G27
Self-checkedTier 2 10 min readdbms.domain-calculus-safety

Safe expressions and domain calculus

The domain relational calculus (variables range over attribute values, atoms like R(x, y)), how it differs from the tuple calculus, what makes a calculus expression safe (its answer is finite and does not depend on the domain, only on the values in the database and the query), unsafe expressions and why, a syntactic test that is sufficient but not necessary, Codd's theorem (safe tuple calculus, safe domain calculus and relational algebra have the same power), and the translation of the algebra operators into safe formulas.

Why it exists

The tuple relational calculus (tuple calculus) lets a variable stand for a whole tuple. The domain relational calculus lets a variable stand for a single value of an attribute, so a query lists the values it wants: {⟨n⟩∣∃d  (EMP(n,d)∧… )}\{\langle n \rangle \mid \exists d\; (\text{EMP}(n, d) \wedge \dots)\}. This is the form used by Query-By-Example. Both calculi share a danger: a formula can describe an answer that is infinite or that changes when the set of possible values changes, for example "all values that are not in RR". Only safe expressions are real queries. GATE asks: which of these calculus expressions is safe, which languages have the same expressive power, write or translate a calculus query.

Prerequisites

You need the tuple relational calculus (tuple calculus) and relational algebra (relational algebra), including division.

Precise definitions

Domain calculus query. A query has the form

{ ⟨x1,…,xn⟩∣P(x1,…,xn) }\{\, \langle x_1, \dots, x_n \rangle \mid P(x_1, \dots, x_n) \,\}

where x1,…,xnx_1, \dots, x_n are domain variables and PP is a formula with exactly these free variables. The atoms of a formula are

  • R(t1,…,tk)R(t_1, \dots, t_k), written ⟨t1,…,tk⟩∈R\langle t_1, \dots, t_k \rangle \in R in some books: the values t1,…,tkt_1, \dots, t_k (variables or constants), taken in the order of the attributes of RR, form a tuple of RR;
  • x  θ  yx \; \theta \; y or x  θ  cx \; \theta \; c with θ∈{=,≠,<,≤,>,≥}\theta \in \{=, \neq, <, \le, >, \ge\}.

Formulas are built with ¬\neg, ∧\wedge, ∨\vee, ⇒\Rightarrow and the quantifiers ∃x\exists x, ∀x\forall x. The answer is the set of all value tuples that make PP true.

Active domain. The set of all values that occur in some tuple of the database or as a constant of the query.

Safe (domain independent) expression. An expression is safe if its answer is finite for every database and depends only on the database and the constants of the query, not on which other values the attribute domains contain. Equivalent test: the answer is the same when the variables range over the active domain and when they range over a larger domain. The textbook (Silberschatz et al.) states it as: every value in the answer comes from dom(P)\text{dom}(P) (the values in PP and in the relations mentioned in PP), and every existential and universal subformula is decided by values of dom(P)\text{dom}(P) alone (quoted).

Codd's theorem (quoted). Relational algebra, the safe tuple relational calculus and the safe domain relational calculus have the same expressive power.

How it works

The same query in the three languages

The database: EMP(ename,did)\text{EMP}(\text{ename}, \text{did}) with five employees and DEPT(did,dname,floor)\text{DEPT}(\text{did}, \text{dname}, \text{floor}) with four departments. In the formulas the letters n,d,m,fn, d, m, f stand for the ename, did, dname and floor.

One query in three languages: start

Computed by a script, not typed
querydomain calculusrelational algebraanswer
names of employees whose department is on floor 2
departments with no employee
employees who work in every department on floor 3

Step 0

Database: EMP(ename, did) = {(Asha, 1), (Ben, 2), (Chen, 1), (Dev, 3), (Esha, 2)}; DEPT(did, dname, floor) = {(1, Sales, 2), (2, Tech, 3), (3, Ops, 2), (4, Legal, 1)}. In the formulas the variables n, d, m, f stand for ename, did, dname and floor.

0 / 3
computed by script: formulas are evaluated by scripts/dc_lib.py and compared with SQLite. python3 scripts/gen-db6-traces.py

For the first query, the SQL used in the check is

SELECT DISTINCT ename
FROM EMP e JOIN DEPT d ON e.did = d.did
WHERE d.floor = 2

(it was run in SQLite and the answer compared with the formula, the algebra expression and the tuple calculus query by the generator that built the table). Notice the shape of each calculus formula: a positive atom introduces every variable (EMP(n,d)\text{EMP}(n, d) binds nn and dd; DEPT(d,m,2)\text{DEPT}(d, m, 2) binds mm), and negation and the universal quantifier only filter.

Algebra written as safe formulas

Every operator of relational algebra is a safe formula; the table checks six of them on a small database:

Relational algebra written as safe domain calculus: start

Computed by a script, not typed
operatordomain calculus formularelational algebraanswer
selection
projection
join
union
difference
division

Step 0

Database: R = {(1, 2), (2, 3), (3, 3), (1, 3)} with columns a, b; S = {(2, 5), (3, 6), (3, 2)} with columns b, c; T = {2, 3}. Union, difference and division need relations of matching shape; in the formulas, ¬ always appears next to a positive atom that binds the same variables.

0 / 6
computed by script: formulas are evaluated by scripts/dc_lib.py and compared with SQLite. python3 scripts/gen-db6-traces.py

Selection and projection are an atom with a condition and an ∃\exists; the join is ∃y (R(x,y)∧S(y,z))\exists y\,(R(x, y) \wedge S(y, z)); union is ∨\vee of two atoms with the same variables; difference is an atom and the negation of another atom over the same variables; division is the universal quantifier in the form "for all zz: if zz is in TT then R(x,z)R(x, z)", with the premise restricting zz.

Unsafe expressions and the test

Safe and unsafe domain calculus expressions: start

Computed by a script, not typed
formulasyntactically safe?answer over the active domainanswer over the domain plus 3 new valuesdomain independent (300 random databases)?
Q1: { <x, y> | R(x, y) ∧ x < y }
Q2: { <x> | ∃y (R(x, y)) }
Q3: { <x> | ¬R(x, x) }
Q4: { <x, y> | x < y }
Q5: { <x> | ∃y (R(x, y) ∨ y = 7) }
Q6: { <x> | ∀y (R(x, y)) }
Q7: { <x> | ∃y (R(x, y)) ∧ ∀z (¬R(x, z) ∨ z ≥ x) }
Q8: { <x> | ∃y (R(x, y)) ∧ ¬S(x) }
Q9: { <x> | ∃y (R(x, y)) ∨ S(x) }
Q10: { <x> | ∃y (R(x, y)) ∨ ¬S(x) }
Q11: { <x> | ∃y (x ≠ y) }

Step 0

Database D: R = {(1, 2), (2, 3), (3, 3)}, S = {2, 3}. A query is safe when its answer does not depend on which extra values the domain contains. The syntactic test (bind every result variable and every quantified variable by a positive relation atom; a universal quantifier must be written as 'atom implies condition') is sufficient but not necessary; deciding domain independence in general is impossible by any algorithm (quoted).

0 / 11
computed by script: formulas are evaluated by scripts/dc_lib.py and compared with SQLite. python3 scripts/gen-db6-traces.py

The first column is a syntactic test that I use on this site (it is a standard idea, called range restriction, but the exact rules are mine): every free variable of the answer, and every variable under a quantifier, must be bound by a positive relation atom in the same conjunction (equalities with constants or with a bound variable also bind), a disjunction binds only the variables bound in both branches, and a universal quantifier must have the form "for all vv (an atom that restricts vv implies a condition)". A formula that passes is safe. The test is sufficient but not necessary: ¬¬R(x,x)\neg\neg R(x, x) is safe (it means R(x,x)R(x, x)) but fails the test. In general, deciding whether a calculus expression is domain independent is undecidable (quoted).

Causes of unsafety seen in the table:

  • Negation without a positive atom (Q3Q3: ¬R(x,x)\neg R(x, x)): every value not related by RR is an answer; the answer grows with the domain.
  • A comparison alone (Q4Q4: x<yx < y, Q11Q11: ∃y (x≠y)\exists y\,(x \ne y)): infinitely many pairs, or a value xx is accepted only if the domain happens to have another value.
  • A disjunction whose branches bind different variables (Q5Q5, Q10Q10): in one branch xx is unrestricted.
  • A universal quantifier without a restricting premise (Q6Q6: ∀y R(x,y)\forall y\, R(x, y)): its truth depends on every value of the domain. On the database of the table both answers happen to be empty, but on a database such as R={(1,1)}R = \{(1, 1)\} the answer over the active domain {1}\{1\} is {1}\{1\} and the answer over a larger domain is empty. Safety is a property of the formula for all databases, not of one.

Worked examples

EX 1Read a domain calculus query

Easy

{⟨n⟩∣∃d ∃m (EMP(n,d)∧DEPT(d,m,2))}\{\langle n \rangle \mid \exists d\,\exists m\,(\text{EMP}(n, d) \wedge \text{DEPT}(d, m, 2))\} asks for the names nn of employees whose department dd appears in DEPT\text{DEPT} with floor 22. Algebra: πename(EMP⋈σfloor=2(DEPT))\pi_{ename}(\text{EMP} \bowtie \sigma_{floor=2}(\text{DEPT})). Answer on the table's database: Asha, Chen, Dev.

EX 2Is it safe?

Easy

{⟨x⟩∣¬R(x,x)}\{\langle x \rangle \mid \neg R(x, x)\}: no positive atom binds xx; the answer contains every value of the domain not related to itself, which changes when the domain grows: unsafe. {⟨x,y⟩∣R(x,y)∧¬S(x,y)}\{\langle x, y \rangle \mid R(x, y) \wedge \neg S(x, y)\}: the positive atom binds both variables and the negation only filters: safe; it is R−SR - S.

EX 3Division as a universal quantifier

Medium

"Employees who work in every department on floor 3" is {⟨n⟩∣∃d EMP(n,d)∧∀d2 ∀m (DEPT(d2,m,3)⇒EMP(n,d2))}\{\langle n \rangle \mid \exists d\,\text{EMP}(n, d) \wedge \forall d_2\,\forall m\,(\text{DEPT}(d_2, m, 3) \Rightarrow \text{EMP}(n, d_2))\}. The first conjunct binds nn; the premise of the implication binds d2d_2 and mm. In algebra it is the division πename,did(EMP)÷πdid(σfloor=3(DEPT))\pi_{ename,did}(\text{EMP}) \div \pi_{did}(\sigma_{floor=3}(\text{DEPT})). Answer: Ben, Esha (only one department is on floor 3).

EX 4Why the quantifier needs a restricting premise

Medium

{⟨x⟩∣∀y  R(x,y)}\{\langle x \rangle \mid \forall y\; R(x, y)\} says that xx is related to every value. Over the active domain this is a finite check, but the formula is judged for all possible domains: add one new value vv to the domain and no xx is related to vv, so the answer becomes empty. The fix is to say which values are meant: ∃y R(x,y)∧∀z (T(z)⇒R(x,z))\exists y\,R(x, y) \wedge \forall z\,(T(z) \Rightarrow R(x, z)) with a relation TT that lists them.

EX 5Typical questions

GATE level

(a) "Which of these calculus expressions is safe?" Check each variable against a positive atom; reject lone negations, lone comparisons and unbalanced disjunctions. (b) "Which languages have the same expressive power: relational algebra, safe tuple calculus, safe domain calculus?" All three. (c) "Is {⟨x⟩∣∀y R(x,y)}\{\langle x \rangle \mid \forall y\, R(x, y)\} safe?" No. (d) "The domain calculus differs from the tuple calculus in that its variables range over ..." single attribute values rather than tuples. (e) "Can every SQL query be expressed in the safe calculus?" No: aggregates and arithmetic go beyond it; the basic select-project-join, union, difference and division queries can.

Cheat box

Cheat box

  • Domain calculus: {⟨x1,…,xn⟩∣P}\{\langle x_1, \dots, x_n \rangle \mid P\}, variables are values; atoms R(t1,…,tk)R(t_1, \dots, t_k) and comparisons.
  • Safe = finite answer, same over the active domain and over any larger domain.
  • Unsafe: lone ¬R\neg R, lone comparison x<yx < y, disjunction binding different variables, ∀\forall without a restricting premise.
  • Safe pattern: every answer variable and every quantified variable bound by a positive atom; ∀v (atom⇒condition)\forall v\,(\text{atom} \Rightarrow \text{condition}).
  • Codd: relational algebra == safe tuple calculus == safe domain calculus.
  • Domain independence is undecidable in general; the syntactic test is sufficient, not necessary.

Traps and GATE patterns

Connections

The domain calculus is the value-based twin of the tuple calculus and has the same relation to relational algebra (Codd's theorem). The division formula connects to the division operator and the "for all" queries of advanced algebra; in SQL, universal quantification is written with a double NOT EXISTS (nested queries).

PYQs

3 previous year questions from your book. I re-solved each one myself (1 by running or simulating, 2 by reasoning only); the book's key is shown next to my answer. All PYQs

GATE 2017 · Set 1 · MCQ · 1 markQ10 · page 390 of the book
Consider a database that has the relation schemas
EMP(Empld,
EmpName,
Deptld)
and
DEPT(DeptName, Deptld). Note that the Deptldcan  be
permitted to a NULL in the relation EMP. Consider the
following queries on the database expressed in tuple
relational calculus.

(I) {t|∃u ε EMP(t[EmpName) = u[EmpName] Λ ∀

         ∨ε DEPT(t[Deptld] ≠ V[Deptld]))}

(II) {t|∃u ε EMP(t[EmpName) = u[EmpName] Λ ∃∨ ε
DEPT(t[Deptld] ≠V[Deptld]))}

(III) {t|∃u ε EMP(t[EmpNmae) = u[EmpName] Λ ∃∨ ε
DEPT(t[Deptld] =V[Deptld]))}

Which of the above queries are safe?
  • (a)I and II only
  • (b)I and III only
  • (c)II and III only
  • (d)I, II and III.
GATE 2013 · MCQ · 2 marksQ17 · page 391 of the book
Consider the following relation schema

Students(rollno:integer, sname: string)

Courses(courseno:integer,cname: string)

Registration (rollno: integer, courseno: integer, percent:
real)

Which of the following queries are equivalent to this query
in English?

"Find the distinct names of all students who score more
than 90% in the course numbered 107".

(I)  SELECT DISTINCT S.sname

FROM Students as S, Registration as R

WHERE R.rollno = S. rollno AND R.courseno = 107 AND
R.percent> 90

(II) πsname(σcourseno= 107 Λ percent> 90 (Registration ⋈Students))

(III) {T|∃S ε Students, ∃R ε Registration (S.rollno =
R.rollno Λ R.courseno = 107 Λ R.percent> 90 Λ T.sname
= S.sname)}

(IV) {<SN>|∃SR∃RP(<SR,SN>∈Students∧<SR,107,RP>∈
Registration∧ RP>90)}
  • (a)I, II, III and IV
  • (b)I, II and III only
  • (c)I, II and IV only
  • (d)II, III and IV only
GATE 2006 · MCQ · 1 markQ30 · page 394 of the book
Which of the following relational query languages have
the same expressive power?
1. Relational algebra
2. Tuple relational calculus restricted to safe
Expressions
3. Domain relational calculus restricted to safe
expressions
  • (a)II and III only
  • (b)I and II only
  • (c)I and III only
  • (d)I, II and III

Self-check

Question 1

Why is {⟨x⟩∣¬R(x)}\{\langle x \rangle \mid \neg R(x)\} unsafe?

Show answer

It returns every value of the domain that is not in RR. The answer depends on the domain and can be infinite.

Question 2

Write "first components of RR that are not in SS" in the domain calculus.

Show answer

{⟨x⟩∣∃y R(x,y)∧¬S(x)}\{\langle x \rangle \mid \exists y\,R(x, y) \wedge \neg S(x)\}: the first conjunct binds xx, the negation filters. Safe.

Question 3

Which languages are equally expressive: relational algebra, safe tuple calculus, safe domain calculus, SQL with aggregates?

Show answer

The first three. SQL with aggregates and arithmetic is stronger.

Question 4

Is {⟨x⟩∣R(x,3)∨S(x)}\{\langle x \rangle \mid R(x, 3) \vee S(x)\} safe?

Show answer

Yes: xx is bound by an atom in each branch of the disjunction.

Question 5

Is the syntactic test of this page an exact test of safety?

Show answer

No. It never accepts an unsafe formula, but it rejects some safe ones such as ¬¬R(x,x)\neg\neg R(x, x).

Revision card

One-screen revision

  • Domain calculus: variables range over values; {⟨x1,… ⟩∣P}\{\langle x_1, \dots \rangle \mid P\}.
  • Safe: finite answer, independent of the domain beyond the active domain.
  • Bind every answer variable and quantified variable by a positive atom; ∀v (atom⇒cond)\forall v\,(\text{atom} \Rightarrow \text{cond}).
  • Unsafe: lone negation, lone comparison, unbalanced disjunction, ∀\forall without premise.
  • Codd: algebra == safe tuple calculus == safe domain calculus (not SQL with aggregates).

References

  • ·Silberschatz, Korth, Sudarshan, Database System Concepts (7th edition), the section on the domain relational calculus and the sections on safety of expressions (in recent editions in the online or appendix chapter on relational calculus)
  • ·Elmasri, Navathe, Fundamentals of Database Systems (7th edition), Section 8.7 (the domain relational calculus) and the discussion of safe expressions in Section 8.6
  • ·Ramakrishnan, Gehrke, Database Management Systems (3rd edition), Section 4.3 (relational calculus), including the domain relational calculus and expressive power

Verification

scripts/dc_lib.py (an evaluator of calculus formulas over a finite domain) and scripts/enum-checks/db_domain_check.py: the three named queries (floor 2, no employees, every department on floor 3) give the same answer in the domain calculus, relational algebra, SQL (SQLite) and the tuple calculus on the table's database and on 150 random databases; the six algebra operators written as safe formulas equal hand-written algebra and SQLite on 300 random databases; the eleven formulas of the safety table: the answer over the active domain and over the domain enlarged by new values (several kinds of extra values) was recomputed, and every formula called unsafe has a database on which the answer changes; the syntactic range-restriction test (mine, not a textbook definition) never accepts a formula that is not domain independent on 4000 random formulas with 120 random databases each (1247 accepted), and it rejects some domain independent formulas (not not R(x, x)), so it is sufficient and not necessary. The tests in tests/db-domain-traces.test.ts recompute the answers of the safety table in TypeScript. Domain independence (and so safety) is undecidable in general (Di Paola; quoted, needs verification), and Codd's theorem is quoted. The textbook definition of a safe tuple calculus expression (every value of the result belongs to dom(P)) is quoted from memory of Silberschatz et al. (needs verification). NULLs are not modelled. The mapped GATE question on safe tuple calculus queries (Databases 3.10) is discussed in the traps: its key is not what this page's definition gives (needs verification against the official key). Textbook chapter references are from memory. The independent second pass has not been run, so the page stays draft. SECOND PASS (2026-11-02, done by the assistant, not a human check): every Self-check question was solved before the printed answer was read and all agreed; the definitions, worked examples, cheat box and traps were read claim by claim and re-derived against the textbook definitions and the sample database. No defect found. Status raised to self-checked; verified needs a textbook or human check.

last verified: never