The kill switch that stops it faster than a human

Graduate · enrolled learners

This lesson opens with Infinium Capital Management, February 2010.

What happened

On 3 February 2010 Infinium put a new automated strategy, meant to trade an energy-based ETF against crude oil futures, live for the first time; its final version had been written the night before with only one to two hours of back-testing, against a protocol that called for simulated trading and six to eight weeks of back-testing. At about 1:26:28 p.m. it malfunctioned and entered 6,767 one-lot buy orders for crude oil futures in about three seconds, a torrent no human could have kept up with, and within 24 seconds Infinium had bought 4,612 contracts at prices from 76.67 to 77.45 dollars before the remaining 2,155 orders were canceled. Infinium had automated shutdown limits, and they did not fire: its maximum order size limit never tripped because every order was a single lot, and its maximum position limit had been set for the ETF rather than for crude, because the strategy had been configured backwards. So the runaway algorithm ran on with nothing at its own speed to stop it, which on the timescale of an algorithm firing thousands of orders a second leaves a human far too slow. In November 2011 the NYMEX Business Conduct Committee fined Infinium 350,000 dollars for failing to supervise, test and control the system, part of 850,000 dollars in CME Group fines that month. Nothing was hacked; a not-fully-tested system malfunctioned at machine speed, and the humans meant to supervise it were, by the nature of the speeds involved, far too slow to be the safety mechanism.

The decision point

An automated trading system acts at machine speed, so when it malfunctions it does so at machine speed too, firing thousands of orders in the time it takes a human to notice something is wrong, which means a human supervisor cannot be the safety mechanism for a runaway algorithm and only another piece of automation, a kill switch and automated risk limits, is fast enough to stop it. Infinium is the case: a barely tested program sent 6,767 orders in about three seconds and its automated limits, misconfigured, never tripped, so nothing at machine speed halted it and it had bought 4,612 contracts before the rest were canceled. This is the core of live-risk engineering: the same speed that makes automation valuable makes its failures uncontrollable by humans, so the system must be able to stop itself, through pre-set limits on order rate, size, and position that trip automatically, and a kill switch that halts trading the instant those limits are breached. A system whose only brake is a human watching a screen is a system with no brake at the speeds it operates at, because by the time the human reacts the algorithm has already done thousands of things. So the discipline is to build the safety into the system itself: automated risk limits that define what the system is never allowed to do, a kill switch that fires faster than a person can, and the assumption that the algorithm will one day malfunction and must be stopped by something as fast as it is. Infinium is what a runaway algorithm does when the only thing that can stop it is a human: it wins the race, because at machine speed the human was never in the race at all.

Recorded loss

$850,000

Orientation and Year One are open: anyone can read them without an account. From Year Two onward the lessons are for enrolled learners, because progress through the later years only means anything if it is tracked against a record.

It is free. We do not sell the list and there is nothing to buy at the end of it.