Stock Exchange / Order Matching

Single-writer matching. Microsecond budgets.

SavedSaved on this device

The problem

Single-writer matching. Microsecond budgets.

A stock exchange is a deterministic state machine wrapped in microsecond-budgeted I/O. The dominant pattern, popularized by LMAX and now near-universal across NYSE Pillar / Nasdaq INET / CME Globex / Eurex T7, is single-writer matching behind a sequencer that linearizes every event before it touches the book. Everything else — gateways, market data, surveillance, post-trade — exists to make that single thread fast, recoverable, and provably deterministic.

The hard parts:

µs budget end-to-end: NIC ingress to NIC egress p99 < 50 µs across gateway + risk + sequencer + match + MD egress. p99.99 < 150 µs. HFT customers budget tick-to-trade ≤ 10 µs round trip on their side, so any internal regression is detected within minutes.
Determinism: replay the journal six hours later → byte-identical book. No wall clocks, no hash-map iteration order, no allocator dependence, no JIT warmup leaks.
Bit-identical hot-standby: same code, same JVM, same kernel, same NIC firmware. Facebook IPO 2012 shipped a secondary that had the data but ran a slightly different code path — $10M SEC settlement, $62M investor fund. State equality is necessary but not sufficient.
Reg SCI / 15c3-5: pre-trade risk is in the order path, not async. Knight Capital lost $440M in 45 minutes when a feature-flag flip woke 8-year-old dead code and there was no kill switch.
MiFID II RTS 25: ±100 µs UTC traceability for HFT venues. Lose the GPS lock for 4 minutes and you're reportable.

Reading: LMAX Disruptor paper · Martin Fowler — The LMAX Architecture · Aeron Cluster Raft consensus · Nasdaq TotalView-ITCH 5.0 · Nasdaq OUCH 4.2 · SEC Release 34-70694 (Knight Capital) · SEC press release 2013-95 (Nasdaq Facebook IPO) · MiFID II RTS 25 (clock synchronisation) · SEC Rule 613 / CAT NMS Plan · CFTC-SEC Joint Report on the May 6, 2010 Flash Crash

single-writer principle
deterministic state machine
Aeron Cluster / Raft sequencer
LMAX Disruptor
kernel bypass (Solarflare/OpenOnload, ef_vi)
ITCH / OUCH / FIX 5.0 SP2 / SBE
PTP IEEE 1588v2 + GPS grandmaster
Reg SCI / SEC 15c3-5 pre-trade risk
MiFID II RTS 25 timestamp tolerance
CAT (Consolidated Audit Trail) reporting
drop-copy / clearing replication
kdb+/q tick capture
auction cross / continuous transition
bit-identical hot-standby failover

01Clarifications

What would you ask before drawing a single box?

Ambiguity you would resolve with the interviewer: scope, scale, who uses it, what counts as done.

About Stock Exchange / Order Matching

Single-writer matching. Microsecond budgets.

Difficulty: advanced
Time: about 50 minutes
Stages: 10
Topic: Transactions, Concurrency & Money

How this problem is worked

Ten stages, from the questions you would ask an interviewer to the trade-offs you would defend. Each asks one question, and the simulator runs the architecture you draw against the requirements you wrote.

01ClarificationsWhat would you ask before drawing a single box?
02Functional reqsWhat must this system actually do?
03Non-functionalWhat must it promise about speed, uptime and correctness?
04Capacity estimationHow much load and data does this have to hold?
05API designWhat does the outside world call, and what comes back?
06Data modelWhat gets stored, and what is it looked up by?
07Use-case breakdownHow does each requirement actually get served?
08High-level designWhich components handle a request, and in what order?
09Deep divesWhich part breaks first, and what do you do about it?
10Trade-offsWhat did this design cost, and what breaks at 10×?

Primary sources for this problem

LMAX Disruptor paper
Martin Fowler — The LMAX Architecture
Aeron Cluster Raft consensus
Nasdaq TotalView-ITCH 5.0
Nasdaq OUCH 4.2
SEC Release 34-70694 (Knight Capital)
SEC press release 2013-95 (Nasdaq Facebook IPO)
MiFID II RTS 25 (clock synchronisation)
SEC Rule 613 / CAT NMS Plan
CFTC-SEC Joint Report on the May 6, 2010 Flash Crash

More in Transactions, Concurrency & Money

Correctness when two writers collide and money is involved: serializability, two-phase commit versus sagas, hold-then-confirm, single-writer matching, and the databases that give you external consistency.

Browse the full problem catalog, or see what the simulator does and does not model.