Clarify requirements first: specify RTO (time to recover service during partition) and RPO (acceptable data loss), expected read/write request mix, latency SLOs, and number of replicas N and their failure domain (AZs/regions). Those inputs drive quorum sizing and routing.
Quorum basics:
- N = total replicas. Pick read quorum R and write quorum W.
- Strong consistency: R + W > N (e.g., majority quorum) ensures every read intersects latest write.
- Lower W or R improves latency/throughput but weakens consistency.
Example configurations and implications:
-
Strong consistency, moderate availability (N=3, W=2, R=2)
- Guarantees linearizable-ish reads (R+W=4>3).
- Write latency: two replicas ack — higher than single-writer but tolerable.
- RTO: service remains if at least 2 replicas reachable; partition that isolates 2 vs 1 will allow the majority side to accept writes.
- RPO: near-zero (writes on majority are durable).
- Trade-off: if network splits 1 vs 2, minority side (single) is read-only or blocked -> higher perceived outage for clients in minority.
-
High availability, relaxed consistency (N=3, W=1, R=1 or R=2)
- W=1: writes complete with single replica -> low write latency and high throughput.
- R=1: fastest reads but may return stale data (R+W<=N).
- RTO: very low — partitions rarely block operations.
- RPO: potential data loss for writes that didn't replicate before failure. To bound RPO, use W=1 but add async replication + durable write-ahead logging and a short TTL for accepting writes in partitions.
- Use R=2 for reads to reduce staleness at cost of read latency.
-
Geo-distributed strong consistency (N=5 across regions, W=3, R=3)
- Majority writes/reads ensure consistency across regions.
- Higher cross-region latency; higher RTO if >2 regions partitioned.
- Good RPO (writes durable on majority); throughput lower due to higher W.
Routing and operational patterns:
- Route writes to a leader (primary) when possible to centralize W and reduce conflicts (e.g., leader with sync replication to W replicas). This simplifies conflict resolution and lowers effective W latency.
- For leaderless stores, use client-side quorum selection and smart routing: route reads with R=1 to nearest replica for low-latency reads but fall back to R=majority for strong-read requirements.
- Implement read-after-write or session affinity: after a write, route a user's reads to a replica that participated in the write (or use causal tokens) to provide monotonic reads without raising global R.
Meeting RTO/RPO targets:
- To meet tight RTO (e.g., <100ms for availability during partitions): prefer W=1 and local reads, combined with mechanisms to bound RPO (durable local write logs, fast cross-region async replication, and disaster recovery replay).
- To meet tight RPO (near-zero): require W=majority synchronous replication; accept increased write latency and potentially higher RTO in certain partition topologies.
- Hybrid: use configurable consistency per operation. Critical writes use W=majority; non-critical use W=1. Enforce SLA at application layer.
Practical mitigations to balance trade-offs:
- Adaptive quorums: dynamic W/R based on detected latency or partition severity.
- Read-repair, hinted handoff, and anti-entropy to reduce eventual staleness while allowing low-latency operations.
- Client-visible guarantees: document when reads may be stale and provide API flags (strong, monotonic, eventual) so clients choose required cost.
- Monitoring: measure replication lag, pending writes, and partition detection to automatically switch routing policies.
Summary: choose N based on failure domains, then size W/R to satisfy RPO (durability) and RTO (availability). Use majority (R+W>N) for consistency; reduce W or R for availability and latency. Compensate with operational techniques (leader routing, session affinity, async catch-up) and expose consistency options to clients so SLAs can be met per workload.
