SAWEM
South African Wholesale Electricity Market
E-Trading Platform
MakwaIT · a South African IT company
MakwaIT · a South African IT company
A wholesale electricity market is, underneath, a settlement problem wearing a market’s clothes — get the arithmetic wrong and nothing else about it matters. Day-ahead, intraday, balancing and settlement grew up as four separate systems — an accident of sequence, not a design. We built them as one, because a market that reconciles itself after the fact is already behind.
A wholesale market this size will not run on spreadsheets and month-end reconciliation for long. That is a systems problem before it is a policy one, and it arrives quietly: nothing breaks on the day the volume doubles, it just stops being possible to answer a question about last Tuesday.
And in a market this new, nobody yet has years of institutional memory for what a bad evening peak is supposed to look like. The baseline has to be built rather than remembered — which is why the arithmetic and the sequence matter more here than they would in a market with forty years of precedent behind it. The infrastructure a market runs on for the next twenty years is usually decided in the first two.
When most of the new capacity is wind and sun, the market’s core input is itself a forecast. Every imbalance charge in the system begins as a forecast that moved. There are only two ways to spend less on that: make the correction cheap and fast, or make the forecast better.
The platform is the first of those — the trading day this document is about. The second is a separate arm of our group: weather, climate and hydrology. That makes high-resolution wind and solar forecasting an input this platform can take rather than a feature it would have to grow. It is not part of the proof of concept, and we do not count it among the seven.
We are not describing an idea for a platform. We built a working one, and this is what we learned building it.
Late afternoon. The wind forecast is revised down, and 280 MW of an 840 MW day-ahead position is suddenly uncovered. That gap has to be closed by somebody, at some price. The question is only whether the seller closes it now, on their own terms, or has it closed for them at delivery. Closing it themselves means re-bidding — which, for a seller who is suddenly short, is a buy-back: a cover trade, not a fresh offer.
Everything below either runs today or is named as proposed production scope. We have tried hard not to blur the two, because the blurring is the thing that makes a document like this worthless.
Day-ahead, intraday, balancing and settlement on one scrubbable, replayable 24-hour timeline. The merit-order stack, the marginal unit that sets the System Marginal Price, and the settlement statement that follows are all the same record — one source of truth, rather than four systems reconciled after the fact. This is the product claim; everything else is a consequence of taking it seriously.
A separate command-line verifier imports the same clearing module the server runs, recomputes the System Marginal Price byte-for-byte from a receipt’s inputs, checks it against the SHA-256 output hash the receipt recorded, and exits non-zero on any mismatch. Determinism is enforced as a build gate: the build mechanically rejects wall-clock reads and random numbers inside clearing, settlement and anomaly code. Money is integer cents, energy is integer MW-minutes, ties break on a strict total order. A price that only one system can produce is a price only that system can defend — a counterparty, an operator or a participant can each re-run the number and get the same answer.
Generator, large customer at 1 MVA and above, distributor, aggregator, cross-border and municipality — the last participating indirectly rather than as a direct counterparty. Traders are excluded from cleared auctions in this phase, and the API returns that reason explicitly rather than failing quietly. These are not generic market roles with local names painted on them.
A forecast slips and a position goes uncovered. The platform prices both ways out while there is still liquidity to act on, instead of presenting the outcome as a line on a settlement statement three days later. Bid validation and gate-closure handling are proposed, not built, and they are what makes this loop safe at production volumes.
Not a downstream reconciliation: the settlement statement reads the same appended events the clearing wrote. Every event lands on a SHA-256 hash-chained append-only log with its own chain verifier, so every trade has a receipt either counterparty can verify independently. The chain is tamper-evident: alteration is detectable rather than impossible, and that is the honest word for it.
A market this size needs a shared, privacy-safe public price signal. Published aggregates carry differential-privacy noise and a k-anonymity floor of five, so the market can be read without revealing any single participant’s book, and a low-bandwidth text-only view is included, so the public price signal stays usable on a slow or metered connection.
Four detectors run against the book: capacity withholding signalled by Residual Supply Index, wash trading by matched offset, price spikes against a 30-day band and collusion or layering by order-book pattern. Each flag is a screening signal, not a verdict. What makes it useful is the counterfactual re-clear behind it, which says what the hour should have cost rather than only that something looked odd: in the worked case, R1 150/MWh against the R2 850 it actually cleared at. It runs inside the market’s own core, alongside matching and settlement — the operator’s own instrument on its own book.
Also built, and deliberately not on this list: vesting contracts, a ramp-cap gauge, an infra-marginal “did my offer clear?” panel and a greeting layer across the eleven official spoken languages, with South African Sign Language noted as the twelfth. Ancillary services, capacity markets, financial transmission rights and full metering reconciliation are real, necessary and not here.
The spine down the left is the point of the design. Every layer writes to it, nothing bypasses it, and what it holds can be checked by someone who does not trust us.
Everything drawn here runs today except the replicated commit log, hardware-backed signing, and the grid and banking integrations. Gate closure, prudential handling and a second South African site are proposed and not drawn.
Proposed production design, written for the person who will be asked whether this is credible.
The honest line runs through the word signing. Clearing receipts and settlement statements would be signed with keys held in an HSM or KMS, laid on top of the tamper-evidence that already exists — what runs today is hashed, not signed, and we keep those two words apart on purpose. Underneath it, archival is write-once with object lock and air-gapped copies, so the record outlives the systems that wrote it.
A record nobody can quietly amend is worth less if anybody can quietly become somebody else, so identity is hardware-rooted at the participant edge and mutual TLS between services, with segregation of duties and maker-checker on every settlement adjustment. Prudential, credit and collateral management — exposure, margining, default handling — is absent from the proof of concept entirely, and the first production workstream we would fund.
Where standards earn their keep we use them rather than invent around them: CIM (IEC 61970/61968) for grid and market data, IEC 62351 for its security, ISO 20022 for settlement messaging, REST and webhooks for the participant API. The stack is containerised and defined as infrastructure-as-code, so it can be moved between hosting providers without redesign.
This runs today, in South Africa, on infrastructure we built and host ourselves — not a slide of a plan. The production design keeps the entire market core in the country. Only the public view is a candidate for distribution beyond it, and only because differential privacy and a k-anonymity floor have already taken everything confidential out of it. For a market this visible, who can see or seize the record tends to get asked before anything about features.
The infrastructure a market runs on for the next twenty years is usually decided in the first two. This is the order in which a system of this consequence earns the right to be trusted — and each step is passed on technical evidence before the next one begins.
Running now, in-country, on synthetic data, with the clearing path held under a determinism build gate and the ledger under a chain verifier.
The same engine fed real data, clearing and checking in parallel, while nothing it produces moves money or changes dispatch. The point is a track record built before it is needed — a detector validated in advance rather than debugged during its first real dispute.
Authority transfers only once the answers have matched reality long enough to be unremarkable. That is the standard we would want applied to us.
That is what runs: a full trading day cleared, re-verifiable by anyone who cares to check, and settled on the record that cleared it — every order, clearing and settlement written once, in sequence, never rewritten.
Credit, collateral and margining are next to build — the layer that stands behind a cleared trade and makes sure it settles. Named now, on the roadmap, rather than discovered late.
Status. What runs today is a proof of concept: real code, real determinism, real cryptographic chaining — on synthetic data, at demonstration scale, on a single site. It is not a licensed exchange, not a certified system, and it carries no claim of regulatory approval. Every figure in the captures above is illustrative synthetic data; the code that produces those figures is real, deterministic and re-runnable, which is the whole point. Who built it. MakwaIT is a South African, B-BBEE-recognised IT company; the engineers and the infrastructure are both South African.