Why it matters
Safe mode is the single most important consistency guarantee HDFS gives operators. The NameNode has no way of knowing, when it comes back up, which blocks still exist and which were lost while it was down. It knows what blocks it expects from the FsImage plus edit log, but expected does not mean present. If it started scheduling replication before it heard from DataNodes, it might mark healthy blocks as under-replicated and start unnecessary work; worse, if it accepted deletes before hearing from DataNodes, it might delete metadata for blocks that were briefly unreachable.
Safe mode blocks all of that until enough DataNodes have reported. Once the reports satisfy the configured block report threshold, safe mode exits and normal operation resumes.
The architecture
Safe mode is a state variable inside the NameNode. It is set to ON at startup and it stays ON until three conditions are met: the FsImage has fully loaded, the edit log has fully replayed, and the fraction of expected blocks with at least one live replica has crossed the safe mode threshold (default 0.999, meaning 99.9 percent of expected blocks must be reported).
Each DataNode sends a full block report at startup, listing every block it holds. The NameNode compares this against its expected block list. As reports arrive, the fraction of reported-to-expected climbs. When it crosses the threshold, safe mode exits automatically.
How it works end to end
Once the threshold is met and safe mode exits, the NameNode begins its normal duties. Under-replicated blocks (those with fewer than dfs.replication live replicas) are scheduled for replication. Over-replicated blocks are scheduled for deletion. Corrupt blocks (those whose reported checksums do not match) are quarantined. This is the moment where the cluster begins to self-heal.
An operator can query safe mode status with hdfs dfsadmin -safemode get. They can also manually enter or leave safe mode with -safemode enter or -safemode leave. Entering safe mode manually is useful before planned maintenance where you want to freeze the cluster in a known state. Leaving safe mode manually is a last-resort operation.
The threshold and minimum block replica count are both tunable. dfs.namenode.safemode.threshold-pct sets the fraction of blocks that must be reported. dfs.namenode.safemode.min.datanodes sets a minimum number of DataNodes that must have checked in regardless of block coverage.