PACELC: normal-operation latency trade-offs

01Ask a second question while the network works

Nia changes her public display name at East. West has not received the change yet, even though the network is working. Should a West read wait, or may it briefly show the earlier name?

CAP addresses a limit during broken communication. PACELC adds a question about ordinary operation:

1. If there is a Partition, ask which operations can remain Available and which Consistency promise they keep.
2. Else, while communication works, ask how the required Consistency changes Latency: the elapsed time before the caller gets a result.

The letters form a discussion framework, not a complete database specification. Name the operation and follow its messages. A database label supplies neither its exact delay nor every configuration’s guarantee.

For this example, Nia’s change produces profile version 8; West still has version 7. For this exercise, a public avatar copy may be reused for 30 seconds after a successful refresh from East. Private-document reads instead check the saved access grant; a completed revocation must be reflected by that check.

• West can return its avatar copy while that refresh age is within 30 seconds. Once it expires, West refreshes from East or returns an unavailable response.
• Before returning private bytes, the service reads the account’s grant through the permission store’s linearizable read. That read must reflect completed revocations; a cached older grant cannot replace it.
• Some operations can combine independent changes without the same coordination as an exclusive claim. Do not assume every stronger guarantee has one universal communication cost.

02Trace a normal update before discussing failure

Assume a cross-region round trip takes 80 ms for this exercise. That is a planning input, not a production measurement.

Trace local acceptance:

1. East safely saves version 8.
2. East reports success before West receives it.
3. A West read can still return 7 if its stated freshness rule allows that result.

Trace a more coordinated path:

1. In this one-writer example, East accepts profile changes and sends version 8 to West.
2. West saves and applies 8, then replies with that applied version. Merely receiving bytes would not make its normal queries show the change.
3. East waits for that reply before acknowledging the update. A subsequent West query can now observe 8; the client paid the remote waiting cost to obtain this read-after-write behavior.
4. Count the actual exchanges, processing, and queueing. The assumed 80 ms round trip does not mean every coordinated operation adds exactly 80 ms, or that this short trace implements every rule needed for global linearizability.

A request can also require a minimum version without demanding a globally current read for every user:

1. East’s update response gives Nia version 8.
2. Nia’s next read asks for “at least version 8.” This number is a freshness requirement, not permission to read private data.
3. The read handler checks the replica’s applied version. If it is 7, wait within the caller’s deadline or route to a source whose applied version is at least 8. If neither is possible, return an unavailable response; do not return 7 as success.
4. If another user later completes version 9, a minimum-8 request alone does not demand 9. The guarantee is narrower than one current order respected by every client.

For every path, state the source, the required state, the communication needed, and the failure response.

03Apply both branches to one user promise

Apply both branches to the two profile operations.

While communication works

• West may reuse its public avatar copy for 30 seconds after the last successful refresh from East. Nia’s edit can therefore appear later at West.
• A private-document read asks the permission store whether this account’s grant is active, using the linearizable read described above. Waiting for that answer adds delay and makes the permission store necessary for completion.
• A minimum-version request must meet that explicit version even if an ordinary avatar read would allow an older one.

When communication fails

1. Identify which source or permission check is unreachable.
2. Serve West’s public avatar only while its last successful refresh is at most 30 seconds old. If the copy expires and East cannot be reached, return unavailable instead of reusing it indefinitely.
3. If the permission-store read does not complete within the request’s deadline, refuse the protected read without returning bytes. An old cached grant does not answer whether access was revoked.
4. If local updates may still complete, save them and define how conflicting accepted changes are combined or resolved after reconnection.

Verify ordinary delay as well as disconnection:

• Inject delay into the actual coordination path, not only a local test endpoint.
• Measure the entire user operation, including catching up, redirects, and retries.
• Check the response when the required version does not arrive before the deadline.
• Reconnect regions that accepted different changes and inspect the combined result.

PACELC is useful when it connects a promised observation to an actual request path and exposes what that path costs on a healthy network.