Mastering Service Degradation and Circuit Breaker in Microservices

Introduction

Many developers confuse service degradation with circuit breaking in microservice design. This article aims to clear up that confusion by explaining each concept, their relationship, and practical implementation details.

Service Avalanche

A service avalanche happens when a failure in one service propagates through the call chain, causing downstream services to become unavailable. The following diagram illustrates the cascade:

When Service A experiences high traffic spikes, it may still handle requests, but downstream Service B and Service C might not, leading to thread exhaustion and eventual unavailability of the entire chain.

Service Circuit Breaker

A circuit breaker stops calling an unhealthy downstream service to protect the upstream service's stability. It typically follows the circuit breaker pattern (closed → open → half‑open → closed). The state transitions are:

Start in closed state; on reaching an error threshold, switch to open.

After a reset timeout, move to half open to test the downstream service.

If the test succeeds, return to closed.

Popular implementations include Alibaba Sentinel and Netflix Hystrix. A typical Hystrix configuration is:

// sliding window size, default 20
circuitBreaker.requestVolumeThreshold
// time to wait before retry, default 5000 ms (5 s)
circuitBreaker.sleepWindowInMilliseconds
// error rate threshold, default 50%
circuitBreaker.errorThresholdPercentage

When 50% of 20 requests fail, the circuit opens, causing immediate failure responses until the timeout expires.

Service Degradation

Degradation is a fallback strategy used when a downstream service is slow or unavailable. Two common scenarios are:

When a downstream service responds slowly, the upstream service can disable non‑essential features to free resources.

When a downstream service is unavailable, the upstream service executes local fallback logic to quickly respond.

Degradation can be implemented via switches, rate limiting, or circuit breaking. In practice, circuit breaking is a specific form of degradation.

Simple Code Example

The following upstream code demonstrates a try‑catch fallback:

try {
    // call downstream helloWorld service
    xxRpc.helloWorld();
} catch (Exception e) {
    // circuit breaker prevented the call; execute fallback
    doSomething();
}

When the downstream service is blocked by a circuit breaker, the catch block runs the degradation logic.

Switch‑Based Degradation

In production, a common approach is to control degradation via feature switches stored in a configuration center. Changing the switch enables or disables certain functionalities without redeploying code.

Key steps for manual degradation include:

Identify core vs. non‑core business flows and add switches to non‑core flows.

Disable secondary features when the system is under pressure.

Reduce consistency requirements by converting synchronous calls to asynchronous or strong consistency to eventual consistency.

Automatic degradation is not covered in this article, but a possible approach involves setting failure thresholds, monitoring interfaces (e.g., with RxJava), and updating configuration centrally to trigger fallback behavior.