Deep within the most perilous gorge of the Taihang Mountains stood three heavily fortified storehouses built into the living rock: the Alpha Granary clinging to the eastern precipice, the Beta Fodder Depot nestled in the western ravine, and the Gamma Armory anchored to the southern slope.

A dozen leagues of sheer cliffs and bottomless chasms separated the three bastions, each governed by its own supply warden. Beyond the mountain passes, nomadic horsemen patrolled day and night. Whenever rations had to be issued or the mountain passes sealed against siege, all three garrisons had to move in absolute unison; if one gate was barred while another was breached or torched, the entire bastion would crumble. Perched atop the Eagle Beak Crag midway between them sat the Grand Dispatch Tower, where the Pass Commandant commanded the gorge by sending dispatches in all directions.

In earlier years, the protocol was deceptively simple: the Commandant would dispatch swift couriers to each garrison asking, “Are the provisions secured?” If all three replied “Secured,” the Commandant would release a whistling signal arrow, ordering them to drop the iron portcullises simultaneously. If even a single garrison replied “Deficient” or sent no word at all, the gong would sound for a total retreat, and all three would stand down.

The rule held for years—until the winter of the great blizzard.

That night, the Commandant dispatched his queries, and all three wardens inspected their reserves and sent word: “Secured.” At the gates, the soldiers braced against the howling wind, keys poised in heavy padlocks. But at the very moment the Commandant drew his brass bow to shoot the signal arrow, a massive avalanche sheared the cliff above. A hundred fathoms of snow and shattered rock swept the Grand Dispatch Tower and the Commandant into the abyss.

Darkness fell over Eagle Beak Crag. Absolute silence enveloped the gorge.

The three storehouses were plunged into an agonizing limbo. Each warden knew his own garrison had reported “Secured.” Yet none knew what the other two had reported, nor whether the Commandant, in his dying breath, had managed to release the signal arrow into the storm.

To unlock the gates and disperse might mean treason if the others had seen an arrow and sealed their doors; to drop the portcullis unilaterally might leave comrades trapped outside. And with the Commandant dead, no second arrow would ever come. For three days and three nights, soldiers stood frozen in their armor, spears gripped in numbed hands, paralyzed in place while transport across the mountain completely ground to a halt.

This was the legendary “Precipice Deadlock.”

The following spring, a newly appointed Commandant arrived at the Eagle Beak Crag. Determined to break the curse, he carved a stark military decree onto stone: “No decision shall leap into finality before the threshold is made clear; the survival of the pass rests upon the Three Flags of the White Steed.”

The new protocol mandated three distinct flags and three consecutive round trips:

First: The Inquiry Flag (Can-Commit?). Whenever the gates were to be barred, the Commandant sent a cinnabar tally to each storehouse: “Can your fortress endure the seal?” Each warden inspected his stores. If soldiers were ill or supplies lacking, they returned “Deficient”; if fully prepared, they returned “Prepared.” If any garrison replied “Deficient” or timed out, the Commandant sounded the bronze gong to abort, and all three stood down without incurring cost.

Second: The Interim Flag (Pre-Commit). If all three garrisons returned “Prepared,” the Commandant strictly refrained from dropping the portcullises. Instead, he unfurled a “Half-Crescent Saffron Banner.” This flag signaled: “The inquiry has cleared across all quarters; not a single bastion objected. Prepare for the seal, but do not yet turn the iron key!” Upon seeing the yellow banner, each garrison knew that unanimity was reached and no retreat was possible anywhere in the pass. Each stamped “Preliminary Seal” into its ledger and sounded a brass horn back toward Eagle Beak Crag in acknowledgment.

Third: The Final Decree (Do-Commit). Only when the Commandant had clearly heard the horn blasts from all three garrisons—confirming that every bastion was poised at the threshold—did he raise the magnificent “Vermillion Phoenix Banner” high above Eagle Beak Crag! At the sight of the red banner, winches groaned across the three bastions, massive counterweights dropped, and the great portcullises slammed shut in unison.

The wardens initially questioned the extra labor: “Two rounds of dispatches already make intentions clear. Why waste time introducing this intermediate yellow flag between query and action?”

The Commandant merely smiled.

The answer arrived late that autumn, when horsemen assaulted the pass beneath blinding dust storms. The Commandant dispatched the cinnabar tallies, and all three garrisons answered “Prepared.” He then raised the Half-Crescent Saffron Banner; all three stamped their ledgers and sounded their horns.

At that exact moment, a stray iron-tipped arrow whistled through the dust and pierced the Commandant’s throat. The dispatch tower fell silent once more. The Commandant tumbled into the gorge before the red banner could be unfurled!

In previous years, this would have triggered the same unending deadlock. But under the new decree, the outcome was entirely different.

When half an hour passed without word from the tower, the warden of Alpha Granary—as the senior officer designated by decree—stepped forward as the “Acting Commandant.”

Standing upon his watchtower, the Alpha warden sounded his horn across the ravine to interrogate his peers: “I hold the Saffron Banner and have stamped the Preliminary Seal! What is your status?”

Beta Depot answered with two horn blasts: “I hold the Saffron Banner and have stamped the Preliminary Seal!” Gamma Armory echoed: “The Saffron Banner is in hand!”

The Alpha warden hesitated not a second: “The Commandant has fallen, but the Saffron Banner reached every gate! This proves that every bastion voted ‘Prepared’ in the first round; not a single post reported ‘Deficient,’ and no retreat was ever sounded. We all stand across the threshold together. Drop the portcullises and seal the pass!”

Winch cables snapped taut, iron gates crashed down, and the pass stood impregnable.

Even more remarkably: had the Commandant fallen earlier—after the cinnabar tallies but before the saffron banner was sent—the Alpha warden would have found upon questioning that none had received the yellow flag. He could then conclude with mathematical certainty that no garrison could have possibly dropped its portcullis. A single order to abort would release all three garrisons safely, without a single soldier trapped in deadlock.

The saffron banner acted as a secure corridor built between the abyss and the fortress. Entering that corridor proved that no one behind had retreated; remaining outside proved that no one ahead had leaped.

— By now you have likely recognized it: the three mountain bastions are the participating nodes (Participants / Cohorts); the Commandant and his designated successor atop Eagle Beak Crag are the transaction coordinator and backup coordinator (Coordinator & Backup Coordinator); the three-day paralysis that froze the garrison is the infamous blocking problem of the classic Two-Phase Commit (2PC); and the three deliberate flags of the White Steed are the non-blocking atomic commitment protocol formulated by Turing Award-level theorist Dale Skeen in 1981: the Three-Phase Commit Protocol (3PC).

What it is

The Three-Phase Commit Protocol (3PC) is a distributed transaction algorithm designed to eliminate the indefinite blocking vulnerability inherent in the classical Two-Phase Commit (2PC) protocol when a coordinator crashes during execution.

In classical Two-Phase Commit (2PC), execution proceeds in two phases:

1. Prepare / Voting Phase: The coordinator asks participants if they can commit. Participants log their intent and vote Yes or No.
2. Commit Phase: If all vote Yes, the coordinator broadcasts Commit; if any vote No, the coordinator broadcasts Abort.

The fatal flaw of 2PC lies in its abrupt state boundary. Once a participant votes Yes, it enters an uncertain state (In-Doubt). If the coordinator crashes while holding the decision and communication fails, surviving participants cannot deduce whether the coordinator issued a Commit before dying. Lacking global consensus, all participants holding local locks must block indefinitely until the failed coordinator recovers and replays its log.

3PC breaks this impasse by introducing a third, intermediate state and phase. It splits the commitment step into two distinct communication rounds, creating a three-stage pipeline:

1. Can-Commit Phase (Inquiry & Vote):
   • The coordinator sends a CanCommit message to all participants;
   • Participants evaluate local resource availability (locks, disk buffers, constraints) and reply Yes or No;
   • If any participant votes No or times out, the coordinator broadcasts an immediate Abort.
2. Pre-Commit Phase (Transition & Agreement):
   • If all participants voted Yes, the coordinator broadcasts PreCommit;
   • Upon receiving PreCommit, participants write an acknowledgment to their write-ahead log, enter the Pre-Committed state, and reply with an Ack. They know with certainty that the transaction will not abort;
   • This phase establishes the core safety invariant: If any node has entered the Pre-Committed state, every node in the cluster must have voted Yes in the initial inquiry, meaning an Abort is globally impossible.
3. Do-Commit Phase (Final Execution & Release):
   • Upon gathering Ack messages from all participants, the coordinator broadcasts DoCommit;
   • Participants commit changes locally, release transaction locks, and return final completion acknowledgments.

By wedging the Pre-Commit state between preparation and final commitment, 3PC eliminates any protocol state where both a commit decision and an abort decision are simultaneously plausible. If the coordinator crashes, a newly elected backup coordinator queries surviving participants:

• If at least one surviving participant is in the Pre-Committed state: The backup coordinator knows that all participants previously agreed to commit and that none could have aborted; it safely proceeds to Commit.
• If all surviving participants are in the initial or uncommitted state: The backup coordinator knows that no participant could have possibly executed a Commit; it safely aborts the transaction.
• The cluster resumes operation and completes the transaction without blocking on the recovery of the original coordinator.

Why it matters

The Three-Phase Commit protocol occupies an essential place in distributed systems theory, bridging classic database transactions and modern consensus protocols:

1. Provably Non-Blocking under Fail-Stop Models: Under a pure fail-stop failure model (where nodes fail only by crashing and network timeouts provide reliable crash detection without partitions), 3PC proves that atomic commitment can be made completely non-blocking. Surviving nodes can always deduce the global state and reach a safe decision autonomously.

2. Illuminating the Boundaries of Atomic Commit and Consensus: While theoretically elegant, 3PC harbors an engineering Achilles’ heel: it is vulnerable to network partitions. If an asymmetric network partition occurs during the Pre-Commit phase, nodes on opposite sides of the partition may timeout and independently reach contradictory decisions (Commit on one side, Abort on the other), resulting in catastrophic split-brain state corruption. This realization spurred the development of quorum-based consensus engines such as Paxos and Raft—proving that in asynchronous, partitionable networks, fixed-round atomic commitment must yield to quorum intersection.

3. Architectural Archetype for Progressive Consensus: The multi-stage progression introduced by 3PC (querying intent, securing agreement, executing commit) serves as the architectural blueprint for modern high-availability protocols:

   • Practical Byzantine Fault Tolerance (PBFT): Utilizes the Pre-Prepare -> Prepare -> Commit three-stage pipeline to establish consensus among distrusted nodes;
   • Raft State Machine Commitment: Requires followers to replicate an entry before advancing the commit index on subsequent leader heartbeats;
   • Modern Distributed Database Engines: Informs timeout recovery and non-blocking state reconstruction in transactional engines.

Metaphor mapping

• The three mountain bastions (Alpha, Beta, Gamma) and their wardens → Participating nodes in a distributed transaction (Participants / Cohorts)
• The Pass Commandant atop the Eagle Beak Crag → The transaction coordinator (Transaction Coordinator)
• The avalanche burying the dispatch tower and freezing soldiers for three days → The classic 2PC coordinator crash causing indefinite blocking (2PC Blocking Problem)
• The First Flag: Cinnabar tallies and the wardens’ “Prepared” responses → The inquiry round of 3PC (Can-Commit Phase & Voting)
• The Second Flag: The Half-Crescent Saffron Banner and preliminary seal stamping → The pre-commit round establishing unanimity (Pre-Commit Phase & Invariant Establishment)
• The secure corridor of the saffron banner where no one retreats → The 3PC safety invariant eliminating uncertainty (Non-blocking State Invariant)
• The Third Flag: The Vermillion Phoenix Banner dropped upon hearing all horns → The final commit and lock release (Do-Commit Phase)
• The Alpha warden assuming command and questioning peers after the Commandant’s death → Backup coordinator election and termination protocol (Backup Coordinator Election & Termination Protocol)
• Committing if the yellow banner is held or aborting if absent → Safe state-based resolution by surviving nodes (Safe State-based Resolution)
• Dust storms causing miscommunication across ravines → 3PC’s fatal vulnerability to network partitions and split-brain decisions (Vulnerability to Network Partitions)