Cascade Circuit Breaker¶
Control device — instantiates Cascade Pathway Management
Trips a chosen link fully open the instant a danger threshold is crossed, halting propagation under pre-authorized automatic control before anyone can deliberate.
A Cascade Circuit Breaker is a standing device that watches one link for a pre-set danger threshold and, the moment that threshold is crossed, fully severs the link — no throttling, no partial flow, no human in the loop. Its defining property is the hard, all-or-nothing trip under pre-delegated authority: the decision to cut has already been made and encoded, so the breaker fires at machine speed when a cascade would otherwise outrun deliberation. It borrows its name and its logic from the electrical breaker that snaps a circuit open before an overload can burn the wiring. It is not a monitor that warns and it is not a valve that dials flow down; it is a switch that goes from closed to open at a threshold, and it works precisely because that switch requires no meeting.
Example¶
A stock exchange faces a day of violent selling. If prices are allowed to fall unchecked, forced-sale programs will trigger more selling, which drives prices lower, which triggers still more forced selling — a self-feeding downward cascade that can outrun any human decision to intervene. The exchange's market-wide circuit breaker is the standing device that cuts the loop. It is wired to a single threshold: if the benchmark index falls 7% from the prior close, trading halts across the whole market for fifteen minutes.[1]
Nobody convenes to decide this. The rule, the threshold, and the authority to halt are all encoded in advance; when the index prints below the trip line, the halt fires automatically. During the pause, the forced-sale feedback is physically broken — orders cannot execute, so falling prices cannot mechanically manufacture the next wave of selling. A second, deeper threshold (13%) triggers a longer halt, and a third (20%) closes the market for the day. The breaker does not decide whether the sell-off is justified; it simply guarantees that propagation cannot continue past a hard line while humans catch up.
How it works¶
- One link, one trip line. The breaker is bound to a specific transfer link and a specific threshold on a specific observed variable; below the line it is inert, above it it fires.
- The cut is total and pre-authorized. When the threshold is crossed the link is opened fully and immediately, exercising authority that was delegated to the device ahead of time so no real-time approval is needed.
- Staged trip levels. Deeper thresholds trigger progressively harder responses (longer halt, wider scope), matching the severity of the cut to how far past the danger line the system has gone.
- Defined re-close. The breaker specifies how and when the link is restored — after a fixed cooldown, or on an explicit human reset — so a trip is a pause with an exit, not a permanent amputation.
Tuning parameters¶
- Trip threshold — how far the observed variable must move before the breaker fires. A tight threshold trips early and often (protective but disruptive and prone to false trips); a loose one trips late (fewer interruptions but risks firing after the cascade has already spread).
- Halt duration / cooldown — how long the link stays open once tripped. Longer halts give the system more time to settle but impose more cost on whatever the severed link was carrying.
- Trip-level staging — how many escalating thresholds to define and how far apart. More levels give graduated response; too many create complexity and ambiguous overlaps.
- Reset authority — whether the breaker re-closes automatically or requires a named human to arm it again. Auto-reset restores service fast; manual reset guards against re-tripping into an unresolved condition.
When it helps, and when it misleads¶
Its strength is speed under pre-committed authority: it acts in the window where a cascade moves faster than any deliberation could, and it acts the same way every time, immune to the hesitation and second-guessing that let real chains run. Because the trip line and the authority are fixed in advance, there is no argument to have while the system burns.
Its failure mode is that a hard cut is blunt. A breaker set too tight trips on noise and becomes a nuisance that operators learn to override or disable; set too loose, it fires after the damage has already propagated — the archetype's late breakpoint placement failure. And a full severance can itself cause harm: halting trading freezes participants who needed to exit, just as tripping a grid segment can black out customers who were never at risk. The classic misuse is installing a breaker without a plan for the cut's collateral cost, so the cure inflicts a shock of its own. The guarding discipline is to size the threshold against real propagation data, stage the trip levels, and pair every breaker with a defined, bounded re-close so a protective pause never hardens into an outage.
How it implements the components¶
cascade_breakpoint_set— the breaker is an installed breakpoint: the point on the pathway where the link is designed to be severed on command.threshold_and_amplification_profile— its trip line is a threshold read off the amplification profile, chosen to fire just before propagation turns nonlinear.response_authority_map— it embodies pre-delegated authority: the right to cut is assigned to the device in advance so no live approval is needed.
It does not decide where a breakpoint should sit — that analysis is Dependency Cut-Set Review, which owns the counter_cascade_safety_gate placement logic. And unlike its nearest twin Rate-Limit or Quarantine Gate, it holds no damping_or_buffer_capacity: the breaker trips a link fully open, whereas the gate throttles flow while keeping the link partly alive — total severance versus continuous restriction is the line between them.
Related¶
- Instantiates: Cascade Pathway Management — the breaker is the archetype's hard-stop control, installed where the pathway map says a full cut belongs.
- Consumes: Dependency Cut-Set Review tells the breaker which link to sit on.
- Sibling mechanisms: Rate-Limit or Quarantine Gate · Beneficial Cascade Seeding Plan · Cascade Dependency Graph · Consequence Cascade Workshop · Domino Tabletop Exercise · Leading-Link Indicator Dashboard · Propagation Simulation or Fault Injection
Editorial Notes¶
Form Classification¶
Form family: Control, Automation & Runtime
Rationale: Trips a chosen link fully open the instant a danger threshold is crossed, halting propagation under pre-authorized automatic control before anyone can deliberate, making its operative form a live operational control that automatically routes, enforces, adapts, or responds during execution.
Independent corroboration: The frozen evidence defines Cascade Circuit Breaker as 'Trips a chosen link fully open the instant a danger threshold is crossed, halting propagation under pre-authorized automatic control before anyone can deliberate', so its operative form is Control, Automation & Runtime.
Review outcome: Independent reviewer agreement; high confidence.
Origin Attribution¶
Primary origin: Engineering & Design
Origin pattern: Convergent development
Present-day reach: Multi-domain
Rationale: Electrical protection engineering cohered the circuit breaker as a threshold-triggered device that opens a link to stop damaging propagation.
Related originating lineages:
- Computer Science & Software Engineering — Resilience engineering short-circuits calls to failing dependencies to prevent cascading resource exhaustion.
- Economics & Finance — Securities markets adapted circuit breakers as automatic trading halts against self-reinforcing selloffs.
Review resolution: Electrical engineering provides the circuit-breaker lineage, while software fault tolerance and financial market halts developed genuine domain-specific forms of the same propagation-stopping intervention. Convergent multi-domain classification best captures the documented lineages despite uncertain priority among generalized uses.
Attribution caveat: Electrical, market, and software circuit breakers share the name and propagation-halting structure across distinct implementations.
Review outcome: Reconciled after independent review; high confidence.
References¶
[1] Market-wide circuit breakers — the exchange rule (in the US, tied to S&P 500 declines of 7%, 13%, and 20%) that halts all trading for a set period once the index falls past a threshold. Introduced in the wake of the 1987 crash precisely to break self-feeding sell-offs, they are the canonical real-world cascade breaker. withdrawn registry ↩