A two-node redundant pair has a built-in weakness: when the two nodes lose contact and disagree, there is no one to settle who should be in charge. A quorum witness is the fix - a small, third-party arbiter whose only job is to break that tie so exactly one node stays primary. This guide defines the quorum witness, explains why an even-numbered cluster needs an odd tiebreaker, describes how a lightweight witness votes without carrying the real workload, and shows how it directly prevents the split-brain problem.
Quorum Witness in one line: A quorum witness is a lightweight third participant in a redundant cluster whose role is to cast a deciding vote when the main nodes cannot agree. By adding an odd third voter to an otherwise even set of nodes, it guarantees that after a communication failure only the side holding a majority - a quorum - remains primary, while the other steps down. This directly prevents split-brain, where both nodes would otherwise act as primary at once.
In a redundant pair, both nodes are equals, and that equality becomes a problem the moment they lose contact with each other. If the link between them breaks, each node has to decide whether it should be primary, but with only two votes and a disagreement, there is no majority - it is one against one, a tie with no resolution. A naive system resolves this by letting each node act on its own judgment, which is exactly the recipe for split-brain, because both may choose to become primary. The two-node cluster simply lacks the arithmetic to pick a single winner on its own.
A quorum witness supplies the missing vote. It is a third participant that both nodes can consult, and it belongs to the cluster only for the purpose of voting - it does not run the SCADA workload or serve operators. When the nodes lose contact, each tries to form a majority by reaching the witness. The side that reaches the witness gains its vote and holds two out of three, a clear majority, so it is entitled to be primary. The other side, unable to form a majority, must step down. What was an unresolvable one-against-one tie becomes a decisive two-against-one, and the standoff is broken.
The underlying principle is that quorum-based clusters want an odd total number of voters so a split can never produce a tie. With an even number - two nodes - a partition divides them into equal halves with no majority, which is the deadlock a quorum witness resolves. Adding the witness makes the voter count three, an odd number, so any partition puts a strict majority on one side and a minority on the other. There is always a clear winner and a clear loser, never a tie. The witness is not adding processing power or capacity; it is adding a vote, purely to make the total odd and the outcome unambiguous.
This is why the witness is described as an arbiter or tiebreaker rather than a third server. It does not need to be able to run the system - it only needs to be reachable and to cast a vote. That keeps it cheap and simple, and it means one witness can do its job without any of the cost of a full third node. The same logic scales to larger clusters: any even-node cluster benefits from an odd tiebreaker so that a network partition cannot split the votes evenly. For the common two-node SCADA pair, the witness is the minimal, standard way to get that odd count and guarantee a single primary survives any partition.
Because the witness only votes, it can be extremely lightweight - often a small service, a shared disk, or a file resource rather than a full server, and frequently placed at a third location or in the cloud so that it does not share a failure domain with either node. Locating it independently matters: if the witness sat next to one of the nodes and shared its power or network, then the event that isolated that node might also take the witness with it, undermining the tiebreak. A witness in the cloud or at a separate site can be reached by both nodes over independent paths, so it remains an impartial third party even when one node's local environment fails.
The direct payoff is split-brain prevention. Split-brain occurs when a broken link lets both nodes become primary at once; the witness makes that impossible by ensuring only the node that can form a majority is allowed to hold the role. A node cut off from both its partner and the witness cannot reach quorum, so it refuses to be primary rather than acting alone - it fails safe. This transforms the dangerous dual-primary standoff into a controlled single-primary outcome. Cloud SCADA platforms apply this same quorum logic inside their own clustering, so a service such as Merobix keeps exactly one node authoritative across failures without the customer standing up and maintaining a witness of their own.
It acts as a third voter in a redundant cluster, casting a deciding vote when the main nodes cannot agree - for example after the link between them breaks. The node that can reach the witness gains a majority and stays primary; the other cannot form a majority and steps down. The witness does not run the workload or serve operators; its only job is to break ties so exactly one node remains primary.
Because two nodes can deadlock. If the link between them fails and they disagree, it is one vote against one - a tie with no majority to resolve it, which can lead both nodes to become primary and cause split-brain. Adding a witness makes three voters, an odd number, so any partition produces a clear majority on one side. That guarantees a single winner and prevents the tie.
Somewhere independent of both nodes, so it does not share a failure domain with either - often at a third site or in the cloud. If the witness sat beside one node and shared its power or network, the same failure that isolated that node could take the witness down too, defeating its purpose. A separately located, independently reachable witness stays an impartial tiebreaker even when one node's local environment fails.
Merobix reads your field devices into a cloud SCADA - the real thing behind these terms, live in days from any browser.