The big idea
What is a stock exchange?
Buyers and sellers submit orders; the exchange matches them into trades — fairly, deterministically, and in microseconds. Money is on the line, so it must never lose an order, never mismatch, and treat every participant equally. Correctness and latency, both absolute.
At the center is a matching engine running a single, ordered stream of events against an in-memory order book. Wrap it in admission, risk checks, deterministic sequencing, market-data broadcast, and a durable journal — keeping the core path tiny and fast.
How to read this: We add one piece at a time, problem then fix, and the diagram grows. Hit Begin.
Step 1 · The core
Match orders into trades
A trader sends “buy 100 at $50”. The exchange must instantly find a matching sell and execute, or rest the order until one appears. What structure makes that match fast and correct?
Design decision: "Buy 100 at $50" must instantly find a match or wait for one. What structure makes that fast and correct?
The call: An in-memory order book of sorted resting bids/asks. — Best bid and best ask sit at the top; matching crosses the spread — highest bid against lowest ask — until they no longer overlap. A market order takes best price; a limit order rests if it can’t match.
An Order Gateway admits the order to a Matching Engine that runs against an Order Book — resting bids and asks per symbol. A market order takes the best price; a limit order matches if possible, otherwise rests in the book.
The book is the state: The order book is a sorted structure: best bid and best ask at the top. Matching is repeatedly crossing the spread — pairing the highest bid with the lowest ask — until they no longer overlap.
Step 2 · The rules of matching
Price-time priority
When many orders want the same price, who trades first? Get this wrong and the market is unfair — and traders will (rightly) leave an exchange that doesn’t treat equal orders equally.
Design decision: Many orders want the same price. Who trades first, fairly?
The call: Price-time priority: best price, then earliest order (FIFO). — Best price wins; among equal prices the earliest order fills first. Organizing the book as price levels, each a FIFO queue, builds the rule into the data structure — deterministic and auditable.
Match by price-time priority: best price wins, and among equal prices the earliest order fills first. The book is organized into price levels, each a FIFO queue, so the rule is built into the data structure.
Fairness is a data structure: Sorting by price, then FIFO within a price level, makes the matching rule deterministic and auditable. Every participant can reason about exactly where their order sits in line.
Step 3 · Guard the book
Pre-trade risk checks
A trader could submit an order they can’t afford, or one that blows past position limits — a “fat finger” or a rogue algo. Letting that reach the book risks trades that can’t settle.
Design decision: A trader could submit an order they can’t afford or that blows past limits (fat-finger, rogue algo). Where do you stop it?
The call: A pre-trade risk check on the admission path, before matching. — Verify buying power, position/credit limits and price/size sanity at the gateway, rejecting violations immediately — so only valid orders ever touch the engine, and the hot loop stays fast and deterministic.
Insert a Risk Check before matching: verify buying power, position and credit limits, and sanity-check price/size. Reject violations immediately, so only valid orders ever touch the matching engine.
Validate at the edge: Keeping risk on the admission path — not inside the matching core — protects the hot loop’s speed and determinism while still stopping dangerous orders cold.
Step 4 · Make it deterministic
A single sequencer
Orders arrive concurrently from everywhere. For fairness, auditability, and the ability to run hot replicas, every component must agree on the exact order events were processed — and racing threads can’t guarantee that.
Design decision: Orders arrive concurrently from everywhere. How do you make matching fair, auditable, and replica-safe?
The call: One sequencer assigns a global order; a single-threaded engine consumes it. — A sequencer stamps every admitted order with a global sequence number, then a single thread processes that one stream — same input order, same output, on primary and every replica. Astonishingly fast in-memory, and perfectly reproducible.
Funnel all admitted orders through one Sequencer that assigns a global sequence number, then feed that single stream to a single-threaded matching engine. Same input order, same output, every time — on the primary and every replica.
Determinism via total order: One thread, one ordered input log, no shared-state races. It sounds slow but is astonishingly fast in-memory, and it makes the engine perfectly reproducible — the key to both fairness and failover.
Step 5 · Tell the world
Market data feed
Every participant needs to see book updates and trades to make decisions — and they must all see them at the same time. Any latency advantage is an unfair edge worth millions.
Design decision: Every participant needs book updates and trades — and a latency edge is worth millions. How do you distribute fairly?
The call: Broadcast every change from one source with equal-latency delivery. — The engine emits each change to a market feed (often multicast) so the same picture reaches everyone simultaneously. Distributing data fairly matters as much as matching fairly.
The engine emits every change to Market Data, broadcast over a Market Feed to all participants with equal-latency delivery (often multicast). The same picture reaches everyone simultaneously.
Equal-latency fairness: Distributing data fairly is as important as matching fairly. Broadcasting from one source with controlled, equal delivery prevents anyone from systematically seeing the market first.
Step 6 · Never lose a trade
Journal & replay
The order book lives in memory for speed — but memory is volatile. A crash without a record would lose orders and trades, which for an exchange is catastrophic and possibly illegal.
Design decision: The order book lives in volatile memory for speed. How do you survive a crash without losing trades?
The call: Journal every event to an append-only log before applying it. — Log first, apply second: on failure a replica replays the journal to reconstruct the exact book, and because the engine is deterministic the replay reproduces an identical result. The sequential write is cheap.
Journal every event to an append-only log before applying it. On failure, a replica replays the journal to reconstruct the exact book state and takes over. Because the engine is deterministic, replay reproduces the identical result.
Log first, apply second: Durability without sacrificing in-memory speed: the sequential journal write is cheap, and determinism means the log is a perfect recipe for rebuilding state anywhere.
Step 7 · After the match
Clearing, settlement & scale
A match is a promise, not finished money. Ownership and cash must actually change hands, and one engine can’t hold the order books for every symbol on earth.
Hand executed trades to Clearing & Settlement (T+1/T+2) off the hot path, so post-trade work never slows matching. Scale by partitioning symbols across matching engines — each symbol’s book is independent, so AAPL and TSLA run on different engines in parallel.
Partition by symbol: Because orders for different symbols never interact, the symbol is a perfect shard key. Each engine owns a set of symbols, keeping every individual book single-threaded and fast while the exchange scales horizontally.
You did it
You just designed a stock exchange.
- A matching engine crossing an in-memory order book turns orders into trades.
- Price-time priority — best price, then FIFO — makes matching fair by construction.
- Pre-trade risk checks at the edge keep invalid orders out of the core.
- A single sequencer + single-threaded engine give deterministic, fair, fast matching.
- A market-data feed broadcasts the same view to all participants with equal latency.
- An append-only journal plus deterministic replay make the in-memory engine durable.
- Clearing runs off the hot path; partitioning by symbol scales the exchange out.