Skip to content
The Data EngineeringThe Data EngineeringBeta
About
Main content

Split brain and the two-site problem

Why can no highly available design run on two symmetric sites?

Split brain, and why two sites cannot work

Split brain is the composite failure of everything above: two components each believing they hold authority. The causes can be listed exactly:

  • no requirement at all;
  • disagreement about the membership set;
  • a gap between and fence;
  • a detector verdict treated as an attribute of a node when it was a property of a link.

The structural result concerns rather than nodes. A symmetric of two equal halves leaves no majority anywhere. So a two-site deployment is either unsafe (both sides proceed) or unavailable (neither side does). There is no third option and no protocol fixes it.

Every two-datacentre high-availability design either smuggles in a third location for a witness, accepts manual failover, or is quietly unsafe. The witness only votes and stores nothing, which is why it is cheap. This is the role separation of replication topologies (vote versus store versus serve) paying off.

Compression: a majority cannot exist inside two symmetric halves, so highly available two-site designs are a category error, and the fix is always a third failure domain holding one vote.