One, Two and Three Tier Architecture

DBMS Architecture · 20 min

Core CS · DBMS

One query, three architectures

A tier is a machine boundary, not a folder in your code. Count the boundaries between the user and the rows.

Send one request through 2-tier, then 3-tier
Every tier you add is a wall in front of the database. The wall buys you safety and scale, and you pay for it in one network hop and one more thing to run.

01 The idea

A tier is a machine boundary

You can write a program with a user-interface layer, a service layer and a data layer, compile all three into one file, and run it on a laptop. That is three layers and one tier. Layers are how you organise code. Tiers are where that code runs, and a tier boundary means the two sides talk over a network.

Four jobs exist in every database application, whatever the architecture. Something draws the screen and takes the click. Something decides what is allowed: may this student see these marks, is the deadline past, is this refund approved. Something opens a connection and sends SQL. Something stores the rows and finds them again. Architecture is only the question of how many machines you spread those four jobs across, and where exactly you cut.

Count the machines between the user and the rows. One machine is 1-tier, two is 2-tier, three is 3-tier. Everything people argue about — who holds the database password, what breaks at 200 users, how many round trips a click costs — follows from that count.
TierA machine boundary, crossed over a network. Adding a tier never removes work; it moves some of the work to a machine you can secure, replace or add more of.
Database APIODBC and JDBC are standard call-level interfaces. Your program opens a connection with a host, port, username and password, sends SQL, and reads rows back. A 2-tier client uses one directly.
Connection poolA fixed set of database connections opened once by an application server and lent out one query at a time. It is why a middle tier can serve hundreds of users on twenty connections.

02 Worked example

One query, and the places you can cut it

Results day. Student S1 opens My Marks, and exactly one query has to run: SELECT subject, marks FROM result WHERE sid = 'S1'. It returns five rows. That SQL is identical in all three architectures — the database cannot tell them apart. What differs is which machine each of the four jobs runs on. Here are the four jobs in order, with the one whose position decides everything else highlighted.

Presentationdraws the page, takes the click
Business rulesmay S1 see these marks?
Data accessopens the connection, sends the SQL
Storagethe rows, and the engine that finds them

Cut nowhere and you have 1-tier. All four boxes are one program on one machine. S1 clicks, and the same process that drew the button opens a file on the local disk and reads five rows out of it. Zero network round trips, so nothing is faster. There is also no connection string, no username and no password, because nothing is being connected to. The catch is the thing that makes it simple: a second person on a second machine cannot see those rows at all.

Cut once, between data access and storage, and you have 2-tier. The database moves to its own machine. The program on the laptop still decides what is allowed and still writes the SQL, then sends it over a JDBC or ODBC connection it opened using a host, a port, a username and a password. One round trip per query. Two consequences follow immediately, and they are the whole case against 2-tier: the laptop has to store a working database login, and the check may S1 see these marks runs on a machine the student owns.

Cut twice, after presentation and after data access, and you have 3-tier. The browser sends an HTTP request carrying a session cookie and nothing else — no host name, no password, no SQL. An application server reads that cookie, works out that this session belongs to S1, writes the query with sid bound to S1, and borrows one of its already-open database connections. Two round trips instead of one. In exchange the database credential exists in exactly one place, and the rule that S1 reads only S1’s marks runs where the student cannot reach it.

The SQL never changed. The cut moved. Every difference in the next section is a consequence of where the cut falls, because a cut is three things at once: a network hop you have to pay for, a place a credential has to live, and a machine you can add more of.

03 Mechanics

Three architectures, seven properties that differ

Read this table down a column, not across a row. Each column is a coherent set of trade-offs, and the numbers assume the same scenario throughout: 200 students, one query per page, a PostgreSQL server left on its default settings.

Property1-tier2-tier3-tier
Machines between user and rows123
Network round trips per query012, and one of them is on the LAN
Where the database login livesthere is no loginon every client machineon the app server only
Connections at 200 usersnot applicable, one user200 asked for, 100 allowed20 pooled
“May S1 see this?” is decidedin the same process as the UIon the user’s machineon a machine you control
Changing one business rulereinstall on that one machinereinstall every clientdeploy once
What you run out of firstusers, at exactly onedatabase connectionsapp servers, so add more

Two rows deserve a second look. Connections is the one that surprises people: a database connection is not free. PostgreSQL gives each connection its own server process and defaults max_connections to 100; MySQL uses a thread per connection and defaults to 151. A 2-tier client holds its connection for as long as the application is open, whether or not anyone is querying, so 200 running copies means 200 connections sitting there. A pool in the middle needs one connection per query that is running right now, which is a far smaller number.

Round trips is the row that keeps 3-tier honest. It really does add a hop, and you should say so in an interview before anyone asks. The reason it usually does not hurt is that the added hop is between two machines in the same rack, while the hop it saves you is across the user’s internet connection. A page needing several queries pays for the slow link once instead of once per query.

n-tier is 3-tier that kept splitting. Put a load balancer in front and a cache beside the application server, and a request that misses the cache crosses the browser, the load balancer, the application server, the cache and the database: five machines instead of three. Nothing conceptual changed, so keep counting the same way — each new machine on the path is one more hop, one more deployment and one more thing that can be down at 6 pm.

05 Cheat sheet

Four architectures on one card

ArchitectureMachinesBusiness logic runs onWhat it costs you
1-tier1the same process as the UIone user, one machine
2-tier2the client, or stored proceduresa DB login on every client
3-tier3a dedicated application serverone extra network hop
n-tier4 or moreseveral specialised servicesone more hop per split
CredentialsIn 2-tier every client machine stores a working database username and password, so anyone who reads that config file or captures the traffic has a login. In 3-tier the client holds a session token that means nothing to the database, and the only database credential sits on the application server. This is the security argument, and it is the one interviewers want to hear.
ConnectionsA connection costs the server memory and a process or a thread, so every database caps them. PostgreSQL defaults max_connections to 100, MySQL to 151. 2-tier needs one per running client. 3-tier needs one per query that is running right now, and a pool holds that number steady no matter how many users arrive.
DeploymentChange a rule in 2-tier and you reinstall the client everywhere it is installed. Change it in 3-tier and you deploy one application. This is most of why the web won: the client is a browser that fetches the current version on every load, so there is nothing to roll out.

06 Where & why

Where each tier count actually lives

None of these three is obsolete and none is a beginner version of the next. Each is the right answer for a particular shape of problem, and you can point at software on your own machine running every one of them right now.

SQLite · MS Access
1-tier is running on your phone

SQLite is a library, not a server. It runs inside your application’s own process and reads a file on the same disk, which is why phone apps, browsers and desktop tools use it for local data. No port, no connection string, no login, and no second user.

Oracle Forms · MySQL Workbench
2-tier is the classic desktop client

You type a host, a port, a username and a password into MySQL Workbench, or into an Oracle Forms client, and it connects straight to the database. That is exactly the right shape for a few trusted staff on one office network, and exactly the wrong shape the moment a client sits outside it.

PostgreSQL · your browser
The modern web is 3-tier by default

Browser, application server, database server. The browser holds a session cookie; the PostgreSQL password sits only in the application server’s environment. Every request is re-authorised on the server, which is why editing the student ID in a URL does not fetch somebody else’s marks.

NGINX · Redis · Elasticsearch
n-tier is 3-tier that kept splitting

NGINX balancing the load, Redis caching beside the application server, Elasticsearch owning search. The counting rule has not changed: trace one request, count the machines it touches on the way to the rows. Split when one piece needs to scale or ship on its own schedule, not because the diagram looks more serious with more boxes.

There is no ranking here. 1-tier is correct for a single-user tool, 2-tier for a small trusted network, 3-tier for anything reachable from the internet. The one line that is never negotiable: do not put a database credential on a machine you do not control, which is what rules 2-tier out for a public application no matter how carefully the client is written.

07 Interview questions

What they actually ask

This topic opens a lot of DBMS interviews because it is easy to ask and easy to answer badly. The failure mode is reciting three definitions with no consequence attached. Attach the consequence every time: credentials, connections, deployment, hops.

What is a tier, exactly?
A machine boundary. Code on one side of it reaches the other side over a network. A program with a UI layer, a service layer and a data layer compiled into one executable is three layers and one tier, so the two words are not interchangeable. Interviewers use them loosely, so say which one you mean before you start counting.
Describe 1-tier architecture and give a real example.
The user, the application and the data all sit on one machine, and the program opens the data file directly with no network in between. A phone app or a browser reading its own SQLite file is 1-tier: SQLite is a library that runs inside your process, not a server you connect to. It is the fastest arrangement and the only one that cannot be shared, because there is no port for anyone else to reach.
What changes when you move to 2-tier?
The database gets its own machine, and the client talks to it over a call-level API such as ODBC or JDBC. The client opens a connection using a host, port, username and password, sends SQL, and reads rows back. Business logic stays on the client, or moves into stored procedures inside the database, because there is nowhere else for it to live.
In 3-tier, where does the business logic run and why does that matter?
On the application server, between the client and the database. It matters because the client machine is not trusted: any rule you enforce in client code can be bypassed by patching the client or by sending a request the client would never send. On the application server the rule runs on hardware you control, so it holds regardless of what the user does to their own copy.
Give the security argument for 3-tier in one sentence.
The client never holds a database credential. In 2-tier every installed client carries a working database username and password, so anyone who reads that config file or captures the traffic has a login and can run any SQL that login permits. In 3-tier the client holds a session token that means nothing to the database, and the one real credential sits in the application server configuration.
Two hundred users open a 2-tier application at the same time. What happens?
Each running client holds its own connection, so the database is asked for 200 of them. Databases cap that, because a connection costs memory and a process or thread: PostgreSQL defaults max_connections to 100 and MySQL to 151. Past the cap, clients are refused before they can send a query, and raising the cap only moves the wall, because nothing in a 2-tier design can share a connection between two clients.
What is a connection pool, and why is it a 3-tier idea?
A fixed set of database connections opened once by the application server and lent out for the duration of a single query. It works because the application server sees all the traffic, so users whose queries only take a few milliseconds each can take turns on a small number of connections. A 2-tier client can pool connections for itself, but no client can lend one to another client, which is the sharing that actually matters.
Does the extra tier make the application slower?
For a single query, yes: the request crosses one more network link, typically around a millisecond when the application server and the database sit in the same rack. For a page that needs several queries the answer usually flips, because those queries run beside the database instead of across the user connection. Quote the extra hop honestly first, then say what it buys.
Is 3-tier the same thing as MVC?
No. MVC organises code inside one program, and a model, a view and a controller can all live in the same process on one machine. Tiers are about where code runs. A small web app with its database file on the same server is 2-tier, because there are two machines involved, the browser and the server; move the database to its own host and the same code becomes 3-tier.
What is n-tier, and when do you actually need it?
n-tier is 3-tier with the middle split further: an API gateway, several services, a cache, a search index. You need it when one piece has a different scaling or release cycle from the rest, so keeping them together holds you back. You do not need it because it looks impressive on a diagram, since each extra tier is one more hop, one more deployment and one more thing that can be down.
When would you still choose 2-tier today?
When every client sits on a network you control and the number of users is small and fixed: billing counters in one shop, an instrument in a lab, an internal reporting tool. It is simple and there is nothing in the middle to operate or pay for. The moment the client is on the internet, or the user count is open-ended, the credential problem and the connection problem both bite at once.

08 Practice problems

Six to work through

For each one, write the list of machines first. Almost every wrong answer in this topic comes from counting layers of code, or counting clients, instead of counting machine boundaries between the user and the rows.

Count the machines

Easy
A student runs a Python script on their laptop. It uses a PostgreSQL driver to connect to a server in the college server room, runs one SELECT and prints the rows. Name the architecture, state how many network round trips that SELECT costs, and name the one thing on the laptop an attacker would want.
Follow-up
The script is written cleanly, with one function to fetch and another to print. That is a split into layers, and it changes the tier count by exactly nothing.
Show the hint
List the machines involved before you name anything. A boundary only counts when the two sides talk over a network.

The disappearing button

Easy
In a 2-tier desktop application the Approve Refund button is hidden unless the logged-in user is a manager, and the application is the only tool staff are given for touching the database. Say whether a non-manager can still approve a refund, then name the smallest change that would stop them even if they never open your application again.
Follow-up
The button really is gone and the client code is right, so the feature passes every test you can write against the app. The change you name has to hold against someone who talks to the database with a tool you did not write.
Show the hint
Ask which machine each part of this system runs on, and which of those machines the staff member is free to open.

Size the pool

Medium
An application server handles a peak of 300 requests per second, and each request runs one query that occupies a database connection for 8 ms. Assuming a connection is held only while its query runs, compute the smallest pool size that keeps up, and say what happens to requests when the pool is smaller than that.
Follow-up
The answer is not 300. Each connection is free again after 8 ms, so the unit that matters is connection-time per second, not requests per second, and the number is far smaller than most people guess.
Show the hint
Work out how much connection-time one second of traffic demands, then how much connection-time one connection can supply in that same second.

Find the crossover

Medium
A page runs n queries one after another. On a mobile connection the round trip from the phone to the college server is 40 ms; inside the datacentre the application server to database round trip is 1 ms; each query takes 4 ms in the database. Write the total for 2-tier and for 3-tier as formulas in n, and give the smallest n at which 3-tier is faster.
Follow-up
n = 1 is the case people quote when they claim the extra hop makes 3-tier slower. The formulas show exactly how narrow that claim is, and how fast it stops being true.
Show the hint
Count how many times each design crosses the 40 ms link, and how many times it crosses the 1 ms link, for a page of n queries. One of those four counts is zero and only two of them grow with n.

Logic in the database

Medium
A team keeps its 2-tier desktop application but moves every business rule into MySQL stored procedures, so the client only calls procedures and never writes SQL itself. State how many machines the system spans, then name two problems from this lesson that this change fixes and two that it does not.
Follow-up
This is a real and common design, and it genuinely does remove SQL from the client, so it feels like a middle tier has appeared. Whether the tier count moved is the whole question, and logic moving is not the same as a machine appearing.
Show the hint
Count the machines first and write that number down. Then take the cheat sheet costs one at a time and check each one against this design rather than against 2-tier in general.

Results night

Hard
At 6 pm, 5,000 students each load a page that runs 3 queries, each taking 6 ms of database time. The database allows 100 connections in total. Give the pool size you would set on a single application server and justify both bounds on it, state the total database work the surge demands in seconds, and say which tier you would add first when one application server is no longer enough and what new problem that added tier creates.
Follow-up
The pool size is squeezed from above by the database and from below by the traffic, and the two bounds have nothing to do with each other. Producing a number is easy; saying which bound you are actually up against is the answer.
Show the hint
Compute the total database time the surge demands, then decide how many seconds you are willing to spread it over: that pair gives you the lower bound. The 100 connection limit gives you the upper one.