Halley: A Predictive Control Plane for Optical AI Data Center Networks

Halley is a predictive control plane for the four optical layers of a co-packaged AI data center fabric — laser pool, circuit switch, microrings, and field-replaceable modules — where correlated laser failures cap availability at a fixed spare ratio, so decorrelation is shown to be cheaper than adding spares.

Between racks, AI training traffic crosses an optical fabric whose four layers (shared external lasers, OCS, microring modulators, field-replaceable modules) each run a fixed or after-the-fact policy. Because every training step ends in an all-to-all collective that acts as a barrier, a drifted ring, failed laser, or late switch reconfiguration idles every accelerator. Lasers sharing one enclosure, cooling, and power fail together, so at a fixed spare ratio correlated failure provably caps a pool's availability however large it grows. Existing control planes do not forecast the co-packaged optical hardware itself, so they act only after the failure or drift arrives.

The paper models a pooled laser supply with exchangeable, positively correlated failures and derives a closed-form availability ceiling A* < 1 that depends on the correlation ρ and the per-laser failure probability but not on pool size, plus a hierarchical version in which within-module correlation is suppressed by 1/M and across-module correlation sets the floor. On that basis it builds four predictive controllers, one per optical layer: LightReserve sizes the spare count from failure rate and correlation and, when the target is unreachable inside a budget cap, emits the decorrelation target ρ' instead; FoldFit recasts OCS scheduling as packing jobs onto m parallel channels and binary-searches a deadline with first-fit-decreasing, inheriting the MULTIFIT bound; ThermaLead pre-positions each ring's heater one step ahead with an 8-sample moving average of drift slope; TriageGuard ranks modules by temperature, age, and FEC bin and pre-spares the top-B risks, which is shown exactly optimal by an exchange argument conditional on the risk estimate. All four defer to the deployed reactive policy when the forecast is stale or unsure. The components are composed arithmetically into effective cluster goodput, and the fail-safe watchdog and thermal servo are implemented, formally verified, and signed off in silicon.

• At the assumed correlation and stress failure rate, a 2× pool ceiling caps availability; 99.999% becomes reachable only below a critical correlation, and a 32-channel pool stays out of reach within the 2× cap when the per-window failure probability is above a threshold. §III-B
• LightReserve reproduces classical small spare counts under independence but needs far more spares once correlation is included, and flags 99.999% as unreachable inside the cap, returning a correlation target instead. §IV-A
• Under the stated cost model, decorrelating first and then buying spares reaches the 99.999% coverage target far cheaper than spares alone, and the ordering holds across the plausible correlation band. §V-B
• Composing the simulated components at the stress operating point lifts effective cluster goodput under the coverage reading, with a much smaller gain on the lit-share reading; most of the gain comes from the provisioning decision. §V-D
• FoldFit stays within the quoted ratio of optimal on the swept MoE workloads and cuts a reconfiguration proxy at 16 engines, though the worked example loses one alignment slot relative to the port lower bound. §IV-B
• The fail-safe watchdog and thermal servo synthesize to a small footprint, close timing on every placement seed on two FPGAs, pass a 130 nm signoff, and are machine-proven against an independent specification core. §VI-B

• The fallback rule catches a stale, low-confidence, or late forecast but not a confident but wrong one, on which a controller can reconfigure the fabric more often than it should; a formal bound on that harm is left to future work, and acting also costs prediction compute, heater energy, and a hardened control interface against spoofed telemetry (§VII-D).
• The failure inputs are assumed rather than measured: the correlation ρ, on which both the sparing result and the ceiling depend, has no field data for these laser form factors, and no published field value was found for the per-laser failure rate; the headline figures use the stress setting λ = 0.05 per window (§VII-D).
• Of the three conditions that carry FoldFit's guarantee onto a switch, the third — realizing the packing as port-disjoint configurations — is exact only when a demand may be split at a configuration boundary, and a proof for strictly unsplittable demands is open; the guarantee also covers dwell time only, not switching delay (§VII-D).
• Every numerical result outside the hardware section is a calibrated simulation or closed-form evaluation, the two loss shares of the goodput model are assumptions, ThermaLead's forecast deficits grow to 49–67% under abrupt phase jumps, and the results are not measurements on hardware (§VII-D).

• At a fixed spare ratio, availability converges as the pool grows to a ceiling depending only on failure correlation and per-laser failure probability, not on pool size; raising the ratio past a point lifts availability too slowly to be deployable. §I
• In a hierarchical module structure, the within-module correlation term is suppressed by 1/M while the across-module correlation sets the floor, so a designer gains more from separating modules than from separating lasers inside one. §V-A
• At the 18×8 module shape with within-module 0.30 and across-module 0.05, the pool-average correlation is 0.062 and coverage of the 32-channel 2× pool rises to 99.993% with the spare count unchanged. §V-A
• A coupled composition, in which one latent variable drives both laser availability and thermal loss, reproduces the same mean goodput but reveals a tail: goodput at the fifth percentile is 67.8% and at the first percentile 59.7%. §V-D1
• ThermaLead's ungated moving-average forecast loses lock 2% more often than the deployed dither lock on the stress trace, but gated on its own recent error it loses lock 2.1% fewer, and it helps more as drift gets smoother. §IV-C
• TriageGuard's top-B selection is exactly optimal for a fixed risk estimate, but the benefit is bounded by ranking quality: fresh telemetry roughly doubles the recovery-time cut of a stale ranking and nearly reaches an oracle. §IV-D
• The systematic part of the goodput tail has closed-form quantiles via monotone transport; below a threshold percentile that falls as correlation rises, decorrelation lifts that part of the tail. §V-E
• Addressing the deployment gap requires a published interface exposing per-laser health and failure timestamps, per-ring temperature and lock state, and switch reconfiguration hooks, which also enables the field measurement of ρ. §VII-B