Accommodating

Integrity

Constraints

During

Database

Design

Dimitris

Plexousakis

and

John

Mylopoulos

Department

of

Computer

Science

University

of

Toronto

Toronto

Canada

E-mail

fdp,jmg@ai.toronto.edu

June

Abstract

We

address

the

problem

of

maintaining

the

integrity

of

large

knowledge

bases

using

a

compile-time

transaction

modification

technique

The

novelty

of

the

approach

lies

in

the

adaptation

of

ideas

from

Artificial

Intelligence

-LRB-

AI

-RRB-

planning

research

Specifically

starting

with

the

observation

that

solutions

to

the

frame

and

ramification

problems

can

be

used

during

database

transaction

design

time

we

propose

an

integrity

maintenance

technique

that

modifies

transaction

specifications

by

incorporating

into

them

conditions

necessary

of

the

constraints

satisfaction

Additions

to

the

transactions

postconditions

whose

effect

is

to

maintain

the

integrity

constraints

are

generated

from

a

set

of

-LRB-

determinate

-RRB-

transaction

specifications

Thus

the

implications

of

constraints

are

realized

by

the

transaction

specifier

and

the

effort

of

having

to

prove

transaction

safety

is

saved

since

it

is

guaranteed

by

the

correctness

of

the

generation

process

We

envision

the

development

of

a

tool

that

given

a

set

of

determinate

transaction

specifications

automatically

suggests

additions

to

the

transaction

postconditions

whose

effect

is

to

maintain

the

integrity

constraints

Introduction

Integrity

constraints

specify

the

valid

states

of

a

data

or

knowledge

base

as

well

as

its

allowable

state

transitions

-LSB-

-RSB-

Structural

integrity

constraints

express

properties

of

the

data

model

used

for

representing

knowledge

Semantic

integrity

constraints

on

the

other

hand

are

user-defined

and

express

properties

of

the

domain

being

modeled

The

maintenance

of

semantic

integrity

constitutes

a

major

performance

bottleneck

in

database

management

systems

The

majority

of

commercial

products

do

not

provide

but

for

the

enforcement

of

very

limited

types

of

integrity

constraints

The

maintenance

of

general

semantic

constraints

becomes

the

responsibility

of

the

user

submitting

transactions

to

the

database

In

large

semantically

rich

knowledge

bases

the

problem

becomes

even

harder

due

to

the

large

numbers

of

constraints

and

due

to

implicit

updates

caused

by

the

presence

of

deductive

rules

Compile-time

processing

of

constraints

and

transactions

aims

at

reducing

the

run-time

cost

associated

with

the

enforcement

of

constraints

and

is

in

our

view

a

promising

avenue

for

achieving

acceptable

performance

The

problem

of

integrity

maintenance

has

received

considerable

attention

in

the

literature

of

the

past

decade

Most

proposed

techniques

for

integrity

maintenance

rely

on

monitoring

by

a

generic

application-independent

program

that

verifies

that

updates

do

not

violate

semantic

constraints

-LSB-

-RSB-

-LSB-

-RSB-

-LSB-

-RSB-

-LSB-

-RSB-

-LSB-

-RSB-

-LSB-

-RSB-

-LSB-

-RSB-

-LSB-

-RSB-

Another

popular

approach

is

based

on

maintenance

by

transactions

-LSB-

-RSB-

-LSB-

-RSB-

-LSB-

-RSB-

-LSB-

-RSB-

-LSB-

-RSB-

The

former

technique

relieves

the

user

from

the

burden

of

implementing

database

transactions

in

a

way

such

that

no

constraint

is

violated

The

latter

requires

that

the

specification

of

updating

transactions

is

given

Transactions

are

then

modified

so

that

database

integrity

constraints

are

guaranteed

to

hold

in

any

executable

sequence

of

transactions

In

our

earlier

work

-LSB-

-RSB-

we

presented

a

compile-time

simplification

method

for

temporal

deductive

knowledge

bases

where

integrity

constraints

specified

in

a

many-sorted

temporal

assertion

language

-LSB-

-RSB-

-LSB-

-RSB-

are

specialized

and

simplified

with

respect

to

the

anticipated

updates

In

this

paper

we

undertake

a

dual

approach

namely

compile-time

transaction

modification

in

the

context

of

knowledge

bases

containing

-LRB-

temporal

-RRB-

integrity

constraints

and

deductive

rules

In

particular

we

examine

how

transactions

specified

by

means

of

precondition-postcondition

pairs

can

be

modified

so

that

the

constraints

they

directly

or

indirectly

affect

are

guaranteed

not

to

be

violated

in

the

state

resulting

from

transaction

execution

Specifying

database

transaction

by

means

of

pre

and

post-conditions

permits

the

database

designer

to

express

what

the

effect

of

transactions

should

be

and

not

how

this

effect

should

be

accomplished

Database

transaction

specifications

should

be

given

in

a

formal

notation

that

possesses

both

notational

suitability

and

the

capacity

of

supporting

formal

treatment

The

formal

specification

language

should

be

accompanied

by

the

appropriate

machinery

for

proving

properties

of

specifications

We

choose

first-order

-LRB-

temporal

-RRB-

logic

as

the

language

for

expressing

transaction

pre/post-conditions

constraints

and

rules

We

address

the

problem

of

proving

integrity

maintenance

by

relating

it

to

that

of

reasoning

about

actions

-LSB-

-RSB-

and

elaborate

on

the

impact

that

the

frame

problem

-LSB-

-RSB-

and

ramification

problem

-LSB-

-RSB-

have

in

transaction

specifications

In

the

majority

of

the

existing

methods

for

integrity

constraint

maintenance

by

transaction

modification

the

frame

and

ramification

problems

have

either

been

ignored

or

bypassed

by

means

of

implicit

assumptions

that

state

that

nothing

but

what

is

explicitly

declared

to

change

in

the

update

procedure

does

Section

addresses

the

inadequacies

of

existing

methods

regarding

the

frame

problem

Given

a

set

of

transaction

specifications

the

problem

of

succinctly

stating

that

nothing

else

changes

except

the

aspects

of

the

state

explicitly

specified

has

been

called

the

frame

problem

The

ramification

problem

amounts

to

devising

a

way

to

avoid

having

to

specify

indirect

effects

of

actions

explicitly

Several

attempts

to

solve

these

problems

have

appeared

in

the

AI

planning

literature

of

the

recent

years

-LSB-

-RSB-

presents

a

solution

to

the

frame

problem

with

application

to

database

updates

-LSB-

-RSB-

and

-LSB-

-RSB-

show

why

the

frame

problem

becomes

particularly

acute

in

object-oriented

specifications

where

transactions

are

inherited

and

specialized

from

superclasses

to

subclasses

The

arguments

presented

therein

apply

directly

to

the

specification

of

database

transactions

in

deductive

active

and

object-oriented

databases

The

effects

of

rule

evaluation

or

firing

have

to

be

accounted

for

and

checked

against

integrity

constraints

Moreover

transaction

specifications

can

be

specialized

from

superclasses

to

subclasses

and

conjoined

to

form

complex

transactions

The

effects

of

specialized

or

synthesized

transactions

must

be

precisely

characterized

To

the

best

of

our

knowledge

there

has

not

been

any

previous

attempt

to

link

the

ramification

problem

with

that

of

proving

safety

of

transactions

In

fact

a

solution

of

the

ramification

problem

can

suggest

a

strategy

for

integrity

maintenance

transform

the

specifications

of

transactions

to

embody

implications

of

constraints

-LRB-

these

may

be

simpler

formulae

than

the

constraints

themselves

-RRB-

if

the

new

specifications

are

not

met

then

the

constraints

are

violated

Embodying

the

implications

of

constraints

in

transaction

specifications

means

that

the

constraints

need

not

be

checked

at

run-time

The

solution

proposed

in

-LSB-

-RSB-

consists

of

systematically

deriving

a

set

of

successor-state

axioms

that

completely

describe

how

can

change

truth

value

as

a

result

of

some

action

taking

place

These

axioms

formulate

closed-world

assumptions

for

actions

A

syntactic

generator

of

successor-state

axioms

in

the

presence

of

binary

constraints

and

stratified

definitions

of

non-primitive

fluents

is

proposed

in

-LSB-

-RSB-

We

relate

this

solution

to

the

problem

of

integrity

maintenance

in

the

context

of

temporal

deductive

KBs

The

following

example

shows

the

rationale

behind

the

use

of

ramifications

for

simplifying

the

task

of

proving

transaction

safety

Example

Transaction

EnrollInCourse

records

the

enrollment

of

student

st

in

course

crs

size

and

classlimit

are

function

symbols

representing

the

class

size

and

enrollment

limit

respectively

whereas

EnrolledIn

is

a

predicate

symbol

We

adopt

the

unprimed/primed

to

refer

to

the

values

of

variables

functions

or

predicates

immediately

before

and

after

the

execution

of

the

transaction

EnrollInCourse

-LRB-

st

crs

-RRB-

Precondition

EnrolledIn

-LRB-

st

crs

-RRB-

Postcondition

-LRB-

crs

-RRB-

size

-LRB-

crs

-RRB-

-LRB-

st

crs

-RRB-

Invariant

Course

size

-LRB-

c

-RRB-

classlimit

-LRB-

c

-RRB-

In

this

specification

the

precondition

requires

that

the

student

is

not

already

enrolled

in

the

course

whereas

the

postcondition

specifies

the

effect

of

the

transaction

on

the

final

state

the

size

of

the

class

is

incremented

and

the

predicate

EnrolledIn

becomes

true

of

st

and

crs

The

invariant

requires

that

the

size

of

a

course

should

not

exceed

its

limit

We

can

easily

verify

that

if

the

condition

-LRB-

size

-LRB-

crs

-RRB-

classlimit

-LRB-

crs

-RRB-

-RRB-

is

conjoined

with

the

postcondition

then

no

implementation

that

meets

the

augmented

postcondition

can

violate

the

invariant

Indeed

the

invariant

follows

as

a

logical

consequence

of

the

augmented

postcondition

the

invariant

in

the

previous

state

and

the

assumption

that

in

the

state

before

transaction

execution

the

invariants

are

known

to

be

satisfied

As

will

be

shown

in

the

sequel

the

derived

addition

to

the

postcondition

is

a

ramification

of

-LRB-

a

form

of

-RRB-

the

invariant

and

the

initial

postcondition

This

is

different

than

simply

conjoining

constraints

to

the

transaction

postconditions

-LSB-

-RSB-

Let

us

assume

for

a

moment

that

the

invariant

had

the

form

Course

size

-LRB-

c

-RRB-

classlimit

-LRB-

c

-RRB-

where

does

not

mention

predicate

EnrolledIn

or

function

size

Then

under

the

assumption

that

the

invariant

was

satisfied

before

the

transaction

execution

the

conjunct

can

be

eliminated

since

its

satisfaction

are

predicates

whose

truth

value

may

change

from

state

to

state

-LSB-

-RSB-

will

abandon

this

notation

when

we

present

the

formal

solution

to

the

frame

and

ramification

problem

Instead

we

will

use

a

many-sorted

logic

and

factor

time

into

predicates

and

functions

persists

The

augmentation

to

the

postcondition

that

suffices

to

guarantee

the

constraint

is

the

same

as

above

i.e.

-LRB-

size

-LRB-

crs

-RRB-

classlimit

-LRB-

crs

-RRB-

-RRB-

A

non-optimizing

transaction

modification

technique

such

as

e.g.

in

-LSB-

-RSB-

would

include

as

a

condition

that

would

need

to

be

conjoined

with

the

transaction

postcondition

We

review

the

concept

of

ramifications

in

section

We

describe

briefly

the

solution

to

the

frame

and

ramification

problems

proposed

in

-LSB-

-RSB-

as

well

as

an

extension

to

the

procedure

proposed

in

-LSB-

-RSB-

and

-LSB-

-RSB-

for

systematically

solving

the

problem

in

the

case

of

determinate

transaction

specifications

Section

presents

the

ramification

method

for

transaction

modification

along

with

several

examples

of

the

application

of

the

method

on

static

and

dynamic

constraints

The

results

are

extended

in

section

to

deal

with

multiple

transactions

conjunction

and

inheritance

of

specifications

Section

reviews

related

work

and

discusses

the

integration

of

the

proposed

method

in

the

database

design

process

The

final

section

summarizes

the

results

and

outlines

directions

for

further

research

Ramifications

In

this

section

we

provide

the

necessary

background

for

the

ramification

method

for

transaction

modification

In

the

first

part

we

review

the

concept

and

properties

of

ramifications

and

in

the

second

we

describe

the

solution

to

the

ramification

problem

for

the

class

of

deterministic

transaction

specifications

The

bulk

of

the

background

material

is

based

on

-LSB-

-RSB-

and

-LSB-

-RSB-

but

is

recast

here

in

database

terminology

Moreover

the

results

presented

therein

are

extended

as

propositions

describe

Background

Let

us

assume

that

a

knowledge

base

KB

comprises

a

set

of

ground

literals

representing

facts

true

in

KB

a

set

R

of

deductive

rules

and

a

set

I

of

integrity

constraints

Constraints

and

rules

are

expressed

as

range-restricted

formulae

of

a

many-sorted

first-order

logic

in

which

we

distinguish

one

sort

Time

for

time

points

We

will

refer

to

this

logic

as

MSTL

for

short

Time

is

interpreted

as

being

relative

linear

and

discrete

Intuitively

a

ramification

of

a

formula

OE

is

a

formula

N

such

that

N

is

inevitably

true

if

OE

is

true

-LSB-

-RSB-

This

definition

is

amenable

to

different

interpretations

in

different

world

models

If

the

world

model

in

question

the

knowledge

base

is

expressed

as

a

first-order

theory

then

the

concept

of

ramifications

can

be

captured

by

first-order

entailment

A

formula

OE

is

said

to

be

in

prenex

normal

form

if

it

is

of

the

form

OE

Qmxm

Sm

OE

where

Qi

i

m

Sm

are

sorts

and

OE

is

quantifier-free

with

free

variables

xm

Definition

-LRB-

Ramification

-RRB-

Given

a

knowledge

base

KB

and

a

formula

OE

in

prenex

normal

form

a

formula

N

with

free

variables

yn

among

xm

is

a

ramification

of

OE

in

KB

if

KB

-LSB-

fOEg

j

Example

Consider

the

knowledge

KB

Dom

-LRB-

A

-LRB-

x

-RRB-

C

-LRB-

y

-RRB-

D

-LRB-

x

y

z

-RRB-

g

and

the

formula

OE

-LRB-

A

-LRB-

x

-RRB-

B

-LRB-

x

y

-RRB-

C

-LRB-

y

-RRB-

-RRB-

Then

the

formula

N

D

-LRB-

x

y

z

-RRB-

is

a

ramification

of

OE

in

KB

since

KB

-LSB-

fOEg

j

N

It

is

easy

to

verify

the

following

properties

of

ramifications

If

a

ramification

of

a

formula

is

known

to

be

unsatisfiable

then

the

formula

itself

is

unsatisfiable

Ramifications

of

formulae

can

reduce

the

search

space

for

the

formulae

satisfaction

Transformations

may

be

applicable

to

formulae

ramifications

but

not

to

the

formulae

themselves

Hence

if

there

exists

a

way

to

systematically

generate

ramifications

from

a

set

of

formulae

then

the

derived

ramifications

can

be

used

for

optimizing

the

evaluation

of

the

formulae

themselves

Generating

ramifications

of

a

formula

OE

essentially

involves

augmenting

a

partial

description

of

a

state

where

OE

holds

with

additional

descriptions

that

stem

from

the

knowledge

of

the

consistency

of

the

state

A

procedure

for

generating

ramifications

may

require

an

arbitrary

amount

of

inferencing

From

the

semi-decidability

of

first-order

entailment

it

follows

that

the

problem

of

finding

ramifications

is

in

its

generality

intractable

Tractability

can

be

achieved

by

restricting

the

class

of

formulae

for

which

ramifications

are

sought

For

instance

the

task

is

tractable

for

ordered

conjunctions

of

literals

-LSB-

-RSB-

Furthermore

not

all

derivable

ramifications

may

be

useful

for

simplifying

the

task

of

proving

a

formula

For

that

the

generator

may

be

guided

to

derive

only

useful

ramifications

by

providing

appropriate

input

clauses

In

fact

the

solution

to

the

the

sake

of

simplicity

we

assume

that

all

variables

range

over

the

same

sort

Dom

Moreover

ed

identifiers

will

denote

Skolem

constants

ramification

problem

that

we

present

in

section

generates

exactly

those

ramifications

that

are

needed

for

proving

the

safety

of

transaction

specifications

The

process

of

modifying

a

goal

by

conjoining

it

with

additional

constraints

so

that

the

reformulated

formula

is

less

expensive

to

check

than

the

original

one

has

been

termed

supersumption

in

-LSB-

-RSB-

The

methods

proposed

therein

apply

only

to

conjunctive

formulae

It

is

easy

to

establish

the

soundness

of

supersumption

for

formulae

in

disjunctive

normal

form

-LRB-

DNF

-RRB-

Proposition

is

a

direct

consequence

of

the

definition

of

ramifications

and

proposition

follows

from

the

properties

of

first-order

entailment

Proposition

If

N

is

a

ramification

of

OE

in

the

knowledge

base

KB

and

N

is

falsified

in

KB

then

so

is

OE

Proposition

Let

OE

be

a

formula

in

DNF

i.e.

OE

Wni

OEi

where

each

OEi

is

a

conjunction

of

literals

Let

also

Ni

be

a

ramification

of

OEi

for

each

i

n

and

KB

j

-LRB-

OEi

-RRB-

Ni

-RRB-

Then

if

for

each

i

n

KB

j

Ni

then

KB

j

OE

According

to

proposition

given

a

formula

in

DNF

one

can

derive

ramifications

of

the

conjuncts

of

the

formula

and

then

test

whether

all

ramifications

are

falsified

If

this

is

the

case

then

the

initial

formula

is

falsified

This

strategy

is

useful

if

one

is

interested

in

monitoring

when

a

formula

becomes

violated

rather

than

proving

that

it

is

always

satisfied

As

will

be

seen

in

the

next

section

this

strategy

is

sufficient

to

monitor

integrity

constraint

violations

in

KBs

The

next

corollary

establishes

the

soundness

of

supersumption

Corollary

-LRB-

Soundness

of

Supersumption

-RRB-

Let

OE

be

the

formula

Qmxm

OE

Qi

i

m

where

OE

is

quantifier-free

in

DNF

with

each

of

the

variables

xm

appearing

in

at

least

one

of

the

disjuncts

and

let

N

be

a

ramification

of

OE

in

the

knowledge

base

KB

Then

KB

-LSB-

fOEg

j

OE

N

The

Frame

and

Ramification

Problems

In

this

section

we

sketch

the

solution

to

the

frame

and

ramification

problems

for

a

class

of

constraints

that

encompasses

static

and

transition

constraints

The

solution

to

the

frame

problem

was

initially

proposed

in

-LSB-

-RSB-

in

the

framework

of

situation

calculus

-LSB-

-RSB-

It

was

extended

in

-LSB-

-RSB-

and

-LSB-

-RSB-

for

dealing

with

the

ramification

problem

as

well

The

solution

relies

on

the

automatic

generation

of

complete

characterizations

of

the

conditions

under

which

predicates

or

functions

may

change

-LRB-

truth

-RRB-

value

as

a

result

of

transaction

execution

Here

we

present

an

extension

to

the

method

of

-LSB-

-RSB-

for

dealing

with

transition

constraints

The

method

generates

successor-state

axioms

from

a

given

set

of

effect

axioms

in

the

presence

of

a

limited

class

of

constraints

and

definitions

of

non-primitive

predicates

Effect

axioms

specify

the

direct

effects

of

transactions

on

predicates

For

instance

a

direct

effect

of

transaction

EnrollInCourse

-LRB-

see

example

-RRB-

is

that

the

size

of

the

course

in

which

a

student

enrolls

is

incremented

by

Successor-state

axioms

characterize

all

conditions

under

which

predicates

and

functions

may

change

value

as

a

result

of

transaction

execution

Such

axioms

serve

as

a

formalization

of

a

closed-world

assumption

about

the

transactions

themselves

rather

than

the

knowledge

base

Integrity

constraints

are

of

the

form

xk

Sk

T

ime

OE

-LRB-

xk

-RRB-

-LRB-

-RRB-

-LRB-

xk

-RRB-

-LRB-

-RRB-

-LRB-

xk

-RRB-

where

are

-LRB-

k

-RRB-

ary

predicates

intensional

or

extensional

Sk

are

object

sorts

and

OE

-LRB-

xk

-RRB-

is

a

formula

in

which

variables

xk

occur

free

if

at

all

and

does

not

mention

any

predicate

other

than

evaluable

predicates

This

class

of

constraints

is

an

extension

of

the

class

of

binary

constraints

of

-LSB-

-RSB-

since

it

allows

the

temporal

variables

to

occur

in

evaluable

predicates

It

includes

static

constraints

and

transition

constraints

i.e.

constraints

referring

to

two

consecutive

states

of

the

knowledge

base

but

not

general

dynamic

constraints

For

example

the

transition

constraint

specifying

the

property

that

an

employee

's

salary

can

never

decrease

can

be

specified

by

the

formula

Employee

Salary

T

ime

-LRB-

-RRB-

-LRB-

-RRB-

salary

-LRB-

e

-RRB-

salary

-LRB-

e

-RRB-

A

transaction

T

with

parameters

x

is

specified

by

a

pair

-LRB-

preT

-LRB-

x

-RRB-

postT

-LRB-

x

-RRB-

-RRB-

where

preT

-LRB-

x

-RRB-

and

postT

-LRB-

x

-RRB-

-RRB-

denote

the

transaction

pre

and

post-condition

respectively

both

specified

as

wellformed

formulae

of

MSTL

The

solution

assumes

that

deductive

rules

are

not

recursive

Moreover

they

are

assumed

to

be

stratified

It

also

presupposes

the

existence

of

causal

rules

describing

the

direct

effects

of

transactions

These

causal

rules

are

expressed

by

direct

effect

axioms

which

for

a

transaction

T

-LRB-

x

-RRB-

-LRB-

preT

-LRB-

x

-RRB-

postT

-LRB-

x

-RRB-

-RRB-

have

the

form

S

Time

-LRB-

Occur

-LRB-

T

-LRB-

x

-RRB-

t

-RRB-

-RRB-

preT

-LRB-

x

t

-RRB-

postT

-LRB-

x

next

-LRB-

t

-RRB-

-RRB-

-RRB-

where

the

term

next

-LRB-

t

-RRB-

denotes

the

state

resulting

from

the

execution

of

the

transaction

at

time

t.

Given

any

transaction

specification

the

effect

axioms

are

derived

independently

of

any

other

transaction

specification

Hence

we

can

avoid

having

to

specify

the

axioms

in

a

reified

logic

that

interprets

the

predicate

Occur

outside

a

standard

first-order

interpretation

The

above

axiom

can

now

be

written

as

S

Time

T

-LRB-

x

t

-RRB-

-RRB-

preT

-LRB-

x

t

-RRB-

postT

-LRB-

x

next

-LRB-

t

-RRB-

-RRB-

From

the

direct

effect

axioms

we

can

systematically

generate

positive

and

negative

effect

axioms

-LSB-

-RSB-

for

every

predicate

P

that

occurs

in

postT

as

described

in

the

following

steps

The

rationale

is

to

describe

concisely

all

conditions

that

are

necessarily

true

when

a

predicate

changes

value

from

False

to

True

-LRB-

True

to

False

respectively

-RRB-

Construct

the

following

positive

and

negative

axioms

S

Time

-LRB-

:P

-LRB-

x

t

-RRB-

P

-LRB-

x

next

-LRB-

t

-RRB-

-RRB-

-RRB-

T

-LRB-

x

t

-RRB-

-RRB-

F

alse

-RRB-

S

Time

-LRB-

P

-LRB-

x

t

-RRB-

:P

-LRB-

x

next

-LRB-

t

-RRB-

-RRB-

-RRB-

T

-LRB-

x

t

-RRB-

-RRB-

F

alse

-RRB-

If

postT

is

P

-LRB-

x

next

-LRB-

t

-RRB-

-RRB-

-LRB-

:P

-LRB-

x

next

-LRB-

t

-RRB-

-RRB-

-RRB-

add

T

rue

as

a

disjunct

to

the

positive

-LRB-

negative

-RRB-

effect

axiom

for

P

If

postT

is

of

the

form

-LRB-

x

t

-RRB-

-RRB-

-LRB-

-RRB-

P

-LRB-

x

t

-RRB-

where

does

not

contain

terms

referring

to

any

time

point

except

t

add

a

disjunct

-LRB-

x

t

-RRB-

to

the

positive

-LRB-

negative

-RRB-

effect

axiom

for

P

If

postT

-LRB-

x

-RRB-

is

of

the

form

-LRB-

-LRB-

x

z

t

-RRB-

-RRB-

-LRB-

-RRB-

P

-LRB-

w

next

-LRB-

t

-RRB-

-RRB-

where

w

consists

of

constants

and

variables

from

x

z

then

augment

the

positive

-LRB-

negative

-RRB-

axiom

for

P

with

a

disjunct

-LRB-

-LRB-

x

z

t

-RRB-

-LRB-

x

w

-RRB-

-RRB-

This

process

results

in

a

set

Tef

of

effect

axioms

of

the

form

S

Time

:P

-LRB-

x

t

-RRB-

-LRB-

x

t

-RRB-

-RRB-

:P

-LRB-

x

next

-LRB-

t

-RRB-

-RRB-

-LRB-

-RRB-

S

Time

P

-LRB-

x

t

-RRB-

-LRB-

x

t

-RRB-

-RRB-

P

-LRB-

x

next

-LRB-

t

-RRB-

-RRB-

-RRB-

-LRB-

-RRB-

These

axioms

concisely

describe

how

transactions

directly

affect

the

truth

values

of

predicates

It

remains

to

describe

the

indirect

effects

that

are

due

to

the

presence

of

integrity

constraints

and

deductive

rules

In

addition

to

the

effect

axioms

Tef

the

knowledge

base

is

augmented

with

an

axiomatization

of

time

-LRB-

Ttime

-RRB-

formalizing

the

properties

of

discreteness

and

unboundedness

as

well

as

unique

name

axioms

-LRB-

Tuna

-RRB-

for

predicates

and

functions

A

new

set

T

ef

is

obtained

from

Tef

by

replacing

each

derived

predicate

occurring

in

an

effect

axiom

by

the

disjunction

of

the

bodies

of

the

rules

that

define

it

Since

the

set

of

deductive

rules

is

assumed

to

be

stratified

the

process

of

replacing

derived

only

show

the

derivation

of

effect

axioms

for

predicates

Effect

axioms

for

functions

can

be

derived

quite

similarly

predicates

by

their

definitions

will

terminate

with

all

effect

axioms

mentioning

only

primitive

predicates

Let

C

S

T

ime

OE

-LRB-

x

-RRB-

P

-LRB-

x

-RRB-

Q

-LRB-

x

-RRB-

be

a

constraint

that

has

to

be

satisfied

at

all

times

Then

for

each

effect

axiom

of

type

-LRB-

-RRB-

for

P

the

following

axiom

for

Q

is

generated

S

Time

:P

-LRB-

x

t

-RRB-

-LRB-

x

t

-RRB-

OE

-LRB-

x

t

next

-LRB-

t

-RRB-

-RRB-

-RRB-

Q

-LRB-

x

next

-LRB-

t

-RRB-

-RRB-

This

axiom

expresses

the

property

that

if

predicate

P

is

known

not

to

be

true

in

the

state

prior

to

the

execution

of

a

transaction

and

constraint

C

is

known

to

be

satisfied

in

the

same

state

then

if

the

conditions

that

cause

P

to

change

truth

value

from

F

alse

to

T

rue

are

not

satisfied

Q

-LRB-

x

next

-LRB-

t

-RRB-

-RRB-

OE

-LRB-

x

t

next

-LRB-

t

-RRB-

-RRB-

has

to

be

true

in

order

for

the

constraint

to

remain

satisfied

in

the

state

after

the

transaction

execution

Symmetrically

for

each

effect

axiom

of

type

-LRB-

-RRB-

for

Q

generate

the

following

axiom

for

P

S

Time

Q

-LRB-

x

t

-RRB-

-LRB-

x

t

-RRB-

OE

-LRB-

x

t

next

-LRB-

t

-RRB-

-RRB-

-RRB-

P

-LRB-

x

next

-LRB-

t

-RRB-

-RRB-

The

respective

process

takes

place

if

the

constraint

contains

negated

predicates

Then

under

the

assumption

that

the

given

specifications

characterize

all

transactions

we

can

generate

the

set

Tss

of

successor-state

axioms

as

follows

Let

P

-LRB-

x

t

-RRB-

-LRB-

x

t

-RRB-

OE

-LRB-

x

t

next

-LRB-

t

-RRB-

-RRB-

and

:P

-LRB-

x

t

-RRB-

-LRB-

x

t

-RRB-

OE

-LRB-

x

t

next

-LRB-

t

-RRB-

-RRB-

Q

-LRB-

x

-RRB-

and

Q

-LRB-

x

-RRB-

are

defined

analogously

Then

the

successor-state

axiom

for

P

is

S

Time

P

-LRB-

x

t

-RRB-

-LRB-

:P

-LRB-

x

t

-RRB-

P

-LRB-

x

t

-RRB-

-RRB-

Example

Example

showed

the

definition

of

transaction

EnrollInCourse

which

affects

the

predicate

EnrolledIn

and

the

function

size

Let

us

assume

that

another

transaction

DropCourse

is

defined

as

follows

DropCourse

-LRB-

st

crs

-RRB-

Precondition

EnrolledIn

-LRB-

st

crs

-RRB-

Postcondition

-LRB-

crs

-RRB-

size

-LRB-

crs

-RRB-

-LRB-

st

crs

-RRB-

Invariant

Course

size

-LRB-

c

-RRB-

classlimit

-LRB-

c

-RRB-

The

generation

process

described

in

this

section

will

generate

the

following

successor-state

axioms

for

EnrolledIn

and

size

Student

Course

Time

EnrolledIn

-LRB-

st

crs

t

-RRB-

EnrolledIn

-LRB-

st

crs

next

-LRB-

t

-RRB-

-RRB-

DropCourse

-LRB-

st

crs

t

-RRB-

Course

Time

-LRB-

size

-LRB-

crs

t

-RRB-

size

-LRB-

crs

next

-LRB-

t

-RRB-

-RRB-

EnrollInCourse

-LRB-

st

crs

t

-RRB-

DropCourse

-LRB-

st

crs

t

-RRB-

Under

the

assumption

that

the

transactions

EnrollInCourse

and

DropCourse

are

the

only

ones

affecting

EnrolledIn

and

size

the

above

axioms

characterize

all

conditions

under

which

the

predicate

or

function

can

change

-LRB-

truth

-RRB-

value

as

a

result

of

transaction

execution

Specifically

the

first

axiom

expresses

the

property

that

if

a

student

is

enrolled

in

a

course

in

the

state

prior

to

a

transaction

's

execution

but

is

not

enrolled

in

the

course

after

the

transaction

's

execution

then

it

has

to

be

the

case

that

transaction

DropCourse

occurred

and

it

can

not

be

the

case

that

any

other

transaction

may

have

occurred

The

second

axiom

says

that

if

function

size

changes

value

because

of

transaction

execution

then

it

is

the

case

that

either

transaction

EnrollInCourse

occurred

or

transaction

DropCourse

occurred

It

has

been

shown

in

-LSB-

-RSB-

that

a

set

Tss

of

successor-state

axioms

constitutes

a

solution

to

the

frame

and

ramification

problem

if

for

every

predicate

p

the

condition

Tuna

j

:-LRB-

p

:p

-RRB-

is

satisfied

Moreover

the

correctness

of

the

syntactic

generation

has

been

proven

in

-LSB-

-RSB-

and

-LSB-

-RSB-

We

are

now

in

a

position

to

state

the

relationship

of

the

syntactic

generation

of

successor-state

axioms

with

ramifications

of

constraints

A

similar

result

holds

for

the

case

in

which

predicates

occur

negated

in

the

expression

of

a

constraint

The

proposition

follows

from

the

syntactic

generation

process

Proposition

For

a

knowledge

base

KB

and

a

constraint

I

S

T

ime

OE

-LRB-

x

-RRB-

P

-LRB-

x

-RRB-

Q

-LRB-

x

-RRB-

the

following

entailment

relation

holds

KB

-LSB-

fIg

j

-LSB-

-LRB-

-LRB-

x

t

-RRB-

OE

-LRB-

x

t

next

-LRB-

t

-RRB-

-RRB-

-RRB-

-LRB-

-LRB-

x

t

-RRB-

OE

-LRB-

x

t

next

-LRB-

t

-RRB-

-RRB-

-RRB-

-RSB-

The

above

result

is

significant

to

the

problem

of

proving

transaction

safety

since

it

provides

a

way

to

produce

systematically

necessary

conditions

-LRB-

ramifications

-RRB-

for

the

satisfaction

of

constraints

in

the

state

resulting

from

the

transaction

execution

Integrity

Maintenance

by

Transaction

Modification

In

this

section

we

establish

the

relationship

between

the

ramification

problem

and

the

maintenance

of

integrity

constraints

in

the

context

of

knowledge

bases

containing

deductive

rules

and

temporal

knowledge

Ramifications

and

Integrity

Maintenance

The

problem

of

integrity

maintenance

is

defined

as

follows

Given

a

knowledge

base

KB

with

constraint

set

I

and

a

set

of

transaction

specifications

T

Tkg

with

Ti

-LRB-

prei

posti

-RRB-

can

the

set

I

be

systematically

partitioned

into

sets

It

If

Ic

so

that

-LRB-

a

-RRB-

constraints

in

It

are

provably

maintained

by

T

-LRB-

b

-RRB-

constraints

in

If

are

provably

violated

by

some

T

T

and

-LRB-

c

-RRB-

constraints

in

Ic

have

to

be

checked

after

execution

of

some

transactions

in

T

but

possibly

in

some

simplified

form

Since

we

are

following

a

transaction

modification

approach

the

problem

is

equivalent

to

transforming

the

set

T

of

transactions

into

a

set

T

of

transactions

with

the

property

that

for

each

transaction

T

i

in

T

either

T

i

Ti

and

Ti

has

been

shown

not

to

violate

any

of

the

integrity

constraints

or

Ti

has

been

modified

to

T

i

and

every

implementation

meeting

its

new

specification

can

not

possibly

violate

any

of

the

constraints

in

I.

Integrity

constraints

serve

the

role

of

invariants

of

transactions

Each

transaction

must

maintain

its

invariants

i.e.

not

violate

the

relevant

integrity

constraints

in

order

to

be

accepted

The

problem

of

proving

that

a

transaction

maintains

its

invariants

is

formalized

in

the

following

definition

Definition

-LRB-

Invariant

Maintenance

-RRB-

Let

T

be

a

transaction

with

precondition

P

postcondition

Q

and

invariant

I.

T

is

said

to

maintain

invariant

I

if

I

P

-RRB-

-LRB-

Q

-RRB-

-RRB-

where

denotes

the

invariant

in

the

state

resulting

after

the

transaction

takes

place

Proving

that

transactions

maintain

invariants

is

a

difficult

task

since

it

requires

theorem

proving

Furthermore

the

cost

of

undoing

the

transaction

in

case

it

is

discovered

to

violate

the

invariants

is

high

A

way

to

avoid

checking

whether

transactions

maintain

their

invariants

is

to

augment

their

postconditions

in

a

way

such

that

the

invariant

is

maintained

as

a

result

of

meeting

the

postcondition

We

now

show

that

such

an

augmented

postcondition

can

be

found

by

computing

ramifications

The

following

discussion

is

based

on

a

number

of

completeness

assumptions

These

assumptions

specify

that

firstly

all

transaction

specifications

are

known

at

the

time

that

integrity

constraints

are

specified

and

secondly

that

transaction

invariants

are

known

to

be

maintained

in

the

state

before

the

transaction

execution

We

discuss

in

the

sequel

how

we

can

incrementally

accommodate

newly

defined

transactions

We

consider

the

single-transaction

case

first

Assume

a

transaction

T

specified

by

a

pair

-LRB-

P

Q

-RRB-

of

a

precondition

and

a

postcondition

expressed

in

MSTL

Let

I

be

an

integrity

constraint

relevant

to

the

We

need

to

find

a

formula

N

such

that

KB

j

-LRB-

Q

N

-RRB-

-RRB-

or

equivalently

that

KB

j

-LRB-

Q

-RRB-

N

-RRB-

If

N

is

a

ramification

of

Q

as

computed

by

the

syntactic

generator

then

the

desired

entailment

relationship

holds

This

leads

to

the

following

theorem

whose

proof

follows

from

definitions

and

corollary

Theorem

Let

T

be

a

transaction

specified

in

terms

of

a

precondition/postcondition

pair

-LRB-

P

Q

-RRB-

and

I

be

an

invariant

of

T

If

N

is

a

ramification

of

Q

computed

by

the

syntactic

generator

of

section

then

the

invariant

is

maintained

in

the

state

resulting

after

transaction

execution

if

the

postcondition

Q

N

is

met

This

result

has

significant

impact

to

both

the

areas

of

procedure

specification

and

constraint

enforcement

if

the

process

of

suggesting

additions

to

the

postconditions

of

transactions

can

be

automated

the

transaction

specifier

actually

realizes

the

implications

of

transaction

invariants

and

the

procedure

implementor

is

saved

the

burden

of

finding

ways

to

meet

the

postcondition

in

a

way

such

that

no

invariant

is

violated

In

fact

the

implementor

may

not

be

familiar

with

all

the

invariants

that

a

certain

transaction

may

affect

The

theorem

also

suggests

a

way

of

enforcing

integrity

constraints

by

requiring

that

updating

transactions

meet

postconditions

that

embody

implications

of

constraints

first

ramifications

of

the

conjunction

of

the

postcondition

and

the

negation

of

the

invariant

instantiated

in

the

state

after

transaction

execution

are

computed

the

negation

of

the

computed

ramifications

is

conjoined

with

the

transaction

postcondition

to

form

a

postcondition

which

should

be

met

by

the

implementation

in

order

not

to

violate

the

invariants

The

fact

that

postconditions

describe

all

the

direct

effects

of

transactions

can

be

exploited

to

simplify

the

formula

of

which

ramifications

are

sought

Specifically

-LRB-

truth

-RRB-

values

of

predicates

or

functions

changed

by

the

transaction

can

be

assumed

to

be

known

in

the

state

resulting

from

transaction

execution

Hence

the

-LRB-

truth

-RRB-

values

can

be

substituted

for

the

predicates

or

functions

and

logical

simplifications

may

be

applicable

The

invariants

themselves

need

not

be

verified

in

the

state

resulting

from

the

transaction

execution

since

their

satisfaction

is

guaranteed

by

the

transformation

process

Moreover

the

ramifications

generated

may

be

simpler

formulae

than

the

invariants

and

hence

the

transformation

of

postconditions

can

incur

considerable

savings

in

testing

for

the

satisfaction

of

invariants

An

exact

assessment

of

the

run-time

complexity

of

testing

the

satisfaction

of

augmented

postcondition

for

the

class

of

transaction

specifications

considered

here

is

a

topic

of

current

research

notion

of

relevance

is

defined

formally

in

the

sequel

The

following

examples

show

the

merits

and

problems

associated

with

the

technique

of

incorporating

ramifications

into

transaction

specifications

Example

Transaction

EnrollInCourse

was

defined

in

example

In

this

example

we

show

the

derivation

of

ramifications

for

postcondition

augmentation

by

rewriting

the

postcondition

and

invariant

in

MSTL

We

first

construct

the

conjunction

of

the

postcondition

Q

and

the

negation

of

the

invariant

instantiated

as

follows

-LRB-

size

-LRB-

crs

t

-RRB-

classlimit

-LRB-

crs

-RRB-

-RRB-

Q

-LRB-

size

-LRB-

crs

t

-RRB-

classlimit

-LRB-

crs

-RRB-

-RRB-

-LRB-

size

-LRB-

crs

t

-RRB-

size

-LRB-

crs

t

-RRB-

-RRB-

EnrolledIn

-LRB-

st

crs

t

-RRB-

By

substituting

T

rue

for

EnrolledIn

-LRB-

st

crs

t

-RRB-

and

size

-LRB-

crs

t

-RRB-

for

size

-LRB-

crs

t

-RRB-

the

conjunction

becomes

-LRB-

size

-LRB-

crs

t

-RRB-

classlimit

-LRB-

crs

-RRB-

-RRB-

This

formula

is

in

fact

a

ramification

of

Q

and

can

be

computed

as

shown

in

section

According

to

theorem

it

suffices

to

conjoin

the

negation

of

the

ramification

to

the

potscondition

The

invariant

is

no

longer

needed

for

verifying

the

safety

of

transaction

EnrollInCourse

since

the

invariant

is

embodied

in

the

new

postcondition

The

augmented

transaction

specification

now

becomes

EnrollInCourse

-LRB-

st

crs

-RRB-

Precondition

EnrolledIn

-LRB-

st

crs

-RRB-

Postcondition

-LRB-

crs

-RRB-

size

-LRB-

crs

-RRB-

-LRB-

st

crs

-RRB-

-LRB-

size

-LRB-

crs

t

-RRB-

classlimit

-LRB-

crs

-RRB-

-RRB-

The

next

example

shows

that

certain

ramifications

can

suggest

that

invariants

do

not

have

to

be

checked

and

postconditions

need

not

be

modified

in

order

to

guarantee

the

invariants

Example

-LRB-

Special

cases

-RRB-

The

specification

of

transaction

DropCourse

was

given

in

example

Intuitively

the

invariant

can

not

be

violated

as

a

result

of

executing

DropCourse

and

hence

the

specification

of

the

transaction

need

not

be

modified

In

fact

the

ramification

generation

process

produces

the

Boolean

constant

F

alse

as

a

ramification

of

the

negation

of

the

conjunction

formed

by

instantiating

and

negating

the

invariant

in

the

state

after

the

transaction

execution

and

by

conjoining

it

with

the

transaction

postcondition

According

to

theorem

it

suffices

to

augment

the

postcondition

with

the

negation

of

the

derived

ramification

i.e.

the

Boolean

constant

T

rue

This

means

that

it

suffices

for

the

implementation

meet

the

transaction

postcondition

as

was

initially

specified

in

order

to

maintain

the

invariant

The

case

in

which

the

propositional

constant

F

alse

is

derived

as

a

ramification

is

of

particular

interest

since

as

the

following

corollary

specifies

no

change

in

the

postcondition

is

needed

in

order

to

meet

the

invariant

The

derivation

of

T

rue

as

a

ramification

is

only

possible

when

the

transaction

specification

is

inconsistent

Corollary

If

F

alse

is

a

ramification

of

Q

then

is

maintained

by

a

transaction

meeting

Q

If

T

rue

is

a

ramification

of

Q

then

the

transaction

specification

is

inconsistent

Hence

the

process

of

generating

ramifications

can

also

discover

inconsistent

specifications

of

transactions

that

may

have

escaped

the

specifier

's

attention

A

valid

question

that

arises

is

whether

a

similar

approach

where

preconditions

rather

than

postconditions

of

transaction

specifications

can

be

augmented

so

that

the

maintenance

of

the

invariants

is

a

result

of

the

satisfaction

of

the

transaction

precondition

In

general

the

two

approaches

are

not

equivalent

They

are

equivalent

only

in

the

case

where

derived

ramifications

refer

only

to

the

state

before

the

transaction

execution

The

following

section

shows

an

example

of

a

transaction

specification

where

the

derived

ramification

refers

to

the

state

after

the

transaction

's

execution

It

is

thus

unnatural

to

augment

the

postcondition

with

a

condition

that

refers

to

the

state

resulting

from

the

transaction

execution

Dynamic

Integrity

Constraints

We

would

like

to

be

able

to

propose

similar

augmentations

to

postconditions

when

the

invariant

refers

to

any

number

of

knowledge

base

states

both

before

and

after

the

transaction

In

other

words

we

need

to

extend

the

method

for

the

enforcement

of

dynamic

integrity

constraints

The

solution

to

the

ramification

problem

presented

in

section

does

not

deal

with

constraints

more

general

than

transition

constraints

It

is

applicable

in

the

cases

where

the

checking

of

conditions

over

multiple

consecutive

states

can

be

reduced

to

checking

conditions

over

pairs

of

consecutive

states

The

extension

of

the

method

to

general

dynamic

constraints

is

a

topic

of

current

research

Some

initial

results

are

given

through

examples

of

the

use

of

ramifications

for

transactions

that

involve

transition

and

general

dynamic

constraints

These

examples

also

motivate

the

use

of

a

temporal

calculus

for

expressing

transaction

specifications

Example

-LRB-

Transition

constraints

as

transaction

invariants

-RRB-

Transaction

RaiseSalary

assigns

an

employee

an

increase

to

her

salary

RaiseSalary

-LRB-

emp

new

sal

-RRB-

Precondition

salary

-LRB-

emp

old

Tb

-RRB-

Postcondition

salary

-LRB-

emp

new

sal

Ta

-RRB-

Invariant

s

=D

T

-LSB-

salary

-LRB-

e

s

t

-RRB-

salary

-LRB-

e

-RRB-

-LRB-

t

-RRB-

-RRB-

-LRB-

s

-RRB-

Tb

and

Ta

are

used

to

denote

time

points

before

and

after

the

transaction

respectively

They

are

parameters

whose

exact

values

are

not

known

at

transaction

specification

For

the

purpose

of

deriving

the

successor

state

axioms

one

needs

to

instantiate

the

time

component

of

predicates

referring

to

the

state

prior

to

the

transaction

with

Tb

The

time

component

of

predicates

referring

to

the

state

after

the

transaction

are

instantiated

with

Ta

The

ramification

derived

is

-LRB-

old

new

sal

-RRB-

Its

addition

to

the

postcondition

suffices

to

ensure

the

maintenance

of

the

invariant

For

the

sake

of

demonstrating

the

applicability

of

using

ramifications

with

constraints

strictly

more

general

than

the

ones

dealt

with

so

far

we

now

switch

to

using

first-order

temporal

logic

-LRB-

FOTL

-RRB-

-LSB-

-RSB-

as

the

specification

language

FOTL

allows

one

to

express

constraints

referring

to

an

arbitrary

number

of

states

We

need

to

assume

without

loss

of

generality

that

exactly

one

action

can

occur

between

two

successive

states

of

the

knowledge

base

The

following

example

also

demonstrates

why

it

is

unnatural

to

consider

augmentations

of

the

precondition

of

a

transaction

specification

in

order

to

achieve

the

maintenance

of

invariants

Example

-LRB-

General

dynamic

integrity

constraints

-RRB-

The

formula

expressing

the

property

If

P

-LRB-

x

-RRB-

then

sometime

in

the

future

Q

-LRB-

x

-RRB-

is

an

invariant

for

transaction

InsertP

that

inserts

a

tuple

-LRB-

x

t

-RRB-

in

the

extension

of

base

predicate

P

InsertP

-LRB-

x

t

-RRB-

Precondition

T

rue

Postcondition

P

-LRB-

x

t

-RRB-

Invariant

=D

Time

-LSB-

P

-LRB-

x

t

-RRB-

-RRB-

T

ime

-LRB-

t

Q

-LRB-

x

-RRB-

-RRB-

-RSB-

In

addition

assume

that

the

knowledge

base

includes

the

following

deductive

rules

=D

Time

P

-LRB-

x

t

-RRB-

R

-LRB-

x

t

-RRB-

=D

Time

R

-LRB-

x

t

-RRB-

Q

-LRB-

x

t

-RRB-

time

points

are

not

unique

It

suffices

that

Ta

is

a

time

point

at

which

the

constraints

have

to

be

verified

-LRB-

before

the

transaction

commits

-RRB-

and

that

Tb

a

time

point

before

the

transaction

begins

execution

and

at

which

it

is

known

that

the

KB

is

in

a

consistent

state

results

can

be

obtained

when

transactions

are

specified

in

a

FOTL

with

modal

operators

and

Intuitively

after

the

transaction

InsertP

finishes

execution

the

knowledge

base

is

in

a

consistent

state

since

the

constraint

is

satisfied

due

to

the

implicit

updates

Because

of

the

presence

of

the

rules

no

precondition

exists

that

will

guarantee

the

invariant

The

invariant

however

contributes

to

effects

-LRB-

ramifications

-RRB-

that

can

be

used

to

eliminate

the

need

for

proving

the

invariant

We

generate

the

ramifications

by

first

instantiating

and

negating

the

invariant

and

then

computing

its

logical

consequences

given

the

knowledge

base

The

negated

invariant

is

-LSB-

P

-LRB-

x

t

-RRB-

-LRB-

Q

-LRB-

x

-RRB-

-RRB-

-LRB-

t

-RRB-

-RRB-

-RSB-

From

the

postcondition

and

rule

we

derive

R

-LRB-

x

t

-RRB-

Using

rule

we

can

now

derive

Q

-LRB-

x

t

-RRB-

Using

the

negated

invariant

and

the

postcondition

we

derive

the

ramification

N

Q

-LRB-

x

t

-RRB-

-RRB-

F

alse

Q

-LRB-

x

t

-RRB-

F

alse

Hence

the

invariant

is

maintained

if

the

postcondition

is

met

Notice

that

it

is

unreasonable

to

include

Q

-LRB-

x

t

-RRB-

as

a

precondition

to

a

transaction

of

which

it

is

an

implicit

consequence

The

constant

F

alse

is

generated

as

a

ramification

by

the

syntactic

generator

by

replacing

the

derived

predicates

that

occur

in

Q

by

their

definitions

and

then

applying

the

steps

described

in

section

Albeit

artificial

example

shows

that

dynamic

constraints

can

have

useful

effects

for

transactions

Even

in

cases

where

the

satisfaction

of

a

constraint

can

not

be

determined

because

the

constraint

refers

to

the

yet

undetermined

future

the

method

yields

a

ramification

that

can

be

used

in

place

of

the

original

constraint

This

is

the

case

in

example

if

the

rules

are

omitted

In

this

case

we

can

not

determine

whether

the

constraint

is

satisfied

or

violated

since

it

refers

to

the

possibly

infinite

set

of

subsequent

states

In

this

case

the

method

can

propose

a

simpler

condition

that

is

actually

a

ramification

of

the

original

constraint

and

the

postcondition

The

formula

N

-LRB-

t

Q

-LRB-

x

-RRB-

-RRB-

is

derived

and

the

new

constraint

that

suffices

to

be

verified

is

N

-LRB-

t

Q

-LRB-

x

-RRB-

-RRB-

It

contains

the

property

that

has

to

be

verified

by

the

future

states

and

can

be

treated

as

the

original

constraint

would

Extensions

In

this

section

we

present

extensions

of

the

ramification

method

for

dealing

with

multiple

constraints

multiple

transactions

conjoining

transaction

specifications

and

inheritance

of

specifications

Multiple

Transactions

The

approach

followed

in

the

previous

section

is

certainly

applicable

to

the

problem

of

reasoning

about

the

set

of

constraints

of

a

knowledge

base

in

the

presence

of

multiple

transaction

specifications

In

this

case

all

transaction

specifications

have

to

be

taken

into

account

since

a

constraint

may

be

relevant

to

or

affected

by

more

than

one

transactions

The

notion

of

relevance

is

formally

defined

here

It

is

based

on

the

notion

of

dependence

taken

from

-LSB-

-RSB-

For

that

we

will

assume

that

the

specifications

are

given

in

first-order

temporal

logic

Moreover

we

will

assume

that

no

interleaving

of

transactions

is

allowed

A

transaction

is

regarded

as

the

only

means

of

knowledge

base

state

change

Definition

-LRB-

Relevance

-RRB-

A

constraint

I

is

relevant

to

a

transaction

T

-LRB-

pre

post

-RRB-

if

post

contains

a

literal

on

which

some

literal

of

I

depends

Definition

-LRB-

Direct

Dependence

-RRB-

A

literal

L

directly

depends

on

a

literal

K

if

and

only

if

there

exists

a

rule

of

the

form

Cn

-LRB-

F

-RRB-

A

-RRB-

such

that

there

exists

a

literal

in

the

body

F

of

the

rule

unifying

with

K

with

mgu

and

A

L.

-LRB-

Dependence

-RRB-

A

literal

L

depends

on

literal

K

if

and

only

if

it

directly

depends

on

K

or

depends

on

a

literal

M

that

directly

depends

on

K

A

constraint/rule

depends

on

a

rule

if

its

literal

depends

on

the

rule

's

conclusion

literal

The

above

relationships

define

a

dependence

graph

for

a

set

of

rules

and

constraints

The

dependence

graph

is

a

directed

graph

representing

how

implicitly

derived

facts

from

deductive

rules

can

affect

the

integrity

of

the

knowledge

base

The

graph

can

be

constructed

at

transaction

specification

time

and

as

shown

in

-LSB-

-RSB-

is

incrementally

modifiable

to

accommodate

changes

in

the

sets

of

rules

or

constraints

An

integrity

constraint

relevant

to

a

set

of

transactions

fTi

-LRB-

prei

posti

-RRB-

ji

kg

has

to

be

considered

for

the

modification

of

each

posti

so

that

the

execution

of

any

Ti

provably

maintains

the

constraint

Hence

it

suffices

to

repeat

the

process

presented

in

section

for

every

Ti

The

process

may

be

optimized

by

reusing

the

derivation

of

ramifications

for

transactions

that

involve

common

predicates

The

symmetric

case

where

a

transaction

specification

is

associated

with

more

than

one

invariants

is

dealt

with

by

simply

taking

the

conjunction

of

the

invariants

as

the

new

invariant

Then

the

derived

ramification

depends

on

all

invariants

provided

that

the

union

of

the

invariants

is

a

satisfiable

set

Conjoining

Transaction

Specifications

The

conjunction

of

specifications

denoted

by

the

operator

jj

is

formed

by

conjoining

the

respective

pre/post-conditions

Then

as

theorem

suggests

it

suffices

to

conjoin

the

ramifications

of

the

two

invariant-postcondition

pairs

to

guarantee

that

the

invariant

will

be

maintained

if

the

new

postcondition

is

met

Theorem

Let

-LRB-

-RRB-

and

-LRB-

-RRB-

be

two

transaction

specifications

sharing

invariant

I

If

there

exist

ramifications

and

which

if

conjoined

with

the

postconditions

and

guarantee

the

maintenance

of

I

in

and

respectively

then

is

a

ramification

which

if

conjoined

with

guarantees

the

maintenance

of

I

in

T

An

important

consequence

of

theorem

is

the

ability

to

accommodate

new

invariants

without

having

to

redo

the

entire

process

Specifically

if

a

new

invariant

is

to

be

added

and

is

relevant

to

a

transaction

specification

whose

postcondition

has

already

been

augmented

by

computed

ramifications

it

suffices

to

verify

that

the

new

invariant

does

not

introduce

any

contradiction

and

if

this

is

the

case

to

generate

ramifications

of

the

new

invariant

and

the

postcondition

The

new

ramification

can

be

conjoined

with

the

previously

derived

ones

so

that

the

new

postcondition

guarantees

the

invariants

Inheritance

of

Transaction

Specifications

In

object-oriented

specification

languages

inheritance

of

transaction

-LRB-

method

-RRB-

specifications

is

traditionally

accomplished

by

conjoining

the

superclass

method

specification

to

that

of

its

subclasses

-LSB-

-RSB-

We

examine

whether

ramifications

derived

for

the

superclass

can

be

inherited

by

the

subclasses

Assume

a

transaction

-LRB-

-RRB-

is

a

specialization

of

-LRB-

-RRB-

and

that

there

exists

a

formula

with

the

property

KB

j

-LRB-

-RRB-

-RRB-

I

The

specification

of

is

inherited

by

It

is

the

responsibility

of

the

specifier

to

ensure

that

neither

of

the

conjunctions

-LRB-

-RRB-

and

-LRB-

-RRB-

is

a

contradiction

Then

according

to

theorem

if

a

ramification

can

be

found

such

that

KB

j

-LRB-

-RRB-

-RRB-

I

then

augmenting

with

suffices

to

guarantee

that

the

invariant

will

be

maintained

if

the

augmented

refined

postcondition

is

met

Discussion

In

the

majority

of

the

existing

methods

for

integrity

constraint

maintenance

by

transaction

modification

the

frame

and

ramification

problems

have

either

been

ignored

or

bypassed

by

means

of

implicit

assumptions

that

state

that

nothing

but

what

is

explicitly

declared

to

change

in

the

update

procedure

does

Within

AI

however

the

problems

have

long

been

recognized

as

common

sense

reasoning

problems

and

several

attempts

towards

their

solution

have

appeared

-LRB-

e.g.

-LSB-

-RSB-

-LSB-

-RSB-

-RRB-

The

solution

presented

by

Reiter

-LSB-

-RSB-

combined

and

extended

previous

results

leading

to

the

systematic

solution

on

which

this

paper

is

based

In

-LSB-

-RSB-

integrity

constraints

expressed

as

QUEL

queries

on

relational

databases

are

added

as

qualifications

to

transactions

The

execution

of

the

resulting

transaction

guarantees

integrity

preservation

However

no

simplification

of

constraints

takes

place

and

the

knowledge

of

their

satisfaction

prior

to

the

update

is

not

exploited

A

set-oriented

language

for

transaction

specification

is

used

in

-LSB-

-RSB-

For

each

update

and

each

constraint

a

weakest

precondition

-LRB-

wp

-RRB-

is

derived

so

that

if

wp

is

true

in

the

state

prior

to

the

update

then

the

constraint

is

guaranteed

to

be

true

in

the

state

resulting

from

the

update

Although

the

derived

weakest

preconditions

are

frequently

amenable

to

simplification

there

is

no

systematic

treatment

of

precondition

optimization

The

method

is

applicable

to

a

limited

class

of

static

constraints

only

and

there

is

no

mention

of

derivations

of

weakest

preconditions

when

multiple

constraints

are

relevant

to

an

update

Finally

although

the

authors

claim

that

it

is

trivial

to

incorporate

implicit

updates

the

machinery

provided

does

not

account

for

them

constraints

In

-LSB-

-RSB-

a

general-purpose

theorem

prover

employing

heuristic

rewrite

rules

is

used

for

proving

safety

of

transactions

with

respect

to

a

set

of

static

constraints

Implicit

updates

and

dynamic

constraints

are

not

considered

Although

safety

of

transactions

is

proved

at

compile-time

the

theorem

prover

could

take

advantage

of

the

knowledge

of

the

updates

taking

part

in

the

transaction

in

order

to

simplify

the

proof

procedure

and

possibly

suggest

changes

to

the

transaction

specification

Although

not

discussed

the

frame

problem

is

implicitly

dealt

with

by

restricting

attention

to

the

predicates

changed

by

transactions

and

by

eliminating

inertial

terms

from

the

theorems

that

have

to

be

proven

in

order

to

verify

integrity

The

concept

of

constraint

protectors

discussed

in

-LSB-

-RSB-

resembles

that

of

constraint

ramifications

Their

generation

however

assumes

the

existence

of

a

fairly

general

theory

of

lemmas

that

is

independent

of

the

transactions

Several

modes

of

feedback

to

the

transaction

designer

are

suggested

but

are

not

put

into

a

formal

framework

Dynamic

integrity

constraints

specified

in

temporal

logic

are

translated

into

transaction

specifi

cations

in

-LSB-

-RSB-

Constraints

are

translated

into

transition

graphs

and

transformation

steps

that

simulate

the

evaluation

of

the

constraints

on

the

graphs

are

applied

Transactions

are

specified

in

terms

of

pre/post-condition

pairs

and

explicit

frame

assumptions

The

transaction

specifier

has

to

supply

all

frame

conditions

explicitly

The

specifications

are

the

modified

by

incorporating

conditions

that

represent

the

parts

of

the

constraints

that

remain

to

be

verified

Although

the

transformation

technique

is

sound

i.e.

violations

of

constraints

are

detected

the

transformations

to

transaction

specifications

introduce

conditions

that

refer

to

the

transition

graphs

instead

of

predicates

occurring

in

constraints

or

transactions

It

It

becomes

unclear

what

the

specifications

of

the

transaction

mean

with

respect

to

the

database

state

Moreover

the

problem

of

implicit

updates

is

not

addressed

In

-LSB-

-RSB-

integrity

constraints

are

semi-automatically

translated

into

set-oriented

production

rules

activated

at

the

commit

point

of

transactions

The

focus

of

this

work

is

on

automatic

integrity

repair

rather

than

optimization

of

constraint

checking

In

-LSB-

-RSB-

active

rules

are

used

to

implement

temporal

integrity

constraints

but

the

problem

of

implicit

updates

is

not

addressed

The

previous

sections

showed

how

the

task

of

proving

integrity

maintenance

can

be

assisted

by

the

adaptation

of

a

systematic

solution

to

the

frame

and

ramification

problems

The

method

presented

is

applicable

to

a

fairly

large

class

of

transaction

specifications

namely

that

of

determinate

specifications

and

a

class

of

constraints

that

encompasses

the

types

of

constraints

that

are

usually

supported

by

commercial

database

systems

and

most

research

prototypes

Furthermore

the

results

extend

to

the

case

of

object-oriented

specifications

and

for

the

synthesis

of

specifications

by

conjoining

existing

specifications

The

process

of

designing

a

knowledge

base

can

be

assisted

by

a

tool

that

when

given

a

set

of

transaction

specifications

suggests

modifications

to

the

postconditions

so

that

the

integrity

constraints

are

provably

maintained

by

any

implementation

meeting

the

modified

specification

Moreover

inconsistencies

in

the

specifications

can

be

discovered

We

argue

that

this

form

of

feedback

is

crucial

for

the

knowledge

base

design

process

since

it

provides

with

a

systematic

way

of

testing

whether

certain

desirable

aspects

of

a

good

design

can

be

achieved

It

has

to

be

noted

that

the

results

presented

here

are

not

tied

to

a

particular

specification

language

A

similar

generation

process

can

be

devised

for

specifications

given

in

language

like

SQL

or

its

extensions

Conclusions

The

contribution

of

the

research

presented

in

this

paper

is

two-fold

it

shows

that

the

use

of

a

solution

to

the

frame

and

ramification

problem

can

provide

valuable

feedback

during

the

transaction

design

phase

and

suggests

a

new

technique

for

integrity

maintenance

in

large

knowledge

bases

In

particular

we

have

presented

an

adaptation

of

ideas

from

AI

into

the

problem

of

maintaining

the

integrity

of

a

knowledge

base

We

adopted

and

extended

a

systematic

solution

to

the

frame

and

ramification

problem

for

simplifying

at

compile

time

the

task

of

proving

that

transaction

execution

does

not

violate

the

integrity

constraints

This

becomes

possible

by

the

syntactic

generation

of

successor

state

axioms

which

for

the

case

of

determinate

transaction

specifications

completely

characterize

under

which

circumstances

predicates

or

functions

change

value

after

a

state

transition

The

complexity

of

the

process

of

generating

these

axioms

is

polynomial

in

the

number

of

predicates

and

functions

in

the

constraints

-LSB-

-RSB-

We

extended

the

method

to

apply

to

a

class

of

constraints

which

includes

static

and

transition

constraints

We

showed

that

the

introduction

of

new

transaction

specifications

or

new

constraints

can

be

accommodated

incrementally

This

technique

can

lead

to

the

development

of

a

tool

which

as

part

of

a

knowledge

base

management

system

-LSB-

MCP

-RSB-

will

suggest

additions

to

transaction

postconditions

whose

effect

will

be

to

maintain

the

invariants

This

tool

aims

at

assisting

the

database

design

process

by

providing

feedback

to

the

designer

of

transactions

and

by

automating

the

task

of

verifying

the

safety

of

transactions

Furthermore

a

new

technique

for

integrity

constraint

checking

is

suggested

Checking

for

the

satisfaction

of

constraints

after

each

transaction

execution

is

saved

for

the

constraints

for

which

it

can

be

decided

at

compile-time

that

they

remain

provably

true

Similarly

for

those

that

are

provably

violated

the

cost

of

undoing

transactions

is

saved

Otherwise

a

simpler

condition

sufficient

for

ensuring

that

constraints

will

not

be

violated

is

derivable

The

proposed

method

is

a

promising

avenue

for

achieving

acceptable

run-time

performance

for

the

problem

of

maintaining

the

integrity

of

large

knowledge

bases

as

it

is

updated

through

transactions

We

are

currently

investigating

the

possibility

of

devising

similar

syntactic

generators

for

general

dynamic

constraints

as

well

as

the

application

of

additional

optimization

steps

for

generating

simpler

conditions

that

suffice

to

guarantee

invariant

maintenance

For

the

case

of

temporal

constraints

in

particular

the

minimization

of

the

temporal

information

required

to

verify

the

constraints

appears

to

be

possible

by

using

knowledge

about

the

satisfaction

of

the

constraints

in

the

history

of

states

up

to

the

current

state

References

-LSB-

-RSB-

F.

Bry

H.

Decker

and

R.

Manthey

A

Uniform

Approach

to

Constraint

Satisfaction

and

Constraint

Satisfiability

in

Deductive

Databases

In

Proceedings

of

the

Int

Conference

on

Extedning

Data

Base

Technology

pages

-LCB-

-LSB-

-RSB-

A.

Borgida

J.

Mylopoulos

and

R.

Reiter

And

nothing

else

changes

The

Frame

Problem

in

Procedure

Specifications

In

Proceedings

of

the

Int

Conference

on

Software

Engineering

-LSB-

-RSB-

A.

Borgida

J.

Mylopoulos

and

R.

Reiter

The

Frame

Problem

in

Procedure

Specifications

IEEE

Transactions

on

Software

Engineering

To

appear

-LSB-

-RSB-

J.

Chomicki

History-less

Checking

of

Dynamic

Integrity

Constraints

In

Int

Conference

on

Data

Engineering

pages

-LCB-

Phoenix

AZ

-LSB-

-RSB-

Jan

Chomicki

and

David

Toman

Implementing

Integrity

Constraints

Using

an

Active

DBMS

In

Proceedings

Active

Database

Systems

pages

-LCB-

-LSB-

-RSB-

S.

Ceri

and

J.

Widom

Deriving

Production

Rules

for

Constraint

Maintenance

In

Proceedings

of

the

Int

Conference

in

Very

Large

Databases

pages

-LCB-

-LSB-

-RSB-

J.

Finger

Exploiting

Constraints

in

Design

Synthesis

Technical

Report

STAN-CS

Stanford

University

-LSB-

-RSB-

J.

Florentin

Consistency

Auditing

of

Data

Bases

Computer

Journal

-LRB-

-RRB-

-LCB-

-LSB-

-RSB-

G.

Gardarin

and

M.

Melkanoff

Proving

Consistency

of

Database

Transactions

In

Proceedings

VLDB

pages

-LCB-

-LSB-

-RSB-

M.

Ginsberg

and

D.

Smith

Reasoning

about

Action

I

A

Possible

Worlds

Approach

In

Matthew

Ginsberg

editor

Readings

in

Non-Monotonic

Reasoning

pages

-LCB-

Morgan

Kauffmann

-LSB-

-RSB-

M.

Jeusfeld

and

M.

Jarke

From

Relational

to

Object-Oriented

Integrity

Simplification

In

Int

Conference

on

Deductive

and

Object-Oriented

Databases

pages

-LCB-

-LSB-

-RSB-

V.

Lifschitz

Towards

a

Metatheory

of

Action

In

Proceedings

of

the

International

Conference

on

Knowledge

Representation

and

Reasoning

pages

-LCB-

-LSB-

-RSB-

U.

Lipeck

Transformation

of

Dynamic

Integrity

Constraints

into

Transaction

Specifications

Theoretical

Computer

Science

-LCB-

-LSB-

-RSB-

F.

Lin

and

R.

Reiter

State

Constraints

Revisited

In

Proceedings

of

the

Symposium

on

Logical

Formalizations

of

Commonsense

Reasoning

pages

-LCB-

-LSB-

-RSB-

F.

Lin

and

R.

Reiter

State

Constraints

Revisited

Journal

of

Logic

and

Computation

Special

Issue

on

Actions

and

Processes

-LSB-

-RSB-

J.

Lloyd

E.

Sonenberg

and

R.

Topor

Integrity

Constraint

Checking

in

Stratified

Databases

Technical

Report

Department

of

Computer

Science

University

of

Melbourne

-LSB-

-RSB-

M.

Lawley

R.

Topor

and

M.

Wallace

Using

Weakest

Preconditions

to

Simplify

Integrity

Constraint

Checking

In

Proceedings

of

the

Australian

Database

Conference

pages

-LCB-

-LSB-

-RSB-

J.

Mylopoulos

A.

Borgida

M.

Jarke

and

M.

Koubarakis

Telos

A

Language

for

Representing

Knowledge

in

Information

Systems

ACM

Transactions

On

Information

Systems

-LRB-

-RRB-

-LCB-

-LSB-

-RSB-

J.

McCarthy

Some

Philosophical

Problems

from

the

Standpoint

of

Artificial

Intelligence

In

B.

Meltzer

and

D.

Mitchie

editors

Machine

Intelligence

pages

-LCB-

Edinburg

University

Press

-LSB-

MCP

-RSB-

J.

Mylopoulos

V.

Chaudhri

D.

Plexousakis

A.

Shrufi

and

T.

Topaloglou

Building

Knowledge

Base

Management

Systems

The

VLDB

Journal

To

appear

-LSB-

-RSB-

Z.

Manna

and

A.

Pnueli

The

Temporal

Logic

of

Reactive

and

Concurrent

Systems

Springer

Verlag

Vol

Specification

-LSB-

-RSB-

J.-M

Nicolas

Logic

for

Improving

Integrity

Checking

in

Relational

Databases

Acta

Informatica

-LCB-

-LSB-

-RSB-

J.

Pinto

Temporal

Reasoning

in

the

Situation

Calculus

PhD

thesis

Department

of

Computer

Science

University

of

Toronto

-LSB-

-RSB-

D.

Plexousakis

Integrity

Constraint

and

Rule

Maintenance

in

Temporal

Deductive

Knowledge

Bases

In

Proceedings

of

the

Int

Conference

on

Very

Large

Data

Bases

pages

-LCB-

Dublin

IR

August

-LSB-

-RSB-

D.

Plexousakis

Semantical

and

Ontological

Considerations

in

Telos

a

Lanugage

for

Knowledge

Representation

Computational

Intelligence

-LRB-

-RRB-

-LCB-

-LSB-

-RSB-

D.

Plexousakis

Compilation

and

Simplification

of

Temporal

Integrity

Constraints

In

Proceedings

of

the

Int

Workshop

on

Rules

in

Database

Systems

Athens

GR

September

To

appear

-LSB-

-RSB-

R.

Reiter

The

Frame

Problem

in

the

Situation

Calculus

A

Simple

Solution

-LRB-

Sometimes

-RRB-

and

a

Completeness

Model

for

Goal

Regression

In

V.

Lifschitz

editor

Artificial

Intelligence

and

the

Mathematical

Theory

of

Computation

Papers

in

Honor

of

John

McCarthy

pages

-LCB-

Academic

Press

-LSB-

-RSB-

L.

Schubert

Monotonic

Solution

to

the

Frame

Problem

in

the

Situation

Calculus

An

Efficient

Method

for

Worlds

with

Fully

Specified

Actions

In

H.

Kyberg

R.

Loui

and

G.

Carlson

editors

Knowledge

Representation

and

Defeasible

Reasoning

pages

-LCB-

-LSB-

-RSB-

D.

Stemple

S.

Mazumdar

and

T.

Sheard

On

the

Modes

and

Meaning

of

Feedback

to

Transaction

Designers

In

Proceedings

of

ACM-SIGMOD

Int

Conference

on

the

Management

of

Data

pages

-LCB-

San

Francisco

CA

-LSB-

-RSB-

S.

Schuman

and

D.

Pitt

Object-Oriented

Subsystem

Specification

In

L.

Meertens

editor

Program

Specification

and

Transformation

pages

-LCB-

Elsevier

Science

-LSB-

-RSB-

Tim

Sheard

and

David

Stemple

Automatic

Verification

of

Database

Transaction

Safety

ACM

Transactions

on

Database

Systems

-LRB-

-RRB-

-LCB-

-LSB-

-RSB-

M.

Stonebraker

Implementation

of

Integrity

Constraints

and

Views

by

Query

Modification

In

Proceedings

of

ACM-SIGMOD

Int

Conference

on

the

Management

of

Data

pages

-LCB-

-LSB-

-RSB-

Teniente

Ernest

and

Oliv?e

Antoni

Updating

Knowledge

Bases

While

Maintaining

Their

Consistency

The

VLDB

Journal

-LRB-

-RRB-

-LCB-

database design
transaction specification

integrity constraints in large knowledge bases