Skip to content

Consistency models, CAP and PACELC

Choose consistency per operation: refuse or answer during a partition, and wait or answer fast the rest of the time.

Predict first

Before you read: predict

ExamHall stores each candidate's answer sheet as one record, copied at two sites. A save sends one changed answer, and the site that receives it writes the answer into its own copy of the sheet. When two copies of a sheet differ, the copy saved later replaces the other. At 10:00:00 the link between the sites fails for 60 s; both sites keep running. Candidate 12's tablet saves answer 7 through site A at 10:00:10 and answer 8 through site B at 10:00:30, and it retries a refused save every 10 s. Proctors at both sites read the dashboard's answer counts at 10:00:20 and 10:00:40.

Which design keeps every answer a candidate is told is saved, and keeps the counts showing at both sites during the cut?

Pick one

The 30-second version

Consistency models say what reads may return when data has copies: linearizable, causal, read-your-writes, eventual, strongest first. Networks partition, so during a partition each operation either refuses (consistent) or answers from its local copy (available); "CA" is not an option. Without a partition, PACELC adds the other trade: waiting for remote copies costs latency.

Choose consistency per operation: refuse or answer during a partition, and wait or answer fast the rest of the time.

How it works

Step 1 of 14

A consistency model says which results reads may return when data has copies on several machines. Stronger models allow fewer results.

Analogy: An antiques dealer's two shops

The dealer has a shop in town and one on the coast, and each keeps its own copy of the stock book of one-of-a-kind pieces.

At the shops In a system
before a sale, ring the other shop and both strike the piece linearizable writes (step 2)
the phone call keeps the buyer waiting even on a good day PACELC's latency (step 12)
the line is down: stop selling stock-book pieces until it is back refuse: consistent (step 7)
the line is down: sell from your own copy, swap copies on Friday answer: available, and copies diverge (steps 7, 9)
the town book cannot show the coast shop's sales a local check missing the other side (step 10)
a "reserved for Mrs Hale" note never arrives before the note listing her clock causal (step 3)
the shop that just sold sees its own strike at once read-your-writes (step 4)
with no new sales, the books match after the swap eventual (step 5)

Breaks down when: a dealer who sold the clock twice rings a buyer to apologise; a store's merge rule drops one sale and tells nobody (step 9).

Contrasting case: price labels may differ between the shops for a week; one clock sold twice may not. Same broken line, a different answer per item (step 11).

In real terms: for each operation, decide what a cut-off copy does (refuse or answer), and what a normal day may cost in waiting.

Examples, run for real

4.1 ExamHall EXH-3870: a saved extension the candidate never saw

ExamHall's exam settings were written by whichever site received a change, and copied later. During a 45 s cut, a proctor at site A gave a candidate 10 extra minutes; the candidate's tablet reads site B.

4.1 before: proctor at site A told "saved" at 10:00:05 · candidate's tablet at site B at 10:00:10 reads 11:00, 10:00:20 reads 11:00, 10:00:40 reads 11:00 while site A says 11:10 · both say 11:10 once the copy crosses
4.1 MR: extension needs both sites · refused 4 times, the proctor's retry saves it at 10:00:45 · site B: 10:00:10 reads 11:00, 10:00:20 reads 11:00, 10:00:40 reads 11:00, the same as site A until then

Site A said "saved" while site B kept the old end time (steps 7, 9). MR !4170 confirms an extension only once both sites hold it, so the proctor sees a refusal and retries; the dashboard's counts still read the local site (step 11).

4.2 A chat message with no partition at all

A chat app in São Paulo keeps copies in Miami and Madrid; nothing is broken.

4.2 round trips from São Paulo: local 2 ms, Miami 110 ms, Madrid 200 ms · confirm after all 3 copies: 200 ms · confirm locally: 2 ms, the Madrid copy lands 100 ms after the send, so a Madrid read 60 ms after it misses the message

Waiting for every copy costs the slowest round trip; confirming locally is fast, and a far reader briefly misses the message (step 12).

4.3 Which reads meet the last write

Five copies; any of them may be the one that is behind.

4.3 N = 5: W = 3, R = 3 -> 100 of 100 (write set, read set) pairs share a replica · W = 2, R = 2 -> 70 of 100, so a read can miss

With W = 3 and R = 3, 3 + 3 > 5, so every read set meets every write set; with 2 and 2 they can miss each other (step 13).

Try it

Answer first, then check. Nothing is saved.

Question 1 of 6

A chat app copies each thread between three regions. Copies take 1 s between regions A and B, 10 s between A and C, and 0.5 s between B and C. At 10:00:00 Alice, in region A, asks "Is the venue changing?" Bob, in region B, reads it at 10:00:02 and replies "Yes, room 4" at 10:00:03. Today, with eventual consistency, Carol's read at 10:00:04 shows Bob's reply with no question above it. She reads again at 10:00:08, 10:00:12 and 10:00:30, and region C loses its links to A and B from 10:00:20 to 10:01:20.

Which guarantee for the thread stops Carol seeing a reply before its question, and still answers all her reads?

Pick one

Question 2 of 6

A streaming service keeps each viewer's watch position on 3 replicas, in Frankfurt, Dublin and Virginia. The app runs in Frankfurt; its round trips take 2 ms to the Frankfurt replica, 25 ms to Dublin and 90 ms to Virginia. A save is confirmed once W replicas have stored it; a read asks all three and answers with the newest of the first R replies. Any replica can be the one that is behind. No link or replica is down.

Which setting guarantees a read never misses the last confirmed save, with no save or read waiting over 30 ms?

Pick one

Question 3 of 6

A concert's seat map is copied in two regions, EU and US. A hold is written by the region that receives it if its own copy shows the seat free, and the buyer is told at once; the copy then crosses to the other region. When two copies of a seat differ, the later hold replaces the other. From 19:00:00 the regions cannot reach each other for 2 minutes. Buyer 1 holds seat 14C through EU at 19:00:20; buyer 2 holds 14C through US at 19:00:50.

How many buyers are told they hold 14C, and who holds it once the copies have crossed?

Pick one

Question 4 of 6

An online shop keeps its catalog at two sites, Sydney and Singapore; a copy takes 60 ms each way between them. Each seller and customer is 1 ms from its own city's site. No link or site is down. A Sydney seller marks a lamp sold out.

Which setting confirms the change to the seller within 50 ms, answers every customer's read within 50 ms, and never shows the lamp as available to a Singapore customer reading 200 ms or more after the confirmation?

Pick one

Question 5 of 6

A chat room's title is one value, copied between regions. Alice sets the title to "Q3 plan" (it was "Q2 plan") at 10:00:00; the change is confirmed at 10:00:01. Bob, who has not used the room today, reads the title at 10:00:05 and gets "Q2 plan". He reads it again at 10:00:09 and gets "Q3 plan". Alice and Bob do nothing else in the room.

Which of these guarantees did this history break: linearizability, causal consistency, read-your-writes?

Pick one

Question 6 of 6

A payments ledger keeps each account's balance at two sites. A debit is confirmed only once both sites have written it, and a request waits until then. The vendor's sheet calls the ledger "CA: consistent and available". Account 88 holds 100. The link between the sites fails from 14:00:00 to 14:01:00. A withdrawal of 70 reaches site A at 14:00:10.

When is it paid, and what does site B's copy of the balance read at 14:00:30?

Pick one

Go deeper

Pro tips
  1. Before calling a design "CP" or "AP", list its operations and write down, for each one, what a cut-off site does with it: refuse, or answer from its own copy. When: a design review or an interview asks whether a system is CP or AP (steps 7, 11). Verify:
    tip per operation during the 45 s cut: extension refused 4 times, then saved · end-time reads at site B answered 3 of 3
    Status: RAN.
Source

quote-check.mjs finds every passage below verbatim in its saved text. Kleppmann's Designing Data-Intensive Applications (the row's sixth source) is a book and keys nothing. Valid as of 2026-10-13.

  • Jepsen, Linearizability: https://jepsen.io/consistency/models/linearizable (jepsen-linearizable.txt). The row's first source. Quoted: "if operation A completes before operation B begins, then B should logically take effect after A", and "This model cannot be totally or sticky available; in the event of a network partition, some or all nodes will be unable to make progress."
  • Jepsen, Causal Consistency: https://jepsen.io/consistency/models/causal (jepsen-causal.txt). Quoted: "causally-related operations should appear in the same order on all processes—though processes may disagree about the order of causally independent operations", and "Causal consistency is sticky available: even in the presence of network partitions, every client connected to a non-faulty node can make progress."
  • Jepsen, Read Your Writes: https://jepsen.io/consistency/models/read-your-writes (jepsen-read-your-writes.txt). Quoted: "read your writes does not apply to operations performed by different processes."
  • Jepsen, Consistency (index): https://jepsen.io/consistency (jepsen-consistency.txt). Quoted: "a consistency model defines a set of histories that a system can legally execute." Supports step 1.
  • Eric Brewer, CAP Twelve Years Later: How the Rules Have Changed (IEEE Computer, 2012; the full text as republished by InfoQ): https://www.infoq.com/articles/cap-twelve-years-later-how-the-rules-have-changed/ (brewer-2012.txt). The row's second source. Quoted: "Allowing at least one node to update state will cause the nodes to become inconsistent, thus forfeiting C"; "If the choice is CA, and then there is a partition, the choice must revert to C or A"; and "the choice can change according to the operation or even the specific data or user involved." Supports steps 7, 8, 9 and 11.
  • Daniel Abadi, Consistency Tradeoffs in Modern Distributed Database System Design (IEEE Computer, 2012): https://www.cs.umd.edu/~abadi/papers/abadi-pacelc.pdf (abadi-2012.txt). The row's third source. Quoted: "if there is a partition (P), how does the system trade off availability and consistency (A and C); else (E), when the system is running normally in the absence of partitions, how does the system trade off latency (L) and consistency (C)?" and "latency is limited by the slowest entity."
  • Seth Gilbert and Nancy Lynch, Brewer's Conjecture and the Feasibility of Consistent, Available, Partition-Tolerant Web Services (2002), from Gilbert's own page: https://www.comp.nus.edu.sg/~gilbert/pubs/BrewersConjecture-SigAct.pdf (gilbert-lynch-2002.txt). The row's fourth source. Quoted: "It is impossible in the asynchronous network model to implement a read/write data object that guarantees the following properties". Supports steps 6–8.

Related lessons

Checked against the tools and docs as of 2026-10-13.