Fable
The same building, two different response manuals
For a mixed-use commercial complex in the city center, the operations team has two emergency manuals. The first manual governs external passages: if a smoke alarm occurs in the corridor leading to the subway station, immediately close the corridor gate and stop directing passenger flow in that direction. The standard for lowering the gate is clear—three consecutive smoke sensor triggers, or one manually confirmed fire alarm. After the gate closes, there is no more testing until the fire inspection is complete and it is reopened.
The second manual covers internal services: if power capacity suddenly drops by forty percent, not all areas lose electricity. First turn off landscape lighting, advertising screens and backup elevators, and prioritize the checkout system, refrigeration equipment and escape route lighting. Which functions to give up first and which must be preserved are prioritized in advance.
Once an air conditioning system failure caused the floor temperature to soar. The operations team triggered two actions at the same time: the floor's fire monitoring data began to show anomalies, but it had not reached the smoke alarm threshold, so the gates did not close. Meanwhile, because the air conditioning compressor overload affected overall power supply stability, the operations team shut down half the advertising screens and all the landscape fountains, bringing the load down. The two things happened on the same day but were executed under different manuals.
In the after-action review, a newly arrived supervisor raised a question: in the air-conditioning failure, since the abnormal temperature was already known, why not directly close the entrance gates on the relevant floors as well? The old supervisor explained: whether to close a gate depends on the sensor at the other end of the passage, not on the thermometer on this side of the building. If everything is normal at the subway station end, closing the gate will only squeeze passenger flow up to the street intersection and create new congestion. A circuit breaker protects the question of whether that dependency is still worth calling, not whether I feel uncomfortable and should cut it off first.
Misunderstandings also arose in the other direction. Once the advertising screen system went down on its own, and someone suggested initiating degradation—cutting peripheral systems to save resources. But the advertising screen itself is a non-core function; its failure does not affect checkout or the cold chain, so degradation was unnecessary. The basis for a degradation decision is the supply capacity of core resources, not shutting down other systems whenever any system has a problem.
Later they drew a flow chart on the wall: external dependency fails → circuit breaker evaluates → cut the call to prevent a cascading avalanche. Internal resources run tight → degradation strategy evaluates → shut down non-core features to preserve core business throughput. The two paths each have their own trigger conditions and evaluation metrics, but when they land on the same incident report form, it must be marked which one was triggered.
The building manager summed it up bluntly at the quarterly training: a circuit breaker closes a door to the outside, fearing fire from the other side. Degradation reduces internal load, fearing your own power is insufficient. Both actions can be called "protection," but they protect completely different things.