The order-management layer, and the state it must not lose

Graduate · enrolled learners

This lesson opens with The BATS IPO, 23 March 2012.

What happened

BATS, an electronic exchange, listed its own shares on its own exchange, and a bug in its matching engine's handling of symbols in a particular alphabetical range caused its own stock to collapse from about 16 dollars to fractions of a cent in under a second, while the same fault produced an erroneous print in Apple that triggered a brief trading halt. The matching engine is the component that tracks which orders exist and pairs them into trades, and once its bug had driven the book into a broken state, BATS could not cleanly undo what had happened, so it took the extraordinary step of withdrawing its own initial public offering entirely. Nothing was hacked and no key was stolen; the order-management and matching layer mishandled an edge case and put the market into a state the firm could not reconcile or reverse. The exchange had working capital, a real business, and a valid offering, and it was undone by the one component whose job was to keep an accurate record of orders and fills.

The decision point

The order-management layer is the part of a trading system that holds its most important state, the record of which orders exist, which are live, and which have filled, and a defect there does not produce a merely wrong number that can be corrected, it produces a corrupted state that the system may be unable to reconcile or reverse. BATS is the case: a matching-engine bug drove its own stock to fractions of a cent and mangled the book so badly that the exchange could not undo the state and withdrew its IPO, a business-ending outcome from a single component's mishandling of an edge case. This is why, in trading-systems engineering, the order layer is not one module among many but the core: everything else, strategy, risk, reporting, depends on the order layer's record being correct, so an error there propagates into every decision built on it and can reach a state from which there is no clean recovery. The mental model is that orders and fills are state, not just messages, and state that is corrupted can be unrecoverable, unlike a display that can simply be refreshed. So the discipline is to treat the correctness of the order-management layer, and the reconciliation that proves its record matches reality, as the foundation of the whole system, tested against edge cases and adversarial inputs before anything is trusted to it, because BATS showed that a firm can have every other thing right, the capital, the strategy, the business, and still be sunk by the one layer whose job is to know, accurately and recoverably, what it has actually done.

Orientation and Year One are open: anyone can read them without an account. From Year Two onward the lessons are for enrolled learners, because progress through the later years only means anything if it is tracked against a record.

It is free. We do not sell the list and there is nothing to buy at the end of it.