The Circuit Breaker Pattern
A small state machine that sits in front of a flaky dependency, stops hammering it once failures pile up, and lets it recover — turning a slow cascade into a fast, contained failure.
TL;DR
Wrap a remote call in a breaker with three states. Closed: traffic flows and failures are counted. Cross the failure threshold and it trips to Open, where every call fails fast with no wait. After a cooldown it moves to Half-Open and lets a single trial request through — success closes the breaker, failure re-opens it.
The state machine
Three states, four transitions. The badges below trace the calm happy-path loop (Closed → Open → Half-Open → Closed); the diagram is the full structural reference.
Walk it through, step by step
Breaker is now
Tip: use ← / → arrow keys, the dots, or auto-play. The diagram above highlights the matching state.
Why it matters
Stops the cascade
A slow dependency ties up threads and connections until the caller falls over too. Opening the breaker cuts the rope before the failure spreads upstream.
Fails in milliseconds
While Open, calls return instantly instead of waiting out a 30-second timeout. Users get a quick error or a fallback, not a hung spinner.
Lets it heal
The cooldown gives the struggling service breathing room, and Half-Open probes gently — one request, not a thundering herd — so recovery is tested without re-overloading it.
Error rate over time
Errors climb past the 50% threshold (dashed line); the breaker trips Open, traffic stops hitting the dependency, and after the cooldown a Half-Open probe confirms recovery — then the rate settles back down.
| t (s) | Error rate % | Breaker |
|---|
Glossary
- Failure threshold
- The count or percentage of failures within a window that trips the breaker from Closed to Open (e.g. 50% over the last 20 calls).
- Half-open
- A probing state. After the cooldown the breaker lets one trial request through to test recovery, then closes (success) or re-opens (failure).
- Fail-fast
- Returning an error immediately rather than waiting on a call that is almost certain to fail, freeing resources for healthy work.
- Cooldown / reset timeout
- How long the breaker stays Open before allowing a probe — long enough for the dependency to recover, short enough to retry promptly.