Circuit breaker
A circuit breaker stops calls to a dependency that keeps failing. In the mini board it opens within 1 s and rejects each call for almost no CPU, instead of 5 ms of checkout work. A long window opens it late, and a long cooldown keeps it open after the API returns.
See it on the board
The same traffic runs on two boards. The simulator measured both when this page was built.
| Measure | Goal | Every call goes to the failing API | Breaker opens after 1 s |
|---|---|---|---|
| p99 latency | under 700 ms | 6.8 s Fail | 544 ms Pass |
| Availability | at least 65% | 71.4% Pass | 70.9% Pass |
| Monthly cost | 8 USD/mo | 12 USD/mo | |
| Error rate | 28.6% | 29.1% |
Key numbers
| Number | Value |
|---|---|
| Default breaker window | 10 s |
| Default breaker cooldown | 30 s |
| Default failure share that opens the breaker | 0.5 ratio |
3 of 3 up · availability 99.9999%
How it works
A call to a broken dependency is not free. The caller sends the request, waits, and does some work before it finds out that the call failed. When shoppers tap Pay again, the load doubles, and the caller spends its CPU on calls that cannot work.
A circuit breaker watches the calls. When the share of failures in a time window passes a threshold, the breaker opens. While it is open, calls fail at once, without waiting and with almost no CPU. After a cooldown the breaker lets a few test calls through. If they work, it closes. If not, it opens again.
In the mini board the payment API is down from 0:20 to 0:35. Checkout traffic doubles, and each call costs 5 ms of CPU. A breaker with a 1 s window and a 5 s cooldown opens within a second and then rejects calls cheaply. Checkout p99 stays under 700 ms, and availability stays at 65 percent or more.
The settings matter. A long window opens the breaker late, after the damage. A long cooldown keeps it open after the API returns, so you lose good calls. A threshold that is too low opens it on normal noise.
An open breaker needs a plan: show a clear message, use a fallback, or queue the work.
In the levels you place a breaker in front of the failing call and tune its window and cooldown.