What is Google Spanner and how does it achieve external consistency (strict serializability) at planetary scale?

Google Spanner is a globally distributed, NewSQL relational database that provides ACID transactions, multi-region replication, and external consistency (the strongest possible consistency model, equivalent to strict serializability). Traditional distributed databases face a fundamental problem: without a synchronized global clock, it is impossible to determine the absolute causal order of transactions originating on different continents without expensive global coordination. Spanner solves this not by eliminating clock skew, but by explicitly bounding it using the TrueTime API. By guaranteeing that every transaction commit timestamp accurately reflects real-world wall-clock time order, Spanner allows globally distributed read-write transactions to serialize correctly and enables lock-free, coordinated-free snapshot reads at any historical timestamp.

How does the TrueTime API use GPS receivers and atomic clocks to bound physical clock uncertainty?

The TrueTime API exposes physical time as an interval TT.now() = [t_earliest, t_latest], where the true absolute physical time t_absolute is guaranteed to lie within the interval with a bounded maximum uncertainty epsilon = (t_latest - t_earliest) / 2. Google achieves this by deploying redundant TrueTime master daemons in every datacenter equipped with two independent time references: (1) GPS satellite receivers, which provide high precision but suffer from antenna failures, weather disruptions, and satellite signal spoofing; (2) Rubidium atomic clocks, which have no external dependencies and drift very slowly (under 1 microsecond per day). The TrueTime daemon continuously cross-checks both sources: if GPS fails or diverges from the atomic clock, the master increases its advertised uncertainty epsilon until resynchronized. In modern Google datacenters, epsilon is typically kept under 1 to 7 milliseconds.

What is the Commit Wait rule in Spanner and why is it mathematically required to preserve causality?

The Commit Wait rule is Spanner core algorithmic mechanism for enforcing external consistency: if a transaction T2 begins after transaction T1 commits in the real world, the commit timestamp of T2 must be strictly greater than T1 (s2 > s1). When a read-write transaction T1 prepares to commit, the coordinator leader picks an absolute commit timestamp s1 = TT.now().latest. Before releasing locks or returning success to the client, the transaction must wait (Commit Wait) until TrueTime guarantees that absolute physical time has passed s1 (i.e. until TT.now().earliest > s1). Because the uncertainty interval is 2*epsilon wide, the coordinator must intentionally sleep for approximately 2*epsilon (typically 2 to 14 ms). This physical pause guarantees that any future transaction T2 anywhere on Earth will observe TT.now().latest > s1, preserving absolute causal ordering without inter-datacenter lock handoffs.

How does Two-Phase Commit (2PC) execute across independent Paxos consensus groups without split-brain?

Spanner organizes data into horizontal splits called Directories, replicated across datacenters as Paxos groups. Within a single Paxos group, consensus writes are handled via standard Paxos leader lease protocol. When a transaction touches data across multiple Paxos groups (a distributed transaction), Spanner combines Two-Phase Commit (2PC) with Paxos: (1) One Paxos group leader is chosen as the Coordinator Leader, and all other touched group leaders act as Participant Leaders; (2) Phase 1 (Prepare): The coordinator sends Prepare messages. Each participant leader logs a Prepare record into its own Paxos consensus group, which replicates across regions. Once replicated, participants acquire read/write locks and vote YES with their minimum prepared timestamp; (3) Phase 2 (Commit): The coordinator chooses a commit timestamp s >= all participant prepare timestamps, logs a Commit record to its own Paxos group, waits out the Commit Wait period, and broadcasts the Commit decision to all participants.

How does CockroachDB achieve serializable isolation using Hybrid Logical Clocks (HLC) without TrueTime hardware?

CockroachDB operates on commodity public cloud infrastructure without atomic clocks or GPS hardware, making TrueTime unavailable. Instead, it uses Hybrid Logical Clocks (HLC), which combine physical NTP wall-clock time with Lamport logical counters: HLC = (physical_time, logical_counter). If a node physical clock lags behind an incoming message timestamp, HLC advances its logical counter to maintain causality. Because NTP clock skew on cloud VMs can be 100-250 ms (max_offset), CockroachDB cannot use the TrueTime Commit Wait rule without unacceptable latency. Instead, when a transaction reads data written within the clock uncertainty window (Read Uncertainty), the read restarts at a higher timestamp or performs an uncertainty restart, trading off occasional read latency spikes for zero specialized hardware requirements.

Why can Spanner execute read-only snapshot transactions without acquiring locks or communicating with Paxos leaders?

In traditional databases, reads require shared locks to prevent dirty or non-repeatable reads. In Spanner, every row version is stored with its exact MVCC commit timestamp. For a read-only transaction, the client picks a read timestamp s_read = TT.now().latest (or any historical timestamp within the GC retention window). The client can send the read query to any local Paxos replica (even an out-of-date follower in the nearest datacenter!). The replica simply checks its local safe time t_safe (the highest timestamp for which all prior Paxos writes have been applied). If t_safe >= s_read, the replica serves the read directly from its local storage without taking locks, communicating with the Paxos leader, or generating network round-trips to distant datacenters.

Verified Specification | Standardized Formulas | Instant Precision

Secure & Private (Zero Data Retention) Free Access • No Sign-Up

Google Spanner TrueTime API ε Paxos + 2PC Transactions

Google Spanner, TrueTime & Distributed SQL Transactions Studio

Architect globally distributed, strictly serializable relational databases: model TrueTime API bounded clock uncertainty [earliest, latest] and Commit Wait delays (2ε), simulate Two-Phase Commit (2PC) across independent multi-region Paxos groups, evaluate TrueTime vs Hybrid Logical Clocks (HLC), and synthesize production distributed SQL transaction code.

±3.5 ms

Clock Uncertainty (ε)

7.0 ms

Commit Wait Delay (2ε)

Strict Serializability

Global Consistency

COMMITTED

2PC Paxos Consensus

0.2 ms (Lock-Free)

Read-Only Snapshot Latency

Atomic + GPS

Time Reference

1. TrueTime API Bounded Uncertainty [earliest, latest] Simulator

Visualizes the real-world physical time band TT.now() and the mandatory 2ε Commit Wait pause

Clock Uncertainty ε (3.5 ms)

Hardware Drift Rate (μs/sec)

GPS Master Status

2. Two-Phase Commit (2PC) across Independent Paxos Groups

Cross-partition transactions span multiple Paxos consensus groups replicated across continents

Paxos Group A (Coordinator) Leader

Region: us-central1 (Iowa)

Role: 2PC Coordinator Leader
Replicas: 3 Paxos nodes (Iowa, Virginia, Oregon)
Status: Waiting for Commit Wait (2ε)

Paxos Group B (Participant) Prepared

Region: europe-west1 (Belgium)

Role: Participant Leader
Replicas: 3 Paxos nodes (Belgium, Frankfurt, London)
Logged Prepare record in Paxos

Paxos Group C (Participant) Prepared

Region: asia-east1 (Taiwan)

Role: Participant Leader
Replicas: 3 Paxos nodes (Taiwan, Tokyo, Singapore)
Logged Prepare record in Paxos

Google Spanner, TrueTime & Distributed SQL Transactions Studio

1. TrueTime API Bounded Uncertainty [earliest, latest] Simulator

2. Two-Phase Commit (2PC) across Independent Paxos Groups

3. Production Distributed SQL Blueprints

🔍 Companion Workbenches & Verification Tools

Distributed Consensus: Multi-Paxos & ZooKeeper Zab Architecture Studio

URL Parser & Query String Parameter Inspector

CSS Box Shadow Generator

Linux Btrfs & ZFS Copy-on-Write Storage Architecture Studio

Why Smart Users Are Switching to This Free Toolkit

The Browser Feature Most People Never Use

Stop Paying for Software You Can Get Free

File Conversion Tricks That Save Hours Every Week

This Free Tool Replaced 5 Paid Apps for Our Team

What Your Browser Can Do Without Any Extensions