The CircuitBreaker is used to provide stability and prevent cascading failures in distributed systems.

Purpose

As an example, we have a web application interacting with a remote third party web service. Let's say the third party has oversold their capacity and their database melts down under load. Assume that the database fails in such a way that it takes a very long time to hand back an error to the third party web service. This in turn makes calls fail after a long period of time. Back to our web application, the users have noticed that their form submissions take much longer seeming to hang. Well the users do what they know to do which is use the refresh button, adding more requests to their already running requests. This eventually causes the failure of the web application due to resource exhaustion. This will affect all users, even those who are not using functionality dependent on this third party web service.

Introducing circuit breakers on the web service call would cause the requests to begin to fail-fast, letting the user know that something is wrong and that they need not refresh their request. This also confines the failure behavior to only those users that are using functionality dependent on the third party, other users are no longer affected as there is no resource exhaustion. Circuit breakers can also allow savvy developers to mark portions of the site that use the functionality unavailable, or perhaps show some cached content as appropriate while the breaker is open.

How It Works

The circuit breaker models a concurrent state machine that can be in any of these 3 states:

1. Closed: During normal operations or when the CircuitBreaker starts
   • Exceptions increment the failures counter
   • Successes reset the failure count to zero
   • When the failures counter reaches the maxFailures count, the breaker is tripped into Open state
2. Open: The circuit breaker rejects all tasks with an ExecutionRejectedException
   • all tasks fail fast with ExecutionRejectedException
   • after the configured resetTimeout, the circuit breaker enters a HalfOpen state, allowing one task to go through for testing the connection
3. HalfOpen: The circuit breaker has already allowed a task to go through, as a reset attempt, in order to test the connection
   • The first task when Open has expired is allowed through without failing fast, just before the circuit breaker is evolved into the HalfOpen state
   • All tasks attempted in HalfOpen fail-fast with an exception just as in Open state
   • If that task attempt succeeds, the breaker is reset back to the Closed state, with the resetTimeout and the failures count also reset to initial values
   • If the first call fails, the breaker is tripped again into the Open state (the resetTimeout is multiplied by the exponential backoff factor)

Usage

import monix.catnap._
import scala.concurrent.duration._

// Using cats.effect.IO for this sample, but you can use any effect
// type that integrates with Cats-Effect, including monix.eval.Task:
import cats.effect.{Clock, IO}
implicit val clock: Clock[IO] = Clock.create[IO]

// Using the "unsafe" builder for didactic purposes, but prefer
// the safe "apply" builder:
val circuitBreaker = CircuitBreaker[IO].unsafe(
  maxFailures = 5,
  resetTimeout = 10.seconds
)

//...
val problematic = IO {
  val nr = util.Random.nextInt()
  if (nr % 2 == 0) nr else
    throw new RuntimeException("dummy")
}

val task = circuitBreaker.protect(problematic)

When attempting to close the circuit breaker and resume normal operations, we can also apply an exponential backoff for repeated failed attempts, like so:

val exponential = CircuitBreaker[IO].of(
  maxFailures = 5,
  resetTimeout = 10.seconds,
  exponentialBackoffFactor = 2,
  maxResetTimeout = 10.minutes
)

In this sample we attempt to reconnect after 10 seconds, then after 20, 40 and so on, a delay that keeps increasing up to a configurable maximum of 10 minutes.

Sync versus Async

The CircuitBreaker works with both Sync and Async type class instances.

If the F[_] type used implements Async, then the CircuitBreaker gains the ability to wait for it to be closed, via awaitClose.

Retrying Tasks

Generally it's best if tasks are retried with an exponential back-off strategy for async tasks.

import cats.implicits._
import cats.effect._
import monix.execution.exceptions.ExecutionRejectedException

def protectWithRetry[F[_], A](task: F[A], cb: CircuitBreaker[F], delay: FiniteDuration)
  (implicit F: Async[F], timer: Timer[F]): F[A] = {

  cb.protect(task).recoverWith {
    case _: ExecutionRejectedException =>
      // Sleep, then retry
      timer.sleep(delay).flatMap(_ => protectWithRetry(task, cb, delay * 2))
  }
}

But an alternative is to wait for the precise moment at which the CircuitBreaker is closed again and you can do so via the awaitClose method:

def protectWithRetry2[F[_], A](task: F[A], cb: CircuitBreaker[F])
  (implicit F: Async[F]): F[A] = {

  cb.protect(task).recoverWith {
    case _: ExecutionRejectedException =>
      // Waiting for the CircuitBreaker to close, then retry
      cb.awaitClose.flatMap(_ => protectWithRetry2(task, cb))
  }
}

Be careful when doing this, plan carefully, because you might end up with the "thundering herd problem".

Credits

This Monix data type was inspired by the availability of Akka's Circuit Breaker.