Computing Boundaries for Reasoning in Sub-Ontologies

Consider an ontology T where every axiom is labeled with an element of a lattice (L,≤). Then every element ` of L determines a sub-ontology T`, which consists of the axioms of T whose labels are greater or equal to `. These labels may be interpreted as required access rights, in which case T` is the sub-ontology that a user with access right ` is allowed to see, or as trust levels, in which case T` consists of those axioms that we trust with level at least `. Given a consequence α (such as a subsumption relationship between concepts) that follows from the whole ontology T , we want to know from which of the sub-ontologies T` determined by lattice elements ` the consequence α still follows. However, instead of reasoning with T` in the deployment phase of the ontology, we want to pre-compute this information during the development phase. More precisely, we want to compute what we call a boundary for α, i.e., an element μα of L such that α follows from T` iff ` ≤ μα. In this paper we show that, under certain restrictions on the elements ` used to define the sub-ontologies, such a boundary always exists, and we describe black-box approaches for computing it that are generalizations of approaches for axiom pinpointing in description

logics. We also present first experimental results that compare the efficiency of these approaches on real-world ontologies.

Introduction
Assume that you have a large ontology T , but you want to offer different users different views on this ontology, i.e., each user can see only a subset of the actual ontology, which is selected by an appropriate criterion. This criterion could be the access right that this user has, the level of trust (in the axioms of the ontology) that the user requires, the level of details that is deemed to be appropriate for this user, etc. In principle, you could explicitly create a sub-ontology for each (type of) user, but then you might end up with exponentially many different ontologies, where each is a subset of T . Instead, we propose to keep just the big ontology T , but label the axioms in T such that a comparison of the axiom label with the user criterion determines whether the axiom belongs to the sub-ontology for this user or not. To be more precise, we use a labeling lattice (L, ≤), i.e., a set of labels L together with a partial order ≤ on these labels such that a finite set of labels always has a join (supremum, least upper bound) and an meet (infimum, greatest lower bound) w.r.t. ≤. All axioms t ∈ T are now assumed to have a label lab(t) ∈ L, and the user also receives a label ∈ L (which can be read as access right, required level of trust, etc.). The sub-ontology that a user with label can see is then defined to be 1 T := {t ∈ T | lab(t) ≥ }.
Of course, the user of an ontology should not only be able to see its axioms, but also the consequences of these axioms. Thus, a user with label should be able to see all the consequences of T . For large ontologies, certain relevant consequences are often pre-computed. The goal of the pre-computation is that certain user queries can be answered by a simple look-up in the precomputed consequences, and thus do not require expensive reasoning during the deployment phase of the ontology. For example, in the version of the large medical ontology SNOMED CT 2 that is distributed to hospitals, all the subsumption relationships between the concept names occurring in the ontology are pre-computed. For a labeled ontology as introduced above, it is not enough to pre-compute the relevant consequences of T . In fact, if 1 To define this sub-ontology, an arbitrary partial order would be sufficient. However, the existence of suprema and infima will be important for the computation of a boundary of a consequence (see below).
2 http://www.ihtsdo.org/snomed-ct/ the relevant consequence α follows from T , then we also need to know for which user labels it still follows from T . Otherwise, if a user with label asks whether α holds, the system could not simple look this up in the precomputed consequences, but would need to compute the answer on-the-fly by reasoning over the sub-ontology T . Our solution to this problem is to compute a so-called boundary for the consequence α, i.e., an element µ α of L such that α follows from T iff ≤ µ α . There are basically two approaches for computing a boundary. The glassbox approach takes a specific reasoner (or reasoning technique) for an ontology language (e.g., a tableau-based reasoner for OWL DL [18]) and modifies it such that it can compute a boundary. Examples for the application of the glass-box approach to specific instances of the problem of computing a boundary are tableau-based approaches for reasoning in possibilistic Description Logics [13,11] (where the lattice is the interval [0, 1] with the usual order) and glass-box approaches to axiom pinpointing in Description Logics [17,12,10,2,3] (where the lattice consists of (equivalence classes of) monotone Boolean formulae with implication as order [3]). The problem with glass-box approaches is that they have to be developed for every ontology language and reasoning technique anew and that optimizations of the original reasoning technique do not always apply to the modified reasoners. In contrast, the black-box approach can re-use existing optimized reasoners without modifications, and it can be applied to arbitrary ontology languages: one just needs to plug in a reasoner for this language.
In this paper, we introduce three different black-box approaches for computing a boundary, and compare their performance on real-world ontologies. The first approach uses an axiom pinpointing algorithm as black-box reasoner, whereas the second one modifies the Hitting-Set-Tree-based black-box approach to axiom pinpointing [9,19]. The third uses binary search and can only be applied if the labeling lattice is a linear order. It can be seen as a generalization of the black-box approach to reasoning in possibilistic Description Logics described in [14].

Basic Definitions and Results
To stay as general as possible, we do not fix a specific ontology language. We just assume that ontologies are finite sets of axioms such that every subset of an ontology is again an ontology. If T is a subset of the ontology T , then T is called a sub-ontology of T . The ontology language determines which sets of axioms are admissible as ontologies. For a fixed ontology language, a monotone consequence relation |= is a binary relation between ontologies T of this language and consequences α such that, for every ontology T , we have that T ⊆ T and T |= α imply T |= α. If T |= α, then we say that α follows from T and that T entails α. For instance, given a Description Logic L (e.g., the DL SHIN (D) underlying OWL DL), an ontology is an L-TBox, i.e., a finite set of general concept inclusion axioms (GCIs) of the form C D for L-concept descriptions C, D. As consequences we can, e.g., consider subsumption relationships A B for concept names A, B.
We consider a lattice (L, ≤) and respectively denote by ∈S and ∈S the join (least upper bound) and meet (greatest lower bound) of the finite set S ⊆ L. A labeled ontology with labeling lattice (L, ≤) is an ontology T together with a labeling function lab that assigns a label lab(t) ∈ L to every element t of T . We denote with L lab the set of all labels occurring in the labeled ontology T , i.e., L lab := {lab(t) | t ∈ T }. Every element of the labeling lattice ∈ L defines a sub-ontology T that contains the axioms of T that are labeled with elements greater than or equal to : Conversely, every sub-ontology S ⊆ T defines an element λ S ∈ L, called the label of S: λ S := t∈S lab(t). The following lemma states some simple relationships between these two notions.
Proof. For the first statement, notice that, by definition, ≤ lab(t) for all t ∈ T . Hence, ≤ t∈T lab(t) = λ T . Regarding the second claim, if t ∈ S, then λ S = s∈S lab(s) ≤ lab(t), which implies that t ∈ T λ S . Now, consider the last claim. First, as ≤ λ T , it holds trivially that T λ T ⊆ T . From the second claim it also follows that T ⊆ T λ T .
Notice that, if a consequence α follows from T for some ∈ L, it must also follow from T for every ≤ , since then T ⊆ T . A maximal element of L that still entails the consequence will be called a margin for this consequence.
Definition 2 (Margin) Let α be a consequence that follows from the ontology T . The label µ ∈ L is called a (T , α)-margin if T µ |= α, and for every with µ < we have T |= α.
If T and α are clear from the context, we usually ignore the prefix (T , α) and call µ simply a margin. The following lemma shows three basic properties of the set of margins that will be useful throughout this paper.
Lemma 3 Let α be a consequence that follows from the ontology T . We have: 1. If µ is a margin, then µ = λ Tµ ; 2. if T |= α, then there is a margin µ such that ≤ µ; 3. there are at most 2 |T | margins for α.
Proof. To show 1, let µ ∈ L. Lemma 1 yields µ ≤ λ Tµ and T µ = T λ Tµ , and thus T λ Tµ |= α. If µ < λ Tµ , then this λ Tµ contradicts our assumption that µ is a margin; hence µ = λ Tµ . Point 3 is a trivial consequence of 1: since every margin has to be of the form λ S for some S ⊆ T , there are at most as many margins as there are subsets of T .
For the remaining point, let ∈ L be such that T |= α. Let m := λ T . From Lemma 1, it follows that ≤ m and T m = T , and hence T m |= α. If m is a margin, then the result holds; suppose to the contrary that m is not a margin. Then, there must exist an 1 , m < 1 , such that T 1 |= α. As m = λ Tm , there must exist an axiom t ∈ T such that m ≤ lab(t), but The existence of such an axiom t implies that T 1 ⊂ T m . Let m 1 := λ T 1 ; then m < 1 ≤ m 1 . If m 1 is not a margin, then we can repeat the same process to obtain a new m 2 with m < m 1 < m 2 and T m ⊃ T m 1 ⊃ T m 2 , and so on. As T is finite, there exists a finite k where this process stops, and hence m k is a margin.
If we know that µ is a margin for the consequence α, then we know whether α follows from T for all ∈ L that are comparable with µ: if ≤ µ, then α follows from T , and if > µ, then α does not follow from T . However, the fact that µ is a margin gives us no information regarding elements that are incomparable with µ. In order to obtain a full picture of when the consequence α follows from T for an arbitrary element of l, we can try to strengthen the notion of margin to that of an element ν of L that accurately divides the lattice into those elements whose associated sub-ontolgy entails α and those for which this is not the case, i.e., ν should satisfy the following: for every ∈ L, T |= α iff ≤ ν. Unfortunately, such an element need not always exist, as demonstrated by the following example.
Example 4 Consider the distributive lattice (S 4 , ≤ 4 ) having the four elements S 4 = {0, a 1 , a 2 , 1}, where 0 and 1 are the least and greatest elements, respectively, and a 1 , a 2 are incomparable w.r.t. ≤ 4 . Let T be the set formed by the axioms ax 1 and ax 2 , which are labeled by a 1 and a 2 , respectively, and let α be a consequence such that, for every S ⊆ T , we have S |= α iff |S| ≥ 1. It is easy to see that there is no element ν ∈ S 4 that satisfies the condition described above. Indeed, if we choose ν = 0 or ν = a 1 , then a 2 violates the condition, as a 2 ≤ ν, but T a 2 |= α. Accordingly, if we choose ν = a 1 , then a 2 violates the condition. Finally, if ν = 1 is chosen, then 1 itself violates the condition: 1 ≤ ν, but T 1 |= α.
It is nonetheless possible to find an element that satisfies a restricted version of the condition, where we do not impose that the property must hold for every element of the labeling lattice, but only for those elements that are join prime relative to the labels of the axioms in the ontology. An element ∈ L is called join prime relative to K if, for every K ⊆ K ⊗ , ≤ k∈K r implies that there is an k 0 ∈ K such that ≤ k 0 .
In Example 4, all lattice elements with the exception of 1 are join prime relative to {a 1 , a 2 }.
Definition 6 (Boundary) Let T be an ontology and α a consequence. An element ν ∈ L is called a (T , α)-boundary if for every element ∈ L that is join prime relative to L lab it holds that ≤ ν iff T |= α.
As with margins, if T and α are clear from the context, we will simply call such a ν a boundary. In Example 4, the element 1 is a boundary. Indeed, every join prime element relative to {a 1 , a 2 } (i.e., every element of L except for 1) is such that < 1 and T |= α. From a practical point of view, our definition of a boundary has the following implication: we must enforce that user labels are always join prime relative to the set L lab of all labels occurring in the ontology.

Computing a Boundary
In this section, we describe three black-box approaches for computing a boundary. The first two approaches are based on Lemma 7 below, and the third one, a modification of binary search, can be used if the labeling lattice is a linear order.
Proof. Let ∈ L be join prime relative to L lab . We need to show that ≤ n i=1 µ i iff T |= α. Assume first that T |= α. Then, from 2 of Lemma 3, it follows that there is a margin µ j such that ≤ µ j , and thus ≤ n i=1 µ i . Conversely, let ≤ n i=1 µ i . From 1 of Lemma 3, it follows that for every i, 1 ≤ i ≤ n, µ i ∈ (L lab ) ⊗ . As is join prime relative to L lab , it then holds that there is a j such that ≤ µ j and hence, by the definition of a margin and the monotonicity of the consequence relation, T |= α.
By Lemma 3, a consequence always has finitely many margins, and thus Lemma 7 shows that a boundary always exists. Note, however, that a consequence may have boundaries different from the one of Lemma 7. To identify the particular boundary of Lemma 7, we will call it the margin-based boundary.

Using Full Axiom Pinpointing
From Lemma 7 we know that the set of all margins yields sufficient information for computing a boundary. The question is now how to compute this set. In this subsection, we show that all margins (and thus the margin-based boundary) can be computed through axiom pinpointing. Axiom-pinpointing refers to the task of computing MinAs [5]: minimal (w.r.t. set inclusion) subontologies from which a consequence α still follows. More formally, S ⊆ T is called a MinA for T and α if S |= α, and S |= α for every S ⊂ S. The following lemma shows that every margin can be obtained from some MinA.
Lemma 8 For every margin µ for α there is a MinA S such that µ = λ S .
Proof. If µ is a margin, then T µ |= α by definition. Thus, there exists a MinA S ⊆ T µ . Since µ ≤ lab(t) for every t ∈ T µ , this in particular holds also for every axiom in S, and hence µ ≤ λ S . Additionally, as S ⊆ T λ S , we have T λ S |= α. This implies µ = λ S since otherwise µ < λ S , and then µ would not be a margin.
Notice that this lemma does not imply that the label of any MinA S corresponds to a margin. However, as the consequence follows from every MinA, point 2 of Lemma 3 shows that λ S ≤ µ for some margin µ. The following theorem is an immediate consequence of this fact together with Lemma 7 and Lemma 8.
Theorem 9 If S 1 , . . . , S n are all MinAs for T and α, then n i=1 λ S i is the margin-based boundary for α.
Thus, to compute a boundary, it is sufficient to compute all MinAs. Several methods exist for computing the set of all MinAs, either directly [17,9,6] or through a so-called pinpointing formula [5,3,4], which is a monotone Boolean formula encoding all the MinAs. The main advantage of using the pinpointing-based approach for computing a boundary is that one can simply use existing implementations for computing all MinAs, such as the ones offered by the ontology editor Protégé 4 3 and the CEL system. 4

Label-Optimized Axiom Pinpointing
From Lemma 8 we know that every margin is of the form λ S for some MinA S. In the previous subsection we have used this fact to compute a boundary by first obtaining the MinAs and then computing their labels. This process can be optimized if we directly compute the labels of the MinAs, without necessarily computing the actual MinAs. Additionally, not all the labels of MinAs are necessary, but only the maximal ones. We present here a blackbox algorithm that uses the labels of the axioms to find the boundary in an optimized way. Our algorithm is a variant of the Hitting-Set-Tree-based [15] method (HST approach) for axiom pinpointing [9,19]. First, we briefly describe the HST approach for computing all MinAs, which will serve as a starting point for our modified version.
The HST algorithm computes one MinA at a time while building a tree that expresses the distinct possibilities to be explored in the search of further MinAs. It first computes an arbitrary MinA S 0 for T , which is used to label the root of the tree. Then, for every axiom t in S 0 , a successor node is created. If T \ {t} does not entail the consequence, then this node is a dead end. Otherwise, T \ {t} still entails the consequence. In this case, a MinA S 1 for T \ {t} is computed and used to label the node. The MinA S 1 for T \ {t} obtained this way is also a MinA of T , and it is guaranteed to be distinct from S 0 since t / ∈ S 1 . Then, for each axiom s in S 1 , a new successor is created, and treated in the same way as the successors of the root node, i.e., it is checked whether T \ {t, s} still has the consequence, etc. This process obviously terminates, and the end result is a tree, where each node that is not a dead end is labeled with a MinA, and every MinA appears as the label of at least one node of the tree (see [9,19]).
An important ingredient of the HST algorithm is a procedure that computes a single MinA from an ontology. Such a procedure can, for example, be obtained by going through the axioms of the ontology in an arbitrary order, and removing redundant axioms, i.e., ones such that the ontology obtained by removing this axiom from the current sub-ontology still entails the consequence (see [5] for a description of this and of a more sophisticated logarithmic procedure). As said before, in our modified HST algorithm, we are now not interested in actually computing a MinA, but only its label. This allows us to remove all axioms having a "redundant" label rather than a single axiom. Algorithm 1 describes a black-box method for computing λ S for some MinA S that is based on this idea. In fact, the algorithm computes a minimal label set of a MinA S, a notion that will also be useful when describing our variant of the HST algorithm.
Algorithm 1 removes all the labels that do not contribute to a minimal label set. If T is an ontology and ∈ L, then the expression T − appearing at Line 7 denotes the sub-ontology T − := {t ∈ T | lab(t) = }. If, after removing all the axioms labeled with k, the consequence still follows, then there is a MinA none of whose axioms is labeled with k. In particular, this MinA has a minimal label set not containing k; thus all the axioms labeled with k can be removed in our search for a minimal label set. If the axioms labeled with k cannot be removed, then all MinAs of the current sub-ontology need an axiom labeled with k, and hence k is stored in the set M L . This set is used to avoid useless consequence tests: if a label is greater than or equal to ∈M L , then the presence or absence of axioms with this label will not influence the final result, which will be given by the infimum of M L ; hence, there is no need to apply the (possibly complex) decision procedure for the consequence relation.
Theorem 11 Let T and α be such that T |= α. There is a MinA S 0 for α such that Algorithm 1 outputs a minimal label set of S 0 .
Proof. As T |= α, the algorithm will enter the for loop. This loop keeps the following two invariants: (i) S |= α and (ii) for every ∈ M L , S − |= α. The invariant (i) is ensured by the condition in Line 7 that must be satisfied before S is modified. Otherwise, that is, if S − |= α, then is added to M L (Line 10) which, together with the fact that S is always modified to a smaller set (Line 8), ensures (ii). Hence, when the loop finishes, the sets S and M L satisfy both invariants. As S |= α, there is a MinA S 0 ⊆ S for α. For each ∈ M L , there must be an axiom t ∈ S 0 such that lab(t) = , ≤ k, and thus it fulfills the test in Line 6, and continues to Line 7. If that test is satisfied, then all the axioms with label k are removed from S, contradicting the assumption that k = lab(t) for some t ∈ S. Otherwise, k is added to M L , which contradicts the assumption that ∈M L ≤ k. Thus, for every axiom t in S, Once the label of a MinA has been found, we can compute new MinA labels by a successive deletion of axioms from the ontology using the HST approach. Suppose that we have computed a minimal label set M 0 , and that ∈ M 0 . If we remove all the axioms in the ontology labeled with , and compute a new minimal label set M 1 of a MinA of this sub-ontology, then M 1 does not contain , and thus M 0 = M 1 . By iterating this procedure, we could compute all minimal label sets, and hence the labels of all MinAs. However, since our goal is to compute the supremum of these labels, the algorithm can be optimized by avoiding the computation of MinAs whose labels will have no impact on the final result. Based on this we can actually do better than just removing the axioms with label : instead, all axioms with labels ≤ can be removed. For an element ∈ L and an ontology T , T ≤ denotes the sub-ontology obtained from T by removing all axioms whose labels are ≤ . Now, assume that we have computed the minimal label set M 0 , and that M 1 = M 0 is the minimal label set of the MinA S 1 . If S 1 is not contained in T ≤ for all ∈ M 0 , then S 1 contains an axiom with label for every ∈ M 0 . Consequently, m∈M 1 m = λ S 1 ≤ m∈M 1 m, and thus M 1 need not be computed. Algorithm 2 describes our method for computing the boundary using a variant of the HST algorithm that is based on this idea. In the procedure hst-boundary, three global variables are declared: C and H, initialized with ∅, and ν. The variable C stores all the minimal label sets computed so far, while each element of H is a set of labels such that, when all the axioms using any of these labels are removed from the ontology, the consequence does not follow anymore; the variable ν stores the supremum of the labels of all the elements in C and ultimately corresponds to the boundary that the method computes. The algorithm starts by computing a first minimal label set M, which is used to label the root of a tree. For each element of M, a branch is created by calling the procedure expand-hst.
The procedure expand-hst implements the ideas of HST construction for pinpointing [9,19] with additional optimizations that help reduce the search space as well as the number of calls to min-lab. First notice that each M ∈ C is a minimal label set, and hence the infimum of its elements corresponds to the label of some MinA for α. Thus, ν is the supremum of the labels of a set of MinAs for α. If this is not yet the boundary, then there must exist another MinA S whose label is not smaller or equal to ν. This in particular means that no element of S may have a label smaller or equal to ν, as the label of S is the infimum of the labels of the axioms in it. When searching for this new MinA we can then exclude all axioms having a label ≤ ν, as done in Line 6 of expand-hst. Every time we expand a node, we extend the set H, which stores the labels that have been removed on the path in the tree to reach the current node. If we reach normal termination, it means that the consequence does not follow anymore from the reduced ontology. Thus, any H stored in H is such that, if all the axioms having a label smaller or equal to an element in H are removed from T , then α does not follow anymore. Lines 1 to 4 of expand-hst are used to reduce the number of calls to the subroutine min-lab and the total search space. We describe them now in more detail. The first optimization, early path termination, prunes the tree once we know that no new information can be obtained from further expansion. There are two conditions that trigger this optimization. The first one tries to decide whether T ≤ν |= α without executing the decision procedure. As said before, we know that for each H ∈ H, if all labels smaller or equal to any in H are removed, then the consequence does not follow. Hence, if the current list of removal labels H contains a set H ∈ H we know that enough labels have been removed to make sure that the consequence does not follow. It is actually enough to test whether {h ∈ H | h ≤ ν} ⊆ H since the consequence test we need to perform is whether T ≤ν |= α. The second condition for early path termination asks for a prefix-path P of H such that P = H. If we consider H as a list of elements, then a prefix-path is obtained by removing a final portion of this list. The idea is that, if at some point we have noticed that we have removed the same axioms as in a previous portion of the search, we know that all possibilities that arise from that search have already been tested before, and hence it is unnecessary to repeat the work. Hence we can prune the tree at that point. The second optimization avoids a call to min-lab by reusing a previously computed minimal label set. Notice that our only requirement on min-lab that it produces a minimal label set. Hence, any minimal label set for the ontology obtained after removing all labels smaller or equal to any h ∈ H or to ν would work. The MinLab reuse optimization checks whether there is such a previously computed minimal label set. If this is the case, it uses this set instead of computing a new one by calling min-lab. Before showing that the algorithm is correct, we illustrate how it works by a small example.
Example 12 Consider the lattice in Figure 1, and let T be the (Description Logic) ontology consisting of the following five axioms: where each axiom t i is labeled with lab(t i ) = i . There are four MinAs for the subsumption relation A B w.r.t. T , namely {t 1 , t 2 , t 3 }, {t 1 , t 2 , t 5 }, {t 1 , t 3 , t 4 }, and {t 1 , t 4 , t 5 }. All the elements of the labeling lattice except 1 and 3 are join prime relative to L lab . Figure 2 shows a possible run of the hst-boundary algorithm. The algorithm first calls the routine min-lab (T , A B). Consider that the for loop of min-lab is executed using the labels 1 , . . . , 5 in that order. Thus, we try first to remove t 1 labeled with 1 . We see that T − 1 |= A B; hence t 1 is not removed from T , and M L is updated to M L = { 1 }. We then see that T − 2 |= A B, and thus t 2 is removed from T . Again, T − 3 |= A B, so t 3 is removed from T . At this point, T = {t 1 , t 4 , t 5 }. We test then whether T − 4 |= A B and receive a negative answer; thus, The minimal label set { 4 , 5 }, is used as the root node n 0 , setting the value of ν = 4 ⊗ 5 = 0 . We then create the first branch on the left by removing all the axioms with a label ≤ 4 , which is only t 4 , and computing a new minimal label set. Assume, for the sake of the example, that min-lab returns the minimal label set { 2 , 3 }, and ν is accordingly changed to 4 . When we expand the tree from this node, by removing all the axioms below 2 (left branch) or 3 (right branch), the subsumption relation A B does not follow any more, and hence we have a normal termination, adding the sets { 4 , 2 } and { 4 , 3 } to H. We then create the second branch from the root, by removing the elements below 5 . We see that the previously computed minimal axiom set of node n 1 works also as a minimal axiom set in this case, and hence it can be reused (MinLab reuse), represented as an underlined set. The algorithm continues now by calling expand-hst(T ≤ 2 , A B, { 5 , 2 }). At this point, we detect that there is H = { 4 , 2 } satisfying the first condition of early path termination (recall that ν = 4 ), and hence the expansion of that branch at that point. Analogously, we obtain an early path termination on the second expansion branch of the node n 4 . The algorithm then outputs ν = 4 , which can be easily verified to be a boundary.
Theorem 13 Let T and α be such that T |= α. Then Algorithm 2 computes the margin-based boundary of α.
Proof. Let η be the margin-based boundary which, by Lemma 7, must exist. Notice first that the procedure expand-hst keeps as invariant that ν ≤ η as whenever ν is modified, it is only to join it with the infimum of a minimal label set (Line 9), which by definition is the label of a MinA and, by Theorem 9, is ≤ η. Thus, when the algorithm terminates, we have that ν ≤ η. Assume now that ν = η. Then, there must exist a MinA S such that λ S ≤ ν; in particular, this implies that none of the axioms in S has a label ≤ ν and thus S ⊆ T ≤ν . Let M 0 be the minimal label set obtained in Line 2 of hst-boundary. There must then be a h 0 ∈ M 0 such that S ⊆ T ≤h 0 ; otherwise, λ S ≤ ∈M 0 ≤ ν. There will then be a call to the process expand-hst with parameters T ≤h 0 , α, and {h 0 }. Suppose first that early path termination is not triggered. A minimal label set M 1 is then obtained, either by MinLab reuse (Line 4) or by a call to min-lab (Line 6). As before, there is a h 1 ∈ M 1 with S ⊆ (T ≤h 0 ) ≤h 1 . Additionally, since T ≤h 0 does not contain any axiom labeled with h 0 , we know h 0 / ∈ M 1 . While iterating this algorithm, we can find a sequence of minimal label sets M 0 , M 1 , . . . , M n and labels h 0 , h 1 , . . . , h n such that (i) h i ∈ M i , (ii) S ⊆ T ≤h i , and (iii) h i / ∈ M j for all i, j, 1 ≤ i < j ≤ n. In particular, this means that the M i s are all different, and since there are only finitely many minimal label sets, this process must terminate. Let M n be the last set found this way. Then, when expand-hst is called with R := (((T ≤h 0 ) ≤h 1 ) ... ) ≤hn , α and H = {h 1 , . . . , h n }, no new minimal label set is found. Suppose first that this is due to a normal termination. Then, R ≤ν |= α. But that contradicts the fact that S is a MinA for α since S ⊆ R ≤ν . Hence, it must have finished by early termination.
There are two possible causes for early termination. Suppose first that there is a H ∈ H such that {h ∈ H | h ≤ ν} ⊆ H. Then it is also the case that, for every h ∈ H , S ⊆ T ≤h : if h ∈ H, then R ⊆ T ≤h ; otherwise, h ≤ ν and hence T ≤ν ⊆ T ≤h . Let R := {t ∈ T | there is no h ∈ H with lab(t) ≤ h}.
As H ∈ H, it was added after a normal termination; thus, α does not follow from R ≤ν . As S ⊆ R ≤ν , we obtain once again a contradiction.
The second cause for early path termination is the existence of a prefixpath P with {h ∈ P | h ≤ ν} = H. This means that in a previously explored path we had concluded that R ≤ν |= α, and a new minimal label set M n+1 was found. As in the beginning of this proof, we can then compute sets M n+1 , . . . , M m and h n+1 , . . . , h m (n < m) such that S ⊆ T ≤h i for all i, 1 ≤ i ≤ m and the M i s are all different. Hence this process terminates. As before, the cause of termination cannot be normal termination, nor the first condition for early path termination. Thus, there must exist a new H ∈ H that fulfills the second condition for early termination. As H is a finite set, and each of its elements is itself a finite list, this process also terminates. When that final point is reached, there are no further causes of termination that do not lead to a contradiction, which means that our original assumption that ν = η cannot be true. Hence, ν is the margin-based boundary of α.

Binary Search for Linear Ordering
In this subsection, we assume that the labeling lattice (L, ≤) is a linear order, i.e., for any two elements 1 , 2 of L we have 1 ≤ 2 or 2 ≤ 1 .

Lemma 14
Let T and α be such that T |= α. Then the unique boundary of α is the maximal element µ of L lab with T µ |= α.
Proof. Let µ be the maximal element of L lab with T µ |= α. Such a maximal element exists since L lab is finite. Obviously, ≤ µ implies T ⊇ T µ , and thus T µ |= α yields T |= α. Conversely, assume that T |= α. Then the fact that µ is maximal with this property together with the fact that ≤ is a linear order implies ≤ µ. Thus, µ is a boundary.
A direct way for computing the boundary in this restricted setting thus consists of testing, for every element in ∈ L lab , in order (either increasing or h := pred(m) 10: return ν := decreasing) whether T |= α until the desired maximal element is found. This process requires in the worst case n := |L lab | iterations. This can be improved using binary search, which requires a logaritmic number of steps measured in n. Algorithm 3 describes the binary search algorithm. In the description of the algorithm, the following abbreviations have been used: 0 lab and 1 lab represent the minimal and the maximal elements of L lab , respectively; for 1 ≤ 2 ∈ L lab , δ( 1 , 2 ) := |{ ∈ L lab | 1 < ≤ 2 }| is the distance function in L lab and for a given ∈ L lab , pred( ) is the maximal element ∈ L lab such that < .
The variables and h are used to keep track of the relevant search space. At every iteration of the while loop, the boundary is between and h. At the beginning these values are set to the minimum and maximum of L lab and are later modified as follows: we first find the middle element m of the search space; i.e., an element whose distance to differs in at most one with the distance to h. We then test whether T m |= α. If that is the case, we know that the boundary must be larger or equal to m, and hence the lower bound is updated to the value of m. Otherwise, we know that the boundary is strictly smaller than m as m itself cannot be one; hence, the higher bound h is updated to the maximal element of L lab that is smaller than m : pred(m). This process terminates when the search space has been reduced to a single point, which must be the boundary.

Test data and test environment
We test on a PC with 2GB RAM and Intel Core Duo CPU 3.16GHz. We implemented all approaches in Java and used Java 1.6, CEL 1.0, Pellet 2.0.0-rc5 and OWL API trunk revision 1150. The boundary computation with full axiom pinpointing (FP in the following) uses log-extract-mina() (Alg. 2 from [6], which is identical to Alg. 8 from [19]) and the HST based hst-extractall-minas() (Alg. 9 from [19]). The set of extracted MinAs is then used to calculate the label of the consequence. We break after 10 found MinAs in order to limit the runtime, so there might be non-final label results. The boundary computation with label-optimized axiom pinpointing (LP in the following) with min-lab() and hst-boundary() are implementations of Alg. 1 and Alg. 2 of the present paper. The boundary computation with binary search for linear ordering (BS in the following) implements Alg. 3 of the present paper.
Although we focus on comparing the efficiency of the presented algorithms, and not on practical applications of these algorithms, we have tried to use inputs that are closely related to ones encountered in applications. The two labeling lattices (L d , ≤ d ) and (L l , ≤ l ) are similar to ones encountered in real-world applications. The labeling lattice (L d , ≤ d ) was already introduced in Fig. 1. Lattices of this structure (where the elements correspond to hierarchically organized user roles) can be obtained from a real-world access matrix with the methodology presented in [7]. The set of elements of L d that are allowed to represent user roles if all elements of the lattice can be used as axiom labels are the elements that are join prime relative to the whole lattice, i.e., 0 , 2 , 4 , 5 . The labeling lattice (L l , ≤ l ) is a linear order with 6 elements L l = L d = { 0 , . . . , 5 } with ≤ l := {( n , n+1 ) | n , n+1 ∈ L l ∧ 0 ≤ n ≤ 5}, which could represent an order of trust values as in [16] or dates from a revision history.
We used the two ontologies O Snomed and O Funct with different expressivity and types of consequences for our experiments. The Systematized Nomenclature of Medicine, Clinical Terms (Snomed ct) is a comprehensive medical and clinical ontology which is built using the Description Logic (DL) EL+. Our version O Snomed is the January/2005 release of the DL version, which contains 379,691 concept names, 62 object property names, and 379,704 axioms. Since more than five million subsumptions are consequences of O Snomed , testing all of them was not feasible and we used the same sample subset as described in [6]  O Funct is an OWL ontology for functional description of mechanical engineering solutions presented in [8]. It has 115 concept names, 47 object property names, 16 data property names, 545 individual names, 3,176 axioms, and the DL expressivity used in the ontology is SHOIN (D). Its 716 consequences are 12 subsumption and 704 instance relationships (class assertions).
To obtain labeled ontologies, axioms in both labeled ontologies received a random label assignment of elements from L l = L d . As black-box subsumption and instance reasoner we used the reasoner Pellet since it can deal with the expressivity of both ontologies. For the expressive DL SHOIN (D) it uses a tableau-based algorithm and for EL+ it uses an optimized classifier for the OWL 2 EL profile, which is based on the algorithm described in [1].

Results
The results for O Snomed and (L d , ≤ d ) are given in the upper part of Tab. 1. LP computed all labels, but since we limit FP to <10 MinAs, only 21,001 subsumptions have a final label, which is guaranteed to be equal to the boundary. The 6,476 remaining subsumptions (31%) have a non-final label which might be too low in the lattice since there might be further MinAs providing a higher label.  is about 34 times faster than FP, but again this is only for the subset of subsumptions which were finished by FP. An estimation for the time needed to label all of the more than 5 million subsumptions in O Snomed with LP would be approximately 6 hours. The final labels of FP and LP (i.e., the computed boundaries) were identical, the non-final labels of FP were identical to the final labels of LP (i.e., the boundaries) in 6,376 of the 6,476 cases (98%), i.e., in most cases the missing MinAs would not have changed the already computed label. Table 2 provides results for the subsumptions with more than 10 MinAs: FP took 2.5 hours on this set without final results (since it stopped after 10 MinAs), whereas LP took 0.6% of that time and returned final results after 58 seconds. We started a test series limiting runs of FP to <30MinAs, which did not terminate after 90 hours, with 1,572 labels successfully computed and 30 subsumptions skipped since they had ≥30MinAs. Interestingly, in both consequence sets, LP can rarely take advantage of the optimizations early termination and MinA reuse, which might be due to the simple structure of the lattice.
For O Funct the comparison between FP and LP is given in the lower part of Tables 1 and 2. Again, the computation of FP was restricted to <10 MinAs. This time, only 363 out of 409 (88%) non-final labels of FP were equal to the final labels of LP (i.e., the boundary). Although the ontology is quite small, LP again behaves much better than FP. The reason could be that in this ontology consequences frequently have a large set of MinAs. From Tables 1 and 2 and the histogram in Fig. 3