Skip to content
The Data EngineeringThe Data EngineeringBeta
About
Main content

Tunable consistency

What does R + W > N really buy, and why is the guarantee weakest during the failures it was chosen for?

If r + w ≥ d is a conservation law, exposing the split per request is the obvious product. Dynamo-style R/W/N: N copies of each item; a write must be acknowledged by W of them; a read asks R of them. If R + W > N, any and any write set share at least one .

Example: N = 3, W = 2, R = 2. A write reached replicas {1, 2}. A read asks {2, 3}. Replica 2 is in both, so the read meets at least one copy of the latest write.

The correction that matters most

buys overlap. Overlap alone gives neither linearizability nor even monotonic reads. Three separate reasons:

  1. You must be able to identify which returned value is latest. That requires versioning. If the versioning is timestamps, then "latest" is a function of clock skew.
  2. You must write the winning value back before returning. Otherwise a later read that hits a different can legitimately return the older value. This is 's second phase (see The latency floor). It is routinely missing from the folk statement of the rule, and its absence breaks specifically. This is Tomás's third ticket: a write was in progress and had reached only replica 1 so far. Read 1 asked {1, 2} and returned the new value. Read 2 asked {2, 3}, which had not seen the write yet, and returned the old value. Nothing wrote the new value back to a majority, so the second read was allowed to go backwards.
  3. A write that reached fewer than W replicas is reported failed but is not rolled back. It may later be repaired into existence. A failed write in a quorum system is not an absent write. That is why a read after a failed write can return the value you were told was not stored.
R + W > N, and a read that goes backwards

Sloppy quorums

Add with hinted handoff (when home replicas are unreachable, writes are accepted by other nodes, which hold a "hint" and hand the data back later) and the overlap argument collapses completely. The W acknowledging nodes need not even be members of the item's preference list. So This is the hidden-assumption rule: the arithmetic assumed which nodes answered, and under stress that assumption is the first to go.

Two more load-bearing facts

  • LOCAL_QUORUM (Cassandra) silently re-scopes N to one datacenter. The arithmetic holds locally and says nothing globally.
  • Per-request levels do not compose. A QUORUM read after a ONE write is not a quorum-consistent interaction. The guarantee of a sequence is set by its weakest pairing, . This is the same non-composability that disqualified as a building block, now inside a configuration parameter.

Cosmos DB as evidence

Cosmos DB ships five levels per request: strong, , session, , eventual. That an independent commercial system converged on exactly the five models this article derives (including consistent prefix and bounded staleness, which are easy to overlook) is the best external validation the taxonomy gets.