Match Server for a Financial Exchange Having Fault Tolerant Operation

Abstract

Fault tolerant operation is disclosed for a primary match server of a financial exchange using an active copy-cat instance, a.k.a. backup match server, that mirrors operations in the primary match server, but only after those operations have successfully completed in the primary match server. Fault tolerant logic monitors inputs and outputs of the primary match server and gates those inputs to the backup match server once a given input has been processed. The outputs of the backup match server are then compared with the outputs of the primary match server to ensure correct operation. The disclosed embodiments further relate to fault tolerant failover mechanism allowing the backup match server to take over for the primary match server in a fault situation wherein the primary and backup match servers are loosely coupled, i.e. they need not be aware that they are operating in a fault tolerant environment.

We claim: 
     
         1 . A method of providing fault-tolerant operation for a primary instance, the method comprising:
 performing, by a computer processor via a duplicate of the primary instance, each operation of a sequence of operations to be performed by the primary instance, subsequent to the operation being successfully completed by the primary instance or after determination that the primary instance will not successfully do so.   
     
     
         2 . The method of  claim 1  further comprising:
 comparing a result of the performance of one of the sequence of operations by the primary instance with a result of the performance of the same one of the sequence of operations by the backup instance and indicating a failure of the backup instance, the primary instance, or a combination thereof, when the results are at least partially different. 
 
     
     
         3 . The method of  claim 1  further comprising:
 preventing the primary instance from completing the at least one of the sequence of operations when at least one of the sequence of operations is not likely to be completed. 
 
     
     
         4 . The method of  claim 3 , wherein the preventing further comprises preventing completion of a store transaction by the primary instance. 
     
     
         5 . The method of  claim 4 , wherein the preventing further comprises causing a database to return a constraint violation in response to the store transaction. 
     
     
         6 . The method of  claim 1  wherein the primary instance comprises one of a process, thread, application, processor, or combination thereof. 
     
     
         7 . The method of  claim 1  wherein the primary instance is loosely coupled to the duplicate thereof. 
     
     
         8 . The method of  claim 1  wherein the each of the sequence of operations comprises one of an incoming trader order, an order cancellation or a combination thereof and further wherein a result of the performance of each of the sequence of operations comprises an order cancellation confirmation, an order confirmation, a trade execution confirmation, an order elimination, order rejection or combination thereof. 
     
     
         9 . A computer readable storage medium containing instructions for execution by a computer processor to implement a system for providing fault tolerance to a primary instance, the instructions comprising:
 instructions executable by the computer processor to cause the computer processor to perform, via a duplicate of the primary instance, each operation of a sequence of operations to be performed by the primary instance, subsequent to the operation being successfully completed by the primary instance or after determination that the primary instance will not successfully do so.   
     
     
         10 . The computer readable storage medium of  claim 9  wherein the instructions are further executable by the computer processor to cause the computer processor to prevent, based on the determination that the primary instance will not successfully complete perform the operation, the primary instance from completing a transaction that the primary instance is supposed to complete to continue operating. 
     
     
         11 . The computer readable storage medium of  claim 9  wherein the instructions are further executable by the computer processor to cause the computer processor to transmit a first backup result generated based on the performance of the operation by the duplicate of the primary instance when a first primary result generated based on the performance of the operation by the primary instance is not likely to be transmitted. 
     
     
         12 . The computer readable storage medium of  claim 9  wherein the instructions are further executable by the computer processor to cause the computer processor to compare a first primary result generated based on the performance of the operation by the primary instance with a first backup result generated based on the performance of the operation by the duplicate of the primary instance and indicate, to the computer processor, a failure of the duplicate of the primary instance, the primary instance or a combination thereof, when the first primary result is at least partially different from the first backup result. 
     
     
         13 . The computer readable storage medium of  claim 9 , wherein the operation comprises a store transaction to a database, the instructions being further executable by the computer processor to cause the computer processor to prevent completion of the store transaction. 
     
     
         14 . The computer readable storage medium of  claim 13 , wherein the instructions are further executable by the computer processor to cause the database to return a constraint violation in response to the store transaction. 
     
     
         15 . The computer readable storage medium of  claim 9 , wherein the primary instance comprises a instance of a financial exchange. 
     
     
         16 . A system for providing fault tolerance to a primary instance, the system comprising:
 a computer processor;   a memory coupled with the computer processor;   first logic stored in the memory and executable by the computer processor to cause the computer processor to perform, via a duplicate of the primary instance, each operation of a sequence of operations to be performed by the primary instance, subsequent to the operation being successfully completed by the primary instance or after determination that the primary instance will not successfully do so.   
     
     
         17 . The system of  claim 16  wherein the first logic is further executable by the computer processor to cause the computer processor to prevent, based on a determination that the next result is not likely to be transmitted, the primary instance from completing a transaction that the primary instance is supposed to complete to continue operating. 
     
     
         18 . The system of  claim 16  wherein the first logic is further executable by the computer processor to cause the computer processor to transmit the first backup result when the first primary result is not likely to be transmitted as the next result. 
     
     
         19 . The system of  claim 16  wherein the first logic is further executable by the computer processor to cause the computer processor to compare the first primary result with the first backup result and indicate a failure of the backup instance, the primary instance or a combination thereof, when the first primary result is at least partially different from the first backup result. 
     
     
         20 . A computer-implemented system for providing fault tolerance to a primary instance means, the system comprising a computer processor and further comprising:
 means for performing, by a duplicate of the primary instance, each operation of a sequence of operations to be performed by the primary instance, subsequent to the operation being successfully completed by the primary instance or after determination that the primary instance will not successfully do so.   
     
     
         21 . The computer-implemented system of  claim 20  further comprising:
 means for preventing, coupled with the means for performing, the primary instance means from completing a transaction that the primary instance means is supposed to complete to continue operating, based on the determination that the first primary result is not likely to be transmitted.