What is Circuit Breaker?
Also called circuit breaking.
A circuit breaker is a resilience pattern that stops calls to a failing dependency after errors cross a threshold, returning failures immediately instead of waiting on timeouts. After a cooling period it allows a small number of trial calls, and restores normal traffic if those succeed. The pattern protects a struggling service from load and keeps the caller responsive.
The pattern models three states. Closed means traffic flows normally while error rates stay under a threshold. Open means the breaker rejects calls immediately without contacting the dependency. Half open means a limited number of probe calls are permitted to test recovery, with success closing the breaker and failure reopening it. Thresholds are usually expressed as an error rate over a rolling window rather than a raw count.
The main benefit is protecting the caller. Without a breaker, every request to a dead dependency occupies a thread, a connection, and a timeout budget. Those resources pile up until the caller itself becomes unavailable, spreading a local outage across the system. Failing fast frees those resources and lets the caller serve a degraded response or queue the work instead.
The secondary benefit is protecting the dependency. A service that is overloaded or restarting recovers faster when incoming load drops. Retry storms are a common way an outage extends itself, because clients retry harder exactly when the target has the least capacity. A breaker plus jittered backoff reduces that feedback loop.
Tuning is a genuine tradeoff and is often contested. A sensitive breaker opens during ordinary transient noise and creates unnecessary unavailability. A tolerant breaker absorbs so much failure that it never trips before the caller has already exhausted its resources. Practitioners disagree about whether breakers belong in application code, in a client library, or in a service mesh or proxy layer.
Key points
- Three states: closed, open, and half open.
- Trips on error rate over a rolling window, not raw counts.
- Fails fast so the caller does not exhaust threads or connections.
- Reduces load on a dependency that is trying to recover.
- Threshold tuning trades false trips against slow protection.
In practice
An agent uses a search tool backed by a third party API. The API starts returning server errors, and within a minute the error rate over the rolling window passes fifty percent, so the breaker opens. Subsequent search calls fail instantly with a clear message, letting the agent fall back to cached documents and continue the task. Two minutes later the breaker sends three probe calls, they succeed, and normal search traffic resumes.