Filter Market Data Messages in an FPGA – part 3

Filter Market Data Messages in an FPGA – part 3

Note: Skip directly to to download the source code by following this link:

This post will cover the next iteration of implementing an OrderBook inside an FPGA that is based on a NASDAQ ITCH 4.1 market data feed.

Some time has passed and I have finally found enough time to finish all the code changes required for the two (2) components listed below, along with the requisite test harnesses to validate.

Starting off, here are the components of an FPGA-based OrderBook

  • ITCH Parser
    • FPGA loop that listens to incoming data from a Network Interface Card that parses, filters and translates each incoming message and sends the appropriate message/command to the OrderBook loop.
  • OrderBook
    • FPGA loop that reads and writes Orders to memory using an insertion sort algorithm.  The Orderbook is currently able to support only one instrument and one side.  It’s capacity is 1,000 elements, which through the power of LabVIEW for FPGA can be easily adjusted, but that is not important right now.  The OrderBook currently supports two commands: add order and get all orders.  The get all orders command is meant to be used by a user or client application for trading and other purposes.

Using Test Driven Development, Here Are the Test Harnesses

  • ITCH Parser Test Harness
    • Input: A file containing raw ITCH 4.1 market data messages (generated using
    • Output: Array of OrderBook operations
  • OrderBook Test Harness
    • Input: An array of OrderBook operations
    • Output: A sorted array of Orders

What Does a Test Harness Look Like?

Here is a screenshot of the Front Panel diagram for the ITCH Parser Test Harness:

and here is a flow chart of what is going on:

What exactly is going on? The vi, reads the file containing raw NASDAQ ITCH Market Data messages, sends them in to the FPGA Test Harness via the Host-to-Target DMA FIFO “HT-TEST_IN”.  The Fpga test harness is located in the “Tests” folder and is named “”, this Test Harness passes the raw Itch data as is to the, which parses, normalized and filters each message for Add order message types only for symbol AAPL. It then sends an OrderBook command for each appropriate message back out to the Fpga-TestHarness which sends the results up to the host

And for the OrderBook Test Harness

Here is what it would look like in a production system

Why this is so important?

Well, normally to create an FPGA based anything, one needs to use Verilog, VHDL or one of any numerous “high-level” design languages.  Here you can accomplish the same thing, but with a really great programming interface that matches the Verilog programming model, but only with a graphical interface.

This means you can create a custom FPGA based solution, reduce your datacenter power usage, increase your applications performance, and reap the rest of the great benefits of FPGA-based computing.

I encourage you to download the source code for this and to see for yourself what LabVIEW for FPGA can do for you and to then try it in one of your own applications.

Stay Tuned… What is next?

  1. Hook the ITCH Parser up to an actual Network Interface Card, preferably a 10 Gigabit, since I already own the hardware to do so.
  2. Hook up either a MicroBlaze processor or the host computer to the OrderBook so that something can be done with the OrderBook data itself.




Filter Market Data Messages in an FPGA – part 1

So I went to NASDAQs ftp site and downloaded the entire ITCH feed for November 9th, 2013.  The file was large – 319MB compressed, and you can download it yourself from here:

NASDAQ has a very simple document describing the specification here:

I skimmed over the specification to get an idea of how Market Data works.  What I basically understand is that at the start of the trading day, NASDAQ sends a list of all securities that will be available to trade for that day following by a bunch of messages indicating changes to prices being offered to buy or sell for the security as well as actual trades.

The basic format of an ITCH 4.1 Market Data message is the size of the message, followed by the data, where the first byte of the data is the message type.  So using this information we can easily decode an entire ITCH feed, paying attention only to messages that interest us.

Timestamp Message

0x05 Length
0x54 Message Type ‘T’
0x00 Second – byte 1
0x00 Second – byte 2
0x58 Second – byte 3
0xb7 Second – byte 4

The ITCH standard says that all Integer fields are in Big-Endian format, so the timestamp in the message above is interpreted as 0x00 00 58 b7, or 22,711. See a nice online hex to dec converter here:

Now 22,711 is the number of seconds since midnight, here is another online tool to convert this to a normal time in hours, minutes, and seconds:

So 22,711 is 06:18:31.  That is pretty early in the morning, so it looks like this particular NASDAQ ITCH feed starts with pre-market trading.

I also used this online tool to convert ASCII to Hex:

The next message in this feed:

System Event Message

0x06 Length
0x53 Message Type ‘S’
0x11 Timestamp byte 1(nanoseconds since last Timestamp Seconds)
0xcd Timestamp byte 2
0x6c Timestamp byte 3
0xc9 Timestamp byte 4
0x4f Event Code

The possible event codes are:

  • Daily
    • ‘O’ – (0x4f) – Start of Messages
    • ‘S’ – (0x53) – Start of System Hours
    • ‘Q’ – (0x51) – Start of Market Hours
    • ‘M’ – (0x4d) – End of Market Hours
    • ‘C’ – (0x43) – End of Messages
  • As Needed – In the event of an emergency market condition
    • ‘A’ – (0x41) – Emergency Market Condition – Halt
    • ‘R’ – (0x52) – Emergency Market Condition – Quote Only Period
    • ‘B’ – (0x42) – Emergency Market Condition – Resumption

I included the “As Needed” Event Codes, because that is when things will get real bad, and you will probably want your FPGA to get ready to liquidate everything in your portfolio… More on that in the future, but for now we must stayed focused on trading Trump and his tweets.

So 0x4f means start of messages.  Okay, continuing, I see a few more system event messages as well as some Timestamp messages.  I skip these for now and come to the next message which sounds interesting and is a Stock Directory Message

Stock Directory Message

byte # length data description
0 1 0x14 (decimal: 20) Length
1 1 0x52 Message Type ‘R’
2-5 4 1d  48 bd c7 Timestamp Nanoseconds
6-13 8 41 20 20 20 20 20 20 20 Stock (0x20 is a space, 0x41 is A) So this is for Agilent (
14 1 4e (‘N’) Market Category – simply the exchange:

    • N – NYSE
    • A – NYSE Amex
    • P – NYSE Arca
    • Q – NASDAQ Global Select Market
    • G – NASDAQ Global MarketSM
    • S – NASDAQ Capital Market
    • Z – BATS BZX Exchange
15 1 20 (space) Financial Status Indicator – Indicates when a firm is not in compliance with NASDAQ continued listing requirements.  This sounds like a way to find distressed stocks that are about to be delisted – lots of volatility with low volume.

  • D – Deficient
  • E – Delinquent
  • Q – Bankrupt
  • S – Suspended
  • G – Deficient and Bankrupt
  • H – Deficient and Delinquent
  • J – Delinquent and Bankrupt
  • K – Deficient, Delinquent and Bankrupt
  • Space – Company is in compliance
16-19 4 00 00 00 64

(decimal: 100)

Round lot size
20 1 4e (N) Round lots only – indicates if NASDAQ only accepts orders in round lot size

  • Y – only round lots are accepted in this stock
  • N – odd/mixed lots are allowed

Okay, so we can now decode a couple of message types.  But this is not important and is only distracting us from the goal.  We can decode all of these messages inside a MicroBlaze Soft Core Processor running embedded C++ inside the FPGA, and then send a message to the rest of the FPGA telling it how to deal with the rest.  So let’s keep scanning this Market Data file and find a message that helps us with trading.

I encounter a message of type “Reg SHO Short Sale Price Test Restricted Indicator”.  I did some googling and found that Reg SHO is yet another loophole-filled attempt by regulators to prevent naked shorting.  My favorite sentence from this Investopedia page is:

“a broker has reasonable belief that the equity to be short sold can be borrowed and delivered to a short seller on a specific date before short selling can occur”

Anyway, let’s keep scanning this file.  I find a message of type ‘H’ – Stock Trading Action Message, this sounds pretty good…

Stock Trading Action Message

byte # length data description
0 1 0x13 (decimal: 19) Length
1 1 0x48 Message Type ‘H’
2-5 4 1d 50 bd 0d Timestamp Nanoseconds
6-13 8 41 42 2d 20 20 20 20 20 Stock Symbol: AB-
14 1 0x54 (T) Trading State

  • H – Halted across all U.S. equity markets / SROs
  • P – Paused across all U.S. equity markets / SROs (NASDAQ-listed securities only)
  • Q – Quotation only period for cross-SRO halt or pause
  • T – Trading on NASDAQ
15 1 20 (space) Reserved
16-19 4 20 20 20 20 Trading Action Reason – I guess all spaces means “no reason” or “nothing to worry about”

Okay, so it looks like the Trading Action Message just tells us when trading is officially open…etc.  Nothing of use here for the FPGA plan.  Anyway, on to the next message type that I find.

I continue running my analysis script and I find the following:

  • Add Order with MPID
  • Add Order Message
  • Order Delete Message

This time I will not analyze the “Add Order with MPID” message unless it appears to have something of use.  The Message Type is ‘F’, and it looks like this message will be useful to us.  Additionally, MPID stands for “Market Participant Identifier” and appears to simply be your broker.  See:

So, here is the analysis:

Add Order with MPID Attribution

byte # length data description
0 1 0x22 (decimal: 34) Length
1 1 0x46 Message Type ‘F’
2-5 4

02 43 d1 46

Nanoseconds portion of timestamp
6-13 8 00 00 00 00 00 00 16 b2 Order number – unique and is assigned during order entry
14 1 0x42 Type of order

  • ‘B’ – (0x42) – Buy
  • ‘S’ – (0x53) – Sell
15-18 4 00 00 00 64 (decimal: 100) Number of shares
19-26 8

5a 56 5a 5a 54 20 20 20

The stock symbol:


Funny… this looks like a test symbol, take a look at the Bloomberg quote:

27-30 4

00 02 97 ac

Display price, converts to: $16.99
31-34 4  4c 45 48 4d NASDAQ MPID: LEHM (Is that Lehman Brothers?)

So I am looking at the NASDAQ ITCH 4.1 specification (as you have obviously realized by now) and I see that the order immediately before “Add Order with MPID Attribution” is “Add Order – No MPID Attribution”, which is exactly the same as the message above, but without the last field.  The only other difference is that the message type is ‘A’.

A word about Display Price

So the specification says that you convert all Integer price values and treat them as fixed pointed numbers with the first 6 places representing the integer portion and the remaining 4 representing decimal digits, and this leads to a maximum price of 200,000.0000.

So in the example message above:

000297ac is equal to 169900, which is 16.9900, or simply $16.99.


Okay, so we know when the market opens and trading is started, stopped…etc We know when a new order is added to the NASDAQ order book.  What is next? Order Delete!

Order Delete is different from Order Cancel.  Order Delete means that the entire order is removed or deleted from the Order Book, Order Cancel is whenever a portion of an order is cancelled.

Order Delete Message

byte # length data description
0 1 0x0D (decimal: 13) Length
1 1 0x44 Message Type ‘D’
2-5 4

21 95 1b cf

Nanoseconds portion of timestamp
6-13 8

00 00 00 00 00 00 031 6b

Order reference number

Order Cancel Message

byte # length data description
0 1 0x (decimal: ) Length
1 1 0x58 Message Type ‘X’
2-5 4

21 dd db e1

Nanoseconds portion of timestamp
6-13 8

00 00 00 00 00 25 42 b7

Order reference number
14-17 4

00 00 00 0a

Number of shares being removed from order.  Hmmm… is someone backing out of a position? Scared!!! that means sell! Eh, maybe not, they only removed 10 shares.  But what if they are trading a high-priced stock like Amazon or Google? Oops, I meant Alphabet… and what about Berkshire Hathaway?

Okay, so we have Add Order, Remove Order, Shorten Order.  What is left? Order Execute and Order Modify.  I will go with Order Executed.

Order Executed Message

byte # length data description
0 1 0x19 (decimal: ) Length
1 1 0x45 Message Type ‘E’
2-5 4

18 45 cd 07

Nanoseconds portion of timestamp
6-13 8


00 00 00 00 00 00 e9 ca

Order reference number
14-17 4  00 00 03 e8 Number of shares executed
18-25 8

00 00 00 00 00 00 00 01

 NASDAQ generated day-unique match number.

Order Executed with Price Message

byte # length data description
0 1 0x1e (decimal: ) Length
1 1 0x43 Message Type ‘C’
2-5 4

01 74 a8 ca

Nanoseconds portion of timestamp
6-13 8


00 00 00 00 00 00 31 9b

Order reference number
14-17 4  00 00 00 64 (decimal: 100) Number of shares executed.
 18-25 8

00 00 00 00 00 00 03 b0

 NASDAQ generated day-unique match number.
26 1



  • ‘Y’ – (0x59)
  • ‘N’ – (0x4e)
27-30 4

00 02 9c 5c

Execution Price: 17.1100, or $17.11

I think that I have enough information to get started with the FPGA portion of this.  So I will skip analyzing the Order Replace Message for now.  So….

We have analyzed the following message types:

  • Timestamp Message
  • System Event Message
  • Stock Directory Message
  • Stock Trading Action Message
  • Add Order – No MPID Attribution (well, kind of)
  • Add Order with MPID Attribution
  • Order Delete Message
  • Order Cancel Message
  • Order Executed Message
  • Order Executed with Price Message

What is missing? I am looking at the ITCH 4.1 specification and I see the following message types:

  • Order Replace
  • Trade Message (Non-Cross)
  • Cross Trade Message
  • Broken Trade / Order Execution Message
  • Net Order Imbalance Indicator (NOII) Message
  • Retail Price Improvement Indicator (RPII)

So I can go ahead and analyze the rest of the messages, but I want to get to some coding.  Coding as in drawing some LabVIEW program (no, not writing, but drawing).  Anyway, I will take a look at how to write (aka draw) some LabVIEW for FPGA code that can handle the parsing and interpreting of the necessary information to react or trade to a Trump Event.  Stay tuned.

From Trump to Profit

I am sure that every single trader gets nervous whenever Trump speaks.  If he says “wall” they have to go short the Mexican Peso, if he talks about Obamacare or the “Unaffordable Care Act”, they have to short Healthcare stocks.  During his first news conference on Thursday, January 11th, 2017, he went a step further and said he wants bidding and competition for Government purchases of Pharmaceutical drugs.  So not only did the Mexican Peso suffer, but so did Pharmaceutical companies such as GlaxoSmithKline, Merck and Pfizer, among others!

His news conference was from 11:00 am to 12:15 pm.

Here is a chart of the Mexican Peso during this time:

USDMXN – 1/11/2017 from 11:00am to 12:15pm

and a chart showing Pfizer:

PFE US Equity – 1/11/2017 from 11:00am to 12:15pm

and GlaxoSmithKline:

GSK US Equity – 1/11/2017 from 11:00am to 12:15pm

See the CNN timeline of Trump’s first news conference here:

Now how do you use your custom trading algorithm to make money during such an event as a Trump News Conference?  Simple, use FPGAs!

You have your algorithm, which may be as simple as “If PFE drops by x percent in y seconds” then “sell z amount of PFE”.  Then after PFE drops a further amount, you may choose to buy it all back.  The algorithm is up to you of course, and my job is to tell you how to use an FPGA to speed it up, because the first to sell at the top make the most profit.  Let’s take a closer look at the chart for GlaxoSmithKline:

GSK US Equity – 1/11/2017 from 11:22am to 11:25am – right before Trump said that he wants bidding on Pharmaceuticals

The major premise is that at the left of this chart trading volume is very high, both for GlaxoSmithKline, other Pharmaceuticals and the markets in general, and that the few trading firms that are able to send sell orders first will make the most money, with those that follow making less and less at an accelerated pace.  Here is a chart of the volume for GSK during the entire trading day:

GSK US Equity – Volume and Price Jan 11, 2017 11:21-11:26am

On January 11th, 2017, the average trading volume for the entire day for GSK was 13,003 shares per minute, and here is a table of the volume for the chart above:

Minute Volume Price
11:20 8,145 39.1599
11:21 7,266 39.16
11:22 147,329 38.97
11:23 64,563 38.95
11:24 60,768 38.821
11:25 38,823 38.8554
11:26 23,603 38.8368
11:27 34,205 38.8001

Look at the spike in volume at 11:22, and look at the price difference!

So a trader or algorithm looking to exploit this opportunity faces some challenges.

  • More Market Data for security of interest
    • Your algorithm is now being bombarded with thousands, if not hundreds of thousands of messages about the price of the security which you want to trade.
  • More Market Data in General
    • Your market data feeds are being overloaded and the time it takes to process each message increases.
    • The amount of time that it takes to process a message with respect to the amount of messages coming in is never linear.
  • Slower response time from your algo
    • Your algo is slower at generating messages because your system is overloaded.

An FPGA can help in all 3 areas.

1 – Filter out all securities and keep only those of interest

2 – Do the analysis portion to detect whether or not to sell GSK in the FPGA

3 – Generate the orders directly in the fpga


The advantages of an FPGA, especially when in a Network Card configuration is that all of the above happens inside hardware,  and is completely outside of your host computer.  So imagine that your host computer gets only Market Data from a list of securities instead of all Market Data from all securities.  Your host now no longer needs to filter market data before sending the information to your algo.

Now the FPGA can also pre-process the data and send the data in a easier format to the host computer.  Imagine your host computer no longer has to perform simple calculations that it uses to determine whether or not trade because that has been done inside the FPGA.

And finally, why generate and send orders to buy or sell a security inside the host computer when the FPGA can do that for you as well? Instead of sending an entire order down your operating system stack, just send a bunch of parameters to the FPGA and let it handle creating the appropriate messages, calculating CRCs and checksums, and of putting them on the wire.