has to be avoided.

Example 2.2.36 (Example 2.2.1 cont'd). We conclude our example by summing up for each KB hT , A x i under which semantics holds q(x).

IAR ICR k-support AR k-defeater brave ICAR CAR k-lazy ann X X k 1 X k X X X k 0 bob X k 3 X k X X X k 2 carl k 2 X k X X k 2 dan k  1 X eva k = 0 X X k = 1 fred X X / Fig.
P i ⌘ ⌘ ⌘ ⌘ ⌘ ⌘ ⌘ ⌘ ⌘ ⌘ ⌘ ⌘ ⌘ ⌘ ⌘ 3 6 ⇣ ⇣ ⇣ ⇣ ⇣ ⇣ ⇣ ⇣ ⇣ ⇣ ⇣ ⇣ ⇣ ⇣ ⇣ ⇣ ⇣ ⇣ 1 -
IAR in AC 0 in AC 0 NP-co in P brave in AC 0 in AC 0 NP-co in P k-support in AC 0 in AC 0 NP-co in P k-defeater in AC 0 in AC 0 NP-co in P ICR coNP-co coNP-co p 2 [O(log n)]-co coNP-co CAR coNP-co in AC 0 ⇧ p 2 -co in P ICAR in AC 0 in AC 0 NP-co in P k-lazy (k 1) coNP-co in P ⇧ p 2 -co in P 3 EFFICIENT INCONSISTENCY-TOLERANT QUERY ANSWERING IN DL-LITE
In this chapter, we present the algorithms we implemented in our CQAPri prototype system for query answering under AR, IAR and brave semantics over DL-Lite knowledge bases. Then, we describe the experimental setting we built to evaluate it, as well as the results we obtained. Finally, we discuss other existing systems for inconsistency-tolerant query answering.

Algorithms

We compute the answers that hold under AR, IAR and brave semantics using the basic algorithms ComputeConflicts and ComputeCauses presented in the preceding section and exploiting the properties of such answers.

Brave To decide if a Boolean query is entailed under brave semantics, we simply need to compute its causes with Algorithm 2.3 (ComputeCauses) and verify that the output is not empty.

IAR Since a query holds under IAR semantics just in the case that one of its cause is such that none of its assertions is involved in some conflict, deciding if a query is entailed under IAR semantics can be done by computing its causes with Algorithm 2.3 (ComputeCauses) and the conflicts of the KB with Algorithm 2.2 (ComputeConflicts).

AR For the coNP-complete problem of deciding if a query is entailed under AR semantics, we encode it as a (UN)SAT problem. Figure 3.1 presents the encoding we use, where variables represent assertions of the ABox, and that is satisfiable just in the case that the query does not hold under AR semantics. Intuitively, the assertions that correspond to the variables assigned to true in a truth assignment that satisfies the formula form a consistent subset of the ABox that contains at least one assertion of the conflicts of each cause of the Fig. 3.1 SAT encoding for AR entailment.

' ¬q = Ĉ2causes(q,K) _ 2confl(C,K)
x

' cons = x↵,x 2vars('¬q), 2confl({↵},K) ¬x ↵ _ ¬x
with vars(' ¬q ) the set of variables appearing in ' ¬q .

query (cf. Definition 2.1.25 for conflicts of a cause). Since this subset is consistent, it can be extended to a repair and such a repair cannot contain any cause for the query, otherwise it would contain a conflict and be inconsistent. The interest of this encoding is that it has as many variables as the number of assertions which are in a conflict with some assertions of a cause of the query. Thus, in practical cases, the size of the formula may be much smaller than the size of the ABox.

Theorem 3.1.1. Let K be a DL-Lite R KB and q be a Boolean conjunctive query. K 6 |= AR q if and only if ' ¬q ^'cons is satisfiable, where ' ¬q and ' cons are defined in Figure 3.1.

Proof. Let ⌫ be a truth assignment of the variables of ' ¬q ^'cons and

R ⌫ = { | ⌫(x ) = true}.
The formula ' ¬q evaluates to true in ⌫ if and only if for every cause C of q, there exists an assertion which is in conflict with some assertion of C and such that ⌫(x ) = true, so is in R ⌫ . The formula ' cons evaluates to true in ⌫ if and only if there is no ↵, which are in a conflict and such that ⌫(x ↵ ) = true and ⌫(x ) = true, so if and only if R ⌫ does not contain any conflict of K, i.e. is T -consistent. Hence ' ¬q ^'cons evaluates to true in ⌫ if and only if R ⌫ is a consistent subset of A that contradicts each cause for q, thus can be extended to a repair of K which does not contain any cause for q, since adding a cause for q to R ⌫ would make it inconsistent. We conclude that ' ¬q ^'cons is satisfiable if and only if there exists a repair of K that does contain any cause for q, so if and only if K 6 |= AR q.

Example 3.1.2. We illustrate the encoding on the following KB:

T ={AProf v Prof, FProf v Prof, Prof v PhD, Postdoc v PhD, AProf v ¬FProf, Prof v ¬Postdoc} A ={AProf(a),

The CQAPri system

For the query q = Prof(a), which has two causes {AProf(a)} and {FProf(a)}, we obtain:

' ¬q =(x FProf(a) _ x Postdoc(a) ) ^(x AProf(a) _ x Postdoc(a) ) ' cons =(¬x FProf(a) _ ¬x Postdoc(a) ) ^(¬x AProf(a) _ ¬x Postdoc(a) ) ^(¬x AProf(a) _ ¬x FProf(a) ) A valuation that assigns x
Postdoc(a) to true and x AProf(a) and x FProf(a) to false satisfies ' ¬q ^'cons , so hT , Ai 6 |= AR q.

If we consider now the query q = PhD(a), which has three causes, {AProf(a)}, {FProf(a)}, and {Postdoc(a)}, we obtain:

' ¬q =(x FProf(a) _ x Postdoc(a) ) ^(x AProf(a) _ x Postdoc(a) ) ^(x AProf(a) _ x FProf(a) ) ' cons =(¬x FProf(a) _ ¬x Postdoc(a) ) ^(¬x AProf(a) _ ¬x Postdoc(a) ) ^(¬x AProf(a) _ ¬x FProf(a) )
The formula ' ¬q ^'cons is unsatisfiable, so hT , Ai |= AR q. / Remark 3.1.3. If we allow denial constraints of the form B 1 u ... u B n v ? in the TBox or of the form of a Boolean CQ (9ỹ (ỹ), where is a conjunction of atoms of the forms A(t) or R(t, t 0 ), with t, t 0 individuals or variables from ỹ) which has to be false, the encoding can be adapted to take into account n-ary conflicts: K 6 |= AR q if and only if '

1 ¬q ^'2 ¬q ^'cons is satisfiable. ' 1 ¬q = Ĉ2causes(q,K) _ B2conflicts(K),C\B6 =; x C,B ' 2 ¬q = xC,B 2vars(' 1 ¬q ) ^ 2B\C ¬x C,B _ x ' cons = x↵2vars(' 2 ¬q ) B2conflicts(K),↵2B _ 2B ¬x
When conflicts are not binary, we cannot define the conflicts of a cause as a set of assertions: it may be necessary to use several assertions to contradict a cause. The new variables x C,B represent each possibility to contradict C and ' 1 ¬q expresses that every cause is contradicted. The formula ' 2 ¬q ensures that when x C,B is assigned to true, which means that C is contradicted with the conflict B, every assertion of B which does not belong to C is selected, so that adding C creates a conflict. As in the preceding encoding, ' cons enforces consistency of the subset consisting of the assertions those corresponding variables are assigned to true by preventing all assertions of a conflict to be selected together. Algorithm 3.4 gives the strongest of these three semantics under which a query holds.

The CQAPri system

We implemented our query answering framework under AR, IAR and brave semantics over DL-Lite R KBs in Java v1.7 within our CQAPri ("Consistent Query Answer-Efficient inconsistency-tolerant query answering in DL-Lite Algorithm 3.4 ClassifyQuery Input: a Boolean conjunctive query q, a TBox T , an ABox A Output: IAR if hT , Ai |= IAR q, AR if hT , Ai |= AR q and hT , Ai 6 |= IAR q, brave if hT , Ai |= brave q and hT , Ai 6 |= AR q, and not brave otherwise Output brave 20: end if where constructEncoding constructs the SAT encoding of Theorem 3.1 from the conflicts of the causes for q and conflicts of K.

Experiments

ing with Priorities") tool. CQAPri is built on top of the relational database server PostgreSQL v9.3.2 (www.postgresql.org), the Rapid v1.0 query rewriting engine for DL-Lite [START_REF] Chortaras | [END_REF], and the SAT4J v2.3.4 SAT solver [Berre & Parrain 2010]. All these building blocks are used with their default settings.

CQAPri classifies a query answer ã into one of 3 classes:

• Possible: K |= brave q(ã) and K 6 |= AR q(ã)

• Likely: K |= AR q(ã) and K 6 |= IAR q(ã)

• (Almost) sure: K |= IAR q(ã)
To do that, CQAPri follows the line of Algorithm 3.4, but uses consistent images instead of causes to decide if a query holds under one or the other semantics, since every cause is an image and every consistent image contains a cause, and removing non-minimal ones is time consuming (cf. Section 4.3.3, Figure 4.5 for an insight of this cost).

CQAPri handles ABoxes stored in PostgreSQL, while it keeps the TBox in-memory. It computes the set of conflicts for the KB in a preprocessing phase since it is query-independent. Conflicts are computed as in Algorithm 2.2: the SQLized rewritings of the queries looking for counter-examples to the negative TBox inclusions are evaluated over the ABox, their images are retrieved and stored as a graph whose vertices are assertions and edges indicate images, and finally the non-minimal ones are discarded by removing edges between any self-inconsistent assertion and the others to obtain the conflict graph.

When a query arrives, CQAPri evaluates it over the ABox using its SQLized rewriting, to obtain its candidate answers and their images. Candidate answers define a superset of the answers holding under the brave, AR and IAR semantics. Among the candidate answers, CQAPri identifies the IAR ones, by checking whether there is some image whose assertions have no outgoing edges in the conflict graph, since such an image contains a cause such that none of its assertions is involved in a conflict. It also identifies those which are not brave-answers by discarding the inconsistent images, that contain an edge of the conflict graph: an answer that has only such images does not hold under brave semantics. Finally, for brave-answers that are not found to be IAR-answers, deciding whether they are entailed under the AR semantics is done using the SAT encodings from the preceding section. Using consistent images instead of causes is not a problem here because the set of causes is included in the set of images and every consistent image contains a cause, so it is possible to consistently contradict every cause iff it is possible to consistently contradict every consistent image.

Experiments

We conducted experiments to empirically study the properties of our framework. We study in particular the impact of the data quality and size on CQAPri behavior, and the proportion of answers in the different classes.

The CQAPri benchmark

To evaluate CQAPri, we needed a DL-Lite R KB with a large and inconsistent ABox. Very few experiments have been done on inconsistent KBs, and the only DL-Lite R benchmark we found was not suitable for our case (cf. Section 3.4.2), so we designed our own.

Ontology

We built our TBox over the LUBM 9 20 TBox from [START_REF] Lutz | [END_REF], which provides an extended DL-Lite R version of the well-known ELI TBox of the Lehigh University Benchmark (LUBM) of [START_REF] Guo | LUBM: A benchmark for OWL knowledge base systems[END_REF]] that describes the university domain. LUBM 9 20 differs from the original LUBM by the removal of the axioms that go beyond DL-Lite R but also by the addition of concept inclusions, many of which having existential restrictions on the right-hand side, and of subconcepts to increase the size of the ontology. LUBM 9 20 comprises 127 concepts, 27 roles and 202 positive inclusions. To allow for contradiction, we added negative inclusions to state the disjointness of pairs of concepts or roles having the same closest super-concept or super-role. Such concepts and roles appear at the same level in the TBox (that is, have the same distance to the top concept Thing). We excluded a small number of such inclusions when they did not seem to reflect the intended meaning of the concepts or roles. Figure 3.2 illustrates how we added negative inclusions for an example concept AssistantProfessor. We added 875 negative inclusions in total. This apparently huge number of constraints results from the many pairwise disjoint concepts or roles used in the TBox.

Datasets

We generated ABoxes of increasing sizes with the Extended University Data Generator (EUGen) provided with LUBM 9 20 by setting its data completeness parameter (i.e. the percentage of individuals from a given concept for which roles describing this concept are indeed filled) to its default value of 95%, which seems realistic from the application viewpoint. All the generated ABoxes were found consistent w.r.t. our enriched TBox, meaning that the added disjointness constraints were faithful to the reused benchmark. The size of these ABoxes ranges from 75,663 to 9,938,139 assertions, which corresponds to 1 to 100 universities in EUGen settings, and each ABox is included in the larger ones: the smallest one corresponds to university 0, the largest one to universities 0 to 99.

Inconsistencies were introduced by reviewing all the assertions of the consistent ABox, and contradicting the presence of an individual in a concept assertion with probability p, and the presence of each individual in a role assertion with probability p/2. A contradicting assertion is built by stating that the considered individual also belongs to a disjoint but close concept, i.e. the two concepts have the same closest super-concept which is not the top concept Thing. Note that a concept may here be an unqualified existential role restriction. The contradicting assertion is added either explicitly or implicitly by choosing one of its specializations (obtained by query rewriting). The concept or role that is used to build the assertion which will actually be added to the ABox is chosen among all rewritings of all possible contradicting assertions with a uniform probability distribution. We chose to FullProfessor, ExDean, VisitingProfessor, AssociateProfessor and Dean. We did not add disjointness axioms with the concepts SubjXProfessor, because such concepts indicate the domain of a professor, which is independent from its seniority.

Efficient inconsistency-tolerant query answering in DL-Lite generate such inconsistencies because they seem quite natural in real applications (e.g. using by mistake AssistantProfessor in place of AssociateProfessor). Conflicting assertions thus introduced are in turn processed as described above to create a few more complex conflicts. Additionally, for every role assertion, its individuals are switched with probability p/10. We chose to generate such misuses of roles because they also seem quite natural mistakes and may lead to inconsistencies (e.g. inverting the Faculty and Course in a TeacherOf role assertion).

Example 3.3.1. Below are four assertions that have been created to conflict some assertions of the original consistent ABoxes.

• The assertion Subj4Course(Department11.U niversity1/GraduateCourse33) contradicts Subj20Course(Department11.U niversity1/GraduateCourse33) because these concepts are disjoint (Subj20Course v ¬Subj4Course). • The assertion Subj3Department(U niversity462) has been inserted to contradict

MastersDegreeFrom(Department22.U niversity0/Lecturer2, U niversity462): in- deed, the range of MastersDegreeFrom is University (9MastersDegreeFrom v University), which is disjoint with Department (University v ¬Department), which has Subj3Department has subconcept (Subj3Department v Department}). • PublicationResearch(DU M M Y _1_1_749, Department18.U niversity1/Course32) conflicts TakesCourse(Department18.U niversity1/U ndergraduateStudent124, Department18.U niversity1/Course32
). Indeed, TakesCourse has Course for range, which is disjoint with Research which is the range of PublicationResearch. • Finally MemberOf(Department5.U niversity1, Department5.U niversity1/ U ndergraduateStudent47) is obtained by switching the two individuals of an assertion. Note that this kind of assertion may induce that an individual belongs to a totally different concept, since the domain and the role of a concept have often no common super-concept other than Thing. Such inversions generally yield a lot of conflicts.

/

For each of the 100 universities that constitute our consistent ABoxes, we set p = 0.002 and generate 50 batches of conflicting assertions to insert, using the method described above. We obtain inconsistent ABoxes with growing ratios of assertions involved in some conflict by adding the n first batches of conflicting assertions to each university of the original consistent ABox, n ranging from 1 to 50, that roughly leads to a percentage of assertions involved in some conflict varying from about 3% to about 46%. We consider that ABoxes with a few percent of assertions in conflicts are realistic, but we also built ABoxes with a huge number of conflicts in order to study the impact of the data quality on the efficiency of our approach.

Table 3.1 displays the characteristics in terms of size, inserted assertions, and number and percentage of assertions involved in conflicts of the ABoxes of our benchmark. Every ABox's id uXcY indicates the number X of universities generated by EUGen and the number of queries batches used to add conflicts Y. Note that our method ensures that uXcY ✓ uX 0 cY when X  X 0 and uXcY ✓ uXcY 0 when Y  Y 0 .

Experiments

ABoxes are stored as relational databases in PostgreSQL with one table per concept and role, of one or two columns (named s for concept and s and o for role) that contains the individuals involved in that concept or role. B-Tree indexes have been created for each table, on s for concepts and (s, o) and (o, s) for roles. The concepts, roles and individuals names are encoded by integers, and a dictionary table relates each name to its identifier. [START_REF] Lutz | [END_REF], Rosati et al. 2012], and we designed the others ourselves. We chose queries that use some concepts that have disjoint specializations to get more chance to get answers that hold under AR semantics and not under IAR semantics.

Queries

Experimental setting

All experiments reported in this thesis were run on an Intel Xeon X5647 at 2.93 GHz with 16 GB of RAM, running CentOS 6.8. Reported times are averaged over 5 runs.

We did not measure the time that our prototype takes to present the results (i.e. translating the answers back in the original terminology with the dictionary table of the database and printing the results in text files), since the goal our experiments was to study the properties of the computation of query answers rather than their presentation, that a real OMQA system would probably handles in a more refined and efficient way.

Experimental results

We empirically study the properties of our consistent query answering framework. We measure the time spent in the different phases of query answering under IAR, AR and brave semantics, and how it varies with the size of the ABoxes and the ratio of assertions involved in some conflicts. We also consider the evolution of the number of answers under each semantics.

The time it took CQAPri to be up and ready to answer queries is dominated by the construction of the conflict graph for the ABox (Table 3.3); it took about 2 seconds to load the TBox, construct the queries that correspond to the violation of negative inclusions, and open the PostgreSQL connection to the ABox. The time for the construction of the conflict graph has a linear behavior w.r.t. the size of the ABox, and the more conflicts there are, the higher is the slope.

Table 3.4 shows, per ABox and query pair, how many Sure, Likely and Possible answers were identified among the candidate answers. In this table, OOM means that CQAPri ran out of memory. In all our experiments, we found only a few candidate answers that are not brave: only q9 got such answers, on all ABoxes (up to 802 inconsistent answers on u100conf50). Only 9 queries out of 20 got Likely answers over some ABoxes, 5 of them have only one or two atoms (q1, q2, q11, q12, q13) while the others are more complex (q5, q6, q9, q18). Such answers show up as these queries are general and involve concepts with many disjoint sub-concepts. For 67.5% of our ABox and query pairs, AR does not provide any additional answers compared to IAR. However, in q5 and uXc20 cases, all answers are AR and not IAR. For such selective queries, using the AR semantics rather than IAR may be necessary to get answers. Unsurprisingly, for a given ABox size, when the proportion of conflicting assertions increases, the number of Sure answers decreases while the number of Likely and Possible answers increases. This incurs a higher computational cost since a call to the SAT solver is needed for each non-IAR-answer to decide if it holds under AR semantics or not. Figure 3.4 shows the evolution of the time spent by CQAPri for AR query answering w.r.t. the size of the ABox, when the proportion of conflicting assertions is a few percent, as it is likely to be in most real applications, about 30%, and about 45%. Figure 3.5 shows the evolution of the time spent by CQAPri for AR query answering w.r.t. the proportion of ABox assertions involved in some conflicts, for small, intermediate and big ABoxes. Figure 3.6 shows the proportion of the query answering time spent in rewriting the query, executing the rewritten query to get candidate answers, filtering the IAR-or not brave-answers, and identifying the AR-answers among the remaining answers.

q1 =Person(x) ^takesCourse(x, y) q2 =Employee(x) ^publicationAuthor(y, x) q3 =Professor(x) ^teacherOf(x, y) ^worksFor(x, Department0.U niversity0) q4 =FullProfessor(x) ^publiAuthor(y, x) ^teacherOf(x, z) ^advisor(u, x)ĝ raduateStudent(u) ^degreeFrom(x, v) ^degreeFrom(u, w) q5 =9yPerson(Department2.U niversity0/Graduatudent131)t akesCourse(Department2.U niversity0/GraduateStudent131, y)Ĝ raduateCourse(y) ^takesCourse(x, y) ^Person(x) q6 =9yEmployee(x) ^publicationAuthor(y, x) ^Employee(z) ^publicationAuthor(y, z)m emberOf(x, Department4.U niversity0)m emberOf(z, Department4.U niversity0) q7 =9xEmployee(x) ^memberOf(x, Department2.U niversity0) ^degreeFrom(x, y) q8 =9yteacherOf(x, y) ^degreeFrom(x, U niversity532) q9 =9yuEmployee(x) ^memberOf(x, u) ^degreeFrom(x, y) ^Employee(z)m emberOf(z, u) ^degreeFrom(z, y) q10 =9uEmployee(x) ^memberOf(x, u) ^degreeFrom(x, U niversity532) ^Employee(z)m emberOf(z, u) ^degreeFrom(z, U niversity532) q11 =9yFaculty(x) ^publicationAuthor(y, x) q12 =Organization(x) q13 =Employee(x) q14 =Student(x) ^advisor(x, y) ^Faculty(y) ^takesCourse(x, z) ^teacherOf(y, z)Ĉ ourse(z) q15 =Person(x) ^worksFor(x, y) ^Organization(y) q16 =9zuStudent(x) ^takesCourse(x, y) ^Course(y) ^teacherOf(z, y) ^Faculty(z)ŵ orksFor(z, u) ^Department(u) ^memberOf(x, u) q17 =9yzFaculty(x) ^degreeFrom(x, y) ^University(y) ^subOrganizationOf(z, y)D epartment(z) ^memberOf(x, z) q18 =9yzPublication(x) ^publicationAuthor(x, y) ^Professor(y)p ublicationAuthor(x, z) ^Student(z) q19 =9zuUniversity(x) ^University(y) ^memberOf(z, x) ^Student(z) ^University(y)m emberOf(u, y) ^Professor(u) ^advisor(z, u) q20 =takesCourse(x, y) ^Student(x)t eacherOf(Department0.U niversity0/AssociateP rof essor0, y) ^Course(y)
At first sight, there are two outlier queries q4 and q9 whose answering times have an exponential-like growth w.r.t. ABox size even in realistic cases. Query q4 is very sensitive both to ABox size and ratio of conflicts, while q9 is rather robust to conflicts. This comes from the uncommon characteristics of these queries. Indeed, q9 has 202,579 rewritings, with 4 variables and no constant, that leads to a very costly execution over the database, as illustrated on Figure 3.6 where almost 90% of the time is spent in executing the rewritten query even in the case of the largest ABox with the highest percentage of conflicts. Query q10 that differs from q9 only by the introduction of a constant, behaves very differently since its answering time stabilizes quickly. Regarding q4, it has a high number of atoms and variables, which are all free, that yields a huge number of answers (10,362,220 answers on u100c10), that becomes quickly non-IAR since their causes involve lots of assertions. These two queries are interesting to challenge our system but are not realistic, especially q4.

For the other queries, CQAPri scales up to large ABoxes when the proportion of assertions involved in some conflict is only a few percent, and even a few tens percent for most of the queries. The increase of the number of non-IAR-answers when the proportion of conflicts increases generally significantly augments the time spent in this last phase. It explains that Efficient inconsistency-tolerant query answering in DL-Lite the lower the ratio of conflicts, the more query answering time shows a linear behavior w.r.t. the ABox size.

The average time to classify an answer is generally under the millisecond, and of at most 7 ms (for q19 on u20c50). The average time to decide if a brave and non-IAR-answer is AR or not is generally a little higher but also under the millisecond.

CQAPri scales overall in settings from realistic to more artificial ones. Our experiments thus demonstrate that the AR-answers can be computed in practice and that this is due to the fact that the IAR semantics often constitutes a very good approximation of the AR semantics.

Discussion:

systems and benchmarks for inconsistency-tolerant query answering

Systems for inconsistency-tolerant query answering

In terms of implemented tools and benchmarks for inconsistency-tolerant query answering over DL KBs, we are aware of two systems : the QuID system [START_REF] Rosati | [END_REF], Lembo et al. 2015] that handles IAR semantics for CQs and DL-Lite A KBs, and the system of [Du et al. 2013] for querying SHIQ KBs under a variant of AR semantics with weight on ABox assertions that handles CQs without non-distinguished variables that reduce to assertions entailments. Neither system is directly comparable to our own, since they employ different semantics, and in the case of the system of Du et al. target different DLs and queries.

The QuID system implements three approaches for query answering under IAR semantics: evaluation of the IAR perfect reformulation over the inconsistent ABox, evaluation over the ABox annotated with information about assertions that belong to some conflict of the original query enriched with conditions to filter out such assertions, and evaluation of the original query over the ABox from which every assertion involved in some conflict has been removed before query answering time. Our approach regarding IAR is closer to the two last, since our preprocessing phase where we compute and store the conflicts is similar in spirit to the annotation and extraction of the intersection of the repairs. The main difference is that we do not modify the query to retrieve only IAR-answers at evaluation time but rather filter out IAR-answers from candidate answers by checking a posteriori that they have causes without conflict.

We can observe some high-level similarities with Du et al.'s system which also has a preprocessing phase that compiles the KB, then employs SAT solvers and uses a reachability analysis to identify a query-relevant portion of the KB to do query answering.

There are also a few systems for querying inconsistent relational databases. Most relevant to our work is EQUIP [Kolaitis et al. 2013], which reduces AR conjunctive query answering in the presence of primary key constraints to binary integer programming (BIP). Similarly to our system, EQUIP first computes the IAR-answers and the causes of the answers with their conflicts. The encoding for AR consists in a first part that encodes the repairs, enforcing that exactly one tuple of each group of same-key tuple is selected, and a second 3.4 Discussion: systems and benchmarks for inconsistency-tolerant query answering part that ensures that the repair contains no cause. The main difference with CQAPri is that instead of building and solving one encoding for each answer, only one is built using variables to represent the different answers, so that setting them to 1 trivializes the equations related to the causes of this answer. The answers that do not hold under AR semantics are computed iteratively, by minimizing the sum of the answers variables, that are then set to 1 when found not AR, until the system becomes unsatisfiable. We considered using BIP but were not convinced by our preliminary experiments. Some systems focus on cases where consistent query answering is tractable, for restricted types of constraints or queries, using first-order rewritings (ConQuer [Fuxman & Miller 2005, Fuxman et al. 2005]) or conflict-hypergraph (Hippo [Chomicki et al. 2004a, Chomicki et al. 2004b]). Others handle more general constraints that can lead to different kinds of repairs, since for databases repairs it may be necessary to insert or modify tuples to restore consistency. For instance, ConsEx [Marileo & Bertossi 2010] reduces AR query answering to answer set programming (ASP) by building repair programs such that there is a one-to-one correspondence between stable models and repairs. Experiments reported in [Kolaitis et al. 2013] show that EQUIP outperforms ConsEx on its restricted setting that is closer to ours.

Experimental settings involving inconsistent DL-Lite KBs

The QuID benchmark QuID is evaluated using the LUBM TBox containing 43 concepts, 25 roles, 7 attributes and about 200 positive inclusions, approximated in DL-Lite by eliminating the inclusions that go beyond DL-Lite, then enriched with 10 negative inclusions, 5 identifications (that state that some sets of properties identify the instances of some basic concepts), and 3 denials constraints consisting in Boolean CQs (of the form 9ỹ (ỹ), where is a conjunction of atoms using variables from ỹ) which have to be false. Datasets are generated with the UBA Data Generator provided with LUBM, for 1, 5, 10 and 20 universities, leading to a size varying from about 100K to about 2 million assertions. For each of these consistent ABoxes, four inconsistent ABoxes are constructed by adding 1%, 5%, 10% and 20% of assertions that are in conflict. The main difference with our setting is the way conflicts are generated. Indeed, the original ABox is left consistent while each assertion added is in conflict with others. In practice, for a growing n, the same n fresh individuals are assigned to the eleven concepts that appear in some negative inclusion, and the same n pairs of fresh individuals are assigned to the five roles (or inverse roles) that appear in some negative inclusion. While such way of adding conflicts may make sense for evaluating the QuID system that implements IAR semantics, which only needs to ignore the assertions that are in some conflicts, it is not realistic at all because the new individuals are inserted in many concepts that are semantically very far from each other like Person, Publication, Course, and Organization. We could therefore not use these datasets to evaluate CQAPri since there is no chance that some query could hold under AR semantics but not under IAR semantics.

Du et al.'s benchmark In Du et al. later work on abduction over inconsistent DL-Lite

KBs [START_REF] Du | [END_REF], the Semintec and LUBM TBoxes without the non-DL-Lite axioms are used. The authors added negative inclusions to LUBM in a similar fashion to ours.

Regarding data, Semintec has a small ABox of about 65K assertions and the number of universities used for LUBM datasets ranges from 1 to 100 as in our experimental setting. Du et al. present in [Du et al. 2013] the tool called Injector they use to insert conflicts in ABoxes. Given a consistent KB and a number of conflicts to be inserted, Injector selects randomly a functional role or an atomic concept that has disjoint atomic concepts. If the KB already entails assertions that correspond to that role or concept, Injector selects randomly such an assertion and adds an assertion that conflicts it: in case of functional role, it relates the corresponding individual of the ABox to a new individual with that role, and in case of concept assertion, it assigns the individual to one of the disjoint atomic concepts. Otherwise, Injector adds two assertions that are in conflict in the same way using fresh individuals. This way of adding conflicts is much more realistic than that of QuID setting. Even if it is similar in spirit to ours, since it tries to distribute randomly conflicts over the ABox, there are some differences. First, we select randomly assertions of the initial ABox rather than concepts or roles that may be contradicted, which leads to a repartition of the conflicts that respects the structure of the data (since there may be lots of assertions of some concepts and no assertion of others). Second, we do not use only atomic concepts to build contradictions but also unqualified existential role restrictions. Finally we take into account another kind of possible errors by switching role individuals. In [START_REF] Du | [END_REF], 0 to 400 "conflicts" (i.e. assertions that contradict an original assertion, or inconsistent pairs of assertions) are added to the consistent ABoxes. We prefer talk in terms of assertions involved in some conflicts rather than in terms of assertions added to the consistent ABox, since we can compute the ratio of conflicts of a real dataset, but not its ratio of erroneous facts. However, note that we added many more assertions than Du et al. in same size original datasets.

EXPLAINING INCONSISTENCY-TOLERANT QUERY ANSWERING

In this chapter, we address the problem of explaining why a tuple is or is not an answer to a query under the IAR, AR or brave semantics. We first define data-centric explanations for positive and negative answers. In the second section, we study their computational complexity in DL-Lite R , and propose algorithms to compute them by exploiting solvers for Boolean satisfaction and optimization problems. The third section presents our implementation within CQAPri and the experiments we conducted. Finally, the last section discusses the notion of responsibility in this context. The main results of this chapter have been published in [Bienvenu et al. 2016a].

Explaining query results

The need to equip reasoning systems with explanation services is widely acknowledged by the DL community (see Chapter 7 for more discussion and references), and such facilities are all the more essential when using inconsistency-tolerant semantics, as recently argued in [Arioua et al. 2014a, Arioua et al. 2014b, Arioua et al. 2015] which introduce an argumentation framework for explaining positive and negative answers under the ICR semantics. Indeed, the brave, AR, and IAR semantics allow one to classify query answers into three categories of increasing reliability (Possible, Likely and Sure), and a user may naturally wonder why a given tuple was assigned to, or excluded from, one of these categories. Our goal is therefore to help the user understand the classification of a particular tuple, e.g. why is ã an AR-answer, and why is it not an IAR-answer? We address this issue by proposing and exploring a framework for explaining query answers under these three semantics by introducing the notion of explanation for positive and negative query answers under brave, AR, and IAR semantics.

Although the study of explanation services for DLs has thus far focused primarily on explaining entailed TBox axioms or ABox assertions, the problem of explaining conjunctive query answers under the classical semantics for consistent KBs has been studied. A prooftheoretic approach to explaining positive answers to CQs over DL-Lite A KBs was introduced Explaining inconsistency-tolerant query answering in [START_REF] Borgida | [END_REF]. It outputs a single proof, involving both TBox axioms and ABox assertions, that is generated by "tracing back" the relevant part of the rewritten query, using minimality criteria to select a "simplest" proof. For negative answers, explanations for hT , Ai 6 |= q(ã) are defined in [Calvanese et al. 2013] as sets A 0 of ABox assertions such that hT , A [ A 0 i |= q(ã). Practical algorithms and an implementation for computing such explanations were described in [Du et al. 2014]. The latter work was recently extended to the case of inconsistent KBs [START_REF] Du | [END_REF]. Essentially the idea is to add a set of ABox assertions that will lead to the answer holding under IAR semantics (in particular, the new assertions must not introduce any inconsistencies).

To explain answers under inconsistency-tolerant semantics, the existing approaches are not sufficient. Indeed, it is no longer sufficient to prove that positive answers are entailed by some part of the ABox together with the TBox to show that they hold in every repair for instance. Regarding negative answers, they do not result from the absence of supporting facts anymore, but rather from the presence of conflicting assertions. Since we target scenarios in which inconsistencies are due to errors in the ABox, understanding the link between (possibly faulty) ABox assertions and query results is especially important. That is why we choose to focus on ABox assertions, rather than TBox axioms. The explanations we consider will therefore take either the form of a set of ABox assertions (viewed as a conjunction) or a set of sets of assertions (interpreted as a disjunction of conjunctions). We shall see that our "ABox-centric" explanation framework already poses non-trivial computational challenges. To get more complete explanations, which also present the TBox reasoning involved in the obtention of the results, our work could be combined with the framework of [START_REF] Borgida | [END_REF]].

Example 4.1.1. As a running example, consider the following inconsistent KB K = hT , Ai and queries.

T = {AProf v Prof, FProf v Prof, 9Advise v Prof, Prof v PhD, Postdoc v PhD, AProf v ¬FProf, Prof v ¬Postdoc} A = {Postdoc(ann), AProf(ann), FProf(ann), Advise(ann, bob), Teach(ann, c 1 ), Teach(ann, c 2 ), Teach(ann, c 3 )} q 1 (x) =Prof(x) q 2 (x) =9yPhD(x) ^Teach(x, y) q 3 (x) =9yTeach(x, y)
The repairs are as follows:

Rep(T , A) = { {Postdoc(ann), Teach(ann, c 1 ), Teach(ann, c 2 ), Teach(ann, c 3 )}, {AProf(ann), Advise(ann, bob), Teach(ann, c 1 ), Teach(ann, c 2 ), Teach(ann, c 3 )}, {FProf(ann), Advise(ann, bob), Teach(ann, c 1 ), Teach(ann, c 2 ), Teach(ann, c 3 )} }

Explaining query results

Evaluating the queries over the KB yields the following results:

K |= brave q 1 (a) K |= AR q 2 (a) K |= IAR q 3 (a) K 6 |= AR q 1 (a) K 6 |= IAR q 2 (a) /
The simplest answers to explain are positive brave-and IAR-answers. We can use the query's causes as explanations for the former, and the causes that do not participate in any contradiction for the latter. Indeed, we have seen in Chapter 2.2.2 that an answer holds under brave semantics just in the case that it has some cause, and under IAR semantics just in the case that it has some cause whose assertions do not belong to any conflict. Definition 4.1.2 (Explanations for IAR-and brave-answers). An explanation for K |= brave q(ã) is a cause for q(ã) w.r.t. K. An explanation for K |= IAR q(ã) is a cause C for q(ã) w.r.t. K such that C ✓ R for every repair R of K.

Example 4.1.3 (Example 4.1.1 cont'd). There are three explanations for K |= brave q 1 (ann): AProf(ann), FProf(ann), and Advise(ann, bob).

There are twelve explanations for K |= brave q 2 (ann) that are the following conjunctions: Postdoc(ann) ^Teach(ann, c j ), AProf(ann) ^Teach(ann, c j ), FProf(ann)

Teach(ann, c j ), and Advise(ann, bob) ^Teach(ann, c j ), for each j 2 {1, 2, 3}. There are three explanations for K |= IAR q 3 (ann): Teach(ann, c 1 ), Teach(ann, c 2 ), and Teach(ann, c 3 ), since these assertions are not involved in any conflict. /

To explain why a tuple is an AR-answer, it is no longer sufficient to give a single cause, since the answer may be supported by different causes in different repairs. We will therefore define explanations as (minimal) disjunctions of causes that "cover" all repairs. Definition 4.1.4 (Explanations for AR-answers). An explanation for K |= AR q(ã) is a set E = {C 1 , . . . , C m } ✓ causes(q(ã), K) such that (i) every repair R of K contains some C i , and (ii) no proper subset of E satisfies this property.

Example 4.1.5 (Example 4.1.1 cont'd). There are 36 explanations for K |= AR q 2 (ann), each taking one of the following two forms:

E ij =(Postdoc(ann) ^Teach(ann, c i )) _ (Advise(ann, bob) ^Teach(ann, c j )) E 0 ijk =(Postdoc(ann) ^Teach(ann, c i )) _ (AProf(ann) ^Teach(ann, c j )) _ (FProf(ann) ^Teach(ann, c k ))
for some i, j, k 2 {1, 2, 3}. / Remark 4.1.6 (Relationship with k-support semantics). A tuple ã is an answer to q under the k-support semantics if and only if K |= AR q(ã) has an explanation consisting of at most k causes.

We next consider how to explain negative AR-and IAR-answers, i.e., brave-answers not entailed under AR or IAR semantics. For AR semantics, the idea is to give a (minimal) subset of the ABox that is consistent with the TBox and contradicts every cause of the query, since any such subset can be extended to a repair that omits all causes. For IAR semantics, the formulation is slightly different as we only need to ensure that every cause is contradicted by some consistent subset, as this shows that no cause belongs to all repairs. Definition 4.1.7 (Explanations for negative AR-answers). An explanation for K 6 |= AR q(ã) is a T -consistent subset E ✓ A such that: (i) hT , E [ Ci |= ? for every C 2 causes(q(ã), K), (ii) no proper subset of E has this property.

Example 4.1.8 (Example 4.1.1 cont'd). The unique explanation for K 6 |= AR q 1 (ann) is Postdoc(ann), which contradicts the three causes of q 1 (ann). / Remark 4.1.9 (Relationship with k-defeater semantics). A tuple ã is an answer to q under the k-defeater semantics if and only if there is no explanation of K 6 |= AR q(ã) of size at most k.

Definition 4.1.10 (Explanations for negative IAR-answers). An explanation for K 6 |= IAR q(ã) is a (possibly T -inconsistent) subset E ✓ A such that: (i) for every C 2 causes(q(ã), K), there exists a T -consistent subset E 0 ✓ E with hT , E 0 [ Ci |= ?, (ii) no proper subset of E has this property.

Example 4.1.11 (Example 4.1.1 cont'd). The three explanations for K 6 |= IAR q 2 (ann) are: AProf(ann) ^Postdoc(ann), FProf(ann) ^Postdoc(ann), and Advise(ann, bob) Postdoc(ann), where the first assertion of each explanation contradicts the causes of q 2 (ann) that contain Postdoc(ann), and the second one contradicts those that contain AProf(ann), FProf(ann) or Advise(ann, bob). /

The following example illustrates that explanations are more informative than causes and conflicts, since some causes and conflicts may not be involved in the answer explanations. It also shows that explanations for negative answers should be accompanied with the explanations for being a brave-answer (i.e. the causes), because otherwise they may be difficult to understand.

Example 4.1.12.

Consider the KB K = hT , Ai T = {9Advise v Prof, Prof v Employee, Postdoc v Employee, Prof v ¬Postdoc, 9WorkFor v Employee, 9WorkFor v Department, Employee v ¬Department, 9TakeCourse v Course, 9Advise v Person, Course v ¬Person} A = {Postdoc(ann), Advise(ann, bob), Advise(ann, carl), Teach(ann, c 1 ),
TakeCourse(c 2 , carl), WorkFor(ann, dpt), WorkFor(dpt, dan)}

The conflicts are: conflicts(K) ={{Postdoc(ann), Advise(ann, bob)}, {Postdoc(ann), Advise(ann, carl)}, {Advise(ann, carl), TakeCourse(c 2 , carl)}, {WorkFor(ann, dpt), WorkFor(dpt, dan)}}

Explaining query results

Evaluating the query q(x, y) = Employee(x) ^Teach(x, y) over K yields K |= AR q(ann, c 1 ).

The causes of q(ann, c 1 ) are as follows:

causes(q(ann, c 1 ), K) = { {Postdoc(ann), Teach(ann, c 1 )}, {Advise(ann, bob), Teach(ann, c 1 )}, {Advise(ann, carl), Teach(ann, c 1 )}, {WorkFor(ann, dpt), Teach(ann, c 1 )}}

There is only one explanation for K |= AR q(ann, c 1 ): (Postdoc(ann) ^Teach(ann, c 1 )) _ (Advise(ann, bob) ^Teach(ann, c 1 )). The cause Advise(ann, carl) ^Teach(ann, c 1 ) does not participate in any explanation because it is conflicted by TakeCourse(c 2 , carl) that can be chosen independently from the other causes. Indeed, note that if R is a repair of K that contains Advise(ann, carl) ^Teach(ann, c 1 ), then R 0 = (R\{Advise(ann, carl)}) [ {TakeCourse(c 2 , carl)} is also a repair. Every explanation contains some cause C included in R 0 , and TakeCourse(c 2 , carl) does not belong to any cause, so C ✓ R. It follows that Advise(ann, carl) ^Teach(ann, c 1 ) is not needed to "cover" R. For the same reason, the cause WorkFor(ann, dpt) ^Teach(ann, c 1 ) does not belong to any explanation for K |= AR q(ann, c 1 ) because of the assertion WorkFor(dpt, dan).

There are two explanations for K 6 |= IAR q(ann, c 1 ): WorkFor(dpt, dan)^Postdoc(ann)Â dvise(ann, bob), and WorkFor(dpt, dan) ^Postdoc(ann) ^Advise(ann, carl). Note that TakeCourse(c 2 , carl) is not involved in the explanations of K 6 |= IAR q(ann, c 1 ), while it is a conflict of the cause Advise(ann, carl) ^Teach(ann, c 1 ). This is because Postdoc(ann) is also a conflict of this cause and is the only assertion that contradicts the other cause Advise(ann, bob) ^Teach(ann, c 1 ), so each set of assertions which contradicts every cause contains Postdoc(ann), and TakeCourse(c 2 , carl) is not needed, so does not appear in any minimal such set.

If a user receives the explanations for K 6 |= IAR q(ann, c 1 ), without the causes of q(ann, c 1 ), it can be very hard for him to figure out why WorkFor(dpt, dan) is relevant. Indeed, there is no obvious relation between this assertion and the answer (ann, c 1 ), since WorkFor(dpt, dan) does not involve any of the individuals of the answer. Even if the explanations for K |= AR q(ann, c 1 ) are provided, it would not help because neither dpt nor dan appears in them. To understand why WorkFor(dpt, dan) is part of the explanations for K 6 |= IAR q(ann, c 1 ), the user needs to know the cause {WorkFor(ann, dpt), Teach(ann, c 1 )}. Ideally, we should allow the user to ask for a justification of the relevance of an assertion ↵ of the explanations, and provide the causes (or at least one cause) that contain some assertion in conflict with ↵. /

When there is a large number of explanations for a given answer, it may be impractical to present them all to the user. In such cases, instead of presenting all explanations, one may choose to rank the explanations according to some preference criteria, and to present one or a small number of most preferred explanations. In this work, we will use cardinality to rank explanations for brave-and IAR-answers and negative AR-and IAR-answers. For positive AR-answers, we consider two ranking criteria: the number of disjuncts, and the total number of assertions. Another interesting criterion would be the difficulty of the associated TBox reasoning. For example, we may compute for each cause the minimum number of TBox Explaining inconsistency-tolerant query answering axioms needed to show that the cause yields the query, and then use this number to rank explanations for brave-and IAR-answers.

Example 4.1.13 (Example 4.1.1 cont'd). Reconsider explanations E 1 1 and E 0 1 2 3 for K |= AR q 2 (ann). There are at least two reasons why E 1 1 may be considered easier to understand than E 0 1 2 3 . First, E 1 1 contains fewer disjuncts, hence requires less disjunctive reasoning. Second, both disjuncts of E 1 1 use the same Teach assertion, whereas E 0 1 2 3 uses three different Teach assertions, which may lead the user to (wrongly) believe all are needed to obtain the query result. Preferring explanations having the fewest number of disjuncts, and among them, those involving a minimal set of assertions, leads to focusing on the explanations of the form E i i , where i 2 {1, 2, 3}. /

A second complementary approach to dealing with a large number of explanations is to concisely summarize the set of explanations in terms of the necessary assertions (i.e. appearing in every explanation) and the relevant assertions (i.e. appearing in at least one explanation). The advantage of this approach is to present the whole information to the user without overwhelming him with all explanations. This is especially relevant in the case of positive AR and negative answers, where the number of explanations may be exponential in the size of the ABox because of the combination of the different causes for AR-answers, and ways of contradicting each cause for negative answers. Indeed, the set of conflicts of each cause can be as large as the ABox. Even for positive IAR or brave-answers, the number of explanations can be very large (imagine for instance a query that retrieves the persons who teach something, advise some students and have some publications).

Example 4.1.14 (Example 4.1.1 cont'd). If we tweak the example KB to include n courses taught by ann, then there would be n 2 + n 3 explanations of the form E i j and E 0 i j k for K |= AR q 2 (ann), built using only n + 4 assertions. Presenting the necessary assertions (here: Postdoc(ann)) and relevant ones (AProf(ann), FProf(ann), Advise(ann, bob), and Teach(ann, c j ) for 1  j  n) gives a succinct overview of the set of explanations. /

Complexity analysis and algorithms

In this section, we study the computational properties of the different notions of explanation for DL-Lite R KBs. In addition to the problem of generating a single explanation (GENONE), or a single best explanation (GENBEST) according to a given criteria, we consider four related decision problems: decide whether a given assertion appears in some explanation (REL) or in every explanation (NEC), decide whether a candidate is an explanation (REC), resp. a best explanation according a given criterion (BEST REC).

This section aims at proving the following theorem and provides the algorithms we use to explain answers. Theorem 4.2.1. The complexity results displayed in Table 4.1 hold.

When showing that a decision problem is hard for a given complexity class, we use standard polynomial-time many-one reductions (also known as Karp reductions), which transform an instance of one decision problem into an instance of a second decision problem. We consider that a procedure solves the generation task GENONE (resp. GENBEST) if it outputs an explanation (resp. best explanation according to the chosen criterion) when there is at least one explanation, and otherwise, it outputs no. To show that a generation task is hard for a class C, we reduce a C-hard decision problem to it. As we cannot use many-one reductions (which relate two decision problems), we will use polynomial-time Turing reductions, that is, we will show how to solve the C-hard decision problem using a polynomial-time Turing machine that can use the generation task as an oracle. Moreover, to prove a stronger intractability result, we will only allow a single oracle call.

Complexity analysis and algorithms

Positive brave and IAR-answers

We recall that in DL-Lite R , the conflicts for a KB K = hT , Ai and the causes of a query q can be computed in polynomial time w.r.t. data complexity. Since the explanations for positive brave-answers are the causes, and the explanations for positive IAR-answers are the causes that belong to every repair, i.e. those which do not contain any assertion involved in a conflict of K, it is possible to compute the entire set of explanations for positive brave and IAR-answers in P. This means that GENONE is in P. For polynomial-time ranking criteria, both GENBEST and BEST REC are solvable in P since we can compare all of the explanations to identify the best ones. The sets of relevant and necessary assertions can be computed in P by taking the union and intersection of the explanations.

Positive AR-answers

We relate explanations of positive AR-answers to minimal unsatisfiable subsets of a set of propositional clauses.

Explaining inconsistency-tolerant query answering Definition 4.2.2 (Minimal Unsatisfiable Subset). Given sets F and H of soft and hard clauses respectively, a subset

M ✓ F is a minimal unsatisfiable subset (MUS) of F w.r.t. H if (i) M [ H is unsatisfiable, and (ii) M 0 [ H is satisfiable for every M 0 ( M .
To explain K |= AR q(ã), we exploit the encoding of Figure 3.1. We consider the soft clauses

' ¬q = { C | C 2 causes(q(ã), K)} with C = _ 2confl(C,K)
x that try to contradict every cause, and the hard clauses

' cons = {¬x ↵ _ ¬x | x ↵ , x 2 vars(' ¬q ), 2 confl({↵}, K)} that enforce consistency. Proposition 4.2.3. A set E ✓ causes(q(ã), K) is an explanation for K |= AR q(ã) iff { C | C 2 E} is a MUS of ' ¬q w.r.t. ' cons .
Proof. First suppose that E is an explanation of K |= AR q(ã). By Definition 4.1.4, this means that every repair of K contains at least one cause C from E. It follows that it is not possible to select one conflicting assertion for each corresponding cause in a consistent way, i.e. { C | C 2 E} [ ' cons is inconsistent. Moreover, the minimality condition ensures that for every proper subset E 0 ( E, there is a repair R that does not contain any cause from E 0 . We can use R to select a consistent set of assertions that conflict with every cause in E 0 , which means that

{ C | C 2 E 0 } [ ' cons is satisfiable. Thus, { C | C 2 E} is a MUS of ' ¬q w.r.t. ' cons . Conversely, suppose that { C | C 2 E} is a MUS of ' ¬q w.r.t. ' cons . Then { C | C 2 E}[' cons is unsatisfiable, and every { C | C 2 E 0 }[' cons with E 0 ( E is satisfiable. The fact that { C | C 2 E} [ ' cons is
unsatisfiable means that there is no way to consistently contradict the causes in E, so every repair must contain one of the causes in E. The satisfiability of

{ C | C 2 E 0 } [ ' cons for E 0 ( E implies
the existence of a repair that omits every cause in E 0 . We have thus shown that E satisfies the conditions of Definition 4.1.4, so it is an explanation of K |= AR q(ã). Proof. We recall the following complexity results for MUSes (see [Liberatore 2005]):

• Deciding if a set of clauses is a MUS is BH 2 -complete. • Deciding if a clause belongs to some MUS is ⌃ p 2 -complete.
When combined with Proposition 4.2.3, the first item yields membership in BH 2 of REC. For BEST REC, we show that an explanation is not a best one by guessing a better candidate and

Complexity analysis and algorithms

checking in BH 2 that it is an explanation. This yields a ⌃ p 2 procedure for the complement of BEST REC, hence membership in ⇧ p 2 for BEST REC. For REL, we note that an assertion ↵ is relevant for explaining K |= AR q(ã) just in the case that there exists a cause C for q(ã) w.r.t. K that contains ↵ and appears in some explanation. By Proposition 4.2.3, the latter holds just in the case that C belongs to some MUS of ' ¬q w.r.t. ' cons . By the second item above, deciding whether a particular clause C belongs to some MUS can be decided in ⌃ p 2 . To obtain a ⌃ p 2 decision procedure for REL, we simply add an initial non-deterministic guess of a cause C 2 causes(q(ã), K) that mentions the considered assertion ↵.

We next show the NP upper bound for NEC.

Proposition 4.2.5. Regarding explanations for positive AR-answers, NEC is in NP w.r.t. data complexity.

Proof. If ↵ is belongs to every explanation of K |= AR q(ã), then there exists a repair R such that every cause for q(ã) included in R contains ↵. Otherwise, if for every repair R, there was a cause C R such that ↵ / 2 C R , then there would be a minimal disjunction of these C R which covers every repair and does not contain ↵. In the other direction, it is clear that if there exists such a repair R , then any minimal disjunction of causes that covers every repair contains ↵.

It follows that ↵ belongs to every explanation of K |= AR q(ã) just in the case that either there are no explanations at all ( i.e. K 6 |= AR q(ã)) or there exists a repair R of K = hT , Ai such that hT , R \ {↵}i 6 |= q(ã).

Both conditions can be tested in NP w.r.t. data complexity. Indeed, to decide whether the second condition holds, we simply guess a subset R ✓ A and check (in P w.r.t. data complexity) that R is a repair and hT , R \ {↵}i 6 |= q(ã).

The following proposition shows how the connection to MUSes can be exploited to obtain matching lower bounds.

T 0 = {9P v ¬9N , 9P v ¬9U , 9N v ¬9U , 9U v A} A 0 = {P (c j , x i ) | X i 2 C j } [ {N (c j , x i ) | ¬X i 2 C j } [ {U (a, c j ) | 1  j  k} q 0 = A(x)
The causes for q 0 (a) are given by the assertions U (a, c j ), which are in conflict with assertions of the form P (c j , x i ) or N (c j , x i ). It was shown that hT 0 , A 0 i |= AR A(a) iff ' 0 is unsatisfiable. To prove the proposition, we will require the following stronger claim: Claim. The following are equivalent:

1. the set of clauses {C j 1 , ..., C jp } is unsatisfiable 2. every repair of hT 0 , A 0 i contains some assertion from {U (a, c j 1 ), ..., U(a, c jp )} Proof of claim. It will be more convenient to show that the negations of the two statements are equivalent. First suppose that {C j 1 , ..., C jp } is satisfiable, as witnessed by the satisfying assignment ⌫. Define a repair R ⌫ of hT 0 , A 0 i by including the assertion

P (c j , v i ) if ⌫(v i ) = true, including N (c j , v i ) if ⌫(v i ) = false,
and then adding as many other assertions as needed to obtain a maximal T 0 -consistent subset. Since ⌫ satisfies every clause in {C j 1 , ..., C jp }, it follows that for every index `2 {j 1 , . . . , j p }, the clause C `contains a positive literal v `such that ⌫(v `) = true, or a negative literal ¬v `such that ⌫(v `) = false. In the former case, R ⌫ contains the assertion P (c `, v `), and in the latter case, R ⌫ contains N (c `, v `). In both cases, there is an assertion in R ⌫ that conflicts with U (a, c `), so the latter assertion cannot appear in R ⌫ . We have thus shown that R ⌫ does not contain any of the assertions in {U (a, c j 1 ), ..., U(a, c jp )}.

Next suppose there exists a repair R of hT 0 , A 0 i that has an empty intersection with the set {U (a, c j 1 ), ..., U(a, c jp )}. By the maximality of R, it follows that for every `2 {j 1 , . . . , j p }, there must exist an assertion in R of the form P (c `, v i ) or N (c `, v i ). Define a (possibly partial) assignment ⌫ R by setting by X i to true if R contains some P (c j , x i ) and to false if R contains some N (c j , x i ) (recall that R is consistent with T 0 , and so it cannot contain both P (c j , x i ) and N (c j 0 , x i )). By construction, ⌫ R satisfies all of the clauses in {C j 1 , ..., C jp }, i.e. {C j 1 , ..., C jp } is satisfiable. (end proof of claim)

It follows from the preceding claim that the explanations for hT 0 , A 0 i |= AR q 0 (a), i.e. the minimal sets of causes for q 0 (a) that cover all repairs, correspond precisely to the MUSes of ' 0 . We can therefore exploit known complexity results for MUSes [Liberatore 2005]:

• Deciding if a clause belongs to a MUS is ⌃ p 2 -complete, so deciding if U (a, c j ) belongs to an explanation for hT 0 , A 0 i |= AR q 0 (a) is ⌃ p 2 -hard w.r.t. data complexity. Thus, we have a ⌃ p 2 lower bound for REL. • Deciding if a clause belongs to every MUS is NP-complete, so deciding if U (a, c j ) belongs to every explanation for hT 0 , A 0 i |= AR q 0 (a) is NP-hard w.r.t. data complexity. This gives an NP lower bound for NEC.

• REC: Deciding if a set of clauses is a MUS is BH 2 -complete, so deciding if {{U (a, c j 1 )}, ..., {U (a, c jp )}} is an explanation is BH 2 -hard w.r.t. data complexity. Hence, REC is BH 2 -hard.
The proof of [Liberatore 2005] for ⌃ p 2 -hardness of deciding if there exists a MUS of size at most k also shows that deciding if a set of clauses is a smallest MUS is ⇧ p 2 -hard. It follows that deciding if an explanation for an AR-answer contains a smallest number of causes is ⇧ p 2 -hard. Moreover, since every cause in the considered KB consists of a single assertion,

Complexity analysis and algorithms

deciding if an explanation for an AR-answer contains a smallest number of assertions is also ⇧ p 2 -hard.

To see why the generation task GENONE is NP-hard, we note that to solve the NPcomplete problem of whether K 6 |= AR q(ã), it suffices to call the procedure for GENONE to generate a single explanation for K |= AR q(ã). If the procedure outputs 'no' (meaning there is no explanation for K |= AR q(ã)), then we output 'yes', and if it outputs an explanation, then we return 'no'.

The ⌃ p 2 -hardness of GENBEST, when explanations are ranked based upon the number of disjuncts or the number of assertions, follows from the ⇧ p 2 -hardness of BEST REC for these same criteria. Indeed, to show that an explanation is not a best explanation, it suffices to generate a best explanation (GENBEST) and verify that it has fewer disjuncts / assertions than the explanation at hand.

Negative AR-answers

We relate explanations of negative AR-answers to minimal models of ' ¬q [ ' cons .

Definition 4.2.7 (Minimal model). Given a clause set over variables X, a set M ✓ X is a minimal model of iff (i) every valuation that assigns true to all variables in M satisfies , (ii) no M 0 ( M satisfies this condition. Cardinality-minimal models are defined analogously.

Proposition 4.2.8. A set E is an explanation (resp. cardinality-minimal explanation) for

K 6 |= AR q(ã) iff {x ↵ | ↵ 2 E} is a minimal (resp. cardinality-minimal) model of ' ¬q [ ' cons .
Proof. We recall that the reason why K |= AR q(ã) iff ' ¬q ^'cons is unsatisfiable is because the assertions whose corresponding variables are assigned to true in a valuation that satisfies ' ¬q ^'cons form a subset of the ABox which: (i) contradicts every cause, since ' ¬q states that for every cause, one conflicting assertion is selected, and (ii) is consistent, since ' cons states that two assertions in a conflict cannot be selected together. Thus, the inclusion-minimal models of ' ¬q ^'cons are precisely the explanations for negative AR-answers.

Next we show the complexity upper bounds for the decision problems. Proposition 4.2.9. Regarding explanations for negative AR-answers, REC is in P, BEST REC is in coNP, REL is in NP, and NEC is in coNP w.r.t. data complexity.

Proof. It follows from Definition 4.1.7 that deciding whether E ✓ A is an explanation for K 6 |= AR q(ã) can be done in P (data complexity) by checking:

• consistency of hT , Ei • inconsistency of hT , E [ Ci for every C 2 causes(q(ã), K) • minimality of E: no proper subset E 0 ( E satisfies the two previous conditions. We can decide in NP that an explanation E is not a best explanation (according to some polynomial-time ranking criterion) by guessing a subset E 0 ✓ A and verifying in P w.r.t. data complexity that E 0 is an explanation (see previous paragraph) and that it is better than E according to the given criterion. This yields a coNP upper bound for BEST REC.

A simple NP procedure for deciding REL (resp. not NEC) consists in guessing a subset E ✓ A that contains (does not contain) the considered assertion and checking in P whether it is an explanation (using the P procedure for REC).

For the purposes of implementation, we propose alternative procedures for REL and NEC.

Proposition 4.2.10. An assertion ↵ is relevant for explaining K 6 |= AR q(ã) iff the clause set ' ¬q [ ' cons [ ' ↵ is satisfiable, where

' ↵ ={ _ C2causes(q(ã),K),↵2confl(C,K) x C } [ {¬x C _ ¬x | C 2 causes(q(ã), K), ↵ 2 confl(C, K), 2 confl(C, K), 6 = ↵}
Proof. If ↵ is relevant, there exists an explanation E such that ↵ 2 E. Since E is minimal, there exists a cause C such that C [ (E\{↵}) is consistent. It follows that no assertion 2 confl(C, K) belongs to E except for ↵. Then the valuation ⌫ such that ⌫(x C ) = true, and for every assertion , ⌫(x

) = true if 2 E, ⌫(x ) = false otherwise, satisfies ' ¬q [ ' cons [ ' ↵ .
In the other direction, if ' ¬q [ ' cons [ ' ↵ is satisfiable, it is possible to contradict every cause with a consistent set E of assertions such that there exists a cause C such that the only assertion of E \ confl(C, K) is ↵. Then an explanation that contains ↵ is included in E.

Proposition 4.2.11. An assertion ↵ is necessary for explaining

K 6 |= AR q(ã) iff the set of clauses ' ¬q [ ' cons [ {¬x ↵ } is unsatisfiable. Proof. By Proposition 4.2.8, E is an explanation for K 6 |= AR q(ã) iff {x ↵ | ↵ 2 E} is a minimal model of ' ¬q [ ' cons .
It follows that ↵ belongs to every explanation for K 6 |= AR q(ã) just in the case that x ↵ belongs to every minimal model of ' ¬q [ ' cons , so ' ¬q [ ' cons [ {¬x ↵ } has no model, i.e. is unsatisfiable.

The next proposition establishes matching lower bounds. All reductions are illustrated on Figure 4.1. Proposition 4.2.12. Regarding explanations for negative AR-answers, NEC is coNP-hard, and REL, GENONE, and GENBEST (for any ranking criterion) are NP-hard w.r.t. data complexity. If explanations are ranked by cardinality, then BEST REC is coNP-hard w.r.t. data complexity.

Proof. All reductions are from (UN)SAT. Let ' = C 1 ^... ^Ck be a set of clauses over propositional variables {X 1 , ..., X n }.

• GENONE and GENBEST: Let T 0 , A 0 , and q 0 be as in Proposition 4.2.6. We know that ' 0 is satisfiable iff hT 0 , A 0 i 6 |= AR A(a). Thus, to decide the satisfiability of ' 0 , we generate a (best) explanation of hT 0 , A 0 i 6 |= AR A(a). If an explanation is produced, then we return 'yes', and if the procedure returns with no explanation, then we output 'no'.

• NEC: We again let T 0 , A 0 , and q 0 be as in Proposition 4.2.6. Define a new TBox T 1 = T 0 [ {9U v ¬S} and ABox A 1 = A 0 [ {S(a)}. By construction, the assertion S(a) contradicts every cause for q 0 (a), so hT 1 , A 1 i 6 |= AR q 0 (a). We show that deciding whether ' is satisfiable is equivalent to deciding if S(a) is not necessary for explaining hT 1 , A 1 i 6 |= AR q 0 (a). This establishes the coNP-hardness of checking necessity.

) Let ⌫ be a satisfying valuation for '. It can be easily verified that the set

{P (c j , v i ) 2 A 0 | ⌫(v i ) = true} [ {N (c j , v i ) 2 A 0 | ⌫(v i ) = false}
conflicts with every cause of q 0 (a), and so by choosing a subset of these assertions, we can construct an explanation for hT 1 , A 1 i 6 |= AR q 0 (a) that does not contain S(a).

( An explanation E that does not contain S(a) forms a T 1 -consistent set of P -and N -assertions such that every c j has an outgoing P -or N -edge. We obtain a (partial) assignment ⌫ E that satisfies ' by setting

⌫ E (v i ) = true if E contains an assertion P (c j , v i ) and ⌫ E (v i ) = false if E contains an assertion N (c j , v i ).
• REL: We use the TBox T 1 and the ABox A 2 = A 1 [ {U (a, c k+1 ), P (c k+1 , x n+1 )}. Again, we note that S(a) contradicts every cause for q 0 (a), so hT 1 , A 2 i 6 |= AR q 0 (a). We show that ' is satisfiable iff P (c k+1 , x n+1 ) is relevant for explaining hT 1 , A 2 i 6 |= AR q 0 (a); it follows that relevance is NP-hard.

) If ' is satisfiable, then we can obtain an explanation for hT 1 , A 2 i 6 |= AR q 0 (a) by adding P (c k+1 , x n+1 ) to a minimal subset of the P -and N -assertions corresponding to a satisfying truth assignment for '.

( If ' is unsatisfiable, then every explanation must contain S(a). It follows that {S(a)} is the only explanation, so P (c k+1 , x n+1 ) is not relevant.

• BEST REC: We consider the following KB:

T 3 = T 0 [ {U 1 v U, U 2 v U, 9U 1 v ¬T, 9U 2 v ¬S} A 3 = {P (c j , x i ) | X i 2 C j } [ {N (c j , x i ) | ¬X i 2 C j }[ {U 1 (a, c j ), U 2 (a, c j ), T (c j ) | 1  j  k} [ {S(a)}
We claim that E = {S(a), T (c 1 ), ..., T (c k )} is a smallest explanation for hT 3 , A 3 i 6 |= AR q 0 (a) iff ' is unsatisfiable.

) If ' is satisfiable, then we can use a satisfying truth assignment to define a consistent set of k P -and N -edges such that every c j has an outgoing edge. This set is an explanation for hT 3 , A 3 i 6 |= AR q 0 (a), and it has fewer assertions than E.

( If there exists an explanation of size at most k, it contains necessarily only P -and N -edges, since k assertions (P , N or T ) are needed to conflict all U 1 , and S(a) is needed as soon as one of the U 1 -assertions is conflicted only by a T -assertion. It follows that there exists a consistent set of P -and N -assertions such that every c j has an outgoing edge, from which we can construct a satisfying assignment for '.

Note that role inclusions are not needed for the lower bound, we can replace

U 1 v U, U 2 v U by 9P v ¬9U 1 , 9N v ¬9U 1 , 9P v ¬9U 2 , 9N v ¬9U 2 , 9U 1 v A, 9U 2 v A in the reduction.
= {C 1 = X 1 _ ¬X 2 , C 2 = ¬X 1 _ X 2 _ ¬X 3 }. A 0 x 1 x 2 x 3 c 1 c 2 Q Q Q Q Q Q Q Q k X X X X X X X X y X X X X X X X X y ⇠ ⇠ ⇠ ⇠ ⇠ ⇠ ⇠ ⇠ 9 ⇠ ⇠ ⇠ ⇠ ⇠ ⇠ ⇠ ⇠ 9 a X X X X X X X X y ⇠ ⇠ ⇠ ⇠ ⇠ ⇠ ⇠ ⇠ 9 P N N P N U U A 1 x 1 x 2 x 3 c 1 c 2 Q Q Q Q Q Q Q Q k X X X X X X X X y X X X X X X X X y ⇠ ⇠ ⇠ ⇠ ⇠ ⇠ ⇠ ⇠ 9 ⇠ ⇠ ⇠ ⇠ ⇠ ⇠ ⇠ ⇠ 9 a S X X X X X X X X y ⇠ ⇠ ⇠ ⇠ ⇠ ⇠ ⇠ ⇠ 9 P N N P N U U A 2 x 1 x 2 x 3 x 4 c 1 c 2 c 3 Q Q Q Q Q Q Q Q k X X X X X X X X y X X X X X X X X y ⇠ ⇠ ⇠ ⇠ ⇠ ⇠ ⇠ ⇠ 9 ⇠ ⇠ ⇠ ⇠ ⇠ ⇠ ⇠ ⇠ 9 a S X X X X X X X X y ⇠ ⇠ ⇠ ⇠ ⇠ ⇠ ⇠ ⇠ 9 ⌘ ⌘ ⌘ ⌘ ⌘ ⌘ ⌘ ⌘ + P N N P N P U U U A 3 x 1 x 2 x 3 c 1 c 2 T T Q Q Q Q Q Q Q Q k X X X X X X X X y X X X X X X X X y ⇠ ⇠ ⇠ ⇠ ⇠ ⇠ ⇠ ⇠ 9 ⇠ ⇠ ⇠ ⇠ ⇠ ⇠ ⇠ ⇠ 9 a S X X X X X X X X y ⇠ ⇠ ⇠ ⇠ ⇠ ⇠ ⇠ ⇠ 9 X X X X X X X X y ⇠ ⇠ ⇠ ⇠ ⇠ ⇠ ⇠ ⇠ 9 P N N P N U 1 U 1 U 2 U 2
4.2 Complexity analysis and algorithms

Negative IAR-answers

Similarly to the negative AR-answers explanations, we relate explanations of negative IARanswers to minimal models of the clause set ' ¬q . Indeed, to show that an answer is not IAR, it is sufficient to contradict every cause, without the consistency constraint.

Proposition 4.2.13. A set E is an explanation (resp. cardinality-minimal explanation) for

K 6 |= IAR q(ã) iff {x ↵ | ↵ 2 E} is a minimal (resp. cardinality-minimal) model of ' ¬q .
Proof. The assertions whose corresponding variables are assigned to true in a valuation that satisfies ' ¬q form a subset of the ABox which contradicts every cause, since ' ¬q states that for every cause, one conflicting assertion is selected. Thus, the inclusion-minimal (resp. cardinality-minimal) models of ' ¬q are precisely the explanations (resp. cardinality-minimal explanations) for negative IAR-answers.

Importantly, ' ¬q does not contain any negative literals, and it is known that for positive clause sets, a single minimal model can be computed in P, and the associated relevance problem is also in P. We establish properties of the necessary and relevant assertions that we use to compute them. Lemma 4.2.14. An assertion is necessary for explaining K 6 |= IAR q(ã) just in the case that it is the only conflict of some cause for q(ã).

Proof. An assertion is necessary to contradicts every cause iff it is necessary to contradict one cause. This means that an assertion ↵ is necessary for explaining K 6 |= IAR q(ã) iff there exists a cause C for q(ã) such that confl(C, K) = {↵}. Lemma 4.2.15. An assertion is relevant for explaining K 6 |= IAR q(ã) just in the case that it is in conflict with a cause C for q(ã) such that for every other cause

C 0 , if confl(C 0 , K) ✓ confl(C, K), then ↵ 2 confl(C 0 , K).
Proof. To see why this characterization holds, first note that if ↵ is relevant for K 6 |= IAR q(ã), then there is a subset E ✓ A with ↵ 2 E such that every cause of q(ã) is in conflict with some assertion in E, and no proper subset of E 0 possesses this property. Since E is a minimal set of assertions having this property, we know that there is some cause C that does not conflict with any assertion in E \ {↵}, and so there cannot exist another cause C 0 such that confl(C 0 , K) ✓ confl(C, K) and ↵ 6 2 confl(C 0 , K). Conversely, let us suppose that the assertion ↵ is in conflict with a cause C of q(ã) and for every other cause C 0 , confl(C 0 , K) ✓ confl(C, K) implies ↵ 2 confl(C 0 , K). It follows that for every cause C 0 of q(ã), either ↵ 2 confl(C 0 , K), or there exists an assertion C 0 2 confl(C 0 , K) such that C 0 / 2 confl(C, K). We can therefore construct an explanation for K 6 |= IAR q(ã) by taking ↵ together with some of the assertions

C 0 .
We next establish the complexity upper bounds.

Proposition 4.2.16. Regarding explanations for negative IAR-answers, REC is in P, BEST REC is in coNP, NEC is in P, REL is in P, and GENONE is in P w.r.t. data complexity.

Proof. It follows from Definition 4.1.10 and from the fact that in DL-Lite R conflicts are binary that deciding whether E ✓ A is an explanation for K 6 |= IAR q(ã) can be done in P (data complexity) by checking:

• for every C 2 causes(q(ã), K), inconsistency of hT , C [ {↵}i for some assertion ↵ 2 E • minimality of E: no proper subset E 0 ( E satisfies the previous condition.

We can decide in NP that an explanation E is not a best explanation (according to some polynomial-time ranking criterion) by guessing a subset E 0 ✓ A and verifying in P w.r.t. data complexity that E 0 is an explanation and that it is better than E according to the given criterion. This yields a coNP upper bound for BEST REC.

Since causes and conflicts can be computed in P, it follows from Lemma 4.2.15 that deciding whether an assertion is necessary can be done in P.

For REL and GENONE, we can use Proposition 4.2.13 to polynomially reduce these problems to the corresponding problems for minimal models of monotone CNF formulas and exploit known results for that setting. Here we describe polytime procedures for the REL and GENONE that are based upon standard techniques from the propositional setting.

The polynomial upper bound for REL follows from the condition of Lemma 4.2.15, which can be checked in polynomial time by examining the causes and conflicts (which are known to be computable in P w.r.t. data complexity).

For GENONE, we first compute (in P) the set of causes of q and conflicts of K. If there is some cause that does not participate in any conflict, then K |= IAR q(ã), so we return 'no'. Otherwise, for each cause C 2 causes(q(ã), K), we choose some assertion ↵ C such that ↵ C conflicts with some assertion in C. By construction, {↵ C | C 2 causes(q(ã), K)} contradicts all causes, which means that this set contains at least one explanation. We therefore proceed to remove one assertion at a time as long the set retains the property of contradicting all causes. When it is no longer possible to remove any assertions, we return the current set of assertions, which is an explanation.

Finally, we establish the intractability of BEST REC and GENBEST.

Proposition 4.2.17. Regarding explanations for negative IAR-answers in the case where explanations are ranked by cardinality, GENBEST is NP-hard, and BEST REC is coNP-hard w.r.t. data complexity.

Proof. We give a reduction from the problem of deciding if a truth assignment that satisfies a monotone 2-SAT formula assigns a smallest number of variables to true. This problem is coNP-complete (coNP-hardness can be shown by a straightforward reduction from the complement of the well-known NP-complete vertex cover problem).

Let ' = C 1 ^... ^Ck be a monotone 2-CNF over the variables {X 1 , ..., X n }, and let ⌫ be a truth assignment that satisfies '. Consider the following KB:

T = {9P r v ¬T | 1  r  2} A = {T (x i ) | 1  i  n} [ {P r (c j , x i ) | X i r th term of C j } q = 9yz 1 z 2 P 1 (y, z 1 ) ^P2 (y, z 2 )
' = {C 1 = X 1 _ X 2 , C 2 = X 2 _ X 3 }. x 1 x 2 x 3 T T T c 1 c 2 X X X X X X X X y X X X X X X X X y ⇠ ⇠ ⇠ ⇠ ⇠ ⇠ ⇠ ⇠ 9 ⇠ ⇠ ⇠ ⇠ ⇠ ⇠ ⇠ ⇠ 9 P 1 P 2 P 1 P 2 Figure 4
.2 illustrates this reduction on an example. The causes for q take the form {P 1 (c j , x i 1 ), P 2 (c j , x i 2 )}. It follows that an explanation for hT , Ai 6 |= IAR q is a set E of T -assertions such that for every c j , there is at least one

X i 2 C j such that T (x i ) 2 E.
Deciding if ⌫ assigns a minimal number of variables to true is equivalent to deciding if E = {T (x i ) | ⌫(X i ) = true} is a smallest explanation. This yields the coNP-hardness of BEST REC, as well as the NP-hardness of GENBEST: we can solve the minimum assignment problemand its complement -by generating a cardinality-minimal explanation and comparing its size with the number of variables set to true by the candidate assignment.

Implementation and experiments

The explanations framework within CQAPri

To explain why a query answer ã belongs to one of the three classes Possible, Likely and Sure that correspond to K |= S q(ã) and K 6 |= S' q(ã) for two semantics S and S', CQAPri provides all the explanations for ã being a positive answer under the first semantics and a single explanation for it being a negative answer under the other one (i.e. a counter-example), together with the necessary and relevant assertions. For Possible answers, we provide also the necessary and relevant assertions for explaining K 6 |= IAR q(ã). Positive explanations are ranked as explained in Section 4.1: using the number of assertions for negative answers and positive brave and IAR-answers, and numbers of disjuncts and total number of assertions for AR-answers; for ranking the later, the user can choose the priority between the two criteria.

Explanations are computed using the results on positive and negative answers from Section 4.2. We thus need the causes of the query answers as well as their conflicts. For the causes, CQAPri prunes the non-minimal images computed during the query answering phase. The conflicts are directly available from the previous steps.

For positive IAR-answers, CQAPri stores the causes without conflict during the query answering time. Instead of halting at the first cause without conflict, it reviews all causes. For Explaining inconsistency-tolerant query answering positive AR-answers, the SAT encoding is constructed for the query answering phase and CQAPri uses the solver SAT4J to compute the MUSes. Necessary and relevant assertions for positive answers are simply the intersection and union of the explanations. For negative AR-answers, we rely on SAT4J to compute a smallest model of ' ¬q ^'cons , as well as the necessary and relevant assertions with the encodings presented in Propositions 4.2.10 and 4.2.11 that we use to test every potentially relevant assertion, i.e. that appears in ' ¬q . For negative IAR-answer, we choose to compute by default an arbitrary explanation in polynomial time (cf. Section 4.3.3 for the reason of this choice), but CQAPri can also provide a smallest explanation using the SAT solver to find a cardinality-minimal model of ' ¬q . The relevant and necessary assertions are computed using Algorithm 4.5 that exploits Lemmas 4.2.14 and 4.2.15.

Algorithm 4.5 RelNecNegIAR Input: the conflicts of the causes of q(ã): confl(C 1 , K), ..., confl(C n , K) Output: relevant and necessary assertions for explaining K 6 |= IAR q(ã)

1: for all C i do 2: if |confl(C i , K)| = 1 then 3: N ecessary N ecessary [ confl(C i , K) 4: end if 5: Relevant i confl(C i , K) 6: for all C j do 7: if confl(C j , K)\confl(C i , K) = ; then 8: Relevant i Relevant i \ confl(C j , K) 9: end if 10:
end for 11: end for 12: Relevant S Relevant i 13: Output Relevant, N ecessary

Experimental setting

To assess the practical interest of our framework, we empirically study the properties of our implementation, in particular: the impact of varying the percentage of assertions in conflict, the typical number and size of explanations, and the extra effort required to generate cardinality-minimal explanations for negative IAR-answers rather than arbitrary ones.

We use the benchmark and experimental setting presented in the Chapter 3 and explain all answers of the queries over all the ABoxes of our benchmark, except for those which have more than 200,000 answers, because it yields unreasonable experimental times.

Experimental results

We summarize below the general tendencies we observed. Table 4.2 shows the number of answers from each class for each query, as well as the distribution of the explanation times Fig. 4.3 Time in seconds for query answers explanation w.r.t. the size of the ABox for three ratios of conflicts (about 4%, 30%, and 45% of assertions involved in some conflict). For readability, the two figures on the right focus on the queries whose explanation times are lower and whose behaviors are thus not visible on the first one.

Implementation and experiments

for these answers, for ABoxes of growing sizes and ratios of conflicts. Figure 4.3 and Figure 4.4 show the time spent in explaining all query answers w.r.t. ABox size or proportion of conflicting assertions. Figure 4.5 shows the proportion of time spent in the different phases to explain all query answers for ABoxes of growing difficulty. The explanation cost, given by the two upper bars, consists in pruning non-minimal consistent subsets of the ABox entailing the answers to get the causes, and computing the explanations from the causes and conflicts.

The three lower bars relate to the query answering phase, which consists in rewriting and executing the query to get the candidate answers, and identifying Sure, Likely, and Possible answers (classify).

The main conclusion is that explaining a single query answer, as described above, is always feasible and fast (1s) when there are a few percent of conflicts in the ABox (Table 4.2, uXc1 case), as is likely to be the case in most real applications. Even with a high percentage of conflicts, the longest time observed is below 20s (19.5s for explaining a Possible answer of q9 on u100c50), and remains lower than 1s for small ABoxes (up to u20cY case, i.e. 2 million assertions), and lower than 8s for a significant percentage of conflicts (uXc20 case, i.e. 30% of assertions in conflict). In all the experiments we made, explaining a single answer typically takes less than 10ms, rarely more than 1s. However, computing explanations of all answers can be prohibitively expensive when there are very many answers, which is why we do not produce them all by default.

In more detail, adding conflicts to the ABox complicates the explanations of answers, due to their shift from the Sure to the Likely and Possible classes. Explaining such answers indeed comes at higher computational cost. Figures 4.3, 4.4 and 4.5 illustrate this phenomenon. Compared to query answering, explaining all query answers is more sensitive both to ABox size and ratio of conflicts.

We observed that the average number of explanations per answer is often reasonably low, although some answers have a large number of explanations. For instance, on the ABoxes u100cY, we got often less than 10 explanations on average, but this number varies from about 1 to more than 400, and for u100c50, we got up to 4560 for an AR-answer (up to 741 causes for a brave-answer). Even on small ABoxes (u1cY), we got up to 693 explanations for a brave-answer and 243 explanations for an AR-answer. Regarding the size of explanations of AR-answers, the number of causes in the disjunction was up to 25 (for a q12 Likely answer on u100c50; up to 5 on the u1cY ABoxes), showing the practical interest of ranking the explanations.

Explaining negative answers

Our prototype is able to explain K 6 |= S 0 q(ã) by providing a (possibly smallest) explanation for K 6 |= S 0 q(ã), together with the relevant and necessary assertions for K 6 |= S 0 q(ã). We explain here why we chose to compute an arbitrary explanation for K 6 |= IAR q(ã) by default rather than a cardinality-minimal one. We also give some insight into the explanation times for K 6 |= AR q(ã) and the contribution of the computation of necessary and relevant assertions.

Explaining inconsistency-tolerant query answering

We consider the following four cases:

• Case 1 is our default setting, in which we compute an arbitrary explanation for negative IAR-answers, a smallest explanation for negative AR-answers, and the necessary and relevant assertions for explaining negative answers, • Case 2 differs from Case 1 in omitting the computation of the necessary and relevant assertions for K 6 |= AR q(ã) and K 6 |= IAR q(ã), • Case 3 differs from Case 1 in omitting the computation of the relevant assertions for K 6 |= AR q(ã),

• Case 4 differs from Case 1 in computing a cardinality-minimal explanation for K 6 |= IAR q(ã) instead of using a polynomial-time procedure to generate an arbitrary one.

Table 4.3 displays, for each query, the number of Likely and Possible answers the query possesses, and the distribution of the times for explaining K 6 |= S 0 q(ã) in our default setting (Case 1). If we compare these distributions with those of Table 4.2, we can see that for many queries, there is the same number of answers having the longest explanation times (columns [100, 1000[ and > 1000) when only the negative answer is explained as in the case where both K |= S q(ã) and K 6 |= S 0 q(ã) are explained. This shows that for many queries, the difficulty comes from explaining K 6 |= S 0 q(ã).

Cost of relevant and necessary assertions Table 4.4 shows the same information as Table 4.3, in the case where the necessary and relevant assertions for explaining K 6 |= IAR q(ã) or K 6 |= AR q(ã) are not computed. In this case, almost all negative answers are explained in less than 10ms. This shows that the main part of the explanation time for negative answers is spent in computing these assertions. Note that for negative IAR-answers (Likely answers), most of the explanation times were already below 10ms in our default case.

Computation of relevant assertions for negative AR-answers Since computing the necessary and relevant assertions for K 6 |= AR q(ã) appears to be costly, we investigate further to see how this cost is distributed and if it is possible to reduce the cost of negative explanation without losing too much information. For negative AR-answers, deciding if an assertion ↵ appears in some explanation is an NP-complete problem, and deciding if it appears in all explanations is coNP-complete. In practice the problem of finding the necessary assertions can be solved efficiently because for a negative AR-answer, the SAT solver has already found a model of ' ¬q [ ' cons during the query answer classification phase, so checking whether ' ¬q [ ' cons [ {¬x ↵ } is unsatisfiable is trivial when ↵ does not appear in this model, and if it does, the SAT solver may reuse what it has already computed for a closely related problem. Deciding if ↵ is relevant is more difficult because the encoding we use differs more from ' ¬q [ ' cons . Indeed, if we compare the execution times with (Table 4.3, for Possible answers) and without (Table 4.5) the computation of the relevant assertions for K 6 |= AR q(ã), we observe significant differences: for all queries and ABoxes, at least 60% of the negative AR-answers are explained in less than 10ms (only 6.45% for q19 on u100c50 in Case 1), and less than 0.15% of them need more than 1s (12.72% of the negative AR-answers of q12 on u100c50 in Case 1). Moreover, the longest time required to explain an answer in Case 1 is generally significantly longer than in Case 3 ( for instance on u100c20, the longest time required to explain an answer is 8s in Case 1, while it is 5s for Case 3). We therefore tried to obtain an approximation of these assertions that is fast to compute. The assertions relevant for K 6 |= IAR q(ã) can be computed very quickly and provide a superset of those for K 6 |= AR q(ã), since the explanations for K 6 |= AR q(ã) are the consistent explanations for K 6 |= IAR q(ã). However, in our experiments, those two sets of assertions differ quite significantly, and when they do the difference may be huge (hundreds of assertions instead of one to four assertions for some answers of q12 on u100c20). When the ABox size and ratio of conflicts increase, the proportion of answers having additional relevant assertions for K 6 |= IAR q(ã) and the difference between the two sets of relevant assertions for K 6 |= IAR q(ã) and K 6 |= AR q(ã) increase. The two sets always coincide on u1c1, while on the uXc50 ABoxes, they differ in up to 100% of the Possible answers of a query (up to 27 assertions for u1c50, up to 651 assertions for u100c50). On u100c1 they differ in up to 5.6% of the Possible answers of a query, and up to 501 assertions. This shows that it is not possible to gain time on explaining negative AR-answers without losing too much information.

Implementation and experiments

Cardinality of explanations of negative IAR-answers Although smallest explanations for negative answers are preferable, we found it worthwhile to use a polynomial-time method to obtain an arbitrary explanation for a negative IAR-answer rather than relying on the SAT solver to generate a smallest such explanation.

Indeed, computing an arbitrary explanation for K 6 |= IAR q(ã) always takes less than 100ms (Table 4.3, Likely answers), and in almost all cases less than 10ms.

By contrast, when a smallest explanation is computed (Table 4.6), more time may be needed. A striking case is that of q12: on u20c20, almost 19 minutes are spent in computing a smallest explanation for one negative IAR-answer, and on u100c20, it takes around 50 minutes, while computing an arbitrary explanation was done in less than 10ms for every ABox and negative IAR-answer of q12 (Table 4.3). This even leads to a time-out for ABoxes from u20c30. This long explanation time is due to the unusual size of the explanation (18 assertions for the answer on u100c20, whereas other negative explanations typically contained only a few assertions).

In terms of size of explanations, we found that on u100c20 the arbitrary explanations generated for all negative IAR-answers of q5, q6, q11, and q12 have exactly the same size as the smallest explanations found with the SAT solver, that only one negative IAR-answer of q13 had a suboptimal explanation (with 4 assertions instead of 3), as well as about 61% of the negative IAR-answers of q9, whose explanations are at most two assertions bigger than the smallest ones.

The possibly very high additional cost of computing a smallest explanation for a limited benefit in terms of the size of explanations lead us to adopt arbitrary explanations for negative IAR-answers as the default setting in our system. However, note that this very high additional cost concerns very few answers, for instance all the other negative IAR-answers of q12 on u20c20 are explained in less than 10ms. It could therefore be possible to allow a short time to first try to find a smallest explanation, and to provide an arbitrary explanation in case of failure.

Discussion about the notion of responsibility

In the database arena, the notion of responsibility has been introduced to quantify the importance of a tuple in the obtention of a (non)answer and can be used to order the tuples of the explanation of this (non)answer [START_REF] Meliou | [END_REF]. The responsibility of a tuple ↵ is a number whose main property is that it is not null just in the case that ↵ is relevant to explain the (non)answer, and equal to one just in the case that ↵ is necessary. Expressed in the DL terminology (in the consistent case and for a positive answer), the responsibility of an assertion ↵ is 1 1+k where k is the least number of assertions to delete to make ↵ critical in the obtention of the answer, i.e. to make ↵ belong to every image of the answer.

We tried to adapt this notion to our context and found that it extends well for positive brave and IAR-answers and seems also to be useful for negative IAR-answers, but that we lost the natural intuition for positive and negative AR-answers. The notion of responsibility is based on contingency sets which are in the consistent case sets of assertions whose removal makes ↵ critical. For the inconsistency-tolerant semantics we consider, we define contingency sets so that the responsibility fulfills the same main property as the responsibility defined for the consistent case. The following definitions and propositions hold for a KB expressed in any DL. We say that a subset B of the ABox contradicts a cause C if there exists a consistent subset B 0 ✓ B such that C [ B 0 is inconsistent. Definition 4.4.1 (Contingency set). A contingency set for an assertion ↵ w.r.t. hT , Ai |= S q is a set of assertions of A such that:

• For S=IAR:

-hT , R \ \ i |= q where R \ = T R2Rep(T ,A) R -hT , (R \ \ )\{↵}i 6 |= q • For S=brave: -9R 2 Rep(T , A), hT , R\ i |= q -8R 2 Rep(T , A), hT , (R\ )\{↵}i 6 |= q • For S=AR: -8R 2 Rep(T , A), hT , R\ i |= q -9R 2 Rep(T , A), hT , (R\ )\{↵}i 6 |= q
A contingency set for an assertion ↵ w.r.t. hT , Ai 6 |= S q is a set of assertions of A such that:

• For S=IAR:

-A\ contradicts every C 2 causes(q, hT , Ai) -(A\ )\{↵} does not contradict every C 2 causes(q, hT , Ai)

• For S=AR:

-9R 2 Rep(T , A), R\ contradicts every C 2 causes(q, hT , Ai) -8R 2 Rep(T , A), (R\ )\{↵} does not contradict every C 2 causes(q, hT , Ai) Definition 4.4.2 (Responsibility). The responsibility of ↵ for hT , Ai |= S q (resp. hT , Ai 6 |= S' q) is:

⇢(↵) = 1 1+min | |
, where ranges over all contingency sets for ↵ w.r.t. hT , Ai |= S q (resp. hT , Ai 6 |= S' q). If there does not exist any contingency set for ↵, ⇢(↵) = 0 . Proposition 4.4.3. Let ⇢(↵) be the responsibility of ↵ for hT , Ai |= S q (resp. hT , Ai 6 |= S' q):

• ⇢(↵) 6 = 0 if and only if ↵ is relevant for explaining hT , Ai |= S q (resp. hT , Ai 6 |= S' q), • ⇢(↵) = 1 if and only if ↵ is necessary for explaining hT , Ai |= S q (resp. hT , Ai 6 |= S' q).

Proof.

Positive IAR-answer -Relevance: If ↵ is relevant, there exists a cause C 0 in R \ such that ↵ 2 C 0 . Then = S C2causes(q,K) C\C 0 is a contingency set. In the other direction, if ⇢(↵) 6 = 0, there exists a contingency set such that every cause in R \ \ contains ↵ and there exist causes in R \ \ , so there exists a cause which contains ↵ in R \ .

-Necessity: ↵ is necessary if and only if ↵ belongs to every cause for q in R \ , so if and only if the empty set is a contingency set for ↵, i.e. ⇢(↵) = 1.

Positive brave-answer -Relevance: If ↵ is relevant, there exists a cause C 0 which contains ↵. Then = S C2causes(q,K) C\C 0 is a contingency set. In the other direction, if ⇢(↵) 6 = 0, there exists a contingency set such that there exists repair R 0 such that every cause in R 0 \ contains ↵ and there exists such a cause. It follows that ↵ is relevant.

Discussion about the notion of responsibility

-Necessity: ↵ is necessary if and only if ↵ belongs to every cause for q, so if and only if the empty set is a contingency set for ↵, i.e. ⇢(↵) = 1.

Positive AR-answer -Relevance: If ↵ is relevant, then there exists a minimal disjunction of causes C 0 , ..., C n such that every repair contains at least one of these causes and ↵ 2 C 0 . Since the disjunction is minimal, there exists a repair R 0 such that C 0 ✓ R 0 and C i 6 ✓ R 0 for all i 6 = 0. Let = S C2causes(q,K) C\ S n i=0 C i . Since C i 6 ✓ R 0 for all i 6 = 0, hT , R 0 \ \{↵}i 6 |= q, and since every repair contains at least one C i , which is disjoint with by construction, hT , R\ i |= q for every R 2 Rep(T , A). It follows that is a contingency set for ↵, so ⇢(↵) 6 = 0.

In the other direction, if ⇢(↵) 6 = 0, there exists a contingency set such that hT , R\ i |= q for every R 2 Rep(T , A) and there exists R 0 2 Rep(T , A) such that hT , R 0 \ \{↵}i 6 |= q.

Every R\ contains at least one cause of q, so it is possible to construct a minimal disjunction of causes with these causes. Since hT , R 0 \ \{↵}i 6 |= q, every cause in R 0 \ contains ↵, so ↵ appears in the disjunction. This disjunction of causes is such that every repair contains at least one of the causes, and it is minimal (otherwise, the minimal sub-disjunction covers also the R\ ). Hence ↵ is relevant.

-Necessity: If ↵ is necessary, then there exists a repair R such that every cause included in R contains ↵ (cf. proof of Proposition 4.2.5). It follows that hT , R\{↵}i 6 |= q, so the empty set is a contingency set for ↵ and ⇢(↵) = 1. In the other direction, if ⇢(↵) = 1, then there exists a repair R such that hT , R\{↵}i 6 |= q, so every cause for q in R contains ↵, and every explanation for hT , Ai |= AR q contains ↵.

Negative IAR-answer -Relevance: If ↵ is relevant, there exists a minimal subset B such that ↵ 2 B and B contradicts every cause. Then = A\B is a contingency set by construction of B since A\ = B. In the other direction, if there exists as required, B = A\ contradicts every cause, and B\{↵} does not contradict every cause, so ↵ 2 B. It follows that ↵ is relevant.

-Necessity: It is clear that ↵ is necessary if and only if A contradicts every cause (q is not entailed under IAR semantics), and A\↵ does not contradict at least one cause (every set that contradicts every cause contains ↵).

Negative AR-answer -Relevance: If ↵ is relevant, there exists a minimal consistent subset B such that ↵ 2 B and B conflicts every cause of q. Since B is consistent, there exists R 0 2 Rep(T , A) such that B ✓ R 0 . Let = A\B. Then R 0 \ = B contradicts every cause for q, and for every repair R, R\ \{↵} ✓ B\{↵} does not contradict every cause for q since B is minimal.

In the other direction, suppose that there exists a set as required. Then there exists R 0 2 Rep(T , A), such that R 0 \ contradicts every cause. Since R 0 is consistent, a negative explanation is obtained by selecting a minimal subset of R 0 \ which contradicts every cause. Since R 0 \ \{↵} does not contradict every cause, this negative explanation contains ↵.

-Necessity: Suppose that ↵ is necessary. Since ↵ belongs to every consistent subset which contradicts the causes of q, for every repair R, R\{↵} does not contradict every cause. Since q is not entailed under AR semantics, there exists R 0 such that R 0 contradicts every cause. It follows that the empty set is a contingency set.

In the other direction, suppose that ⇢(↵) = 1 and suppose for a contradiction that there exists a consistent subset B which contradicts every cause and does not contain ↵. There exists a repair R 0 such that B ✓ R 0 , and R 0 \{↵} does not contradict the causes for q since the empty set is a contingency set. It follows that B ✓ R 0 \{↵} does not contradict every cause.

The following proposition shows that for positive brave or IAR-answers and negative IAR-answers, the responsibility has exactly the same meaning as in the database setting: it corresponds to 1 1+k where k is the least number of assertions to delete to make ↵ critical in the (non) obtention of the answer under brave or IAR semantics. In particular, this means that for S 2 {IAR, brave}, ↵ is necessary for explaining hT , Ai |= S q if and only if hT , Ai |= S q and hT , A\{↵}i 6 |= S q, and that ↵ is necessary for explaining hT , Ai 6 |= IAR q if and only if hT , Ai 6 |= IAR q and hT , A\{↵}i |= IAR q. Proposition 4.4.4. If is a contingency set for ↵ w.r.t. hT , Ai |= S q for S 2 {IAR, brave}:

• hT , A\ i |= S q • hT , (A\ )\{↵}i 6 |= S q
If is a minimal contingency set for ↵ w.r.t. hT , Ai 6 |= IAR q:

• hT , A\ i 6 |= IAR q • hT , (A\ )\{↵}i |= IAR q Proof. For positive IAR-answers, by definition of a contingency set hT , R \ \ i |= q where R \ = T R2Rep(T ,A) R, so there is a cause for q in R \ \ ✓ T R2Rep(T ,A\ ) R (every assertion in R \ is free of conflicts in A, so also in A\ ). Thus hT , A\ i |= IAR q. Moreover, hT , (R \ \ )\{↵}i 6 |= q, so there is no cause for q in (R \ \ )\{↵}. It follows that ↵ belongs to every cause for q in R \ \ . In particular, this means that ↵ has no conflict, so removing ↵ does not make any assertion of A conflict free, and every cause for q in T R2Rep(T ,(A\ )\{↵}) R was in R \ \ . It follows that T R2Rep(T ,(A\ )\{↵}) R contains no cause for q. For positive brave-answers, since there exists R 2 Rep(T , A) such that hT , R\ i |= q, there is a cause for q in R\ so in A\ and hT , A\ i |= brave q. Moreover, since for every R 2 Rep(T , A), hT , (R\ )\{↵}i 6 |= q, [ {↵} intersects every cause for q in A, so hT , (A\ )\{↵}i 6 |= brave q.

For negative IAR-answers, a minimal contingency set is such that A\ contradicts every cause for q, so hT , A\ i 6 |= IAR q. Moreover, since is a minimal contingency set, there exists a cause C 0 such that confl(C 0 , K) = [ {↵} (indeed, (A\ )\{↵} does not contradict every cause for q, so there exists a cause C such that confl(C, K) ✓ [ {↵}, and by minimality of , [ {↵} corresponds exactly to the conflicts of one such cause). Since C 0 is consistent, C 0 \ ( [ {↵}) = ;, so (A\ )\{↵} contains C 0 and none of its conflicts, and hT , (A\ )\{↵}i |= IAR q.

The following examples illustrate how responsibility can help to understand a (positive brave or IAR or negative IAR) answer by ordering the relevant assertions.

Explaining inconsistency-tolerant query answering

how ranking the relevant assertions by responsibility helps to understand a surprising answer, or to find problematic assertions in case of erroneous brave-answer.

If we now consider IAR semantics, there are 5 explanations for hT , Ai |= IAR q (the 5 first causes, so this time Postdoc(dan), Teach(dan, c d ), GradCourse(c d ) are not relevant). The responsibility is as follows:

• ⇢ = 0.5 Postdoc(ann)

• ⇢ = 0.5 GradCourse(c bc ) • ⇢ = 0.33 Postdoc(bob) • ⇢ = 0.33 Teach(bob, c bc ) • ⇢ = 0.33 Postdoc(carl) • ⇢ = 0.33 Teach(carl, c bc ) • ⇢ = 0.25 Teach(ann, c a1 ) • ⇢ = 0.25 GradCourse(c a1 ) • ⇢ = 0.25 Teach(ann, c a2 ) • ⇢ = 0.25 GradCourse(c a2 ) • ⇢ = 0.25 Teach(ann, c a3 ) • ⇢ = 0.25 GradCourse(c a3 )
Here again, by ranking assertions using their responsibility, we get first the assertions that play a more important role in deriving the answer under IAR semantics. / Example 4.4.6. Regarding negative IAR-answers, consider the following KB and query:

T ={AProf v Prof, FProf v Prof, 9Advise v Prof, Prof v PhD, Postdoc v PhD, 9Teach v Course, AProf v ¬FProf, Prof v ¬Postdoc, 9Advise v ¬Course} A ={AProf(ann), FProf(ann), Advise(ann, c), Course(c), Teach(ann, c), Postdoc(ann)} q =PhD(ann)
The causes of q are {AProf(ann)}, {FProf(ann)}, {Advise(ann, c)}, and {Postdoc(ann)}.

There are four explanations for hT , Ai 6 |= IAR q: Postdoc(ann) ^Advise(ann, c), Postdoc(ann) ^AProf(ann), Postdoc(ann) ^FProf(ann), Course(c) ^AProf(ann) FProf(ann) and Teach(ann, c) ^AProf(ann) ^FProf(ann).

• ⇢ = 0.50 AProf(ann) • ⇢ = 0.50 FProf(ann) • ⇢ = 0.50 Postdoc(ann)

• ⇢ = 0.33 Advise(ann, c) • ⇢ = 0.33 Course(c) • ⇢ = 0.33 Teach(ann, c)
Ordering the assertions w.r.t. their responsibility allows us to get first the assertions that contradict causes that have fewer conflicts (AProf(ann) and FProf(ann)), then those who conflict the causes which have more conflicts (Postdoc(ann) and Advise(ann, c)). If the query should be entailed under IAR semantics, we can think that the former causes have a higher probability of being correct, and so their conflicts of being erroneous. /

For positive or negative AR-answers, the responsibility is not related to the minimal number of changes to make ↵ critical in the (non) obtention of the answer under AR semantics. Indeed, it is related to the minimal number of changes to make ↵ critical in the (non) obtention of the answer in one repair, but deleting assertions changes the repairs of the knowledge base. For instance if Prof(a) holds under AR semantics with only one explanation 4.4 Discussion about the notion of responsibility AProf(a) _ FProf(a), both assertions are necessary to explain that Prof(a) holds under AR semantics, so have a responsibility of 1, but deleting one of the two necessary assertions will make Prof(a) be entailed under IAR semantics. This shows that it is not possible to define a notion that is related to the minimal number of changes to make an assertion critical in the obtention of an answer under AR semantics and which is not null just in the case that ↵ is relevant to explain the answer and equal to one just in the case that ↵ is necessary. The following example illustrates the same phenomenon for negative AR-answers.

Example 4.4.7. In this example, we consider a KB defined by a set of assertions B and conflicts E between them. It is always possible to find a KB which corresponds to such a specification by defining a set of individuals

N I = {a}, a set of concepts N C = {C | C 2 B}, the ABox A = {C(a) | C 2 N C }, and the TBox T = {C 1 v ¬C 2 | {C 1 , C 2 } 2 E}.
We can also assume that a query q has for causes some sets of assertions C 1 , ..., C k by defining q = A 1 (a) ^... ^An (a) where n is the maximal size of the C i , and adding for every

C i = {C 1 (a), ..., C m i (a)} the inclusions C 1 v A 1 , ..., C m i v A m i , ..., C m i v
A n to the TBox. Let A = {↵, , , , ✏} and T be such that hA, T i has the following conflicts: {↵, ✏}, { , }, { , }, { , ✏}. Suppose that a query q has two causes: C 0 = {↵, }, C 1 = {✏}. Then q is not entailed under AR semantics and there is only one explanation for hA, T i 6 |= AR q: {↵, }. If we remove the necessary assertion ↵, since the remaining cause C 1 can be contradicted by , q is still not entailed under AR semantics. Therefore, even if ⇢(↵) = 1, ↵ is not critical in the obtention of q. By contrast, is critical since the only way of contradicting C 0 in A\{ } is ✏, so no consistent subset contradicts both C 0 and C 1 . /

QUERY-DRIVEN REPAIRING

In this chapter, we address the problem of query-driven repairing of inconsistent DL-Lite R knowledge bases: query answers are computed under inconsistency-tolerant semantics, and the user provides feedback about which answers are erroneous, or missing under a stronger semantics. The aim is to find a set of ABox modifications (deletions and additions), called a repair plan, that addresses as many of the defects as possible. After formalizing this problem and introducing different notions of optimality, we investigate the computational complexity of reasoning about optimal repair plans and propose interactive algorithms for computing such plans. For deletion-only repair plans, we propose an improved algorithm and present the implementation of its core components in our CQAPri system. While we first focus on IAR and brave semantics, since the erroneous answers should ideally not hold under brave semantics whereas the desired answers should hold under IAR semantics, we investigate the use of the AR semantics in the fourth section. Indeed, the AR semantics is a natural alternative to IAR. We will see that even if considering the AR semantics changes the complexity of recognizing an optimal repair plan, we do not have to modify our algorithms to handle it. The main results of this chapter have been published in [Bienvenu et al. 2016b].

Query-driven repairing problem

While inconsistency-tolerant semantics are essential for returning useful results when consistency cannot be achieved, they by no means replace the need for tools for improving data quality. That is why we propose a complementary approach that exploits user feedback about query results to identify and correct errors.

There are several reasons to use queries to guide the repairing process. First, we note that it is typically impossible (for lack of time or information) to clean the entire dataset, and therefore reasonable to focus the effort on the parts of the data that are most relevant to users' needs. In the database arena, this observation has inspired work on integrating entity resolution into the querying process [START_REF] Altwaijry | [END_REF]. Second, expert users may have a good idea of which answers are expected for queries concerning their area of expertise, and thus queries provide a natural way of identifying flaws. Indeed, it was recently proposed in [Kontokostas et al. 2014] to use queries to search for errors and help evaluate Query-driven repairing linked data quality. Finally, even non-expert users may notice anomalies when examining query results, and it would be a shame not to capitalize on this information, and in this way, help distribute the costly and time-consuming task of improving data quality, as argued in [START_REF] Bergman | [END_REF].

We consider the following scenario: a user interacts with an OMQA system, posing conjunctive queries and receiving the results under inconsistency-tolerant semantics. When reviewing the results, the user detects some unwanted answers, which are erroneous and should therefore not have been retrieved, and identifies wanted answers, which should definitely be considered answers. Ideally, the unwanted tuples should not be returned as possible (brave) answers, and all of the desired tuples should be found among the sure (IAR) answers. To fix the detected problems and improve the quality of the data, the objective is to modify the ABox with a set of atomic changes (deletions and additions of facts), called a repair plan, that achieves as many of these objectives as possible, subject to the constraint that the changes must be validated by the user.

Our framework is inspired by that of [START_REF] Jiménez-Ruiz | [END_REF], in which a user specifies two sets of axioms that should be entailed or not by a KB. Repair plans are introduced as pairs of sets of axioms to remove and add to obtain an ontology satisfying these requirements. Compared to prior work, distinguishing features of our framework are the specification of changes at the level of CQ answers, the use of inconsistency-tolerant semantics, and the introduction of optimality measures to handle situations in which not all objectives can be achieved.

Example 5.1.1. As a running example, we consider the simple KB K ex = hT ex , A ex i.

T ex ={AProf v Prof, FProf v Prof, 9Advise v Prof, Prof v PhD, Postdoc v PhD, AProf v ¬FProf, Postdoc v ¬Prof} A ex ={Postdoc(a), AProf(a), Advise(a, b), Teach(a, c)}
A user poses the queries Prof(x) and PhD(x) over K ex . Since K ex |= brave Prof(a) and K ex |= AR PhD(a), he receives a as an answer for both queries. Suppose that the user knows that a is definitely a PhD holder, but is not a professor. He would therefore like PhD(a) to hold under IAR semantics rather than AR which is less strong, and Prof(a) not to hold under any semantics, since any cause for this query has something wrong. He then indicates a as an unwanted answer for Prof(x) but a wanted answer for PhD(x). /

A first way of repairing the data is to delete assertions from the ABox that lead to undesirable consequences, either because they contribute to the derivation of an unwanted answer or because they conflict with causes of some wanted answer. /

The next example shows that, due to data incompleteness, it can also be necessary to add new assertions.

Query-driven repairing

Example 5.1.6 (Example 5.1.1 cont'd). Reconsider the problem from Example 5.1.5, and suppose that the user knows that FProf(b) and TakeCourse(s, c) are false and every other assertion in A is true. An automatic repairing will remove the true assertion Teach(b, c). The problem is due to the absence of a "good" cause for the wanted answer q 2 (a) in A.

/ Since we will be studying an interactive repairing process, in which users must validate changes, we will also need to formalize the user's knowledge. For the purposes of this work, we assume that the user's knowledge is consistent with the considered TBox T , and so can be captured as a set M user of models of T . Instead of using M user directly, it will be more convenient to work with the function user induced from M user that assigns truth values to BCQs in the obvious way: user(q) = true if q is true in every I 2 M user , user(q) = false if q is false in every I 2 M user , and user(q) = unknown otherwise. We will assume throughout the chapter the following truthfulness condition: user(q) = false for every q 2 U, and user(q) = true for every q 2 W.

We now formalize the requirement that repair plans only contain changes that are sanctioned by the user.

Definition 5.1.7. A repair plan (P , P + ) is validatable w.r.t. user1 just in the case that user(↵) = false for every ↵ 2 P and user(↵) = true for every ↵ 2 P + .

Unfortunately, it may be the case that there is no validatable repair plan addressing all defects. This may happen, for instance, if the user knows some answer is wrong but cannot pinpoint which assertion is at fault, as we illustrate next. As validatable repair plans addressing all defects are not guaranteed to exist, our aim will be to find repair plans that are optimal in the sense that they address as many of the defects as possible, subject to the constraint that the changes must be validated by the user.

Optimal repair plans

To compare repair plans, we consider the answers from U and W that are satisfied by the resulting KBs, where:

Optimal repair plans

• q 2 U is satisfied by K if K 6 |= brave q; • q 2 W is satisfied by K if there exists C 2 causes(q, K) such that confl(C, K) = ; and there is no ↵ 2 C with user(↵) = false.

Remark 5.2.1. Observe that for q 2 W to be satisfied by K, we require not only that K |= IAR q, but also that there exists a cause for q that does not contain any assertions known to be false, i.e. K |= IAR q should hold "for a good reason". We impose this additional requirement to avoid counterintuitive situations, e.g. preferring repair plans that remove fewer false assertions in order to retain a conflict-free (but erroneous) cause for a wanted answer.

We say that a repair plan P = (P , P + ) satisfies q 2 U [ W if the KB K P = hT , (A\P ) [ P + i satisfies q, and we use S(P) (resp. S U (P), S W (P)) to denote the sets of answers (resp. unwanted answers, wanted answers) satisfied by P.

Two repair plans P and P 0 can be compared w.r.t. the sets of unwanted and wanted answers that they satisfy: for A 2 {U , W}, we define the preorder A by setting P A P 0 iff S A (P) ✓ S A (P 0 ), and obtain the corresponding strict order ( A ) and equivalence relations (⇠ A ) in the usual way. If the two criteria are equally important, we can combine them using the Pareto principle: P {U,W} P 0 iff P U P 0 and P W P 0 .

Alternatively, we can use the lexicographic method to give priority either to the wanted answers ( W,U ) or unwanted answers ( U,W ): P A,B P 0 iff P A P 0 or P ⇠ A P 0 and P B P 0 , where {A, B} = {U , W}.

For each of the preceding preference relations , we can define the corresponding notions of -optimal repair plan. Definition 5.2.2 (Optimal repair plan). A repair plan (P , P + ) is globally (resp. locally) -optimal w.r.t. user iff it is validatable w.r.t. user and there is no other validatable repair plan (P 0 , P 0 + ) such that (P , P + ) (P 0 , P 0 + ) (resp. such that P ✓ P 0 , P + ✓ P 0 + and (P , P + ) (P 0 , P 0 + )).

Globally -optimal repair plans are those that are maximal with respect to the preference relation , whereas locally -optimal repair plans are those that cannot be improved in the ordering by adding further assertions to P or P + .

Remark 5.2.3. If a repair plan is validatable and addresses all defects of a QRP, then it is globally U -optimal. If it additionally satisfies every q 2 W (ensuring that there is a "good" cause for every q 2 W), then it is globally -optimal for every 2 { W , {U,W} , U,W , W,U }.

The following example illustrates the difference between local and global optimality. It can be verified that the repair plan P 1 = ({Teach(a, e), GradCourse(e)}, {Teach(a, c)}) satisfies the first answer in W and the (only) answer in U . It is locally {U,W} -optimal since the only way to satisfy the second wanted answer would be to add GradCourse(c), which would create a cause for the unwanted answer, which could not be repaired by removing additional assertions as the user does not know which of Advise(a, b) and TakeCourse(b, c) is false. However, P 1 is not globally {U,W} -optimal because P 2 = ({Teach(a, e), GradCourse(e)}, {Teach(a, d), GradCourse(c)}) satisfies all answers in W [ U. /

Characterization and complexity analysis

In order to gain a better understanding of the computational properties of the different ways of ranking repair plans, we study the complexity of deciding if a given repair plan is optimal w.r.t. the different criteria. Since validatability of a repair plan depends on user, in this section, we will use the following notations for the sets of false, unknown, and true ABox assertions w.r.t. user:

F alse user = {↵ 2 A | user(↵) = false} Unk user = {↵ 2 A | user(↵) = unknown} T rue user = {↵ | user(↵) = true}
Checking if an assertion is false (resp. unknown, true) is in P w.r.t. the size of F alse user (resp. Unk user , T rue user ). The sets F alse user and Unk user are included in A, while T rue user may be larger. However, only the assertions of T rue user that are relevant to the given QRP need to be considered. We make similar assumptions as for data complexity and thus assume that the sizes of the queries and the TBox are bounded. We thus measure complexity w.r.t. |A|, |U|, |W|, as well as the size of the set T rue rel user ={↵ 2 T rue user | there exists q 2 W such that ↵ 2 C for some C 2 causes(q, A [ T rue user )} We make the reasonable assumption that T rue user (hence T rue rel user ) is finite. We begin with the following lemma which shows that removing false assertions or adding true assertions (whose conflicts are false) can only satisfy more wanted answers, and Query-driven repairing -In the other direction, it follows from the definition of satisfiable answers that if a validatable repair plan satisfies every satisfiable q 2 U (resp. q 2 W), it is globally (so also locally) U -(resp. W -) optimal.

• A validatable repair plan is locally U,W -optimal iff it is locally {U,W} -optimal: -If a repair plan (P , P + ) is locally U,W -optimal, it is locally {U,W} -optimal, otherwise there would be a validatable repair plan (P 0 , P 0 + ) such that P ✓ P 0 , P + ✓ P 0 + and (P , P + ) {U,W} (P 0 , P 0 + ), so also such that (P , P + ) U,W (P 0 , P 0 + ). -Suppose for a contradiction that a repair plan (P , P + ) is locally {U,W} -optimal and not locally U,W -optimal. Then there exists a validatable repair plan (P 0 , P 0 + ) such that P ✓ P 0 , P + ✓ P 0 + and (P , P + ) U,W (P 0 , P 0 + ). Since removing more false assertions cannot deteriorate satisfied wanted answers (see Lemma 5.2.5), (P 0 , P 0 + ) cannot satisfy more unwanted answers otherwise we would have (P , P + ) {U,W} (P [ P 0 , P + ). Hence (P 0 , P 0 + ) must satisfy the same unwanted answers and more wanted answers, which yields (P , P + ) {U,W} (P 0 , P 0 + ), contradicting our assumption of local U,W -optimality. • A validatable repair plan P is locally {U,W} -( U,W -) optimal iff it satisfies every q 2 U [ W that is satisfiable w.r.t. P: -Suppose that (P , P + ) is locally {U,W} -optimal, and let q 2 U [ W be an answer that is satisfiable w.r.t. (P , P + ). Then there exists a validatable repair plan (P 0 , P 0 + ) such that P ✓ P 0 , P + ✓ P 0 + and (P , P + ) {U,W} (P 0 , P 0 + ) and q 2 S(P 0 , P 0 + ). Since (P , P + ) is locally {U,W} -optimal, we must have (P , P + ) ⇠ {U,W} (P 0 , P 0 + ), and hence q 2 S(P , P + ). -In the other direction, suppose that (P , P + ) is a validatable repair plan that satisfies every q 2 U [W that is satisfiable w.r.t. (P , P + ). Consider a validatable repair plan (P 0 , P 0 + ) such that P ✓ P 0 , P + ✓ P 0 + and (P , P + ) {U,W} (P 0 , P 0 + ), and take some q 2 S(P 0 , P 0 + ). Then q is satisfiable w.r.t. (P , P + ), so, by our assumption, it must be satisfied by (P , P + ). We thus have (P , P + ) ⇠ {U,W} (P 0 , P 0 + ), so (P , P + ) is locally {U,W} -optimal. • A validatable repair plan P is locally W,U -optimal iff it satisfies every satisfiable q 2 W and every q 2 U that is satisfiable w.r.t. P: -Suppose that (P , P + ) is locally W,U -optimal. First consider some satisfiable q 2 W. Then there exists a validatable repair plan (P 0 , P 0 + ) such that q 2 S(P 0 , P 0 + ). By Lemma 5.2.5, we have (P , P + ) W (P [ P 0 , P + [ P 0 + ). Applying our assumption of local W,Uoptimality, we have (P , P + ) ⇠ W (P [ P 0 , P + [ P 0 + ), which implies that q is satisfied by (P , P + ) .

Next take some q 2 U that is satisfiable w.r.t. (P , P + ). Then there exists a validatable repair plan (P 0 , P 0 + ) such that P ✓ P 0 , P + ✓ P 0 + , (P , P + ) {U,W} (P 0 , P 0 + ) and q 2 S(P 0 , P 0 + ). Since (P , P + ) is locally W,U -optimal, we must have (P , P + ) ⇠ W (P 0 , P 0 + ) and (P , P + ) ⇠ U (P 0 , P 0 + ). From the latter, we obtain q 2 S(P , P + ). -In the other direction, let (P , P + ) be a validatable repair plan that satisfies every satisfiable q 2 W and every q 2 U that is satisfiable w.r.t. (P , P + ). Take some validatable repair plan (P 0 , P 0 + ) such that P ✓ P 0 , P + ✓ P 0 + and (P , P + ) W,U (P 0 , P 0 + ). We observe that (P 0 , P 0 + ) cannot satisfy more wanted answers than (P , P + ) since (P , P + ) satisfies all satisfiable wanted answers, nor can it satisfy more unwanted answers, since otherwise (P , P + ) would not satisfy all unwanted answers that are satisfiable w.r.t. (P , P + ).

In the other direction, if q and C 0 satisfy the conditions of the lemma statement, then one can easily verify that

({ 2 A | 9↵ 2 C 0 , hT , {↵, }i |= ?, user( ) = false}, {↵ 2 C 0 \ A | user(↵) = true})
is a validatable repair plan that satisfies q.

Lemma 5.2.11. Let (P , P + ) be a validatable repair plan for the KB hT , Ai. Then an answer q 2 U is satisfiable w.r.t. (P , P + ) iff q 2 U is satisfiable for the KB hT , A [ P + i.

Proof. If q 2 U is satisfiable w.r.t. (P , P + ), then there exists a validatable repair plan (P 0 , P 0 + ) with P ✓ P 0 and P + ✓ P 0 + that satisfies q. By Lemma 5.2.8, P 0 must intersect all of the causes of q w.r.t. hT , A [ P 0 + i. Since P + ✓ P 0 + , the set P 0 intersects all of q 0 s causes w.r.t. hT , A [ P + i. By applying Lemma 5.2.8 again, we can show that the repair plan (P 0 , ;) witnesses the satisfiability of q for the KB hT , A [ P + i.

In the other direction, suppose that q 2 U is satisfiable when hT , A [ P + i is the input KB. By Lemma 5.2.9, we know that for every C 2 causes(q, hT , A [ P + i) there exists ↵ 2 C such that user(↵) = false. Now consider the repair plan (P 0 , P + ) where P 0 contains the following assertions

P [ {↵ | 9C 2 causes(q, hT , Ai), ↵ 2 C, user(↵) = false}.
By construction, q is satisfied by the KB hT , (A \ P 0 ) [ P + i induced by (P 0 , P + ). Since (P , P + ) is known to be validatable, and P 0 \ P ✓ F alse user , it follows that (P 0 , P + ) is also validatable. It follows from Lemma 5.2.5 that S W (P , P + ) ✓ S W (P 0 , P + ) and S U (P , P + ) ✓ S U (P 0 , P + ). We have thus found a validatable repair plan that extends (P , P + ) and whose corresponding KB satisfies q and all answers that were already satisfied by (P , P + ). We can therefore conclude that q 2 U is satisfiable w.r.t. (P , P + ).

Lemma 5.2.12. Let (P , P + ) be a validatable repair plan for the KB hT , Ai. Then an answer q 2 W is satisfiable w.r.t. (P , P + ) iff q is satisfiable for the KB hT , Ai with a witness C 0 such that every q 0 2 S U (P , P + ) is satisfiable for the KB hT , A [ P + [ C 0 i.

Proof. If q 2 W is satisfiable w.r.t. (P , P + ), then there exists a validatable repair plan (P 0 , P 0 + ) such that P ✓ P 0 and P + ✓ P 0 + which satisfies q and all answers in S(P , P + ). As q is satisfied by (P 0 , P 0 + ), the ABox (A\P 0 ) [ P 0 + contains a cause C 0 for q that has no conflict and that does not contain any false assertion. This means that q is satisfiable for hT , Ai. Now take some q 0 2 S U (P , P + ). Since S U (P , P + ) ✓ S U (P 0 , P 0 + ), we have q 0 2 S U (P 0 , P 0 + ), and so by Lemma 5.2.8, we have P 0 \ C 6 = ; for every C 2 causes(q 0 , hT , A [ P 0 + i). We observe that P 0 ✓ F alse user and A [ P + [ C 0 ✓ A [ P 0 + . It follows that for every C 2 causes(q 0 , hT , A [ P + [ C 0 i), there exists ↵ 2 C with user(↵) = false. By Lemma 5.2.9, we can conclude that q 0 is satisfiable for the KB hT , A [ P + [ C 0 i.

In the other direction, suppose that q 2 W is satisfiable for the KB hT , Ai with a witness C 0 such that every q 0 2 S U (P , P + ) is satisfiable for the KB hT , A [ P + [ C 0 i. Consider the 108 5.2 Optimal repair plans repair plan (P 0 , P 0 + ) where

P 0 = P [ { 2 A | 9↵ 2 C 0 , hT , {↵, }i |= ?, user( ) = false} [ {↵ | user(↵) = false
and there exists some q 0 2 U and C 2 causes(q 0 , hT ,

A [ P + [ C 0 i) such that ↵ 2 C} P 0 + = P + [ {↵ 2 C 0 \ A | user(↵) = true}
By construction, (P 0 , P 0 + ) is validatable and satisfies q. We have S W (P , P + ) ✓ S W (P 0 , P 0 + ) by Lemma 5.2.5. To see why S U (P , P + ) ✓ S U (P 0 , P 0 + ), take some answer q 0 2 S U (P , P + ). By our earlier assumption, we know that q 0 is satisfiable for the KB hT , A [ P + [ C 0 i, so by Lemma 5.2.9, every C 2 causes(q 0 , hT , A [ P + [ C 0 i) contains an assertion ↵ 2 C such that user(↵) = false, which will thus be included in P 0 . Since every cause for q 0 in hT , A [ P + [ C 0 i has a non-empty intersection with P 0 , we can apply Lemma 5.2.8 to conclude that q 0 is satisfied by (P 0 , P 0 + ).

It follows from the preceding characterizations that deciding the satisfaction, satisfiability, or satisfiability w.r.t. a repair plan of an answer is tractable.

Proposition 5.2.13. Deciding if an answer is satisfied, satisfiable, or satisfiable w.r.t. a repair plan is in P.

Proof.

• Deciding if a wanted (resp. unwanted) answer is satisfied amounts to deciding if it is entailed under IAR semantics with a nonfalse explanation (resp. not entailed under brave semantics), so is in P w.r.t. |A|.

• Since computing the causes of a query q is in P w.r.t. |A|, and the number of causes is polynomial w.r.t. |A|, the characterization of Lemma 5.2.9 shows that deciding if an unwanted answer is satisfiable is in P w.r.t. |A|.

• Deciding if a wanted answer q is satisfiable using the characterization of Lemma 5.2.10 can be done by computing the causes of q and their conflicts in hT , A [ T rue rel user i in P w.r.t. |A| and |T rue rel user | and verifying in P that at least one of the causes fulfils the required conditions. • By Lemma 5.2.11, checking whether q 2 U is satisfiable w.r.t. (P , P + ) reduces to checking whether q 2 U is satisfiable for the KB hT , A [ P + i. We know from earlier that the latter check can be done in P w.r.t. the size of the ABox. Since P + ✓ T rue rel user , this condition can be verified in P w.r.t. |A| and |T rue rel user |. • To check whether an answer q 2 W is satisfiable w.r.t. (P , P + ), it suffices to check whether q satisfies the conditions of Lemma 5.2.12. These can be verified by: (i) computing the causes of q and their conflicts in hT , A [ T rue rel user i, and (ii) for each candidate cause C 0 that fulfils the conditions of Lemma 5.2.10, and every unwanted answer q 0 2 U , check that if q 0 is satisfied by (P , P + ), then it is satisfiable for the KB hT , A [ P + [ C 0 i. Everything can be done in P w.r.t. |A|, |T rue rel user |, and |U| with the same arguments as previous cases. We are now ready to establish the complexity of deciding the optimality of a repair plan. For the lower bounds, we will use the coNP-hard problems presented in the two following lemmas.

Query-driven repairing

Lemma 5.2.14. NP-hardness of SAT holds if we impose that at least one variable appears in positive and negative form in the formula.

Proof. Reduction from SAT. Let {C 1 , ..., C m } be a set of clauses. C 1 ^... ^Cm is satisfiable iff C 1 ^... ^Cm ^(z _ ¬z) is satisfiable, where z is a fresh variable.

Lemma 5.2.15. The following problem is NP-hard: given a set {C 1 , ..., C m , C m+1 } of clauses such that {C 1 , ..., C m } is satisfiable and C m+1 is not a tautology: decide whether {C 1 , ..., C m , C m+1 } is satisfiable.

Proof. Reduction from SAT. Let {C 1 , ..., C m } be a set of clauses. Then C 1 ^... ^Cm is satisfiable iff (C 1 _¬z) ^... ^(C m _¬z) ^z is satisfiable, where z is a fresh variable. Clearly, (C 1 _ ¬z) ^... ^(C m _ ¬z) is satisfiable and z is not a tautology.

Theorem 5.2.16. Deciding if a repair plan is globally -optimal is coNP-complete for 2 { {U,W} , U,W , W,U }, and in P for 2 { W , U }. Deciding if a repair plan is locally -optimal is in P for 2 { U , W , {U,W} , U,W , W,U }.

Upper bounds. The tractability results follow from the characterizations of optimality given in Proposition 5.2.7 together with the complexity results of Proposition 5.2.13.

For the coNP upper bounds, we note that to show that P is not -optimal (for 2 { {U,W} , U,W , W,U }), we can guess another repair plan P 0 and verify in P that both plans are validatable and that P 0 satisfies more answers than P.

The lower bounds are as follows:

Lower bound for global U,W -and {U,W} -optimality. Let be a CNF formula of the form = V m+1 i=1 C i over the variables x 1 , ..., x n such that V m i=1 C i is satisfiable and C m+1 is not a tautology (cf. Lemma 5.2.15). Consider the QRP defined as follows

T ={P v S, N v S} A ={A(x j ), B(x j )|1  j  n} [ {P (b, x j ), N(b, x j ) | 1  j  n} W ={9xS(c 1 , x), ..., 9xS(c m+1 , x)} U ={9xyzP (y, x) ^N (z, x) ^A(x) ^B(x)} where T rue rel user ={P (c i , x j )|x j 2 C i } [ {N (c i , x j )|¬x j 2 C i } F alse user ={P (b, x j ), N(b, x j ) | 1  j  n} Unk user =A\F alse user
Let ⌫ be a valuation of the x j that satisfies

V m i=1 C i .
We show that deciding if the repair (P , P + ) with

P =F alse user P + ={P (c i , x j ) | x j 2 C i , ⌫(x j ) = true, 1  i  m}[ {N (c i , x j ) | ¬x j 2 C i , ⌫(x j ) = false, 1  i  m}
= {C 1 = x 1 _ ¬x 2 , C 2 = ¬x 1 _ x 2 _ ¬x 3 } [ {C 3 = x 2 _ x 3 }. A T rue rel user b x 1 x 2 x 3 A, B A, B A, B c 1 c 2 c 3 H H H H H H H H Y ⇡ ⇡ H H H H H H H H Y - * H H H H H H H H j - * H H H
{C 1 = x 1 _ ¬x 2 , C 2 = ¬x 1 _ x 2 _ ¬x 3 }. A T rue rel user b x 1 x 2 x 3 A, B A, B A, B c 1 c 2 Q Q Q Q Q Q Q Q k X X X X X X X X y X X X X X X X X y ⇠ ⇠ ⇠ ⇠ ⇠ ⇠ ⇠ ⇠ 9 ⇠ ⇠ ⇠ ⇠ ⇠ ⇠ ⇠ ⇠ 9 - * H H H H H H H H j - * H H H H H H H H j P N N P N P N
Query-driven repairing is not globally U,W -optimal iff is satisfiable.

First observe that (P , P + ) is validatable and satisfies the single unwanted answer. Moreover, as ⌫ satisfies the clauses c 1 , . . . , c m , all of the wanted answers concerning the individuals c 1 , ..., c m are satisfied by (P , P + ).

If is satisfiable, let ⌫ 0 be a valuation of the x j that satisfies . It is readily verified that the repair plan (P 0 , P 0 + ) with

P 0 =F alse user P 0 + ={P (c i , x j ) | x j 2 C i , ⌫ 0 (x j ) = true, 1  i  m + 1}[ {N (c i , x j ) | ¬x j 2 C i , ⌫ 0 (x j ) = false, 1  i  m + 1}
is validatable and satisfies all unwanted and wanted answers, so (P , P + ) is not U,Wglobally optimal.

In the other direction, if (P , P + ) is not globally U,W -optimal, then there must exist a repair plan (P 0 , P 0 + ) that is validatable and satisfies all of the answers in U [ W. Then it can be straightforwardly verified that is satisfied by the valuation ⌫ 0 of the x j defined by ⌫ 0 (x j ) = true iff there exists c i such that P (c i , x j ) 2 P + . Indeed, every c i has an outgoing edge in (A\P 0 ) [ P 0 + , and no x j has both P -and N -incoming edges, since otherwise the unwanted answer would not be satisfied.

Lower bound for global W,U -optimality. The proof is by reduction from SAT when at least one variable appears both in positive and negative form in the formula. Take some CNF formula = V m i=1 C i over the variables x 1 , ..., x n that satisfies this requirement, and consider the QRP defined as follows:

T ={P v S, N v S} A ={A(x j ), B(x j )|1  j  n} [ {P (b, x j ), N(b, x j ) | 1  j  n} W ={9xS(c 1 , x), ..., 9xS(c m , x)} U ={9xyzP (y, x) ^N (z, x) ^A(x) ^B(x)}
where:

T rue rel user ={P (c i , x j )|x j 2 C i } [ {N (c i , x j )|¬x j 2 C i } F alse user ={P (b, x j ), N(b, x j ) | 1  j  n} Unk user =A\F alse user
It is easy to see that the repair plan (P , P + ) = (F alse user , T rue rel user ) is validatable and satisfies all wanted answers but does not satisfy the unwanted answer because at least one x j has both incoming N -and P -edges. In fact, we can show that (P , P + ) is not globally W,U -optimal (i.e., there is some validatable repair plan that satisfies all of U [ W) iff is satisfiable. Indeed, every validatable repair plan that satisfies all unwanted and wanted answers gives rise to a satisfying valuation for , and conversely, any such valuation induces 5.2 Optimal repair plans such a repair plan (add either N (c i , x j ) or P (c i , x j ) for each x j in such a way that every c i has an outgoing edge).

Remark 5.2.17. If U contains only instance queries, deciding if a repair plan is globally -optimal for 2 { {U,W} , U,W , W,U } is in P. Indeed, because of the truthfulness condition, every assertion that entails some q 2 U is false, so cannot be used to satisfy a wanted answer. There is therefore no need to make the compromise between the satisfaction of wanted and unwanted answers. A repair plan (P , P + ) is globally -optimal iff it is globally U -optimal (which is in this case equivalent to P contains all causes of unwanted answers) and globally W -optimal.

Generic algorithms

Our complexity analysis reveals that the notions of global optimality based upon the preference relations {U,W} , U,W , and W,U have undesirable computational properties: even when provided with all relevant user knowledge, it is intractable to decide whether a given plan is optimal. Moreover, while plans globally U -(resp. W -) optimal can be interactively constructed in a monotonic fashion by removing further false assertions (resp. and adding further true assertions), building a globally optimal plan for a preference relation that involves both U and W may require backtracking over answers already satisfied (cf. the situation in Example 5.2.4). We therefore target validatable repair plans that are both globally optimal for U or W (depending which is preferred) and locally optimal for {U,W} .

Remark 5.2.18. The repair plans we target actually cover some other cases. Indeed, it follows from Proposition 5.2.7 that the following notions of optimality are equivalent: It is also notable that for our target repair plans, it is equivalent to replace set-inclusion by cardinality for the comparison between sets of satisfied answers in the definition of the preorders. In the following we use  and ✓ to denote these two families of preorders. We show that being globally (resp. locally) optimal for  and ✓ is equivalent for

2 { U , W } (resp. 2 { U , W , {U,W} , U,W , W,U }).
Proposition 5.2.19. For 2 { U , W }, a repair plan is globally  -optimal iff it is globally ✓ -optimal.

Proof. A repair plan is globally ✓ U -optimal (resp. ✓ W -optimal) iff it satisfies all satisfiable unwanted (resp. wanted) answers, so iff it is globally  U -optimal (resp.  W -optimal). Remark 5.2.20. Even for the other preorders, the complexity of recognizing a globally optimal repair plan is the same when preorders are defined using cardinality: to show that a repair plan is not optimal, it is still possible to guess a better one and check in P that it is actually better.

Query-driven repairing

Proposition 5.2.21. For 2 { U , W , {U,W} , U,W , W,U }, a repair plan is locally optimal iff it is locally ✓ -optimal.

Proof. Let P = (P , P + ) be a locally ✓ -optimal repair plan and suppose for a contradiction that there exists P 0 = (P 0 , P 0 + ) such that P ✓ P 0 , P + ✓ P 0 + and P  P 0 . Since P ✓ P 0 and P + ✓ P 0 + , then by Lemma 5.2.5 S W (P) ✓ S W (P 0 ), so if |S W (P)| < |S W (P 0 )|, then S W (P) ⇢ S W (P 0 ).

It follows that if = W , P  P 0 implies P ✓ P 0 , so yields a contradiction. Moreover, if 6 = W , P satisfies all unwanted answers that are satisfiable w.r.t. P, and it is not possible that P 0 satisfies some unwanted answers that are not satisfiable w.r.t. P, because those answers have some causes in A [ P + , so also in A [ P 0 + , which do not contain any false assertions, so S U (P 0 ) ✓ S U (P).

It follows that if 2 { U , U,W , {U,W} }, then |S U (P)|  |S U (P 0 )|, so S U (P 0 ) = S U (P). Then, since P  P 0 , |S W (P)| < |S W (P 0 )|, so |S W (P)| ⇢ |S W (P 0 )|, and P ✓ P 0 , which contradicts the local ✓ -optimality of P.

In the case = W,U , either |S W (P)| < |S W (P 0 )| and S W (P) ⇢ S W (P 0 ), which contradicts the local ✓ -optimality of P, or S W (P) = S W (P 0 ) and |S U (P)| < |S U (P 0 )|, which is impossible because S U (P 0 ) ✓ S U (P).

In Algorithm 5.6, we give an interactive algorithm OptimalRepairPlan U for building a repair plan that is both globally optimal for U and locally optimal for {U,W} to address the case where U is preferred; if W is preferred, we use the algorithm OptimalRepairPlan W obtained by removing Step 14 from OptimalRepairPlan U to construct a repair plan that is globally optimal for W and locally optimal for {U,W} . The idea of OptimalRepairPlan U is to remove every false assertion involved in the QRP in order to satisfy the unwanted answers and wanted answers that are satisfiable by removing assertions, then to try to satisfy the wanted answers that are not satisfied by adding assertions, while preserving the satisfied unwanted answers. The algorithms terminate provided the user knows only a finite number of assertions that may be inserted. In this case, the algorithms output optimal repair plans: Theorem 5.2.22. The output of OptimalRepairPlan U (resp. OptimalRepairPlan W ) is globally U (resp. W ) and locally {U,W} -optimal.

Proof. We give first the proof for OptimalRepairPlan U .

First observe that at every point during the execution of the algorithm, the current repair plan is validatable, since only true assertions are added to P + and false assertions are added to P (they are either marked as false by the user, or conflict with assertions that have been marked as true).

Step 2 adds to P all assertions known to be false that belong to a cause of some q 2 U [ W or a conflict of some cause of q 2 W. Thus, at the end of this step, P satisfies every satisfiable answer in U , that is, every answer in U every cause of which contains at least one false assertion (cf. proof of Proposition 5.2.13). Hence (P , P + ) is globally U -optimal at the end of Step 2. Moreover, every false assertion that occurs in a cause or conflict of a cause of a wanted answer has been removed, so if q 2 W is not satisfied at this point, then it has no cause without any conflict in A\{↵ | user(↵) = false}.

Optimal repair plans

Algorithm 5.6 OptimalRepairPlan U Input: QRP (K = hT , Ai, U , W) Output: repair plan 1: P ;, P + ; 2: Display the assertions of S q2U [W causes(q, K) and S q2W,C2causes(q,K) confl(C, K) 3: Ask user to mark all false (F ) and true (T ) assertions 4: P P [ F [ confl(T, K) 5: while W 0 = W\S W (P , P + ) 6 = ; do 6:

q first(W 0 ) 7:
Ask the user for true assertions T q (not already provided) to complete (or create) a cause for q 8:

if T q = ; then // nothing to add, q cannot be satisfied 9:

W W\{q}, go to 5 // try to satisfy next unsatisfied wanted answer 10:

end if 11:

P + P + [ T q , P P [ confl(T q , hT , A [ T q i) 12:
Show assertions of every cause C of q such that T q \ C 6 = ; and its conflicts: user indicates all false, true assertions F 0 , T 0 : P

P [ F 0 [ confl(T 0 , K) 13:
Show assertions of causes of every q 0 2 U in A\P [ P + : user indicates all false assertions F 00 : P P [ F 00 14:

if there is q 00 2 U such that hT , A\P [ P + i |= brave q 00 and (T , A\P ) 6 |= brave q 00 then 15:

P + P + \T q // revert P + 16:
end if 17: end while 18: Return (P , P + )

Query-driven repairing

The purpose of Step 5 is to add new true assertions to create causes for the wanted answers not satisfied after Step 2, while preserving S U (P , P + ). For every q 2 W, while q is not satisfied, the user is asked to input true assertions to complete a cause for q in Step 7. If he is unable to do so, at Step 8, we remove q from W (since it cannot be satisfied w.r.t. user); otherwise, we update P and P + using T q (Step 11). Note that since T q contains only true assertions, we can remove its conflicts without affecting already satisfied wanted answers; this step is necessary because T q may conflict with assertions of A that are not involved in the causes and conflicts presented at Step 2. In Step 12, we remove false assertions appearing in a new cause for q or its conflicts (such assertions may not have been examined in Step 2).

Step 13 removes false assertions of new causes of unwanted answers, and Step 14 undoes the addition of T q if it affects S U (P , P + ). Thus, at the end of Step 5, for every wanted answer, either it is satisfied, or the user is unable to supply a cause that does not deteriorate S U (P , P + ). It follows that (P , P + ) is locally {U,W} -optimal.

For OptimalRepairPlan W , Step 14 is removed, so every satisfiable answer in W is satisfied at the end of Step 5, and (P , P + ) is globally W -optimal. To see why (P , P + ) is locally {U,W} -optimal, observe that (P , P + ) satisfies every q 2 U that is satisfiable w.r.t. (P , P + ), i.e. is such that every cause for q in A [ P + contains some false assertion. Indeed, the assertions of every such cause have been presented to the user either at Step 2 or at Step 13.

Optimal deletion-only repair plans

In this section, we restrict our attention to constructing optimal deletion-only repair plans. In this simpler setting, all of the previously introduced notions of optimality collapse into the one characterized in the following proposition.

Proposition 5.3.1. A validatable deletion-only plan is optimal iff it satisfies every q 2 U such that every C 2 causes(q, K) has ↵ 2 C with user(↵) = false, and every q 2 W for which there exists C 2 causes(q, K) such that user(↵) 6 = false for every ↵ 2 C and user( ) = false for every 2 confl(C, K).

Proof. In the case of deletion-only repair plans, being satisfiable or satisfiable w.r.t. a given repair plan is equivalent since removing more false assertions can only improve the satisfied answers (see Lemma 5.2.5). Hence, a validatable deletion-only plan is optimal iff it satisfies every answer satisfied by the "maximal" deletion-only plan {↵ | user(↵) = false}, or more precisely: every q 2 U such that every C 2 causes(q, K) has ↵ 2 C with user(↵) = false, and every q 2 W for which there exists C 2 causes(q, K) such that user(↵) 6 = false for every ↵ 2 C and user( ) = false for every 2 confl(C, K).

Constructing such repair plans can be done with one of the preceding algorithms, omitting

Step 5 that adds facts. However, it is possible to further assist the user by taking advantage of the fact that subsets of the ABox whose removal addresses all defects of the QRP can be automatically identified, and then interactively transformed into optimal repair plans. We call such subsets potential solutions.

Optimal deletion-only repair plans

Fig. 5.2 SAT encoding for potential solutions.

' U = q2U Ĉ2causes(q,K) _ ↵2C x ↵ ' W = q 2W _ C2causes(q,K) w C ^q 2W Ĉ2causes(q,K) ↵2C ¬w C _ ¬x ↵ ^q 2W Ĉ2causes(q,K) ^ 2confl(C,K) ¬w C _ x
An assertion is said to be relevant if it appears in a cause of some q 2 U [ W or in the conflicts of a cause of some q 2 W. If an assertion ↵ appears in every potential solution, either user(↵) = false, or there is no validatable potential solution. We call such assertions necessarily false. If ↵ appears in no potential solution, it is necessary to keep it in A to retrieve some wanted answers under IAR semantics, so either user(↵) 6 = false, or it is not possible to satisfy all wanted answers. We call such assertions necessarily nonfalse.

When a potential solution does not exist, a minimal correction subset of wanted answers (MCSW) is an inclusion-minimal subset W 0 ✓ W such that removing W 0 from W yields a QRP with a potential solution. Because of the truthfulness condition, we know that the absence of a potential solution means that some wanted answers are supported only by causes containing erroneous assertions (otherwise the wanted and unwanted answers would be contradictory, which would violate the truthfulness condition). Moreover, since removing all such answers from W yields the existence of a potential solution, there exists a MCSW which contains only such answers, which we call an erroneous MCSW. This is why MCSWs can help identify the wanted answers that cannot be satisfied by a deletion-only repair plan. We will present an algorithm that exploits necessarily (non)false assertions and MCSWs to help the user in constructing an optimal deletion-only repair plan.

SAT encoding and complexity results

We first give a propositional encoding that can be used to compute the necessarily (non)false assertions or the MCSWs. We will use the minimal correction subsets of a formula. Definition 5.3.2 (Minimal Correction Subset). Given sets F and H of soft and hard clauses respectively, a subset M ✓ S is a minimal correction subset (MCS) of S w.r.t. H if (i) (S\M ) [ H is satisfiable, and (ii) (S\M 0 ) [ H is unsatisfiable for every M 0 ( M We construct in polynomial time the propositional CNF ' = ' U ^'W , where ' U and ' W are defined in Figure 5.2, and rely on the results of the following lemma: Lemma 5.3.3. The CNF formula ' has the following properties:

• there exists a potential solution iff ' is satisfiable (every satisfying assignment corresponds to a potential solution); Proof. First suppose that there exists a potential solution P, and let ⌫ be a valuation of the variables of ' defined as follows: ⌫(x ↵ ) = true iff ↵ 2 P, and ⌫(w C ) = true iff C ✓ A\P and confl(C, K) ✓ P for every C 2 causes(q, K) with q 2 W.

• ↵ is necessarily false iff ' ^¬x ↵ is unsatisfiable; • ↵ is necessarily nonfalse iff ' ^x↵ is unsatisfiable; • let H = { W C2causes(q,K) w C | q 2 W},
Since P is a potential solution, it contains at least one assertion of each cause of every unwanted answer, otherwise this answer would still be entailed under brave semantics in A\P. It follows that ' U is satisfied by ⌫. Moreover, every q 2 W has at least one cause C without any conflict in A\P, so C \ P = ; and confl(C, K) ✓ P. By the way we defined ⌫, it satisfies ' W , and hence the full formula '.

In the other direction, suppose that the formula ' is satisfiable, with satisfying valuation ⌫. Let P = {↵ | ⌫(x ↵ ) = true}. For every q 2 U and C 2 causes(q, K), P contains an assertion ↵ 2 C, so there is no cause for q in A\P, so every q 2 U is satisfied by P. For every q 2 W, there is a cause C 2 causes(q, K) such that ⌫(w C ) = true. By the way we defined ', this means that for every ↵ 2 C, ⌫(↵) = false, so C \ P = ;, and for every 2 confl(C, K), ⌫( ) = true, so confl(C, K) ✓ P. It follows that all q 2 W are satisfied by P.

Since the assertions assigned to true in a satisfying assignment correspond to a potential solution, ↵ is necessarily false (resp. necessarily nonfalse) iff ' ^¬x ↵ (resp. ' ^x↵ ) is unsatisfiable: ↵ belongs to every potential solution (resp. no potential solution) iff there is no satisfying valuation with ↵ assigns to false (resp. to true).

For the final point, we will show that

M ✓ W is a MCSW iff M = { W C2causes(q,K) w C | q 2 M}
is a MCS of S w.r.t. H. First suppose that M is a MCSW. Since removing M from W yields a QRP that has a potential solution P, the valuation ⌫ such that ⌫(w C ) = false for every C 2 causes(q) with q 2 M, and ⌫(x ↵ ) = true iff ↵ 2 P, and ⌫(w C ) = true iff C ✓ A\P and confl(C, K) ✓ P for C 2 causes(q) with q 2 W\M satisfies '\M. Moreover, since removing M 0 ( M from W does not yield a QRP that has a potential solution, M is a MCS. The other direction is similar.

To show that this approach is optimal from the complexity point of view, we establish the complexity of deciding if a potential solution exists, if an assertion is necessarily (non)false, and if W 0 ✓ W is a MCSW. For the lower bounds, we need the following lemma.

Lemma 5.3.4. Given two sets of soft and hard clauses S, H,

deciding if M ✓ S is a MCS of S w.r.t. H is BH 2 -complete.
Proof. To show that M is a MCS of S: show in NP that (S\M ) [ H is satisfiable and in coNP that M is minimal (to show in NP that M is not minimal, guess M 0 ✓ M and a valuation that satisfies

(S\M 0 ) [ H).
Hardness is shown by reduction from SAT-UNSAT: let ' S , ' U be two CNF formulas that do not share variables. Then ¬x is a MCS of ' = ' S ^(' U _ x) ^¬x iff ' S is satisfiable and ' U is unsatisfiable.

Query-driven repairing

Necessarily nonfalse: The proof is by reduction from unsatisfiability of C 1 ^... ^Cm+1 given that C 1 ^... ^Cm is satisfiable (cf. Lemma 5.2.15). We use the same TBox T 0 and set U of unwanted answers as before, together with the following slightly modified ABox and set of wanted answers:

A 1 = {P (c i , x j )|x j 2 C i } [ {N (c i , x j )|¬x j 2 C i } [ {S(c m+1 )} W 1 = {S(c 1 ), . . . , S(c m+1 )}
We argue that the assertion S(c m+1 ) is necessarily nonfalse iff C 1 ^...^C m+1 is unsatisfiable. Since there exists a valuation ⌫ that satisfies C 1 ^... ^Cm , the repair plan

P ={P (c i , x j )|⌫(x j ) = false} [ {N (c i , x j )|⌫(x j ) = true}[ {P (c m+1 , x j ), N(c m+1 , x j )} \ A 1
is a potential solution: the wanted answer S(c m+1 ) is satisfied by the assertion S(c m+1 ), the other wanted answers are satisfied by outgoing P -or N -edges as in proof for existence. The set of clauses C 1 ^... ^Cm+1 is unsatisfiable iff no potential solution contains the assertion S(c m+1 ) (i.e., we are forced to keep S(c m+1 ) to satisfy the wanted answers).

Necessarily false: The proof is by reduction from unsatisfiability of C 1 ^... ^Cm+1 given that C 1 ^... ^Cm is satisfiable (cf. Lemma 5.2.15). We reuse the sets U and W 1 of unwanted and wanted answers from before, and consider the following TBox and ABox:

T 2 = T 0 [ {E v S, U v ¬E} A 2 = {P (c i , x j )|x j 2 C i } [ {N (c i , x j )|¬x j 2 C i } [ {E(c m+1 ), U(c m+1 )}
We show that U (c m+1 ) is necessarily false iff C 1 ^... ^Cm+1 is unsatisfiable. Since there exists a valuation ⌫ that satisfies C 1 ^... ^Cm , the repair plan

P ={P (c i , x j )|⌫(x j ) = false} [ {N (c i , x j )|⌫(x j ) = true} [ {U (c m+1 )}[ {P (c m+1 , x j ), N(c m+1 , x j )} \ A 2
is a potential solution: the wanted answer S(c m+1 ) is satisfied by the assertion E(c m+1 ), and the other wanted answers are satisfied by outgoing P -or N -edges as in proof for existence. The set of clauses C 1 ^... ^Cm+1 is unsatisfiable iff every potential solution is such that S(c m+1 ) is satisfied by means of the assertion E(c m+1 ), so the conflicting assertion U (c m+1 ) is included in the potential solution.

Remark 5.3.6 (Minimal incompatible sets of wanted answers). If we drop the truthfulness condition and assume that the user may make mistakes when inputting the wanted and unwanted answers, it may be interesting to show him the minimal sets of wanted answers that are incompatible instead of the MCSWs to help him to find its error. Indeed, the former show a "problem" that must be solved by removing one of the answers of this set, which should not be wanted, while it may be difficult to choose which MCSW to remove. However, in the case where we assume that the user cannot make mistake, the MCSWs are more appropriate,

= {C 1 = X 1 _ ¬X 2 , C 2 = ¬X 1 _ X 2 _ ¬X 3 } (or ' = {C 1 = X 1 _ ¬X 2 , C 2 = ¬X 1 _ X 2 _ ¬X 3 } [ {C 3 = x 2 _ x 3 }). A 0 x 1 x 2 x 3 c 1 c 2 Q Q Q Q Q Q Q Q k X X X X X X X X y X X X X X X X X y ⇠ ⇠ ⇠ ⇠ ⇠ ⇠ ⇠ ⇠ 9 ⇠ ⇠ ⇠ ⇠ ⇠ ⇠ ⇠ ⇠ 9 P N N P N A 1 x 1 x 2 x 3 c 1 c 2 c 3 S H H H H H H H H Y ⇡ ⇡ H H H H H H H H Y P N N P N P P A 2 x 1 x 2 x 3 c 1 c 2 c 3 E, U H H H H H H H H Y ⇡ ⇡ H H H H H H H H Y P N N P N P P
since in all cases the user has to look into the causes of the answers to find those which are supported only by erroneous data.

The minimal incompatible sets of wanted answers correspond to the MUSes of S w.r.t. H, so can also be computed using '. Moreover, the reduction given for the MCSWs can be used for the minimal incompatible sets of wanted answers that correspond exactly to the MUSes of the set of clauses, so the complexity results for the MUSes transfer (in particular, recognition is BH 2 -complete).

Algorithm for optimal deletion-only repair plans

We present an algorithm OptDeletionRepairPlan (Algorihm 5.7) for computing optimal deletion-only repair plans. Within the algorithm, we denote by R(K, U , W, A 0 ) (resp.

N f (K, U , W, A 0 ), N ¬f (K, U , W, A 0
)) the set of assertions from A 0 ✓ A that are relevant (resp. necessarily false, nonfalse) for the QRP (K, U , W) when deletions are allowed only in A 0 (the set A 0 will be used to store assertions whose truth value is not yet determined). The general idea is that the algorithm incrementally builds a set of assertions that are false according to the user. It aids the user by suggesting assertions to remove, or wanted answers that might not be satisfiable when there is no potential solution, while taking into account the knowledge the user has already provided. If there exists a potential solution, the algorithm computes the necessarily (non)false assertions (Step 3) and asks the user either to validate them or to input false and nonfalse assertions to justify why they cannot be validated (Step 23). When the necessarily (non)false assertions have been validated, the user is asked to input further true or false assertions if the current set of false assertions does not address all defects (Step 15). When a potential solution is found (Step 6), the user has to verify that each wanted answer has a cause that does not contain any false assertion. If there does not exist a potential solution at some point (Step 25), either initially or after some user inputs, the algorithm looks for an erroneous MCSW by computing all MCSWs, then showing for each of them the assertions involved in the causes of each query of the MCSW. If there is a query which has a cause without any false assertion, the MCSW under examination is Query-driven repairing not erroneous, nor are the other MCSWs that contain that query. Otherwise, the MCSW is erroneous and its queries are removed from W, and we return to the case where a potential solution exists.

Theorem 5.3.7. The algorithm OptDeletionRepairPlan always terminates, and it outputs an optimal deletion-only repair plan.

Proof. Termination follows from the fact that every time we return to Step 2, something has either been added to P or deleted from W, nothing is ever removed from P or added to W, and only assertions from the original ABox A can be added to P .

Note first the following invariants: • The set P contains only false assertions, since every time P is modified, the assertions added have been marked as false by the user, or are conflicts of assertions that have been declared true. Hence, the output plan is validatable.

• The set P [ A 0 contains all assertions ↵ 2 A such that user(↵) = false. Indeed, A 0 is initialized to A, and whenever ↵ is removed from A 0 , it is either added to P , or it has been shown to be nonfalse. • The satisfiable answers (i.e. those that fulfil the conditions of Proposition 3) are never removed from U and W. Indeed, U is never modified and W is modified only at Step 38, where only answers that do not fulfil the conditions of Proposition 3 are removed from W, since all their causes contain some false assertion. It follows that if at some point P satisfies every answer in U [ W, then P is optimal.

The algorithm can end at three different steps: -If the algorithm ends at Step 10, then P is a potential solution for (K 0 , U , W). That means that for every q 2 U, hT , A\P i 6 |= brave q, i.e. q is satisfied by P , and for every q 2 W, hT , A\P i |= IAR q. Moreover, for every q 2 W, Step 7 ensures that there is a cause of q in K = hT , A\P i without conflicts that contains no false assertions, so q is satisfied by P . It follows that P satisfies every satisfiable answer since such answers always remain in U [ W. The output set P is thus an optimal deletion-only repair plan.

-If the algorithm ends at Step 17, the user has been required to input some false or true assertions at Step 15 and he was not able to input anything, so the user has deleted all false assertions he knows among the relevant assertions, and thus it is not possible to improve the current repair plan further. Indeed, the set of relevant assertions contains every assertion that appear in a cause of q 2 U [ W or in a conflict of a cause of q 2 W and has not be declared false, true or nonfalse yet, so it is not possible to satisfy additional answers by removing further assertions that are not relevant, either because they are not involved in the problem at all, or because they are known to be nonfalse.

-If the algorithm ends at Step 38, Step 2 of the general algorithm OptimalRepairPlan U is applied: the user is asked to mark every false and true assertion in the relevant assertions, so the output is optimal since it takes into account everything the user knows.

We illustrate OptDeletionRepairPlan running on a small example.

Optimal deletion-only repair plans

Algorithm 5.7 OptDeletionRepairPlan Input: QRP (K = hT , Ai, U , W) Output: repair plan (Note: below K is a macro for (T , A \ P ), using the current P .)

1: K 0 K, A 0 A, P ; 2: if a potential solution for (K, U , W) exists in A 0 then 3: R R(K, U , W, A 0 ), N f N f (K, U , W, A 0 ), N ¬f N ¬f (K, U , W, A 0 ) 4:
if the user validates 8↵ 2 N f , user(↵) = false, and 8↵ 2 N ¬f , user(↵) 6 = false then 5:

P P [ N f , A 0 A 0 \(N f [ N ¬f ) 6:
if P is a potential solution for (K 0 , U , W) then 7:

the user gives all false assertions F ✓ S q2W,C2causes(q,K),confl(C,K)=; C 8:

P P [ F 9:
if P is still a potential solution then for all q 2 M do 30:

the user selects F, T ✓ S C2causes(q,K) C 31:

P P [ F [ confl(T,), A 0 A 0 \(P [ T ) 32:
if a cause for q contains no false assertion then 33:

M M\{M 0 2 M | q 2 M 0 },
(K = hT , Ai, U , W). T ={AProf v Prof, Prof v Employee, Postdoc v Employee, 9MemberOf v Employee} A ={Teach(a, b), GradCourse(b), AProf(a), Postdoc(a), MemberOf(a, c), PublicationAuthor(a, d)} U ={q 1 = 9xAProf(x) ^Teach(x, b), q 2 = 9xyTeach(x, y) ^GradCourse(y) ^Postdoc(x)} W ={q 3 = 9xTeach(x, b), q 4 = Prof(a), q 5 = 9xEmployee(a) ^PublicationAuthor(a, x)}
The first step is to check if there exists a potential solution for (K, U , W) in A 0 = A. This is not the case because q 1 , q 3 , and q 4 cannot be satisfied together because q 3 and q 4 have only one cause each ({Teach(a, b)} and {AProf(a)} respectively), whose union forms a cause for the unwanted answer q 1 . Therefore, we jump to Step 25 and compute the MCSWs. There are two MCSWs: {q 3 } and {q 4 }. We first display the assertions of the causes for q 3 (i.e. Teach(a, b)) and ask the user if he knows some true or false assertions. Suppose that user(Teach(a, b)) = unknown. Since a cause for q 3 contains no false assertion, {q 3 } is not an erroneous MCSW and we examine the next one. We then present the assertions of the causes for q 4 (AProf(a)). Suppose that the user indicates that user(AProf(a)) = false. Since AProf(a) is false, it is added to P and removed from A 0 . At this point, q 4 has no cause in K = hT , A\P i, so {q 4 } is an erroneous MCSW: q 4 is removed from W and we jump to Step 3.

We know that there exists some potential solution and compute the relevant, necessarily false and nonfalse assertions: N f = ;, N ¬f = {Teach(a, b), PublicationAuthor(a, d)}. Suppose that the user validates that the two assertions of N ¬f are nonfalse. Then Teach(a, b) and PublicationAuthor(a, d) are removed from A 0 . P = {AProf(a)} is not a potential solution (since q 2 is not satisfied), so the relevant assertions (GradCourse(b), Postdoc(a) and MemberOf(a, c)) are displayed. The user indicates that Postdoc(a) is false, so Postdoc(a) is added to P and removed from A 0 . We then go to Step 2.

A potential solution exists (actually P is a potential solution for (K 0 , U , W), so ; is a potential solution for (K = hT , A\P i, U , W)). The user validates the necessarily (non)false assertions (here all remaining assertions are necessarily nonfalse), and the assertions involved in some IAR causes of the wanted answers are displayed (here all assertions of A\P ). Suppose that the user does not find anything false, then we have found an optimal deletiononly repair plan: P = {AProf(a), Postdoc(a)}. /

Improvements to the algorithm

To avoid overwhelming the user with relevant assertions at Step 15, it is desirable to reduce the number of assertions presented at a time. This leads us to propose two improvements to the basic algorithm. First, we can divide QRPs into independent subproblems. Two answers are considered dependent if their causes (and conflicts in the case of wanted answers) share some assertion.

Optimal deletion-only repair plans

Independent sets of answers do not interact, so they can be handled separately. Algorithm 5.8 computes independent subproblems of a QRP by constructing the independent sets of answers. For each wanted or unwanted answer q 0 , the algorithm first builds a set that contains only this answer. Then for each independent set p it has already built, it checks whether some query of p is dependent of q 0 . This is the case if some query of p has causes (or conflicts if it is a wanted query), that share assertions with the causes of q 0 (or its conflicts if q 0 is wanted). If so, it aggregates p with the set of q 0 . At the end of the algorithm, each query appears in exactly one set, and every pair of dependent answers are in the same set.

Algorithm 5.8 IndependentSubproblems Input:

QRP (K = hT , Ai, U , W) Output: independent QRPs {(K = hT , Ai, U i , W i )} 1: P ; 2: for all q 0 2 U [ W do 3: p q 0 {q 0 } 4: if q 0 2 W then 5: B 0 S C2causes(q 0 ,K) (C [ confl(C, K)) 6: else 7: B 0 S C2causes(q 0 ,K) C 8: end if 9:
for all p 2 P do 10:

B p S q2p\W,C2causes(q,K) (C [ confl(C, K)) [ S q2p\U,C2causes(q,K) C 11:
if B p \ B 0 6 = ; then 12: P P \{p} 13:

p q 0 p q 0 [ p 14:
end if 15:

end for 16:

P P [ {p q 0 } 17: end for 18: Output {(K = hT , Ai, U \ p i , W \ p i ) | p i 2 P } Second, at
Step 15, the assertions can be presented in small batches. When axiom (in)validation can be partially automatized, ranking axioms by their potential impact reduces the effort of manual revision [START_REF] Meilicke | [END_REF][START_REF] Nikitina | Nadeschda Nikitina, Sebastian[END_REF]]. In our setting, we believe that validating sets of necessarily (non)false assertions requires less effort than hunting for false assertions among all relevant assertions, leading us to propose a similar notion of impact to rank assertions to be examined. Indeed, deleting or keeping an assertion may force us to delete or keep other assertions to get a potential solution. Relevant assertions can be sorted using two scores that express the impact of being declared false or true. For the impact of an assertion ↵ being false, we use the number of assertions that becomes necessarily (non)false if ↵ is deleted. The impact of ↵ being true also takes into account the fact that the conflicts of ↵ can be marked as false: we consider the number of assertions that are in conflict with ↵ or become necessarily (non)false when we disallow ↵'s removal. We Query-driven repairing can rank assertions by the minimum of the two scores, using their sum to break ties. More formally, the scores are given by the following formulas:

impact false (↵) =|N f (↵ = false) [ N ¬f (↵ = false)| impact true (↵) =|N f (↵ = true) [ N ¬f (↵ = true)| + |(confl({↵}, K) \ R)\N f (↵ = true)| with R =R(hT , Ai, U , W, A 0 ), N (¬)f (↵ = false) =N (¬)f (hT , A\{↵}i, U , W, A 0 \{↵}), N (¬)f (↵ = true) =N (¬)f (hT , Ai, U , W, A 0 \{↵}).
Example 5.3.9 (Example 5.3.8 cont'd). At Step 3, there are three assertions to sort:

GradCourse(b) Postdoc(a) MemberOf(a, c)
Their impacts are computed as follows:

impact false (GradCourse(b)) =0 impact true (GradCourse(b)) =|{Postdoc(a)}| = 1 Indeed, if GradCourse(b) is true, then Postdoc(a)
(Postdoc(a)) + impact true (Postdoc(a)) = 2. impact false (MemberOf(a, c)) =|{Postdoc(a)}| = 1 impact true (MemberOf(a, c)) =0 Indeed, if MemberOf(a, c) is false, Postdoc(a) is necessarily nonfalse.
We thus have min(impact false (MemberOf(a, c)), impact true (MemberOf(a, c))) = 0 and impact false (MemberOf(a, c)) + impact true (MemberOf(a, c)) = 1. Based upon the impact scores, Postdoc(a) will be presented first. / 5.4 Considering the AR semantics for wanted answers

Considering the AR semantics for wanted answers

While in the preceding chapters we studied three semantics, AR, IAR and brave, we defined the query-driven repairing problem using only the brave and IAR semantics. In this section, we investigate the use of AR semantics in this context. We still call potential solutions the repair plans that achieve our objectives in terms of query (non) entailments. More formally, a potential solution for AR (resp. for IAR) is a subset of the ABox whose removal makes every unwanted answer not hold under brave semantics, and every wanted answer hold under AR (resp. IAR) semantics.

One could think that requiring that wanted answers hold under AR semantics instead of IAR semantics would help to find potential solutions or yield more necessarily nonfalse assertions. The following proposition shows that this is not true because a potential solution for AR can always be transformed into a potential solution for IAR.

Proposition 5.4.1. Let (hT , Ai, U , W) be a QRP. If there does not exist a potential solution for IAR, then there does not exist a potential solution for AR.

Proof. If (P AR , P AR + ) is a repair plan for (hT , Ai, U , W) that makes the wanted answers hold under AR semantics and unwanted answers not hold under brave semantics, let R be a repair of (A\P AR ) [ P AR + . Then P IAR = (A\R, P AR + \ R) is a repair plan that makes the wanted answers hold under IAR semantics and unwanted answers not hold under brave semantics. Indeed, (A\P IAR ) [ P IAR + = R and every q 2 W has a cause in R, which has no conflicts by consistency of R.

Futhermore, deciding if a set of assertions is a potential solution for AR is intractable, while it is tractable for IAR.

Proposition 5.4.2. For complexity w.r.t. |A|, |U| and |W|, deciding if (P , P + ) is a potential solution for AR is coNP-complete.

Proof. We can show that P is not a potential solution for AR as follows: decide in P if all unwanted answers are satisfied, and if it is the case, guess a wanted answer q and a repair R of hT , (A\P ) [ P + i such that hT , Ri 6 |= q.

Hardness is by reduction from AR query answering: hT , Ai |= AR q iff (;, ;) is a potential solution for AR for the QRP (hT , Ai, ;, {q}). However, the following example shows that it may be useful to accept that some wanted answers are entailed under AR semantics rather than IAR, because even if using AR semantics has no impact on the existence of potential solutions, it may have one on existence of validatable repair plans that satisfy all wanted answers. Even in the case where additions are allowed, we would probably prefer to simply delete Postdoc(a) and keep the information than a is either a full or an assistant professor, rather than also adding Prof(a) to create an IAR cause which is somehow redundant with the knowledge already present in the base. Moreover, it is possible that in some settings it would be forbidden to add assertions using the general predicate Prof, for instance if a professor has to be registered with his level of seniority. /

In this section, we therefore study the impact of using AR semantics to define the satisfaction of wanted answers. We refine the notions of satisfaction (resp. satisfiability, satisfiability w.r.t. a repair plan) of a wanted answer into satisfaction (resp. satisfiability, satisfiability w.r.t. a repair plan) for IAR and for AR. We say that q is satisfied by K for S (S 2 {IAR,AR}) if there exists an explanation for K |= S q that does not contain any false assertions. In the case of AR semantics, this means that there exist C 1 , ..., C k 2 causes(q, K) such that every repair of K contains some C i and there is no ↵ 2 S k i=1 C i such that user(↵) = false. We use S AR W (P) (resp. S IAR W (P)) to denote the set of answers satisfied for AR (resp. for IAR) by a repair plan P. We redefine the preorder W to take both semantics into account: P W P 0 iff:

• S AR W (P) ⇢ S AR W (P 0 ) and S IAR W (P) ✓ S IAR W (P 0 ), or • S AR W (P) = S AR W (P 0 ) and S IAR W (P) ⇢ S IAR W (P 0 ).

Remark 5.4.4. When we do not want to impose IAR semantics rather than AR semantics to avoid adding assertions, we can also define a weak preorder: P weak W P 0 iff:

• S AR W (P) ⇢ S AR W (P 0 ) and S IAR W (P) ✓ S IAR W (P 0 ), or • S AR W (P) = S AR W (P 0 ) and S IAR W (P) ⇢ S IAR W (P 0 ) and P 0 + = P + .

Characterization and complexity of optimal repair plans

We recall that for the problems related to optimal repair plans, we measure complexity w.r.t. |A|, |U|, |W|, and |T rue rel user |, and assume that the sizes of the queries and the TBox are bounded. In particular, this means that the causes of the queries can be computed in polynomial time.

First note that Lemma 5.2.5 is still true: if P 0 is validatable and such that P ✓ P 0 and P + ✓ P 0 + , then S AR W (P , P + ) ✓ S AR W (P 0 , P 0 + ) and S IAR W (P , P + ) ✓ S IAR W (P 0 , P 0 + ), with the same argument: extending the repair plan in a validatable fashion preserves the nonfalse causes of wanted answers, and cannot add assertions which conflict them. It follows that the characterizations of optimal repair plans in terms of satisfiability of answers with the redefined W are similar to those with the initial W , since the proof of Proposition 5.2.7 5.4 Considering the AR semantics for wanted answers uses only this lemma and the definitions of the different notions of optimality, satisfaction, satisfiability and satisfiability w.r.t. a repair plan are not modified.

Proposition 5.4.5. A validatable repair plan P is:

• globally W -optimal iff it is locally W -optimal iff it satisfies for AR every q 2 W satisfiable for AR, and for IAR every q 2 W satisfiable for IAR. • locally U,W -optimal iff it is locally {U,W} -optimal iff it satisfies every q 2 U that is satisfiable w.r.t. P, satisfies for AR every q 2 W that is satisfiable for AR w.r.t. P, and satisfies for IAR every q 2 W that is satisfiable for IAR w.r.t. P. • locally W,U -optimal iff it satisfies for AR every q 2 W that is satisfiable for AR, satisfies for IAR every q 2 W that is satisfiable for IAR, and satisfies every q 2 U that is satisfiable w.r.t. P.

As for IAR, we can give the characterizations of answers that are satisfiable or satisfiable w.r.t. a repair plan for AR.

Lemma 5.4.6. An answer q 2 W is satisfiable for AR iff there exists some T -consistent sets of assertions C 1 , ..., C k such that:

• for every 1  i  k hT , C i i |= q, • for every ↵ 2 S k i=1 C i , either user(↵) = true, or user(↵) = unknown and ↵ 2 A, and • for every consistent B ✓ A such that for every 1  i  k, B [ C i is inconsistent, there
exists 2 B such that user( ) = false.

(We will call C 1 , ..., C k a witness for the satisfiability of q for AR.)

Proof. If q 2 W is satisfiable for AR, then there exists a validatable repair plan (P , P + ) such that (A\P ) [ P + contains an explanation C 1 , ..., C k for hT , (A\P ) [ P + i |= AR q that does not contain any false assertions. It follows that C 1 , ..., C k are consistent sets of assertions such that hT , C i i |= q, and for every ↵ 2 S k i=1 C i , either ↵ 2 P + and user(↵) = true, or ↵ 2 A and user(↵) = true or user(↵) = unknown. Moreover, for every consistent B ✓ A such that B [ C i is inconsistent for every 1  i  k, B \ P 6 = ;. Otherwise B would be a consistent subset of (A\P ) [ P + contradicting every C i , and C 1 , ..., C k would not be an explanation for hT , (A\P ) [ P + i |= AR q. Since P is validatable, it follows that there exists 2 B such that user( ) = false.

In the other direction, if q and C 1 , ..., C k satisfy the conditions of the lemma statement, then the repair plan P defined by:

({ 2 A | 9B ✓ A such that B is consistent and 8C i 2 {C 1 , ..., C k }, B [ C i is inconsistent, 2 B, user( ) = false}, {↵ 2 k [ i=1 C i \ A | user(↵) = true})
is a validatable repair plan that satisfies q for AR. Indeed, there is no consistent B ✓ (A\P ) [ P + that contradicts C 1 , ..., C k : since P + contains only true assertions, whose Query-driven repairing conflicts are false, and the C i contains no false assertions, such a B would be included in A, so would contain some false assertion , which belongs to P by construction. Therefore every repair of (A\P ) [ P + contains some C i that contains some cause for q without any false assertion, and q is satisfied for AR.

Lemma 5.4.7. Let (P , P + ) be a validatable repair plan for the KB hT , Ai. Then an answer q 2 W is satisfiable for AR w.r.t. (P , P + ) iff q is satisfiable for AR for the KB hT , Ai with a witness C 1 , ..., C k such that every q 0 2 S U (P , P + ) is satisfiable for the KB hT ,

A [ P + [ S k i=1 C i i.
Proof. If q 2 W is satisfiable for AR w.r.t. (P , P + ), then there exists a validatable repair plan (P 0 , P 0 + ) such that P ✓ P 0 and P + ✓ P 0 + which satisfies q for AR and all answers in S(P , P + ). As q is satisfied for AR by (P 0 , P 0 + ), the ABox (A\P 0 ) [ P 0 + contains an explanation C 1 , ..., C k for hT , (A\P 0 ) [ P 0 + i |= AR q that does not contain any false assertion. This means that q is satisfiable for hT , Ai. We then use exactly the same arguments as in proof of Lemma 5.2.12 to show that every q 0 2 S U (P , P + ) is satisfiable for the KB hT ,

A [ P + [ S k i=1 C i i.
In the other direction, suppose that q 2 W is satisfiable for AR for the KB hT , Ai with a witness C 1 , ..., C k such that every q 0 2 S U (P , P + ) is satisfiable for the KB hT ,

A [ P + [ S k i=1 C i i.
We can show as in Lemma 5.2.12 that the repair plan (P 0 , P 0 + ) where

P 0 =P [ { 2 A | 9B ✓ A such that B is consistent and 8C i 2 {C 1 , ..., C k }, B [ C i is inconsistent, 2 B, user( ) = false}[ { | q 0 2 U, C 2 causes(q 0 , hT , (A\P ) [ P + [ k [ i=1 C i i), 2 C, user( ) = false} P 0 + =P + [ {↵ 2 k [ i=1 C i \ A | user(↵) = true}
is a validatable repair plan that extends P and satisfies q for AR and all answers in S(P , P + ).

In contrast to the characterizations of answers satisfiable or satisfiable w.r.t. a repair plan for IAR, these characterizations cannot be verified in P, because the size of the witness is not bounded. However, they allow us to show the following result for instance queries.

Lemma 5.4.8. For instance queries, minimal witnesses of satisfiability for AR are either a single cause {↵} with user(↵) = true, or a set of causes {↵ 1 }, ..., {↵ k } (k > 1) such that user(↵ i ) = unknown and ↵ i 2 A for every ↵ i . It follows that if an instance query q is not satisfiable for IAR w.r.t. a repair plan P, then q is satisfiable for AR w.r.t. P iff q is satisfiable for AR with a witness included in A.

Proof. If we need to add a cause {↵} with user(↵) = true to satisfy an instance query q, since all its conflicts are false, removing the conflicts of ↵ satisfies q for IAR and a minimal witness for AR satisfiability of q containing {↵} does not contain any other cause.

If q is not satisfiable for IAR w.r.t. P, then q has no true cause {↵} such that every q 0 2 S U (P) is satisfiable in hT , A [ P + [ {↵}i. If q is satisfiable for AR w.r.t. P, its witness for AR satisfiability w.r.t. P {↵ 1 }, ..., {↵ k } is then such that ↵ i 2 A for every ↵ i . In the other direction, if q is satisfiable for AR with a witness {↵ 1 }, ..., {↵ k } such that ↵ i 2 A for every ↵ i ,

A[P + [ S k i=1 {↵ i } = A[P + , so every q 0 2 S U (P) is satisfiable in hT , A[P + [ S k
i=1 {↵ i }i (using P ). It follows that q is satisfiable for AR w.r.t. P.

The following proposition gives the complexity upper bounds of deciding if an answer is satisfied, satisfiable or satisfiable w.r.t. a repair plan for AR.

Proposition 5.4.9. Deciding if a wanted answer is satisfied or satisfiable for AR is in coNP. Deciding if a wanted answer is satisfiable for AR w.r.t. a repair plan is in ⌃ p 2 , in coNP for instance queries.

Proof. • Showing that q 2 W is not satisfied for AR can be done by guessing a repair R of K such that every cause for q in R contains some false assertion, so is in NP.

• Showing q 2 W is not satisfiable for AR can be done by guessing a repair R of the KB hT , (A\F alse user ) [ T rue rel user i such that hT , Ri 6 |= q, so is in NP. • Deciding whether q 2 W is satisfiable for AR w.r.t. a repair plan P can be done by guessing a repair plan P 0 , and checking in p 2 that P 0 is validatable, extends P, satisfies all answers satisfied by P (at most 2 ⇤ |W| calls to a coNP oracle), and satisfies q for AR, so is in ⌃ p 2 . If q is an instance query, we first check in P if q is satisfiable w.r.t. P for IAR. If it is, q is also satisfiable for AR w.r.t. P. If it is not, by Lemma 5.4.8, q is satisfiable for AR w.r.t. P iff it is satisfiable for AR with a witness included in A, which can be check in coNP (show that this is not the case by guessing a repair R of the KB hT , (A\F alse user )i such that hT , Ri 6 |= q). We now establish the complexity of deciding the optimality of a repair plan when AR is taken into account for the satisfaction of wanted answers.

Theorem 5.4.10. Deciding if a repair plan is globally -optimal is ⇧ p 2 -complete for 2

{ {U,W} , U,W , W,U } ( p 2 [O(log n)]-complete if all wanted answers are instance queries), and p 2 [O(log n)]-complete for W . Deciding if a repair plan is locally -optimal is ⇧ p 2 -complete for 2 { {U,W} , U,W } ( p 2 [O(log n)]-complete if all wanted answers are instance queries), and p 2 [O(log n)]- complete for 2 { W , W,U }.
Upper bounds. • For global or local W -optimality, the conditions of Proposition 5.4.5 can be verified as follows: for each wanted answer that is neither satisfied nor satisfiable for IAR (check in P), use two calls to a coNP oracle that decides if an answer is satisfiable or satisfied for AR. Then check in P if there is one answer such that the oracle has answered yes to the first question and no to the second. Since all calls to the oracle are independent, they can be done in parallel, so the procedure is in p 2 [O(log n)] (cf. Appendix A.1). • For the ⇧ p 2 upper bounds for 2 { {U,W} , U,W , W,U }, we can show that a repair plan P is not globally (resp. locally) -optimal by guessing a better one (resp. that extends P): guess P 0 (resp. P 0 such that P ✓ P 0 ), and verify with a polynomial procedure (for the unwanted answers) and 2 ⇤ |W| calls to a coNP oracle (for the wanted answers) that S(P) ⇢ S(P 0 ) (or S U (P) ⇢ S U (P 0 ) in the case U,W , and S AR W (P) ⇢ S AR W (P 0 ) or S AR W (P) = S AR W (P 0 ) and S IAR W (P) ⇢ S IAR W (P 0 ) in the case W,U ). • When all wanted answers are instance queries, it is possible to decide whether a repair plan P is globally -optimal for 2 { {U,W} , U,W , W,U } in p 2 [O(log n)] with the following procedure that use 2 ⇤ |W| + 1 independent calls to a coNP oracle:

-check whether P is globally -optimal without taking AR into account (in coNP) -compute the set B of wanted answers that are satisfied for AR in A\F alse user , i.e. which are satisfiable for AR with a witness included in A (|W| calls to a coNP oracle)

-compute S AR W (P) (|W| calls to a coNP oracle) -check that B ✓ S AR W (P) We show that P is globally {U,W} -optimal iff it is globally {U,W} -optimal without taking AR into account and satisfies for AR every q 2 B.

In the first direction, suppose that P is not globally {U,W} -optimal. There exists P 0 such that P {U,W} P 0 . By Lemma 5.2.5, P 00 = (F alse user , P 0 + ) is also such that P {U,W} P 00 . It follows that S U (P) ✓ S U (P 00 ), S IAR W (P) ✓ S IAR W (P 00 ), and S AR W (P) ✓ S AR W (P 00 ), and one of these inclusions is proper. If S U (P) ⇢ S U (P 00 ) or S IAR W (P) ⇢ S IAR W (P 00 ), then P is not globally {U,W} -optimal without taking AR into account. Otherwise, if S U (P) = S U (P 00 ) or S IAR W (P) = S IAR W (P 00 ) and S AR W (P) ⇢ S AR W (P 00 ), q 2 S AR W (P 00 )\S AR W (P) is satisfiable for AR with a witness included in A (otherwise, any witness would contain a true cause and P 00 would satisfy q for IAR, so P would also satisfy q for IAR) so q 2 B and q / 2 S AR W (P). In the other direction: -If there exists q 2 B and q / 2 S AR W (P), P 0 = (F alse user , P + ) is such that S U (P) ✓ S U (P 0 ), S IAR W (P) ✓ S IAR W (P 0 ) (by Lemma 5.2.5), and satisfies q for AR. Indeed, q has a witness for AR included in A so by definition of the witness, hT , A\F alse user i |= AR q, and P + does not add conflicts to the assertions of the witness since they are nonfalse.

-If (P , P + ) is not {U,W} -globally optimal without considering AR because (P 0 , P 0 + ) is a better repair plan, then we show that either (F alse user , P 0 + ) or (F alse user , P + ) is a better repair plan than (P , P + ) when AR is taken into account. First, note that since S U (P) ✓ S U (P 0 ), S IAR W (P) ✓ S IAR W (P 0 ), and one of the inclusions is strict, then S U (P) ✓ S U (F alse user , P 0 + ), S IAR W (P) ✓ S IAR W (F alse user , P 0 + ) and one of the inclusions is strict. If there exists q such that q 2 S AR W (P), q / 2 S AR W (F alse user , P 0 + ) and q 2 S IAR W (F alse user , P + ), then (F alse user , P + ) is a better repair plan than (P , P + ). Indeed, q / 2 S IAR W (P) otherwise q 2 S IAR W (F alse user , P 0 + ) ✓ S AR W (F alse user , P 0 + ). Otherwise, if for every q such that q 2 S AR W (P), if q / 2 S AR W (F alse user , P 0 + ), then q / 2 S IAR W (F alse user , P + ), then we show that in this case (F alse user , P 0 + ) is a better repair plan. Indeed, we can show that S AR W (P) ✓ S AR W (F alse user , P 0 + ): suppose for a contradiction that there exists q such that q 2 S AR W (P) and q / 2 S AR W (F alse user , P 0 + ). By assumption q / 2 S IAR W (F alse user , P + ). It follows that its causes in A[P + are in A (otherwise there would be some cause {↵} with user(↵) = true and the answer would be in S IAR W (F alse user , P + )). It follows that q is also AR in A [ P 0 + \F alse user (a consistent subset that contradicts every 5.4 Considering the AR semantics for wanted answers cause in (A [ P 0 + )\F alse user would also contradict every cause in (A [ P + )\F alse user ): contradiction.

For 2 { U,W , W,U }, the proof is similar. • When all wanted answers are instance queries, for 2 { {U,W} , U,W }, deciding if a repair plan P is locally -optimal can be done in p 2 [O(log n)] using the characterization of Proposition 5.4.5 and the complexity results of Proposition 5.4.9 (satisfaction and satisfiability w.r.t. a plan in coNP for instance queries).

• For local W,U -optimality, the conditions of Proposition 5.4.5 can also be verified with 2 ⇤ |W| independent coNP calls by Proposition 5.4.9.

We next prove the lower bounds.

Proof of p

2 [O(log n)]-hardness (all cases). The proof is by reduction from the Parity(SAT) problem, where we assume that the formulas are such that ' i+1 is unsatisfiable whenever ' i is unsatisfiable (cf. Appendix A.3). Consider a Parity(SAT) instance given by ' 1 , . . . , ' n . For each i, 1  i  n, let {c i,1 , ..., c i,r(i) } be the clauses of ' i over variables

X i = {x i,1 , ..., x i,h(i) }. T ={U E v U, U O v U, 9P v ¬9N , 9P v ¬9U , 9N v ¬9U , 9U E v ¬A} A ={P (c i,m , x i,l )|x i,l 2 c i,m } [ {N (c i,m , x i,l )|¬x i,l 2 c i,m }[ {U O (' i , c i,m ) | i ⌘ 1 mod 2, 1  i  n, 1  m  r(i)}[ {U E (' i , c i+1,m ) | i ⌘ 1 mod 2, 1  i  n 1, 1  m  r(i + 1)}[ {U E (' n , a) | if n ⌘ 1 mod 2}[ {A(' i ) | i ⌘ 1 mod 2, 1  i  n} W ={9xU (' i , x) | i ⌘ 1 mod 2, 1  i  n} T rue rel user =; F alse user ={A(' i ) | i ⌘ 1 mod 2, 1  i  n} Unk user =A\F alse user Figure 5
.4 illustrates the reduction. We show that (P , P + ) = (;, ;) is not optimal iff there exists an odd integer k such that ' k is satisfiable and ' k+1 is unsatisfiable (or n is odd and ' n is satisfiable). Note that (F alse user , ;) is optimal and that the repairs of A\F alse user correspond to the combinations of the possible valuations of the X i (1  i  n) (that do not interact), and that a formula ' i with i odd (resp. i even) is satisfiable iff 9xU O (' i , x) (resp. 9xU E (' i 1 , x)) is not AR in A\F alse user , using the same arguments as usual. Let 1  i  n be odd. The causes of 9xU (' i , x) in A are the U O (' i , c i,m ) and the U E (' i , c i+1,m ). If ' i is satisfiable then there exists a repair that contains no U O (' i , c i,m ). There is such a repair that contains A(' i ), so which does not contain any U E (' i , c i+1,m ). Thus hT , Ai 6 |= AR 9xU (' i , x), and (;, ;) does not satisfy the wanted answer 9xU (' i , x). If ' i+1 is unsatisfiable, then hT , A\F alse user i |= AR 9xU E (' i , x), so the wanted answer Fig. 5.4 Reduction from Parity(SAT) for p 2 [O(log n)]-hardness of recognition of optimal repair plans using AR semantics. Graphical representation for the case where n is odd.

A ' 1 ' 3 ... ' n a ? U E A A A A A A A A A A o (1) A A A A A A A e (1) A A A A A A A o (3) A A A A A A A e (3) A A A A A A A o (n) A o (i) ' i c i,1 c i,r(i) A A A A A K U O ... A A A A A A K ✓ P/N A A A A A A K @ @ @ @ @ @ I A e (i) ' i c i+1,1 c i+1,r(i+1) A A A A A K U E ... A A A A A A K ✓ P/N A A A A A A K @ @
@ @ @ @ I 9xU (' i , x) is satisfiable. It follows that if ' i is satisfiable and ' i+1 is unsatisfiable, then (F alse user , ;) is a validatable repair plan which is better than (P , P + ), so (P , P + ) is not optimal. If n is odd and ' n is satisfiable, (;, ;) does not satisfy 9xU (' n , x) but (F alse user , ;) satisfies it because A(' n ) is the only conflict of U E (' n , a).

In the other direction, if (P , P + ) is not optimal, there exists 1  i  n odd such that (P , P + ) does not satisfy the wanted answer 9xU (' i , x), and there exists a validatable repair plan that satisfies it, and in particular (F alse user , ;) satisfies it. It follows that ' i is satisfiable (otherwise the answer 9xU (' i , x) is already satisfied) and ' i+1 is unsatisfiable (or i = n) (otherwise (F alse user , ;) would not satisfy it: there would be a repair that corresponds to a valuation of the X i that satisfies ' i and a valuation of X i+1 that satisfies ' i+1 and that would not contains any cause for 9xU (' i , x)). The repair plan (F alse user , T rue rel user ) satisfies q 2 W for AR, since the function ⇡ such that ⇡(c) = e, ⇡(l 1 ) = ⇡(l 2 ) = ⇡(l 3 ) = ⇡(l 4 ) = d, and ⇡(x) = b is a match for the wanted answer, but (F alse user , T rue rel user ) does not satisfy the unwanted answer. Note that the wanted answer cannot be satisfied for IAR because 9xC(x) has only two causes C 1 (b) and C 2 (b) which are in conflict and are unknown.

Proof of ⇧

1 = x 1 ^y1 ^¬x 2 ^¬y 2 , C 2 = x 2 ^y2 ^¬x 1 ^¬y 1 }. A c 1 c 2 a A, B, T, F x 1 x 2 y 1 y 2 A,B T, F A,B T, F T Y , F Y T Y , F Y ✓ @ @ @ @ @ I 6 * P 1 N 1 P 2 N 2 ✓ @ @ @ @ @ I 6 H H H H H H H H H H Y N 1 P 2 N 2 P 1 Proof for ⇧ p 2 -hardness for global W,U optimality. Let = 9x 1 ...x m 8y 1 ...y p W n i=1 C i where W n i=1 C i is a 2+2 DNF (C i = l i 1 ^li 2 ^¬l i 3 ^¬l i 4 ). T ={T Y v T, F Y v F, T Y v ¬F Y , C 1 v C, C 2 v C, C 1 v ¬C 2 } A ={A(x j ), B(x j )|1  j  m} [ {T Y (y j ), F Y (y j ) | 1  j  p} [ {A(a), B(a), T (a), F (a)} [ {P 1 (c i , l 1 ), P 2 (c i , l 2 ), N 1 (c i , l 3 ), N 2 (c i , l 4 ) | C i = l i 1 ^li 2 ^¬l i 3 ^¬l i 4 } [ {C 1 (b), C 2 (b)} [ {P 1 (e, d), P 2 (e, d), N 1 (e, d), N 2 (e, d)} [ {A(d), B(d)} W ={9c, l 1 , l 2 , l 3 , l 4 , x P 1 (c, l 1 ) ^P2 (c, l 2 ) ^N1 (c, l 3 ) ^N2 (c, l 4 ) ^T (l 1 ) ^T (l 2 ) ^F (l 3 ) ^F (l 4 ) ^C(x)} U ={9xT (x) ^F (x) ^A(x) ^B(x)} T rue rel user ={T (x j ), F (x j )|1  j  m} [ {T (d), F (
If is valid, it is possible to satisfy both the wanted answer for AR and the unwanted answer as in the previous proof.

If (F alse user , T rue rel user ) is not optimal, there exists (P , P + ) that satisfies both the wanted and unwanted answers (since (F alse user , T rue rel user ) W,U (P , P + ) and the wanted answer is not satisfiable for IAR). Then is satisfiable as in previous proof: e and d cannot be used to satisfy the wanted answer, since it would require to add both T (d) and F (d) and would make the unwanted answer not satisfied.

Considering the AR semantics for wanted answers

Fig. 5.6 Reduction from QBF 2,9 for ⇧ p 2 -hardness of recognition of globally W,U -optimal repair plans using AR semantics. Graphical representation of the ABox constructed from

{C 1 = x 1 ^y1 ^¬x 2 ^¬y 2 , C 2 = x 2 ^y2 ^¬x 1 ^¬y 1 }. A c 1 c 2 a A, B, T, F e d A,B T, F 6 P 1 , P 2 , N 1 , N 2 b C 1 , C 2 x 1 x 2 y 1 y 2 A,B T, F A,B T, F T Y , F Y T Y , F Y ✓ @ @ @ @ @ I 6 * P 1 N 1 P 2 N 2 ✓ @ @ @ @ @ I 6 H H H H H H H H H H Y N 1 P 2 N 2 P 1
[O(log n)]-co ⇤ p 2 [O(log n)]-co ⇤ in P in P W,U ⇧ p 2 -co / p 2 [O(log n)]-co †⇤ p 2 [O(log n)]-co ⇤ coNP-co ⇤ in P U,W ⇧ p 2 -co / p 2 [O(log n)]-co †⇤ ⇧ p 2 -co / p 2 [O(log n)]-co †⇤ coNP-co ⇤ in P {U,W} ⇧ p 2 -co / p 2 [O(log n)]-co †⇤ ⇧ p 2 -co / p 2 [O(log n)]-co †⇤ coNP-
-optimal for 2 { {U,W} , U,W , W,U } is in p 2 [O(log n)],
since in this case a repair plan (P , P + ) is globally -optimal iff it is globally U -optimal (i.e. P contains all causes of unwanted answers) and globally W -optimal. Moreover, the p 2 [O(log n)] lower bound holds since the reduction does not use unwanted answers.

Table 5.1 summarizes the complexity results for the recognition of an optimal repair plan.

Discussion: impact of AR semantics on the algorithms

While the complexity of recognizing an optimal repair plan increases when AR is taken into account, the repair plans constructed by the algorithms previously introduced are actually optimal also in this case.

Query-driven repairing

The algorithm OptimalRepairPlan U (resp. OptimalRepairPlan W ) still outputs a globally U (resp. W ) and locally {U,W} -optimal repair plan. The only difference when we consider AR is that some answers removed from W, because they cannot be satisfied for IAR semantics, are actually satisfied for AR. Indeed, every known cause that can be added without deteriorating the satisfaction of the unwanted answers has been added, and all of its false conflicts removed. Therefore, the output plan satisfies for IAR (resp. for AR) every wanted answer that is satisfiable for IAR (resp. for AR) w.r.t. the output plan. We could add a step that checks whether an answer not satisfiable for IAR w.r.t. the plan is satisfied for AR (by simply checking if the answer holds under AR semantics, since every false assertion has been removed from its causes), to also provide the information about the satisfied answers for AR.

However, we could also modify the algorithm by dividing the addition step into two phases: the first one tries to satisfy wanted answers for AR, and the second one tries to satisfy for IAR the answers already satisfied for AR. In some cases, this procedure allows us to satisfy more answers for AR than the existing algorithm. Indeed, since we will not add every known cause for an answer already satisfied for AR, we may be able to add causes to satisfy another wanted answer that would have interacted in a wrong way with these superfluous causes. For instance, suppose that Prof(a) and GradCourse(c) are wanted, that 9xyzAdvise(x, b) ^Teach(x, y) ^GradCourse(y) ^TakeCourse(z, y) is unwanted, that AProf and FProf are disjoint, and the ABox contains the assertions AProf(a), FProf(a), Teach(a, c), and TakesCourse(c, d). Suppose that the user does not know whether these assertions are true or false but knows Advise(a, b) and GradCourse(c). If he adds Advise(a, b) to satisfy Prof(a) for IAR, he cannot satisfy GradCourse(c) and the unwanted answer together, whereas if he does not add it, he can satisfy the unwanted answer and every wanted answer, at least for AR. The plans (;, {Advise(a, b)}) and (;, {GradCourse(c)}) are both locally {U,W} -optimal, since extending them cannot improve them, but the second one satisfies more answers for AR.

Regarding deletion-only repair plans, since the potential solutions for IAR are potential solutions for AR and potential solutions for AR can be extended to potential solutions for IAR (cf. Proposition 5.4.1), the sets of relevant, necessarily false or necessarily nonfalse assertions, and the MCSWs are exactly the same as before. As for OptimalRepairPlan U and OptimalRepairPlan W , we can add a step that checks whether the wanted answers that are not satisfied for IAR are satisfied for AR at the end of OptDeletionRepairPlan, to inform the user of the satisfaction of the wanted answers under AR semantics, but the repair plan that is returned is optimal in all cases.

Overall, we believe that the AR semantics can be profitably exploited in the following scenario: a user begins by executing OptDeletionRepairPlan as a first step to construct a repair plan such that the resulting knowledge base satisfies all satisfiable unwanted answers and satisfies for IAR all wanted answers satisfiable for IAR without inserting new assertions. However, this plan does not satisfy some wanted answers, either because they became nonbrave at Step 31, or because the user does not know how to clean a cause (in this case the algorithm ended at Step 17). He therefore uses the insertion step of OptimalRepairPlan U (Step 5) to try to satisfy the remaining unsatisfied wanted answers, but considering as satisfied Query-driven repairing

Experimental setting

We focused on measuring the time to decide whether a potential solution exists, to compute the necessarily (non)false assertions, to rank the relevant assertions w.r.t. their impact, and to find the MCSWs. We built QRPs for ABoxes u100c1 and u100c20 (which have respectively about 5% and 30% of assertions involved in conflicts) using queries q5, q7, q8 and q10 that have many dependent answers (whose causes and conflicts of causes share some assertions).

When building QRPs, the unwanted answers are picked from a set of "false answers" that contains: (i) the answers that were not answers over the initial consistent ABox u100c0, and (ii) the answers such that all their causes contain some assertions that we choose arbitrary and consider to be false. We choose seven such assertions in total (displayed in Figure 5.7). The wanted answers are picked from the complement of these false answers. Table 5.2 shows the number of false and true answers for each query and ABox. We built in sequence 13 QRPs, one being obtained from the preceding QRP by adding further queries answers to U or W. They have for each of the four queries 1 up to 25 wanted answers and 1 up to 7 unwanted answers. U [ W's size varies from 8 (one wanted and unwanted answer per query) to 102 (the 21 false answers common to u100c1 and u100c20 are unwanted, the 6 true answers of q5 and 25 for each other query are wanted). To study the impact of adding further unwanted answers, we built a second set of QRPs by completing the formers using the additional false answers obtained on u100c20. These QRPs have the same wanted answers and 1 up to 24 unwanted answers. Therefore, U [ W's size is up to 121 (when the 40 false answers on u100c20 are unwanted).

Experimental results

In all of our experiments, deciding if a potential solution exists, as well as computing the relevant assertions, takes a few milliseconds. The difficulty of computing the necessarily (non)false assertions correlates with the number of relevant assertions induced by QRPs. On u100c1, the QRPs involve 85 to 745 relevant assertions, and it takes 30ms to 544ms, while it takes 59ms to 1333ms for the same QRPs on u100c20, where 144 to 1350 assertions are involved, and up to 1541ms for 1395 assertions for the QRPs having more unwanted answers. Figure 5.8 shows the time needed to compute necessarily (non)false assertions w.r.t. the number of relevant assertions on the three cases. While these times seem reasonable in practice, ranking the remaining relevant assertions based on their impact is time consuming (it requires a number of calls to the SAT solver quadratic in the number of assertions): it takes less than 10s up to ⇠150 assertions, less than 5 minutes up to ⇠480 assertions, and up to 30 minutes for ranking 833 assertions. Figure 5.9 shows the time needed to rank remaining assertions w.r.t. their number.

The percentage of necessarily (non)false assertions is higher on u100c20 (between 29% and 41% of the relevant assertions) than on u100c1 (between 14% and 21% of the relevant assertions) for the same QRPs as well as for those having more unwanted answers. This is due to higher numbers of necessarily false assertions on u100c20.

Regarding the ranking of the relevant assertions not necessarily (non)false, we observed that the minimal impact guaranteed is typically 0 for our QRPs, but that the sum of the impact of being false or true can be high (up to 20 on u100c20, up to 16 on u100c1). Moreover, the first assertions have an impact significantly higher than the average: on u100c20, for almost every QRP, the 10 first assertions have an impact of 20, while the average ranges from 2.4 to 5.8, and on u100c1, the average impact of the 10 first assertions ranges from 3.8 to 6.5, while the average of all assertions is below 1.

We also executed a few steps of interaction. We accepted the necessarily (non)false assertions, and indicated for the 10 first assertions whether they are true or false. We observed that during the first steps, the false assertions (the assertions inserted to create conflicts as well as those displayed in Figure 5.7) tend to be ranked in the first tens assertions. Indeed, their impact of being declared true is generally high, either because they have a lot of conflicts, or because they belong to many causes of unwanted answers which have only one remaining assertion not assigned to nonfalse beside them.

We also generate random QRPs to get some problems which have no potential solution. In all cases, computing the MCSWs takes a few milliseconds, and we found at most one MCSW.

In this chapter, we investigate variants of the AR, IAR and brave semantics obtained by replacing the classical notion of repair by one of four different types of preferred repairs. We analyze the complexity of query answering under the resulting semantics, focusing on DL-Lite R . Unsurprisingly, query answering is intractable in all cases, but we nonetheless identify one notion of preferred repair, based upon priority levels, whose data complexity is "only" coNP-complete, as for plain AR semantics. This leads us to propose an approach exploiting a SAT encoding for the semantics based on this kind of repairs. An experimental evaluation of the approach shows that consistent query answering is more difficult with priorities than with the classical set-inclusion repairs, but still scales on realistic cases. The main results of this chapter have been published in [START_REF] Bienvenu | [END_REF]].

Preferred repair semantics

The classical notion of repair integrates a very simple preference relation, namely set inclusion. When additional information on the reliability of ABox assertions is available, it is natural to use this information to identify preferred repairs, and to use the latter as the basis of inconsistency-tolerant reasoning. This idea leads us generalize the earlier definitions, using preorders to model preference relations. Definition 6.1.1. Let K = hT , Ai be a KB, and let be a preorder over subsets of A. A -repair of K is a T -consistent subset of A which is maximal w.r.t. . The set of -repairs of K is denoted Rep (K). Definition 6.1.2. A Boolean query q is entailed by K = hT , Ai under the -AR semantics, written K |= -AR q, if hT , Ri |= q for every R 2 Rep (K); it is entailed by K under the -IAR semantics, written K |= -IAR q, if hT , R \ i |= q where R \ = T R2Rep (K) R; it is entailed by K under the -brave semantics, written K |= -brave q, if hT , Ri |= q for some R 2 Rep (K).

Preference relations

The problem of reasoning on preferred subsets has been studied in a number of areas of AI, such as abduction, belief change, argumentation, and non-monotonic reasoning, see [Eiter & Gottlob 1995, Nebel 1998, Amgoud & Vesic 2011, Brewka et al. 2008] and references therein. We consider four standard ways of defining preferences over subsets. Cardinality-maximal repairs are intended for settings in which all ABox assertions are believed to have the same likelihood of being correct. The other three types of preferred repairs target the scenario in which some assertions are considered to be more reliable than others, which can be captured qualitatively by partitioning the ABox into priority levels (and then applying either the set inclusion or cardinality criterion to each level), or quantitatively by assigning weights to the ABox assertions (and selecting those repairs having the greatest weight). Cardinality () A first possibility is to compare subsets using set cardinality:

A 1  A 2 iff |A 1 |  |A 2 |.
The resulting notion of -repair is appropriate when all assertions are believed to have the same (small) likelihood of being erroneous, in which case repairs with the largest number of assertions are most likely to be correct.

Priority levels (✓ P ,  P ) We next consider the case in which ABox assertions have been partitioned into priority levels P 1 , . . . , P n based on their perceived reliability, with assertions in P 1 considered most reliable, and those in P n least reliable. Such a prioritization can be used to separate a part of the dataset that has already been validated from more recent additions. Alternatively, one might stratify assertions based upon the concept or role names they use (when some predicates are known to be more reliable), or the data sources from which they originate (in information integration applications). Given a prioritization P = hP 1 , . . . , P n i of A, we can refine the ✓ and  preorders as follows:

• Prioritized set inclusion: A 1 ✓ P A 2 iff A 1 \ P i = A 2 \ P i for every 1  i  n, or there is some 1  i  n such that A 1 \ P i ( A 2 \ P i and for all 1  j < i, A 1 \ P j = A 2 \ P j . • Prioritized cardinality:

A 1  P A 2 iff |A 1 \ P i | = |A 2 \ P i | for every 1  i  n,
or there is some

1  i  n such that |A 1 \ P i | < |A 2 \ P i | and for all 1  j < i, |A 1 \ P j | = |A 2 \ P j |.
Notice that a single assertion on level P i is preferred to any number of assertions from P i+1 , so these preorders are best suited for cases in which there is a significant difference in the perceived reliability of adjacent priority levels. A few priority classes seems a reasonable scenario.

Weights ( w ) The reliability of different assertions can be modelled quantitatively using a function w : A ! N assigning weights to the ABox assertions. The weight function w induces a preorder  w over subsets of A in the expected way:

A 1  w A 2 iff  ↵2A 1 w(↵)   ↵2A 2 w(↵).
If the ABox is populated using information extraction techniques, the weights may be derived from the confidence levels output by the extraction tool. Weight-based preorders can also be used in place of the  P preorder to allow for compensation between the priority levels.

6.1 Preferred repair semantics Remark 6.1.3. For cardinality, prioritized cardinality or weights, it may be interesting to relax the constraint by considering the repairs of cardinality or weight greater than a fraction of the maximum cardinality or weight to temper the threshold effect. As we will see, this generalization does not cause an increase in complexity.

By definition of -IAR, -AR, and -brave, we still have the following relation: Proposition 6.1.4. For every preference relation :

K |= -IAR q =) K |= -AR q =) K |= -brave q
Moreover, since for 2 {, ✓ P ,  P ,  w }, every -repair is a ✓-repair:

Proposition 6.1.5. For 2 {, ✓ P ,  P ,  w }, and S 2 {IAR, AR, brave}, if K |= ✓-S q, then K |= -S q.

Finally, since every  P -repair is a ✓ P -repair: Proposition 6.1.6. For S 2 {IAR, AR, brave}, if K |= ✓ P -S q, then K |=  P -S q. The following example illustrates the different semantics. From A and the inclusions in T , we can infer that ann is both a student and professor, and bob is a person and course, so the KB is inconsistent as both negative inclusions of T are violated. The repairs of K are: R 1 ={Student(ann), Student(bob)} R 2 ={Teach(ann, c 1 ), Teach(ann, c 2 ), Student(bob)} R 3 ={Student(ann), Prof(bob), Teach(bob, c 3 )} R 4 ={Teach(ann, c 1 ), Teach(ann, c 2 ), Prof(bob), Teach(bob, c 3 )} R 5 ={Student(ann), Teach(c 2 , bob)} R 6 ={Teach(ann, c 1 ), Teach(ann, c 2 ), Teach(c 2 , bob)}

We observe that the query Person(ann) is entailed under the AR semantics, since it can be inferred from every repair together with the TBox, but it is not entailed under the IAR semantics, as the intersection of the repairs does not contain any assertion concerning ann.

By moving to preferred repair semantics, we can obtain further answers. First suppose we adopt the cardinality criterion. Then there is a single -repair: R 4 . Queries Prof(ann) Preferred repair semantics and Prof(bob) are entailed under the -IAR semantics, while they were not entailed under plain AR semantics.

Next suppose we have the following prioritization P = hP 1 , P 2 i of A: Three other preference-based semantics are proposed in [START_REF] Staworko | [END_REF] for querying databases that violate integrity constraints, based upon partially ordering the assertions that appear together in a conflict. We show that if such an ordering is induced from an ABox prioritization, then the three semantics all coincide with our ✓ P -AR semantics. The following definitions are theirs, adapted to our context. Definition 6.1.8 (Priority). A priority is a binary relation on A such that is acyclic and for every , in A, if then and are in a conflict of A w.r.t. T . Definition 6.1.9 (Globally-optimal repair). Given a priority , a subset R of A is a globallyoptimal repair if R 2 Rep ✓ (T , A) and no nonempty subset B of assertions from R can be replaced with a subset D of A\R such that for every 2 B there exists 2 D such that and the resulting set of assertions (R\B) [ D is T -consistent.

P 1 ={Student(
Definition 6.1.10 (Pareto-optimal repair). Given a priority , a subset R of A is a Paretooptimal repair if R 2 Rep ✓ (T , A) and no nonempty subset B of assertions from R can be replaced with a subset D of A\R such that for every 2 B and for every 2 D, and the resulting set of assertions (R\B)

[ D is T -consistent.
Notice that the definition of Pareto-optimal repair is equivalent if we require D to be a singleton. Definition 6.1.11 (Total priority). A priority is total if for every , in A, if and are in a conflict together, then or .

Definition 6.1.12 (Completion-optimal repair). Given a priority , a subset R of A is a completion-optimal repair if there exists a total priority 0 such that ✓ 0 (i.e. for every , in A, if then 0 ) and R is globally-optimal w.r.t. 0 .

 P  w AR coNP p 2 [O(log n)] coNP p 2 † p 2 † IAR in P p 2 [O(log n)] coNP p 2 † p 2 † brave in P p 2 [O(log n)] NP p 2 † p 2 † Data complexity ✓  ✓ P  P  w AR ⇧ p 2 ⇧ p 2 ⇧ p 2 ⇧ p 2 ⇧ p 2 IAR NP p 2 [O(log n)] p 2 [O(log n)] p 2 † p 2 † brave NP p 2 [O(log n)] NP p 2 † p 2 †
Combined complexity

Complexity analysis

query entailment problem as follows:

T ={9A v Y }[ {9A v ¬V d , 9A v ¬W d | 1  d  3}[ {W d v ¬9K m | 1  d  3, 1  m  4}[ {V d v ¬9E m | 1  d  3, 1  m  4}[ {9K m v ¬9F r | 1  m  4, 1  r  7}[ {9E m v ¬S g | 1  m  4, 1  g  5}[ {S g v ¬9F r | 1  g  5, 1  r  7}[ {9F r v ¬9P k l | 1  r  7, 1  k  8, 1  l  3}[ {9F r v ¬9N k l | 1  r  7, 1  k  8, 1  l  3}[ {9N k l v ¬9P k 0 l 0 | 1  k, k 0  8, 1  l, l 0  3}[ {9N k l v ¬9P k 0 l 0 | 1  k, k 0  8, 1  l, l 0  3}[ {9P k l v ¬9P k 0 l 0 | 1  k, k 0  8, 1  l 6 = l 0  3}[ {9N k l v ¬9N k 0 l 0 | 1  k, k 0  8, 1  l 6 = l 0  3} A ={A(y, a i ) | i ⌘ 1 mod 2, 1  i  n} [ {K m (a i , ' i ), W d (a i ) | i ⌘ 1 mod 2, 1  i  n, 1  d  3, 1  m  4} [ {E m (a i 1 , ' i ), V d (a i 1 ) | i ⌘ 0 mod 2, 1  i  n, 1  d  3, 1  m  4} [ {S g (' i ) | 1  i  n, 1  g  5} [ {F r (' i , c i,j ) | 1  i  n, 1  j  m(i), 1  r  7} [ {P k l (c i,j , x i,h ) | x i,h is the l th literal of c i,j , 1  i  n, 1  l  3, 1  k  8} [ {N k l (c i,j , x i,h ) | ¬x i,h is the l th literal of c i,j , 1  i  n, 1  l  3, 1  k  8} q =Y (y)
Note that T , A and q can be constructed in time polynomial in ' 1 , ..., ' n .

First, notice that if R 2 Rep  (K) and C p (x) 2 R with C 2 {V, W, S}, then C p 0 (x) 2 R for all C p 0 (x) 2 A. Indeed, since C p (x) and C p 0 (x) do not conflict with each other and they conflict with the same assertions of A, both or neither will appear in R. For the same reasons, if

R p (x, z) 2 R with R 2 {K, E, F, P, N }, then R p 0 (x, z) 2 R for every assertion R p 0 (x, z) 2 A. Hence, if F 1 (' i , c i,j ) 2 R for instance, then the seven assertions F r (' i , c i,j ) (1  r  7) are in R, and if F 1 (' i , c i,j ) /
2 R, then no assertion of the form F r (' i , c i,j ) belongs to R.

Next we establish a series of claims that further characterize the sets in Rep  (K).

Claim 1

If ' i is satisfiable and R 2 Rep  (K), then S 1 (' i ) 2 R.
Proof of claim. Suppose that ' i is satisfiable and let R 2 Rep  (K). Since ' i is satisfiable, there exists a truth assignment ⌫ i of X i such that ⌫ i (' i ) = true. It follows that for every ...

a n V d , W d W d ' 1 ' 2 ... ' n S g S g S g c 1,1 ... c 1,m(1) c 2,1 ... c 2,m(2) c n,1 ... c n,m(n) x 1,1 ... x 1,l(1) x 2,1 ... x 2,l(2) x n,1 ... x n,l(n) * H H H H H H H Y A A ⌘ ⌘ ⌘ ⌘ ⌘ 3 Q Q Q Q Q k K m E m ⌘ ⌘ ⌘ ⌘ ⌘ 3 K m ✓ @ @ @ I F r F r ✓ @ @ @ I F r F r ✓ @ @ @ I F r F r 6 ✓ * 6 @ @ @ I H H H H H H Y 6 ✓ * 6 @ @ @ I H H H H H H Y P k 1 N k 2 N k 3 6 ✓ * 6 @ @ @ I H H H H H H Y clause c i,j of ' i , ⌫ i (c i,j ) = true so there exists k such that x i,k 2 c i,j and ⌫ i (x i,k ) = true or ¬x i,k 2 c i,j and ⌫ i (x i,k ) = false. Let A 0 ⌫ i ={S g (' i ) | 1  g  5} [ {P k l (c i,j , x i,h ) | x i,h l th literal of c i,j , ⌫ i (x i,h ) = true, 1  k  8} [ {N k l (c i,j , x i,h ) | ¬x i,h l th literal of c i,j , ⌫ i (x i,h ) = false, 1  k  8} and A ⌫ i be a ✓-repair of A 0 ⌫ i w.r.t. T . By construction, the conflicts of A 0 ⌫ i are of the form {P k l (c i,j , x i,h ), P k 0 l 0 (c i,j , x i,h )},{N k l (c i,j , x i,h ), N k 0 l 0 (c i,j , x i,h )} or {P k l (c i,j , x i,h ), N k 0 l 0 (c i,j , x i,h )}. Hence S g (' i ) 2 A ⌫ i (1  g  5
) and for each clause c i,j , there exists exactly one h such that

P k l (c i,j , x i,h ) 2 A ⌫ i or N k l (c i,j , x i,h ) 2 A ⌫ i (1  k  8) (otherwise A ⌫ i would not be maximal for set inclusion). Suppose for a contradiction that S 1 (' i ) / 2 R (thus S g (' i ) / 2 R, 1  g  5). Let Y = A ⌫
i \R and let X be the set of the assertions of R which conflict with some assertion of Y w.r.t. T . By construction of X, (R\X) [ Y is T -consistent. Since S g (' i ) 2 Y, 1  g  5, and letting n c be the number of clauses c i,j such that Remaining lower bounds. Applying Lemma 6.2.5, we can transfer the p 2 lower bound for instance queries under  P -AR and  P -brave semantics to the  w -AR and  w -brave semantics. The preceding p 2 [O(log n)] lower bound for instance queries under the -AR and -brave semantics transfers to the  P -AR and  P -brave semantics (under the bounded priority level assumption). The latter result can then be transferred using Lemma 6.2.5 to the  w -AR and  w -brave semantics (under the bounded weight assumption).

P k l (c i,j , x i,h ) 2 Y or N k l (c i,j , x i,h ) 2 Y (1  k  8), |Y | = 5 + n c ⇤ 8. X can contain at most 4 assertions of the form E m (a i 1 , ' i ) (if i is even), which conflict with the S g (' i ), and n c sets of 7 F r (' i , c i,j ) or of 8 N k l (c i,j , x i,h ) / 2 Y or 8 P k l (c i,j , x i,h ) / 2 Y , which conflict with the P k 0 l 0 (c i,j , x i,h ) 2 Y or N k 0 l 0 (c i,j , x i,h ) 2 Y (1  k 0  8).
We next give the combined complexity of query entailment under the different brave semantics. Proposition 6.2.7. Regarding combined complexity, CQ entailment over DL-Lite R KBs is p 2 [O(log n)]-complete under -brave, NP-complete under ✓ P -brave, and p 2 -complete under  P -brave and  w -brave semantics. If there is an ABox-independent bound on the number of priority classes (resp. maximal weight), CQ entailment under  P -brave (resp.

 w -brave) is p 2 [O(log n)]-complete.
Proof. For the upper bounds, we use the fact that in the decision procedures used in the proofs for data complexity, instead of guessing a repair and checking that it is a preferred repair that entails the query q, we can guess a repair together with a certificate that it entails q, and verify everything in P w.r.t. combined complexity. Therefore the "guess and check" step of all procedures is in NP, and the uppers bounds are the same w.r.t. combined complexity as w.r.t. data complexity. The lower bounds follow from the data complexity.

Finally, we establish the complexity of query entailment under the different IAR semantics. Proposition 6.2.8. Regarding data complexity, instance query and CQ entailment over DL-Lite R KBs is coNP-complete for the ✓ P -IAR semantics. For instance queries, we also have coNP-complete regarding combined complexity.

Proof. We can show that hT , Ai 6 |= ✓ P -IAR q as follows:

1. Guess a subset A 0 = {↵ 1 , . . . , ↵ m } ✓ A together with a subset R i ✓ A with ↵ i 6 2 R i for each 1  i  m.
2. Verify that (i) each R i is a ✓ P -repair and (ii) hT , A \ A 0 i 6 |= q.

Since ✓ P -repairs can be identified in polynomial time (cf. proof of Proposition 6.2.3) and query entailment is in P for data complexity, the above procedure runs in non-deterministic polynomial time in the size of A. We thus obtain a coNP upper bound for data complexity.

For instance queries, query entailment is in P for combined complexity, so we obtain an coNP upper bound also for combined complexity.

6.3 Query answering via reduction to SAT for ✓ P -repair based semantics arguments to above, we can infer that there is some there must exist some 2 R with P ↵ and 2 confl({↵}, K). Since ↵ 2 R q , it follows from the definition of the set R q that 2 R q , hence 2 R 0 . We thus have ⌫ R 0 (x ) = true, and so the clause for ↵ is satisfied. This proves that ' max is satisfied by ⌫ R 0 . Finally, since R 0 is T -consistent, it contains no conflicts, and so ⌫ R 0 satisfies ' cons . We have thus exhibited a satisfying assignment for the formula ' ¬q ^'max ^'cons .

For the ✓ P -IAR semantics, a query is not entailed just in the case that every cause is absent from some ✓ P -repair. This can be tested by using one SAT instance per cause. Theorem 6.3.5. For each C 2 causes(q, K), consider the formulas:

' ¬C = _ ↵2C _ 2confl({↵},K) P ↵ x ' C max = ↵ 2R C (x ↵ _ _ 2confl({↵},K) P ↵ x ) ' C cons = ↵, 2R C 2confl({↵},K) ¬x ↵ _ ¬x
where R C is the set of assertions reachable in G P K from some assertion such that x appears in ' ¬C . Then K |= ✓ P -IAR q iff there exists C 2 causes(q, K) such that the formula

^'C

max is satisfiable for every C 2 causes(q, K) just in the case that there is no cause of q in the intersection of the ✓ P -repairs of A w.r.t. T , i.e. K 6 |= ✓ P -IAR q. For the ✓ P -brave semantics, a query is entailed just in the case that some cause is present in some ✓ P -repair. Theorem 6.3.6. Let q be a Boolean CQ, K = hT , Ai be a DL-Lite R KB, and P = hP 1 , . . . , P n i be a prioritization of A.

' q = ( _ C2causes(q,K) w C ) ^Ĉ2causes(q,K) ↵2C ¬w C _ x ↵ ' max = ↵ 2Rq (x ↵ _ _ 2confl({↵},K) P ↵ x ) ' cons = ↵, 2Rq 2confl({↵},K)
¬x ↵ _ ¬x Fig. 6.6 Time in seconds for query answering under ✓ P -AR w.r.t. the ratios of conflicts on u1cYpZW (about 76K assertions), for four prioritizations. For readability, the figures on the bottom focus on the queries whose answering times are lower and whose behaviors are thus not visible on the first one.

Fig. 6.7 Time in seconds for query answering under ✓ P -AR w.r.t. the ratios of conflicts on u20cYpZW (about 2 million assertions), for four prioritizations. For readability, the figures on the bottom focus on the queries whose answering times are lower and whose behaviors are thus not visible on the first one.

Fig. 6.8 Time in seconds for query answering under ✓ P -AR w.r.t. the size of the ABox on uXc1pZW (about 4% of assertions involved in some conflict), for four prioritizations. For readability, the figures on the bottom focus on the queries whose answering times are lower and whose behaviors are thus not visible on the first one.

Implementation and experiments

Figure 6.9 shows the evolution of the query answering time w.r.t. the proportion of conflicting assertions for u1cYp3a in three cases: ✓ P -AR query answering, and ✓ P -AR and ✓ P -IAR with two different methods: method 1 is the standard method described in Section 6.3, and method 2 consists in deciding for the relevant facts whether they hold under ✓ P -IAR before deciding whether the answer is entailed under ✓ P -IAR or ✓ P -AR semantics. Figure 6.10 shows the evolution of the query answering time w.r.t. the ABox size for uXc1p3a in the same cases. Table 6.2 shows, per query for some prioritized ABoxes, how many answers were in the approximation of ✓ P -IAR, the number of ✓ P -IAR answers (not in the approximation), of ✓ P -AR answers (not ✓ P -IAR), and the number of candidate answers which are not ✓ P -AR.

Computing the exact set of ✓ P -IAR answers is very costly when there are lots of ✓ P -AR answers not in the approximation of ✓ P -IAR (columns ✓ P -IAR and ✓ P -AR in Table 6.2).

The method consisting in computing the set of ✓ P -IAR assertions among the relevant ones is generally less robust to conflicts and ABox size. However, it sometimes performs better on easy cases.

Preferred repair semantics Fig. 6.9 Time in seconds for query answering under ✓ P -AR, or ✓ P -AR and ✓ P -IAR w.r.t. the proportion of conflicts on u1cYp3a. For readability, the figures on the bottom focus on the queries whose answering times are lower and whose behaviors are thus not visible on the first one.

RELATED WORK

In this chapter, we position our work in a more general context and provide more details on some topics mentioned in the other chapters.

Consistent query answering outside DL

Consistent query answering (CQA), which corresponds to query answering under AR semantics in the database setting, has been introduced in [Arenas et al. 1999]. Contrary to DLs, the closed world assumption is generally made, so the facts that are not in the database are considered false. It follows that the violations of integrity constraints of the form 8xA(x) ) B(x) can be solved by removing or adding tuples (e.g. if the database contains only A(a) with the example constraint, we can either remove A(a) or add B(a) to restore consistency). A repair is generally defined as a database that is consistent with the integrity constraints and whose symmetric difference to the original database is inclusion-minimal. The computational complexity of CQA with different kinds of integrity constraints and queries has been extensively studied, and algorithms have been proposed for the different combinations of classes of constraints and queries (see [Bertossi 2006, Chomicki 2007, Bertossi 2011] for surveys about CQA).

In [Calì et al. 2003], several semantics are defined for inconsistent and incomplete databases, by considering the database instances that satisfy the integrity constraints and are either supersets (sound semantics) or subsets (complete semantics) of the initial database instance. In order to avoid that the violation of a constraint leads to the non-existence of such instances in the sound case, loose versions of these semantics are introduced. They consider the consistent databases that are "as close as possible" to the actual database instance, w.r.t. the intersection (sound semantics) or the difference (complete semantics) with the initial database. The loosely-sound semantics therefore corresponds exactly to the AR semantics, since these database instances correspond to the models of the repairs (in the DL sense) of the actual instance.

Regarding variants of CQA, [Lopatenko & Bertossi 2007] considers repairs whose symmetric difference to the original database is cardinality-maximal, but also aggregate attribute repairs, which are attribute-based repairs (under which database instances can be repaired by changing attributes values in existing tuples only), which minimize a numerical aggregation function over attribute changes throughout the database. Recently, [Pfandler & Sallinger 2015] proposed another variant where the distance between the repairs and the original database is bounded. Note that contrary to preferred repair semantics, a distance-bounded repair is not guaranteed to exist. In this case, every query is considered not entailed under distance-bounded CQA.

Consistent query answering has also been investigated for ontologies given by existential rules. The data complexity of query answering under AR, IAR, and ICR semantics is studied in [START_REF] Lukasiewicz | [END_REF], and [START_REF] Lukasiewicz | [END_REF] analyzes the combined complexity (as well as bounded-arity combined complexity, where the arity of the predicates is bounded, and fixed-program combined complexity, which amounts to fix the TBox in DL setting) of AR query answering for the main decidable classes of existential rules enriched with negative constraints.

Recently, the AR semantics has been generalized in [START_REF] Eiter | [END_REF]] so that rules and rule instances, not just database facts, can be removed to restore consistency. This would correspond to removing or altering TBox axioms in the DL setting. Generalized repairs are obtained by minimally removing database facts and rules, and local generalized repairs by minimally removing database facts and rule instances but not whole rules (e.g. if we have the rules 8xA(x) ) B(x) and 8xB(x) ^C(x) ) ? and the facts A(a) and C(a), it is possible to restore consistency by removing the rule instance A(a) ) B(a)). In both cases, it is allowed to define sets of hard rules and facts that cannot be removed.

Explanations

Justifications of entailed axioms

As mentioned in Chapter 4, there has been significant interest in equipping DL reasoning systems with explanation facilities. The earliest work proposed formal proof systems as a basis for explaining concept subsumptions [McGuinness & Borgida 1995, Borgida et al. 2000], while the post-2000 literature mainly focuses on axiom pinpointing [START_REF] Schlobach | [END_REF], Kalyanpur et al. 2005, Horridge et al. 2012], in which the problem is to generate minimal subsets of the KB that yield a given (surprising or undesirable) consequence. Such subsets are often called justifications. It should be noted that work on axiom pinpointing has thus far focused on explaining entailed TBox axioms (or possibly ABox assertions), and in particular on TBox debugging by explaining unsatisfiable classes. In our work, we assume that the TBox has been properly debugged, so is consistent and correct, i.e. all consequences of the TBox are desirable. This work on axiom pinpointing can therefore be seen as a first step that allows us to be sure that the errors stem from the data.

For the lightweight DL EL+, justifications have been shown to correspond to minimal models of propositional Horn formulas and can be computed using SAT solvers [Sebastiani & Vescovi 2009]; a polynomial algorithm has been proposed to compute one 7.2 Explanations justification in [START_REF] Baader | [END_REF]]. In DL-Lite, the problem is simpler: all justifications can be enumerated in polynomial delay [START_REF] Peñaloza | [END_REF].

Beside computing efficiently justifications, several works addressed the problem of making them understandable for the user, either by studying their cognitive complexity [Horridge et al. 2011], or by grouping justifications that have a similar structure to help to handle large number of justifications [START_REF] Bail | [END_REF]. Our experiments showed that a query answer can possess a very large number of explanations, many of which are quite similar in structure. It could therefore be interesting to investigate ways of improving the presentation of explanations, e.g. by identifying and grouping similar explanations as has been done for justifications, or by adopting a factorized representation (like in [Olteanu & Zavodny 2012]).

Explanation of query answers

The problem of explaining answers to conjunctive queries over DL-Lite KBs is considered in [START_REF] Borgida | [END_REF]] which provides a proof-theoretic approach to explaining positive answers. The proof of an answer involves the ABox assertions and TBox axioms used to derived it. As mentioned in Chapter 4, the difficulty of such proofs could provide an additional criteria for ranking explanations, and the work on the cognitive complexity of justifications may give clues on this difficulty.

Probably the closest related work is [START_REF] Arioua | [END_REF] which introduces an argumentation framework for explaining positive and negative answers under the inconsistency-tolerant semantics ICR. Their motivations are quite similar to our own, and there are some highlevel similarities in the definition of explanations (e.g. to explain positive ICR-answers, they consider sets of arguments that minimally cover the preferred extensions, whereas for positive AR-answers, we use sets of causes that minimally cover the repairs). They propose to compute one explanation for a positive or negative ICR-answer with a hitting set algorithm, applied either on the sets of supporting arguments (which correspond to our causes) present in each extension (corresponding to the repair), or on the set of attacking arguments (which correspond to the conflicts of the causes). Our work differs from theirs by considering different semantics and by providing detailed complexity analysis, in which we do not assume that the set of repairs is given, and an implemented prototype. Another argumentation framework has been proposed for ground BCQs explanation under IAR and brave semantics in [Arioua & Croitoru 2016a], then under AR semantics in [Arioua & Croitoru 2016b], and has been implemented in the DALEK prototype.

Finally, we note that the problem of explaining query results has been studied in the database community (cf. [START_REF] Cheney | [END_REF]] for a survey). The lineage of a query answer is the set of tuples of the database that contribute to produce the answer, i.e. the union of the images for the answer. The why-provenance corresponds to the images and the minimal witness basis to the set of causes of the answer. The how-provenance describes how a result was produced from the tuples. The where-provenance provides the location (i.e. relation, tuple and attribute) of the values in the answer tuple.

Query abduction

Since we defined explanations for a negative AR-or IAR-answer using assertions of the ABox that conflict its causes, defining explanations for negative brave-answers (which have no cause) would significantly differ in spirit. The problem of explaining negative answers has been primarily seen as the problem of finding a minimal dataset to be added to the data to get the missing answers, i.e. as query abduction, both in the DL (cf. [Calvanese et al. 2013, Du et al. 2014] for DL-Lite and [Wang et al. 2015] for ELH ? ) and in the database arena (cf. [START_REF] Herschel | [END_REF]). In both settings, restrictions on the signature of the explanation are allowed. Note that a different approach related to query debugging was proposed in the database context [START_REF] Bidoit | [END_REF], and focuses on finding subqueries responsible for pruning the missing answer from a query result. This approach is less relevant to our setting since conjunctive queries over DL KBs are much simpler and less error-prone than SQL queries.

The complexity of the decision problems related to explaining negative answers in DL-Lite (recognition and existence of an explanation, necessity and relevance of an assertion) is studied in [Calvanese et al. 2013]. An implementation that computes explanations in DL-Lite was presented in [Du et al. 2014] and the case of inconsistent KBs is treated in [START_REF] Du | [END_REF], where an explanation is a set of assertions to add that will lead to the answer holding under IAR semantics. These three papers tackle the issue of preferred explanations: Calvanese et al. consider subset or cardinality-minimal explanations, whereas Du et al. introduce the notion of representative explanation, which is an explanation that is minimal (when allowing renaming of fresh individuals to compare explanations) and is not subsumed by any other (e.g. if Advise(ann, ann), Advise(ann, bob), and Advise(ann, ind) where ind is a fresh individual are the explanations for ann not being an answer to 9yAdvise(x, y), the last one is the unique representative explanation), and cardinality-minimal preferred explanations for a preference relation based on cardinality-preserving substitutions.

The idea of representative explanation could be used for presenting our explanations, treating the individuals that are mapped to existentially quantified variables in the same way as Du et al. treat fresh individuals. The framework of query abduction could also be a useful starting point for providing users with suggestions of assertions to add when insertions are needed to satisfy some answers during query-driven repairing. As mentioned in Chapter 5, it would be natural to restrict the signature of the explanations to avoid adding some predicates. It would also be crucial to exploit the interaction between the answers of the QRP and to define proper preference relations. For instance, we should favor the insertion of assertions that do not create causes for unwanted answers or participate in creating causes for several unsatisfied wanted answers.

Evolution, revision and updates

The problem of making a knowledge base evolve has been intensively explored in the past decades. Belief revision [Gärdenfors 1992] consists in incorporating new information in a KB while preserving consistency. Different operators have been defined for removing or 7.3 Evolution, revision and updates adding a sentence to a logical theory. A commonly agreed criterion is that the changes to the original belief set have to be minimal, but minimality can be defined at the syntactic level (formula-based changes), or at the level of the models of the knowledge base (model-based changes). The former approach seems more reasonable if the KB corresponds to a body of explicit belief, while the latter respects the principle of irrelevance of syntax that expresses that two KBs which have the same models are equivalent so should lead to equivalent revised KBs. Note that in our setting, since we treat inconsistent KBs that have no models, formula-based approaches make more sense.

When there are several KBs that realize the revision and differ minimally from the initial KB, several strategies have been proposed. Among the approaches considered in [START_REF] Eiter | [END_REF]], the three formula-based approaches consider the formulas true in all (Ginsberg's approach), some (Cross-Product), or the intersection (When In Doubt Throw It Out) of the possible worlds. The AR, brave and IAR semantics correspond to these approaches. The latter is used in [Nebel 1991] in the context of belief revision, and [START_REF] Fagin | [END_REF]] considers the Cross-Product strategy for updating databases.

It is widely accepted that some pieces of knowledge are more important or reliable than others. Partitioning the KB into levels of priority is a natural solution [START_REF] Fagin | [END_REF], Nebel 1991]. In particular, in [START_REF] Fagin | [END_REF], they are used to make database integrity constraints take priority over database facts, since the authors consider that the constraints should not be given up because of an update in the data that violates them.

Many works address belief change in the DL setting. The model-based approach for instance-level update and erasure (i.e. addition or deletion of a set of assertions) is studied in [START_REF] De | [END_REF]], with a focus on DL-Lite F . Since the KB resulting from such an update may not be expressible in the DL of the initial KB, the authors introduce a minimal extension of DL-Lite F closed for instance-level updates and use it to construct an approximated instance-level update and erasure for DL-Lite F KB. The formula-based approach is considered in [START_REF] Calvanese | Evolution of DL-Lite Knowledge Bases[END_REF]] which proposes novel update strategies for which evolution is expressible in DL-Lite to overcome the limitation of the Cross-Product approach (which leads to KBs not expressible in DL-Lite), while losing less information than with the "When In Doubt Throw It Out" approach. Similar problems have been explored in [Calvanese et al. 2015], where different inconsistency-tolerant semantics for querying and updating knowledge and action bases are defined.

While the new piece of information is traditionally considered more reliable than the initial KB, [Ahmeti et al. 2016] defines three semantics for SPARQL instance-level updates that do not systematically give preference to the update: the cautious semantics rejects updates potentially introducing conflicts; the brave semantics gives favor to the new information, and the fainthearted semantics is a compromise between the former two approaches which incorporates as much of the new information as possible, as long as consistency with the prior knowledge is not violated.

Closer to our work on query-driven repairing is the problem of modifying DL KBs to ensure (non) entailments of assertions. The erasure operation, which consists in deleting an entailed statement, is tackled from a practical point of view in [Gutierrez et al. 2011] for RDFS knowledge bases. When the erasure concerns the schema, the possible solutions correspond to the minimal cuts in the path from the causes to the unwanted consequence. In the case of instance erasure, when the schema should be left untouched, the erasure is unique and amounts to removing the (singleton) causes of the unwanted assertion.

Our query-driven repairing framework is inspired by that of [START_REF] Jiménez-Ruiz | [END_REF], in which a user specifies two sets of axioms that should be entailed or not by a KB. Repair plans are introduced as pairs of sets of axioms to remove and add to obtain an ontology satisfying these requirements. Deletion-only repair plans are studied in [START_REF] Jiménez-Ruiz | [END_REF] where heuristics based on the confidence and the size of the plan are used to help the user to choose a plan among all minimal plans. Axioms that occur in all plans (i.e. are necessary to remove to be able to find a solution) are also marked. We adapted their framework to the setting of conjunctive queries and inconsistent KBs, using inconsistency-tolerant semantics. This leads us to consider not only the causes of the answers, but also the conflicts of the causes of wanted answers, since a tuple may be a negative IAR-answer because of the presence of erroneous assertions that contradict its causes. The main difference with our work is in the treatment of the problem: Jiménez-Ruiz et al. compute all solutions (if there are any) and present them to the user, while we investigate the case in which the assertions that can be added are not in a known finite set (so it is not possible to compute all solutions), and we look for approximations when there is no solution and ensure that a solution will actually satisfy every answer. In the case of deletion-only repair plans, instead of computing all solutions and presenting them, we propose to help the user to find which assertions to remove. We integrate a notion of impact similar to that presented in [START_REF] Nikitina | Nadeschda Nikitina, Sebastian[END_REF]. The latter paper studies the problem of interactive KB revision where each axiom of a KB has to be (in)validated by an expert, and the goal is to reduce the expert effort by ordering the axioms to evaluate to maximize the automatic (in)validation of axioms.

Compared with the work of Jiménez-Ruiz et al., one distinguishing feature of our work is the specifications of the changes at the level of query answers. The main idea of our querydriven repairing approach is the same as in [START_REF] Bergman | [END_REF]]: erroneous or missing answers are indicated by the user and the data has to be repaired by asking the user if some tuples are valid or not. The strategy presented in the latter work consists in repeating the two following steps until the objectives are achieved: (i) remove all erroneous answers, one after the other, by removing singleton causes (necessarily false) then questioning the user about the tuples that appear in the highest number of causes; (ii) add the missing answers by asking the user to complete a partial cause.The authors also study the impact of using several imperfect experts for this process and try to split the query to help the user to find a cause for a missing answer. The main difference of our approach is that we take into account all answers at the same time to increase the number of necessarily false assertions. The number of causes in which a tuple appears, as well as other criteria mentioned in [START_REF] Bergman | [END_REF], such as responsibility or trust scores could be considered to refine our ranking.

Inconsistency and uncertainty handling in DL

Note that the problem of modifying the data to make some consequences hold is also related to the problem of view update in databases where the data modification is specified at the level of a view, which corresponds to a query, and the corresponding database update has to be found [START_REF] Fagin | [END_REF].

Inconsistency and uncertainty handling in DL

The problem of dealing with inconsistencies has been considered in several areas of knowledge representation and reasoning (cf. survey [Bertossi et al. 2005]). Regarding DL-based ontologies, [START_REF] Haase | [END_REF] surveys four different approaches to handling inconsistency: consistent ontology evolution, which has been discussed in the preceding section, locating and repairing inconsistencies, reasoning in the presence of inconsistencies, and multi-version reasoning, which considers not only the latest version of an ontology, but also all previous versions to deal with inconsistencies that arise from the interaction of the ontology with its environment.

A general framework for reasoning in the presence of inconsistent ontologies is presented in [START_REF] Huang | [END_REF]]. The authors define some desirable properties for an inconsistent reasoner, among them soundness, which requires that every formula that follows from an inconsistent KB follows from a consistent subset using a classical reasoner, and meaningfulness, which requires that the reasoner does not allow to derive contradictory statements. In our setting, semantics that are sound approximations of brave fulfill the soundness criteria, and complete approximations of AR, as well as CAR and ICAR and k-lazy semantics are meaningful according to this definition.

An alternative way to get meaningful answers from an inconsistent theory is to adopt paraconsistent logics, which have more than two truth values (most often four (Belnap's logic): true, false, undefined and over-defined). For DL KBs, a four-valued semantics is defined in [START_REF] Zhou | [END_REF], Maier et al. 2013]. We give the idea of this semantics using simple ontologies consisting of axioms of the forms A v B and A v ¬B, where A, B 2 N C . A four-valued interpretation I over a domain I maps each concept A to a pair of sets hA I Inconsistency is quite related to uncertainty. First because uncertainty may arise from inconsistency, for instance the answers to a query under different inconsistency-tolerant semantics could be seen as more or less certain. Second because inconsistency can be avoided to some extent by expressing that we are not sure of some pieces of knowledge, so that two contradictory but unsure statements can coexist. Different ways of dealing with uncertain DL KBs have been proposed.

P , A I N i of individuals. The inclusion A v B is satisfied if A I P ✓ B I P , A v ¬B is satisfied if A I P ✓ B I N ,
The first and most widely studied proposition is the use of probability to model uncertainty. There has been a number of proposals for probabilistic DLs. In [Jaeger 1994], probabilistic KBs associate probabilities to the ABox assertions, and the TBox contains both classical terminological axioms and probabilistic terminological axioms that take the form of conditional probability which express statistical probabilities. In [START_REF] Lutz | [END_REF], the authors introduce an operator that allows them to construct complex concepts involving priorities and to express probability on conjunctions of (negated) assertions. In the OMQA setting, [Jung & Lutz 2012] introduces probabilistic ABoxes that associate expressions built on probabilistic events to ABox assertions and probabilities to these events, and computes the probabilities of conjunctive query answers.

In possibilistic DLs [START_REF] Qi | [END_REF], each axiom is associated with a degree of certainty, and the ↵-cut of a KB consists of the axioms of degree greater than ↵. The inconsistency degree Inc of a KB is the maximal degree such that the corresponding cut is inconsistent, and the plausible consequences of the KB are the consequences of its Inc-cut. Recently, [START_REF] Benferhat | [END_REF]] investigated inconsistency-tolerant semantics in possibilistic DL-Lite, which extend the plausible consequences, for instance by adding to the Inc-cut the assertions that are free of conflicts, or conflicted only by assertions of lower degree of certainty.

Subjective DLs [START_REF] Garcia | [END_REF]] extend ABox assertions with opinions (b, d, u) where b is a degree of belief, d the degree of disbelief, and u the degree of uncertainty (b + d + u = 1). The semantics is given in terms of interpretations that map each individual to an element of the domain, and each concept (resp. role) to a function that associates to every element (resp. pair of elements) of the domain an opinion. For instance, an interpretation I satisfies an assertion A(a) if the degree of belief and disbelief associated to A I (a I ) are greater than those of the opinion associated to A(a). The problem of instance checking amounts to find the most general opinion associated to a given assertion, and query answering is defined accordingly.

Note that fuzzy DLs [START_REF] Straccia | Umberto Straccia. Reasoning within Fuzzy Description Logics[END_REF]] model vagueness rather than uncertainty, by providing degree of membership for concepts for which there exists no sharp distinction between members and nonmembers (e.g. for two concepts describing temperature cold and hot, some intermediate values could be assigned to both concepts, with a degree of membership lower than 1. Notice that in this case, it would not make sense to state that these two concepts are disjoint).

CONCLUSION AND PERSPECTIVES

Summary of our contributions

In this thesis, we defended the idea that it is possible to deal with inconsistent data in a satisfying and efficient way, which is a crucial point for spreading the use of ontologies allowing for disjointness axioms or functional roles. Indeed, until now, most of ontologybased data-rich applications simply avoid inconsistency, either by using simple ontologies that do not allow for contradiction, or by rejecting any update of the data that will lead to inconsistency. We focused on the AR semantics, which is the most well-known and arguably the most natural semantics, since it can be seen as a generalization to the inconsistent case of the classical semantics, under which the certain answers have to hold in every model of the KB. We also use the IAR and brave semantics, which we consider as lower and upper bounds of the possible answers. As a first step, we proposed an efficient approach to compute the answers under these three semantics, and our experimental evaluation showed promising results. We then addressed three problems that should support the adoption of this framework: query result explanation, to help the user to understand the different levels of confidence of the answers he obtained, query-driven repairing, to capitalize on the user feedback about query results to improve the data quality, and preferred repair semantics, to take into account the reliability of the ABox assertions. For these three issues, we came up with a solution framework, analyzed the complexity of the related problems, and proposed and implemented algorithms, which we empirically studied over an inconsistent DL-Lite R benchmark we built. Our results indicate that even if the problems related to dealing with inconsistent DL-Lite R KBs are theoretically hard, they can often be solved efficiently in practice by using tractable approximations and features of modern SAT solvers.

Discussion and perspectives

We conclude this dissertation by discussing some of our results and possible directions for future work. disjointness using ?, query answering under IAR and brave semantics is intractable w.r.t. data complexity for instance queries, while query answering is in P under classical semantics. However, for EL ? , AR query answering has the same complexity as in DL-Lite. It would be interesting to see if query answering under these semantics can be done efficiently for EL ? , since the IAR semantics does not provide a tractable approximation of AR in this setting.

Using other query answering techniques

Our approach is based on the computation of the causes of the answers, which are obtained straightforwardly using the UCQ rewritings of the initial queries. Our system uses the tool Rapid that implements the algorithm of [START_REF] Chortaras | [END_REF] to reformulate the query, but we could use any algorithm that produces such rewritings. However, database management systems perform poorly on large UCQs, and it is not uncommon for UCQ rewritings to be (very) large (there were more than 200,000 CQs in the rewritings of some queries of our benchmark!). That is why FOL rewritings that can be evaluated more efficiently in practice than the standard UCQs have been proposed. In [Thomazo 2013a], an algorithm that rewrites a conjunctive query in a union of semi-conjunctive queries (which are conjunctions of disjunctions) is proposed. In [Bursztyn et al. 2015, Bursztyn et al. 2016], the authors introduce a space of reformulated queries which are joins of unions of conjunctive queries, from which the reformulated query with the lowest estimated evaluation cost is selected. Another promising approach is the use of non-recursive Datalog rewritings. The algorithm Presto presented in [START_REF] Rosati | [END_REF] generates a non-recursive Datalog program instead of a UCQ, and produces a query that is not exponential in the number of atoms of the initial query but only in the number of a subset of the join variables of the query typically much smaller. In [START_REF] Eiter | [END_REF]], the Clipper system, which implements an algorithm for rewriting queries over Horn-SHIQ ontologies that transforms the query into a Datalog program ready for evaluation over any ABox, performs well over DL-Lite KBs.

To improve the performance of our system for queries that have a long evaluation time, we could try to use such optimized techniques to find the candidate answers, and then evaluate only the Boolean UCQ rewritings instantiated with these answers to retrieve their causes. Indeed, they would contain less variables and so would be easier to evaluate than the original UCQs. It would probably be useful for queries with a limited number of answers. An open question is whether it is possible to compute the causes more directly, without the UCQs.

Note that the alternative method to rewriting for query answering in DL-Lite, namely the combined approach [START_REF] Lutz | [END_REF], which saturates the data by adding to the ABox every assertion that can be derived and introduces constants to witness existential role restrictions, then uses a special rewriting to prune spurious answers, cannot be straightforwardly adapted to our setting. Indeed, this approach is based on the fact that a DL-Lite KB has a canonical model which is such that the answers of a query in the canonical model are the same as those over the KB, and the inconsistency-tolerant semantics are based on repairs that each has its own canonical model. For IAR semantics, it is possible to compute the intersection of the repairs then use the combined approach over the resulting consistent KB, but in this case updating the saturated intersection when the original ABox is modified will be non-trivial.

Conclusion and perspectives

Developing and enhancing this work

Explanation framework The explanations we defined provide the basic information needed to understand positive and negative query answers under the AR, IAR and brave semantics. We could build a more complete explanation framework which allows the user to ask for the justification of such explanations (e.g. why is this set of assertions a cause for the query? which causes are contradicted by this assertion and why? in which causes is this assertion?). Such justifications would involve both ABox and TBox axioms and rely on related work about justifications of entailed axioms and query answer explanations. They could be computed on demand and we could find clues on how to select or present them in the literature (cf. Chapter 7.2).

Query-driven repairing framework Our work on query-driven repairing gives the basis for partially cleaning the data based on the user feedback at query time. There are many possible improvements to our algorithms. First, when insertions are allowed and needed, it is very important to help the user to find what insert. Besides the work on query abduction that will be very useful, we could use the specific aspects of this setting to propose insertions. For instance, when the wanted answers were initially entailed under brave semantics and lost their causes because of the deletion of some assertion, we could suggest that the user adds an assertion that "replaces" the assertion deleted (e.g. if we removed AProf(ann) and lose the wanted answer 9xProf(x), we could suggest to add Prof(ann)). In the same vein, we could present the consequences of the deleted assertions to the user to ask him if he wants to preserve some of them. It would also be interesting to see how allowing the insertion of ABox assertions using variables, as it is done for the language introduced in [START_REF] De | [END_REF], impacts the problem. Another approach which could be interesting is to try to find which assertions have to be removed by asking more general questions to the user to obtain part of his knowledge. For instance suppose that a QRP involves several assertions from which derives Prof(ann), and others from which derives Postdoc(ann), that Person(ann) is wanted and that Prof and Postdoc are disjoint subconcepts of Person. Then asking for the truth value of Prof(ann) will allow us to discover that several assertions are false if the answer is different from unknown. Finally, our algorithm for deletion-only repair plans could be improved by refining the impact we use to rank the assertions, optimizing its computation or considering ranking only a part of the relevant assertions.

Preferred repairs We provided algorithms for the semantics based on ✓ P , but did not investigate further the three other cases, which are computationally harder. It would be interesting to find a good way of performing query answering under these semantics, especially  w , which can also translate different levels of reliability but allow for compensation between the priority levels.

It would also be interesting to extend our explanation framework to the case of preferred repair semantics. Indeed, a starting point for explaining a positive or negative answer under these semantics would be the explanations defined in the same way as in the classical case (i.e. causes included in some preferred repair, or in the intersection of the preferred repairs, disjunctions of causes that cover the preferred repairs, minimal consistent subsets of the ABox contradicting every cause and belonging to some preferred repair...), but we also need to explain why a given cause is in some or all preferred repairs for instance. In the case of the ✓ P based semantics, it should still be possible to provide explanations that involve only a restricted part of the ABox, since it is possible to reason locally to decide whether a query is entailed or not under these semantics.

System, benchmarks and experiments Our CQAPri system is a prototype, which aims at analyzing the behavior of our algorithms. We therefore focused on the algorithmic part of the system rather than on the query evaluation part or on the presentation of query results. A real system for inconsistency-tolerant query answering should be able to use different rewriting systems, be more flexible on the way of storing the data, and implement an interface for efficiently displaying the results and interacting with the user. Working on these points would probably result in gains in performance.

We did our best to experimentally evaluate our algorithms and built an experimental setting over a well-known benchmark by adding contradictions in data in a way as realistic as we could. However, LUBM 9 20 is an artificial benchmark whose data is very regular, and it would be important to find more natural and varied data to test our framework in a more realistic setting. As discussed in Section 3.4.2, there have been very few experiments conducted over DL-Lite KBs with inconsistent ABoxes, and we did not find any satisfying benchmark.

Another parameter that should be taken into account in the experiments to go further is the user. Indeed, when providing explanations or support for repairing, the major objective is to help a user to operate inconsistent data. The next step should therefore be to conduct experiments with users to understand better what are their needs and how the explanations or suggestions of assertions to remove to repair the ABox are useful and can be improved.

Going a step further

B RÉSUMÉ EN FRANÇAIS

Interrogation de données en présence d'ontologies L'accroissement du volume des données disponibles pose le problème de savoir les exploiter. Interroger les données de façon précise et efficace est une tâche complexe. Il est notamment nécessaire de permettre l'intégration de données provenant de différentes sources utilisant des vocabulaires différents et la formulation de requêtes d'une manière simple et intuitive, dans un vocabulaire proche de celui de l'utilisateur. Par exemple, supposons que quelqu'un cherche à trouver les professeurs d'un département qui enseignent un cours lié à l'intelligence artificielle à partir d'une liste des membres du département avec l'intitulé de leur poste et une liste des cours avec leurs enseignants. Si il intègre simplement ces données dans une base de données traditionnelle et formule directement sa requête "sélectionner tous les professeurs qui enseignent l'intelligence artificielle", il peut rencontrer les problèmes suivants: d'abord l'intitulé des postes ne sera pas "professeur" mais plutôt "professeur titulaire", "professeur assistant", ou "professeur associé" par exemple, ensuite de nombreux cours qui concernent un sous-domaine de l'intelligence artificielle ne seront pas pris en compte par cette requête (par exemple les cours répertoriés comme traitant de "raisonnement automatique", "représentation des connaissances" ou "logiques de description" ne seront pas reconnus comme des cours d'intelligence artificielle). Il doit donc d'abord trouver les différentes dénominations qui correspondent à un poste de professeur et les différents domaines et sous-domaines de l'intelligence artificielle, puis reformuler sa requête en conséquence. L'interrogation de données en présence d'ontologies est un paradigme récent qui ajoute une couche sémantique au-dessus des données à l'aide d'une théorie logique appelée ontologie, qui formalise la connaissance à propos d'un domaine d'intérêt et est utilisée pour raisonner sur les données pour fournir des réponses plus complètes aux requêtes. Dans notre exemple, ajouter aux données une ontologie qui donne des informations sur les domaines et sous-domaines de l'informatique et sur l'organisation de l'université permettra à l'utilisateur d'obtenir toutes les réponses pertinentes en posant sa requête de la manière qui lui est naturelle.

Les logiques de description [Baader et al. 2003] sont une famille de fragments de la logique du premier ordre qui sont largement utilisées comme langages d'ontologie. Une base de connaissances exprimée en logique de description est constituée d'une ontologie, appelée TBox, qui exprime des connaissances générales et des règles à propos du domaine d'intérêt, et d'un ensemble de données, appelé ABox, qui donne des informations sur des individus spécifiques. Par exemple, la TBox d'une base de connaissances sur le domaine de l'université pourrait indiquer que les cours sont enseignés par des enseignants et suivis par des étudiants, et sa ABox pourrait spécifier qu'un individu nommé Ann donne un cours de base de données qui est suivi par un autre individu Bob.

Enrichir les données avec une ontologie a un prix: cela augmente la complexité algorithmique de la réponse aux requêtes. Le passage à l'échelle étant essentiel pour les applications riches en données, les logiques de description dites légères, qui offrent un bon compromis entre l'expressivité du langage et la complexité des problèmes de raisonnement associés, ont suscité un intérêt croissant. En particulier, la famille DL-Lite [Calvanese et al. 2007] a été spécialement conçue pour l'interrogation de données en présence d'ontologies qu'elle permet de réduire, par réécriture de la requête, à l'évaluation standard d'une requête sur une base de donnée. Dans cette thèse, nous adoptons le langage DL-Lite R qui est le dialecte de la famille DL-Lite à la base de OWL 2 QL [Motik et al. 2012], le profil du standard pour le web sémantique OWL2 pour la réponse aux requêtes.

Gestion des incohérences

Un problème important qui se pose dans le contexte d'interrogation de données en présence d'ontologies est de traiter le cas où les données sont incohérentes avec l'ontologie. En effet, alors que la TBox est généralement de taille limitée et soigneusement déboguée par des experts du domaine, la ABox est typiquement large, sujette à de fréquentes modifications, et peut résulter de l'intégration de différentes sources de données, ce qui rend les erreurs probables. Une base de connaissances incohérente impliquant toute formule logique, poser une requête sur une telle base renvoie toutes les réponses possibles formées à partir des individus de la base. Par exemple, si une base de connaissances indique qu'il est impossible d'être en même temps un professeur titulaire et un professeur assistant et qu'un individu Ann est indiqué comme étant les deux, la base de connaissances permettra de conclure non seulement qu'Ann est un professeur titulaire et assistant, mais aussi qu'Ann est un cours par exemple, ce qui est clairement indésirable.

Il y a deux attitudes possibles dans ce contexte. La première est de restaurer la cohérence, en abandonnant une ou plusieurs assertions portant sur l'ancienneté d'Ann dans notre exemple, mais il peut être impossible de le faire d'une façon satisfaisante. En effet, nous ne savons souvent pas comment réparer les données (Ann est-elle un professeur titulaire ou assistant?), et supprimer toutes les informations impliquées dans des contradictions résulterait souvent en une perte d'information inacceptable. De plus, examiner à la main chaque conflit dans les données pour réparer une grande base de données serait trop coûteux. La seconde option est de décider de vivre avec les incohérences, en essayant d'obtenir des réponses qui ont du sens à partir de données incohérentes. Par exemple, il peut être acceptable de conclure qu'Ann est un professeur, mais pas que c'est un cours. Plusieurs sémantiques tolérantes aux incohérences ont été définies dans ce but. La plus connue est la sémantique AR [START_REF] Lembo | [END_REF], qui fournit les réponses qui sont vraies dans chaque sous-ensemble cohérent maximal des données, appelé réparation. Cette sémantique revient à accepter les réponses qui sont vraies quelque soit le monde possible choisi. Par exemple, elle permet de trouver qu'Ann est un professeur, sans information sur son niveau d'ancienneté. L'inconvénient de cette sémantique est qu'elle est difficile à calculer. En effet, pour des bases de connaissances en DL-Lite, la réponse aux requêtes conjonctives sous la sémantique AR est intractable, même quand la complexité est mesurée uniquement en fonction de la taille des données. Pour surmonter cette difficulté, une approximation de AR, appelée IAR, a été introduite dans [START_REF] Lembo | [END_REF]. Les réponses IAR sont obtenues en interrogeant l'intersection des réparations. Cette sémantique est aussi intéressante pour elle-même car elle retient seulement les réponses les plus sûres, dont les supports ne participent à aucune contradiction. Sous cette sémantique, aucune information à propos d'Ann ne sera obtenue, car les raisons de penser qu'Ann est un professeur prennent toutes les deux part à un conflit, donc ne sont pas complètement fiables. A l'autre bout de l'échelle, la sémantique brave donne toutes les réponses qui sont vraies dans au moins une réparation [START_REF] Bienvenu | [END_REF]. Il peut en effet être important pour certaines applications de ne manquer aucune réponse possible qui a une raison cohérente d'être vraie. Utiliser cette sémantique permet de trouver qu'Ann peut être un professeur titulaire aussi bien qu'elle peut être un professeur assistant.

Contributions

Le but de cette thèse est de développer des méthodes pour gérer en pratique des bases de connaissances incohérentes. En particulier, nous défendons l'idée que la sémantique AR, bien qu'intractable, peut être utilisée en pratique.

Notre première contribution est en effet une approche pour classer les réponses selon qu'elles sont conséquences de la base de connaissances sous sémantique IAR, AR ou brave. Pour la sémantique AR, les sémantiques brave et IAR fournissent des bornes supérieures et inférieures calculables en temps polynomial par rapport à la taille des données, et une traduction du problème en un problème de satisfiabilité propositionnelle nous permet de décider si les réponses braves et non-IAR sont vraies sous sémantique AR.

Au-delà de l'efficacité de la réponse aux requêtes, il est important de pouvoir expliquer les résultats des requêtes sous les sémantiques tolérantes aux incohérences. En effet, un utilisateur peut naturellement se demander pourquoi une réponse appartient à une de ces classes (e.g. pourquoi Ann est-elle indiquée comme un professeur pour la sémantique AR mais pas pour IAR?). C'est pourquoi notre seconde contribution est un cadre pour expliquer les réponses positives et négatives sous les sémantiques AR, IAR et brave (e.g. Ann est probablement un professeur car c'est un professeur assistant ou un professeur titulaire dans tous les mondes possibles, mais aucune de ces deux raisons n'est hors de doute car elles sont contradictoires).

Notre troisième contribution est une approche de réparation partielle des données guidée par les requêtes. En effet, bien que les sémantiques alternatives soient nécessaires pour utiliser des bases de connaissances incohérentes, elles ne dispensent pas d'améliorer la qualité des données. Nous proposons d'exploiter les retours des utilisateurs sur les résultats des requêtes qui sont corrects ou incorrects pour nettoyer les données en nous concentrant sur la partie utile pour l'utilisateur et qu'il connait suffisamment bien pour la réparer (e.g. si l'utilisateur sait qu'Ann est un professeur assistant, nous pouvons supprimer les données qui indiquent que c'est un professeur titulaire, puisqu'elle ne peut pas être les deux à la fois).

La dernière contribution de la thèse est l'étude de variantes des sémantiques AR, IAR et brave obtenues en remplaçant les réparations classiques par des réparations préférées. Cela nous permet de prendre en compte les informations sur la fiabilité des données (e.g. si l'information qu'Ann est un professeur assistant vient d'une source moins fiable que le fait qu'Ann est un professeur titulaire, nous pouvons garder uniquement les réparations qui contiennent ce dernier fait et conclure qu'Ann est un professeur même pour la sémantique IAR).

Pour chacun des sujets abordés, nous analysons la complexité des problèmes liés et proposons des algorithmes pour les résoudre, en exploitant les performances des SAT solveurs modernes pour résoudre en pratique les problèmes durs. Nous avons mis en oeuvre la plupart de ces algorithmes dans notre prototype CQAPri 1 et avons étudié leurs propriétés empiriquement à l'aide d'une base de connaissances incohérente que nous avons construite à partir du benchmark LUBM 9 20 .

Organisation de la thèse

La thèse est organisée comme suit:

Chapitre 2 Ce chapitre introduit l'interrogation de données en présence d'ontologies exprimées en logique de description et le langage DL-Lite R adopté dans ce travail. Dans la seconde partie du chapitre, nous passons en revue les sémantiques alternatives qui ont été proposées pour gérer des données incohérentes dans ce contexte. Abstract : The problem of querying description logic knowledge bases using database-style queries (in particular, conjunctive queries) has been a major focus of recent description logic research. An important issue that arises in this context is how to handle the case in which the data is inconsistent with the ontology. Indeed, since in classical logic an inconsistent logical theory implies every formula, inconsistency-tolerant semantics are needed to obtain meaningful answers. This thesis aims to develop methods for dealing with inconsistent description logic knowledge bases using three natural semantics (AR, IAR, and brave) previously proposed in the literature and that rely on the notion of a repair, which is an inclusion-maximal subset of the data consistent with the ontology. In our framework, these three semantics are used conjointly to identify answers with different levels of confidence.

In addition to developing efficient algorithms for query answering over inconsistent DL-Lite know-ledge bases, we address three problems that should support the adoption of this framework: (i) query result explanation, to help the user to understand why a given answer was (not) obtained under one of the three semantics, (ii) query-driven repairing, to exploit user feedback about errors or omissions in the query results to improve the data quality, and (iii) preferred repair semantics, to take into account the reliability of the data. For each of these three topics, we developed a formal framework, analyzed the complexity of the relevant reasoning problems, and proposed and implemented algorithms, which we empirically studied over an inconsistent DL-Lite benchmark we built. Our results indicate that even if the problems related to dealing with inconsistent DL-Lite knowledge bases are theoretically hard, they can often be solved efficiently in practice by using tractable approximations and features of modern SAT solvers.

Université Paris-Saclay Espace Technologique / Immeuble Discovery Route de l'Orme aux Merisiers RD 128 / 91190 Saint-Aubin, France

4

  Syntax and semantics of ABox assertions: a, b denote two individuals names, C a concept and R a role. Name Syntax Semantics Concept assertion C(a) a I 2 C I Role assertion R(a, b) ( a I , b I ) 2 R I

R

  In DL-Lite R , TBox axioms are concept inclusions B v C and role inclusions of the form R v Q built according to the following syntax, where A 2 N C and R 2 N R :B := A | 9S, C := B | ¬B, S := R | R , Q := S | ¬S A TBox axiom of the form B v C or R v Q is a positive inclusion,and a TBox axiom of the form B v ¬C or R v ¬Q is a negative inclusion.

T

  ={AProf v Prof, FProf v Prof, Prof v Person, 9Teach v Person, 9Teach v Course, Prof v 9WorkFor, WorkFor v MemberOf, AProf v ¬FProf, Person v ¬Course} A ={AProf(ann), AProf(bob), FProf(bob), MemberOf(bob, dpt), Teach(bob, c b ),

,

  Teach(carl, c c2 ), Teach(c c1 , c c2 )}} Rep(T , A dan ) ={{AProf(dan), Teach(dan, c d1 ), Teach(dan, c d2 )}, {AProf(dan), Teach(dan, c d1 ), AProf(c d2 )}, {AProf(dan), Teach(dan, c d2 ), AProf(c d1 )}, {AProf(dan), AProf(c d1 ), AProf(c d2 )}} Rep(T , A eva ) ={{Student(eva), Teach(eva, c e )}, {AProf(eva), Prof(eva), Teach(eva, c e )}} Rep(T , A fred ) ={{Postdoc(fred), Teach(fred, c f )}, {MemberOf(fred, fred), Teach(fred, c f )}}

Fig. 2 . 1

 21 Fig. 2.1 Reduction from SAT for coNP-hardness of AR query answering. Graphical representation of the ABox constructed from an example set of clauses '= {C 1 = x 1 _ ¬x 2 , C 2 = ¬x 1 _ x 2 _ ¬x 3 }.

2. 2

 2 Inconsistency-tolerant semantics Example 2.2.23 (Example 2.2.1 cont'd). The logical closures of the repairs of hT , A bob i are as follows: {{AProf(bob), Prof(bob), PhD(bob), Person(bob), MemberOf(bob, dpt), Teach(bob, c b ), Course(c b )}, {FProf(bob), Prof(bob), PhD(bob), Person(bob), MemberOf(bob, dpt), Teach(bob, c b ), Course(c b )}, {Postdoc(bob), PhD(bob), Person(bob), MemberOf(bob, dpt), Teach(bob, c b ), Course(c b )}}

  FProf(a), Postdoc(a)} The conflicts of hT , Ai are {AProf(a), FProf(a)}, {AProf(a), Postdoc(a)}, and {FProf(a), Postdoc(a)}. We have therefore: confl({AProf(a)}, K) ={FProf(a), Postdoc(a)} confl({FProf(a)}, K) ={AProf(a), Postdoc(a)} confl({Postdoc(a)}, K) ={AProf(a), FProf(a)}

Fig. 3

 3 Fig. 3.2 The left side displays a part of the concept hierarchy of the LUBM 9 20 ontology, the right upper part shows of which concepts AssistantProfessor is a subconcept (here the single concept Professor). The right lower part displays the negative inclusions added between AssistantProfessor and concepts with the same closest super-concept Professor:FullProfessor, ExDean, VisitingProfessor, AssociateProfessor and Dean. We did not add disjointness axioms with the concepts SubjXProfessor, because such concepts indicate the domain of a professor, which is independent from its seniority.

Figure 3 .

 3 Figure 3.3 displays the 20 queries used in our experiments andTable 3.2 summarizes their characteristics. They have between 1 and 8 atoms, with an average of 4.25 atoms. Their rewritings produced with Rapid have between 2 and 202,710 CQs, 23,185.95 on average. Queries q14 to q20 were available on websites associated with [Pérez-Urbina et al. 2009,[START_REF] Lutz | [END_REF], Rosati et al. 2012], and we designed the others ourselves. We chose queries that use some concepts that have disjoint specializations to get more chance to get answers that hold under AR semantics and not under IAR semantics.

Fig. 3 . 4

 34 Fig.3.4 Time in seconds for query answering w.r.t. the size of the ABox for three ratios of conflicts (about 4%, 30%, and 45% of assertions involved in some conflict). For readability, the two figures on the right focus on the queries whose answering times are lower and whose behaviors are thus not visible on the first one.

Fig. 3 . 5

 35 Fig. 3.5 Time in seconds for query answering w.r.t. the ratios of conflicts for three ABox sizes (about 76K, 2 million, and 10 million assertions). For readability, the two figures on the right focus on the queries whose answering times are lower and whose behaviors are thus not visible on the first one.

Fig. 3 . 6

 36 Fig. 3.6 Proportion of time spent by CQAPri in the different phases of query answering on 9 ABoxes: the two lower bars are the time for rewriting the query and executing the rewritten query to get candidate answers, and the two upper bars represent the time needed to classify such answers, by identifying the IAR-and non-brave-answers in a first step, then the AR-answers.

Fig. 4 . 1

 41 Fig. 4.1 Reductions for hardness of explaining positive and negative AR-answers. Graphical representation of the ABox constructed from an example set of clauses '= {C 1 = X 1 _ ¬X 2 , C 2 = ¬X 1 _ X 2 _ ¬X 3 }.

Fig. 4 . 2

 42 Fig. 4.2 Reduction for hardness of generating and recognizing best explanations of negative IAR-answers. Graphical representation of the ABox constructed from an example set of clauses' = {C 1 = X 1 _ X 2 , C 2 = X 2 _ X 3 }.

Fig. 4 . 4

 44 Fig.4.4 Time in seconds for query answers explanation w.r.t. the ratios of conflicts for three ABox sizes (about 76K, 2 million, and 10 million assertions). For readability, the two figures on the right focus on the queries whose explanation times are lower and whose behaviors are thus not visible on the first one.

Fig. 4 . 5

 45 Fig. 4.5 Proportion of time spent by CQAPri in the different phases of query answers explanation on 9 ABoxes: the two lower bars are the time for rewriting the query and executing the rewritten query to get candidate answers, the midle bar is the time needed to classify such answers, and the two upper bars give the total explanation cost, which is divided in the cost of computing the causes by pruning the non-minimal causes and the time needed to compute the explanations from the causes and conflicts.

  Example 5.1.2 (Example 5.1.1 cont'd). Deleting the assertions AProf(a) and Advise(a, b) from A ex achieves the objectives since hT ex , {Postdoc(a), Teach(a, c)}i 6 |= brave Prof(a) and hT ex , {Postdoc(a), Teach(a, c)}i |= IAR PhD(a).

  Example 5.1.8 (Example 5.1.1 cont'd). Consider the QRP given by:K =hT ex , {FProf(a), Teach(a, c), GradCourse(c)}i W ={Prof(a)} U ={9xProf(a) ^Teach(a, x) ^GradCourse(x)}Suppose that user(FProf(a)) = false, user(Teach(a, c)) = unknown, user(GradCourse(c)) = unknown, and user(AProf(a)) = true. It is not possible to satisfy the wanted and unwanted answers at the same time, since adding the true assertion AProf(a) creates a cause for the unwanted answer that does not contains any assertion ↵ with user(↵) = false: the user does not know which of Teach(a, c) and GradCourse(c) is erroneous./

  Consider the QRP (hT ex , Ai, W, U ) where A ={Teach(a, e), Advise(a, b), TakeCourse(b, c), TakeCourse(b, e), GradCourse(e)} W ={9xTeach(a, x), 9xTakeCourse(b, x) ^GradCourse(x)} U ={9xyTeach(a, x)^Advise(a, y)^TakeCourse(y, x)^GradCourse(x)} Suppose that user(Teach(a, e)) = user(GradCourse(e)) = false, user(↵) = unknown for the other ↵ 2 A, and the user knows that Teach(a, c), Teach(a, d) and GradCourse(c) are true.

Fig. 5 . 1

 51 Fig.5.1 Reduction for coNP-hardness of recognition of globally U,W or {U,W} -optimal optimal repair plans. Graphical representation of A [ T rue rel user constructed from an example set of clauses= {C 1 = x 1 _ ¬x 2 , C 2 = ¬x 1 _ x 2 _ ¬x 3 } [ {C 3 = x 2 _ x 3 }.

  -hardness of recognition of globally W,U -optimal optimal repair plans. Graphical representation of A [ T rue rel user constructed from an example set of clauses =

  global U -and local {U,W} -optimality () global U -and local U,W -optimality global W -and local {U,W} -optimality () global W -and local W,U -optimality () global W -and local U -optimality () local W,U -optimality

  and S = '\H, the MCSWs correspond to the MCSs of S w.r.t. H.

Fig. 5 . 3

 53 Fig. 5.3 Reductions for hardness of problems related to potential solutions. Graphical representation of the ABox constructed from an example set of clauses '= {C 1 = X 1 _ ¬X 2 , C 2 = ¬X 1 _ X 2 _ ¬X 3 } (or ' = {C 1 = X 1 _ ¬X 2 , C 2 = ¬X 1 _ X 2 _ ¬X 3 } [ {C 3 = x 2 _ x 3 }).

M

  [ confl(T,), A 0 A 0 \(P [ T ), gives F ✓ {↵ 2 N ¬f | user(↵) = false} and NF ✓ {↵ 2 N f | user(↵) 6 = false} with F [ NF 6 = ;, P P [ F , A 0 A 0 \(P [ NF ) MCSW s(K, U , W, A 0 ) ordered by size 27:while erroneous MCSW not found and M 6 = ; do

  is necessarily false. It follows that min(impact false (GradCourse(b)), impact true (GradCourse(b))) = 0 and impact false (GradCourse(b)) + impact true (GradCourse(b)) = 1. impact false (Postdoc(a)) =|{MemberOf(a, c)}| = 1 impact true (Postdoc(a)) =|{GradCourse(b)}| = 1 Indeed, if Postdoc(a) is false, then MemberOf(a, c) is necessarily nonfalse and if Postdoc(a) is true, then GradCourse(b) is necessarily false. It follows that min(impact false (Postdoc(a)), impact true (Postdoc(a))) = 1 and impact false

  Example 5.4.3 (Example 5.1.1 cont'd). Consider the following QRP: K =(T ex , {FProf(a), AProf(a), Postdoc(a)}) W ={Prof(a)}, U = ; Query-driven repairing Suppose that user(FProf(a)) = unknown, user(AProf(a)) = unknown and user(Postdoc(a)) = false. There are two deletion-only potential solutions: {FProf(a), Postdoc(a)} and {AProf(a), Postdoc(a)}, but none of them is validatable. However, deleting Postdoc(a) is a validatable deletion-only repair-plan that makes Prof(a) hold under AR semantics.

  Figure5.6 illustrates the reduction. We show that is valid iff (F alse user , T rue rel user ) is not optimal.The repair plan (F alse user , T rue rel user ) satisfies q 2 W for AR, since the function ⇡ such that ⇡(c) = e, ⇡(l 1 ) = ⇡(l 2 ) = ⇡(l 3 ) = ⇡(l 4 ) = d, and ⇡(x) = b is a match for the wanted answer, but (F alse user , T rue rel user ) does not satisfy the unwanted answer. Note that the wanted answer cannot be satisfied for IAR because 9xC(x) has only two causes C 1 (b) and C 2 (b) which are in conflict and are unknown.If is valid, it is possible to satisfy both the wanted answer for AR and the unwanted answer as in the previous proof.If (F alse user , T rue rel user ) is not optimal, there exists (P , P + ) that satisfies both the wanted and unwanted answers (since (F alse user , T rue rel user ) W,U (P , P + ) and the wanted answer is not satisfiable for IAR). Then is satisfiable as in previous proof: e and d cannot be used to satisfy the wanted answer, since it would require to add both T (d) and F (d) and would make the unwanted answer not satisfied.

Fig. 5 . 7

 57 Fig. 5.7 Assertions of the original ABox considered false for building QRPs.

Fig. 5

 5 Fig. 5.8 Time in seconds for computing the necessarily false and nonfalse assertions w.r.t. the number of relevant assertions involved in the QRP. The two figures on the left are related to the same QRPs, on u100c1 and u100c20. The QRPs of the figure on the right have more unwanted answers.

Fig. 5

 5 Fig. 5.9 Time in seconds for ranking the relevant assertions that are not necessarily false or nonfalse w.r.t. the number of such assertions. The two figures on the left are related to the same QRPs, on u100c1 and u100c20. The QRPs of the figure on the right have more unwanted answers.

  Example 6.1.7. We consider a simple knowledge base K = hT , Ai.T ={Student v Person, Prof v Person, Student v ¬Prof,9Teach v Prof, 9Teach v Course, Course v ¬Person} A ={Student(ann), Teach(ann, c 1 ), Teach(ann, c 2 ), Student(bob), Prof(bob), Teach(c 2 , bob), Teach(bob, c 3 )}

Fig. 6 . 3

 63 Fig. 6.3 Reduction for p 2 [O(log n)]-hardness of query answering under -AR semantics. Graphical representation of an example ABox (for the case n is odd).

Fig. 6 .

 6 Fig. 6.10 Time in seconds for query answering under ✓ P -AR, or ✓ P -AR and ✓ P -IAR w.r.t. ABox size on uXc1p3a. For readability, the figures on the bottom focus on the queries whose answering times are lower and whose behaviors are thus not visible on the first one.

  and the assertion A(a) is satisfied if a I 2 A I P . Models and entailment are defined as usual. Under this semantics, the KB h{A v ¬B}, {A(a), B(a)}i has models, like A I P = {a I }, A I N = ; and B I P = {a I }, B I N = {a I }, and both A(a) and B(a) are entailed. Note that A v ¬B and B v ¬A are no longer equivalent. This approach is orthogonal to inconsistency-tolerant semantics. If a DL allows us to use intersection and bottom, it is possible to construct a KB that has no models in the four-valued semantics, like h{A u ¬B v ?}, {A(a), B(a)}i, while inconsistency-tolerant semantics always give meaningful results.

Titre:

  Gestion des incohérences pour l'accès aux données en présence d'ontologiesMots clefs : Logiques de description, Réponse aux requêtes, Gestion de l'incohérence Résumé : Interroger des bases de connaissances avec des requêtes conjonctives a été une préoccupation majeure de la recherche récente en logique de description. Une question importante qui se pose dans ce contexte est la gestion de données incohérentes avec l'ontologie. En effet, une théorie logique incohérente impliquant toute formule sous la sémantique classique, l'utilisation de sémantiques tolérantes aux incohérences est nécessaire pour obtenir des réponses pertinentes. Le but de cette thèse est de développer des méthodes pour gérer des bases de connaissances incohérentes en utilisant trois sémantiques naturelles (AR, IAR et brave) proposées dans la littérature et qui reposent sur la notion de réparation, définie comme un sous-ensemble maximal des données cohérent avec l'ontologie. Nous utilisons ces trois sémantiques conjointement pour identifier les réponses associées à différents niveaux de confiance. En plus de développer des algorithmes efficaces pour interroger des bases de connaissances DL-Lite incohé-rentes, nous abordons trois problèmes: (i) l'explication des résultats des requêtes, pour aider l'utilisateur à comprendre pourquoi une réponse est (ou n'est pas) obtenue sous une des trois sémantiques, (ii) la réparation des données guidée par les requêtes, pour améliorer la qualité des données en capitalisant sur les retours des utilisateurs sur les résultats de la requête, et (iii) la définition de variantes des sémantiques à l'aide de réparations préférées pour prendre en compte la fiabilité des données. Pour chacune de ces trois questions, nous développons un cadre formel, analysons la complexité des problèmes de raisonnement associés, et proposons et mettons en oeuvre des algorithmes, qui sont étudiés empiriquement sur un jeu de bases de connaissance DL-Lite incohérentes que nous avons construit. Nos résultats indiquent que même si les problèmes à traiter sont théoriquement durs, ils peuvent souvent être résolus efficacement dans la pratique en utilisant des approximations et des fonctionnalités des SAT solveurs modernes. Title : Inconsistency Handling in Ontology-Mediated Query Answering Keywords : Description logics, Query answering, Inconsistency handling

Table 2

 2

		.5 Data and combined complexity of conjunctive query answering and instance
	checking over DL-Lite KBs under inconsistency-tolerant semantics.
		Data complexity	Combined complexity
		CQs	instance queries	CQs	instance queries
	AR	coNP-co	coNP-co	⇧ p 2 -co	coNP-co

Table 3 .

 3 1 Characteristics of ABoxes used in experiments.

	ABox id	size	% assertions	# assertions	% assertions
			added to uXc0	in some conflict	in some conflict
	u1c0	75,663	0	0
	u1c1	75,724	0.08	2,373
	u1c5	75,951	0.38	6,412
	u1c10	76,201	0.70	10,891
	u1c20	76,821	1.51	20,175
	u1c30	77,447	2.30	26,086
	u1c50	78,593	3.73	34,814
	u5c0	463,325	0	0
	u5c1	463,691	0.08	12,191
	u5c5	465,157	0.39	45,906
	u5c10	466,919	0.77	83,263
	u5c20	470,674	1.56	137,836
	u5c30	474,368	2.33	172,245
	u5c50	481,400	3.75	221,900
	u20c0	1,981,872	0	0
	u20c1	1,983,493	0.08	69,597
	u20c5	1,989,788	0.40	253,141
	u20c10	1,997,445	0.78	408,398
	u20c20	2,013,048	1.55	610,271
	u20c30	2,028,069	2.28	748,664
	u20c50	2,056,957	3.65	946,819
	u50c0	4,934,691	0	0
	u50c1	4,938,737	0.08	224,131
	u50c5	4,954,494	0.40	686,159
	u50c10	4,973,292	0.78	1,034,226
	u50c20	5,010,776	1.52	1,517,499
	u50c30	5,046,802	2.22	1,865,679
	u50c50	5,115,473	3.53	2,353,739
	u100c0	9,938,139	0	0
	u100c1	9,946,144	0.08	546,708
	u100c5	9,977,656	0.40	1,381,298
	u100c10	10,014,894	0.77	2,077,201
	u100c20	10,087,801	1.48	3,069,321
	u100c30	10,157,192	2.16	3,755,732
	u100c50	10,289,863	3.42	4,728,588

Table 3 .

 3 2 Queries in terms of shape, numbers of atoms, variables, constants, rewritings, and rewriting time (Rapid).

	id	shape #atoms #variables #constants #rewritings rewriting time (ms)
	q1	chain	2	2	0	80	4
	q2	chain	2	2	0	44	3
	q3	tree	3	2	1	58	4
	q4	dag	7	6	0	25	3
	q5	dag	5	2	1	6,401	88
	q6	dag	5	3	1	8,240	742
	q7	tree	3	2	1	450	7
	q8	tree	2	2	1	155	4
	q9	dag	6	4	0	202,579	15,917
	q10	dag	6	3	1	202,710	33,865
	q11 chain	2	2	0	35	3
	q12 atomic	1	1	0	44	3
	q13 atomic	1	1	0	44	3
	q14	dag	6	3	0	23	3
	q15 chain	3	2	0	2	3
	q16	dag	8	4	0	3,887	124
	q17 chain	6	3	0	14,700	190
	q18	tree	5	3	0	667	13
	q19	dag	8	4	0	23,552	920
	q20 chain	4	2	1	23	3
				52

Table 3 .

 3 3 Construction of conflict graph in milliseconds w.r.t. size uX and conflicts cY.

		c1	c5	c10	c20	c30	c50
	u1	2,033	2,384	2,498	2,710	2,920	3,113
	u5	7,758	8,542	8,920	9,644	10,462	11,230
	u20	27,748	29,878	31,792	34,683	36,982	40,586
	u50	73,031	78,673	80,563	91,122	100,134	118,375
	u100 153,476	166,234	177,441	200,468	221,172	247,191

Table 3 .

 3 4 Number of answers in the different classes for a growing proportion of conflicts and three sizes of ABoxes.

			u1c1			u1c5			u1c10			u1c20			u1c30			u1c50
		Sure Likely Possible	Sure	Likely Possible	Sure	Likely Possible	Sure	Likely Possible	Sure	Likely Possible Sure Likely Possible
	q1	20029	0	380 18261	0	2148 16524	0	3885 12538	7	7864 10286	11	10112 6646	19
	q2	7215	20	12	7077	57	146	6887	124	308	6284	402	734	5693	652	1174 4728	887
	q3	85	0	0	73	0	12	67	0	18	0	0	85	0	0	87	0	0
	q4	78101	0	5636 62478	0	22159 48745	0	35892 24545	0	60236 12776	0	72221 4806	0
	q5	10	0	0	10	0	0	10	0	0	0	10	0	0	10	0	0	0
	q6	235	0	0	224	0	14	194	9	44	177	14	110	147	39	129	0	0
	q7	136	0	1	130	0	7	0	0	138	0	0	138	0	0	142	0	0
	q8	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0
	q9	1291	3	80	1220	11	172	1138	26	259	1002	68	406	897	106	530	783	116
	q10	0	0	3	0	0	3	0	0	6	0	0	6	0	0	6	0	0
	q11	534	0	4	524	0	20	513	0	38	471	4	89	440	5	140	385	7
	q12	1180	11	10	1140	49	28	1092	90	57	999	174	117	930	231	204	802	345
	q13	1069	3	8	1054	11	31	1034	24	56	966	71	122	889	117	204	783	169
	q14	191	0	4	177	0	18	157	0	38	98	0	97	65	0	130	36	0
	q15	405	0	102	337	0	171	235	0	273	99	0	409	34	0	474	0	0
	q16 13545	0	3987 10182	0	7350	6669	0	10863	2052	0	15480	392	0	17140	0	0
	q17	0	0	1	0	0	1	0	0	1	0	0	1	0	0	1	0	0
	q18	3107	0	66	2959	0	214	2770	0	403	2302	0	872	1860	0	1319 1319	0
	q19	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0
	q20	50	0	0	49	0	1	26	0	24	25	0	25	2	0	48	0	0
			u20c1			u20c5			u20c10			u20c20			u20c30			u20c50
		Sure	Likely Possible Sure Likely Possible	Sure	Likely Possible	Sure	Likely Possible	Sure	Likely Possible	Sure	Likely Possible
	q1	532331	0	12776 485196	11	59900 434068	47 110995 344391	190 200539 279492	395 265246 187504	758
	q2	189186	228	1019 184238 1642	5628 177611	3902	11443 163260	9927	22489 150280 15085	32790 127098 23819
	q3	85	0	0	73	0	12	67	0	18	0	0	85	0	0	87	0	0
	q4 1123422	0 944364 115026	0 1956534	8955	0 2067051	118	0 2082472	0	0 2092082	0	0
	q5	10	0	0	10	0	0	10	0	0	0	10	0	0	10	0	0	0
	q6	235	0	0	224	0	14	194	9	44	177	14	110	147	39	129	0	0
	q7	91	0	46	35	0	102	0	0	138	0	0	138	0	0	142	0	0
	q8	0	0	31	0	0	31	0	0	31	0	0	31	0	0	32	0	0
	q9	33433	60	2714 29222	123	7504 27581	126	9873 25701	59	13282 24150	96	16196 21462	267
	q10	0	0	58	0	0	58	0	0	61	0	0	62	0	0	64	0	0
	q11	14331	0	145 13975	3	708 13514	8	1410 12613	42	2781 11798	96	4066 10329	267
	q12	7082	218	251	6460	649	1044	6120	810	1997	5830	880	3881	5646	914	5548	5395	991
	q13	28891	64	204 28315	348	1033 27512	779	2054 25791	1780	4028 24209	2658	5938 21471	4185
	q14	4785	0	166	4165	0	786	3529	0	1422	2539	0	2412	1853	0	3098	1007	0
	q15	12050	0	1702	7877	0	5896	4448	0	9358	1715	0	12143	628	0	13278	54	0
	q16 396411	0	72138 234542	0 234007 115090	0 353459 33936	0 434613	9413	0 459136	585	0
	q17	27	0	10	3	0	34	0	0	37	0	0	37	0	0	37	0	0
	q18	81760	0	1342 76118	0	7020 69639	0	13545 58294	0	24959 48975	0	34375 34795	0
	q19	0	0	1	0	0	3	0	0	5	0	0	8	0	0	15	0	0
	q20	50	0	0	49	0	1	26	0	24	25	0	25	2	0	48	0	0
			u100c1			u100c5			u100c10			u100c20			u100c30			u100c50
		Sure Likely Possible Sure	Likely Possible	Sure	Likely Possible	Sure	Likely Possible Sure	Likely Possible Sure	Likely Possible
	q1 2675887	3	65067 2433476	57	307432 2171624	253	569097 1732258	961 1007794 1398917	1870 1340294 934012	3751
	q2 946599 1003	5807 921744 8217	29012 888761 20619	56374 819168 50118 109934 755044 77267 159584 637443 124113
	q3	85	0	0	73	0	12	67	0	18	0	0	85	0	0	87	0	0
	q4 702009	0 9614733	0	0 10339007	0	0 10362220	OOM	OOM	OOM	OOM	OOM	OOM OOM	OOM	OOM
	q5	10	0	0	10	0	0	10	0	0	0	10	0	0	10	0	0	0
	q6	235	0	0	224	0	14	194	9	44	177	14	110	147	39	129	0	0
	q7	34	0	103	1	0	136	0	0	138	0	0	138	0	0	142	0	0
	q8	0	0	187	0	0	188	0	0	188	0	0	188	0	0	189	0	0
	q9 152404	110	27107 140733	18	41939 136664	35	49594 128616	192	64820 121104	451	78963 107220	1300
	q10	0	0	293	0	0	294	0	0	299	0	0	310	0	0	319	0	0
	q11 71756	0	739	69907	14	3627	67723	35	7089	63411	192	13778	59446	451	19956 51791	1300
	q12 31955	566	1109	30977	674	5066	30224	713	9572	29074	1166	18162	28256	1733	26118 27002	2849
	q13 144313	308	1014 141289 1853	5153 137356	4056	10055 129083	8902	19737 121332 13397	28913 107258 21279
	q14 23330	0	777	20271	0	3836	17222	0	6885	12390	0	11717	9083	0	15024	4942	0
	q15 61189	0	7584	40044	0	28820	23163	0	45806	7693	0	61492	2494	0	66918	221	0
	q16 2029091	0 323720 1182399	0 1170412 594303	0 1758508 150512	0 2202299	37860	0 2314951	2374	0
	q17	28	0	190	0	0	219	0	0	220	0	0	221	0	0	222	0	0
	q18 406817	0	7330 378618	0	35727 347379	0	67228 291909	0 123116 246077	0 169421 174140	17
	q19	0	0	5	0	0	13	0	0	26	0	0	56	0	0	81	0	0
	q20	50	0	0	49	0	1	26	0	24	25	0	25	2	0	48	0	0
										54

Table 4 .

 4 1 Data complexity results for CQs explanations in DL-Lite R .

			brave, IAR	AR	neg. AR	neg. IAR
	GENONE		in P	NP-h	NP-h	in P
	GENBEST	†	in P	⌃ p 2 -h ‡	NP-h	NP-h ⇤
	REL		in P	⌃ p 2 -co	NP-co	in P
	NEC		in P	NP-co	coNP-co	in P
	REC		in P	BH 2 -co	in P	in P
	BEST REC †	in P	⇧ p 2 -co ‡	coNP-co ⇤	coNP-co ⇤

† upper bounds hold for ranking criteria that can be decided in P ‡ lower bounds hold for smallest disjunction or fewest assertions ⇤ lower bounds hold for cardinality-minimal explanations

  Proposition 4.2.4. Regarding explanations for AR-answers, REC is in BH 2 , BEST REC is in ⇧ p 2 , and REL is in ⌃ p 2 w.r.t. data complexity.

	Using Proposition 4.2.3 and known complexity results for MUSes yields the following
	upper bounds:

  Proposition 4.2.6. Regarding explanations for positive AR-answers, REC is BH 2 -hard, NEC is NP-hard, REL is ⌃ p 2 -hard, and GENONE is NP-hard w.r.t. data complexity. Moreover, if we rank explanations according to the number of causes or number of assertions, then BEST REC (resp. GENBEST) is ⇧ p 2 -hard (resp. ⌃ p 2 -hard) w.r.t. data complexity. . Proof. We show how the MUSes of a propositional clause set can be captured by explanations of positive AR-answers. Let ' 0 = {C 1 , ..., C k } be a set of clauses over {X 1 , ..., X n }. Consider the KB and query used in the reduction of the proof of coNP-hardness of AR entailment (Theorem 2.2.6):

Table 4 .

 4 2 Number of answers of each class with distribution (in %) of their explanation times (in ms) per query over ABoxes of three different sizes and ratios of conflicts.

		u1c1 #ans	<10 [10,100[ [100,1000[ >1000 u1c20	#ans	<10 [10,100[ [100,1000[ >1000 u1c50	#ans	<10 [10,100[ [100,1000[ >1000
	q1 Sure	20029	100	0	0	0	12538	100	0	0	0	6646	100	0	0	0
	Likely	0					7	100	0	0	0	19	100	0	0	0
	Poss.	380	100	0	0	0	7864	100	0	0	0	13747 99.96	0.04	0	0
	q2 Sure	7215	100	0	0	0	6284	100	0	0	0	4728	100	0	0	0
	Likely	20	100	0	0	0	402 99.75	0.25	0	0	887 99.89	0.11	0	0
	Poss.	12	100	0	0	0	734	100	0	0	0	2087 99.95	0.05	0	0
	q3 Sure	85	100	0	0	0	0					0
	Poss.	0					85	100	0	0	0	87	100	0	0	0
	q4 Sure	78101	100	0	0	0	24545	100	0	0	0	4806	100	0	0	0
	Poss.	5636 99.96	0.04	0	0	60236 99.99	0.01	0	0	80839 99.98	0.01	<0.01	0
	q5 Sure	10	100	0	0	0	0					0
	Likely	0					10	60	40	0	0	0
	Poss.	0					0					10	100	0	0	0
	q6 Sure	235	100	0	0	0	177	100	0	0	0	0
	Likely	0					14	100	0	0	0	0
	Poss.	0					110	100	0	0	0	342	100	0	0	0
	q7 Sure	136	100	0	0	0	0					0
	Poss.	1	100	0	0	0	138	100	0	0	0	149	100	0	0	0
	q9 Sure	1291	100	0	0	0	1002 99.99	0.01	0	0	783	100	0	0	0
	Likely	3	100	0	0	0	68	100	0	0	0	116	100	0	0	0
	Poss.	80	100	0	0	0	406	100	0	0	0	741 99.87	0.13	0	0
	Poss.	3	100	0	0	0	6	100	0	0	0	7	100	0	0	0
	q11 Sure	534	100	0	0	0	471	100	0	0	0	385	100	0	0	0
	Likely	0					4	100	0	0	0	7	100	0	0	0
	Poss.	4	100	0	0	0	89	100	0	0	0	236 99.58	0.42	0	0
	q12 Sure	1180	100	0	0	0	999	100	0	0	0	802	100	0	0	0
	Likely	11	100	0	0	0	174	100	0	0	0	345	100	0	0	0
	Poss.	10	40	20	40	0	117 69.23	4.27	26.50	0	350 73.43	0	26.57	0
	q13 Sure	1069	100	0	0	0	966	100	0	0	0	783	100	0	0	0
	Likely	3	100	0	0	0	71	100	0	0	0	169	100	0	0	0
	Poss.	8	100	0	0	0	122 99.18	0	0.82	0	351 98.58	0.28	1.14	0
	q14 Sure	191	100	0	0	0	98	100	0	0	0	36	100	0	0	0
	Poss.	4	100	0	0	0	97	100	0	0	0	159	100	0	0	0
	q15 Sure	405	100	0	0	0	99	100	0	0	0	0
	Poss.	102	100	0	0	0	409 99.76	0	0.24	0	515 99.03	0	0.97	0
	q16 Sure	13545 99.99	0.01	0	0	2052	100	0	0	0	0
	Poss.	3987	100	0	0	0	15480 99.99	0.01	0	0	17532 99.98	0.02	0	0
	Poss.	1	100	0	0	0	1	100	0	0	0	1	100	0	0	0
	q18 Sure	3107	100	0	0	0	2302	100	0	0	0	1319	100	0	0	0
	Poss.	66	100	0	0	0	872 99.89	0.11	0	0	1871	100	0	0	0
	q20 Sure	50	100	0	0	0	25	100	0	0	0	0
	Poss.	0					25	100	0	0	0	50	100	0	0	0
								79

Table 4 .

 4 3 Distribution of the times (in ms) for explaining K 6 |= S q(ã) in Case 1.

		u1c1 #ans	<10 [10,100[ [100,1000[ >1000 u1c20	#ans	<10 [10,100[ [100,1000[ >1000 u1c50	#ans	<10 [10,100[ [100,1000[ >1000
	q1 Likely	0					7	100	0	0	0	19	100	0	0	0
	Poss.	380	100	0	0	0	7864	100	0	0	0	13747 99.96	0.04	0	0
	q2 Likely	20	100	0	0	0	402	100	0	0	0	887	100	0	0	0
	Poss.	12	100	0	0	0	734	100	0	0	0	2087 99.95	0.05	0	0
	q3 Poss.	0					85	100	0	0	0	87	100	0	0	0
	q4 Poss.	5636 99.96	0.04	0	0	60236	100	0	0	0	80839 99.99	<0.01	<0.01	0
	q5 Likely	0					10	100	0	0	0	0
	Poss.	0					0					10	100	0	0	0
	q6 Likely	0					14	100	0	0	0	0
	Poss.	0					110	100	0	0	0	342	100	0	0	0
	q7 Poss.	1	100	0	0	0	138	100	0	0	0	149	100	0	0	0
	q9 Likely	3	100	0	0	0	68	100	0	0	0	116	100	0	0	0
	Poss.	80	100	0	0	0	406	100	0	0	0	741 99.87	0.13	0	0
	q10 Poss.	3	100	0	0	0	6	100	0	0	0	7	100	0	0	0
	q11 Likely	0					4	100	0	0	0	7	100	0	0	0
	Poss.	4	100	0	0	0	89	100	0	0	0	236 99.58	0.42	0	0
	q12 Likely	11	100	0	0	0	174	100	0	0	0	345	100	0	0	0
	Poss.	10	70	0	30	0	117 79.49	0	20.51	0	350 75.42	2.29	22.29	0
	q13 Likely	3	100	0	0	0	71	100	0	0	0	169	100	0	0	0
	Poss.	8	100	0	0	0	122 99.18	0	0.82	0	351 98.58	0.28	1,14	0
	q14 Poss.	4	100	0	0	0	97	100	0	0	0	159	100	0	0	0
	q15 Poss.	102	100	0	0	0	409 99.76	0	0.24	0	515 99.03	0	0.97	0
	q16 Poss.	3987	100	0	0	0	15480 99.99	0.01	0	0	17532 99.99	0.01	0	0
	q17 Poss.	1	100	0	0	0	1	100	0	0	0	1	100	0	0	0
	q18 Poss.	66	100	0	0	0	872	100	0	0	0	1871	100	0	0	0
	q20 Poss.	0					25	100	0	0	0	50	100	0	0	0
		u20c1 #ans	<10 [10,100[ [100,1000[ >1000 u20c20 #ans	<10 [10,100[ [100,1000[ >1000 u20c50 #ans	<10 [10,100[ [100,1000[ >1000
	q2 Likely	228	100	0	0	0	9927	100	0	0	0	23819 >99.99	<0.01	0	0
	Poss.	1019	100	0	0	0	22489 >99.99	<0.01	0	0	52117 99.97	0.03	0	0
	q3 Poss.	0					85	100	0	0	0	87	100	0	0	0
	q5 Likely	0					10	100	0	0	0	0
	Poss.	0					0					10	100	0	0	0
	q6 Likely	0					14	100	0	0	0	0
	Poss.	0					110	100	0	0	0	342	100	0	0	0
	q7 Poss.	46	100	0	0	0	138	100	0	0	0	149	100	0	0	0
	q8 Poss.	31	100	0	0	0	31	100	0	0	0	32	100	0	0	0
	q9 Likely	60	100	0	0	0	59	100	0	0	0	267	100	0	0	0
	Poss.	2714	100	0	0	0	13282 99.92	0.08	0	0	21419 94.47	5.53	0	0
	q10 Poss.	58	100	0	0	0	62	100	0	0	0	66	100	0	0	0
	q11 Likely	0					42	100	0	0	0	267	100	0	0	0
	Poss.	145	100	0	0	0	2781 99.93	0.07	0	0	6373 99.76	0.24	0	0
	q12 Likely	218	100	0	0	0	880	100	0	0	0	991	100	0	0	0
	Poss.	251 66.53	13.55	19.92	0	3881 59.26	17.39	23.35	0	8769 56.43	14.85	28.72	0
	q13 Likely	64	100	0	0	0	1780	100	0	0	0	4185	100	0	0	0
	Poss.	204 98.53	0	1.47	0	4028 98.01	0.05	1.94	0	9430 98.35	0.17	1.48	0
	q14 Poss.	166	100	0	0	0	2412	100	0	0	0	3944	100	0	0	0
	q15 Poss.	1702 99.82	0	0.18	0	12143 99.28	0.02	0.70	0	13946 98.72	0.01	1.27	0
	q17 Poss.	10	100	0	0	0	37	100	0	0	0	39	100	0	0	0
	q18 Poss.	1342	100	0	0	0	24959 99.97	0.03	0	0	48770 99.99	0.01	0	0
	q19 Poss.	1	100	0	0	0	8	75	25	0	0	20	10	90	0	0
	q20 Poss.	0					25	100	0	0	0	50	100	0	0	0
		u100c1 #ans <10 [10,100[ [100,1000[ >1000 u100c20 #ans <10 [10,100[ [100,1000[ >1000 u100c50	#ans <10 [10,100[ [100,1000[ >1000
	q3 Poss.	0					85 100	0	0	0	87 98.85	0	0	1.15
	q5 Likely	0					10 100	0	0	0	0
	Poss.	0					0					10	10	90	0	0
	q6 Likely	0					14 100	0	0	0	0
	Poss.	0					110 100	0	0	0	342 100	0	0	0
	q7 Poss.	103 100	0	0	0	138 99.28	0	0.72	0	149 95.30	4.03	0.67	0
	q8 Poss.	187 100	0	0	0	188 100	0	0	0	190 42.63	56.84	0.53	0
	q9 Likely	110 100	0	0	0	192 100	0	0	0	1300 100	0	0	0
	Poss.	27107 99.99	0.01	0	0	64820 90.70	9.30	0	0	105450 75.55	22.30	2	0.15
	q10 Poss.	293 100	0	0	0	310 98.39	1.61	0	0	326 51.23	48.77	0	0
	q11 Likely	0					192 100	0	0	0	1300 100	0	0	0
	Poss.	739 100	0	0	0	13778 99.97	0.03	0	0	31764 99.84	0.16	0	0
	q12 Likely	566 100	0	0	0	1166 100	0	0	0	2849 100	0	0	0
	Poss.	1109 64.65	0.09	35.26	0	18162 61.67	0.22	31.26	6.84	41644 58.84	2.84	25.60 12.72
	q13 Likely	308 100	0	0	0	8902 100	0	0	0	21279 100	0	0	0
	Poss.	1014 98.82	0	1.18	0	19737 98.60	0.02	1.38	0	46553 98.62	0.10	1.28	0
	q14 Poss.	777 100	0	0	0	11717 100	0	0	0	19165 99.99	0	0	0.01
	q15 Poss.	7584 99.84	0	0.16	0	61492 99.53	<0.01	0.47	0	69599 98.99	0.01	1.00	0
	q17 Poss.	190 100	0	0	0	221 95.93	4.07	0	0	226 14.60	84.52	0.88	0
	q19 Poss.	5 100	0	0	0	56 91.07	8.93	0	0	124 6.45	93.55	0	0
	q20 Poss.

  Table 4.6 Distribution of the times (in ms) for explaining K 6 |= IAR q(ã) in Case 4.

	Explaining inconsistency-tolerant query answering	4.3 Implementation and experiments
	u1c1 #ans <10 [10,100[ [100,1000[ >1000 u1c20 #ans <10 [10,100[ [100,1000[ >1000 u1c50 #ans <10 [10,100[ [100,1000[ >1000
	q1 Likely	0										7 100				0		0		0		19 100	0	0	0
	q2 Likely	20 100		0		0		0		402 100				0		0		0		887 100	0	0	0
	q5 Likely	0										10 100				0		0		0		0
	q6 Likely	0										14 100				0		0		0		0
	q9 Likely q11 Likely q12 Likely	3 100 0 Table 4.5 Distribution of the times (in ms) for explaining K 6 |= AR q(ã) in Case 3. 0 0 0 68 100 0 0 0 116 100 0 4 100 0 0 0 7 100 0 11 100 0 0 0 174 100 0 0 0 345 100 0	0 0 0	0 0 0
	q13 Likely	u1c1 #ans <10 [10,100[ [100,1000[ >1000 u1c20 3 100 0 0 0	#ans 71 100	<10 [10,100[ [100,1000[ >1000 u1c50 0 0 0	#ans 169 100	<10 [10,100[ [100,1000[ >1000 0 0 0
	q1 Poss. q2 Poss. u20c1 #ans <10 [10,100[ [100,1000[ >1000 u20c20 #ans 380 100 0 0 0 7864 12 100 0 0 0 734	100 100 <10 [10,100[ [100,1000[ >1000 u20c50 0 0 0 0 0 0	13747 2087 #ans	100 100 <10 [10,100[ [100,1000[ >1000 0 0 0 0
	q3 Poss. q4 Poss. q2 Likely q5 Poss. q5 Likely q6 Poss. q6 Likely q7 Poss. q9 Likely q9 Poss. q11 Likely q10 Poss. q12 Likely q11 Poss. q13 Likely	0 5636 100 228 100 0 0 0 0 1 100 60 100 80 100 0 3 100 218 100 4 100 64 100	0 0 0 0		0 0 0 0 0	0 0 0 0	0 0 0 0 0	0 0 0 0	0 0 0 0 0	85 60236 9927 0 10 110 14 138 59 406 42 6 880 >99.99 100 100 100 100 100 89 1780 100		100 100 100 100 100 100 100		0 0 0 0 0 0 0	0 0 0 0 0 0 0	0 0 0 0 0 0 0 <0.01 0 0 0 0 0 0 0 0 0 0 0 0 0	0 0 0 0 0 0 0	87 80839 >99.99 100 23819 99.82 10 100 0 342 100 0 149 100 267 100 741 100 267 100 7 100 991 TO 236 100 4185 100	0 <0.01 0.18 0 0 0 0 0 0 0 TO 0 0	0 0 0 TO 0	0 0 0 0 0 0 0 0	0 0 0 TO 0
	q12 Poss.	10	70		20	10		0		117	79.49		16.24	4.27		0	350	77.71	18.29	4.00
	q13 Poss. u100c1 #ans <10 [10,100[ [100,1000[ >1000 u100c20 #ans 8 100 0 0 0 122	100 <10 [10,100[ [100,1000[ >1000 u100c50 0 0 0	351 #ans	98.87 <10 [10,100[ [100,1000[ >1000 0.85 0.28
	q14 Poss. q15 Poss. q5 Likely q16 Poss. q6 Likely q17 Poss. q9 Likely q18 Poss. q11 Likely q20 Poss. q12 Likely q13 Likely	4 100 102 100 0 3987 100 0 1 100 110 100 66 100 0 0 566 100 308 100	0 0 0	0 0 0 0 0	0 0 0	0 0 0 0 0	0 0 0	0 0 0 0 0	97 409 >99.99 100 10 100 15480 100 14 100 1 100 192 91.15 872 100 192 100 25 100 1166 89.28 8902 99.80	0 <0.01 0 0 0 0 1.04 0 0 0 10.63 0.20	0 0 0 0 0 0	0 0 0 0 7.81 0 0 0 0 0 0.09 0	0 0 0 0 0 0	159 515 0 17532 >99.99 100 99.03 0 1 100 1300 99.84 1871 100 1300 100 50 100 2849 TO 21279 99.44	0 0.78 <0.01 0 0.08 0 0 0 TO 0.56	0 0 TO 0	0 0.19 0 0.08 0 0 0 TO 0 0
		u20c1 #ans	<10 [10,100[ [100,1000[ >1000 u20c20	#ans		<10 [10,100[ [100,1000[ >1000 u20c50	#ans	<10 [10,100[ [100,1000[ >1000
	q2 Poss.	1019	100		0		0		0		22489		100			0		0		0	52117 >99.99	<0.01	0
	q3 Poss.	0											85		100			0		0		0	87	100	0	0
	q5 Poss.	0											0										10	100	0	0
	q6 Poss.	0										110		100			0		0		0	342	100	0	0
	q7 Poss.	46	100		0		0		0		138		100			0		0		0	149	100	0	0
	q8 Poss.	31	100		0		0		0			31		100			0		0		0	32	100	0	0
	q9 Poss.	2714	100		0		0		0		13282 99.96		0.04		0		0	21419 99.69	0.31	0
	q10 Poss.	58	100		0		0		0			62		100			0		0		0	66	100	0	0
	q11 Poss.	145	100		0		0		0		2781		100			0		0		0	6373 99.98	0.02	0
	q12 Poss.	251 79.28	13.95	6.77		0		3881 76.04		18.01		5.95		0	8769 71.05	22.98	5.97
	q13 Poss.	204 98.53	0.98	0.49		0		4028 98.06		1.29		0.65		0	9430 98.51	1.04	0.45
	q14 Poss.	166	100		0		0		0		2412		100			0		0		0	3944	100	0	0
	q15 Poss.	1702 99.82	0.12	0.06		0		12143 99.29		0.50		0.21		0	13946 98.72	0.92	0.35
	q17 Poss.	10	100		0		0		0			37		100			0		0		0	39	100	0	0
	q18 Poss.	1342	100		0		0		0		24959		100			0		0		0	48770	100	0	0
	q19 Poss.	1	100		0		0		0			8		100			0		0		0	20	100	0	0
	q20 Poss.	0											25		100			0		0		0	50	100	0	0
		u100c1 #ans <10 [10,100[ [100,1000[ >1000 u100c20 #ans <10 [10,100[ [100,1000[ >1000 u100c50	#ans <10 [10,100[ [100,1000[ >1000
	q3 Poss.	0											85		100		0		0		0	87	100	0	0
	q5 Poss.	0											0										10	100	0	0
	q6 Poss.	0											110		100		0		0		0	342	100	0	0
	q7 Poss.	103		100		0		0		0			138		100		0		0		0	149	100	0	0
	q8 Poss.	187		100		0		0		0			188		100		0		0		0	190	100	0	0
	q9 Poss.	27107		100		0		0		0		64820 95.40		4.60		0		0	105450 93.64	6.13	0.08	0.15
	q10 Poss.	293		100		0		0		0			310		100		0		0		0	326 99.69	0.31	0
	q11 Poss.	739		100		0		0		0		13778		100		0		0		0	31764 99.99	0.01	0
	q12 Poss.	1109 64.74		29.94		5.32		0		18162 61.88	27.74	10.38 <0.01	41644 61.68	27.59	10.72	0.01
	q13 Poss.	1014 98.82		0.88		0.30		0		19737 98.63		0.84		0.53		0	46553 98.71	0.78	0.50	0.01
	q14 Poss.	777		100		0		0		0		11717		100		0		0		0	19165 99.99	0	0.01
	q15 Poss.	7584 99.84		0.12		0.04		0		61492 99.53		0.29		0.18		0	69599 99.00	0.63	0.37
	q17 Poss.	190		100		0		0		0			221		100		0		0		0	226	100	0	0
	q19 Poss. q10 Poss. q20 Poss.	5 293 100 0	100	0	0	0	0	0	0		97.86 56 310 100 25	2.14 100 0 100	0 0	0 0	0 0	0 0	0 0	105450 93.76 124 326 100 50	100 100	6.07 0	0 0	0.02 0	0 0.15 0 0
	q11 Likely	0										192 100			0		0		0		1300	100	0	0	0
	Poss.	739 100		0		0		0		13778 100			0		0		0		31764	100	0	0	0
	q12 Likely	566 100		0		0		0		1166 100			0		0		0		2849	100	0	0	0
	Poss.	1109 100		0		0		0		18162 100			0		0		0		41644 >99.99	<0.01	0	0
	q13 Likely	308 100		0		0		0		8902 100			0		0		0		21279	100	0	0	0
	Poss.	1014 100		0		0		0		19737 100			0		0		0		46553	100	0	0	0
	q14 Poss.	777 100		0		0		0		11717 100			0		0		0		19165	100	0	0	0
	q15 Poss.	7584 100		0		0		0		61492 100			0		0		0		69599	100	0	0	0
	q17 Poss.	190 100		0		0		0			221 100			0		0		0		226	100	0	0	0
	q19 Poss.	5 100		0		0		0			56 100			0		0		0		124	100	0	0	0
	q20 Poss.	0										25 100			0		0		0		50	100	0	0	0
															88	89

  Suppose that we have the following QRP

	Query-driven repairing
	Example 5.3.8.
			go to 27
	34:	end if
	35:	end for
	36: 37:	MCSW found: W end while	W\M and go to 3
	38: 39: end if No MCSW found: do Step 2 of OptimalRepairPlan U , output P
			123

  p 2 -hardness for local or global {U,W} , U,W optimality. The proof is by reduction from QBF 2,9 . Let = 9x 1 ...x m 8y 1 ...y p Reduction from QBF 2,9 for ⇧ p 2 -hardness of recognition of {U,W} -or U,W -optimal repair plans using AR semantics. Graphical representation of the ABox constructed from {C

	Fig. 5.5
	W n i=1 C i where	W n i=1 C i is a 2+2 DNF

Table 5 .

 5 1 Recognition of an optimal repair plan in DL-Lite R : complexity w.r.t. |A|, |U|, |W|, and |T rue rel user |.

			with AR		without AR
			Global	Local	Global	Local
	U W	p 2	in P	in P	in P	in P

  co ⇤ in P † upper bounds hold for instance queries wanted answers ⇤ lower bounds hold for instance queries wanted answers If U contains only instances queries: deciding global or local -optimality for 2 { W,U , U ,W , {U ,W} } is p 2 [O(log n)]-co with AR, and in P without AR Remark 5.4.11. If U contains only instance queries, deciding if a repair plan is globally

Table 5 .

 5 2 Number of false and true answers per query and ABox.

		q	5	q	7	q	8	q	10
		false	true	false	true	false	true	false	true
	u100c1	4	6	7	130	3	184	7	286
	u100c20	4	6	8	130	4	184	24	286

  ann), Student(bob), Prof(bob)} P 2 ={Teach(ann, c 1 ), Teach(ann, c 2 ), Teach(bob, c 3 )}The ✓ P -repairs are R 1 and R 3 , and there is only one  P -repair, namely R 3 . Notice that Student(ann) is entailed under the ✓ P -IAR and  P -IAR semantics, whereas it was not entailed under plain AR semantics, and it conflicts with an assertion entailed under -IAR semantics. The assertion Prof(bob) is entailed under  P -IAR semantics, but only Person(bob) is entailed under ✓ P -AR semantics.Finally, if we assign assertions in P 1 a weight of 2, and assertions of P 2 a weight of 1, we obtain two  w -repairs: R 3 and R 4 . Under  w -AR semantics, neither Prof(ann) nor Student(ann) is entailed, but only Person(ann). Under  w -IAR semantics, Prof(bob) is entailed.

	/
	6.1.2 Discussion: other notions of prioritized repairs

Table 6 .

 6 1 Data and combined complexity of CQ entailment over DL-Lite R KBs under AR, IAR, and brave semantics for different types of preferred repairs. For instance queries, the data and combined complexity coincide with the data complexity for CQs. All results are completeness results unless otherwise noted. † p 2 [O(log n)]-complete under the assumption that there is a bound on the number of priority classes (resp. maximal weight).

	✓		✓ P

  Hence |X|  4 + n c ⇤ 8. It follows that |X| < |Y |, so applying Lemma 6.2.6, we get R / 2 Rep  (K). (End proof of Claim 1) 6.2 Complexity analysis satisfiable (by Claim 2) and ' k+1 is unsatisfiable (by Claim 4) or ' k is satisfiable and k = n.

  Chapitre 3 Dans ce chapitre, nous présentons les algorithmes implémentés dans notre prototype CQAPri pour répondre aux requêtes sous les sémantiques AR, IAR et brave en DL-Lite R . Nous décrivons ensuite le cadre expérimental que nous avons construit pour évaluer notre système et les résultats obtenus, et passons rapidement en revu les systèmes et benchmarks existants.Chapitre 4 Nous abordons dans ce chapitre le problème d'expliquer pourquoi un tuple est ou n'est pas une réponse à une requête sous les sémantiques IAR, AR ou brave. Nous définissons des explications centrées sur les données pour les réponses positives et négatives, étudions leur complexité pour DL-Lite R , et proposons des algorithmes pour les calculer en exploitant des SAT solveurs. Nous présentons aussi notre implémentation dans CQAPri et les expériences que nous avons effectuées.Chapitre 5 Ce chapitre aborde la réparation des données guidée par les requêtes pour des bases de connaissances DL-Lite R incohérentes. Nous considérons le scénario suivant: un utilisateur reçoit les réponses à des requêtes sous les différentes sémantiques tolérantes aux incohérences et indique que certaines réponses sont fausses tandis que d'autres sont correctes et devraient être impliquées sous une sémantique plus forte. Le but est de trouver un ensemble de modifications de la ABox (suppressions et ajouts), appelé un plan de réparation, qui résout le plus de problèmes possible. Après avoir formalisé ce problème et introduit différentes notions d'optimalité, nous étudions la complexité de raisonnement lié aux plans optimaux et proposons des algorithmes interactifs pour calculer de tels plans. Dans le cas où seules les suppressions sont autorisées, nous proposons un algorithme amélioré et présentons l'implémentation de ses principaux composants dans CQAPri.Chapitre 6 Dans ce chapitre nous étudions des variantes des sémantiques AR, IAR et brave obtenues en remplaçant la notion de réparation classique par un type de réparation préférée parmi quatre (e.g. les réparations de cardinal maximal, ou basées sur des niveaux de priorité qui distinguent les assertions plus ou moins fiables). Nous analysons la complexité de la réponse aux requêtes sous les sémantiques résultantes et proposons une approche exploitant un encodage SAT pour celles basées sur les niveaux de priorité, dont la complexité est la même que pour la sémantique AR classique. Nous présentons ensuite notre implémentation de ces sémantiques et son évaluation expérimentale.Chapitre 7 Dans ce chapitre, nous nous positionnons dans un contexte plus général de l'état de l'art et détaillons certains sujets mentionnés dans les chapitres précédents.Chapitre 8 Ce chapitre résume nos contributions et indique quelques extensions possibles de ce travail.Annexe A L'annexe fournit les bases de théorie de la complexité et de la logique propositionnelle, et rappelle les définitions des classes de complexité apparaissant dans cette thèse ainsi que les problèmes utilisés dans les preuves de complexité. {U,W} , U,W , W,U , 103 Rep (T , A), 143

	Index
	k-lazy semantics, 37	relevant assertion, 117
	k-support semantics, 29	relevant assertions, 66
	KB complexity, 11	repair, 23
	knowledge base (KB), 8	repair plan, 100, 101
	Likely answer, 45 literal, 202 INDEX P = (P , P + ), 101 S(P), 103 U , 101 W, 101  P , 144 causes(q, K), 18 conflicts(K), 18 confl(B, K), 18 vars(' ¬q ), 42 Ind(A), 8 match, 11 MCSW eroneous MCSW, 117 minimal correction subset of wanted an-swers, 117 minimal correction subset (MCS), 117 minimal unsatisfiable subset (MUS), 67 model, 10 minimal model, 71 monotone, 202 necessarily false, 117 necessarily nonfalse, 117 necessary assertions, 66 , 144 ans(q, I), 11 cert(q, K), 11 |=, 10 Rep(T , A), 23 ✓ P , 144  w , 144 N I , N C , N R , 8 atoms, 11 ABox, 8 ontology, 7 ontology-mediated query answering (OMQA), 7 optimal repair plan, 103 optimality global optimality, 103 local optimality, 103 for IAR, 127 for AR, 127 potential solution, 116 Possible answer, 45 Parity(SAT), 205	responsibility, 91 rewriting, 13 cause, 18 clause, 202 combined complexity, 11 conflict, 17 SAT, 204 satisfaction of an answer, 102 satisfiable answer, 105 formula, 203 satisfiable answer w.r.t. a repair plan, 105 Sure answer, 45 conflict graph, 17 tautology, 203 oriented, 164 TBox, 8 conflicts of a set of assertions, conjunctive normal form (CNF), truthfulness condition, 102 conjunctive query (CQ), 10 UNSAT, 204 contingency set, 91 unsatisfiable data complexity, 11 deletion-only, 101 dependent answers, 124 formula, 203 unwanted answer, 100, 101 user, 102 disjunctive normal form (DNF), 202 validatable, 102 DL-Lite R , 12 entailment, 10 explanation wanted answer, 100, 101 witness for satisfiability for AR, 129 for a negative AR-answer, for a positive IAR-answer, 63 for a positive brave-answer, 63 for a positive AR-answer, 63 for a negative IAR-answer, 64 for IAR, 107
	answer, 11 AR semantics, 22 axiom, 8 preferred explanation, 65 repair, 143	IAR semantics, 26 ICAR semantics, 33 ICR semantics, 30
	Boolean conjunctive query (BCQ), 11 Boolean query, 10 brave semantics, 28 QBF 2,9 , 205 QBF 2,8 , 205 quantified Boolean formula (QBF), 203 query, 10 candidate answer, 45 CAR semantics, 33 query-driven repairing problem (QRP), 101	image, 16 impact, 125 independent subproblems, 124 interpretation, 10 k-defeater semantics, 29

P , 164 U , W ,

available at www.lri.fr/~bourgaux/CQAPri

In what follows, we often omit "w.r.t. user" and leave it implicit.

[Bienvenu & Ortiz 2015] Meghyn Bienvenu et Magdalena Ortiz. Ontology-Mediated Query Answering with Data-Tractable Description Logics. In Lecture Notes of the 11th International Reasoning Web Summer School, volume 9203 of LNCS, pages 218-307. Springer, 2015.

We focused on the setting where the TBox is consistent and assumed to be correct. Little work has been done without this assumption, and there are interesting questions there.

Inconsistency-tolerant semantics could also be combined with other approaches for uncertainty handling (probabilistic or possibilistic DLs for instance), or other settings that take into account some other dimensions of the data, like vagueness with fuzzy DLs, or temporal aspects.

Discussion about the notion of responsibility

Example 4.4.5. Suppose that we have the following KB and query.

T ={GradCourse v ¬UndergradCourse} A ={Postdoc(ann), Teach(ann, c a1 ), GradCourse(c a1 ), Teach(ann, c a2 ), GradCourse(c a2 ), Teach(ann, c a3 ), GradCourse(c a3 ), Postdoc(bob), Teach(bob, c bc ), Postdoc(carl), Teach(carl, c bc ), GradCourse(c bc ), Postdoc(dan), Teach(dan, c d ), GradCourse(c d ), UndergradCourse(c d )} q =9xy Postdoc(x) ^Teach(x, y) ^GradCourse(y)

If a user wonders why q is entailed under brave semantics (for instance because he thinks that postdoctoral researchers should not teach graduate courses), he will get the 6 following causes as explanations for hT , Ai |= brave q, and every assertion from A is relevant except UndergradCourse(c d ):

• {Postdoc(ann), Teach(ann, c ai ), GradCourse(c ai )} for 1  i  3, • {Postdoc(bob), Teach(bob, c bc ), GradCourse(c bc )},

• {Postdoc(carl), Teach(carl, c bc ), GradCourse(c bc )},

• {Postdoc(dan), Teach(dan, c d ), GradCourse(c d )}.

Ordering the assertions w.r.t. their responsibility gives the following ranking: • ⇢ = 0.20 Teach(ann, c a1 )

• ⇢ = 0.20 GradCourse(c a1 )

• ⇢ = 0.20 Teach(ann, c a2 )

• ⇢ = 0.20 GradCourse(c a2 )

• ⇢ = 0.20 Teach(ann, c a3 )

• ⇢ = 0.20 GradCourse(c a3 )

If it is the case that postdoctoral researchers do not teach graduate courses:

• either Postdoc(ann) is erroneous, or at least three assertions are erroneous (either Teach(ann, c ai ) or GradCourse(c ai ) for each c ai ); • either GradCourse(c bc ) is erroneous, or at least two others assertions are erroneous (either Postdoc(x) or Teach(x, c bc ) for x 2 {bob, carl}); • one of the three assertions Postdoc(dan), Teach(dan, c d ), and GradCourse(c d ) is erroneous.

Therefore, if we suppose that every assertion has the same probability of being erroneous a priori, the assertions of responsibility 0.33 are more likely to be problematic than those of lower responsibility, since we have to remove more of the latter to lose the entailment of q.

The assertions of higher responsibility are more important in getting the answer. This shows

Query-driven repairing problem

Example 5. 1.3 (Example 5.1.1 cont'd). Consider K = hT ex , {AProf(a)}i with the same wanted and unwanted answers as in Example 5.1.1. The assertion AProf(a) has to be removed to satisfy the unwanted answer, but then there remains no cause for the wanted answer. This is due to the fact that the only cause of PhD(a) in K contains an erroneous assertion: there is no "good" reason in the initial ABox for PhD(a) to hold. A solution is for the user to add a cause he knows for PhD(a), such as Postdoc(a). /

We now provide a formal definition of the query-driven repairing problem investigated in this chapter.

Definition 5.1.4. A query-driven repairing problem (QRP) consists of a KB K = hT , Ai to repair and two sets W, U of BCQs that K should entail (W) or not entail (U ). A repair plan (for A) is a pair P = (P , P + ) such that P ✓ A and P + \ A = ;; if P + = ;, we say that P is deletion-only.

The sets U and W correspond to the unwanted and wanted answers in our scenario: q(ã) 2 U (resp. W) means that ã is an unwanted (resp. wanted) answer for q. Slightly abusing terminology, we will use the term unwanted (resp. wanted) answers to refer to the BCQs in U (resp. W). We say that a repair plan (P , P + ) addresses all defects of a QRP (K, W, U ) if the KB K 0 = hT , (A\P ) [ P + i is such that K 0 |= IAR q for every q 2 W, and K 0 6 |= brave q for every q 2 U.

The next example shows that by considering several answers at the same time, we can exploit the interaction between the different answers to reduce the search space.

Example 5.1.5 (Example 5.1.1 cont'd). Consider the KB K = hT ex , Ai with ABox A = {Prof(a), AProf(b), FProf(b), Teach(a, c), Teach(b, c), GradCourse(c), TakeCourse(s, c)}. It is easy to see that K is inconsistent, and its two repairs are obtained by removing either AProf(b) or FProf(b). Evaluating the queries q 1 (x) = PhD(x) and q 2 (x) = 9yzProf(x) ^Teach(x, y) ^GradCourse(y) ^TakeCourse(z, y) over this KB yields:

We consider the QRP (K, W, U ) with wanted answers W = {q 1 (b), q 2 (a)} and unwanted answers U = {q 2 (b)}.

Two deletion-only repair plans address all defects: {AProf(b), Teach(b, c)} and {FProf(b), Teach(b, c)}. Indeed, we must delete exactly one of AProf(b) and FProf(b) for q 1 (b) to be entailed under IAR semantics, and we cannot remove GradCourse(c) or TakeCourse(s, c) without losing the wanted answer q 2 (a). Thus, the only way to get rid of q 2 (b) is to delete Teach(b, c).

If we consider only U (i.e. W = ;), there are additional possibilities such as {GradCourse(c)} and {TakeCourse(s, c)}, and there is no evidence that Teach(b, c) has to be deleted. /

If we want to avoid introducing new errors, a fully automated repairing process is impossible: we need the user to validate every assertion that is removed or added in order to remove (resp. add) only assertions that are false (resp. true).

Optimal repair plans

removing additional false assertions, while adding the same set of true assertions, can only satisfy more unwanted answers.

Lemma 5.2.5. Let (P , P + ) and (P 0 , P 0 + ) be validatable repair plans.

1. If P ✓ P 0 and P + ✓ P 0 + , then S W (P , P + ) ✓ S W (P 0 , P 0 + ).

2. If P ✓ P 0 and P + = P 0 + , then S U (P , P + ) ✓ S U (P 0 , P 0 + ).

Proof. Suppose that P ✓ P 0 and P + ✓ P 0 + and let q 2 S W (P , P + ). There exists a cause C for q in (A\P ) [ P + such that C does not contain any false assertion and has no conflicts in (A\P ) [ P + . Since C ✓ A [ P + and P + ✓ P 0 + , C ✓ A [ P 0 + , and since C does not contain any false assertion and (P 0 , P 0 + ) is validatable, C \ P 0 = ;, so C ✓ (A\P 0 ) [ P 0 + . Moreover, C has no conflict in (A\P ) [ P + , so the set of assertions of A in conflict with C is included in P ✓ P 0 , so C has no conflict in (A\P 0 ) [ P 0 + (note that since the assertions of C are nonfalse, and the repair plans are validatable, assertions of C cannot conflict with assertions of P 0 + ). It follows that q 2 S W (P 0 , P 0 + ). Suppose that P ✓ P 0 and P + = P 0 + and let q 2 S U (P , P + ). There is no cause for q in (A\P ) [ P + ✓ (A\P 0 ) [ P 0 + , so q 2 S U (P 0 , P 0 + ).

We next provide characterizations of optimal plans in terms of the notion of satisfiability of answers. Definition 5.2.6 (Satisfiable answer). An answer q 2 U [ W is satisfiable if there exists a validatable repair plan that satisfies q. We say that q is satisfiable w.r.t. a validatable repair plan P = (P , P + ) if there exists a validatable repair plan P 0 = (P 0 , P 0 + ) such that P ✓ P 0 , P + ✓ P 0 + , q 2 S(P 0 ), and P {U,W} P 0 .

Proposition 5.2.7. A validatable repair plan P is:

• globally U -(resp. W -) optimal iff it is locally U -(resp. W -) optimal iff it satisfies every satisfiable q 2 U (resp. q 2 W). • locally U,W -optimal iff it is locally {U,W} -optimal iff it satisfies every q 2 U [ W that is satisfiable w.r.t. P. • locally W,U -optimal iff it satisfies every satisfiable q 2 W and every q 2 U that is satisfiable w.r.t. P.

Proof.

• A validatable repair plan is globally (or locally) U -(resp. W -) optimal iff satisfies every satisfiable q 2 U (resp. q 2 W):

-Let (P , P + ) be a globally (or locally) U -(resp. W -) optimal repair plan. Take some satisfiable q 2 U (resp. q 2 W), and let (P 0 , P 0 + ) be a validatable repair plan satisfying q. By Lemma 5.2.5, (P , P + ) U (P [ P 0 , P + ) (resp. (P , P + ) W (P [ P 0 , P + [ P 0 + )). Because of global (or local) optimality, we must in fact have (P , P + ) ⇠ U (P [ P 0 , P + ) (resp. (P , P + ) ⇠ W (P [ P 0 , P + [ P 0 + )), and so q is satisfied by (P , P + ).

Optimal repair plans

The next lemma characterizes when a validatable repair plan satisfies an unwanted answer.

Lemma 5.2.8. Let (P , P + ) be a validatable repair plan. Then (P , P + ) satisfies q 2 U iff P \ C 6 = ; for every C 2 causes(q, hT , A [ P + i).

Proof. For the first direction, suppose that (P , P + ) satisfies q 2 U. This means that hT , (A\P ) [ P + i 6 |= brave q. It follows that for every C 2 causes(q, hT , A [ P + i), we have C 6 ✓ (A\P ) [ P + , hence C \ P 6 = ;. For the second direction, suppose that P \ C 6 = ; for every C 2 causes(q, hT , A [ P + i). It follows that causes(q, hT , (A [ P + ) \ P i) = ;. Since (P , P + ) is validatable, we know that user(↵) = false for every ↵ 2 P and user(↵) = true for every ↵ 2 P + . In particular, this means that P \ P + = ;, so (A [ P + ) \ P = (A \ P ) [ P + . We therefore have causes(q, hT , (A \ P ) [ P + i) = ;, hence hT , (A\P ) [ P + i 6 |= brave q.

We now establish the following characterizations of satisfiable answers and answers satisfiable w.r.t. a repair plan.

Lemma 5.2.9. An answer q 2 U is satisfiable iff for every C 2 causes(q, hT , Ai) there exists ↵ 2 C such that user(↵) = false.

Proof. If q 2 U is satisfiable, then there exists a validatable repair plan (P , P + ) that satisfies q. By Lemma 5.2.8, we must have P \C 6 = ; for every C 2 causes(q, hT , A[P + i), hence for every C 2 causes(q, hT , Ai). Since (P , P + ) is validatable, we know that P ✓ F alse user , hence every cause of q in hT , Ai contains at least one assertion ↵ such that user(↵) = false.

In the other direction, if for every C 2 causes(q, hT , Ai) there exists ↵ 2 C such that user(↵) = false, then it is easily shown using Lemma 5.2.8 that

is a validatable repair plan that satisfies q. Lemma 5.2.10. An answer q 2 W is satisfiable iff there exists a T -consistent set of assertions C 0 such that hT , C 0 i |= q and for every ↵ 2 C 0 , either • user(↵) = true, or • ↵ 2 A, user(↵) = unknown and for every 2 A such that hT , {↵, }i |= ?, user( ) = false.

(We will call C 0 a witness for the satisfiability of q.)

Proof. If q 2 W is satisfiable, then there exists a validatable repair plan (P , P + ) such that (A\P ) [ P + contains a cause C 0 for q that contains no false assertion and has no conflicts in (A\P ) [ P + . It follows that for every ↵ 2 C 0 , either ↵ 2 P + and user(↵) = true, or ↵ 2 A and user(↵) = true or user(↵) = unknown, and every conflict of ↵ is in P , hence is such that user( ) = false.

Optimal deletion-only repair plans

Theorem 5.3.5. For complexity w.r.

Proof. Deciding if P ✓ A is a potential solution amounts to verifying that hT , A\Pi |= IAR q for every q 2 W, and hT , A\Pi 6 |= brave q for every q 2 U.

The other upper bounds follow from Lemma 5.3.3 and the fact that the formula ' can be constructed in polynomial time in |A|, |U| and |W|. Indeed, the construction relies upon computing the causes and conflicts of (un)wanted answers, which is known to be computable in P in |A|.

The lower bounds can be shown by reduction from propositional satisfiability related problems. Figure 5.3 illustrates the different reductions. Existence: The proof is by reduction from satisfiability of a CNF C 1 ^... ^Cm over x 1 , ...x n . Consider the following QRP setting:

We show that there exists a potential solution iff C 1 ^... ^Cm is satisfiable. First suppose that P is a potential solution, and let ⌫ be the valuation defined as follows: ⌫(x j ) = true iff there exists some P (c i , x j ) 2 A 0 \ P. Because P satisfies all wanted answers, we know that for every C i , the ABox A 0 \ P contains an assertion of the form P (c i , x j ) or N (c i , x j ).

In the former case, ⌫(x j ) = true, so ⌫ satisfies C i . In the latter case, since P satisfies the unwanted answer, N (c i , x j ) 2 A 0 \ P implies that ⌫(x j ) = false, so ⌫ satisfies C i .

Conversely, if ⌫ is a valuation of x 1 , ..., x n that satisfies the set of clauses, then P = {P (c i , x j )|⌫(x j ) = false} [ {N (c i , x j )|⌫(x j ) = true} is a potential solution: it satisfies every q 2 U since no x j can have both incoming P -and N -edges in A 0 \P, and every q 2 W because every clause contains some x j with ⌫(x j ) = true or ¬x j with ⌫(x j ) = false, so every c i has an outgoing P -or N -edge in A 0 \P. MCSWs: The proof is by reduction from deciding if a set of clauses of an unsatisfiable set of clauses {C 1 , ..., C m } is a MCS, using the same QRP setting as for existence. Since the set of clauses is unsatisfiable, there does not exist a potential solution. The MCSWs correspond to the MCSes of {C 1 , ..., C m }. Indeed, a set {S(c i 1 ), ..., S(c i k )} is a MCSW iff there exists a potential solution with W 0 = W\{S(c i 1 ), ..., S(c i k )} and for every M ( {S(c i 1 ), ..., S(c i k )} there is no potential solution with W 0 = W\M. Using the same arguments as in reduction for existence, one can show that the set of clauses {C 1 , ..., C m }\{C i 1 , ..., C i k } is satisfiable and for every M ( {C i 1 , ..., C i k }, {C 1 , ..., C m }\M is unsatisfiable. Indeed, a potential solution for W\{S(c i 1 ), ..., S(c i k )} corresponds to a valuation that satisfies {C 1 , ..., C m }\{C i 1 , ..., C i k }, and if there was a valuation satisfying {C 1 , ..., C m }\M for some M ( {C i 1 , ..., C i k }, there would be a potential solution for the corresponding W\M. The argument in the other direction proceeds analogously. We show that the formula is valid iff the repair plan (F alse user , ;) is not optimal. This repair plan satisfies the unwanted answer but does not satisfy the wanted answer. Indeed, the repair of A\F alse user that contains every F Y (y j ) does not contain any T Y or T assertion, so does not entail the wanted answer.

Considering the AR semantics for wanted answers

If is valid, there exists a valuation ⌫ of the x j that makes 8y 1 ...y p

satisfies U and W. The repairs of (A\P ) [ P + correspond exactly to the valuations of the y j . Since for every valuation of the y j , there exists a C i = l i 1 ^li 2 ^¬l i 3 ^¬l i 4 such that C i is true, the corresponding repair contains an F (x j ) or T (x j ) per x j , but not both, as well as P 1 (c i , l i 1 ), P 2 (c i , l i 2 ), N 1 (c i , l i 3 ), N 2 (c i , l i 4 ), and

3 ), and T (l i 4 ) or T Y (l i 4 ), depending whether l i j is a x j or a y j . In the other direction, if (F alse user , ;) is not optimal, then there exists (P , P + ) that satisfies U and W. P + contains at most one assertion F (x j ) or T (x j ) per x j . The valuation ⌫ such that ⌫(x j ) = true if T (x j ) 2 P + , ⌫(x j ) = false otherwise is such that 8y 1 ...y p W n i=1 ⌫(C i ) is true: since P ✓ F alse user , the repairs of (A\P ) [ P + correspond exactly to the valuations of the y j , so since W is satisfied for AR, for every valuation ⌫ of the y j , there is a C ⌫ i which evaluates to true in ⌫.

Implementation and experiments

the answers satisfied for AR. Note that in this case the final repair plan is not optimal since it may not satisfy for IAR some wanted answers that are satisfiable for IAR, but the number of insertions as well as the effort of the user is reduced.

Implementation and experiments

Computing deletion-only repair plans with CQAPri

We implemented the core components of the OptDeletionRepairPlan within CQAPri. During the query answering phase, the causes of the answers are computed and stored as for explaining the answers. The user is then asked to input unwanted and wanted answers. Based on this input and the precomputed causes and conflicts, CQAPri constructs the encoding ' = ' U ^'W of Figure 5.2 and uses the SAT solver to check whether there exists a potential solution. If so, it computes the necessarily (non)false assertions by checking for each relevant assertion ↵ if ' ^(¬)x ↵ is unsatisfiable, and sorts the remaining relevant assertions. Their impact is computed as follows: for each other relevant and non necessarily (non)false assertion , CQAPri checks whether ' ^x↵ ^(¬)x is unsatisfiable to compute the impact of ↵ being false, and whether ' ^¬x ↵ ^(¬)x is unsatisfiable for the impact of ↵ being true. For the latter case, the number of conflicts of ↵ in the relevant assertions is also taken into account. To compute the necessarily (non)false assertions and the impact of the others, we rely on a functionality of SAT4J that allows us to assign a value to some variables (for instance assuming that x ↵ is true and x false allows us to decide if removing ↵ implies that is necessarily false), so that the solver does not begin from scratch at each call but can capitalize on the clauses learned when deciding whether ' is satisfiable and on the model already found.

If the user validates the necessarily (non)false assertions, he may input false and true assertions. The encoding is then updated to take the user input into account by adding clauses of the form x ↵ if ↵ is false and ¬x ↵ if it is nonfalse, and CQAPri computes the necessarily (non)false assertions and the impact of the others for the new step.

At each step, CQAPri checks whether the current repair plan is a potential solution by verifying if: (i) it intersects all unwanted causes and (ii) it removes all conflicts of a cause that it does not intersect for each wanted answer. In this case, CQAPri stops and outputs the repair plan. To fully implement OptDeletionRepairPlan, we should add a phase that ensures that each wanted answer has an IAR cause validated by the user, which does not contain any false assertion.

If at some point there does not exist any potential solution (i.e. the encoding is unsatisfiable), CQAPri uses SAT4J to find the MCSWs by computing the maximal satisfiable subsets (MSSes) of the encoding, that are the complements of the MCSes. We did not implement the modification of the wanted answers by the user.

Preferred repair semantics

In the following, the sets of repairs of A for these three notions will be denoted GRep (T , A), P Rep (T , A) and CRep (T , A) respectively. Remark 6.1.13. If the priority is total, then it specifies how to resolve every conflict. In this case, GRep (T , A) = P Rep (T , A) = CRep (T , A) and contain only one repair [START_REF] Staworko | [END_REF]]. This repair is obtained by repeating the following step until the ABox is empty: choose an assertion which is not dominated for by any other, add it to the repair if it does not lead to T -inconsistency, and remove it from A.

These notions use another type of priority than the ✓ P -preference. It is thus natural to wonder how they are related. We show that the priority induced by a partition of A into priority levels (and even in the case where some assertions are not assigned to any level) makes the globally-optimal, the Pareto-optimal and the completion-optimal repairs coincide with the ✓ P -repairs. Notice that in the general case, these three notions of repairs can be different. Proposition 6.1.14. Let P [ I = hP 1 , ..., P k i [ I be a partition of A. Let P be the priority defined by: for , in A, P if there exist i, j 2 {1, ..., k} such that 2 P i , 2 P j and i > j and , are in a conflict. In this case, [START_REF] Staworko | [END_REF] To get a total priority, it suffices to arbitrary order the assertions belonging to I\R, to I \ R, to P i \R and to P i \ R for each i.

Clearly P ✓ 0 P . We show that R is a globally-optimal repair w.r.t. 0 P . Suppose it is not. Then there exist nonempty B ✓ R and D ✓ A\R such that for all 2 B, there exists 2 D such that

There exists 0 2 D such that 0 0 P 0 . It follows from the construction of 0 P that 0 / 2 P j for any j, so 0 2 I. Thus 0 2 I\R and 0 2 I \ R so 0 0 P 0 . This yields a contradiction so B \ I = ;. Let m = min {i | B \ P i 6 = ;}. If there exist j < m and 0 2 D \ P j then P 0 for all 2 B and since Preferred repair semantics

Suppose for a contradiction that R / 2 P Rep P (T , A). Then we can find nonempty B ✓ R and 2 A\R such that for all 2 B, P and (R\B) [ { } is T -consistent. Since there exists such that P , then there exists m such that 2 P m by definition of P . For all 2 B, since P , there exists i such that 2 P i and i > m. Let A 0 be any T -consistent extension of (R\B) [ { }. Since for all 2 B, 2

Then there exists a T -consistent subset A 0 ✓ A and m 2 {1, ..., k} such that R \ I ✓ A 0 \ I, R \ P j ✓ A 0 \ P j for all j < m, and R \ P m ( A 0 \ P m . (Indeed, if R \ P j ✓ A 0 \ P j for all j, and R \ I ( A 0 \ I, then R ( A 0 is not maximal.) Let 2 (A 0 \ P m )\R and let C be the set of assertions in R [ { } which belong to a conflict. The assertion belongs to C, since R is T -consistent and maximal for set inclusion. Let B = C\A 0 . B is nonempty, since A 0 is T -consistent and contains . We know that if 2 B then there exists i > m such that 2 P i (since for all 2 R, if 2 I or 2 P j with j  m, 2 A 0 ). So we have that for all 2 B, P and (R\B)

Complexity analysis

In this section, we study the complexity of query entailment under preferred repair semantics, focusing on DL-Lite R . However, many of our results hold also for other DLs and ontology languages.

There are some previous works that study the complexity of reasoning with preferred repairs: [Du et al. 2013] considers query answering under  w -AR semantics for the expressive DL SHIQ, but they focus on ground CQs, as such queries are better-supported by SHIQ reasoners. By contrast, we work with DL-Lite R and can thus use query rewriting techniques to handle CQs with existential variables. In [Lopatenko & Bertossi 2007], the authors study the complexity of query answering in the presence of denial constraints in the databases setting under the -AR and  w -AR semantics. Because of the difference in setting, we could not transfer their complexity results to DL-Lite R .

Table 6.1 recalls existing results for query entailment under the standard AR, IAR and brave semantics and presents our new results for the different preferred repair semantics. Theorem 6.2.1. The results in Table 6.1 hold.

We break the proof of Theorem 6.2.1 down into several propositions. We first consider combined complexity and the AR family of semantics. Proposition 6.2.2. Regarding combined complexity, CQ entailment over DL-Lite R KBs is ⇧ p 2 -complete under -AR, ✓ P -AR,  P -AR, and  w -AR semantics.

Preferred repair semantics

Proof. First, we observe that for all four notions of preferred repair, it is possible to test in coNP whether a given set constitutes a preferred repair. Indeed, if a consistent subset of the ABox is not a repair, then this is witnessed by another consistent subset which is preferred to it. Thus, non-entailment of a CQ q from a KB K = hT , Ai can be shown by guessing a subset R ✓ A and using an NP oracle to verify that (i) R is a preferred repair of K, and (ii) hT , Ri 6 |= q.

For the lower bounds, we note that the proof of ⇧ p 2 -hardness of CQ entailment under plain AR semantics can be reused for the -AR semantics, since the -repairs and ✓-repairs coincide for the KBs employed in that reduction. The lower bounds for the other semantics follow immediately.

We next turn to the data complexity of query entailment under the different brave and AR-based semantics. Proposition 6.2.3. Regarding data complexity, instance queries and CQ entailment over DL-Lite R KBs are coNP-complete for ✓ P -AR, and NP-complete for ✓ P -brave semantics. For instance queries, we obtain coNP-completeness also for combined complexity.

Proof. We observe that it can be tested in polynomial time (w.r.t. combined complexity) whether a subset R ✓ A is a ✓ P -repair. This can be done by first verifying that R is T -consistent and then for 1  i  k, checking that it is not possible to add an assertion belonging to

It follows that in the procedure from the proof of Proposition 6.2.2, properties (i) and (ii) can be verified in P w.r.t. data complexity, yielding a coNP upper bound for CQ entailment under ✓ P -AR.

For ✓ P -brave, replacing (ii) by hT , Ri |= q in the procedure from the proof of Proposition 6.2.2 gives a procedure to show ✓ P -brave entailment of a CQ q. This gives us the NP upper bound.

Finally, we note that in the case of instance queries, property (ii) can be checked in P w.r.t. combined complexity in both cases, and so we obtain the upper bounds also w.r.t. combined complexity.

The lower bound for ✓ P -AR follows from the coNP-hardness of instance query entailment under the standard AR semantics.

For the ✓ P -brave semantics, the NP-hardness of instance query entailment can be shown by reduction from SAT. Let ' = c 1 ^. . . ^cm be a propositional CNF with variables x 1 , ..., x n . Consider the TBox and prioritized ABox defined as follows:

with A = P 1 [ P 2 and P = hP 1 , P 2 i. Figure 6.1 illustrates the reduction. It can be verified that hT , Ai |= ✓ P -brave B(a) iff ' is satisfiable. Indeed, ' is satisfiable iff there exists a

Complexity analysis

Fig. 6.1 Reduction from SAT for NP-hardness of ✓ P -brave query answering. Graphical representation of the ABox constructed from an example set of clauses

✓-repair of P 1 that contains no U assertion (as in the proof for coNP-hardness of plain AR query entailment). Since the U -edges are preferred to B(a), there exists a ✓ P -repair of A that contains B(a) iff there exists a ✓-repair of P 1 that contains no U assertion. It follows that ' is satisfiable iff hT , Ai |= ✓ P -brave B(a).

For the  P and  w -based semantics, we distinguish two cases, depending on whether the maximal number of priority classes (resp. maximal weight) is considered to be fixed independently of the ABox or is counted as part of the input. The former assumption is made in [Du et al. 2013], where a p 2 [O(log n)] upper bound is given for the expressive DL SHIQ that contains DL-Lite R as a fragment. A p 2 [O(log n)] lower bound for atomic queries is also given in [Du et al. 2013], but the proof uses constructs that are unavailable in DL-Lite. Likewise, the proof of p 2 [O(log n)]-hardness for atomic queries under the -AR semantics from [Lopatenko & Bertossi 2007] utilizes denial constraints that cannot be expressed in DL-Lite. Proposition 6.2.4. Regarding data complexity, instance query and CQ entailment over DL-Lite R KBs are:

• p 2 -complete for the  P -AR,  w -AR,  P -brave and  w -brave semantics, • p 2 [O(log n)]-complete for the -AR and -brave semantics, and for the  P -AR and  P -brave, and  w -AR and  w -brave semantics, if there is an ABox-independent bound on the number of priority classes (resp. maximal weight).

For instance queries, these results also hold w.r.t. combined complexity.

For the proof of Proposition 6.2.4 and later propositions, we will leverage the following result, which demonstrates how the semantics based upon the prioritized cardinality preference relation can be recast in terms of weight functions. Lemma 6.2.5. (Adapted from [Eiter & Gottlob 1995]) Let P = hP 1 , . . . , P k i be a prioritization of A, let u = (max k i=1 |P i |) + 1, and let w be defined by: w(↵) = u k i for ↵ 2 P i . Then the set of  P -repairs of hT , Ai coincides with the set of  w -repairs of hT , Ai, for every TBox T .

Preferred repair semantics

The proof of Proposition 6.2.4 will also make frequent use of the following characterization of -repairs.

Proof. For the first direction, let R be in Rep  (K). Suppose for a contradiction that there exist a subset X of R and a subset

For the other direction, let R be a T -consistent subset of A such that there does not exist any subset X of R such that there exists a subset

We are now ready to give the proof of Proposition 6.2.4.

Proof of Proposition 6.2.4. Upper bounds. For the  w -AR semantics, we use the following procedure to decide whether K 6 |= w-AR q:

1. Compute the weight u rep of  w -repairs by binary search, calling the NP oracle to determine whether there exists a T -consistent subset A 0 ✓ A such that  ↵2A 0 w(↵) u where u is the input.

2. Call the NP oracle to determine whether there exists R ✓ A, T -consistent and such that  ↵2R w(↵) = u rep and hR, T i 6 |= q. Return "not entailed" if the call succeeds.

This procedure yields membership in p 2 for the general case. If there is an ABox-independent bound b on the maximal value of w, then u rep  Â ↵2A w(↵)  b|A|, where b is treated as a constant. It follows that the procedure requires only logarithmically many oracle calls, yielding an improved upper bound of p 2 [O(log n)]. Note that in the case of instance queries, we can test hR, T i 6 |= q in polynomial time w.r.t. combined complexity, so these upper bounds apply also w.r.t. combined complexity.

We can derive the upper bounds for the  P -AR semantics by applying Lemma 6.2.5. Note that when there is a bound k on the number of priority levels, then this implies a polynomial bound of (max k i=1 |P i | + 1) k 1  (|A| + 1) k 1 on the maximal weight of the corresponding weight function, and so the p 2 [O(log n)] upper bound applies. This holds in particular when k = 1, i.e. for the -AR semantics.

For the  w ,  P , and -brave semantics, we simply replace hR, T i 6 |= q by hR, T i |= q in the above procedure.

In the case where we consider the repairs that have a weight greater than a fraction 0 < t < 1 of the maximum weight, we simply need to replace u rep by t ⇤ u rep in the second 6.2 Complexity analysis Fig. 6.2 Reduction for p 2 -hardness of query answering under  P -AR or  P -brave semantics. Graphical representation of the ABox constructed from an example set of clauses ' = {c

step. In this case we cannot use Lemma 6.2.5 to derive the upper bound for  P -AR, but it is still possible to use a similar procedure, which starts by computing the number of assertions of each priority in a preferred repair by binary search (compute first the maximum number s 1 rep of assertions from P 1 in a consistent subset, then the maximum number of assertions from P 2 in a consistent subset that contains s 1 rep of assertions from P 1 , etc..).

p 2 lower bound for instance queries under  P -AR and  P -brave semantics. The proof is by reduction from the following P 2 -complete problem, cf. [Krentel 1988]: given a satisfiable 3CNF formula ' = c 1 ^. . . ^cm over variables x 1 , ..., x n , decide whether the lexicographically maximum truth assignment satisfying ' with respect to (x 1 , ..., x n ), denoted by ⌫ max , fulfills ⌫ max (x n ) = true. We encode this problem as a  P -AR (resp.  P -brave) query entailment problem as follows:

with the prioritization P = hP 1 , ..., P n+1 i of A as follows: We show that hT , Ai |=  P -AR q (resp. hT , Ai |=  P -brave q) iff ⌫ max (x n ) = true.

Preferred repair semantics

The formula ' is satisfiable so there exists a truth assignment ⌫ satisfying '. Let A 00 be the subset of A defined as follows:

and let A 0 be a ✓-repair of A 00 . All the conflicts between the assertions in A 00 are of the form {P l (c j , x i ), P l 0 (c j , x i 0 )}, {N l (c j , x i ), N l 0 (c j , x i 0 )} or {P l (c j , x i ), N l 0 (c j , x i 0 )} so A 0 contains the same assertions involving T than A 00 and exactly m assertions of the form P l (c j , x i ) or N l (c j , x i ) (one for each clause c j , since there is no reason to remove all P l (c j , x i ) or N l (c j , x i ) for a given c j ).

It follows that A 0 is a ✓-repair of A which contains m assertions of P 1 . Since it is not possible for a T -consistent subset of A to contain more than one assertion of P 1 involving c j for each c j , a  P -repair of A contains exactly m assertions of P 1 .

Then, among all ✓-repairs of A which contain m assertions of P 1 , if some of them contain T (x 1 ), the others are not  P -repairs of A. In the same way, for all 1  i  n, among all ✓-repairs of A which contain m assertions of P 1 and all possible T (x h ) w.r.t. the same condition for h < i, if some of them contain T (x i ), the others are not  P -repairs of A.

Thus, all  P -repairs of A contain the same assertions T (x i ), and the x i are precisely the variables assigned to true in the lexicographically maximum truth assignment satisfying ', ⌫ m .

It follows that K |=  P -AR q (resp. K |=  P -brave q) if and only if ⌫ m (x n ) = true.

p 2 [O(log n)]-hardness for instance queries under -AR and -brave semantics. The proof is by reduction from the Parity(3SAT) problem where we assume that the formulas are such that ' i+1 is unsatisfiable whenever ' i is unsatisfiable (cf. Appendix A.3). Consider a Parity(3SAT) instance given by ' 1 , . . . , ' n . For each i, 1  i  n, let {c i,1 , ..., c i,m(i) } be the clauses of ' i over variables X i = {x i,1 , ..., x i,l(i) }. We define an -AR (resp. -brave)

Complexity analysis

For all c i,j and 1  r  7, F r (' i , c i,j ) / 2 R. Suppose for a contradiction that there exists c i,j such that for all x i,h and all l,

If i is even, it is possible to add 7 assertions of the form F r (' i , c i,j ) and remove the 5 assertions S g (' i ) 2 R to obtain a T -consistent subset of A, contradicting the fact that R is a -repair. If i is odd, it is possible to add 7 assertions of the form F r (' i , c i,j ) and 3 assertions of the form W d (a i ) and remove the 5 assertions S g (' i ) 2 R and 4 assertions K m (a i , ' i ) 2 R (or add 7 assertions of the form F r (' i , c i,j ) and remove the 5 assertions S g (' i ) 2 R if there is no assertions of the form K m (a i , ' i ) in R) to obtain a T -consistent subset of A, contradicting the fact that R is a -repair. Thus for all c i,j , there exists x i,h such that P 1 l (c i,j , x i,h ) 2 R or N 1 l (c i,j , x i,h ) 2 R. Let ⌫ i be the truth assignment of the variables of X i defined as follows:

Claim 3 If ' i is unsatisfiable and R 2 Rep  (K), then there exists j such that F 1 (' i , c i,j ) 2 R.

Proof of claim. Suppose that ' i is unsatisfiable and let R 2 Rep  (K). Since ' i is unsatisfiable, S g (' i ) / 2 R, 1  g  5 (by 2). Hence there exists j such that F r ('

Thus, if i is odd, then there exists

In both cases, there exists

Suppose for a contradiction that ' i is satisfiable. Then S 1 (' i ) 2 R (by 1) which is not possible since F 1 (' i , c i,j ) and S 1 (' i ) are in a conflict. (End proof of Claim 4)

If there exists an odd integer k such that S 1 (' k ) 2 R and there exists j such that F 1 (' k+1 , c k+1,j ) 2 R, or such that S 1 (' k ) 2 R and k = n, then Preferred repair semantics

satisfy the above conditions, and suppose for a contra-

We have obtained the desired contradiction, so we can conclude that A(y, a k ) 2 R. (End proof of Claim 5)

First suppose for a contradiction that

repair. This is a contradiction, so we may conclude that S 1 (' k ) 2 R.

If k 6 = n, suppose for a contradiction that for every j, F r ('

) and adding the 5 S g (' k+1 ) will provide a T -consistent subset of A with a greater cardinality than R).

Again we have a reached a contradiction, and so may infer that there is some j such that F r (' k+1 , c k+1,j ) 2 R (1  r  7). (End proof of Claim 6)

We are now ready to show that K |= -AR q (resp. K |= -brave q) if and only if the answer of the initial Parity(SAT) problem is "yes".

• First suppose that there exists an odd integer k such that ' k is satisfiable and

(by Claim 1), and since ' k+1 is unsatisfiable (or k = n) there exists j such that F 1 (' k+1 , c k+1,j ) 2 R (by Claim 3) (or k = n). Hence A(y, a k ) 2 R (by Claim 5). Thus for every R 2 Rep  (K), A(y, a k ) 2 R so hR, T i |= Y (y). Hence K |= -AR q (and therefore K |= -brave q). • To show the other direction, suppose that K |= -brave Y (y) (or that K |= -AR Y (y)).

There exists R 2 Rep  (K) such that hR, T i |= Y (y), so there exists an (necessarily odd) integer k such that A(y, a k ) 2 R. Thus by Claim 6, S 1 (' k ) 2 R and there exists j such that F 1 (' k+1 , c k+1,j ) 2 R, or S 1 (' k ) 2 R and k = n. It follows that ' k is Preferred repair semantics Fig. 6.4 Reduction from UNSAT for coNP-hardness of ✓ P -IAR query answering. Graphical representation of the ABox constructed from an example set of clauses

We show coNP-hardness using a reduction from UNSAT. Let ' = c 1 ^. . . ^cm be a propositional CNF with variables x 1 , ..., x n . Consider the TBox and prioritized ABox defined as follows:

with A = P 1 [ P 2 [ P 3 and P = hP 1 , P 2 , P 3 i. Figure 6.4 illustrates the reduction. It can be verified that hT , Ai |= ✓ P -IAR A(a) iff ' is unsatisfiable. Indeed, a ✓ P -repair does not contain A(a) iff it contains B(a) (since it is its only conflict), and since the U -edges are preferred to B(a), a ✓ P -repair contains B(a) only if it contains some P or N assertions that conflict every U , i.e. if ' is satisfiable. In the other direction, if ' is satisfiable, there exists a ✓ P -repair that contains no U and such a repair contains either A(a) or B(a). Proposition 6.2.9. For data and combined complexity, instance query and CQ entailment over DL-Lite R KBs is:

• p 2 -complete for the  P -IAR and  w -IAR semantics, • p 2 [O(log n)]-complete for the -IAR semantics, and for the  P -IAR and  w -IAR semantics, if there is an ABox-independent bound on the number of priority classes (resp. maximal weight).

We also have p 2 [O(log n)]-completeness for CQ entailment under ✓ P -IAR semantics for combined complexity.

Proof. Upper bounds. For the  w -IAR semantics, we can use the following procedure to decide whether hT , Ai 6 |= w-IAR q:

1. Compute the weight u rep of  w -repairs (cf. proof of Proposition 6.2.4).

Complexity analysis

2. For every ↵ 2 A, use an NP oracle to decide if there exists a T -consistent subset B ✓ A such that ↵ 6 2 B and  ↵2B w(↵) = u rep . Let A 0 be the set of all assertions for which no such subset exists.

3. Use an NP oracle to verify that the CQ q is not entailed from hT , A 0 i.

Correctness of the above procedure is straightforward: the ABox A 0 constructed in Step 2 is precisely the intersection of the  w -repairs. The procedure runs in polynomial time with access to an NP oracle, yielding membership in p 2 . For the bounded weight case, we recall that the class p 2 [O(log n)] can be equivalently characterized as the class of decision problems which can be solved in polynomial-time with a single round of parallel calls to an NP oracle, cf. [Buss & Hay 1991]. By using this technique, instead of computing u rep in

Step 1 by making a sequence of logarithmically many oracle calls, we can instead issue a single round of parallel calls to the NP oracle. Steps 2 and 3 can be implemented using two further rounds of parallel NP oracle calls. It follows from results in [Buss & Hay 1991] that we can reduce these three rounds into a single one, from which membership in p 2 [O(log n)] follows.

Similarly to the proof of Proposition 6.2.4, we can exploit Lemma 6.2.5 to obtain the upper bounds for the  P -IAR and -IAR semantics. For the ✓ P -IAR semantics, we can skip Step 1 of the procedure and modify Step 2 by using the polynomial-time procedure for identifying ✓ P -repairs from the proof of Proposition 6.2.4. p 2 [O(log n)]-hardness for CQs and ✓ P -IAR semantics. The proof is by reduction from the Parity(3SAT) problem. Let = ' 1 , . . . , ' n be a Parity(3SAT) instance satisfying the same restrictions as in the proof of Proposition 6.2.4, where each ' i is a 3CNF over the variables x i,1 , . . . , x i,g i composed of m i clauses c i,1 , . . . , c i,m i . We combine ideas from the proof of Proposition 6.2.8 with a construction from [START_REF] Bienvenu | [END_REF]]. In the latter paper, the authors define ABoxes A j for the odd j 2 [1, n] and a Boolean CQ q with the following properties:

1. if j 1 6 = j 2 , then Inds(A j 1 ) \ Inds(A j 2 ) = ;; 2. h;, S j A j i |= q if and only if h;, A j i |= q for some j; 3. h;, A j i |= q if and only if ' `is satisfiable for 1  ` j; 4. there is a variable x in q and an individual a j in each A j such that h;, A j i |= q if and only if h;,

The query q and ABoxes A j provide a means of showing that the first j formulas are satisfiable, but we still also need a way of showing that the j+1st formula is unsatisfiable.

To this end, we consider the TBox from the proof of Proposition 6.2.8:

Preferred repair semantics A

where we assume that P, N, U, B, A are fresh roles and concepts, appearing neither in q nor any A j . We also create ABoxes

where the individuals of the forms c j+1,`a nd x j+1,h are fresh and do not appear in any A j or any B j 0 for j 0 6 = j, and the individual a j is shared by B j and A j . We then define the ABox A as the union of the A j and B j , for all odd j 2 [1, n], and consider the following prioritization P = hP 1 , P 2 , P 3 i:

We remark that since the signatures of the ABoxes A j and T are disjoint, the assertions in the ABoxes A j are not involved in any conflicts, and hence belong to every ✓ P repair. Moreover, because the ABoxes B j use disjoint sets of variables, the ✓ P -repairs of A w.r.t. T can be obtained by repairing each of the B j separately (according to the prioritization P ) and taking the union of these repairs and the ABoxes A j . Using similar arguments to Proposition 6.2.8, one can show that hT , Ai |= ✓ P -IAR A(a j ) just in the case that ' j+1 is unsatisfiable.

Complexity analysis

Now let q 0 be the query obtained by adding A(x) to q. We aim to show that hT , Ai |= ✓ P -IAR q 0 if and only if there is an odd j 2 [1, n] such that ' j is satisfiable and ' j+1 is unsatisfiable.

First suppose that hT , Ai |= ✓ P -IAR q 0 , and let R be the intersection of the ✓ P -repairs. Then hT , Ri |= q 0 , and since T contains only negative inclusions, we in fact have h;, Ri |= q 0 . Thus, there exists a function ⇡ mapping variables in q 0 to individuals in R which witnesses the satisfaction of q 0 . It follows that A(⇡(x)) 2 R, and hence ⇡(x) = a `for some odd `2 [1, n]. By above, we know that this means that ' `+1 is unsatisfiable. We have also seen above that R contains all of the A j , and since q uses only predicates from the A j , we must have h;, S j A j i |= q. By Properties 2 and 4, we can infer that h;, A `i |= q. Applying Property 3, we obtain that ' `is satisfiable.

For the other direction, suppose that ' j is satisfiable and ' j+1 is unsatisfiable. Then by our earlier assumption, for every 1  ` j, the formula ' `is satisfiable. It follows then by Property 3 that h;, A j i |= q, and so by Property 4, we must have h;, A j i |= q[x 7 ! a j ]. Since A j appears in all repairs, this yields hT , A j i |= ✓ P -IAR q[x 7 ! a j ]. By earlier arguments, the unsatisfiability of ' j+1 means that hT , Ai |= ✓ P -IAR A(a j ). Putting this together, we obtain hT , Ai |= ✓ P -IAR q 0 .

Remaining lower bounds. To show the p 2 lower bounds, we can use the reduction from the proof of Proposition 6.2.4: as the TBox does not give any way of deriving T (x n ), the query T (x n ) holds in all  P -repairs iff it holds in the intersection of all  P -repairs. Finally, a p 2 [O(log n)] lower bound for instance query entailment under -IAR semantics can be proved similarly to the corresponding result for the -AR semantics (Proposition 6.2.4).

Let us briefly comment on the obtained results. Concerning data complexity, we observe that the use of preferred repairs significantly impacts complexity: we move from polynomial data complexity in the case of (plain) IAR or brave semantics to coNP-hard or NP-hard data complexity (or worse) for IAR and brave semantics based on preferred repairs. Actually, the IAR semantics is just as difficult as the AR semantics. This is due to the fact that there is no simple way of computing the intersection of preferred repairs, whereas this task is straightforward for ✓-repairs. In the same way, for brave semantics, verifying the existence of a cause for the query is not sufficient to show that it holds under -brave semantics, since a cause is not guaranteed to belong to some -repair. However, if we consider combined complexity, we see that the IAR and brave semantics still retain some computational advantage over AR semantics. This lower complexity comes from the fact that the IAR and brave semantics require only that the answer is entailed by one set of facts (either the intersection of the repairs or some repair), while the AR semantics requires it is entailed by every repair. Note that for the IAR semantics, one can precompute the intersection of repairs in an offline phase and then utilize standard querying algorithms at query time. Finally, if we compare the different types of preferred repairs, we find that the ✓ P preorder leads to the lowest complexity, and  P and  w the greatest. However, under the reasonable assumption that there is a bound on the number of priority classes (resp. maximal weight), we obtain the same complexity for the semantics based on -,  P -and  w -repairs.

Preferred repair semantics

We should point out that the only properties of DL-Lite R that are used in the upper bound proofs are (i) consistency and instance checking are in P w.r.t. combined complexity, and (ii) CQ entailment is in P w.r.t. data complexity and in NP w.r.t. combined complexity. Consequently, our combined complexity upper bounds apply to all ontology languages having polynomial combined complexity for consistency and instance checking and NP combined complexity for CQ entailment, and in particular to the OWL 2 EL profile [Motik et al. 2012]. Our data complexity upper bounds apply to all data-tractable ontology languages, which includes Horn DLs [START_REF] Hustadt | [END_REF], Eiter et al. 2008] and several classes of the existential rules framework, also called Datalog +/- [START_REF] Calì | [END_REF]]. Such classes have been introduced in [Baget et al. 2011a, Baget et al. 2011b, Krötzsch & Rudolph 2011, Thomazo 2013b].

Query answering via reduction to SAT for ✓ P -repair based semantics

Since the ✓ P -repair based semantics are coNP or NP-complete w.r.t. data complexity, we propose to reduce query answering to SAT, as we did for plain AR semantics.

In the case of the ✓ P -AR semantics, the most obvious encoding would stipulate that the subset corresponding to a valuation (i) contains no cause for q, (ii) is maximal w.r.t. ✓ P , and (iii) contains no conflicts. However, such an encoding would contain as many variables as ABox facts, even though most of the ABox may be irrelevant for answering the query at hand. In order to identify potentially relevant assertions, we introduce the notion of an oriented conflict graph. In what follows, we use ↵ P to signify that there exist i  j such that ↵ 2 P i and 2 P j , i.e. ↵ has priority over . Definition 6.3.1. Let K = hT , Ai be a DL-Lite R KB and P be a prioritization of A. The oriented conflict graph for K and P , denoted G P K , is the directed graph whose set of vertices is A and which has an edge from to ↵ whenever ↵ P and {↵, } is a conflict for K.

The outgoing edges of an assertion in the oriented conflict graph link it to the assertions of same or greater priority which conflict it. The assertions without outgoing edges conflict only assertions of lower priority.

We now give a succinct encoding inspired from that for plain AR semantics, which can be seen as selecting a set of assertions which contradict all of the query's causes, and verifying that this set can be extended to a ✓ P -repair. Importantly, to check the latter, it suffices to consider only those assertions that are reachable in G P K from an assertion that contradicts some cause. Theorem 6.3.2. Let q be a Boolean CQ , K = hT , Ai be a DL-Lite R KB, and P = hP 1 , . . . , P n i be a prioritization of A. Consider the following propositional formulas having 6.3 Query answering via reduction to SAT for ✓ P -repair based semantics variables of the form x ↵ for ↵ 2 A:

where R q is the set of assertions reachable in G P K from some assertion such that x appears in ' ¬q . Then K |= ✓ P -AR q iff ' ¬q ^'max ^'cons is unsatisfiable. In order to prove Theorem 6.3.2, we begin by establishing the following lemmas that relate the ✓ P -repairs of A with the ✓ P -repairs of R q . Lemma 6.3.3. Every ✓ P -repair of R q can be extended to a ✓ P -repair of A.

Proof. Let B be a ✓ P -repair of R q . Construct a set A 0 by adding to B a maximal subset C 1 of assertions from

and so on. By construction, the set A 0 is T -consistent, and we claim that it is in fact a ✓ P -repair of A. Suppose for a contradiction that this is not the case. Then there must exist another T -consistent set B 0 ✓ A and some k such that A 0 \ P i = B 0 \ P i for every 1  i < k, and

known to be T -consistent, and all conflicts involve at most two assertions, it must be the case that ↵ conflicts with some 2 B \ (P 1 [ . . . [ P k ). Since 2 B, it must belong to R q . It follows then from the definition of R q and the fact that ↵ 2 P k that the assertion ↵ must also belong to R q . Now consider the set

Proof. Let A 0 be a ✓ P -repair of A, and set

Suppose for a contradiction that there exists a set R 0 ✓ R q such that R ( P R 0 , and let k be such that

satisfies the following:

1. A 00 is T -consistent.

2. A 0 ( P A 00 .

Preferred repair semantics

Note that these statements together contradict our earlier assumption that A 0 is a ✓ P -repair.

To show the first statement, suppose for a contradiction that A 00 is T -inconsistent. Since A 0 \ R q and R 0 are both known to be T -consistent, and conflicts in DL-Lite R involve at most two assertions, there must exist a conflict {↵, } with ↵ 2 (A 0 \ R q ) \ (P 1 [ . . . [ P k ) and 2 R 0 . Moreover, since 2 R q and ↵ 6 2 R q , we must have P ↵. The assertion ↵ belongs to P 1 [ . . . [ P k , so we must have 2 P j for some j < k. Since R \ P i = R 0 \ P i for all 1  i < k, it follows that 2 R, hence {↵, } ✓ A 0 . This is a contradiction, since A 0 was assumed to be a ✓ P -repair, and so must be T -consistent.

For the second statement, we simply note that since R \ P i = R 0 i \ P i for all 1  i < k, we have A 0 \ P i = A 00 \ P i for every 1  i < k, and since R \ P k ( R 0 \ P k , we also have

Proof of Theorem 6.3.2. We observe that the set of assertions ↵ whose corresponding variable x ↵ appears in the formula ' ¬q ^'max ^'cons is precisely the set R q . Moreover, every variable x ↵ with ↵ 2 R q appears in the subformula ' max . For the first direction, suppose that the formula ' ¬q ^'max ^'cons is satisfiable, and let ⌫ be a satisfying truth assignment. Consider the corresponding set of assertions R ⌫ ✓ R q consisting of all those assertions ↵ whose corresponding variable x ↵ is assigned to true by ⌫. As ⌫ satisfies ' cons , the set R ⌫ contains no conflicts, i.e. it is T -consistent. We claim that R ⌫ is a ✓ P -repair of R q . Suppose that this is not the case, and let R 0 be a T -consistent subset of R q such that R \

max is satisfied by ⌫, there must exist some variable x with ⌫(x ) = true such that the corresponding assertion satisfies 2 confl({↵}, K) and P ↵. However, we know that R \ P i ✓ R 0 i \ P i for every 1  i  k, hence 2 R 0 , contradicting the supposed consistency of R 0 . We have thus shown that R ⌫ is a ✓ P -repair of R q . Applying Lemma 6.3.3, we can find a ✓ P -repair A 0 of A such that R ⌫ ✓ A 0 . To show that hT , A 0 i 6 |= q, consider some cause C for q in K. Then since ⌫ satisfies ' ¬q , there must exist some assertion ↵ 2 C and some 2 confl({↵}, K) such that ⌫(x ) = true. It follows that 2 R, hence 2 A 0 and C 6 ✓ A 0 . We have thus showed that A 0 contains no cause for q. We can thus conclude that K 6 |= ✓ P -AR q. For the other direction, suppose that K 6 |= ✓ P -AR q, and let R be a ✓ P -repair of A such that hT , Ri 6 |= q. Consider the set R 0 = R \ R q . By Lemma 6.3.4, we have that R 0 is a ✓ P -repair of R q . Let ⌫ R 0 be the truth assignment that assigns to true precisely those variables x ↵ for which ↵ 2 R 0 . We wish to show that ⌫ R 0 satisfies ' ¬q ^'max ^'cons . First, consider some cause C ✓ A for q w.r.t. K. Since hT , Ri 6 |= q, there must exist an assertion ↵ 2 C that does not appear in R. We also know that R is a ✓ P -repair, so there must exist some 2 R with P ↵ that conflicts with ↵ (otherwise, we could obtain a more preferred subset by adding ↵ to R and removing any assertions conflicting with ↵). The assertion belongs to R q , so the variable x will be assigned to true by ⌫ R 0 , and the clause in ' ¬q that corresponds to cause C is satisfied by ⌫ R 0 . We have thus shown that every clause in ' ¬q is satisfied.

Next, consider an assertion ↵ 2 R q and its associated clause

If ↵ 2 R 0 , then x ↵ will be assigned true by ⌫ R 0 , and the clause is satisfied. If instead ↵ 6 2 R 0 , then also ↵ 6 2 R. Using the fact that R is a ✓ P -repair of A and similar where R q is the set of assertions reachable in G P K from some assertion ↵ such that x ↵ appears in ' q . Then K |= ✓ P -brave q iff ' q ^'max ^'cons is satisfiable. Proof. As in proof of Theorem 6.3.2, the set of assertions whose corresponding variables are assigned to true in a valuation that satisfies ' max ^'cons can be extended to a ✓ P -repair. If the valuation also satisfies ' q , this set of assertion contains a cause for q, so K |= ✓ P -brave q. In the other direction, if there exists a ✓ P -repair that contains a cause for q, we can find a valuation that satisfies ' q ^'max ^'cons . As in proof of Theorem 6.3.2, if R is a ✓ P -repair that contains a cause C for q, R 0 = R \ R q is a ✓ P -repair of R q . The valuation ⌫ R 0 that assigns to true the variables whose corresponding assertions are in R 0 and assigns w C to true and w 0 C to false for every other cause C 0 for q satisfies ' q ^'max ^'cons . Indeed, since C ✓ R and every assertion of C has its corresponding variable that appears in ' q , C ✓ R 0 so for every ↵ 2 C, ⌫ R 0 (↵) = true.

Implementation and experiments

Consistent query answering with priorities in CQAPri

We implemented query answering under ✓ P -AR and ✓ P -IAR semantics within CQAPri. To take into account priorities over ABox assertions, we store the conflicts of the KB as an oriented conflict graph, so that each assertion is linked only to its conflicts of same or greater priority.

When a query arrives, CQAPri computes the candidate answers and their images as in the case without priorities, then discards the non-brave answers by checking if all their images contain some conflict, and identifies an approximation of the ✓ P -IAR ones by checking whether there is some image whose assertions have no outgoing edges in the oriented conflict graph. For those (plain) brave-answers that are not found in the approximation of ✓ P -IAR answers, CQAPri uses the SAT encoding from the preceding section to decide if they hold under ✓ P -AR semantics. Finally, for the ✓ P -AR answers not in the approximation of ✓ P -IAR, it can decide if they hold under ✓ P -IAR semantics with the SAT encodings for ✓ P -IAR.

We also implemented an alternative method that consists in first computing the set of assertions that appear in some image of the candidate answer and are in the intersection of the ✓ P -repairs. For each relevant assertion, we use our encoding to decide if it is entailed under ✓ P -IAR semantics. We then ignore the outgoing edges of such assertions in the oriented conflict graph when computing the approximation of ✓ P -IAR answers, which is therefore exactly the set of ✓ P -IAR answers.

Note that we can observe some high-level similarities between our system and that presented in [Du et al. 2013] for querying SHIQ KBs under  w -AR semantics, which also employs SAT solvers and uses a reachability analysis to identify a query-relevant portion of the KB.

Implementation and experiments

Prioritized ABoxes

We put different prioritizations over our benchmark ABoxes. Prioritizations of an ABox were made either by choosing the same priority level for all the assertions of a concept/role or by choosing a priority level for each ABox assertion. We built prioritizations this way to capture a variety of scenarios. For instance, a database administrator may (manually) partition an ABox using a few priority levels set by concept/role, based upon the reliability of the business processes that provide the data; an ABox integrating data from many sources may be partitioned with more priority levels set per assertion, with the priority of an assertion depending on the reliability of the sources from which it originates.

We built 4 prioritizations for each ABox, further denoted by the id uXcY of the ABox it derives from, and a suffix pZW first indicating the number Z of priority levels, and then whether priority levels were chosen per concept/role (W = cr) or assertion (W = a). In our experiments, the number of priority levels is 3 and 10.

Experimental results

We measure query answering time and how it varies w.r.t. the size and ratio of conflicts of the ABox depending on the prioritization (3 or 10 levels of priority, set per concept/role or assertion). We also compare our two approaches to see in which cases computing the set of ✓ P -IAR assertions involved in the problem improves the performances.

The main conclusion of our experiments is that adding priorities really complicates query answering under AR, and even more IAR semantics. In particular, query answering is less robust to the number of conflicts. CQAPri runs out of memory or time (time-out fixed to 3 hours) for many queries on ABoxes which are large or have many assertions in conflicts (e.g. , even on u20c20p3a, CQAPri runs out of time for three queries, and for six when we try to compute the exact set of ✓ P -IAR answers). However, query answering with priorities remains feasible on realistic cases, when there are only a few assertions in conflict (uXc1pZW case), and on small ABoxes (up to u20cYpZW). We therefore present the results on these cases. Figures 6.6 and 6.7 show the evolution of the query answering time w.r.t. the proportion of conflicting assertions for u1cYpZW and u20cYpZW in five cases: standard AR query answering, and ✓ P -AR query answering for the four prioritizations. Figure 6.8 shows the evolution of the query answering time w.r.t. the size of the ABox for the same five cases.

Using priorities makes query answering more sensitive to conflicts because the size of the encodings is related to the number of assertions reachable from the causes in the oriented conflict graph. We observed that using 3 priority levels typically led to harder instances than using 10 levels. Indeed, when there is a large number of priority levels, there are less pairs of conflicting assertions of the same priority, so fewer conflicts translate into bidirectional edges in the oriented conflict graph and the encodings involve fewer assertions. By contrast, it is not clear whether choosing to set priority levels per assertion or per concept and role has an impact on the difficulty of query answering. Extension of our results to other languages of the DL-Lite family We recall that DL-Lite core is the core language of the family and amounts to DL-Lite R without role inclusions. DL-Lite F extends DL-Lite core with functionality axioms on roles or on their inverses of the form (funct S). DL-Lite A extends DL-Lite core with both role inclusions and functionality with the restriction that functional roles cannot be specialized, i.e. used positively on the right-hand side of a role inclusion.

Preferred repair semantics

The complexity of query answering, consistency checking and computation of the causes for a query and the conflicts of a knowledge base are the same for all these languages, and the size of the conflicts is at most two in all cases. Therefore, all complexity upper bounds presented in the thesis hold for DL-Lite core , DL-Lite R , DL-Lite F and DL-Lite A . Moreover, since all our algorithms only need the causes and conflicts, they can be used without any modification. To make our prototype CQAPri able to handle KBs expressed in DL-Lite F or DL-Lite A , we simply need to modify the computation of the conflicts of the knowledge base that currently only search for violation of disjointness TBox axioms in order to also find pairs of assertions that contradict functionality axioms.

Regarding complexity lower bounds, all hardness results of Chapters 4 and 6 hold for KBs expressed in DL-Lite core , hence for these four DL-Lite dialects. Indeed, the reductions used to prove hardness in these chapters do not use role inclusions. In Chapter 5, the complexity results for potential solutions (Theorem 5.3.5) hold for KBs expressed in DL-Lite core , but the reductions used in the proofs of the complexity results related to optimal repair plans (Theorem 5.2.16) use role inclusions. Note that if we allow the restriction of the signature of the assertions that can be added, the hardness results hold for DL-Lite core : we can avoid using role inclusions in the reductions if we restrict this signature. For the complexity of recognizing an optimal repair plan with AR (Theorem 5.4.10), the ⇧ p 2 -hardness results hold for DL-Lite core , but not the p 2 [O(log n)]-hardness results. The latter hold in the case where the insertion signature is restricted.

Regarding Horn versions of DL-Lite, which allow the use of conjunctions in the concepts appearing in the left-hand side of TBox inclusions, our complexity results do not hold because in this case the size of the causes is not bounded by q, so they cannot be computed in P.

DL languages outside the DL-Lite family When moving outside the DL-Lite family, query answering under the AR, or even the IAR or brave semantics becomes hard [Rosati 2011]. For ALC, which is the prototypical expressive description logic, query answering under these three semantics is in the second level of the polynomial hierarchy w.r.t. data complexity, even for instance queries, while it is coNP-complete under classical semantics. Even for EL ? , which extends the lightweight DL EL with the ability to express

A COMPLEXITY OF REASONING IN PROPOSI-TIONAL LOGIC

A.1 Complexity theory

We study the complexity of different problems, generally decision problems, whose answer is yes or no on any input, and a few generation problems, which generate a solution (or all solutions). We say that a procedure solves a decision problem if it terminates and outputs the correct answer on all inputs, and it solves a generation problem if, for all inputs, it outputs a solution (or all solutions) if one exists, and no otherwise.

Decision problems can be assigned to different complexity classes depending on the computational resources needed to solve them. The following classes of the polynomial hierarchy are relevant to this thesis:

• P: problems which are solvable in polynomial time in the size of the input.

• NP: problems which are solvable in non-deterministic polynomial time.

• coNP: problems whose complement is in NP. These classes are related as follow: P ✓ NP ✓ p 2 ✓ ⌃ p 2 and P ✓ coNP ✓ p 2 ✓ ⇧ p 2 , and it is widely believed that all these inclusions are proper.

Importantly, the class p 2 [O(log n)] can be equivalently characterized as the class of decision problems which can be solved in polynomial time with a single round of parallel calls to an NP oracle, (cf. [Buss & Hay 1991]). Actually, problems that can be solved by Complexity of reasoning in propositional logic a polynomial-time procedure using NP oracle calls that can be structured as a tree are in The class AC 0 consists of those problems that can be solved by a uniform family of circuits of constant depth and polynomial size, with unbounded-fanin AND and OR gates. It is known that AC 0 ⇢ P.

A problem is hard for a complexity class if it is at least as difficult as any problem of this class. When showing that a decision problem P is hard for a given complexity class, we use standard polynomial-time many-one reductions (also known as Karp reductions), which transform an instance of one decision problem known to be hard P 0 into an instance of P . To show that a generation task is hard for a class C, we reduce a C-hard decision problem to it. As we cannot use many-one reductions (which relate two decision problems), we use polynomial-time Turing reductions, that is, we show how to solve the C-hard decision problem using a polynomial-time Turing machine that can use the generation task as an oracle. Moreover, to prove a stronger intractability result, we only allow a single oracle call.

A.2 Propositional logic

We recall here some definitions for propositional satisfiability and related problems. Propositional formulas are defined from a set of propositional variables X, two constants true and false, and a set of logical connectors: ¬ (negation), _ (disjunction), and ^(conjunction). Other connectors can be introduced as abbreviations.

Definition A.2.1 (Propositional formulas). Given a set of propositional variables X = {x 1 , ..., x n }, propositional formulas are defined as follows:

• true and false are propositional formulas • every x 2 X is a propositional formula • for every propositional formula ', ¬' is a propositional formula • for all propositional formulas ' and , ' _ and ' ^ are propositional formulas We denote by vars(') the set of propositional variables that appear in '. A literal is a formula of the form x or ¬x with x 2 X. A clause is a disjunction of literals. A formula ' is in conjunctive normal form (CNF) if it is a conjunction of clauses, and in disjunctive normal form (DNF) if it is a disjunction of conjunctions of literals. A formula in CNF ' = C 1 ^... ^Ck is often be seen as the set of clauses {C 1 , ..., C k }. A formula in CNF is monotone if all its literals are of the form x.

The semantics of propositional formulas is given by interpretations. An interpretation, or valuation, ⌫ is a function that assigns to each variable x 2 X a truth value in {true, false}. If the domain of ⌫ is a proper subset of X, ⌫ is called partial. The truth value of a formula ' in an interpretation ⌫, denoted ⌫('), is defined as follows:

• ⌫(true) = true and ⌫(false) = false Definition A.2.3 (Quantified Boolean Formula). A quantified Boolean formula (QBF) is a formula in quantified propositional logic where every variable is quantified, using either existential or universal quantifiers, at the beginning of the sentence. The truth value of a QBF is defined recursively:

• 9x 1 , ..., x n '(x 1 , ..., x n ) is true iff '(x 1 , ..., x n ) is satisfiable, • 8x 1 , ..., x n '(x 1 , ..., x n ) is true iff ⌫('(x 1 , ..., x n )) = true for every valuation ⌫ of {x 1 , ..., x n },

• 9x 1 , ..., x n '(x 1 , ..., x n , x n+1 , ...x m ) is true iff there exists a valuation ⌫ of {x 1 , ..., x n } such that ⌫('(x 1 , ..., x n , x n+1 , ...x m )) is true, • 8x 1 , ..., x n '(x 1 , ..., x n , x n+1 , ...x m ) is true iff for every valuation ⌫ of {x 1 , ..., x n }, ⌫('(x 1 , ..., x n , x n+1 , ...x m )) is true.

A QBF is valid if and only if it is true.

A.3 Problems used in reductions

We list here the problems of propositional logic we use to show hardness by reduction in the complexity proofs of this thesis.

Complexity of reasoning in propositional logic

A.3.1 NP or coNP-hard problems

The following problems are NP-complete:

• SAT: decide if a propositional formula is satisfiable. SAT is already NP-complete for formulas in 3-CNF, i.e., conjunctions of three-literal clauses (3SAT). NP-hardness of SAT holds if we impose that at least one variable appears in positive and negative form in the formula (Lemma 5.2.14). • decide if a clause of a propositional formula in CNF belongs to every MUS is NPcomplete [Liberatore 2005].

The following problems are coNP-complete:

• UNSAT: decide if a propositional formula is unsatisfiable. UNSAT is already coNPcomplete for formulas in 3-CNF. • decide if a valuation that satisfies a monotone 2-SAT formula assigns a smallest number of variables to true (coNP-hardness can be shown by a straightforward reduction from the complement of the well-known NP-complete vertex cover problem). • Tautology: decide if a propositional formula is a tautology (since ' is valid if and only if ¬' is unsatisfiable). • given a set {C 1 , ..., C k , C k+1 } of clauses such that {C 1 , ..., C k } is satisfiable and C k+1 is not a tautology: decide whether {C 1 , ..., C k , C k+1 } is satisfiable (Lemma 5.2.15).

A.3.2 BH 2 -hard problems

The following problems are BH 2 -complete:

• SAT-UNSAT: given a pair (' The following problem is p 2 -complete:

• Lexicographically maximum truth assignment problem [Krentel 1988]: given a satisfiable 3CNF formula ' = C 1 ^. . . ^Ck over variables x 1 , ..., x n , decide whether the lexicographically maximum truth assignment satisfying ' with respect to (x 1 , ..., x n ), denoted by ⌫ max , fulfills ⌫ max (x n ) = true.

The following problem is p 2 [O(log n)]-complete:

204

A.3 Problems used in reductions

• Parity(SAT) problem [Wagner 1987, Eiter & Gottlob 1997]: a Parity(SAT) instance is given by a sequence ' 1 , . . . , ' m of propositional formulas in CNF, and the problem is to decide whether the number of satisfiable formulas is odd. It is known that it can be assumed w.l.o.g. that the formulas are such that ' i+1 is unsatisfiable whenever ' i is unsatisfiable. Consequently, the problem reduces to deciding existence of an odd integer p such that ' p is satisfiable and ' p+1 is unsatisfiable. p 2 [O(log n)]-hardness holds if the propositional formulas are in 3-CNF (Parity(3SAT)).

A.3.4 ⌃ p

2 or ⇧ p 2 -hard problems

The following problems are ⌃ p 2 -complete:

• QBF 2,9 : decide the validity of a QBF 2,9 formula 9x 1 , ..., x n 8y 1 , ..., y m '(x 1 , ..., x n , y 1 , ..., y m ).

⌃ p 2 -hardness holds when '(x 1 , ..., x n , y 1 , ..., y m ) is a a 2+2 DNF formula, i.e. '(x 1 , ..., x n , y 1 , ..., y m ) = W k i=1 C i , where C i = `i 1 ^`i 2 ^¬`i 3 ^¬`i 4 . • deciding if a clause of a propositional formula in CNF belongs to a MUS [Liberatore 2005].

The following problem is ⇧ p 2 -complete:

• QBF 2,8 : decide the validity of a QBF 2,8 formula 8x 1 , ..., x n 9y 1 , ..., y m '(x 1 , ..., x n , y 1 , ..., y m ).

⇧ p 2 -hardness holds when '(x 1 , ..., x n , y 1 , ..., y m ) is a 3-CNF formula.