System Circuit Breaker Explained: Concepts, State Machine, Frameworks & Interview Tips

Interview Focus

Stability awareness : interviewers look for a mindset that the system can fail at any time. Avalanche effect : understanding why a downstream failure can drag down the whole call chain. Principle depth : knowing the circuit‑breaker state machine (Closed → Open → Half‑Open). Framework implementation : being able to explain the positioning and differences of Hystrix, Sentinel and Resilience4j.

Core Answer

Definition : A circuit breaker is a self‑protective mechanism that, when a downstream service becomes faulty or slow and a configured threshold is reached, automatically “trips” and rejects or degrades calls for a period, preventing the fault from propagating through the call chain.

Analogy: like a household fuse that blows when current exceeds the limit, then is manually reset after repair. The circuit breaker also attempts automatic “test‑close” to recover.

Mechanism Comparison

Rate Limiting : controls request volume to avoid overload; triggers on QPS or concurrency thresholds; comparable to a ticket gate at a scenic spot.

Circuit Breaker : cuts off calls to a failing downstream service; triggers on failure‑rate or slow‑call‑ratio thresholds; comparable to a fuse blowing.

Fallback (Degradation) : executes alternative logic when the main flow cannot proceed; triggers on circuit‑breaker open, timeout, exception, etc.; comparable to an aircraft’s emergency landing.

Avalanche Effect

Scenario: a notification service hangs, response time jumps from 50 ms to 30 s. Payment service threads wait on each call, exhausting its thread pool; new payment requests cannot obtain threads; order service cannot call payment service, exhausting its pool; gateway requests pile up, leading to a full‑chain collapse. Without a circuit breaker, the fault spreads exponentially.

Circuit Breaker State Machine

Closed : normal operation; requests pass through while the breaker records success/failure statistics.

Open : when the failure rate exceeds a configured threshold (e.g., >50 %), the breaker trips; all requests are immediately failed without network calls, usually invoking fallback logic.

Half‑Open : after a wait period (e.g., 5 s), a small number of trial requests are allowed. If they succeed, the breaker returns to Closed; if they fail, it goes back to Open.

The breaker can self‑heal because the Half‑Open state automatically probes the downstream service.

Framework Comparison

Hystrix (Netflix): early default in Spring Cloud, now in maintenance mode.

Resilience4j (Community): active, lightweight, built on Java 8 functional programming, recommended as a Hystrix replacement.

Sentinel (Alibaba): active Apache top‑level project, integrates circuit breaking, rate limiting and system adaptive protection, provides a visual dashboard and dynamic rule push.

Selection advice : for new projects use Sentinel (full features, good console) or Resilience4j (lightweight, Spring Boot‑friendly). Hystrix is legacy but still appears in interviews.

Sentinel Code Example

// 1. Define circuit‑breaker rules
private static void initCircuitBreakerRule() {
    List<DegradeRule> rules = new ArrayList<>();
    // Slow‑call ratio rule: response > 200 ms is slow
    DegradeRule slowCallRule = new DegradeRule("orderService")
        .setGrade(CircuitBreakerStrategy.SLOW_REQUEST_RATIO.getType())
        .setCount(200) // slow‑call threshold (ms)
        .setSlowRatioThreshold(0.5) // 50 % slow calls
        .setMinRequestAmount(5) // at least 5 requests
        .setStatIntervalMs(10_000) // 10 s window
        .setTimeWindow(5); // break for 5 s
    // Exception‑ratio rule: >50 % exceptions triggers break
    DegradeRule exceptionRule = new DegradeRule("orderService")
        .setGrade(CircuitBreakerStrategy.ERROR_RATIO.getType())
        .setCount(0.5)
        .setMinRequestAmount(5)
        .setStatIntervalMs(10_000)
        .setTimeWindow(5);
    rules.add(slowCallRule);
    rules.add(exceptionRule);
    DegradeRuleManager.loadRules(rules);
}

// 2. Business code wrapped with try‑with‑resources
public Order getOrder(String orderId) {
    try (Entry entry = SphU.entry("orderService")) {
        // call downstream service
        return orderClient.query(orderId);
    } catch (BlockException e) {
        // circuit‑breaker or rate‑limit triggered, fallback
        return getFallbackOrder(orderId);
    }
}

// 3. Fallback method
private Order getFallbackOrder(String orderId) {
    Order cached = orderCache.get(orderId);
    return cached != null ? cached : Order.defaultOrder();
}

Key Parameters Explained

setCount

: threshold value – response time (ms) for slow‑call mode or error ratio (0‑1) for exception mode. setMinRequestAmount: minimum sample size; prevents a tiny number of failures from tripping the breaker (commonly ≥5). setStatIntervalMs: statistics window length. setTimeWindow: duration the breaker stays in Open state before entering Half‑Open.

Hystrix Bucket Statistics

Hystrix uses a sliding window divided into buckets (default 10 buckets, 1 s each). Each bucket records success/failure counts; the recent 10 buckets are summed to compute the failure rate. This design saves memory but loses some precision.

High‑Frequency Interview Questions

Difference between circuit breaker and fallback? Circuit breaker is the trigger mechanism based on failure thresholds; fallback is the downstream handling logic executed after the trigger.

How does Half‑Open work? After the Open period, a few trial requests are allowed. Success switches the breaker back to Closed; failure returns it to Open.

Why need a minimum request count? To avoid false trips during cold start or transient spikes; a small sample (e.g., 2 failures out of 2 requests) should not open the circuit.

Core differences between Sentinel and Hystrix? Sentinel integrates rate limiting and adaptive protection, uses a more granular sliding window (LeapArray), provides a visual dashboard and dynamic rule push; Hystrix focuses mainly on circuit breaking with static configuration.

Memory Mnemonic

Three states – Two triggers – One self‑heal : Closed, Open, Half‑Open; triggers are failure‑rate and slow‑call‑ratio; Half‑Open automatically probes recovery.

Conclusion

Circuit breaker is the “fuse” of distributed systems: it quickly cuts off calls to a faulty downstream service, protects upstream availability, and automatically attempts recovery. The three core interview points are the avalanche effect, the three‑state state machine, and the differences among Hystrix, Sentinel and Resilience4j. Demonstrating a Sentinel or Resilience4j demo in an interview solidifies the answer.