Proving PACELC

Scalable distributed systems face inherent trade-offs arising from the relatively high cost of exchanging information between computing nodes. Brewer's CAP (Consistency, Availability, Partition-Tolerance) principle states that when communication becomes impossible between isolated parts of the system (i.e., the network is partitioned), then the system must give up either safety (i.e., sometimes return an incorrect result) or liveness (i.e., sometimes fail to produce a result). Abadi generalized Brewer's principle by defining the PACELC (if Partition then Availability or Consistency, Else Latency or Consistency) formulation, which captures the ob- servation that the trade-off between safety and liveness is often made in practice even while the network is reliable. Building on Gilbert and Lynch's formal proof of the CAP principle, this paper presents a formal treatment of Abadi's formulation and connects this result to a body of prior work on latency bounds for distributed objects.