Fail closed: why our trading platform refuses risk when it is unsure

Most automation fails open. A quote goes stale and the bot keeps using it. A broker times out on a fill confirmation and the ledger records the order anyway. The failure is quiet, and the quiet is the expensive part: you find out at month end, if at all.

SUTP was built the other way round. Every order passes through a pre-trade gate with a fixed rule: missing data, a stale quote, an unreadable calendar, an unset configuration or an unreachable broker means no new risk. The gate does not weigh the evidence. If anything it needs is absent, it refuses and says why.

What this costs

A fail-closed gate declines trades that would have been fine. On days when a venue’s data feed is late, the book does less than it could. We accept that trade, because the alternative is a book whose record we cannot defend.

What it buys

Three things that matter more to us than the trades we miss:

1. The ledger means something. Because nothing is booked without the evidence it was booked on, reconciliation to the broker’s record is a check, not a repair.
2. Breakers can be trusted. Drawdown, daily-loss and order-rate breakers latch when they fire and stay latched until a person clears them. A breaker that could be argued with is not a breaker.
3. Halts are cheap. HALT.ALL stops every book at once, and the platform’s default state after a surprise is stopped. Restarting is a decision a human makes with the facts in front of them.

Where it shows up elsewhere

The same rule appears in TaxReturnStudio as a completeness contract: the system works out which forms and schedules a return requires and refuses to call the inputs complete while any of them is missing, doubtful or unsupported. The anti-goal, written into the design, is “silently producing an incomplete return.”

Fail closed is not a feature. It is the shape of every system we are willing to put our name on.