400G per wavelength on a 610 km nine-span DCI with no regeneration

Start with the arriving OSNR at 0.1 nm. Using the standard amplifier-chain approximation, OSNR = 58 + per-channel launch power - span loss - noise figure - 10log(number of spans): 58 + 0 - 17 - 5.5 - 9.5, which is about 26 dB, matching the pre-build estimate. Remove the 2 dB ROADM penalty to get about 24 dB, then the 5 dB of combined margin, leaving roughly 19 dB of usable OSNR.

Now compare with what the modulations need back to back, including FEC and a realistic implementation penalty of about 2 dB:

• 200G on PM-QPSK at about 64 GBaud needs roughly 14 to 15 dB back to back; with penalty, 16 to 17 dB. That closes with 2 to 3 dB in hand.
• 400G on 16QAM needs about 6 dB more than QPSK, so roughly 20 to 21 dB back to back and 22 to 23 dB with penalty. That does not close against 19 dB; the link would run with negative margin and would fail as fiber ages or as span loss drifts.

So the answer is 2 x 200G lambdas rather than 1 x 400G. That delivers the 400G of capacity the business case wants, uses modulation that closes with real margin, and keeps the option of moving to higher-order modulation later if a regeneration site is added.

The options, in order of how likely I would be to recommend them:

1. Mid-point regeneration. Put a regenerator at roughly span 5, splitting the line into 5-span and 4-span segments. Each segment improves to about 28.5 dB before the ROADM, so around 26.5 dB, and about 21.5 dB after margins. That is still marginal against the 22 to 23 dB that 400G 16QAM needs, so a single regeneration point at this span count probably does not close the case on its own; two regeneration points or shorter spans would.
2. Reduce span loss or span count. Re-splicing, moving an amplifier site to cut the longest spans, or replacing the two 0.25 dB/km spans would buy the missing margin more cheaply than regeneration if the geography allows it.
3. 400G coherent pluggables in the routers, bypassing the ROADM degrees. This avoids ROADM penalty and some amplification, but reach at 400G over 610 km of this loss profile is well beyond typical pluggable reach and should not be assumed.

On cost and latency: regeneration adds two powered sites, floor space lease, and operational cost, plus roughly microseconds of latency per regenerator, which is negligible compared with the 3 ms of propagation over 610 km. The honest answer is that the 400G day-one assumption is the wrong thing to hold fixed; the capacity target and the per-lambda rate are separate decisions.

Encryption does not consume optical signal-to-noise ratio in any of the three cases, because it happens in the client or framing logic rather than on the line signal. The differentiators are granularity, transparency and where the crypto boundary sits.

• OTN-layer encryption (GCM-AES-256 in the transponder or muxponder) is transparent to whatever the tenant runs, covers the whole wavelength regardless of client protocol, terminates at the two 1830 PSS ends, and adds microseconds. Against it: it encrypts everything on that wavelength, so you over-protect other tenants unless you dedicate lambdas, and it slightly reduces client payload through framing overhead.
• MACsec is Ethernet-layer and hop by hop, so it terminates wherever the next MACsec peer is; it also adds microseconds but requires MACsec-capable line-rate ports on both ends, which at 400G narrows the card choice. It gives clean per-tenant separation if the tenant gets dedicated Ethernet circuits.
• IPsec terminates on the routers, gives the finest per-tenant granularity and the strongest policy control, but has the highest latency and throughput cost and needs crypto capacity on the PEs.

Given one tenant with a hard requirement and a shared wavelength plan, the cleanest design is to dedicate one or two lambdas to that tenant and encrypt at the OTN layer, keeping key management on an external key server rather than inline, and confirming the certification requirement before choosing the layer.