Johannes Bund
email: jbund@mpi-inf.mpg.de

Matthias Függer
email: mfuegger@lsv.fr

Christoph Lenzen
email: clenzen@mpi-inf.mpg.de

Moti Medina
email: medinamo@bgu.ac.il

Synchronizer-free Digital Link Controller

Keywords: consumer link, digital controllers, continuous processes, metastability-free, metastability-containing mixed signal control loop I

This work presents a producer-consumer link between two independent clock domains. The link allows for metastability-free, low-latency, high-throughput communication by slight adjustments to the clock frequencies of the producer and consumer domains steered by a controller circuit.

Any such controller cannot deterministically avoid, detect, nor resolve metastability. Typically, this is addressed by synchronizers, incurring a larger dead time in the control loop. We follow the approach of Friedrichs et al. (TC 2018) who proposed metastability-containing circuits. The result is a simple control circuit that may become metastable, yet deterministically avoids buffer underrun or overflow. More specifically, the controller output may become metastable, but this may only affect oscillator speeds within specific bounds. In contrast, communication is guaranteed to remain metastability-free.

We formally prove correctness of the producer-consumer link and a possible implementation that has only small overhead. With SPICE simulations of the proposed implementation we further substantiate our claims. The simulation uses 65 nm process running at roughly 2 GHz.

Index Terms-producer-

TABLE I: Performance and hardware overhead (buffer size N , gates, flip-flops, oscillator type) of the proposed controller with a tunable 2.0 to 2.3 GHz oscillator, [START_REF] Dally | The Even/Odd Synchronizer: A Fast, All-Digital, Periodic Synchronizer[END_REF], and [START_REF] Polzer | A Metastability-Free Multisynchronous Communication Scheme for SoCs[END_REF].

this work [ "stale" by the time they affect the system. This requires almost-full flags [START_REF] Coates | Congestion and Starvation Detection in Ripple FIFOs[END_REF], long handshake latencies that increase the dead time and affect the latency and throughput, additional slack in a controller cycle accounting for metastability resolution time in controller's flip-flops or mutual exclusion (MUTEX) elements [START_REF] Dobkin | High Rate Data Synchronization in GALS SoCs[END_REF], [START_REF] Jackson | Gradual Synchronization[END_REF].

At the heart of the problems faced in these controllers lies the impossibility to solve discrete decision problems, e.g., writing to a cell at a certain clock tick or skipping a clock cycle, under continuous inputs (i.e., arbitrary phase shifts between producer and consumer clocks) within bounded time [START_REF] Marino | General Theory of Metastable Operation[END_REF]. One way out of this impossibility is to resort to endto-end analog designs, e.g., by letting an analog controller apply continuous phase shifts by (slightly) tuning the producer and/or consumer oscillator. This comes at the burden of a fullyfledged analog design.

An interesting alternative was proposed in [START_REF] Sokolov | Towards Asynchronous Power Management[END_REF], where the authors advocate the use of asynchronous controllers, sensing and controlling analog processes. With this approach, analog components are required at the controller interfaces only, and the controller itself is implemented by a digital asynchronous circuit. For certain classes of controllers, this approach allows to completely circumvent metastable upsets within the controller circuit, essentially by allowing for the occurrence of (digital) controller outputs within a continuous time range, rather than at discrete clock ticks only.

Contribution: We propose a fundamentally different approach, exemplifying it at the hand of highly efficient link controllers: like [START_REF] Sokolov | Towards Asynchronous Power Management[END_REF], we replace large parts of a (conceptually) analog controller by standard digital circuitry. However, we do not resort to asynchronous circuits. Instead, we allow unstable/metastable signal values within our circuit and treat them as a third "logical" value. Clearly, care must be taken that such values do not "infect" the whole controller logic, leading to unconstrained control outputs. For this purpose, we follow [START_REF] Friedrichs | Metastability-Containing Circuits[END_REF], using the same worst-case propagation model and analysis to provably contain metastability.

Specifically, we propose a digital controller that drives tunable ring oscillators as presented in [START_REF] Ghai | Design of Parasitic and Process-Variation Aware Nano-CMOS RF Circuits: A VCO Case Study[END_REF] at the sender and receiver side and prove its correctness. The controller is small in size, has low control latency and allows for small link buffers. We show that this guarantees high throughput and low latency communication. Most notably, while the controller may become metastable, we ensure that metastability is contained within the controller, and does not lead to metastable upsets, corruption, or drops of communicated data words in the ring buffer between the sender and receiver. We complement our provable system guarantees with simulations (see Sec. IV).

Related Work and Comparison:

There is a large body of work on links between clock domains, motivated by their central importance in GALS designs. According to [START_REF] Teehan | A Survey and Taxonomy of GALS Design Styles[END_REF], GALS systems can be classified by their clocking schemes: (i) pausible clocked systems, (ii) asynchronous systems with uncorrelated clocks, and (iii) loosely synchronous systems, with (partially) synchronized clocks. We shortly review senderreceiver communication in these three approaches.

(i) Pausible clocking overcomes synchronization issues by halting the clock until metastability is resolved [START_REF] Mullins | Demystifying Data-Driven and Pausible Clocking Schemes[END_REF]; e.g., the design in [START_REF] Najvirt | How to Synchronize a Pausible Clock to a Reference[END_REF] guarantees no glitches on stopping and starting. Metastability inside the control loop may lead to an arbitrary delay of the final pulse on stopping. This requires that the clock cannot be started again before metastability has been resolved.

(ii) Uncorrelated clocks: Communication between uncorrelated clock frequencies and phases is traditionally done by combining classical two-flop synchronizers with buffers and flow-control circuitry. A downside of these approaches is that the latency and the throughput are determined by the handshake cycle that has to include (at least) two synchronizer cycles at both sides. Clearly, also this approach has a non-zero upset probability and thus finite MTBF. In [START_REF] Chelcea | Robust Interfaces for Mixed-Timing Systems[END_REF], a mixed-clock first-in first-out pipeline (FIFO) with flow control logic is proposed. Instead of classical handshaking, synchronized full/empty and almost full/empty signals are used. The throughput is one data item per clock cycle until the almost full signal is raised; afterwards, the "true" full signal has to be considered, at the cost of increased latency and lower throughput. The approach has finite MTBF. In [START_REF] Coates | Congestion and Starvation Detection in Ripple FIFOs[END_REF], a ripple FIFO solution with almost full/empty signals is proposed. The approach requires slow sender/receiver speeds compared to data propagation within the ripple FIFO. Moreover, full/empty flags have to be synchronized, which leads to increased latency and finite MTBF. In [START_REF] Dobkin | High Rate Data Synchronization in GALS SoCs[END_REF], a locally delayed latching (LDL) approach is proposed: conflicting read/write operations are delayed by an asynchronous controller with a MUTEX element. Controller latency is in the order of 20 gate delays, and the minimum feasible clock cycle is no less than 69 gate delays, accounting for enough time for the MUTEX to stabilize with high probability. Gradual synchronization [START_REF] Jackson | Gradual Synchronization[END_REF] allows finegrained interweaving of synchronization and computation, also shifting conflicting ripple FIFO requests by MUTEX elements at each stage. Like synchronizer chains, this approach has finite MTBF that can be increased at the cost of higher latency. Dally and Tell [START_REF] Dally | The Even/Odd Synchronizer: A Fast, All-Digital, Periodic Synchronizer[END_REF] propose a scheme in which the MTBF can be made arbitrarily large without increasing latency. They use synchronizers to continually determine phase offsets between sender and receiver clocks only. A drawback is that the frequency and phase measurement circuits require accurate phase tracking (64bit in their implementation) and can account for slow phase drifts only.

(iii) Loosely synchronous systems: in contrast to (i) and (ii), synchronizing clocks allows obtaining worst-case guarantees on latency and throughput together with provable absence of metastable upsets. Our approach also falls into this class. The closest work to our approach presumably is proposed in [START_REF] Polzer | A Metastability-Free Multisynchronous Communication Scheme for SoCs[END_REF]. By using the distributed DARTS clock generation mechanism [START_REF] Függer | Reconciling Fault-tolerant Distributed Computing and Systems-on-Chip[END_REF], a buffer size of 9 and latency of 9 clock cycles was achieved for a receiver-sender clock shift of 4 ticks at around 25 MHz in an FPGA. While these numbers clearly can be improved in ASIC designs, DARTS inherently is slower than our approach.

Table I shows a comparison of our controller with the most closely related works, [START_REF] Polzer | A Metastability-Free Multisynchronous Communication Scheme for SoCs[END_REF] and [START_REF] Dally | The Even/Odd Synchronizer: A Fast, All-Digital, Periodic Synchronizer[END_REF] (cf. Section IV for details).

Our link controller has some similarities to a phase locked loop (PLL) with an all-digital phase detector; see e.g. [START_REF] Chung | An All-Digital Phase-Locked Loop for High-Speed Clock Generation[END_REF], [START_REF] Abadian | A New Low-Power and Low-Complexity All Digital PLL (ADPLL) in 180 nm and 32 nm[END_REF] for all-digital PLL designs. We briefly summarize commonalities and differences in the following. 1Classical PPLs lock a slave clock to a typically more stable master clock. In our case we do not distinguish between a slave and a master, but our controller treats both receiver and sender clocks equally; one might think of this as a "peer-topeer PLL". The reason is that our goal is not to stabilize the absolute frequency of a poor clock by ensuring a bounded phase offset to a more stable master clock, but rather to bound the phase offset between a sender and receiver clock of similar quality. Additionally we provide lower and upper bounds on the frequency of the clocks which are close to the frequency bounds free-running oscillators of the same quality have. For example, this is useful when communicating with the environment.

The initial stage of a classical PLL is a phase frequency detector (PFD), which measures the phase difference between the master and slave clock signals. Designs range from conventional PFDs, which measure negative and positive phase offsets on separate binary output signals by producing pulses whose width is the negative/positive phase offset, to more advanced setups [START_REF] Pan | A Fast Lock Phase-Locked Loop Using a Continuous-Time Phase Frequency Detector[END_REF]. Phase differences are then either forwarded to charge pumps (analog PLLs) [START_REF] Bashir | Fast Lock Scheme for Phase-Locked Loops[END_REF] or converted to digital counter offsets (digital PLLs). For the latter, an unstable phase difference poses a risk for increased power consumption and likelihood of metastable upsets; see [START_REF] Abadian | A New Low-Power and Low-Complexity All Digital PLL (ADPLL) in 180 nm and 32 nm[END_REF], where a filter on phase difference signals for a low-power digital PLL is proposed.

In our case, there is a (digital) unary-encoded up/downcounter at the heart of the controller, allowing to measure the phase difference between both clocks. Note that since our goal is not to lock to a highly stable oscillator, our design is much simpler: our circuit only determines whether the actual phase offset is larger or smaller than the desired phase offset. It is also worth noting that, while our oscillators are analog components, our circuit relies on the ability to switch between "fast" and "slow" only. This binary decision may become un- The use of local clocks in our design has a further advantage over locking to a centralized clock that is assumed to provide a highly stable frequency reference. In our system the sender and receiver are not impaired by the failure of the respective other's clock. While correct communication between the two nodes inherently requires both oscillators to work correctly, our design guarantees that if one of the oscillators fails, the respective other keeps running within the same frequency bounds. Potential top-level error-detection based on the (non-)communicated data then provides adequate application-specific reaction to such scenarios.

Organization of the paper: We start with presenting the problem of communication in a system of two nodes with controllable oscillators in Section II. We then break the system down into modules, formally specifying their requirements. Section III discusses gate-level implementations of the modules, together with proofs that the implementations satisfy the formal requirements. In Section IV, we present simulations of our implementation at gate-level (VHDL) and transistor level (Spice). The simulation results are consistent with our formally proven results, and allow to obtain detailed performance metrics. We conclude in Section V.

II. SYSTEM SPECIFICATION AND MODEL

We specify the system requirements and functionality next. The link (see Fig. 1) has three parts: (i) tunable oscillators OSC snd and OSC rcv , (ii) a (ring) buffer BUFF, and (iii) a buffer controller CTRL. The link enables communication between two parties, a sender SND and a receiver RCV, that interact with the link via prescribed interfaces, discussed later on.

The sender writes data to a ring buffer of even size N > 0, which is read by the receiver. Cells are numbered from 0 to N -1. Read and write access is clocked: following transitions of its clock clk snd , the sender writes to the ring buffer. The register address is specified by the current value of its address pointer, which it subsequently increments (modulo N ); likewise, following transitions of its clock clk rcv , the receiver reads from its current address and subsequently increments its pointer.

We remark that our design can easily be altered for bidirectional communication. Each party needs to perform a read/write sequence instead of just a read (RCV) (respectively write (SND)) operation when it is accessing a buffer cell; the only effect is that the respective higher access time needs to be respected in the timing constraints on the system. For ease of presentation, we stick to the asymmetric setting in the following.

A. Local Clocks

Sender and receiver clocks clk snd and clk rcv are derived from clock sources OSC snd and OSC rcv , respectively. We require that these clock sources (or oscillators) are tunable in frequency by the mode signals md snd and md rcv .

Denote by C(t) ∈ Z a discrete clock value at wall-clock time t ∈ R + 0 . This discrete clock is derived from a continuous clock c(t) ∈ R as C(t) c(t) , with current frequency ċ(t). Let C s (t), C r (t) be the discrete clock values of sender and receiver at wall-clock time t, and c s (t), c r (t) their continuous clocks. For properly chosen T osc ≥ 0 and δ ≤ 1, we require: (C1) We assume that the clocks are started roughly at the same time:

2 c s (0), c r (0) ∈ (-δ, 0]. (C2) If md snd (md rcv ) is constantly 0 during [t -T osc , t], the sender (receiver) is in slow mode at time t and ċs (t) ∈ [s -, s + ] ( ċr (t) ∈ [s -, s + ]). (C3) If md snd (md rcv ) is constantly 1 during [t -T osc , t], the sender (receiver) is in fast mode at time t and ċs (t) ∈ [f -, f + ] ( ċr (t) ∈ [f -, f + ]). (C4) If md snd (md rcv ) is neither constantly 0 nor constantly 1 during [t -T osc , t], the respective clock is unlocked and ċs (t) ∈ [s -, f + ] ( ċr (t) ∈ [s -, f + ]
). (C5) Clocks in slow mode are never faster than clocks in fast mode: s + ≤ f -. Here, T osc is the response time of the tunable oscillator. Note that our requirements on the oscillator are fairly weak, making it easy to implement (cf. Section IV): Only if the stable control signal is stable for T osc time, the oscillator needs to guarantee the respective rate. At any other time, it is not locked to a fixed frequency mode and may run at any rate between the slowest and fastest possible. This unlocked mode may be entered when the control signal is ambiguous or transitioned recently, i.e., when both parties are almost perfectly synchronized. The last condition is a minimal requirement ensuring that the phase offset between the two clocks cannot increase further when a clock in fast mode is chasing a clock in slow mode.

B. Buffer Access Specification

Next, we specify buffer access in an abstract model with few parameters. We assume that access to a buffer cell starts when the respective clock modulo N (possibly with a fixed offset) equals the buffer index. Note that this is a normalization of the time axis so that one computational cycle takes 1 unit of "local" time as measured by the sender or receiver oscillator, respectively. 3 A computational cycle is defined by the local time between accessing consecutive buffers.

Intuitively, a buffer cell is valid (i.e., ready to be read) if it contains stable, logical data and is currently not written. A buffer cell is invalid (i.e., ready to be written) if it is not valid and currently not read. Formally: (B1) We define the receiver's (discrete) address pointer as P r (t) p r (t) mod N = C r (t) mod N , where the receiver's (continuous) address pointer is p r (t) c r (t). That is, the receiver starts to access cell at each time t when P r (t) = p r (t) mod N = . (B2) We define the sender's address pointer to be P s (t) p s (t) mod N , where p s (t) c s (t) + N/2. That is, the sender pointer has a (nominal) offset of half the ring size relative to the receiver pointer. In the following, we will simply drop the "starts to" and say that the receiver (sender) accesses cell at time t if p r (t) mod N = (p s (t) mod N = ). (B3) Read and write operations take non-zero time. We account for setup/hold times and latency by parameters τ s and τ r , which denote the maximum "durations" of write and read operations. Concretely, if the sender accesses a cell at time t, the receiver must not do so during [t, t+τ s ), and if the receiver accesses a cell at time t, the sender must not do so during [t, t + τ r ). (B4) On initialization, cells 0 ≤ < N/2 are valid, while cells N/2 ≤ < N are invalid. If the sender accesses an invalid cell at time t, the cell becomes valid at time t + τ s . If the reader accesses a valid cell at time t, it becomes invalid at time t + τ r . This inductively defines for each cell and each time t ≥ 0 whether it is valid or invalid. Note that these definitions are crafted in such a way that if the sender accesses only invalid cells and the reader accesses only valid cells, we have mutual exclusion of read and write operations and for each individual cell, reads and writes alternate. This is the intended mode of operation, which we will formalize in Section II-F.

C. Metastability

To minimize dead time of the control loop regulating the clock speeds, we do not make use of synchronizers. Forgoing their use can result in meta-/unstable signals. At any point in time, a signal has a value in {0, M, 1}, where M means that a signal is potentially metastable or in transition. We employ a worst-case analysis, which assumes that M propagates whenever possible; only explicit logical masking may protect from metastability, no probabilistic statements are used.

In particular, a flip-flop latching when its input is M will "store" an M until is latched again with a stable input. Note that an output signal may also be unstable due to a transitioning signal, e.g. after latching a new value different from the previously stored one.

0 F 0 (t) = 0 1 F 1 (t) = 0 2 F 2 (t) = 1 3 F 3 (t) = 1 4 F 4 (t) = M N -1 F N -1 (t) = 0 pr(t -τr) pr(t) ps(t -τs) ps(t) Pr(t) Ps(t)
Fig. 2: Ring buffer access at time t. The sender currently accesses cell 4. Hence, its full/empty flag is M. The receiver has just finished accessing cell 1. Thus, its full/empty flag is 0. In executions, we mark (potential) in-/metastability in red, cf. Fig. 8.

D. Link Controller Interface Specification

The mode signals themselves are generated by the controller CTRL. Controller decisions are based on full/empty flags of the ring-buffer cells, which we will describe shortly. We stress that, inherently, the controller acts at the border of two clock domains. Any digital implementation (including ours) is thus susceptible to metastable upsets. Accordingly, the voltage levels of md snd and md rcv may become meta-/unstable (between logical 0 and 1, denoted by M), as, in order to minimize delay, we do not pipe them through a synchronizer chain before making use of them.

Let T ctr denote the maximum end-to-end delay of the controller circuit, i.e., between its input (the full/empty flags) and its output (md snd and md rcv ). The specification of the link controller's interface is as follows: (L1) If for t ≥ T ctr the controller circuit specification maps the inputs during [t -T ctr , t] continuously to 1 for signal md snd , then md snd (t) = 1; analogous statements hold for output 0 as well as signal md rcv and outputs 0 and 1, respectively. (L2) In all other cases, the output at time t is arbitrary, i.e., any value from {0, M, 1}.

E. Full/Empty Flags

With each buffer cell , we associate a full/empty flag F . It is specified as (F1) F (t) = 1 if the cell is valid at time t and it either has not been accessed yet or the most recent access to it was by the sender; (F2) F (t) = 0 if the cell is invalid at time t and it either has not been accessed yet or the most recent access to it was by the receiver; (F3) if neither applies at time t, then F (t) ∈ {0, M, 1}.

In other words, we allow for the possibility that F (t) = M at any point in time during read and write operations.

Algorithm 1 Controller CONTTH(T )

At each time t ≥ 0 do: Fig. 2 depicts the state of the above described cell pointers at time t. Observe that all cells between the sender and the receiver are full and thus their full/empty flags equal to to 1, those between the receiver and the sender are empty with full/empty flags equal to 0, and the flags of those currently accessed are M.

F. System Correctness

Expressing the correct order of and separation in time between cell accesses, we can now succinctly state what correct operation of the link architecture means. The goal is now to design a (simple) controller that is correct even if the ring size N is small: this minimizes both the size of the buffer and its latency.

III. CONTINUOUS THRESHOLD CONTROLLER

Our control algorithm CONTTH(T ) is specified in Alg. 1. It is parametrized by T ∈ R + . In the remainder of this section, we explain the intuition behind the approach.

For the purpose of exposition, denote by fill(t) p s (t)p r (t) = N/2 + c s (t) -c r (t) the fill level of the buffer. Recall that one of our design goals is to have a simple digital controller. The most straightforward choice for such a control algorithm is presumably the threshold controller: If the fill level of the ring buffer is larger than N/2, the sender is forced to slow and the receiver to fast mode. If the fill level is less than N/2, the sender and receiver are forced into fast and slow mode, respectively.

However, as the various involved circuit components incur non-zero delays, we cannot expect instantaneous (and thus also not exact) information on the fill-level. Also, changing the oscillators' speeds takes non-zero time, so we cannot hope for an immediate response to a small/large fill-level. Alg. 1 takes this into account by introducing two thresholds. Fig. 3 shows an execution where the controller CTRL runs the algorithm. Fig. 3: CONTTH(T )'s signals of the receiver. The fill-level increases until it hits N 2 + T , which makes the md rcv signal drive 1 after T ctr time. After another T osc time, the receiver and sender clocks are required to run in fast and slow mode, respectively (cf. Section II). Note that the second phase during which the threshold N 2 + T is crossed is too short for CTRL and the oscillators to react with certainty.

A. Correctness of CONTTH(T )

Before we show that, for a T that is chosen sufficiently large, CONTTH(T ) is implementable by a digital circuit in Section III-B, we show that CONTTH(T ) indeed is correct (as per Definition 2) if T is chosen small enough.

Theorem 3. CONTTH(T ) is correct if δ ≤ T ≤ N/2 -(f + -s -)(T osc + T ctr ) -f + max{τ s , τ r }. (1)
Recall that p r (t) = c r (t) and p s (t) = c s (t) + N/2. Thus, when perfectly synchronized, the sender and receiver concurrently access opposite cells of the buffer. The first subtrahend accounts for the fact that the clocks remain unconstrained for T osc +T ctr time even after a threshold is reached: the controller guarantees corresponding output only after T ctr time, which is bound to affect clock speeds at most another T osc time later; during this time period, one clock may "catch up" to the other at rate f + -s -. The second subtrahend accounts for the fact that the sender must always access a cell at least τ r time before the receiver, while the receiver must do so τ s time before the sender (B3).

Note that these two conditions become fully symmetric when using max{τ s , τ r } as the minimum required separation between accesses. Translating this wall-clock time difference to the address pointers using the upper bound of f + on clock frequencies, we see that the following lemma is the key to showing Theorem 3. Lemma 4. If Eq. (1) holds, then

∀t ∈ R + 0 : |c s (t) -c r (t)| ≤ N/2 -f + max{τ s , τ r } .
Proof. Assume for contradiction that c s (t) -c r (t) > N/2f + max{τ s , τ r } > T for some time t. Let t 0 ∈ R + 0 be the minimal time such that c s (τ ) -c r (τ ) ≥ T for all τ ∈ [t 0 , t]; as |c s (0) -c r (0)| < δ ≤ T by (C1) and ( 1) and both c s and c r are continuous, such a time t 0 must exist. Observe that c s (t 0 ) -c r (t 0 ) = T .

By the specification of the controller (L1), we have that md snd (τ ) = 0 and md rcv (τ ) = 1 for all τ ∈ [t 0 + T ctr , t].

Thus, we have that ċr (τ ) ≥ f -≥ s + ≥ ċs (τ ) for all τ ∈ [t 0 +T ctr +T osc , t] by the specification of the clocks ((C2), (C3), (C5), and (C6)). Recall that also ċr (τ ) ≥ s -and ċs (τ ) ≤ f + at all times τ by (C2) to (C5). If t -t 0 ≥ T ctr + T osc , we can thus bound

c s (t) -c r (t) = c s (t 0 ) -c r (t 0 ) + t t0 ċs (τ ) -ċr (τ ) dτ ≤ T + t0+Tctr+Tosc t0 f + -s -dτ + t t0+Tctr+Tosc 0 dτ ≤ T + (f + -s -)(T ctr + T osc ) (1) ≤ N 2 -f + max{τ s , τ r }.
If t -t 0 < T ctr + T osc , the second part of the integral vanishes and the first part becomes smaller, showing that the same bound holds. Either way, this contradicts our assumption that c s (t) -c r (t) exceeds this bound. Finally, we argue analogously for the case that c r (t)c s (t) > N/2 -f + max{τ s , τ r }, where the roles of sender and receiver are exchanged.

Proof of Theorem 3. By Lemma 4,

|p s (t) -p r (t)| = |c s (t) + N/2 -c r (t)| ∈ [f + max{τ s , τ r }, N -f + max{τ s , τ r }]. (2)
In particular, the (continuous) sender and receiver address pointers never have the same value modulo N and thus cannot "pass" each other. Moreover, by our assumptions on the initial clock values (C1), and since δ ≤ 1, we have that c s (0), c r (0) ∈ (-1, 0], i.e., p r (0) ∈ (-1, 0] and p s (0) ∈ (N/2 -1, N/2] by (B1) and (B2), respectively. Together with (B4), this implies that (i) the first access to each cell that is invalid at time 0 is by the sender, (ii) the first access to each cell that is valid at time 0 is by the receiver, and (iii) each cell is accessed alternatingly by sender and receiver. It remains to show that the receiver does not access a cell less than τ s time after a sender access to the same cell. Similarly, we need to show that the sender does not access a cell less than τ r time after a receiver access. To this end, suppose cell is accessed by the sender and receiver at times t s and t r , respectively. Thus, = p r (t r ) + aN = p s (t s ) + bN for some a, b ∈ Z, i.e.,

|p r (t r ) -p r (t s )| = |p s (t s ) -p r (t s ) + (b -a)N | (2) ≥ f + max{τ s , τ r }.
As ṗr (t) = ċr (t) ≤ f + at all times t by (C2) to (C5), we also have |p r (t r ) -p r (t s )| ≤ f + |t r -t s | and therefore |t r -t s | ≥ max{τ s , τ r }. Thus, (P1) and (P2) are satisfied for any access to cell ; since was arbitrary, this completes the proof.

B. Clocked Implementation ClockedTh

Next, we provide a simple and efficient controller implementation that works if T is sufficiently large. Recall that our goal is to detect when c s (t) -c r (t) ≥ T or c r (t) -c s (t) ≥ T . By Lemma 4, assuming a correct implementation satisfying [START_REF] Teehan | A Survey and Taxonomy of GALS Design Styles[END_REF], it holds that the address pointers never reach each other. Together with the equality c r (t)-c s (t) = p r (t)+N/2-p s (t), it follows that all we need to check is whether one pointer is more or less than N/2 cells "ahead" of the other or not. This gives us an indication of whether the buffer is more or less than half full, and the more accurately we can decide, the smaller T can be for the implementation to be correct.

We use the receiver's clock to sample whether the sender's address pointer is currently by more or less than N/2 cells ahead of the receiver's address pointer. 4 This is where the full/empty flags come in handy. Instead of having to communicate and sample c s (t), the receiver simply samples the flag of cell + N/2 mod N when accessing cell ∈ [N ]. This occurs at each time t when = p r (t) mod N = c r (t) mod N , which means that if the buffer is exactly half full, we had that p s (t) mod N = +N/2 mod N , i.e., the sender accesses cell + N/2 mod N at precisely the same time. This means that it starts setting the full/empty flag of the cell from 0 to 1 at time t, i.e., if the buffer is less than half full, the receiver will successfully sample a stable 0 into flip-flop ffa, 5 see Fig. 4.

In contrast, if the buffer is more than half full, it may be the case that the receiver "reads" an M, because the sender is still writing the full/empty flag. Only if it accessed the cell at the latest at time t -τ s , we can be certain that the result of the read operation is a stable 1. To avoid this asymmetry, we sample cell at times t when c r (t) mod N = + f + τ s /2.

(i) c s (t) -c r (t) ≥ f + τ s /2 ⇒ F (t) = 1, and (ii) c r (t) -c s (t) ≥ f + τ s /2 ⇒ F (t) = 0.
Proof. We show (i) first, i.e., assume that c s (t) ≥ c r (t) + f + τ s /2. Then

p s (t -τ s ) = c s (t -τ s ) ≥ c s (t) -f + τ s ≥ c r (t) -f + τ s /2 .
Note that c r (t) -f + τ s /2 mod N = , i.e., the sender completed writing cell (for the most recent time) at time t; here, [START_REF] Coates | Congestion and Starvation Detection in Ripple FIFOs[END_REF] shows that neither sender nor receiver cannot have accessed the cell again after the operation was complete. In other words, F (t) = 1, as claimed. Now we show (ii). Thus, we assume that c s (t) ≤ c r (t)f + τ s /2, while also

c r (t) -f + τ s /2 mod N = .
Hence, the most recent access to cell was by the reader (again using also (2)), which also completed its access (as N ≥ 2 4 It is worth noting that one could use a purely combinational controller to achieve the same result, i.e., there is no need to rely on clocking. Making use of the clock does also not guarantee that stable values are sampled. However, making use of the clock results in a controller with smaller threshold value than a straightforward combinational implementation due to the known alignment of the sampling times with one of the clocks. 5 For simplicity, we attribute any unstable reading to the transition of the memory flag of the cell via τs. However, of course the parameters of the flipflop we sample into, quality of the clock signal, and the delay from the flag's output to the flip-flop's input through the MUX all have an effect. Based on a timing analysis of the circuit and adding a suitable phase shift to the clock input of ffs by, e.g., using a buffer, the abstract behavior we assume can be realized. τs then simply describes the size of the time window during which ffs is vulnerable to metastability induced by a transition of the memory flag of cell . and we assume that operations are completed within a single clock cycle). In other words, F (t) = 0, as claimed.

Based on this idea, we derive a straightforward implementation of the controller. Put simply, the receiver samples the full/empty flag of the cell opposite to the one it currently reads in the ring. More precisely, md rcv is the output of a flip-flop (flip-flop 'ffs' in Fig. 4), into which the receiver samples F (t) at times t such that c r (t) mod N = + f + τ s /2. Signal md snd is obtained by negating md rcv . A circuit implementing this approach for ring size N = 2 is shown in Fig. 4. Here, flipflop ffa is a modulo 2 counter used to track the address to the current cell to sample. It is initialized to the opposite of the receiver address. We need to ensure that the MUX switches to forwarding the respective full flag before flip-flop ffs latches the output of the MUX. We do so by computing the select bit on the negated clock signal. This shifts the computation of the select bit by half a clock cycle and ensures correct timing. Note that here we might get metastable mode signals due to switching full flags. Naturally, it is necessary that the mode signal is computed within a single clock cycle; given the simplicity of the circuit, this is easily achieved.

In the following, denote by τ max the maximum propagation time through the circuit shown in Fig. 4 from the full/empty flags at the top to md snd (without τ s , which is already taken into account by Lemma 5). Lemma 5 then characterizes the proposed controller. Corollary 6. Assume that the control circuit ClockedTh is used in accordance with Lemma 5 and that (P1) and (P2) hold until time t > T ctr = 1/s -+ τ max .

(i) If for all t ∈ [t -T ctr , t] we have that

c s (t ) -c r (t ) ≥ f + τ s /2 , then md rcv (t) = 1 and md snd (t) = 0. (ii) If for all t ∈ [t -T ctr , t] we have that c r (t ) -c s (t ) ≥ f + τ s /2 ,
then md snd (t) = 1 and md rcv (t) = 0.

Proof. The outputs md rcv (t) and md snd (t) at time t are derived from the output of ffs at time t (or one inverter delay earlier). As the receiver clock runs at least at speed s -(by (C2)-(C4)), flip-flop ffs is latched at least every 1/s -time. Hence, taking into account the propagation time through the MUX and the definition of τ max , the outputs correspond to the output of one of the flags at some time t ∈ [t -T ctr , t]. As the MUX selects the flag output it forwards according to Lemma 5, we can apply the lemma to time t , yielding in Case (i) that a stable 1 is latched and in Case (ii) that a stable 0 is latched. This results in the desired corresponding circuit outputs md rcv (t) = 1 and md snd (t) = 0 (Case (i)) or md snd (t) = 1 and md rcv (t) = 0 (Case (ii)), respectively.

We now can derive the correctness of the controller, expressed in Theorem 7, conditional on simple constraints on T . Theorem 7. Assume that Eq. (1) holds, where T ctr = 1/s -+ τ max , and T ≥ f + τ s /2. Then ClockedTh is an implementation of CONTTH(T ).

Proof. If there is some access to a valid cell by the sender or to an invalid cell by the reader, there must be a minimal such time (because the start of a cell access is a discrete event). Denote by t the minimal such time if such an access occurs and set t to infinity otherwise.

We claim that the circuit implements CONTTH(T ) at all times 0 ≤ t < t; from this we will infer the statement of the theorem. Recall that by (L1) and (L2), the controller implementation needs to output a specific (and stable) signal only if the condition in Line 3 or the one in Line 7 of Algorithm 1 continuously holds during the previous T ctr time. According to Algorithm 1, this is the case at time t if and

only if c s (t ) -c r (t ) ≥ T for all t ∈ [t -T ctr , t] or c r (t ) -c s (t ) ≥ T for all t ∈ [t -T ctr , t].
Consider such a time t. Note that t > T ctr , as |c s (0)c r (0)| < δ ≤ T by (C1) and Eq. ( 1), i.e., neither condition is satisfied at time 0. We consider the two cases (i) c s (t )c r (t ) ≥ T for all t ∈ [t -T ctr , t] and (ii) c r (t) -c s (t) ≥ T for all t ∈ [t -T ctr , t].

Case (i):

Since T ≥ f + τ s /2, we may apply Case (i) of Corollary 6. We conclude that md rcv (t) = 1 and md snd (t) = 0.

Case (ii):

In this case we may apply Case (ii) of Corollary 6, from which we deduce that md rcv (t) = 0 and md snd (t) = 1.

We conclude that the circuit meets the specification at all times t < t. In particular, we can apply Lemma 4 at times

t < t, showing that |c s (t) -c r (t)| ≤ N/2 -f + max{τ s , τ r }. If t = ∞, continuity of c s and c r implies that also |c s ( t ) - c r ( t )| ≤ N/2 -f + max{τ s , τ r }.
Reasoning analogously to the proof of Theorem 3, it follows that (P1) and (P2) are not violated at times t ≤ t, contradicting the definition of t. We conclude that t = ∞, implying that the circuit from Fig. 4 indeed implements CONTTH(T ).

Finally, we translate the theorem into a sufficient condition for correctness of the link implementation. To state its performance, we define the latency as the maximum time between consecutive accesses of the sender and receiver to the same cell, plus the setup/hold time at the receiver (as the data should be stable before it is used). The throughput is the guaranteed minimum rate of delivered packets; note that no packet drops or corruptions occur in our implementations.

Corollary 8. For ∆ = (f + -s -)(T osc + 1/s -+ τ max ) + f + max{τ s , τ r } + max{δ, f + τ s /2} and N ≥ 2∆, the given clocked link implementation is correct with latency N/s -and throughput 1/s -.

Proof. Set T ctr = 1/s -+ τ max . We choose T such that (1) and T ≥ f + τ s /2 are both satisfied. This is possible if and only if N/2 ≥ ∆, which holds by the prerequisites of the corollary. Then Theorem 7 yields that the circuit from Fig. 4 indeed implements CONTTH(T ), and Theorem 3 shows that the implemented controller is correct.

The performance bounds follow immediately from correctness and the fact that the guaranteed minimum clock rate is s -.

IV. PERFORMANCE EVALUATION

We discuss a UMC 65 nm ASIC design operating at roughly 2 GHz for which we carried out simulations. This demonstrates that the derived performance bounds indeed lead to promising results.

In the section, we also demonstrate simulated executions that show the circuit behaving according to the specification, despite reoccurring metastability of its control signals; see Fig. 8. In fact metastability of the control signals is likely to be observed in an implementation, since by its attempt to synchronize the two oscillators, the controller repeatedly drives the control signals into metastability; much like experimental setups to measure deep metastability of synchronizers [START_REF] Zhou | On-chip measurement of deep metastability in synchronizers[END_REF], [START_REF] Polzer | An approach for efficient metastability characterization of FPGAs through the designer[END_REF]. We would like to point out that any such demonstration, however, does not replace the correctness proofs in Section III. Proving that metastability is not a problem would require to verify the absence of metastability (or resulting effects) in all circuit components, except for the places to which our proofs show metastability to be confined.

A. ASIC Implementation

The complete design is shown in Fig. 5. It comprises the digital controller (CTRL), tunable sender and receiver oscillator (OSC snd ,OSC rcv ), and the ring buffer of size N = 2.

At a buffer size of 2 the address logic in SND and RCV reduces to a simple modulo 2 counter. Hence, we only have a single register for the sender and the receiver side. The modulo counter operates on the negated clock to ensure a stable output at the time a register in the buffer is accessed. The buffer consists of two buffer cells that store the full/empty-flags. The design of a buffer cell that can be set to 1 by one clock domain and reset to 0 by another clock domain is given in Fig. 6. The design uses a flip-flop for each clock domain that forwards its output to a XOR which computes the output. If the sender flip-flop is enabled it copies the negation of the receiver state. For differing states the XOR will output a 1. If the receiver enables its flip-flop the state of the sender is copied. Hence, the output of the buffer cell is reset to 0.

We can optimize the controller from Fig. 4, as we already compute the write address of the sender. We remove flip-flop ffa and read the address from the SND address logic. The multiplexer in CTRL is connected such that we sample from the buffer cell that is currently not written by the sender. The timing diagram in Fig. 7 shows the behavior of CTRL.

Recall that we require the sender and receiver oscillators to be well-behaved even when control bits are unstable. Specifically, we require that (i) oscillator frequencies are always within [s -, f + ], and (ii) frequency mode changes occur within T osc time ((C2) to (C5)). This is why we resorted to starvedinverter ring oscillators that guarantee such behavior [START_REF] Hajimiri | Jitter and Phase Noise in Ring Oscillators[END_REF]; we designed the sender and receiver starved inverter rings at transistor level following [START_REF] Suman | Analysis and design of current starved ring VCO[END_REF]. Note that we do not need the full control logic overhead typically required to drive the starved inverter cells, since we only need two speeds: slow and fast. Hence, the control logic of the oscillator takes a single bit and adjusts the delay of the starved inverters according to fast or slow mode. As the receiver oscillator OSC rcv additionally drives the control logic CTRL its load is higher than the load driven by the sender oscillator. The effect is that OSC rcv has slightly slower fast and slow modes. The difference does not matter as long as the oscillator speeds lie within their theoretical bounds. One can keep the imbalance very small by decoupling the oscillators from the load with buffers.

Signals md rcv and md snd are used as control signals of the rings, which run at roughly 2 GHz and 2.3 GHz for input 0 and 1, respectively.

Extracting delay and frequency parameters from the standard cell library we get ∆ = 1 in Corollary 8, i.e., ClockedTh is provably correct for N ≥ 2. This fits to the bounds given in Table I.

B. Frequency Stability of Tunable Oscillators

Typically, accuracy of oscillator frequencies is stated as a two-sided error, i.e., if the nominal frequency of the oscillator is f and it has a relative frequency error of at most r, then at any time its momentary frequency is between (1 -r)f and (1 + r)f .

Recall from (C5) that we require that the fast oscillator mode is always faster than the slow oscillator mode. For a 2 -2.3 GHz clock we must therefore tune the clock within an error r that satisfies the condition 2 • (1 + r) 2 /(1 -r) 2 ≤ 2.3, i.e., r ≤ 3.49% is a sufficient bound on the frequency error. In case these error margins would be too restrictive, we could choose a clock with larger gap between fast and slow modes, e.g., 2 -2.5 GHz. Depending on the outcome of the timing analysis (see also Corollary 8), this may require a larger buffer size N .

For comparison, the accuracy requirements for the oscillators used in [START_REF] Dally | The Even/Odd Synchronizer: A Fast, All-Digital, Periodic Synchronizer[END_REF] are as follows. If both the sender and receiver oscillator run at (roughly) the same nominal frequency, ∆p < g/S is proven to be sufficient for correctness of the design, where ∆p is the relative phase change per clock cycle, S = 4 the number of synchronizer stages, and g = 0.1 the guard band. However, the proof assumes a perfectly stable receiver clock. If receiver and sender oscillator may drift, the above inequality becomes 2∆p(1 + ∆p) < g/S. This is equivalent to a frequency error of less than 1.24%.

C. Gate level and SPICE Simulations

We first ran gate-level VHDL simulations of designs of our ClockedTh controller with delay and setup/hold parameters from the ASIC design. The starved-inverter rings were simulated by forward Euler integration of a first order ODE model, clock cycles) long and all in accordance with the proven correctness results. We stress that signals md rcv and md snd were unstable (X) almost all the time due to the conservative gate model assumptions, yet no buffer over-/underruns were encountered; cf. Fig. 8.

D Q Q D Q Q D Q Q 0 1 s md snd md rcv clk snd clk rcv Q Q F 0 F 1 Buffercell Buffercell
We then ran Spice simulations for the ClockedTh design: The design was implemented in Spice using standard cells and parameters of the UMC 65 nm library combined with an implementation of a tunable ring oscillator. The oscillator runs at speed 2.09 GHz in slow mode and 2.42 GHz in fast mode. Taking into account timing constraints and propagation delays of the elements we can use a ring buffer of size two, according to Corollary 8.

When simulating the design for 500 ns (about 1100 clock cycles) no faulty behavior could be detected. However, the simulation confirms what we stressed previously. In almost 50% of the cases the setup time of ffs (see Fig. 4) is violated due to late transition of the full flags. Still the controller behaves correct and the two oscillators run synchronously. Fig. 9a shows the full flags of the buffer. Sender and receiver alternatingly access cell 0 and cell 1. Fig. 9b shows the clock signals produced by the sender and receiver oscillators. When stabilized, the sender is ahead by slightly more than a clock cycle. Both run on average with a frequency of roughly 2.28 GHz. Fig. 9c shows the mode signals of the sender and receiver which are computed by ClockedTh.

D. Increasing Initialization Slack

If a sufficiently small δ (i.e., initial clock offset) cannot be guaranteed, the address pointers may "collide". However, if the pointers move apart sufficiently far, the link will resume to operate as intended. Note that the pointers colliding and moving at the same speed (i.e., the clocks running at the same speed) is an unstable equilibrium state, as the control logic aims at "pushing" them apart. Accordingly, this is a metastable state of the link, which can be expected to resolve fairly quickly.

We used a variation of the Spice simulation that allows us to initialize sender and receiver clocks to a specific offset (due to the the machinery simulation does not start exactly at 0 ns). Together with a suitable initialization of the full/empty flags, this simulates one of the clocks being started earlier.

We simulated the link with small initial offsets of the continuous pointers, i.e., p s (0) -p r (0) = C s (0) -C r (0) + N/2 ≈ 0, with the goal of finding a good tradeoff between resolution time and precision of the initialization. Fig. 10 shows the pointer offset of the sender and the receiver clock (p s (t) -p r (t) -N/2) over time t for different initializations. We see that simulations with an initial offset of 0 ps, 30 ps and 50 ps stay in the metastable state until eventually the sender advances by one clock cycle relatively to the receiver and the simulation stabilizes. Similarly, a simulation with an initial offset of -75 ps stays in the metastable state until the receiver advances by one clock cycle relative to the sender and the simulation reaches the corresponding stable state. Simulations with 30 ps resp. -75 ps offsets resolve after 11 ns resp. 10 ns. Hence, if the designer is willing to wait 11 ps after initialization, it is sufficient to guarantee avoiding this window of 105 ps during initialization. At the given clock speed, this corresponds to a much larger δ = 1/f + -105/2 ps, which in our setting is roughly 360 ps. In general, waiting for a couple of clock cycles after initialization increases the slack δ to being close to a full clock cycle. (50ps) (30ps) (0ps) (-75ps) Fig. 10: Offset of the sender and receiver pointers over simulation time. When initializing the pointer offset to 50, 30, 0 and -75 ps, we observe different times to stabilization. According to the analysis, setup and hold times cannot be violated once link is stabilized.

V. CONCLUSION

We provided a digitally controlled implementation of a synchronously accessed buffer-based link, where both sender and receiver each have their own tunable clock. This can be seen as a distributed phase-locked loop, as we guarantee a fixed bound on the absolute time difference between the clocks, based on feedback derived from measuring the phase difference via keeping book of buffer accesses. Our design is novel in that we neither rely on analog or asynchronous design nor incur synchronizer delay, yet deterministically guarantee correct operation. By accepting an un-or metastable control signal for the oscillators when the buffer is roughly half full, we can completely dispense with synchronizers in the control loop. As this eliminates the associated delay from the control loop, it leads to relaxed timing constraints compared to synchronizer-based solutions. As a result, our link implementation can operate with a minimal buffer size of 2 under fairly weak requirements on the frequency stability of oscillators, yet guarantee correctness deterministically. We complemented our formal claims with VHDL and Spice simulations of UMC 65 nm ASIC implementations.

For the link to operate correctly upon initialization, it may be the case that δ, the initial clock offset between the sender and receiver clock, needs to be fairly small (cf. Corollary 8). If the resulting constraint is too tight, one can violate this constraint, possibly resulting in the two address pointers "meeting" each other. However, this is a metastable state of the control loop: If the two pointers move apart sufficiently far, operation will go back to the intended mode and push the pointers apart. Note that once the link has stabilized, the resulting total clock difference between the sender and receiver clock is unknown. One could now use the operational link to let the sender communicate its current clock value to the receiver (prefixing the encoding e.g. by a 1, while the buffer cells where initialized to 0).

However, the most practical compromise may be to avoid this complication and simply relax the initialization constraint without removing it entirely, as discussed in Section IV-D. Simulating the link with varying initial pointer offsets, we demonstrated a reasonable tradeoff between the time the link stays in an unstable state (max 11 ns) and the precision of the initialization (in two clock cycles avoid a window of 105 ps), cf. Figure 10.

One limitation of the proposed system is that it is restricted to a single link. In follow-up work [START_REF] Bund | PALS: Plesiochronous and Locally Synchronous Systems[END_REF], the ideas presented here are combined with a gradient clock synchronization algorithm [START_REF] Kuhn | Optimal Gradient Clock Synchronization in Dynamic Networks[END_REF], [START_REF] Lenzen | Tight Bounds for Clock Synchronization[END_REF] that tightly bounds the phase offset between adjacent nodes. This retains the advantages of small buffers and latency while maintaining deterministic correctness. Future work needs to flesh this concept out into a fully-fledged design, which subsequently is to be tested in silicon. Here, suitable oscillators are more challenging to devise, because the scalability of the system is directly affected by the parameters of the oscillators. Ultimately, the result will be an alternative approach to clocking synchronous systems with far better scalability properties than classic designs, which derive time from a single reference.

Definition 1 .

 1 A link is correct if the following holds in any execution adhering to our model. (P1) No underrun: the receiver accesses only valid cells. (P2) No overflow: the sender accesses only invalid cells. Definition 2. Controller CTRL is correct if it computes the signals md snd and md rcv out of the inputs F so that the link is correct.

Lemma 5 .

 5 Suppose time t and ∈ [N ] are such that c r (t) mod N = + f + τ s /2 and Eq. (2) holds. Then

Fig. 4 :

 4 Fig. 4: Controller ClockedTh for ring-size N = 2. Flip-flop ffa stores the address (modulo 2) that is sampled and ffs the sampled full/empty flag.

Fig. 8 :Fig. 9 :

 89 Fig. 8: Gate-level simulations for link with ClockedTh.

  Implementation of the system with buffer size N = 2. Clock regions are marked red (sender) and blue (receiver).

									snd				rdv
													Buff
											E snd	E rcv
												E snd	E rcv
							Osc snd					Osc rcv
												Ctrl
	Fig. 5: Q clk snd
			E snd	E
				D
				D			Q
			E rcv	E
		clk rcv				Q
	Fig. 6: Implementation of a buffer cell that can only be set by
	the sender and only be reset by the receiver.
	clk rcv
	addr rcv
	F 0
	F 1
	md snd
	md rcv
	12.2ns	12.4ns	12.6ns	12.8ns	13ns	13.2ns	13.4ns	13.6ns	13.8ns	14ns	14.2ns	14.4ns

Fig. 7: Timing diagram of the controller CTRL. The address addr rcv decides which full-flag is sampled into the register of the controller at a rising clock transition.

where current clock rates are independently uniformly distributed in each integration step to account for drift. The high respectively low frequency of the starved inverter rings where set to 2.3 GHz respectively 2 GHz. Potential in-/metastability of signals was simulated by X in a worst-case manner; this includes flip-flops with setup/hold violations, full/empty-flags, and oscillator mode signals. Simulated traces were 5 ms

(10 7

We remark that the exposition does not rely on the information given in this comparison, and it might be easier to follow the comparison based on a more detailed understanding of our approach. Accordingly, readers should feel free to skip to the next section and return later if needed.

For δ = 1, this is a fairly weak constraint. If sender and receiver each access one element of the ring buffer per clock cycle, it means that both oscillators are started within one clock cycle of each other. However, smaller values of δ may reduce the minimum feasible ring size by 2 in some cases.

Note that this will typically not be 1 unit of "absolute" time, as oscillator speeds may vary.

ACKNOWLEDGMENT

We thank Attila Kinali and Prof. Ran Ginosar for pointing out that our link controller is in fact an "all-digital PLL."

Johannes Bund and Christoph Lenzen are with the Max Planck Institute for Their work on this project has been supported by funding from the European Research Council (ERC) under the European Union's Horizon 2020 research and innovation programme (grant agreement 716562). Moti Medina is with the Ben Gurion University of the Negev, Israel. He was partially supported by the Israel Science Foundation grant No. 867/19.


Thomas Badr

Ben Dany

Joseph Ali

Yangliang Seaward

Fabrice Guo

Romain Wiotte

Hélène Dubessy

Aurélien Perrin

Perrin

Comparison of time profiles for the magnetic transport of cold atoms

niveau recherche, publiés ou non, émanant des établissements d'enseignement et de recherche français ou étrangers, des laboratoires publics ou privés.

Comparison of time profiles for the magnetic transport of cold atoms T. Badr, 1, 2 D. Ben Ali, 2, 1 J. Seaward, 2, 1 Y. Guo, 2, 1 F. Wiotte, 2, 1 R. Dubessy, 2, 1 H. Perrin, 1, 2 and A. Perrin 1, 2 1 CNRS, UMR7538, F-93430, Villetaneuse, France 2 Université Paris 13, Sorbonne Paris Cité, Laboratoire de physique des lasers, F-93430, Villetaneuse, France (Dated: April 29, 2019)

We have compared different time profiles for the trajectory of the centre of a quadrupole magnetic trap designed for the transport of cold sodium atoms. Our experimental observations show that a smooth profile characterized by an analytical expression involving the error function minimizes the transport duration while limiting atom losses and heating of the trapped gas: moving the gas over nearly 31 cm requires only about 600 ms. Using numerical calculations of single atom classical trajectories within the trap, we show that this observation can be qualitatively interpreted as a trade-off between two types of losses: finite depth of the confinement and Majorana spin flips.

I. INTRODUCTION

The transport of cold atoms over macroscopic distances is now a well established technique that allows one to spatially isolate two stages in the production of degenerate quantum gases [1]; typically a cold sample is prepared in a magneto-optical trap (MOT) in a first vacuum chamber, and conveyed to a second one with a lower background pressure for a final evaporation stage. This, for instance, gives the opportunity to improve optical and mechanical access where the atoms are manipulated and observed. This can also allow for an increase of the repetition rate of the experiments, with the MOT being loaded while the final part of the experimental sequence is performed.

Various implementations have been explored involving either magnetic or optical fields: a chip magnetic conveyor belt [2,[START_REF] Hänsel | Reichel[END_REF], time-varying currents in an assembly of anti-Helmholtz coils [1,4], optical tweezers [5,6], a single pair of anti-Helmholtz coils on a translation stage [7,8], a train of Ioffe-Pritchard traps [9] or a unidimensionnal optical lattice [10,11]. Recently, optimal control has been applied in harmonic [12] and anharmonic potentials [13,14]. These works allow for the design of fast transport trajectories going far beyond the adiabaticity criterion. In linear traps, the possibility of Majorana spin flips [15] prohibits the existence of adiabatic trajectories which motivates other approaches.

The main objective of this paper is to compare different time profiles for the trajectory of a quadrupole magnetic trap centre and attempt to identify the main factors explaining their performance. In section II, we recall the basic principles of magnetically trapping cold atoms in a quadrupole magnetic trap and give details on the experimental design we have used to transport cold atomic gases. In section III we investigate different time profiles for the trap centre motion and present our experimental observations. In order to understand our results, we have performed simulations of classical trajectories of the atoms within the moving quadrupole trap. Comparing different time profiles, we propose a qualitative explanation of our experimental results in section IV. Finally, section V gives concluding remarks.

II. EXPERIMENTAL IMPLEMENTATION A. Basic principles

A straightforward realization of a quadrupole trap can be experimentally obtained with two identical coils in an anti-Helmholtz configuration: in practice this corresponds to two coils separated along their common axis of revolution by a distance comparable to their radii and carrying the same current, I, flowing in opposite directions. At the symmetry centre of the assembly, O, the produced magnetic field B vanishes and can be approximated close to this position by a quadrupole field. Assuming z is the axis of revolution of the assembly, it reads

B(x, y, z)   -b x -b y 2b z   ( 1
)
where b is the modulus of the magnetic field gradient in the x-y plane. The latter depends on the exact geometry of the coils and is proportional to I [16]. In the following, we keep for simplicity the notation B to refer to the total magnetic field induced by a given coil configuration.

A set of two pairs of anti-Helmholtz coils with z-axis of revolution separated along the y-axis by a distance comparable to their radii also produces a quadrupole field at a position (0, y 0 , 0) entirely determined by the ratio of the currents flowing in each pair of coils. Close to (0, y 0 , 0), the resulting magnetic field B reads

B(x, y, z) 2b     - α 1 + α x - 1 1 + α (y -y 0 ) z     (2)
where α is defined as the ratio of magnetic gradients along the x-and y-axis and b is half the modulus of the magnetic field gradient along z. The expression in Eq. ( 2) takes into account the fact that ∇ • B = 0 as well as the different symmetries of this particular current distribution.

An atom with magnetic moment µ interacts with the magnetic field leading to a coupling V . For 23 Na atoms in their ground state 3 2 S 1/2 as long as V remains small compared to the hyperfine splittings, one can write

V (x, y, z) = g F m F µ B |B(x, y, z)| (3)
where g F is the Landé factor in the ground state F , µ B the Bohr magneton and m F the atomic spin projection onto the local direction of the magnetic field. As soon as g F m F > 0, V presents a minimum where atoms can be confined. In the following, we neglect gravity since the magnetic gradients b considered here are sufficiently large and assume m F = -1 since we consider 23 Na atoms trapped in the |F = 1, m F = -1 Zeeman substate. In this case g F = -1/2. A minimum of three free parameters are necessary to control independently the values of y 0 , α and b . With two sets of anti-Helmholtz coils, only two currents can be freely and independently tuned. Therefore, it is not possible to move the quadrupole trap along the (Oy) axis while keeping both α and b constant [1]. Adding a third pair of anti-Helmholtz coils along the (Oy) axis offers an additional degree of freedom which lifts this constraint while keeping the same shape for the magnetic field, B, as in Eq. ( 2).

Overall, the experimental design of a magnetic transport of cold atoms in a quadrupole trap relying on static anti-Helmholtz coils requires a minimum of three independent current supplies. In practice, additional experimental constraints may limit the control over the trap parameters y 0 , α and b . For instance, our current supplies are not bipolar, so the range of accessible values for α is restricted to values typically larger than 1.5. We expect that better results can be obtained with bipolar current supplies which would allow to keep α = 1 throughout the magnetic transport. Moreover, switching smoothly from one set of three pairs of anti-Helmholtz coils to the next requires going through a configuration where only two current supplies out of three deliver a non-zero current.

In turn, at these switching positions, only α or b but not both can be freely set.

B. Experimental design

The design of our magnetic transport is generally inspired by [1] while its specific implementation is close to [4]. It relies on 15 pairs of anti-Helmholtz coils and an additional so-called push coil (see Fig. 1). It allows for transport of atoms along two stages of orthogonal directions and of length L 1 = 30.7 cm and L 2 = 34.4 cm respectively. The atoms are initially confined into a magneto-optical trap (MOT) [17] before being transferred into a quadrupole magnetic trap involving only the MOT coils. During the process, b is ramped up to 65 G/cm and the atoms eventually occupying the |F = 1, m F = -1 Zeeman substate are trapped. At the end of the magnetic transport, the atoms are ready to be transferred onto an atom chip. Determining the value of the currents passing through the different coils along the first stage of the magnetic transport requires setting the dependence of α and b on y 0 . We have chosen to keep b = 65 G/cm constant throughout the magnetic transport. The value of α is equal to one at the beginning and at the end of the first stage, where a single pair of anti-Helmholtz coils is used and the atomic cloud is at rest. As mentioned in the previous section, since we rely on only three non-bipolar current supplies, the value of α is also constrained at each switching position between different sets of three pairs of anti-Helmholtz coils. We explain in Appendix B how to determine these positions. The value of α is linearly interpolated between these spots apart from the last part of the first stage where only two pairs of anti-Helmholtz coils are then available (C 6 and C 7 ) and therefore α evolves freely. This is also the case at the beginning (C 7 and C 8 ) and end (C 13 and MT) of the second stage.

Relying on the analytical formula of the magnetic field induced by a single current loop [16] and neglecting the helicity of the coils, it is possible to find an analytical formula for |B(x, y, z)| in Eq. ( 3) which takes into account the geometry of each coil and includes their respective number of windings. At each position y 0 we then compare this potential to the approximate one arising from Eq. ( 2). Fixing α and b , we fit the current in the different coils so that these two potentials overlap in the best possible way. The results are shown in Fig. 2. The relative accuracy of the fit on y 0 , α and b after this procedure is better than 0.1%. Additional technical details are given in Appendix B. The same method is used for the second stage of the magnetic transport.

III. TIME PROFILES COMPARISON

A. Overview

Controlled displacement of the magnetic trap requires defining the dependence of y 0 on the time t. In this section we focus on three different trajectories for the trap centre: constant velocity, constant acceleration and an extremely smooth path based on the error function where all time derivatives of the position of the trap are continuous. A constant velocity trajectory leads to the following equations for the position of the trap centre:

y 0 (t) = 0 t ≤ 0 y 0 (t) = L 1 t ∆t 0 < t < ∆t y 0 (t) = L 1 t ≥ ∆t ( 4
)
where ∆t is the duration of the one-way magnetic transport from the MOT chamber to C 7 . In this case the acceleration of the trap centre diverges at t = 0 and t = ∆t since the velocity is discontinuous. Outside these two points, the effective potential for the atoms in the comoving frame is the same as in the lab frame.

For a constant acceleration trajectory we find:

y 0 (t) = 0 t ≤ 0 y 0 (t) = 2L 1 t ∆t 2 0 < t ≤ ∆t 2 y 0 (t) = L 1 1 -2 1 - t ∆t 2 ∆t 2 < t < ∆t y 0 (t) = L 1 t ≥ ∆t. (5)
In this case the velocity of the trap centre is continuous while the acceleration is not. The effective potential for the atoms in the comoving frame becomes tilted so that its gradient along the (Oy) axis is ∓2g

F m F µ B b /(1 + α) + 4mL 1 /∆t
y 0 (t) = 0 t ≤ 0 y 0 (t) = L 1 2 1 + erf -γ t ∆t -δ + γ 1 - t ∆t -δ 0 < t < ∆t y 0 (t) = L 1 t ≥ ∆t (6)
where δ > 0 and γ = 2 -3/2-δ (δ + 1)(δ + 2)/δ ensures that the jerk of the trap centre at ∆t/2 vanishes. This allows the acceleration to be close to zero for a large portion of L 1 . This trajectory is extremely smooth, with continuous derivatives at all orders. The potential in the comoving frame is only tilted at the beginning and the end of the trajectory. Figure 3 shows the behaviour of the position (a), velocity (b) and acceleration (c) of the trap centre for different time profiles. Slight changes in the trajectory can result in large modifications of the acceleration. When the absolute value of the latter becomes larger than 2g F m F µ B b /[(1 + α)m], the potential V in the comoving frame tilts enough so that the atoms are not trapped anymore. This sets a lower limit on ∆t above which the atoms remain confined throughout the magnetic transport. This is illustrated in Fig. 3(d) for the different time profiles considered here. For our typical magnetic gradients and α 2 we see that ∆t must be at least larger than 300 ms for the error function time profile.

It is important to note that experimentally, the bandwidth of the current supplies is finite which may filter the current output profiles and affect the magnetic transport sequence. We have checked that this effect is negligible in the different situations we have studied.

B. Experimental results

We have experimentally compared the number of atoms remaining in the magnetic trap after a round trip along the first stage of the magnetic transport for different time profiles and different ∆t. The time profile is just reversed on the way back without any waiting time at the end. In order to account for the losses due to the finite lifetime of the atoms in the trap (about 15 s), we have normalized the results by the number of atoms remaining in the magnetic trap after the same total duration, 2∆t, but without moving; this leads to the ratio r N . Fig. 4(a) shows that the error function time profile allows us to keep a maximum of about 75% of the atoms after the round trip and for shorter ∆t than any other time profile. The worst results are obtained with constant velocity time profile while constant acceleration time profile gives intermediate results.

We have also compared the results of the error function time profile for different δ. The results are shown in Fig. 4(b). The best results are obtained for the lowest value of δ. Note that δ = 0 corresponds to the following trap centre trajectory

y 0 (t) = 0 t ≤ 0 y 0 (t) = L 1 2 1 -erf log ∆t -t t 0 < t < ∆t y 0 (t) = L 1 t ≥ ∆t. (7)
Smooth trajectories reaching high values for the acceleration of the trap centre for a short time seem hence to be favoured. This is confirmed by the results of Fig. 8(b), described in Appendix C. The limit of this strategy comes from the tilt of the potential in the comoving frame: above a certain value of the acceleration the atoms be- come anti-trapped resulting in large atom losses.

In order to estimate the heating of the gas due to the magnetic transport, we have measured the temperature T of the cloud with a time-of-flight expansion. Relying on a model described in Appendix E, we are able to extract T from single shot data. We then normalize the results with the temperature of a gas at rest in the trap for the same total duration 2∆t. This leads to the ratio r T presented in Fig. 4(c). Heating is observed for the shortest durations where r N starts to decrease significantly. The error function time profile gives the best results in particular for the shortest durations. Note that our clouds are not at thermal equilibrium right after the loading of the magnetic trap. Since the collision rate in the trap is low (see Appendix D) the gas barely reaches thermal equilibrium even for the longest transport durations. Because of this, the temperature we extract from our data is strictly speaking an effective temperature and can be different along the horizontal and vertical direction. Nevertheless, our estimation of r T should still be accurate. Throughout the paper, r T is estimated from temperature fits along the horizontal direction.

IV. CLASSICAL SIMULATIONS

Two loss sources can be considered in order to explain our observations: first, losses due to the finite depth of the magnetic trap. Second, Majorana losses due to the fact that the atomic spins cannot adiabatically follow the changes in the magnetic field orientation [15]. In this section we simulate classical trajectories of the atoms in the moving trap in order to compare different loss types for the different time profiles.

Considering each atom as a classical point-like particle, the equation of motion for each atom reads

m d 2 r a dt 2 = -∇V (y 0 (t), t) (8)
where r a (t) = (x a (t), y a (t), z a (t)) is the position of an atom at time t and the potential V is fully determined by the three parameters b , α(y 0 ) and y 0 (t) as in Eq. ( 3) with the approximate |B(x, y, z)| from Eq. ( 2). In principle, we could have relied on the analytical formula for V taking into account the exact geometry of the different coils but this significantly slows down the numerical calculation and would have required several weeks of computation on a single computer. Moreover we don't expect that this would significantly change our conclusions. In the following, b = 65 G/cm and α(y 0 ) follows the profile depicted in Fig. 2(b) as in the experiment. The trap centre trajectory, y 0 (t), follows a time profile with either a constant velocity, Eq. ( 4), a constant acceleration, Eq. ( 5) or an error function with δ = 0, Eq. ( 7). As a reference, we have also computed atomic trajectories in a static potential V with parameters b = 65 G/cm, α(0) = 1 and y 0 (t) = 0. With our typical atom number and temperature, the collision rate of the atoms in the trap is smaller than 1 s -1 (see Appendix D). To keep the treatment as simple as possible, in the following we do not take into account interatomic interactions. Despite this choice, we expect our main conclusions to remain qualitatively valid thanks to the low collision rate experienced by the atoms.

In order to estimate the phase-space density of the gas throughout a roundtrip along the first stage of the magnetic transport, we have simulated 1000 different atomic trajectories indexed by a parameter i, with initial positions r i a (t) = (x i a (0), y i a (0), z i a (0)) randomly picked in order to reproduce a system initially at thermal equilibrium at temperature T = 100 µK in the static trap V with parameters b = 65 G/cm, α(0) = 1 and y 0 (0) = 0 (see Appendix F). This allows us to introduce a length scale r 0 = k B T /(g F m F µ B b ), with k B the Boltzmann constant, and a velocity scale v 0 = k B T /m. The length r 0 is related to the size of the atomic cloud at rest while the velocity v 0 is simply the rms velocity along each direction of space.

In order to estimate finite depth losses in the trap associated to each time profile, we have computed for each trajectory i the maximal distance to the trap centre ri max = max 2 where ȳi a (t) = y i a (t) -y 0 (t). In our simulations, the potential is idealized and the trap depth is infinite. The atoms are never lost. This is not the case in the experimental realization of V , where the radius of the magnetic coils fixes an upper limit to the maximal distance to the trap centre (see Fig. 6(b)). To reproduce this effect, we fix an upper limit rmax for the maximal distance to the trap centre above which the simulated atom is considered lost.

t x i a (t) 2 + ȳi a (t) 2 + z i a (t)
Estimating losses associated to Majorana spin flips requires the comparison of two frequencies: the rate associated with changes in the orientation of the magnetic

field ν i B (t) = d dt B[r i a (t), t] B[r i a (t), t]
and the Larmor fre-

quency ν i L (t) = g F m F µ B B[r i a (t)
, t] /h. We define the ratio r i Maj = max t ν i B (t)/ν i L (t). As soon as r i Maj gets close to 1, the probability of spin flip is high. As for the distance to the trap centre, we set an upper limit r max Maj for this ratio. Majorana losses and finite trap depth losses can be treated independently since they correspond in principle to different types of atoms: Majorana spin flips happen mostly with slow atoms spending too much time in the low magnetic field regions while finite trap depth losses arise from hot atoms reaching the upper limit of the trapping potential.

Relying on the limits rmax and r max Maj , we calculate the ratio r N corresponding to the ratio of simulated atoms remaining in the trap after a round trip along the first stage of the magnetic transport for different duration ∆t and different time profiles. All the obtained ratios are normalized by the ones obtained from simulations in a static trap for the same duration. The results are shown in Fig. 5(a) for rmax = 10r 0 and r max Maj = 0.4. These two values have been set in order to reproduce in the best possible way the experimental results presented in Fig. 4(a). We see that our simulations qualitatively reproduce the experimental results of Fig. 4(a) even if they fail to explain the better performance of the error function time profile at short duration ∆t. We see that finite trap depth losses are dominant for short ∆t whereas losses associated with Majorana spin flips contribute more for long duration of the magnetic transport. We also remark that a constant acceleration trajectory minimizes finite trap depth losses but presents a slightly larger Majorana spin flip rate compared to the error function time profile. Setting an upper limit to the ratio r i Maj is probably too crude and a more precise treatment of Majorana losses might potentially lead to a better reproduction of the experimental results for short durations.

In order to estimate the heating induced by the different time profiles we have calculated the velocity distribution of the simulated atoms after a round trip. This allows us to estimate the kinetic energy of the atomic distribution that we normalize by the one obtained from the simulations in the static trap for the same duration to obtain the ratio r T . In this analysis, we only consider the simulated atoms that remain in the trap after a round trip taking into account the limits rmax and r max Maj . The results are shown in Fig. 5(b). It roughly agrees with our experimental results presented in Fig. 4(c): the constant velocity time profile leads to significantly larger temperatures compared to the other two trajectories. At short duration of the magnetic transport we do not observe heating in the simulations for the constant acceleration and error function time profiles. This might come from the fact that we do not take into account any collision in the simulation. Even if the collision rate is weak, it tends to redistribute the energy acquired during the acceleration phases among the atoms.

Overall, these simulations tend to indicate that the error function time profile realizes a trade-off between the two sources of losses we have taken into account. This is in qualitative agreement with our experimental results and is probably sufficient to explain why the error function time profile leads to the best magnetic transport efficiency even if our simple classical simulations fail to reproduce this point. A more careful analysis taking into account the collisions and the exact behaviour of Majorana spin flips would be required to fully check this point.

V. CONCLUSION

Comparing different time profiles, we have identified an efficient trajectory for the centre of a quadrupole trap designed for the transport of cold sodium 23 Na atoms. It relies on a smooth profile parametrized by the error function. Relying on classical simulations of individual trajectories of the atoms during the transport, we have been able to qualitatively investigate our experimental results: two main loss sources -finite depth of the trap and Majorarana spin flips -limit the efficiency of the magnetic transport for the shortest durations. Constant velocity trajectories tend to minimize the amount of Majorana spin flips while constant acceleration ones optimize the finite trap depth losses. Faster magnetic transport also tends to minimize Majorana losses while finite trap depth becomes a bigger limitation for all time profiles. The error function trajectory corresponds to a trade-off between these two types of losses with a sharp but finite acceleration at the beginning and the end of the transport and an almost constant velocity in between. Overall, we are able to transport on the order of 70% of the atoms over a roundtrip along the first stage of the magnetic transport (nearly 30 cm) in about 2×600 ms with limited heating of the gas. We have also tested that the same results could be obtained along the beginning of the second stage of the magnetic transport.

While this work does not answer the question of what is theoretically the optimal trajectory to transport cold atoms in a quadrupole trap over large distances, it gives good hints of the direction where to look for. We hope this will contribute to stimulate theoretical works relying on optimal control to determine the best transport trajectories in linear traps (see [18,19] and references therein). two of these spots, α reaches a maximum: α = 1.87 for the second to the fifth maximum, and α = 1.937 for the sixth and seventh. The difference between these two values comes from the fact that the distance between the coils and the magnetic transport axis is slightly larger for the last three pairs of anti-Helmholtz coils of the assembly. These positions of maximal α are the ones we use in our design to switch from one set of three pairs of anti-Helmholtz coils to the next due to the fact that adding a third pair of anti-Helmholtz coils to adjust the shape of the quadrupole trap V can only lead to an increase of α if we restrict ourselves to positive currents. This is actually the opposite with the push coil for which the current direction is set so that positive currents in the push coil lead to lower values of α. This is why the first switching position in Fig. 6(a) is set where α = 1.87, as in the next ones, and not to the maximum value of α reached with these two pairs of anti-Helmholtz coils.

In order to adjust the shape of the quadrupole trap V throughout the magnetic transport, we fit the analytical formula for V discussed in section II to the approximate profile given by Eq. 3 with b = 65 G/cm and α(y 0 ) following the red dashed profile in Fig. 2(b). More precisely we compute V (x, y 0 , 0), V (0, y 0 + y, 0) and V (0, y 0 , z) for x, y, z ∈ [-5 mm, 5 mm] with a spatial grid of 101 points along each direction and rely on a least square algorithm to minimize the distance between the potential obtained by the analytical formula and the one deduced from Eq. 3. The currents in the three supplies are the only free parameters here. For the last few centimetres of the transport, only two current supplies are used and only the profile of V along the (Oz) axis is used. A typical result is illustrated in Fig. 6(b). The velocity of the atoms v simply follows a Maxwell-Boltzmann distribution

p(v) = 1 √ 2πv 0 3 exp - v 2 2v 2 0 . ( E2
)
Neglecting interatomic collisions during the expansion of the gas, the density distribution after a time of flight t tof stems from the free expansion of the atoms n(r; t tof ) = where β t = v 0 t tof /r 0 and erfc is the complementary error function. Integrating n(r; t tof ) along the x and y axis leads to an expression for n xy similar to Eq. E4 but where x has to be replaced by z, r 0 by r 0 /2 and β t by 2β t . For long times of flight such as β t 1, n xy and n yz both converge toward a simple Gaussian function with RMS width β t r 0 = v 0 t tof .

To experimentally measure the temperature of our atomic clouds, we switch off the magnetic trap and let the atoms expand for a few milliseconds. Relying on absorption imaging along the y axis we obtain the integrated density profile dy n(r; t tof ). Integrating numerically along either the x and z axis we can then fit the resulting profile with the analytical expression of n xy or n yz . This then gives us a measurement of the temperature of the cloud T in a single shot.

FIG. 1 .

 1 FIG. 1. Overview of the magnetic transport design which connects the MOT chamber to the atom chip chamber. It consists in 15 pairs of anti-Helmholtz coils: MOT, C1 to C13 and MT. An additional push coil is used to produce a magnetic gradient which allows us control of the geometry of the quadrupole magnetic trap at the beginning of the transport.

FIG. 2 .

 2 FIG. 2. (a) Currents in the different coils along the first stage of the magnetic transport. Each color corresponds to one of the current supplies. (b) Fitted value of the horizontal trap anisotropy ratio, α, along the first stage of the magnetic transport (black line). The red dashed line shows the fit target for α (see Appendix B for details). In (a) and (b), the black dotted vertical lines indicate the switching positions between two consecutive sets of three pairs of anti-Helmholtz coils.

2 FIG. 3 .

 23 FIG. 3. (a)Behaviour of y0 in units of L1 for different time profiles: constant velocity (blue solid line), constant acceleration (red solid line), error function shape (green lines): δ = 0.02 (solid), δ = 0.1 (dashed) and δ = 0.5 (dashed-dotted). (b) Same as (a) for the velocity of the trap centre expressed in units of L1/∆t. (c) Same as (a) for the acceleration of the trap centre expressed in units of L1/∆t 2 . (d) Absolute value of the acceleration corresponding to the slope of the potential V in units of L1/∆t 2 : b = 65 G/cm and α = 1.937 (black solid line) and α = 1 (black dashed line). The vertical black segments indicate the range of slopes covered during a trajectory for some particular values of ∆t. The three horizontal green lines correspond to the maximal absolute value of the acceleration in units of L1/∆t 2 of the error function time profiles: δ = 0.02 (solid line), δ = 0.1 (dashed line) and δ = 0.5 (dashed-dotted line). The horizontal red line is the same for the constant acceleration profile. As soon as the acceleration corresponding to the slope of the potential V lies below one of the horizontal lines, the atoms become untrapped. As an example, the grey shaded area indicates the range of slopes leading to untrapped atoms for the error function time profile with δ = 0.02.

1 FIG. 4 .

 14 FIG. 4. (a) Ratio rN of the number of atoms remaining in the magnetic trap after a round trip along the first stage of the magnetic transport for different duration ∆t and different time profiles: constant velocity (blue solid line), constant acceleration (red solid line) and error function shape with δ = 0 (green solid line). (b) Ratio rN of the number of atoms remaining in the magnetic trap after a round trip along the first stage of the magnetic transport for the error function time profile with different values of δ and different ∆t: 500 ms (green solid line), 750 ms (olive solid line) and 1000 ms (light green solid line). (c),(d) Same as (a),(b) for the temperature ratio rT .

1 FIG. 5 .

 15 FIG. 5. (a) Ratio rN of the number of atoms remaining in the magnetic trap after a simulated round trip along the first stage of the magnetic transport for different duration ∆t and different time profiles: constant velocity (blue solid line), constant acceleration (red solid line) and error function shape with δ = 0 (green solid line). The dashed lines show the same ratio but considering only finite trap depth losses. The dotted lines only take into account losses associated with Majorana spin flips. (b) Temperature ratio rT estimated from the simulated velocity distribution. The color code is the same than in (a).

y 2 FIG. 6 .

 26 FIG. 6. (a) Dependence of α on the centre position of the magnetic quadrupole trap, y0, when only two consecutive pairs of anti-Helmholtz coils are used. The vertical dotted lines indicate the switching positions from one set of three pairs of anti-Helmholtz coils to the next (see text). The red dashed lines connect the maxima of α. (b) Cut in the magnetic quadrupole potential along the y axis around y0 = L1/2. The red dashed line corresponds to V of Eq. 3 taking the approximate |B(x, y, z)| from Eq. 2 with b = 65 G/cm and α(y0) = 1.87. The black line corresponds to the analytical formula of V which takes into account the details of the geometry of each coil. The current flowing in the coils have been adjusted so that the black lines optimally fit the red dashed line within the light grey area (see text).

2 FIG. 7 . 1 FIG. 8 . 2 FIG. 9 .

 271829 FIG. 7. (a)Behaviour of y0 in units of L1 for different time profiles: sinusoidal acceleration (red solid line), hyperbolic tangent function shape (green lines): δ = 0.2 (solid), δ = 0.3 (dashed) and δ = 0.9 (dashed-dotted). (b) Same as (a) for the velocity of the trap centre in units of L1/∆t. (c) Same as (a) for the acceleration of the trap centre expressed in units of L1/∆t 2 . (d) Absolute value of the acceleration corresponding to the slope of the potential V in units of L1/∆t 2 : b = 65 G/cm and α = 1.937 (black solid line) and α = 1 (black dashed line). The vertical black segments indicate the range of slopes covered during a trajectory for some particular values of ∆t. The three horizontal green lines correspond to the maximal absolute value of the acceleration in unit of L1/∆t 2 of the hyperbolic tangent function shape time profiles: δ = 0.2 (solid line), δ = 0.3 (dashed line) and δ = 0.9 (dashed-dotted line). The horizontal red line is the same quantity for the sinusoidal acceleration profile. As soon as the acceleration corresponding to the slope of the potential V lies below one of the horizontal line, the atoms become untrapped. As an example, the grey shaded area indicates the range of slopes leading to untrapped atoms for the hyperbolic tangent function time profile with δ = 0.2.

  which implies an abrupt change in the tilt of the potential in the middle of the trajectory.Countless other trajectories are conceivable. A few extra examples are given in Appendix C. We will focus in the following on a family of trajectories which give good results experimentally. It relies on the error function:

2

for y < y 0 (t) and y > y 0 (t) respectively with t ∈ [0, ∆t/2]. This is the opposite for t ∈ [∆t/2, ∆t],

  While Eq. E3 does not simplify into a simple analytical expression, integrating n(r; t tof ) along the y and z axis leads to n yz (x; t tof ) =

	β t N √ 2 2πr 0	exp -	x 2 2β 2 t r 2 0	+	N 8r 0	exp	β 2 t 2	exp -	x r 0	1 +	x r 0	-β 2 t	erfc	β t √ 2	-	√	x 2β t r 0
							+ exp	x r 0	1 -	x r 0	-β 2 t	erfc	β t √ 2	+	√	x 2β t r 0	(E4)
												1 t 3 tof	du n(u)p		r -u t tof	.	(E3)

ACKNOWLEDGMENTS

We are grateful to D. Guéry-Odelin for helpful comments on the manuscript. We thank A. Kaladjian for the building of a large part of the mechanical pieces we have used for the fabrication of the coils and their mounts. This work has been supported by the ANR Project No. 11-PDOC-021-01 and the Région Île-de-France in the framework of DIM NanoK (Des atomes froids aux nanosciences) project FluoStrong. LPL is a member of DIM SIRTEQ (Science et Ingénierie en Région Île-de-France pour les Technologies Quantiques).

Appendix A: Experimental details

The different coils are made of flat copper wires of rectangular cross section 1×2.5 mm 2 . They are insulated with a thin Kapton R layer. The MOT and C l coils, l ∈ [1,12], are made of 2 layers of 22 windings with outer and inner diameters of 72 mm and 26.6 mm respectively. Each C 13 coil is made of 5 C l coils soldered on top of each other. Each magnetic trap coil (MT) is made of 2 coils soldered on top of each other with 2 layers of 27 windings with an inner diameter of 124 mm. The push coil is conical and made of 16 layers with windings from 2 to 16 and an inner diameter of 38 mm. Except for the latter, all the coils are mounted in a water-cooled aluminium frame.

Three current supplies (one SM 15-100 and two SM 60-100 models from DELTA ELECTRONIKA) are used to deliver the currents in the different coils. An electronic box relying on MOSFETs allows to quickly switch from one pair of coils to another one. The open/close sequences can be read from a rewritable component of the box, or they can be delivered as digital signals by an ADwin-Pro II system with a clock period of 4 µs. The latter also provides the analog signals setting the output current of the different supplies at all time steps.

Appendix B: Determination of the currents

In order to determine the positions where we switch from one set of three pairs of anti-Helmholtz coils to the next, we first considered a situation where we only use two pairs of anti-Helmholtz coils to move the atoms. Fixing b = 65 G/cm, we fit the currents of the two pairs of anti-Helmholtz coils which lie on both sides of y 0 . This has the advantage of leading to positive current solutions only. If y 0 corresponds to the position of the symmetry axis of a given pair, the current in the other pair has to be zero and α(y 0 ) = 1. As shown in Fig. 6(a), between

Appendix C: Other examples of trajectories

We have tested a few additional trajectories in order to complete our experimental observations presented in section III B. Their respective behaviour is shown in Fig. 7. The first time profile realizes a sinusoidal profile for the acceleration:

Such trajectory allows us to check whether the abrupt change in the acceleration in the constant acceleration time profile is critical or not. Fig. 8(a) actually shows that the answer is negative since it is hard to distinguish the performances of the two time profiles. We have also tested a time profile very similar to Eq. 7 but replacing the error function by a hyperbolic tangent:

Such trajectory converges toward a constant velocity time profile when δ tends to zero. In Fig. 8(b), we observe an optimum around δ 0.2 for short values of ∆t. This is in agreement with Fig. 7(d), where we qualitatively see that for δ > 0.2 the duration ∆t must be larger than 500 ms so that the atoms remain trapped throughout the

Appendix D: Collision rate

The collision rate γ c can be defined as [START_REF] Dalibard | Proceedings of the International School of Physics "Enrico Fermi[END_REF]

where n is the mean density in the trap V , v r the average relative collision velocity and σ = 8πa 2 the scattering cross-section with a the scattering length. The scattering length for sodium atoms in the |F = 1, m F = -1 Zeeman substate is a = 2.75 nm [START_REF] Tiesinga | [END_REF]. For a cloud at thermal equilibrium in the trap V with α = 1, one finds

where N is the total atom number in the trap. We show in Fig. 9 how γ c depends on N . For our typical atom number and temperature, γ c < ∼ 1 s -1 . This is in good qualitative agreement with our experimental observations of the thermalization time of our gas after loading into the magnetic quadrupole trap which is on the order of a few seconds, where ∼ 3γ -1 c is expected from numerical simulations [START_REF] Dalibard | Proceedings of the International School of Physics "Enrico Fermi[END_REF].

Appendix E: Thermometry

We estimate the temperature of the trapped gas by relying on a fit of the density profile of the atoms after a time of flight t tof . If we assume the atoms to be initially at thermal equilibrium at a temperature T , the density in the quadrupole trap n is proportional to exp Single trajectories from Eq. 8 are solved with Matlab R relying on the ode45 solver which is based on the Dormand-Prince method. The relative tolerance for the calculation is set to 10 -6 .