As you say, only one instance is shared between simultaneous requests, so everything must be passed as function parameters.

What are they trying to do? In the grand scheme of things, business services are meant to be provided by something else, such as an EJB server. Servlets aren't supposed to do too much. Yes, I know that's a lame excuse and they could use instance pooling, much like EJB.

You're not supposed to use instance or static variables. Use the getAttribute() and setAttribute() from ServletContext for application wide, HttpSession for session wide and HttpRequest when passing control to another servlet.