What is a circuit breaker in software, and when do you need one?

How does a circuit breaker work?

It has three states. While closed, calls go through and failures are counted. When failures pass a threshold it opens, and calls fail immediately. After a wait it goes half-open, lets a few trial calls through, and closes again if they succeed.

Why not just retry?

Immediate retries from many callers multiply the load on a struggling service and can stop it recovering. A breaker limits that, and retries should also use exponential backoff with some random jitter.

What else belongs with it?

Timeouts, so no call waits forever, and bulkheads, which isolate resources so one slow dependency cannot use up everything. A fallback, such as cached data or a reduced feature, gives users something useful while the circuit is open.

How do you choose the settings?

Base the failure threshold, the time window and the wait before trial calls on how the dependency behaves, and test them. Too sensitive and the circuit opens needlessly, too lenient and it protects nothing.

How do you know it works?

Expose the breaker’s state as a metric, alert when it opens, and practise failures in a test environment. A protection that has never been exercised may not work when you need it.

IICTP is an independent technical credentialing body.