Author of fuse here :)<p>What we do in order to make the ideas of load regulation (see <a href="https:&#x2F;&#x2F;github.com&#x2F;jlouis&#x2F;safetyvalve" rel="nofollow">https:&#x2F;&#x2F;github.com&#x2F;jlouis&#x2F;safetyvalve</a> or <a href="https:&#x2F;&#x2F;github.com&#x2F;uwiger&#x2F;jobs" rel="nofollow">https:&#x2F;&#x2F;github.com&#x2F;uwiger&#x2F;jobs</a> ) and circuit breakers is that we &quot;prove&quot; them correct by extensive use of property based testing. That is, it is highly unlikely that these tools have errors under production runs because the corner-cases tested for them are far more complex than what a normal program would do.<p>The reason it is nice to have circuit breakers is what Fred touched on in another thread here: you want to gracefully degrade a system, even if parts of it is temporarily down, either due to error or for maintenance. You can thus keep up the processes that are proxying for the underlying cascading dependency, and turn faults into terms of the form `{error, system_unavailable}` which lets you turn an implicit crash into an explicit error path.