The kill switch that stops it faster than a human

Graduate · enrolled learners

This lesson opens with Infinium Capital Management, February 2010.

What happened

Infinium deployed a new automated trading program to trade a crude-oil fund, and the program had not been fully tested before it went live. Within its first seconds of operation it malfunctioned and sent roughly 6,767 orders in about two seconds, a torrent no human could have kept up with, disrupting the market before anyone could intervene, and the firm was later penalized by the CFTC around 850,000 dollars. There was no effective kill switch: no automated limit that noticed the program was doing something impossible, thousands of orders in seconds, and halted it on its own. So the runaway algorithm ran until a person could understand what was happening and stop it by hand, which on the timescale of an algorithm firing thousands of orders per second is an eternity. Nothing was hacked; a not-fully-tested system malfunctioned at machine speed, and the humans meant to supervise it were, by the nature of the speeds involved, far too slow to be the safety mechanism.

The decision point

An automated trading system acts at machine speed, so when it malfunctions it does so at machine speed too, firing thousands of orders in the time it takes a human to notice something is wrong, which means a human supervisor cannot be the safety mechanism for a runaway algorithm and only another piece of automation, a kill switch and automated risk limits, is fast enough to stop it. Infinium is the case: an untested program sent about 6,767 orders in two seconds with no automated limit to halt it, so it ran until a person could intervene by hand, long after the damage was done. This is the core of live-risk engineering: the same speed that makes automation valuable makes its failures uncontrollable by humans, so the system must be able to stop itself, through pre-set limits on order rate, size, and position that trip automatically, and a kill switch that halts trading the instant those limits are breached. A system whose only brake is a human watching a screen is a system with no brake at the speeds it operates at, because by the time the human reacts the algorithm has already done thousands of things. So the discipline is to build the safety into the system itself: automated risk limits that define what the system is never allowed to do, a kill switch that fires faster than a person can, and the assumption that the algorithm will one day malfunction and must be stopped by something as fast as it is. Infinium is what a runaway algorithm does when the only thing that can stop it is a human: it wins the race, because at machine speed the human was never in the race at all.

Recorded loss

$850,000

Orientation and Year One are open: anyone can read them without an account. From Year Two onward the lessons are for enrolled learners, because progress through the later years only means anything if it is tracked against a record.

It is free. We do not sell the list and there is nothing to buy at the end of it.