Filter Market Data Messages in an FPGA – part 2

Skip directly to the source code on here:

So what now.  We know what a NASDAQ ITCH 4.1 Market Data Message looks like.  The format is very simple, there is some – yes – ASCII data in the message format, and all messages are preceded by the message length.  Message length preceding the message makes it very easy to interpret a feed from inside an FPGA.

What to do first? Well, what does eXtreme Programming say to do? It says keep it simple.

So, I am working on a LabVIEW 2016 program that does the following:

  1. Open a NASDAQ ITCH file
  2. Send it one byte at a time into the FPGA over the PCIe bus
  3. FPGA reads the feed, skips over messages types that it does not know how to handle, and parses only messages of a specific type.
  4. Send back to the host computer a statistic – any statistic for now.

If you are unfamiliar with National Instruments products and LabVIEW, go here to learn more:

Step 1 – Open a NASDAQ ITCH file

The first step is to create a LabVIEW for Windows – as opposed to LabVIEW for FPGA – and to read in an entire NASDAQ ITCH 4.1 file.  This file is quite big, so I wrote a quick Python script (used Ryan Day’s code as a guide:, and I generated a file with the following:

  • 1 Timestamp message
  • 5 Timestamp messages
  • 50 Timestamp messages

The Python script can also output the seconds field from each message read in.  See the python script here:

Now I have three files, named: T.itch, T.5.itch, and T.50.itch, and I will write a LabVIEW program to send all data from one of the files above in to the FPGA.

Step 2 – Send Data From One File to FPGA via DMA FIFO

This requires knowledge of LabVIEW for Windows and some knowledge of LabVIEW for FPGA.  I wrote a simple User Interface that allows you to select a file.  That file is then sent to the FPGA using a Host-to-Target FIFO 1 byte at a time.  Since viewing a LabVIEW vi requires that you have LabVIEW installed on your computer, I took some screen shots of the LabVIEW code and placed them here:

Step 3 – Interpret the Feed Inside the FPGA

Right now I have generated a file that contains, 1, 5, and 50 Timestamp messages.  So that means, for each messaged that is encountered, I will extract the timestamp, which will be in seconds, save it in to a local FPGA variable, and send the value back up to the host.

Step 4 – Send Data Back to Host

The statistic will be the seconds portion of each message that was passed in.  The seconds field is a 32-bit integer, so the Target-to-Host DMA FIFO will be a 32-bit integer.  Here is a quick screen shot of the FPGA top-level loop, which reads the input data stream one byte at a time:

The purple colored box is how the FPGA receives the data from the host.  In a live application, the purple colored box, also known as the “Read (FIFO Method)” can have this data come directly from a 10 gigabit connection, or from another loop inside the FPGA.

(Read more about this method on National Instruments website:

As the data comes in, a counter is started at 0, and depending on the element count, the data is stored in different output variables.  The first 2 bytes are the message length, the 3rd is the message type, the 4th, 5th, 6th, and 7th elements are the Seconds portion of the message.

The counter is then compared to the message length variable, and when they are equal, the output variable “Message Done” is set to true.  Here is the bottom portion of the screen shot from above:

After the end of the message is read, we have a case structure, which is similar to an if statement but for FPGAs, which will read the appropriate variables and send them back up to the host via a DMA-FIFO.  Now this DMA-FIFO can be configured to send data up to the host computer, or to another DMA-FIFO inside the FPGA.  For now we are going to send this up to the host for analysis.

Take a look at the right-half of the original FPGA vi screenshot.  This element executes once, and reads the Seconds variable and sends it up to the host.

In part 3, I will add another feature – Add Order with MPID, so we can now know in the FPGA when a new order is entered for a particular security, what side that order is on, and how many shares/price.  This is more meaningful information that can be used to trade the markets, especially during a Donald Trump speech!

Filter Market Data Messages in an FPGA – part 1

So I went to NASDAQs ftp site and downloaded the entire ITCH feed for November 9th, 2013.  The file was large – 319MB compressed, and you can download it yourself from here:

NASDAQ has a very simple document describing the specification here:

I skimmed over the specification to get an idea of how Market Data works.  What I basically understand is that at the start of the trading day, NASDAQ sends a list of all securities that will be available to trade for that day following by a bunch of messages indicating changes to prices being offered to buy or sell for the security as well as actual trades.

The basic format of an ITCH 4.1 Market Data message is the size of the message, followed by the data, where the first byte of the data is the message type.  So using this information we can easily decode an entire ITCH feed, paying attention only to messages that interest us.

Timestamp Message

0x05 Length
0x54 Message Type ‘T’
0x00 Second – byte 1
0x00 Second – byte 2
0x58 Second – byte 3
0xb7 Second – byte 4

The ITCH standard says that all Integer fields are in Big-Endian format, so the timestamp in the message above is interpreted as 0x00 00 58 b7, or 22,711. See a nice online hex to dec converter here:

Now 22,711 is the number of seconds since midnight, here is another online tool to convert this to a normal time in hours, minutes, and seconds:

So 22,711 is 06:18:31.  That is pretty early in the morning, so it looks like this particular NASDAQ ITCH feed starts with pre-market trading.

I also used this online tool to convert ASCII to Hex:

The next message in this feed:

System Event Message

0x06 Length
0x53 Message Type ‘S’
0x11 Timestamp byte 1(nanoseconds since last Timestamp Seconds)
0xcd Timestamp byte 2
0x6c Timestamp byte 3
0xc9 Timestamp byte 4
0x4f Event Code

The possible event codes are:

  • Daily
    • ‘O’ – (0x4f) – Start of Messages
    • ‘S’ – (0x53) – Start of System Hours
    • ‘Q’ – (0x51) – Start of Market Hours
    • ‘M’ – (0x4d) – End of Market Hours
    • ‘C’ – (0x43) – End of Messages
  • As Needed – In the event of an emergency market condition
    • ‘A’ – (0x41) – Emergency Market Condition – Halt
    • ‘R’ – (0x52) – Emergency Market Condition – Quote Only Period
    • ‘B’ – (0x42) – Emergency Market Condition – Resumption

I included the “As Needed” Event Codes, because that is when things will get real bad, and you will probably want your FPGA to get ready to liquidate everything in your portfolio… More on that in the future, but for now we must stayed focused on trading Trump and his tweets.

So 0x4f means start of messages.  Okay, continuing, I see a few more system event messages as well as some Timestamp messages.  I skip these for now and come to the next message which sounds interesting and is a Stock Directory Message

Stock Directory Message

byte # length data description
0 1 0x14 (decimal: 20) Length
1 1 0x52 Message Type ‘R’
2-5 4 1d  48 bd c7 Timestamp Nanoseconds
6-13 8 41 20 20 20 20 20 20 20 Stock (0x20 is a space, 0x41 is A) So this is for Agilent (
14 1 4e (‘N’) Market Category – simply the exchange:

    • N – NYSE
    • A – NYSE Amex
    • P – NYSE Arca
    • Q – NASDAQ Global Select Market
    • G – NASDAQ Global MarketSM
    • S – NASDAQ Capital Market
    • Z – BATS BZX Exchange
15 1 20 (space) Financial Status Indicator – Indicates when a firm is not in compliance with NASDAQ continued listing requirements.  This sounds like a way to find distressed stocks that are about to be delisted – lots of volatility with low volume.

  • D – Deficient
  • E – Delinquent
  • Q – Bankrupt
  • S – Suspended
  • G – Deficient and Bankrupt
  • H – Deficient and Delinquent
  • J – Delinquent and Bankrupt
  • K – Deficient, Delinquent and Bankrupt
  • Space – Company is in compliance
16-19 4 00 00 00 64

(decimal: 100)

Round lot size
20 1 4e (N) Round lots only – indicates if NASDAQ only accepts orders in round lot size

  • Y – only round lots are accepted in this stock
  • N – odd/mixed lots are allowed

Okay, so we can now decode a couple of message types.  But this is not important and is only distracting us from the goal.  We can decode all of these messages inside a MicroBlaze Soft Core Processor running embedded C++ inside the FPGA, and then send a message to the rest of the FPGA telling it how to deal with the rest.  So let’s keep scanning this Market Data file and find a message that helps us with trading.

I encounter a message of type “Reg SHO Short Sale Price Test Restricted Indicator”.  I did some googling and found that Reg SHO is yet another loophole-filled attempt by regulators to prevent naked shorting.  My favorite sentence from this Investopedia page is:

“a broker has reasonable belief that the equity to be short sold can be borrowed and delivered to a short seller on a specific date before short selling can occur”

Anyway, let’s keep scanning this file.  I find a message of type ‘H’ – Stock Trading Action Message, this sounds pretty good…

Stock Trading Action Message

byte # length data description
0 1 0x13 (decimal: 19) Length
1 1 0x48 Message Type ‘H’
2-5 4 1d 50 bd 0d Timestamp Nanoseconds
6-13 8 41 42 2d 20 20 20 20 20 Stock Symbol: AB-
14 1 0x54 (T) Trading State

  • H – Halted across all U.S. equity markets / SROs
  • P – Paused across all U.S. equity markets / SROs (NASDAQ-listed securities only)
  • Q – Quotation only period for cross-SRO halt or pause
  • T – Trading on NASDAQ
15 1 20 (space) Reserved
16-19 4 20 20 20 20 Trading Action Reason – I guess all spaces means “no reason” or “nothing to worry about”

Okay, so it looks like the Trading Action Message just tells us when trading is officially open…etc.  Nothing of use here for the FPGA plan.  Anyway, on to the next message type that I find.

I continue running my analysis script and I find the following:

  • Add Order with MPID
  • Add Order Message
  • Order Delete Message

This time I will not analyze the “Add Order with MPID” message unless it appears to have something of use.  The Message Type is ‘F’, and it looks like this message will be useful to us.  Additionally, MPID stands for “Market Participant Identifier” and appears to simply be your broker.  See:

So, here is the analysis:

Add Order with MPID Attribution

byte # length data description
0 1 0x22 (decimal: 34) Length
1 1 0x46 Message Type ‘F’
2-5 4

02 43 d1 46

Nanoseconds portion of timestamp
6-13 8 00 00 00 00 00 00 16 b2 Order number – unique and is assigned during order entry
14 1 0x42 Type of order

  • ‘B’ – (0x42) – Buy
  • ‘S’ – (0x53) – Sell
15-18 4 00 00 00 64 (decimal: 100) Number of shares
19-26 8

5a 56 5a 5a 54 20 20 20

The stock symbol:


Funny… this looks like a test symbol, take a look at the Bloomberg quote:

27-30 4

00 02 97 ac

Display price, converts to: $16.99
31-34 4  4c 45 48 4d NASDAQ MPID: LEHM (Is that Lehman Brothers?)

So I am looking at the NASDAQ ITCH 4.1 specification (as you have obviously realized by now) and I see that the order immediately before “Add Order with MPID Attribution” is “Add Order – No MPID Attribution”, which is exactly the same as the message above, but without the last field.  The only other difference is that the message type is ‘A’.

A word about Display Price

So the specification says that you convert all Integer price values and treat them as fixed pointed numbers with the first 6 places representing the integer portion and the remaining 4 representing decimal digits, and this leads to a maximum price of 200,000.0000.

So in the example message above:

000297ac is equal to 169900, which is 16.9900, or simply $16.99.


Okay, so we know when the market opens and trading is started, stopped…etc We know when a new order is added to the NASDAQ order book.  What is next? Order Delete!

Order Delete is different from Order Cancel.  Order Delete means that the entire order is removed or deleted from the Order Book, Order Cancel is whenever a portion of an order is cancelled.

Order Delete Message

byte # length data description
0 1 0x0D (decimal: 13) Length
1 1 0x44 Message Type ‘D’
2-5 4

21 95 1b cf

Nanoseconds portion of timestamp
6-13 8

00 00 00 00 00 00 031 6b

Order reference number

Order Cancel Message

byte # length data description
0 1 0x (decimal: ) Length
1 1 0x58 Message Type ‘X’
2-5 4

21 dd db e1

Nanoseconds portion of timestamp
6-13 8

00 00 00 00 00 25 42 b7

Order reference number
14-17 4

00 00 00 0a

Number of shares being removed from order.  Hmmm… is someone backing out of a position? Scared!!! that means sell! Eh, maybe not, they only removed 10 shares.  But what if they are trading a high-priced stock like Amazon or Google? Oops, I meant Alphabet… and what about Berkshire Hathaway?

Okay, so we have Add Order, Remove Order, Shorten Order.  What is left? Order Execute and Order Modify.  I will go with Order Executed.

Order Executed Message

byte # length data description
0 1 0x19 (decimal: ) Length
1 1 0x45 Message Type ‘E’
2-5 4

18 45 cd 07

Nanoseconds portion of timestamp
6-13 8


00 00 00 00 00 00 e9 ca

Order reference number
14-17 4  00 00 03 e8 Number of shares executed
18-25 8

00 00 00 00 00 00 00 01

 NASDAQ generated day-unique match number.

Order Executed with Price Message

byte # length data description
0 1 0x1e (decimal: ) Length
1 1 0x43 Message Type ‘C’
2-5 4

01 74 a8 ca

Nanoseconds portion of timestamp
6-13 8


00 00 00 00 00 00 31 9b

Order reference number
14-17 4  00 00 00 64 (decimal: 100) Number of shares executed.
 18-25 8

00 00 00 00 00 00 03 b0

 NASDAQ generated day-unique match number.
26 1



  • ‘Y’ – (0x59)
  • ‘N’ – (0x4e)
27-30 4

00 02 9c 5c

Execution Price: 17.1100, or $17.11

I think that I have enough information to get started with the FPGA portion of this.  So I will skip analyzing the Order Replace Message for now.  So….

We have analyzed the following message types:

  • Timestamp Message
  • System Event Message
  • Stock Directory Message
  • Stock Trading Action Message
  • Add Order – No MPID Attribution (well, kind of)
  • Add Order with MPID Attribution
  • Order Delete Message
  • Order Cancel Message
  • Order Executed Message
  • Order Executed with Price Message

What is missing? I am looking at the ITCH 4.1 specification and I see the following message types:

  • Order Replace
  • Trade Message (Non-Cross)
  • Cross Trade Message
  • Broken Trade / Order Execution Message
  • Net Order Imbalance Indicator (NOII) Message
  • Retail Price Improvement Indicator (RPII)

So I can go ahead and analyze the rest of the messages, but I want to get to some coding.  Coding as in drawing some LabVIEW program (no, not writing, but drawing).  Anyway, I will take a look at how to write (aka draw) some LabVIEW for FPGA code that can handle the parsing and interpreting of the necessary information to react or trade to a Trump Event.  Stay tuned.

From Trump to Profit

I am sure that every single trader gets nervous whenever Trump speaks.  If he says “wall” they have to go short the Mexican Peso, if he talks about Obamacare or the “Unaffordable Care Act”, they have to short Healthcare stocks.  During his first news conference on Thursday, January 11th, 2017, he went a step further and said he wants bidding and competition for Government purchases of Pharmaceutical drugs.  So not only did the Mexican Peso suffer, but so did Pharmaceutical companies such as GlaxoSmithKline, Merck and Pfizer, among others!

His news conference was from 11:00 am to 12:15 pm.

Here is a chart of the Mexican Peso during this time:

USDMXN – 1/11/2017 from 11:00am to 12:15pm

and a chart showing Pfizer:

PFE US Equity – 1/11/2017 from 11:00am to 12:15pm

and GlaxoSmithKline:

GSK US Equity – 1/11/2017 from 11:00am to 12:15pm

See the CNN timeline of Trump’s first news conference here:

Now how do you use your custom trading algorithm to make money during such an event as a Trump News Conference?  Simple, use FPGAs!

You have your algorithm, which may be as simple as “If PFE drops by x percent in y seconds” then “sell z amount of PFE”.  Then after PFE drops a further amount, you may choose to buy it all back.  The algorithm is up to you of course, and my job is to tell you how to use an FPGA to speed it up, because the first to sell at the top make the most profit.  Let’s take a closer look at the chart for GlaxoSmithKline:

GSK US Equity – 1/11/2017 from 11:22am to 11:25am – right before Trump said that he wants bidding on Pharmaceuticals

The major premise is that at the left of this chart trading volume is very high, both for GlaxoSmithKline, other Pharmaceuticals and the markets in general, and that the few trading firms that are able to send sell orders first will make the most money, with those that follow making less and less at an accelerated pace.  Here is a chart of the volume for GSK during the entire trading day:

GSK US Equity – Volume and Price Jan 11, 2017 11:21-11:26am

On January 11th, 2017, the average trading volume for the entire day for GSK was 13,003 shares per minute, and here is a table of the volume for the chart above:

Minute Volume Price
11:20 8,145 39.1599
11:21 7,266 39.16
11:22 147,329 38.97
11:23 64,563 38.95
11:24 60,768 38.821
11:25 38,823 38.8554
11:26 23,603 38.8368
11:27 34,205 38.8001

Look at the spike in volume at 11:22, and look at the price difference!

So a trader or algorithm looking to exploit this opportunity faces some challenges.

  • More Market Data for security of interest
    • Your algorithm is now being bombarded with thousands, if not hundreds of thousands of messages about the price of the security which you want to trade.
  • More Market Data in General
    • Your market data feeds are being overloaded and the time it takes to process each message increases.
    • The amount of time that it takes to process a message with respect to the amount of messages coming in is never linear.
  • Slower response time from your algo
    • Your algo is slower at generating messages because your system is overloaded.

An FPGA can help in all 3 areas.

1 – Filter out all securities and keep only those of interest

2 – Do the analysis portion to detect whether or not to sell GSK in the FPGA

3 – Generate the orders directly in the fpga


The advantages of an FPGA, especially when in a Network Card configuration is that all of the above happens inside hardware,  and is completely outside of your host computer.  So imagine that your host computer gets only Market Data from a list of securities instead of all Market Data from all securities.  Your host now no longer needs to filter market data before sending the information to your algo.

Now the FPGA can also pre-process the data and send the data in a easier format to the host computer.  Imagine your host computer no longer has to perform simple calculations that it uses to determine whether or not trade because that has been done inside the FPGA.

And finally, why generate and send orders to buy or sell a security inside the host computer when the FPGA can do that for you as well? Instead of sending an entire order down your operating system stack, just send a bunch of parameters to the FPGA and let it handle creating the appropriate messages, calculating CRCs and checksums, and of putting them on the wire.

Hello FPGA

So I want to use an FPGA.  I don’t want to spend thousands of hours reading through manuals, learning VHDL or the “easier” Verilog, and I don’t want to spend forever picking the right hardware, accessories, boards, installing drivers, getting it to work with my operating system…etc

I heard LabVIEW for FPGA is a great tool for FPGAs, but all of my computer programmer friends told me that LabVIEW sucks.  Then I started using LabVIEW for FPGA and realized that they were all wrong and I was right.

Everywhere I look, I see Wall Street people using FPGAs to process Network data before it goes in and out of the network.  In fact many solutions claim to have implemented portions of the network stack inside the FPGA, some even claim an entire TCP/IP stack.  One of these solutions is an open-source project called “NetFPGA”.  Now they have a 10 gigabit board, and a bunch of other similar products, but I don’t know what they are talking about by looking at their website, and I don’t have the time to listen to a bunch of long and boring YouTube videos.  I bought their 1 Gigabit board several years ago, and I was never able to get anything useful done with it.  From not having the right version of the Xilinx tools installed on my machine, lack of the IP Cores to just  not knowing all of the things that “every” programmer is “assumed” to know.  Anyway, go here and see what I mean:

Perhaps I am a moron, perhaps I suck at programming.  But at least I was able to use LabVIEW for FPGA to do some pretty interesting stuff many years ago.  Anyway, welcome to this blog where I will work towards the goal of making a 10 gigabit FPGA accelerated network card that can parse FIX messages and generate Fill Orders whenever certain conditions are met. I will use my own desktop computer for this, which is an older Windows machine with a 10 gigabit network card – Mellanox MNPA19-XTR ($24 USD) purchased for the purposes of this project, and a Windows machine that will be controlling the National Instruments PXIe-6592R ($10,999 USD) FPGA board.  I will install a MicroBlaze Soft Core Processor on the PXIe FPGA board to do the network connectivity for me and to run a simple C++ program that will instruct the rest of the FPGA on what to do.

This should not be difficult, this should not be tedious, and everything that I do I will log here, no more paper logs for me, no more confidentiality or secrecy or fear that someone out there will “steal” my ideas.  The truth is that everybody who is using FPGAs and is not using LabVIEW is making a mistake, and this blog will set out to help people to avoid making the mistakes already being made.  For the good of the world, for the good of Science, for the good of organic farming, for the good of small researchers who can’t afford to develop FPGA solutions using Verilog and VHDL.