Safe expressions and domain calculus
The domain relational calculus (variables range over attribute values, atoms like R(x, y)), how it differs from the tuple calculus, what makes a calculus expression safe (its answer is finite and does not depend on the domain, only on the values in the database and the query), unsafe expressions and why, a syntactic test that is sufficient but not necessary, Codd's theorem (safe tuple calculus, safe domain calculus and relational algebra have the same power), and the translation of the algebra operators into safe formulas.
Why it exists
The tuple relational calculus (tuple calculus) lets a variable stand for a whole tuple. The domain relational calculus lets a variable stand for a single value of an attribute, so a query lists the values it wants: . This is the form used by Query-By-Example. Both calculi share a danger: a formula can describe an answer that is infinite or that changes when the set of possible values changes, for example "all values that are not in ". Only safe expressions are real queries. GATE asks: which of these calculus expressions is safe, which languages have the same expressive power, write or translate a calculus query.
Prerequisites
You need the tuple relational calculus (tuple calculus) and relational algebra (relational algebra), including division.
Precise definitions
Domain calculus query. A query has the form
where are domain variables and is a formula with exactly these free variables. The atoms of a formula are
- , written in some books: the values (variables or constants), taken in the order of the attributes of , form a tuple of ;
- or with .
Formulas are built with , , , and the quantifiers , . The answer is the set of all value tuples that make true.
Active domain. The set of all values that occur in some tuple of the database or as a constant of the query.
Safe (domain independent) expression. An expression is safe if its answer is finite for every database and depends only on the database and the constants of the query, not on which other values the attribute domains contain. Equivalent test: the answer is the same when the variables range over the active domain and when they range over a larger domain. The textbook (Silberschatz et al.) states it as: every value in the answer comes from (the values in and in the relations mentioned in ), and every existential and universal subformula is decided by values of alone (quoted).
Codd's theorem (quoted). Relational algebra, the safe tuple relational calculus and the safe domain relational calculus have the same expressive power.
How it works
The same query in the three languages
The database: with five employees and with four departments. In the formulas the letters stand for the ename, did, dname and floor.
One query in three languages: start
Computed by a script, not typed| query | domain calculus | relational algebra | answer |
|---|---|---|---|
| names of employees whose department is on floor 2 | |||
| departments with no employee | |||
| employees who work in every department on floor 3 |
Step 0
Database: EMP(ename, did) = {(Asha, 1), (Ben, 2), (Chen, 1), (Dev, 3), (Esha, 2)}; DEPT(did, dname, floor) = {(1, Sales, 2), (2, Tech, 3), (3, Ops, 2), (4, Legal, 1)}. In the formulas the variables n, d, m, f stand for ename, did, dname and floor.
For the first query, the SQL used in the check is
SELECT DISTINCT ename
FROM EMP e JOIN DEPT d ON e.did = d.did
WHERE d.floor = 2(it was run in SQLite and the answer compared with the formula, the algebra expression and the tuple calculus query by the generator that built the table). Notice the shape of each calculus formula: a positive atom introduces every variable ( binds and ; binds ), and negation and the universal quantifier only filter.
Algebra written as safe formulas
Every operator of relational algebra is a safe formula; the table checks six of them on a small database:
Relational algebra written as safe domain calculus: start
Computed by a script, not typed| operator | domain calculus formula | relational algebra | answer |
|---|---|---|---|
| selection | |||
| projection | |||
| join | |||
| union | |||
| difference | |||
| division |
Step 0
Database: R = {(1, 2), (2, 3), (3, 3), (1, 3)} with columns a, b; S = {(2, 5), (3, 6), (3, 2)} with columns b, c; T = {2, 3}. Union, difference and division need relations of matching shape; in the formulas, ¬ always appears next to a positive atom that binds the same variables.
Selection and projection are an atom with a condition and an ; the join is ; union is of two atoms with the same variables; difference is an atom and the negation of another atom over the same variables; division is the universal quantifier in the form "for all : if is in then ", with the premise restricting .
Unsafe expressions and the test
Safe and unsafe domain calculus expressions: start
Computed by a script, not typed| formula | syntactically safe? | answer over the active domain | answer over the domain plus 3 new values | domain independent (300 random databases)? |
|---|---|---|---|---|
| Q1: { <x, y> | R(x, y) ∧ x < y } | ||||
| Q2: { <x> | ∃y (R(x, y)) } | ||||
| Q3: { <x> | ¬R(x, x) } | ||||
| Q4: { <x, y> | x < y } | ||||
| Q5: { <x> | ∃y (R(x, y) ∨ y = 7) } | ||||
| Q6: { <x> | ∀y (R(x, y)) } | ||||
| Q7: { <x> | ∃y (R(x, y)) ∧ ∀z (¬R(x, z) ∨ z ≥ x) } | ||||
| Q8: { <x> | ∃y (R(x, y)) ∧ ¬S(x) } | ||||
| Q9: { <x> | ∃y (R(x, y)) ∨ S(x) } | ||||
| Q10: { <x> | ∃y (R(x, y)) ∨ ¬S(x) } | ||||
| Q11: { <x> | ∃y (x ≠ y) } |
Step 0
Database D: R = {(1, 2), (2, 3), (3, 3)}, S = {2, 3}. A query is safe when its answer does not depend on which extra values the domain contains. The syntactic test (bind every result variable and every quantified variable by a positive relation atom; a universal quantifier must be written as 'atom implies condition') is sufficient but not necessary; deciding domain independence in general is impossible by any algorithm (quoted).
The first column is a syntactic test that I use on this site (it is a standard idea, called range restriction, but the exact rules are mine): every free variable of the answer, and every variable under a quantifier, must be bound by a positive relation atom in the same conjunction (equalities with constants or with a bound variable also bind), a disjunction binds only the variables bound in both branches, and a universal quantifier must have the form "for all (an atom that restricts implies a condition)". A formula that passes is safe. The test is sufficient but not necessary: is safe (it means ) but fails the test. In general, deciding whether a calculus expression is domain independent is undecidable (quoted).
Causes of unsafety seen in the table:
- Negation without a positive atom (: ): every value not related by is an answer; the answer grows with the domain.
- A comparison alone (: , : ): infinitely many pairs, or a value is accepted only if the domain happens to have another value.
- A disjunction whose branches bind different variables (, ): in one branch is unrestricted.
- A universal quantifier without a restricting premise (: ): its truth depends on every value of the domain. On the database of the table both answers happen to be empty, but on a database such as the answer over the active domain is and the answer over a larger domain is empty. Safety is a property of the formula for all databases, not of one.
Worked examples
EX 1Read a domain calculus query
Easyasks for the names of employees whose department appears in with floor . Algebra: . Answer on the table's database: Asha, Chen, Dev.
EX 2Is it safe?
Easy: no positive atom binds ; the answer contains every value of the domain not related to itself, which changes when the domain grows: unsafe. : the positive atom binds both variables and the negation only filters: safe; it is .
EX 3Division as a universal quantifier
Medium"Employees who work in every department on floor 3" is . The first conjunct binds ; the premise of the implication binds and . In algebra it is the division . Answer: Ben, Esha (only one department is on floor 3).
EX 4Why the quantifier needs a restricting premise
Mediumsays that is related to every value. Over the active domain this is a finite check, but the formula is judged for all possible domains: add one new value to the domain and no is related to , so the answer becomes empty. The fix is to say which values are meant: with a relation that lists them.
EX 5Typical questions
GATE level(a) "Which of these calculus expressions is safe?" Check each variable against a positive atom; reject lone negations, lone comparisons and unbalanced disjunctions. (b) "Which languages have the same expressive power: relational algebra, safe tuple calculus, safe domain calculus?" All three. (c) "Is safe?" No. (d) "The domain calculus differs from the tuple calculus in that its variables range over ..." single attribute values rather than tuples. (e) "Can every SQL query be expressed in the safe calculus?" No: aggregates and arithmetic go beyond it; the basic select-project-join, union, difference and division queries can.
Cheat box
Cheat box
- Domain calculus: , variables are values; atoms and comparisons.
- Safe = finite answer, same over the active domain and over any larger domain.
- Unsafe: lone , lone comparison , disjunction binding different variables, without a restricting premise.
- Safe pattern: every answer variable and every quantified variable bound by a positive atom; .
- Codd: relational algebra safe tuple calculus safe domain calculus.
- Domain independence is undecidable in general; the syntactic test is sufficient, not necessary.
Traps and GATE patterns
Connections
Builds on
Unlocks
Nothing built depends on this yet.
Across subjects
No cross-subject links yet.
The domain calculus is the value-based twin of the tuple calculus and has the same relation to relational algebra (Codd's theorem). The division formula connects to the division operator and the "for all" queries of advanced algebra; in SQL, universal quantification is written with a double NOT EXISTS (nested queries).
PYQs
3 previous year questions from your book. I re-solved each one myself (1 by running or simulating, 2 by reasoning only); the book's key is shown next to my answer. All PYQs
Consider a database that has the relation schemas
EMP(Empld,
EmpName,
Deptld)
and
DEPT(DeptName, Deptld). Note that the Deptldcan be
permitted to a NULL in the relation EMP. Consider the
following queries on the database expressed in tuple
relational calculus.
(I) {t|∃u ε EMP(t[EmpName) = u[EmpName] Λ ∀
∨ε DEPT(t[Deptld] ≠ V[Deptld]))}
(II) {t|∃u ε EMP(t[EmpName) = u[EmpName] Λ ∃∨ ε
DEPT(t[Deptld] ≠V[Deptld]))}
(III) {t|∃u ε EMP(t[EmpNmae) = u[EmpName] Λ ∃∨ ε
DEPT(t[Deptld] =V[Deptld]))}
Which of the above queries are safe?- (a)I and II only
- (b)I and III only
- (c)II and III only
- (d)I, II and III.
Consider the following relation schema
Students(rollno:integer, sname: string)
Courses(courseno:integer,cname: string)
Registration (rollno: integer, courseno: integer, percent:
real)
Which of the following queries are equivalent to this query
in English?
"Find the distinct names of all students who score more
than 90% in the course numbered 107".
(I) SELECT DISTINCT S.sname
FROM Students as S, Registration as R
WHERE R.rollno = S. rollno AND R.courseno = 107 AND
R.percent> 90
(II) πsname(σcourseno= 107 Λ percent> 90 (Registration ⋈Students))
(III) {T|∃S ε Students, ∃R ε Registration (S.rollno =
R.rollno Λ R.courseno = 107 Λ R.percent> 90 Λ T.sname
= S.sname)}
(IV) {<SN>|∃SR∃RP(<SR,SN>∈Students∧<SR,107,RP>∈
Registration∧ RP>90)}- (a)I, II, III and IV
- (b)I, II and III only
- (c)I, II and IV only
- (d)II, III and IV only
Which of the following relational query languages have the same expressive power? 1. Relational algebra 2. Tuple relational calculus restricted to safe Expressions 3. Domain relational calculus restricted to safe expressions
- (a)II and III only
- (b)I and II only
- (c)I and III only
- (d)I, II and III
Self-check
Question 1
Why is unsafe?
Show answerHide
It returns every value of the domain that is not in . The answer depends on the domain and can be infinite.
Question 2
Write "first components of that are not in " in the domain calculus.
Show answerHide
: the first conjunct binds , the negation filters. Safe.
Question 3
Which languages are equally expressive: relational algebra, safe tuple calculus, safe domain calculus, SQL with aggregates?
Show answerHide
The first three. SQL with aggregates and arithmetic is stronger.
Question 4
Is safe?
Show answerHide
Yes: is bound by an atom in each branch of the disjunction.
Question 5
Is the syntactic test of this page an exact test of safety?
Show answerHide
No. It never accepts an unsafe formula, but it rejects some safe ones such as .
Revision card
One-screen revision
- Domain calculus: variables range over values; .
- Safe: finite answer, independent of the domain beyond the active domain.
- Bind every answer variable and quantified variable by a positive atom; .
- Unsafe: lone negation, lone comparison, unbalanced disjunction, without premise.
- Codd: algebra safe tuple calculus safe domain calculus (not SQL with aggregates).
References
- ·Silberschatz, Korth, Sudarshan, Database System Concepts (7th edition), the section on the domain relational calculus and the sections on safety of expressions (in recent editions in the online or appendix chapter on relational calculus)
- ·Elmasri, Navathe, Fundamentals of Database Systems (7th edition), Section 8.7 (the domain relational calculus) and the discussion of safe expressions in Section 8.6
- ·Ramakrishnan, Gehrke, Database Management Systems (3rd edition), Section 4.3 (relational calculus), including the domain relational calculus and expressive power
Verification
scripts/dc_lib.py (an evaluator of calculus formulas over a finite domain) and scripts/enum-checks/db_domain_check.py: the three named queries (floor 2, no employees, every department on floor 3) give the same answer in the domain calculus, relational algebra, SQL (SQLite) and the tuple calculus on the table's database and on 150 random databases; the six algebra operators written as safe formulas equal hand-written algebra and SQLite on 300 random databases; the eleven formulas of the safety table: the answer over the active domain and over the domain enlarged by new values (several kinds of extra values) was recomputed, and every formula called unsafe has a database on which the answer changes; the syntactic range-restriction test (mine, not a textbook definition) never accepts a formula that is not domain independent on 4000 random formulas with 120 random databases each (1247 accepted), and it rejects some domain independent formulas (not not R(x, x)), so it is sufficient and not necessary. The tests in tests/db-domain-traces.test.ts recompute the answers of the safety table in TypeScript. Domain independence (and so safety) is undecidable in general (Di Paola; quoted, needs verification), and Codd's theorem is quoted. The textbook definition of a safe tuple calculus expression (every value of the result belongs to dom(P)) is quoted from memory of Silberschatz et al. (needs verification). NULLs are not modelled. The mapped GATE question on safe tuple calculus queries (Databases 3.10) is discussed in the traps: its key is not what this page's definition gives (needs verification against the official key). Textbook chapter references are from memory. The independent second pass has not been run, so the page stays draft. SECOND PASS (2026-11-02, done by the assistant, not a human check): every Self-check question was solved before the printed answer was read and all agreed; the definitions, worked examples, cheat box and traps were read claim by claim and re-derived against the textbook definitions and the sample database. No defect found. Status raised to self-checked; verified needs a textbook or human check.
last verified: never
My notes (saved in this browser)