The order-management layer, and the state it must not lose

Graduate · enrolled learners

This lesson opens with The BATS IPO, 23 March 2012.

What happened

BATS, an electronic exchange, listed its own shares on its own exchange, and a single-line bug in its new IPO auction software sent the matching engine for ticker symbols A to BFZZZ into an infinite loop, making them inaccessible on BATS; its own stock fell from 16 dollars to 0.02 cent as it started changing hands, and erroneous prints in Apple, which the glitch played a role in, triggered a five-minute circuit-breaker halt. The matching engine is the component that tracks which orders exist and pairs them into trades. BATS voided every trade in its own shares and the Apple prints, but voiding trades did not restore the market: it judged that the failure and the delay in fixing it had eroded investor confidence and made a timely return to fair and orderly trading unlikely, so it took the extraordinary step of withdrawing its own initial public offering entirely. Nothing was hacked and no key was stolen; the order-management and matching layer mishandled an edge case its months of testing had not reached, and put the market into a state the firm could not promptly restore. The exchange had working capital, a real business, and a valid offering, and it was undone by the one component whose job was to keep an accurate record of orders and fills.

The decision point

The order-management layer is the part of a trading system that holds its most important state, the record of which orders exist, which are live, and which have filled, and a defect there does not produce a merely wrong number that can be corrected, it produces a corrupted state that the system may be unable to reconcile or reverse. BATS is the case: a matching-engine bug froze trading in its own stock, which fell to 0.02 cent, and although the trades were voided the exchange could not promptly restore fair and orderly trading and withdrew its IPO, an offering-ending outcome from a single component's mishandling of an edge case. This is why, in trading-systems engineering, the order layer is not one module among many but the core: everything else, strategy, risk, reporting, depends on the order layer's record being correct, so an error there propagates into every decision built on it and can reach a state from which there is no clean recovery. The mental model is that orders and fills are state, not just messages, and state that is corrupted can be unrecoverable, unlike a display that can simply be refreshed. So the discipline is to treat the correctness of the order-management layer, and the reconciliation that proves its record matches reality, as the foundation of the whole system, tested against edge cases and adversarial inputs before anything is trusted to it, because BATS showed that a firm can have every other thing right, the capital, the strategy, the business, and still be sunk by the one layer whose job is to know, accurately and recoverably, what it has actually done.

Orientation and Year One are open: anyone can read them without an account. From Year Two onward the lessons are for enrolled learners, because progress through the later years only means anything if it is tracked against a record.

It is free. We do not sell the list and there is nothing to buy at the end of it.