Design Movie Ticket Booking (BookMyShow), Low Level Design (LLD) Interview

It looks simple (browse shows, pick seats, pay) but the interviewer is really probing whether you can reason about a shared mutable resource, a seat, under concurrent access. The single most important thing they want to see is how you stop two people clicking the same seat at the same instant from both succeeding. That forces a real conversation about locking, lock timeouts, idempotency, and the booking state machine. It also exercises clean entity modelling (a Show is not a Movie, a Seat is not a ShowSeat) and tasteful use of design patterns without over-engineering.

• City → composition → Theatre. A city owns many theatres (1 to N). A theatre does not exist outside its city in the browse model.
• Theatre → composition → Screen. A theatre owns many screens (1 to N).
• Screen → composition → Seat. A screen owns a fixed physical layout of seats. Seats are part of the screen, not of any show.
• Show → association → Movie. A show references one movie. Many shows can point to the same movie (N to 1). The movie is shared catalog data, not owned by the show.
• Show → association → Screen. A show plays on exactly one screen. The screen's seat layout is projected into the show's ShowSeats.
• Show → composition → ShowSeat. A show owns one ShowSeat per physical seat in its screen. This is the key modelling move: per-show seat state lives here, not on Seat.
• ShowSeat → association → Seat. Each ShowSeat wraps one physical Seat to inherit its row/number/category, while adding show-specific status and price.
• Booking → association → ShowSeat. A booking holds the set of ShowSeats it reserved (1 to N). On confirm it stamps its bookingId onto each.
• Booking → association → Show. A booking belongs to exactly one show.
• Booking → composition → Payment. A confirmed booking owns its payment record (1 to 1).
• BookingService → association → SeatLockProvider. BookingService delegates all hold/release to the lock provider (dependency injection so the lock can be in-memory or Redis-backed).
• BookingService → association → PaymentService. BookingService delegates charging/refunding to the payment service.

// ---------- Enums ----------
enum SeatCategory { SILVER, GOLD, PLATINUM, RECLINER }
enum SeatStatus { AVAILABLE, LOCKED, BOOKED }
enum BookingStatus { CREATED, CONFIRMED, EXPIRED, CANCELLED }
enum PaymentStatus { PENDING, SUCCESS, FAILED, REFUNDED }

// ---------- Static layout ----------
class Seat { // physical seat, no status
 String seatId; String row; int number; SeatCategory category;
}

class Screen {
 String screenId; String name; List<Seat> seats;
}

class Show {
 String showId; Movie movie; Screen screen;
 LocalDateTime startTime, endTime;
 Map<String, ShowSeat> showSeats; // seatId -> per-show state
 ShowSeat seatFor(String seatId) { return showSeats.get(seatId); }
}

// ---------- Per-show bookable seat ----------
class ShowSeat {
 String showSeatId; Seat seat; Show show;
 SeatStatus status = SeatStatus.AVAILABLE;
 double price;
 String lockedByUserId;
 Instant lockExpiry;
 String bookingId;

 boolean lockableBy(String userId, Instant now) {
 if (status == SeatStatus.BOOKED) return false;
 if (status == SeatStatus.AVAILABLE) return true;
 // LOCKED: ok only if expired or held by the same user
 return now.isAfter(lockExpiry) || userId.equals(lockedByUserId);
 }
}

// ---------- Locking (Strategy) ----------
interface SeatLockProvider {
 boolean lockSeats(Show show, List<ShowSeat> seats, String userId);
 void unlockSeats(Show show, List<ShowSeat> seats, String userId);
 boolean validateLock(Show show, ShowSeat seat, String userId);
}

class InMemorySeatLockProvider implements SeatLockProvider {
 private final Duration lockTtl;
 // one mutex per show keeps contention scoped to the same screening
 private final Map<String, Object> showLocks = new ConcurrentHashMap<>();

 private Object mutex(String showId) {
 return showLocks.computeIfAbsent(showId, k -> new Object());
 }

 public boolean lockSeats(Show show, List<ShowSeat> seats, String userId) {
 synchronized (mutex(show.showId)) { // critical section
 Instant now = Instant.now();
 for (ShowSeat s : seats) // check ALL first
 if (!s.lockableBy(userId, now)) return false;
 Instant expiry = now.plus(lockTtl);
 for (ShowSeat s : seats) { // then set ALL
 s.status = SeatStatus.LOCKED;
 s.lockedByUserId = userId;
 s.lockExpiry = expiry;
 }
 return true; // all-or-nothing
 }
 }

 public void unlockSeats(Show show, List<ShowSeat> seats, String userId) {
 synchronized (mutex(show.showId)) {
 for (ShowSeat s : seats)
 if (s.status == SeatStatus.LOCKED && userId.equals(s.lockedByUserId)) {
 s.status = SeatStatus.AVAILABLE;
 s.lockedByUserId = null; s.lockExpiry = null;
 }
 }
 }

 public boolean validateLock(Show show, ShowSeat s, String userId) {
 synchronized (mutex(show.showId)) {
 return s.status == SeatStatus.LOCKED
 && userId.equals(s.lockedByUserId)
 && Instant.now().isBefore(s.lockExpiry);
 }
 }
}
// Production: same interface, body uses Redis SET key val NX PX ttl
// (atomic on the server, TTL handles expiry and crashed holders).

// ---------- Booking ----------
class Booking {
 String bookingId; String userId; Show show;
 List<ShowSeat> seats; double amount;
 BookingStatus status = BookingStatus.CREATED;
 Payment payment; Instant createdAt;
}

// ---------- Orchestrator (Facade) ----------
class BookingService {
 private final SeatLockProvider lockProvider;
 private final PaymentService paymentService;
 private final Map<String, Booking> bookings = new ConcurrentHashMap<>();
 private final Map<String, Show> shows;

 public Booking selectSeats(String showId, List<String> seatIds, String userId) {
 Show show = shows.get(showId);
 List<ShowSeat> seats = seatIds.stream()
 .map(show::seatFor).collect(toList());
 if (!lockProvider.lockSeats(show, seats, userId))
 throw new SeatUnavailableException("One or more seats just got taken");

 double amount = seats.stream().mapToDouble(s -> s.price).sum();
 Booking b = new Booking(UUID.randomUUID().toString(),
 userId, show, seats, amount);
 bookings.put(b.bookingId, b);
 // schedule expireBooking(b.bookingId) after lock TTL
 return b;
 }

 public synchronized Booking confirmBooking(String bookingId, PaymentInfo info) {
 Booking b = bookings.get(bookingId);
 if (b.status == BookingStatus.CONFIRMED) return b; // idempotent
 if (b.status != BookingStatus.CREATED)
 throw new IllegalStateException("Booking " + b.status);

 for (ShowSeat s : b.seats) // re-validate holds
 if (!lockProvider.validateLock(b.show, s, b.userId))
 throw new SeatLockExpiredException("Hold expired, please retry");

 Payment p = paymentService.charge(bookingId, b.amount, info);
 if (p.status != PaymentStatus.SUCCESS)
 throw new PaymentFailedException();

 for (ShowSeat s : b.seats) { // commit
 s.status = SeatStatus.BOOKED;
 s.bookingId = bookingId;
 s.lockedByUserId = null; s.lockExpiry = null;
 }
 b.payment = p;
 b.status = BookingStatus.CONFIRMED;
 return b; // publish BookingConfirmed event
 }

 public synchronized void expireBooking(String bookingId) {
 Booking b = bookings.get(bookingId);
 if (b == null || b.status != BookingStatus.CREATED) return; // race-safe
 lockProvider.unlockSeats(b.show, b.seats, b.userId);
 b.status = BookingStatus.EXPIRED;
 }
}

• Two users select the exact same seat at the same millisecond. Only one lockSeats call may win. The check-and-set inside the lock provider must be atomic (single lock / compare-and-swap), otherwise both read AVAILABLE and both write LOCKED.
• Partial selection: a user picks seats A1, A2, A3 but A2 was just taken. The whole selection must fail and release A1/A3, never lock a partial set, because the UI promised the user all three.
• Hold expires while the user is on the payment screen. confirmBooking must re-validate the lock (validateLock) and reject with a clear error if the lock expired or was reassigned; never confirm on a stale lock.
• User pays but the response is lost (network blip) and they retry. confirmBooking must be idempotent keyed on bookingId so the gateway is not charged twice.
• Lock expiry sweep races with confirm: a background thread tries to expire a booking at the same instant the user confirms it. Guard with the booking state machine, only one of EXPIRE or CONFIRM can transition out of CREATED.
• A seat ends up LOCKED forever because the process that held it crashed. The lockExpiryTime makes every lock self-healing; getSeatMap also treats expired locks as available so a crash never permanently strands a seat.
• Same user clicks a seat they already hold. lockSeats should be reentrant for the same userId (extend the hold) rather than throwing.
• Payment succeeds at the gateway but our confirm code throws before flipping seats to BOOKED. Reconcile via gateway webhook + the booking record so money and seats stay consistent; treat the booking, not the charge, as source of truth.
• Cancelling after the show has started, or cancelling an already CANCELLED/EXPIRED booking, must be rejected by the state machine.
• Clock skew across servers in the distributed version makes lock expiry unreliable; rely on Redis TTL (server-side expiry) rather than comparing local timestamps.