Circuit breaker

A hung dependency does not fail loudly; it fails slowly, by timing out, and every caller absorbs the full timeout before it learns anything. A circuit breaker watches the recent failure share, and past a threshold stops sending traffic at all - calls fail fast against the breaker instead of waiting on the dependency - while the breaker periodically sends a probe to detect recovery. The point is not fewer failures; the point is cheap failures and a bounded blast radius.

In AI serving the dependency being protected is a provider that can degrade without notice, so the breaker is paired with a fallback ladder: retries with backoff first, then a smaller or older model, then a cached reply - ordered so users meet slow before they meet gone. The breaker decides when to leave the primary rung, and the ladder decides where to land. Without the ladder, a breaker is just a faster error message.

The reporting matters as much as the trip. A breaker that fails 90 of 100 calls over to a cached reply has kept the feature up, and the report that says so honestly - which share rode which rung - is what makes the design sustainable, because a ladder quietly absorbing most traffic is a quality regression wearing an uptime number.

A provider hangs, then recovers after a while. Each call against it would otherwise wait out a 30-second timeout. With a breaker, 10 calls trip it and the next 90 fail fast to a cached reply answered in 50 ms.

1. No breaker: 100 calls x 30 s = 3,000 s of cumulative user-visible wait, and every answer is an error after the wait.
2. With the breaker: 10 calls x 30 s = 300 s of wait before the trip, then 90 calls x 0.05 s = 4.5 s - a 3,300-fold drop in total wait across the same incident.
3. The trade named plainly: 90 of 100 answers came from a cache instead of the model, and the availability report should say so.

3,000 s of cumulative wait becomes about 300 s plus 4.5 s, with 90 answers served from the fallback rung - the breaker converts dead waits into cheap, honest answers.

Where this shows up

• Serving AI ReliablyThe AI feature launched ten days ago and is the quietest thing you operate: the dashboard is a strip of green graphs, no complaints, nothing shipped this week. Then at 3am something changes, and running this feature is different because the dependency is a model you neither wrote nor can restart: a provider answers your users, and the provider can change its capacity, its pricing, or the model itself without telling you. So the board grows meters that watch the call rather than your code. p95 latency, the wait that 95 of every 100 requests stay under, catches a capacity squeeze that the median wait, p50, smooths right over. The error share catches a rate limit, a provider ceiling on how many calls fit in a minute that a launch surge can trip with zero code changes. Daily spend catches a prompt edit that quietly broke the prefix cache, the discount a provider grants while your requests resend the same opening text. And an eval set, a small fixed list of prompts with expected answers that your code reruns on a schedule, catches the scariest one: a silent quality drop after the provider swapped the model, the failure users notice and no latency meter ever blinks. What you do about it is the fallback ladder, an ordered list of answers to serve while the model misbehaves: retries with backoff first, then a smaller or older model, then a cached reply, ordered so the user meets slow long before they ever meet gone. Pinning, writing the exact model version into your config instead of floating on the provider default, is what turns a swap back into a rollback. Interviewers ask what you watch and what you do at 3am: a specific ladder is the answer of someone who ran a live AI feature, and we would monitor things is the answer of someone who has not. The three challenges below grade exactly that: the order you triage a crowded alert board in, the p95 and eval math that tells you to roll a model version back, and the share counters that say whether the ladder is holding.
• Design ChatGPT: Tiers & Rate LimitsDesign ChatGPT is the most-cited systems design question at AI companies, and it is really one question: when everyone arrives at once, who gets served, who waits, and who is told no, all without the paying tier ever noticing. The answer interviewers grade against has three parts. First, three pools: a small provisioned pool whose cards exist for one tier only, a larger shared pool where paid requests carry priority over free ones, and the queue itself, which lives in card memory, not in a message broker. Second, a token-bucket rate limiter at the gateway, held in Redis for atomicity under concurrent writers, that admits free arrivals at a chosen share of demand and reconciles the token count after each grant, so a burst of arrivals is answered instantly without consulting a GPU. Third, shedding: a request refused at the gateway with a 429 costs nothing; the same request admitted into a saturated pool holds an expensive seat and lengthens every wait behind it, which is why the tail wait punishes utilization non-linearly, and why an incident that removes 30% of capacity can turn a 97 millisecond paid wait into an 850 millisecond one. Interviewers test this because every knob in the design is a money or trust decision: renting burst capacity for a launch day, tightening the bucket over a jammed pool, or letting the free tier shed so the subscribers do not notice an outage. The three challenges below work the mechanics: the admit count a token bucket grants, the queue wait the utilization formula quotes, and the shed arithmetic that keeps the shared pool from jamming.

Related terms