S Valance

H Breitkreutz

Y Calzavara

M Hrehor

F Huet

J Jaroszewicz

H Palancher

B Stepnik

S Van Den Berghe

THE H2020 EUROPEAN PROJECT FUEL FOR RESEARCH REACTORS LEU-FOREVER: LEU FUELS FOR MEDIUM AND HIGH POWER RESEARCH REACTORS IN EUROPE

The minimization of proliferation risks for research reactors necessitates the reduction of the enrichment of the uranium fuels. In the EU, this conversion from high to low enriched uranium has already begun and is currently on its way towards the qualification phase. This concerns both medium and high power research reactors.

Neither for medium nor for high power research reactors are off-the-shelf low enriched uranium fuel elements available. Indeed, introducing a new type of fuel element in a research reactor implies the conservation or improvement of both safety and performance on one of a kind units within specific safety legislation.

The H2020 European LEU-FOREvER Project (2017-2021), associating major actors of the European research reactors field -Areva-NP, CEA, Centrum výzkumu Řež, ILL, NCBJ, SCK•CEN, TechnicAtome, TUM, aims to foster the development of sustainable and innovative low enriched uranium fuel elements for the whole spectrum of European research reactors.

1.

Introduction

One of the biggest challenges for European research reactors is securing their nuclear fuel supply. Two major factors have been identified in this regard: (i) the ongoing conversion of High Performance Research Reactors (HPRRs) from high to low enriched nuclear fuels (LEU), and (ii) the monopoly for the manufacture of fuel for Medium Power Research Reactors (MPRR) with an original Soviet design. A multi-disciplinary consortium composed of fuel/core designers, operators and fuel manufacturers has been set up to tackle both issues in the framework of the H2020 European Project LEU-FOREvER (2017)(2018)(2019)(2020)(2021). Key issues and operative solutions for this topic are underlined in the schematic drawing of Figure 1.

Five of the members, AREVA NP, CEA, ILL, SCK•CEN and TUM, constituting the HERACLES consortium, have been closely involved for almost 20 years in the development of LEU fuels for HPRR conversion. The focus of their common work has been the development of UMo based solutions, both dispersed and monolithic. Within LEU-FOREvER, optimisation of the manufacturing process up to the construction of pilot equipment, modelling of the in-pile behaviour and post-irradiation examinations of european fuels irradiated at the ATR are addressed. An alternative to UMo based fuels, high loaded U3Si2, appears also to be a possible path toward conversion of HPRR. Within LEU-FOREvER, design and manufacturing will be optimised and tested in an irradiation experiment under representative high power and burnup.

For European MPRR, a new mixed core design is under definition to operate with both the original and new fuel elements that will be developed, licensed and qualified within LEU-FOREvER. The LVR-15 reactor in the Czech Republic (CVR) will serve as a case study, identified in a preliminary analysis carried out by TechnicAtome which resulted in a robust design based on U3Si2/Al flat fuel plates. To improve economic competitiveness, AREVA NP will also reinvestigate its manufacturing process to identify optimisation opportunities.

As most HPRRs will also have to operate with a mixed core configuration during conversion and both HPRRs and MPRR are considering or even already using U3Si2/Al fuel plates, strong synergies are found in both subprojects.

Secure nuclear fuel supply for European research reactor

Objectives

Advance UMo fuel development

UMo based nuclear fuels, monolithic and dispersed, are promising candidates to carry out the conversion of HPRR. In such a fuel system, the addition of molybdenum to uranium stabilises the body-centred cubic crystal structure of the high-temperature γ-phase of uranium under irradiation. Hence the transition to the low-temperature orthorhombic α-phase with its strongly anisotropic thermal expansion, is prevented with an addition of 7 or 10 wt.% Mo. These stoechiometries have been proven to be the best compromise between achievable uranium densities and stabilisation of the phase behaviour.

Despite this inherent quality, significant obstacles were encountered on the way to qualification in the challenging environment of the HPRR regarding density of dispersion fuel, power and burn-up. The very first in-pile tests (IRIS2, FUTURE, IRIS3 0.3%Si) of nuclear fuels with a UMo/Al composition showed an unacceptable swelling under irradiation, in certain cases even leading to plate breakaway, even though these tests were only performed under limited surface power (≤350 W.cm -²) [START_REF] Dubois | Proceedings of the 11th International Meeting on Research REactorFuel Management (RRFM)[END_REF] [2] [START_REF] Leenaers | [END_REF]. The failure has been traced back to a UMo/Al Inter-Diffusion Layer (IDL) growing during in-pile irradiation at UMo-Al interfaces and to its unsatisfactory properties under irradiation: poor fission gas retention leads to the formation of large porosities at the interface between this IDL and the matrix, probable low thermal conductivity [4].

The developments performed worldwide over the last fifteen years have successfully limited the IDL growth [5]. The beneficial effect of Si additions to the dispersion UMo fuel, and more recently the coating of UMo particles with a diffusion barrier can be observed in the gradual, controlled swelling up to higher burnups. A dispersion of UMo particles coated by Physical Vapour Deposition (PVD) with a 1 μm thick ZrN layer, dispersed in an Al matrix, is currently the baseline solution for the conversion of most European HPRR.

Concerning the dispersed case, the key tasks of the comprehension phase are undoubtedly the SEMPER FIDELIS irradiation test (BR2, Mol -Belgium) and its sister experiment EMPIrE (ATR, Idaho -USA). These tests aim to fill the data gaps in the understanding of UMo fuel irradiation behaviour and assess a number of fabrication options for the dispersion UMo fuel. Both experiments are scheduled to start in 2017 with PIEs lasting until 2020. With the progression of the current H2020 HERACLES-CP project (2015-2019), identified additional knowledge and comprehension gaps will now be addressed in the LEU-FOREvER project.

Regarding the monolithic UMo fuel type, the developments and assessments performed in the HERACLES-CP project have made it possible to successfully demonstrate that the fabrication of monolithic UMo plates with the appropriate quality is entirely possible with the processes developed in Europe. Therefore, significant efforts can now be devoted to the next manufacturing steps and to improving the current manufacturing techniques.

Within the frame of the LEU-FOREvER proposal, the developments are threefold :

1. Irradiation temperature is suspected to have an influence on the swelling of UMo/Al based fuel and this influence will be studied using the SEMPER-FIDELIS test. To reach this objective, the fuel meat temperature will be computed using the CEA MAIA code dedicated to thermos-mechanical simulations of research reactor ;

2. UMo particle coating is necessary to stabilize fuel plate swelling during irradiation. Prototypic equipment was designed for using PVD (SCK•CEN, Belgium) and ALD (ANL, USA). It has been used for coating powders for the SELENIUM (PVD), SEMPER-FIDELIS (PVD) and EMPIrE tests (PVD & ALD). Within the HERACLES-CP H2020 project, the design of combined pilot equipment for both PVD and ALD is on-going. Its fabrication is a deliverable of the project by the end of May 2019. Within LEU-FOREvER, a combined (PVD and ALD) pilot equipment for coating, designed in the frame of the HERACLES-CP project, will be assessed with special care taken in the safety aspects ;

3. conducting first experiments on the fabrication of graded foils and the production of plates from such foils, albeit with inert material as precursor to monolithic UMo.

Demonstrate high loaded U 3 Si 2 solution for HPRR

The High Performance Research Reactors currently operating in western Europe (RHF, BR2, FRM II) are fuelled with HEU either in an aluminide (UAlx) or silicide (U3Si2) compounds dispersed in a pure Al matrix [6]. Lowering enrichment at constant 235 U content involves a significant raise of the uranium surface density of the plate. A correlate of this uranium density increase is an increased parasitic absorption due to the higher amount of 238 U in the core. This absorption needs to be overcome in order to maintain cycle length and neutron flux.

Within a given dispersion fuel system, two options are available to increase the fissile phase content :

-increase the volume fraction of fissile compound in the meat for a dispersion fuel ;

-modify the geometry of the fuel assembly and/or fuel plates to accommodate more fuel meat volume, e.g. using thicker plates, larger plates, more plates per assembly.

In an optimised geometry, it would then be possible to increase the quantity of fissile material in the assembly still maintaining the volume fraction of fuel at an acceptable level.

One of these options or a combination of both approaches may offer an alternative to UMo based dispersion fuels for conversion.

As the aluminide fuel option is insufficient for achieving conversion with acceptable modifications of the assembly geometry, the best candidate for developing such high loaded fuel is U3Si2. Under the NUREG-1313 NRC document [7], U3Si2 is qualified as a low power research reactor dispersion fuel at a loading of 4.8 g U .cm -3 , which is equivalent to a volume density of 42%. Other developments in the frame of JHR fuel qualification are ongoing to extend the use of U3Si2 dispersion fuel to higher powers (i.e. 500 W.cm -2 ) [8] [9] [START_REF] Gouat | [END_REF].

Within the LEU-FOREvER project, manufacturing developments and an irradiation for this high loaded U3Si2 are planned. The manufacturing developments will permit to ascertain the manufacturability of such geometry modified fuels, and to fix the boundary for the use of high loading U 3 Si 2 fuels. The High Performance research Reactors Optimized Silicide Irradiation Test (HiPROSIT) experiment will then evaluate the behaviour under irradiation of such modified fuels. This test irradiation of 6 full size flat fuel plates will permit to assess different approaches to increase the loading of U3Si2 fuel: increased density, increased meat thickness and a combination of both. These developments maximise the conversion probability and thereby minimise the risk of proliferation.

Diversify fuel supply for European MPRR

MPRR with an original Soviet design have a single fuel provider. An alternative to the fuel currently employed will be developed in LEU-FOREvER. However, the assembly will have different characteristics, eg. geometry, fuel composition, uranium loading. The use of such a fuel therefore implies an in-depth analysis of the reactor neutronics, thermo-hydraulics and the design of the MPRR core. In addition to these technical aspects, special care will be taken to develop a solution which is also economically efficient. Here, the direct aim of LEU-FOREvER is the qualification of a well-assessed fuel solution.

For this work, the LVR-15 research reactor will be a case study. First, it is representative of several other MPRR in Europe. Second, it has a very good operational record.

The research reactor LVR-15 serves as a neutron source for basic and applied research, as well as for the practical needs of industry and irradiation for the production of radiopharmaceuticals.

LVR-15 is a pool-type light water research reactor, placed in a stainless steel vessel covered with the shielding lid and coolant flow, operating at a thermal power up to 10 MW. The reactor was put in trial operation in 1989 after substantial refurbishing, and has been operating in continuous operation since 1995. In the framework of the Russian-American Global Threat Reduction Initiative (GTRI), the reactor underwent a transformation from 36 % enrichment to 19.7 % in 2009, maintaining its fuel geometry.

The active part of the reactor consists of 28-32 cells containing standard fuel assemblies. 12 fuel assemblies contain control rods (control assemblies); the 4 cells in the centre of the core contain channels for irradiation of samples. Located on the periphery of the core are the active channels of experimental loops, as well as a rotary channel for the doping of silicon, a tube post and vertical irradiation channels. The remaining cells are equipped with a beryllium reflector or water displacers.

Currently, the reactor uses Russian IRT-4M sandwich-type fuel assemblies, manufactured by NZCHK in Novosibirsk. The meat is composed of a dispersion of UO2 and aluminium powders. The Uranium loading in the meat is 2.77 g.cm -3 at an enrichment of 19.7%. The assemblies have the form of six or eight concentric square tubes. The central tube of the sixtube fuel assemblies can be equipped with a control rod channel. The inlet and outlet parts of the fuel assembly as well as the fuel cladding are made of aluminium. The length of the fuel assembly is 880 mm, the length of the active fuel part is 600 mm. The 235 U weight per assembly is approx. 230 g and 263.8 g, depending on the number of tubes in the assembly.

The development of a fuel alternative for MPRRs by the LEU-FOREvER project will bring several enhancements for the operators of these reactors:

-Much greater ease of use, on a routine basis, of European origin fuel in reactors of Russian origin ;

-Facilitated transition from historical fuel to new fuel, with respect to both technical and regulatory aspects ;

-Improved life cycle cost coupled with extended operating cycles.

Extensive joint investigations to achieve these goals already began in 2014 and will move forward considerably thanks to the developments carried out in LEU-FOREvER. To maximize the success probability of these efforts, the LEU-FOREvER consortium brings together a multidisciplinary team involving representatives of all affected entities:

 Reactor operators i.e. CVR;

 Fuel designers, to optimise both fuel "meat" and fuel "assemblies" i.e. TechnicAtome and AREVA NP ;

 Research reactor designers with all the relevant experience and calculation codes i.e. TechnicAtome.

A preliminary dimensioning has already been developped for a LVR-15 fuel alternative based on assemblies with a European design, i.e. with parallel flat plates and U3Si2/Al meat. Significant manufacturing and operating experience already exists for this kind of assembly in Europe, as the OSIRIS material testing reactor has been fuelled with assemblies of the same geometry and almost the same fuel composition.

Indeed, preliminary drawings have been made for both standard and control fuel elements, making it possible to verify the feasibility of moving from one type to the other. It was verified that even though the total fuel plate heating surfaces are drastically different in both assembly designs, it is still possible to optimise the 235U density, moderator volume, plate shapes, etc. Furthermore, it has been verified that the envisaged U3Si2/Al fuel plate usage in LVR-15 is covered by NUREG 1313 [7] as suggested by the UO2/Al fuel operational parameters in Table 4. This will make the qualification phase considerably shorter and cheaper. Finally, it has been verified that control elements are also compatible with the use of flat fuel plates.

By implementing an innovative methodology for fuel assembly design such as the design-tocost methodology and by involving all relevant parties from designer to manufacturer and to reactor operator, LEU-FOREvER aims to design and produce an economically attractive alternative fuel element based on solid European technology, produced by a European manufacturer. Moreover, efforts will be made to enhance fuel lifecycle costs. As an example, the possible use of burnable poison will be assessed. To do so, the COCONEUT neutronic scheme developed by AREVA-TA will be implemented [START_REF] Lacombe | internatinal Meeting on Research Reactor Fuel Management (RRFM)[END_REF].

Conclusion

An ambitious work program has been proposed within LEU-FOREvER to provide solutions to HPRRs for their conversion. Developments are pursued in three directions (dispersed UMo, monolithic UMo and high loaded U3Si2) to obtain, by the end of 2021 before starting the qualification phase, a robust evaluation of their maturity. Indeed in addition to the manufacturing studies undertaken for these three concepts, each of these solutions will have been tested under in-pile irradiation in three different tests: SEMPER FIDELIS for dispersed UMo within the frame of HERACLES CP, EMPIrE for monolithic UMo supported by the HERACLES group and finally HiPROSIT for high loaded U3Si2 thanks to LEU-FOREvER.

For MPRR, LEU-FOREvER will open up the possibility of an alternative nuclear fuel supply to all other European MPRR and thus enhance their sustainability. Indeed, on completion of this project, the following should be available:

-A summary report based on "Research reactor licensing and the research reactor fuel manufacturing licensing framework based on MARIA reactor conversion experience" ; -A hydraulic test loop for new fuel assembly pressure drop test ;

-Neutronic and thermal hydraulic codes at CVR, able to calculate a LVR-15 mixed core, i.e. a mix of Russian and European designs ;

-First-of-a-kind fuel assembly irradiation in LVR-15.

Beyond LEU-FOREvER, it is anticipated that CVR will be able to start the process of regulatory approval for LVR-15 operation with a mixed core beyond 2020:

-Irradiation of another LTA (Lead test assembly) to verify its performance at very high levels of burn-up ;

-Neutronic and thermal hydraulics codes qualification and validation ;

-Full amendment of the safety report to be allowed to operate with a mixed core.

For other reactors, irrespective of whether or not, they are members of LEU-FOREvER, or the end-user group, who are willing to initiate the process, a way forward will be defined.

Based on LVR-15 experience and LEU-FOREvER development, these reactors can expect to benefit from an accelerated process for their conversion.

Figure 1 :

 1 Figure 1: key issues and related nuclear fuel development to secure fuel supply for European research reactors.


Minjia Shi

Daitao Huang

Lin Sok

Patrick Solé

Double circulant self-dual and LCD codes over Galois rings *

Keywords: double circulant codes, self-dual codes, LCD codes MSC (2010): Primary 94B65 Secondary 13K05 13.95

This paper investigates the existence, enumeration and asymptotic performance of self-dual and LCD double circulant codes over Galois rings of characteristic p 2 and order p 4 with p and odd prime. When p ≡ 3 (mod 4), we give an algorithm to construct a duality preserving bijective Gray map from such a Galois ring to Z 2 p 2 . Using random coding, we obtain families of asymptotically good self-dual and LCD codes over Z p 2 , for the metric induced by the standard F p -valued Gray maps.

Introduction

Double circulant self-dual codes over finite fields have been studied recently in [START_REF] Alahmadi | On self-dual double circulant code, Designs, Codes Cryptogr[END_REF]. Double circulant self-dual codes over a commutative ring can only exist if there is a square root of -1 over that ring [START_REF] Ling | On the Algebraic Structure of Quasi-cyclic Codes II: Chain Rings[END_REF]. Such a root does not exist over Galois rings of even characteristic which are not fields, but does exist over Galois rings of odd characteristic and even extension degree [8, Lemma 3.1, Lemma 3.2]. We study these codes in the case of Galois rings of characteristic p 2 and size p 4 , for p an odd prime. A recent topic related to self-dual codes is LCD codes. They are popular because of their connections with cybersecurity [START_REF] Carlet | Complementary Dual Codes for Counter-Measures to Side-Channel Attacks[END_REF]. We also study LCD double circulant codes over the same Galois rings. For every such Galois ring we construct a duality preserving Gray map with image Z 2 p 2 , which maps self-dual (resp. LCD) codes to self-dual (resp. LCD) codes. Note that self-dual codes over Z p 2 , for p an odd prime, have been studied by many authors [START_REF] Dougherty | Self-Dual Codes over Z 8 and Z 9 , Designs, Codes, and Cryptography[END_REF][START_REF] Harada | On the classification of self-dual Z k -codes[END_REF]. This alphabet Z p 2 , in turn can be mapped into F p p by the Gray map studied in [START_REF] Ling | Z p k+1 -linear codes[END_REF]. For the two families of codes under scrutiny we give a complete enumeration formula in length 2n when n is coprime with p. This formula relies on the CRT approach to quasi-cyclic codes over rings [START_REF] Shi | Codes and Rings: Theory and Practice[END_REF][START_REF] Ling | On the Algebraic Structure of Quasi-cyclic Codes II: Chain Rings[END_REF], and requires to count the number of solutions of certain algebraic equations over Galois rings and over their residue fields. From there, building on Artin conjecture in arithmetic progressions [START_REF] Moree | On primes in arithmetic progression having a prescribed primitive root[END_REF], we construct infinitely many odd primes n such that x n -1 has only three factors over F p 2 the residue class ring of the Galois ring alphabet. Depending on the congruence class of n modulo 4, these irreducible factors are all three self-reciprocal, or consist of x -1, and one reciprocal pair. When n varies in one of these two families of primes, we obtain two infinite families of double circulant codes, one self-dual, one LCD, of length 2n. By expurgated random coding, we derive a lower bound on the relative Hamming distance of the F p image of both families. This shows, in particular, that both families are good.

The material is organized as follows. The next section collects the notions and notations needed in the forthcoming sections. Section 3 contains the main results on enumeration and Section 4 the main results on asymptotics. Section 5 displays some numerical examples. Section 6 concludes the article and points out some open problems.

Definitions and notation

Some rings

Throughout the paper, let p be an odd prime. The ring Z p s is the ring of integers modulo p s . A linear code of length N over Z p 2 is a submodule of Z N p 2 . The dual C ⊥ and C ⊥ H are understood with respect to the standard inner product and Hermitian inner product, respectively. A code is self-dual if it is equal to its dual. It is LCD (linear complementary dual) if it intersects its dual trivially. The Galois ring GR(p s , p ms ) of order p ms and characteristic p s is the Galois extension of Z p s with degree m. It is a local ring, with maximal ideal (p). The Teichmuller set T = {x ∈ GR(p s , p ms )|x p m = x} is a set of representatives of the residue field F p m = GR(p s , p ms )/(p). If r ∈ GR(p s , p ms ), let r denote its image in F p m by reduction modulo (p). It is known that GR(p s , p ms ) = T ⊕ pT ⊕ • • • ⊕ p s-1 T (base p decomposition of GR(p s , p ms )). See [START_REF] Wan | Finite Fields and Galois Rings[END_REF] for background and details.

Double circulant codes

Denote by R the ring

Z p 2 [y] (h(y))
, where h(y) is a basic irreducible polynomial over Z p 2 with deg(h(x)) = 2. For any ring M, we denote by M * the set of units in M. Assume that n is an integer with gcd(n, p) = 1, and consider the code C of length 2n over R whose generator matrix has the form of (I n , A), where I n is the identity matrix of order n and A is a circulant matrix over R. Note that C can be viewed as a submodule of ( R[x] (x n -1) ) 2 , with generator (1, a(x)) where the x-expansion of a(x) is the first row of A.

For all p's, we know there exists w ∈ R such that w 2 = -1, by [START_REF] Kim | Construction of MDS self-dual codes over Galois rings[END_REF]. When p ≡ 3 (mod 4), the polynomial y 2 + 1 is irreducible over F p , hence over Z p 2 . We may write R = Z p 2 [y]/(y 2 + 1), and take w = y.

Gray map

Recall Lagrange's four-square theorem, also known as Bachet's conjecture [START_REF] Ireland | A Classical Introduction to Modern Number Theory[END_REF].

Lemma 1. Every natural number can be represented as the sum of four integer squares.

We will also need the sum of two squares theorem, and the Diophantus identity [START_REF] Ireland | A Classical Introduction to Modern Number Theory[END_REF].

Lemma 2. An integer greater than one can be written as a sum of two squares if and only if its prime decomposition contains no prime congruent to 3 (mod 4) raised to an odd power.

Lemma 3. The product of two sums of two squares is a sum of two squares in following two different ways.

a 2 + b 2 c 2 + d 2 = (ac -bd) 2 + (ad + bc) 2 (1)
= (ac + bd) 2 + (ad -bc) 2 .

(

) 2
Assume p ≡ 3 (mod 4). By Lemma 1, we define a Gray map from R to Z 2 p 2 as follows:

φ : R → Z 2 p 2 a + by → (ka + sb, ta + rb),
where 3p 2 = k 2 + s 2 + t 2 + r 2 . Then extend it in the obvious way to R N . This Gray map is bijective, as the next result shows.

Theorem 1. The matrix k t s r is nonsingular.

Proof. Suppose that, looking for a contradiction, a linear dependence between the two rows of the matrix. Let µ, ν be two integers satisfying ν(k, t) = µ(s, r). Substituting k and s by their values in 3ν 2 p 2 we get

3ν 2 p 2 = (µ 2 + ν 2 )(r 2 + s 2 ).
By Diophantus identity (Lemma 3) the RHS is a sum of two squares. This contradicts Lemma 2, because the integer 3 times a square will always contain 3 to an odd power in its primary factors decomposition.

Theorem 2. Assume p ≡ 3 (mod 4). For all codes C over R, we have φ(C)

⊥ = φ(C ⊥ ). If C is a self-dual (resp. LCD) code of length N over R, then φ(C) is self- dual (resp. LCD) of length 2N over Z p 2 .
Proof. For any vector u

= (u 1 , u 2 , • • • , u N ), v = (v 1 , v 2 , • • • , v N ) ∈ R N , where u i = a i 1 + b i 1 y, v i = a i 2 + b i 2 y ∈ R (i = 1, 2, • • • , N)
. Suppose uv = 0 (mod p 2 ), and noting that p ≡ 3 (mod 4), we have y 2 + 1 = 0 over R. Considering the standard inner product, we then obtain

N i=1 (a i 1 + b i 1 y)(a i 2 + b i 2 y) = N i=1 [(a i 1 a i 2 -b i 1 b i 2 ) + (a i 1 b i 2 + a i 2 b i 1 )y] = 0, which is equivalent to    N i=1 (a i 1 a i 2 -b i 1 b i 2 ) ≡ 0 (mod p 2 ), N i=1 (a i 1 b i 2 + a i 2 b i 1 ) ≡ 0 (mod p 2
). We then naturally obtain

φ(u)φ(v) = N i=1 φ(u i )φ(v i ) = N i=1 (ka i 1 + sb i 1 , ta i 1 + wb i 1 )(ka i 2 + sb i 2 , ta i 2 + wb i 2 ) ≡ N i=1 [(k 2 + t 2 )(a i 1 a i 2 -b i 1 b i 2 ) + (ks + tw)(a i 1 b i 2 + a i 2 b i 1 )y] ≡ 0 (mod p 2 ). This implies φ(C ⊥ ) ⊆ φ(C) ⊥ ,
and, since φ is a bijection the first statement follows by showing that both sides have the same size.

The second statement for LCD codes is as in [START_REF] Dougherty | The combinatorics of LCD codes: linear programming bound and orthogonal matrices[END_REF]Th. 5.2]. The second statement for self-dual codes follows by plugging C ⊥ = C in the first statement.

Example: If p = 3, then 3p 2 = 27 = 16 + 9 + 1 + 1. The Gray map can be taken to be a + by → (4a + 3b, a + b).

Finite fields

If L, K are two finite fields of respective orders p rs and p r satisfying K ⊆ L, we write the trace from L down to K as 1) , where r, s are positive integers.

T r p rs p r (z) = z + z p r + • • • + z p r(s-

Codes over fields and asymptotics

Let p be an odd prime, and denote by F p the finite field of order p. By a code of length N over F p , we shall mean a proper subset of F N p . This code is linear if it is a F p -vector subspace of F N p . The dimension of a code C, denoted by k, is equal to its dimension as a vector space. Its (minimum) distance, denoted by d or d(C), is defined as the minimum Hamming weight of its nonzero elements. The Hamming weight of A family of codes is said to be good iff rδ > 0.

x = (x 1 , x 2 , • • • , x n ) ∈ F n p ,
Recall that the q-ary entropy function H q (•) is defined for 0 < y < q-1 q by H q (y) = y log q (q -1) -y log q (y) -(1 -y) log q (1 -y).

3 Main results

Enumeration in a special case

Assume that p is a primitive root modulo n with n an odd prime. Then, (p 2 )

n-1 2 ≡ 1 (mod n), and we have x n -1 = (x-1) g2 (x)g 3 (x) with g2 (x), g3 (x) monic irreducible polynomials over F p 2 . By Hensel lifting, since (n, p) = 1, we have x n -1 = ϑ(x -1)g 2 (x)g 3 (x) over R, with g 2 (x) ≡ g2 (x) (mod p), g 3 (x) ≡ g3 (x) (mod p) and ϑ ∈ R * . Both g 2 (x) and g 3 (x) are monic basic irreducible polynomials over R. The following lemma is taken from [START_REF] Wan | Finite Fields and Galois Rings[END_REF].

Lemma 4. Let R 1 = GR(p s , p sm ) and h(x) be a monic basic irreducible polynomial of degree l over R 1 . Then the residue class ring R 1 [x] (h(x)) is a Galois ring of characteristic p s and cardinality p sml and contains R 1 as a subring. Thus

R 1 [x] (h(x)) = GR(p s , p sml ).
Thus this lemma shows that the alphabet rings R i for i = 2, 3 of the constitutent codes defined below are also Galois rings. 2 . With this notation b = α u + pβ u . We can then define a Hermitian scalar product on R 2 2 , by the formula x • y = x 1 y 1 + x 2 y 2 for x = (x 1 , x 2 ), y = (y 1 , y 2 ) ∈ R 2 2 . From the introduction we know there is w ∈ R such that

3.1.1 n ≡ 1 (mod 4) Firstly, if n ≡ 1 (mod 4), since p is primitive modulo n, we can deduce (p 2 ) n-1 4 ≡ -1 (mod n). This implies that -1 is in the p 2 -cyclotomic coset modulo n. Conse- quently, we obtain g * i (x) = g i (x) for i = 2, 3. Note that deg(g i (x)) = n-1 2 . By the CRT, we have C = C 1 C 2 C 3 , where C 1 is a code of length 2 over R and C i is a code of length 2 over the ring R[x] (g i (x)) for i = 2, 3. Let R i = R[x] (g i (x)) for i = 2,
w 2 = -1. Write w = w 1 + pw 2 , w 1 , w 2 ∈ T 1 = {x ∈ R | x p 2 = x}. Then w 2 = w 2 1 + 2pw 1 w 2 = -1, which is equivalent to w 2 1 = -1, w 2 = 0.
That is to say, only has two choices for w in R such that w 2 = -1. Let us denote one of this two w ′ s by √ -1.

Theorem 3. Writing C 1 = [1, a] , where a ∈ R. Then we have C 1 is self-dual over R iff a = ± √ -1. Proof. C 1 is self-dual iff 1 + aa = 0, which implies a = ± √ -1.
The following lemma generalizes the Yamada normal form of [START_REF] Wan | Finite Fields and Galois Rings[END_REF].

Lemma 5. Let A, B ∈ T , then we have

A + B = T 1 + pT 2 with T 1 , T 2 ∈ T is uniquely given by    T 1 = (A 1 p + B 1 p ) p , T 2 ≡ -P p (A 1 p , B 1
p ) (mod p),
where pP p (A, B) = p-1 i=1 ( p i )A i B p-i , and P p (A, B) is a polynomial in A, B with integral coefficients.

Proof. Note that (A + B) p = A p + B p + pP p (A, B).

We then claim that (A + B)

p i = A p i + B p i + pP p (A p i-1 , B p i-1
) for any integer i. This can be proved by induction on n as follows.

(A + B)

p n = (A p n-1 + B p n-1 + pP p (A p n-1 , B p n-1 )) p = (A p n-1 + B p n-1 ) p = A p n + B p n + pP p (A p n-1 , B p n-1 ),
where the first and last equality hold by induction hypothesis. We then obtain

A + B = (A 1 p + B 1 p ) p -pP p (A 1 p , B 1 p ), which implies    T 1 = (A 1 p + B 1 p ) p , T 2 ≡ -P p (A 1 p , B 1
p ) (mod p),
since it can be checked by the formulas above that (A

1 p + B 1 p ) p n = (A 1 p + B 1 p ) p , showing that (A 1 p + B 1 p
) p ∈ T . This determines T 1 uniquely. We can only determine T 2 (mod p), which is enough for our purpose. Then the result follows.

With Lemma 5, we then obtain the following important theorem, which gives a necessary and sufficient condition for C 2 to be a self-dual code over R 2 . Proof. C 2 is self-dual iff 1 + bb = 0, i.e. 1 + bF n-1 4 (b) = 0, which is equivalent to

1 + α 1+u + pβα u + pβ u α = 0 = T 1 + pT 2 , (3)
where T 1 ∈ T , T 2 ∈ T and T 1 = T 2 = 0.

By Equation (3) and Lemma 5, we can then have

1 + α 1+u = (1 + α 1+u p ) p -pP p (1, α 1+u p ).
Then Equation ( 3) is equivalent to

(1 + α 1+u p ) p + p(βα u + β u α -P p (1, α 1+u p )) = 0. That implies    1 + α 1+u p ≡ 0 (mod p) βα u + β u α -P p (1, α 1+u p ) ≡ 0 (mod p)
Then the result follows.

Next, we will enumerate the number of possible choices for C 2 .

Theorem 5. The number of self-dual codes C 2 over R 2 is equal to u(1 + u).

Proof. Let x = α 1 p and we then consider the equation

x 1+u ≡ -1 (mod p).
It can be obtained that, noting that 2(1 + u) is a divisor of u 2 -1, the number of choices for x, hence for α, is 1 + u. Then by the equation βα u + β u α -P p (1, α 1+u p ) ≡ 0 (mod p), we get T r u 2 u ( β α u ) = f ( α), where f ( α) denotes P p (1, α 1+u p ) ≡ 0 (mod p). That implies that there are u choices for β when fixed α. Thus, the number of C 2 is equal to u(1 + u).

By the CRT, the following theorem can be derived. Theorem 6. The number of self-dual codes C over R is equal to 2u 2 (u + 1) 2 .

Proof. By Theorems 3 and 5, we obtain the number of C's as 2u 2 (u + 1) 2 .

We are now ready to investigate the number of LCD codes. We firstly introduce the following proposition.

Proposition 1. C 2 is LCD over R 2 iff 1 + b • b ∈ R * 2 . Proof. " ⇐ " 1. If b ∈ R * 2 , we then obtain C ⊥ H 2 = [1, -1 b ] . Suppose C 2 is not LCD, then there exist nonzero t, k ∈ R 2 such that t(1, b) = k(1, -1 b ). We then obtain t(1 + bb) = 0, which implies t = 0 since 1 + b • b ∈ R * 2 . Contradiction ! 2. If b ∈ R 2 \R * 2 , write b = pb ′ with b ′ ∈ T . Then we have C ⊥ H 2 = 2b ′ 1 0 2b ′′ with b ′′ ∈ T . Suppose C 2 is not LCD, then there exist nonzero m, n, l ∈ R 2 such that m(1, 2b ′ ) = n(2b ′ , 1) + l(0, 2b ′′ ). That implies    m = 2nb ′ , 2mb ′ = n + 2lb ′′ ,
then we obtain m = 0, a contradiction !

" ⇒ " Suppose 1 + b • b ∈ R 2 \R *
2 , then we have the following two cases.

1. If b ∈ R * 2 , we have p(1 + b • b) = 0 = p(1, b) • (1, b). Note that C ⊥ H 2 = [1, -1 b ] , we then obtain p(1, b) ∈ C ⊥ H 2 , which implies p(1, b) ∈ C ⊥ H 2 ∩ C 2 . Contradiction! 2. If b ∈ R 2 \R * 2 , we then get 1 ∈ R 2 \R * 2 , a contradiction !
This completes the proof.

Similarly, we have Proposition 2 about C 1 , which is a constituent code over R.

Proposition 2. The code C 1 is LCD over R iff 1 + a • a ∈ R * .
In particular, the number of possible choices for a is p 4 -2p 2 .

(2) If λ is not a unit, writing λ = pλ 1 with λ 1 ∈ T e j , we can obtain 1

+ b ′ c ′ ∈ pR ′ 2 , Contradiction !
Then the result follows.

Theorem 11. Suppose u ′ = p n-1 , the number of LCD codes over R is equal to

(p 4 -2p 2 ) • (u ′4 -u ′2 + u ′ ).
Proof. Just keep the same notations as in Lemma 6. In the following, we aim to count the possible choices for C ′ 2 and C ′ 3 . Then we have

(1) If b ′ is a unit, then c ′ is arbitrary except the case when c ′ ∈ -1 b ′ + pR ′ 2 , which implies the number of pairs (b ′ , c ′ ) is (u ′2 -u ′ ) 2 . (2) If b ′ is not a unit, i.e., b ′ = pb ′ 1 with b ′ 1 ∈ T ′ , then c ′ is arbitrary. In detail, c ′ = c ′ 1 + pc ′ 2 with c ′ 1 , c ′ 2 ∈ T ′ , we have 1 + b ′ c ′ = 1 + pc ′ 1 b ′ 1 / ∈ pR ′ 2 . Thus, the number of pairs (b ′ , c ′ ) is u ′ • u ′2 = u ′3 . Thus, the total number of C ′ j , C ′′ j is (u ′2 -u ′ ) 2 + u ′3 = u ′4 -u ′3 + u ′2
. Therefore, the total number of LCD double circulant codes is equal to, based on Proposition 2,

(p 4 -2p 2 ) • (u ′4 -u ′3 + u ′2 ).
This completes the proof.

Enumeration in the general case

The following result, while not needed for the asymptotics, is of interest in its own right.

Theorem 12. Let n be an odd integer, assume that the factorization of x n -1 into irreducible polynomials over R is of the form

x n -1 = ς(x -1) s i=2 g i (x) t j=1 h j (x)h * j (x),
with ς ∈ R * , and g i (x) is a self-reciprocal polynomial of degree d i with d i a even integer, the polynomial h j (x) is of degree e j and * denotes reciprocation. The number of self-dual double circulant codes over R is

2 s i=2 (u 2 i + u i ) t j=1 (u ′2 j -u ′ j ),
The number of LCD double circulant codes over R is

(p 4 -2p 2 ) s i=2 (u 4 i -u 3 i -u 2 i ) t j=1 (u ′4 j -u ′3 j + u ′2 j ),
where

u i = p d i , u ′ j = p 2e j . Proof. Let R = R[x] (x n -1) . We know that R ≃ R[x] (x -1) ⊕ s i=2 R[x] (g i (x)) ⊕ t j=1 ( R[x] (h j (x)) ⊕ R[x] (h * j (x))
) by the CRT. Denote by

G i the ring R[x] (g i (x)) , by H ′ j the ring R[x] (h j (x))
and by H ′′ j the ring

R[x] (h * j (x))
. This decomposition naturally extends to R 2 as

R 2 ≃ R 2 ⊕ s i=2 G 2 i ⊕ t j=1 (H ′2 j ⊕ H ′′2 j ) .
In particular, each R-linear code of length 2 can be decomposed as the "CRT sum"

C ≃ C 1 ⊕ s i=2 C i ⊕ t j=1 (C ′ j ⊕ C ′′ j ) .
By Theorem 3, and the analogues of Theorems 5 and 9, the number of self-dual codes is

2 s i=2 u i (1 + u i ) t j=1 (u ′2 j -u ′ j ).
Based on Theorems 8 and 11, the number of LCD codes is equal to

(p 4 -2p 2 ) s i=2 (p 4d i -u 2 i (u i + 1)) t j=1 (u ′4 j -u ′3 j + u ′2 j ),
where

u i = p d i , u ′ j = p 2e j .
Then the result follows.

Relative distance bound

This section only uses enumeration for the special case of the factorization of x n -1 into two irreducibles. We assume p ≡ 3 (mod 4) to use the duality-preserving Gray map given by Section 2.3. If C is an R-code, we call its F p image the image of φ(C) by the Gray map of [START_REF] Ling | Z p k+1 -linear codes[END_REF] with k = 1. Note that if C is a code of length 2n over R then φ(C) is of length 4n over Z p 2 and the F p -image of φ(C) has length 4pn over F p . We prepare for the proof of the main result by the following result.

Theorem 13. If e, f ∈ R n , and (0, 0) = (e, f ) has Hamming weight < n, then the vector (e, f ) is in at most λ double circulant codes of length 2n with λ = p 3n+1 .

Proof. Write (e, f ) = (e 1 , f 1 ) ⊕ (e 2 , f 2 ) ⊕ (e 3 , f 3 ) for the CRT decomposition of (e, f ).

Consider C 1 = [1, a] , a = α 1 +pβ 1 , α 1 , β 1 ∈ T 1 = {x ∈ R | x p 2 = x}. Let (e 1 , f 1 ) ∈ C 1 , we have f 1 = e 1 a. (i) If e 1 is a unit, a = f 1 e 1 .
(ii) If e 1 ( = 0) is not a unit, write e 1 = pe ′ 1 with e ′ 1 ∈ T * 1 . We then obtain f 1 = pae ′ 1 .

(ii-1) α 1 = 0, we have

f 1 = pf ′ 1 = pα 1 e ′ 1 , which implies α 1 = f ′ 1 e ′ 1
, β 1 is arbitrary.

(ii-2) α 1 = 0, we have a = pβ 1 , which implies f 1 = 0, β 1 is arbitrary.

(iii) If e 1 = 0, we then get f 1 = 0. That implies a is arbitrary. We can easily get there are at most p 4 double circulant codes that containing (e 1 , f 1 ).

Consider C 2 = [1, b] , b = α 2 + pβ 2 , α 2 , β 2 ∈ T 2
, where the case is similar to that of C 1 with T 2 playing the role of T 1 . Note that T 2 = T or T ′ . Thus, the number of constituent codes C 2 is at most

|T | 2 = |T ′ | 2 .
The case is the same as that of C 3 . However, these two analyses cannot be run independently. The detail is as follows.

1. If both e 2 and e 3 are 0, then we obtain e ∈ (g 2 (x)g 3 (x)), the repetition code of length n. So either e = 0 yielding f = 0, or w H (e) = n, contradicting the hypothesis. This argument shows that the case (iii) cannot happen simultaneously for C 2 and C 3 .

2.

If both e 2 and e 3 are not units, and e 2 , e 3 = 0, we can easily get e ≡ e 2 e 3 ≡ 0 (mod g 2 (x)g 3 (x)).

(a) If e = 0, we then obtain w H (e) ≥ w H ( e) = n, a contradiction ! Theorem 15. Assume the Artin conjecture for primes in arithmetic progression [START_REF] Moree | On primes in arithmetic progression having a prescribed primitive root[END_REF] holds. There is an infinite family of double circulant self-dual (resp. LCD) R-codes with rate

(δ 0 ) = 1
4p for LCD codes. The result follows by observing that, by definition of the family of codes so constructed, δ ≥ δ 0 .

Numerical examples

Assume p = 3 and C = [I, A 0 + yA 1 ] , where A 0 , A 1 are circulant matrices of size n and I is the identity matrix of the same size. The generator matrix of φ(C) can be computed as

4I I 4A 0 + 3A 1 A 0 + A 1 3I I 3A 0 -4A 1 A 0 -A 1 .
Define the base 3 decomposition of x ∈ Z 9 as x = r 0 (x) + 3r 1 (x), where r i (x) ∈ {0, 1, 2}. Then we can define the Gray map of [START_REF] Ling | Z p k+1 -linear codes[END_REF] as Φ : Z 9 → Z where a i = r 1 (a) + ir 0 (a). The explicit map is tabulated below.

x Φ(x) w H (Φ(x)) 0 (0,0,0) 0 1 (0,1,2) 2 2 (0,2,1) 2 3 (1,1,1) 3 4 (1,2,0) 2 5 (1,0,2) 2 6 (2,2,2) 3 7 (2,0,1) 2 8 (2,1,0) 2

In Table 1 and Table 2 we have collected some examples of double circulant LCD and self-dual codes obtained by random search in Magma. The coefficients of degree n polynomial a(x) are written in decreasing powers of x, for example for n = 3, the entry 811 means 8x 2 + x + 1. The parameters over Z 9 and Z 3 are given in the form (4n, 9 2n , d φ(C) ) and [12n, 4n, d Φ(C) ] respectively, where d φ(C) and d Φ(C) are the Hamming minimum distancess of their Gray images φ and Φ respectively. The entry in the rightmost column is the best known distance of an [12n, 4n] tenary linear code, obtained by looking up at the tables in www.codetables.de.

Conclusion

In this article we have studied double circulant codes either self-dual or LCD over Galois rings of characteristic p 2 and size p 4 . Extending the study to GR(p s , p ms ), with s > 2 would result in more terms in the base p expansion of a ring element and would make the computations of Section 3 more difficult. A similar remark can be made about using m > 2. More tractable could be to study quasi-cyclic codes of higher index, like four-circulant codes, for instance.

We have used the composition of two Gray maps to derive codes over F p . While the choice of the Hamming metric over F p is the most natural one, the study of the Lee minimum distance of the F p -image could also be worthwhile.

  denoted by w(x), is the number of indices i where x i = 0. The three parameters of a code are written compactly as [n, k, d]. We extend this notation to a possibly nonlinear code C ⊆ F n p , by letting then k = log p (|C|), and letting d be the minimum pairwise distance between two nonzero codewords. If C(n) is a family of codes of parameters [n, k n , d n ], the rate r and relative distance δ are defined as r = lim sup n→∞

conjugate b of b is F n- 1 4

 1 3. The properties of C 3 being similar to that of C 2 , we only investigate C 2 for simplicity's sake. Write C 2 = [1, b] , where b ∈ R 2 . Note that b can be uniquely decomposed in base p as b = α + pβ, where α, β ∈ T = {x ∈ R 2 | x p n-1 = x}. Define a generalized Frobenius map F as F (b) = α p 2 + pβ p 2 , then F (b). Throughout this paper, we let u = p n-1

Theorem 4 .

 4 C 2 is self-dual over R 2 with respect to Hermitian inner product iff  mod p), βα u + β u α -P p (1, α 1+u p ) ≡ 0 (mod p).

  1 2 and relative Hamming distance of the F p image δ ≥ H -1 Artin conjecture for primes in arithmetic progression shows in particular that p and ǫ ∈ {±1} being given, there are infinitely many primes n ≡ ǫ (mod 4) such that p is primitive modulo n. It should be noted that the size Ω n of the family of codes we consider is asymptotically equivalent to 2u 4 for self-dual codes and to p 4n for LCD codes. This holds for the case ǫ = 1 by Subsection 3.1.1 like for the case ǫ = -1 by Subsection 3.1.2. Assume we can prove that for n large enough Ω n > λB(d n ), where λ = p 3n+1 for LCD codes and λ = 2u 2 (u + 1) for self-dual codes and B(r) denotes the number of vectors in R 2n with Hamming weight of their F p image < r. This would imply by Theorem 13 that there are codes of length 2n in the family with F p image distance ≥ d n . Denote by δ the relative distance of this family of p-ary codes. If we take d n the largest number satisfying the said inequality, and assume a growth of the form d n ∼ 4pδ 0 n, then, using an entropic estimate for B(d n ) ∼ p 4pnHp(δ 0 ) (cf. [6, Lemma 2.10.3]) yields, with the said values of Ω n and λ the estimate H p (δ 0 ) = 1 8p for self-dual codes and H p

	p (1/8p) (resp.
	δ ≥ H -1 p (1/4p)).
	Proof.

3 3 Table 1 :

 31 Double circulant LCD codes over Z 9 + uZ 9 and their Gray images φ, Φ n a 1 (x) a 0 (x) (4n, 9 2n , d φ(C) ) Z 9 [12n, 4n, d Φ(C) ] Z 3 Distance of BKLC over Z 3

	2 41	51	(8, 9 4 , 4)	[24, 8, 6]	11
	3 811	081	(12, 9 6 , 6)	[36, 12, 12]	15
	4 3651 6505	(16, 9 8 , 5)	[48, 16, 14]	18
	5 10856 57664	(20, 9 10 , 6)	[60, 20, 16]	21

a → (a 0 , a 1 , a 2 ),

Table 2 :

 2 Double circulant self-dual codes over Z 9 + uZ 9 and their Gray images φ, Φ n a 1 (x) a 0 (x) (4n, 9 2n , d φ(C) ) Z 9 [12n, 4n, d Φ(C) ] Z 3 Distance of BKLC over Z 3

	2 10	00	(8, 9 4 , 3)	[24, 8, 10]	11
	3 811	081	(12, 9 6 , 6)	[36, 12, 12]	15
	4 6731 4752	(16, 9 8 , 6)	[48, 16, 15]	18
	5 26758 62532	(20, 9 10 , 6)	[60, 20, 18]	21

* This research is supported by National Natural Science Foundation of China (61672036), Technology Foundation for Selected Overseas Chinese Scholar, Ministry of Personnel of China (05015133) and the Open Research Fund of National Mobile Communications Research Laboratory, Southeast University (2015D11) and Key projects of support program for outstanding young talents in Colleges and Universities (gxyqZD2016008).

Proof. The proof of the first statement is similar to that of Proposition 1, with the Euclidean inner product replacing the Hermitian inner product. We omit it here. Write a = a 1 + pa 2 with a 1 , a 2 ∈ T 1 . By this criterion the number of possible choices for a is equal to

where

Then the result follows.

To determine the number of LCD codes C 2 , we will reason by complementation.

Theorem 7. C 2 is not LCD code over R 2 with respect to Hermitian inner product iff

where T 1 = 0, T 2 ∈ T . By Equation ( 4) and Lemma 5, we can then have

Then Equation ( 4) is equivalent to

That implies 1 + α 1+u p ≡ 0 (mod p), with β is arbitrary.

Combining Proposition 2 and Theorem 7, we have the following important theorem.

Proof. We know that the total number of codes over R and R 2 are p 4 and p 2(n-1) , respectively. Based on Theorems 3 and 5, the choice for non LCD codes is (u + 1)u 2 , then the result follows by subtraction.

n ≡ 3 (mod 4)

If n ≡ 3 (mod 4), we have g

Then by the CRT, we obtain

The following result is needed to count the number of self-dual C's.

Thus, from the form of the generator matrix of

is exactly the size of R ′ * 2 , i.e., is equal to p 2(n-1) -p n-1 .

Theorem 10. The number of self-dual codes C over R is equal to 2 • (p 2(n-1) -p n-1 ).

Proof. Based on Theorems 3 and 9, we can obtain the desired results.

(b) If e = 0, assume that 0 = e = pe ′ , then we have f = pf ′ . Write C = [1, d] ,

where

e ′ and d 2 is arbitrary. In this case, there are at most p 2n double circulant codes containing (e, f ). Thus, we obtain λ = p 4 |T | 2 |T | = p 3n+1 when e 1 = e 2 = 0 and e 3 is not unit.

Theorem 14. If e, f ∈ R n , and (0, 0) = (e, f ) has Hamming weight < n, then the vector (e, f ) is in at most λ self-dual double circulant codes of length 2n with λ = 2u 2 (u + 1).

Proof. Write (e, f ) = (e 1 , f 1 ) ⊕ (e 2 , f 2 ) ⊕ (e 3 , f 3 ) for the CRT decomposition of (e, f ).

We can easily get there at most exist 2 self-dual codes which contain (e 1 , f 1 ). Consider (e 2 , f 2 )

(ii-1) α 2 = 0, we have

, β 2 is arbitrary.

(ii-2) α 2 = 0, we have b = pβ 2 , which implies f 2 = 0, β 2 is arbitrary.

(iii) If e 2 = 0, we then get f 2 = 0. That implies b is arbitrary. We can easily get there are at most u(1 + u) self-dual codes that containing (e 2 , f 2 ).

By Theorem 13, then e 2 , e 3 = 0. If e 2 , e 3 are not units with e 2 , e 3 = 0, based on 2 in Theorem 13, for the subcase 2(b), we obtain 1 + d 2 = 0. We then get 1 + d . Then d 2 is uniquely determined by d 1 . That is to say, there are at most 2 self-dual codes containing (e, f ) when e 2 , e 3 are not units. Thus, by Theorem 5, we obtain λ = 2u 2 (u + 1) with at most u self-dual codes containing (e 3 , f 3 ) if n ≡ 1 (mod 4). When n ≡ 3 (mod 4), C 3 is determined by C 2 .

Then, the result follows.

We can now state and prove the main result of this paper.


Crater T H Prettyman
email: prettyman@psi.edu

N Yamashita

M E Landis

J C Castillo- Rogez

B L Ehlmann

H Y Mcsween

M J Toplis

S Marchi

C M Pieters

N Schorghofer

C T Russell

M. D Rayman

C A Raymond

DAWN'S GRAND FINALE: HIGH SPATIAL-RESOLUTION ELEMENTAL MEASUREMENTS REVEAL AN ANOMALY AT OCCATOR

ou non, émanant des établissements d'enseignement et de recherche français ou étrangers, des laboratoires publics ou privés.

Introduction: During Dawn's primary mission, coarse, global maps of Ceres' elemental composition (about 400 km spatial resolution) were determined from data acquired by Dawn's Gamma Ray and Neutron Detector (GRaND) [1,2]. GRaND is sensitive to the composition of the bulk regolith to depths of a few decimeters, providing geochemical constraints on the formation and evolution of Ceres' outermost crustal layer. Elements measured during the primary mission included H, Fe, and K as well as bounds on C.

Elemental and mineralogical constraints support extensive aqueous alteration within Ceres' interior, similar to processes that occurred within the parent bodies of the CI chondrites [1][2][3][4]. However, differences between the elemental composition of Ceres' ice-free regolith and the CI chondrites indicate Ceres underwent chemical fractionation [1]. This is consistent with geophysical observations that indicate a layered interior, with a crust rich in ice, salts and/or clathrates covering a brine-rich layer, possibly the remnants of a subsurface ocean and a source region for cryovolcanism [5][6][7]. Ceres' carbon-rich, global regolith contains high concentrations of H, in the form of water ice, phyllosilicates, ammoniated species, and perhaps organic compounds, with unknown exogenic contributions [1,2,[8][9][10]. The elemental data acquired by Dawn will help understand the relationship between Ceres' regolith and bulk crustal composition, providing new insights into crustal processes.

Here, we describe preliminary results of the analysis of high spatial-resolution gamma ray and neutron data acquired in Dawn's second extended mission (XM2). We find that concentrations of hydrogen within Occator crater and its immediate surroundings are anomalously high in comparison to other regions at similar latitudes. This may result from the presence of subsurface ice, excavated by the impact and concentrated in a melt sheet and/or the presence of water bound to salts emplaced by cryovolcanism or impact induced hydrothermal activity [11,12]. Interpretation of the elemental data is supported by results of geochemical and thermophysical modeling and constraints on surface mineralogy.

High resolution data: In June of 2018, the spacecraft maneuvered into a highly eccentric elliptical orbit with a periapsis altitude as low as 30 km. The orbit was in a 3:1 resonance with Ceres, enabling the acquisition of data along a meridional arc and providing multiple, low-altitude passes over diverse geologic regions in the eastern and western hemispheres (along longitudes 60E and 240E). The elliptical campaign continued until the spacecraft ran out of hydrazine on October 31, marking the end of the mission. Data were acquired under nearly ideal solar conditions with negligible data loss. Elemental analyses used data from 113 of the 123 completed orbits.

The low altitude data acquired in XM2 enabled the determination of the elemental composition of the regolith on fine spatial scales, comparable to geologic features imaged by Dawn's optical instruments, including the interior of Occator crater and the surrounding ejecta blanket (Fig. 1). The orbits also sampled ejecta from the Yalode and Urvara basins, the interior of Ur- As the spacecraft moved closer to Ceres, the flux of gamma rays and neutrons increased and background contributions from the spacecraft decreased due to shielding of cosmic rays by Ceres. An approximately five-fold increase in signal to background was achieved in XM2 for gamma ray spectra compared to the primary mission. This enables improved accuracy for elements measured during the primary mission and the acquisition of new elemental signatures and bounds. Additional signatures targeted in XM2 include elemental mass ratios (Fe/Si, Mg/Si and C/O) and brine tracers such as Cl.

Preliminary results: A high resolution map of subsurface hydrogen was determined from thermal and epithermal neutron counting data acquired at altitudes <100 km (Fig. 1).[ 13, 14]Methods described by [1] were used to convert mapped counting data to hydrogen concentration. The distribution of hydrogen along the 60E and 240E meridians is consistent with global maps [1], with high concentrations near the poles and lower concentrations near the equator, indicating the presence of a receding ice table. The new data enable improved characterization of the depth distribution and concentration of subsurface ice and hydration state of minerals. Notably, the interior of Occator crater (centered at about 20N) and its eastern ejecta blanket have anomalously high concentrations of hydrogen. Analyses of regional gamma ray spectra acquired at low altitude are in progress. Chlorine was not detected; however, based on modeling of analog materials, the regolith may contain up to 5 wt.% Cl.

Interpretation: The concentration of hydrogen measured by GRaND in the bulk regolith is higher and more variable than in the outermost surface layer sensed by VIR (Fig. 2). Excess hydrogen detected by GRaND within and around Occator may be in the form of subsurface water ice. Ice may be concentrated in lobate deposits, which fill a significant fraction of the crater floor [13]. Icy crustal material may have been excavated by the impact and deposited in the ejecta blanket. Given Occator's age (about 20 Myr) [15], it is plausible that ice has survived within the outermost meter of the surface [16].

A portion of the hydrogen sensed by GRaND may also be in the form of hydrated and/or ammoniated salts; however, their contributions are likely small given the extent of the faculae. In addition, hydrated salts such as natron and hydrohalite are unstable at predicted subsurface temperatures [16,17]. Ammonium chloride was detected in the faculae by VIR [14].

Chlorine-bearing minerals should be a major component of the Ceres' crust [7]. However, GRaND measurements indicate Cl is a minor component of the regolith. The dearth of Cl in the regolith may indicate a large-scale gradient in crustal composition with depth, perhaps resulting from chemical fractionation as the crust froze from a muddy brine.

  DAWN'S GRAND FINALE: HIGH SPATIAL-RESOLUTION ELEMENTAL MEASUREMENTS REVEAL AN ANOMALY AT OCCATOR CRATER. T T.H. Prettyman, N Yamashita, M E Landis, J. Castillo-Rogez, B. Ehlmann, H y Mcsween, M. Toplis, S. Marchi, C M Pieters, N. Schorghofer, et al. To cite this version: T.H. Prettyman, N Yamashita, M E Landis, J. Castillo-Rogez, B. Ehlmann, et al.. DAWN'S GRAND FINALE: HIGH SPATIAL-RESOLUTION ELEMENTAL MEASUREMENTS REVEAL AN ANOMALY AT OCCATOR CRATER. T. Lunar and Planetary Science Conference, Mar 2019, HOUSTON, United States. hal-02411671

Figure 1 .

 1 Figure 1. (A) Map derived from GRaND data acquired at altitudes less than 100 km reveals relatively high concentrations of hydrogen within Occator crater (19.86N, Ø 92 km) and its eastern ejecta blanket (arrows). The map resolution is smaller than the diameter of Occator (B) Geologic map provides context, including the extent of the ejecta and the heterogeneous crater interior [priv. comm., A. Nass; 13].

Figure 2 .

 2 Figure 2.GRaND map of subsurface hydrogen (A) is compared to a map of surficial hydrogen (B) determined using a mineral mixing model[9] with mixing ratios determined by[14] from Visible and Infrared Mapping Spectrometer (VIR) data. The vertical bar in A shows the range of hydrogen in B.


H Fuqua Haviland
email: heidi.haviland@nasa.gov

S Karunatillake

D Susko

L Ojha

D Baratoux

M Toplis

R El Maarry

CHARACTERIZING ELYSIUM'S MAGMATIC EVOLUTION AND CHEMISTRY INITIAL STUDY

Introduction:

The Elysium volcanic province (EVP) is a location of great geologic interest on Mars. EVP is notable not only for the presence of three shield volcanoes, Elysium, Alber, and Hecates, but also for some of the most recent eruptions on the planet, with some interpretations suggesting activity even in the last few million years. Its predominantly Amazonian surface age and isolation in the northern hemisphere away from other volcano-tectonic regions make it an ideal locale to investigate igneous compositions during the most recent geologic period on Mars. Specifically, EVP experienced an extended period of volcanism; compared to large igneous provinces on Earth, the martian context has persisted orders of magnitude longer. Therefore, changes in mantle chemistry, pressure, and temperature are expected, as well as changes in fractional crystallization processes and crustal contamination. Due to the coarse length scale of the observation resolution and lack of resolved local features, these systems appear much simpler than their terrestrial counterpart. In addition, regional scale changes in eruptive processes of any given martian volcanic province over geologic time are still poorly understood. Related investigations are crucial for understanding how the martian crust and mantle have evolved in the absence of Earth-like plate-tectonics. Consequently, this project helps fill this knowledge gap by assessing the compositional evolution of Elysium as a major martian volcanic province, using remote sensing data sets (Mars Odyssey Gamma Ray and neutron Spectrometer suite (GRS), and gravity) and modeling (petrologic and thermoelastic).

By analyzing data based on predictions from petrologic modeling, we develop an expansive geologic history for the region that spans over 3 Ga. Our work shows a compositional transition in Elysium's volcanism coupled to differences in geologic age between NW and SE regions [1] (mapped Geology summarized in Fig. 1). The continuity of volcanic activity, and the notable spatiotemporal changes in the abundance of heat-producing radioactive elements (K and Th) along with others (Al, Ca, and Fe in particular) make this region an ideal case study for the evolution of volcanism on Mars [1,2]. Here we perform a detailed petrological and thermoelastic modeling to test the emerging hypothesis that compositional variability within EVP resulted from spatiotemporal changes in the depth of magma formation and present initial results.

Methods:

We use two primary methods: first, we constrain the pressure and temperature conditions of EVP as a case study of geologically recent magmatic evolution on Mars using GRS informed surface chemistry constraints and pMELTS modeling. Second, we place constraints on the density of the EVP melt through thermoelastic modeling and a local gravity analyses.

Task 1: GRS informed petrological melt modeling. First, we characterize chemically and geologically distinct regions within EVP. Our previous work verified that Elysium's compositional signature reflects primary igneous processes coupled to mantle sources, not secondary alteration or dust cover [1]. However, our ongoing work suggests a need to revise the EVP regions to ensure better spatial and temporal resolution of magmatic evolution in the context of GRS resolution. We identify the compositional trends from mapped geology, impact crater-based geochronology, and the GRS based chemical maps.

Next, we derive melt conditions consistent with regional compositions. Our previous work performed melt modeling in the martian context [3,4]. Similarly, here we use pMELTS software to thermodynamically model partial melting of the underlying mantle. Seven oxide (SiO2, FeO, Al 2 O 3 , CaO, K 2 O, TiO 2 , and MgO) mass fractions (wt%) derived from GRS data, 10 -30 kbar pressure (P) range, and 1000 to 2000 °C temperature (T) range, comprise the initial parameter space. The P and T ranges correspond to crustal heat flow of 18 mW/m 2 , with a mean surface temperature of 273 K, 100 km depth (corresponding to the 10 kbar constraint) [5,6]. The P and T conditions will be further refined with geophysical datasets, including a local gravity study with estimates on the pressure gradient across the lithosphere and upper mantle. We also test a range of H 2 O wt% for martian magmas, and the latest bulk silicate Mars compositional model [7] as inputs to our pMELTS calculations including dry and wet martian mantle end members [e.g., 8 and references therein]. Mantle hydration is naturally variable and dependent on the condition of melting; also, the martian mantle hydration may be highly heterogeneous [9]. We identify the optimal melt conditions for EVP among the multiple plausible models across the range of P, T. (one example oxide and the effects of P-T is summarized in Fig. 2).

Task 2: Gravity constrained thermoelastic modeling. We place constraints on the density of the EVP 3206.pdf 50th Lunar and Planetary Science Conference 2019 (LPI Contrib. No. 2132) melt through thermoelastic modeling and gravity analysis. First, we perform a local gravity study comparing topography from the Mars Orbiter Laser Altimeter [10] and the spherical harmonic gravity field of Mars (the JPL gravity model, [11]). Localized gravity and topography are obtained by applying a band-limited localization window to the global gravity and topography fields to obtain admittance and correlation spectra [12]. Sections of EVP with high gravity/topography correlation will be analyzed first. Porosity and compaction are considered in the interpretation of these results. A bestfit load density, elastic lithosphere and crustal thicknesses within EVP are obtained. This method follows the successful implementation of a local gravity study at the Medusae Fossae Formation on Mars, bounding density with topography and gravity [12].

Next, we calculate the temperature dependent elastic properties of each melt, after crystallization for a range of P and T conditions for direct comparison with geophysical datasets. These calculations are performed for each model composition generated in Task 1 using the open source mineral physics software BurnMan [13]. Third order Birch-Murnahan equations of state are applied to martian appropriate minerals (starting from [14]) to obtain the elastic properties at depth for each model P and T. Then each model will be compared with local gravity and heat flow observations (Fig. 3). Additionally, bulk geophysical parameters (mass, moment of inertia (MOI)) are used as a final discriminator. These parameters have been used in a similar methodology which scales the Earth to similar exoplanets and provides key information on interior structure [START_REF] Unterborn | pdf 50th Lunar and Planetary Science Conference[END_REF]. Therefore, EVP is a region of great geologic interest on Mars and this project will help add understanding of the spatiotemporal evolution of this region.

Fig. 1. The geographic location of EVP, along with the preliminary demarcation into distinct regions, by [1]. The lower pie charts show the areal distribution of different mapped geologic units. Fig. 2. Oxide compositions of the liquids in terms of degree of partial melting, using H 2 O wt% of 39 ppm (solid lines) and 185 ppm (dashed lines). Each curve represents a specific pressure. The 10 kbar is the curve furthest to the right and progress to the left by 2 kbar increments (up to 30 kbar). Melt % indicated as number (3, through 50). Triangles represent the average oxide compositions in three preliminary EVP regions. Arrows designate P=10 kbar, T e =100 km, T=273 K, 185 ppm H 2 O which corresponds to ~50 wt% SiO 2 and ~5 wt% FeO for a 3% melt.

Fig. 3 .

 3 Fig. 3. Initial Heat flow computed from the distribution of HPE and crustal thickness models. Areas of the polar regions where HPE concentration is affected by the presence of shallow sub-surface ice have been excluded from the calculation.


Cyril Grunspan
email: cyril.grunspan@devinci.fr

Ricardo P Érez-Marco
email: ricardo.perez.marco@gmail.com

ON PROFITABILITY OF NAKAMOTO DOUBLE SPEND

Keywords: 2010 Mathematics Subject Classification. 68M01, 60G40, 91A60m 33B20S. Bitcoin, blockchain, proof-of-work, selfish mining, martingale, glambler's ruin, random walk

Nakamoto double spend strategy, described in Bitcoin foundational article, leads to total ruin with positive probability and does not make sense from the profitability point of view. The simplest strategy that can be profitable incorporates a stopping threshold when success is unlikely. We solve and compute the exact profitability for this strategy. We compute the minimal amount of the double spend that is profitable. For a given amount of the transaction, we determine the minimal number of confirmations to be requested by the recipient such that this double spend strategy is non-profitable. We find that this number of confirmations is only 1 or 2 for average transactions and a small hashrate of the attacker. This is substantially lower than the original Nakamoto numbers that are widely used and are only based on the success probability instead of the profitability.

Introduction and background

Satoshi Nakamoto's Bitcoin foundational article [15] describes Bitcoin protocol. Section 11 contains an analysis of Bitcoin security and estimates the probability of success of a double spend attack. Unfortunately the strategy proposed has a positive probability of total ruin for the attacker, hence it cannot be profitable.

The attacker with a relative hashrate 0 < q < 1/2, attemps the double spend by sending a legitimate transaction and starts mining a secret fork with a conflicting transaction that invalidates the first one. The recipient requests z ≥ 0 confirmations of the transaction to consider it definitive. The goal of the attacker is to catch-up the official blockchain after z confirmations of the original transaction. He will only succeed with a probability that was computed exactly by the authors in [START_REF] Grunspan | Double spend races[END_REF], correcting the original approximate Nakamoto formula given in [15]. If he does not succeed, he will be stuck for ever catching-up the official blockchain and will go broke. Hence, for a sound strategy, it is necessary to introduce a "give-up" threshold. If he lags by A ≥ z behind the official blockchain the attacker gives-up. Now, this A-nakamoto strategy (the precise definition in section 2) defines an integrable repetition game and fits in the general mining profitability theory developped by the authors in [START_REF] Grunspan | On profitability of Selfish Mining[END_REF].

According to [START_REF] Grunspan | On profitability of Selfish Mining[END_REF], the profitability is compared using the Revenue Ratio

Γ = E[R] E[T]
where R and T are random variables, R is the revenue and T the duration of the attack. For example, for the honest strategy consisting of mining one block according to the protocol rules, we have E[R H ] = qb, where b is the coinbase reward, and E[T H ] = τ 0 , where τ 0 the interblock time 1 , thus the honest Revenue Ratio is

Γ H = qb τ 0
To compare the profitability of two full time mining strategies is equivalent to compare their Revenue Ratios (Proposition 3.6 from section 3 in [START_REF] Grunspan | On profitability of Selfish Mining[END_REF]). Therefore, the A-nakamoto strategy is profitable if and only if its Revenue Ratio Γ A is higher than the Revenue Ratio of the honest strategy, Γ A > Γ H .

We give an exact closed-form formula for the probability of success of the attack.

Theorem 1.1. Let 0 < q < 1/2, respectively p = 1 -q, be the relative hashrate of the attacker, respectively of honest miners. We denote λ = q/p < 1. Let z ≥ 1 be the number of confirmations requested by the recipient of a transaction. For A ≥ z, the probability P A (z) of success for the A-Nakamoto double spend attack is

P A (z) = I 4pq (z, 1/2) -λ A+1 1 -λ A+1 where I x (a, b) is the Regularized Incomplete Beta function I x (a, b) = Γ(a + b) Γ(a)Γ(b) x 0 t a-1 (1 -t) b-1 dt .
and Γ is Euler Gamma function.

This generalizes the main result from [START_REF] Grunspan | Double spend races[END_REF] that we obtain taking the limit A → +∞. In the formula for P A (z) we have that A + 1 instead of A because we assume that the attacker pre-mines one block as it is implicit in Satoshi's paper (see Section 2 below). A major Corollary of this result is obtained taking the asymptotics, 1 In the current Bitcoin network b = 12.5 B and τ 0 = 10 min.

Corollary 1.3 (G.-P.M., 2017). When z → +∞, we have

P ∞ (z) ∼ s z π(1 -s)z where s = 4pq < 1
This Corollary is important because it proves the profusely cited and "well-known" result (but nowhere correctly proved before) that this probability decays exponentially to 0 with the number of confirmations z, hence the probability of a reorganisation of Bitcoin blockchain decays exponential with the depth. This is a fundamental result for Bitcoin security.

Observe that P A (z) decreases with A, and P A (z) < lim A→+∞ P A (z) = P ∞ (z) as expected. We also have when z → +∞

P A (z) ∼ s z π(1 -s)z
with an asymptotic that is independent of A ≥ z. In the next Theorem we make also use of the Beta function

B(a, b) = 1 0 t a-1 (1 -t) b-1 dt = Γ(a)Γ(b) Γ(a + b) .
The main result in this article is the computation of the Revenue Ratio Γ A . We compute exact formulas for E[R A ] and E[T A ].

Theorem 1.4. With the previous notations, the expected revenue and the expected duration of the A-Nakamoto double spend strategy is

E[R A ] b = qz 2p I 4pq (z, 1/2) - (A + 1)λ A+1 p(1 -λ) 3 [A + 1] 2 I (p-q) 2 (1/2, z) + 2 -λ + λ A+2 (1 -λ) 2 [A + 1] p z-1 q z B(z, z) + P A (z) v b + 1 E[T A ] τ 0 = z 2p I 4pq (z, 1/2) + A + 1 p(1 -λ) 2 [A + 1] I (p-q) 2 (1/2, z) - p z-1 q z p(1 -λ)B(z, z) + 1 q with the notation [n] = 1-λ n 1-λ for n ∈ N.
As in the original article [START_REF] Grunspan | On profitability of Selfish Mining[END_REF], and subsequent application to other block withholding strategies [START_REF] Grunspan | On profitability of Selfish Mining[END_REF], [START_REF] Grunspan | On profitability of Stubborn Mining[END_REF], [START_REF] Grunspan | On profitability of Trailing Mining[END_REF], the main tool in the proof of this Theorem are martingale techniques and the application of Doob's Stopping Time Theorem. Previous techniques using Markov chains do not allow the computation of the expected duration of the attack, which is critical for the profitability analysis. The profitability analysis is based on attack cycles, modeled by games with repetition, and only holds for integrable games, i.e. those that have finite expectation duration of cycles E[T] < +∞ and allow the application of Doob's Theorem.

Observe that, all other parameters being fixed, we have the asymptotics when A → +∞,

E[T A ] τ 0 ∼ I (p-q) 2 (1/2, z) p -q A and lim A→+∞ E[R A ] b = E[R ∞ ] b = qz 2p I 4pq (z, 1/2) + 2 -λ 1 -λ p z-1 q z B(z, z) + P ∞ (z) v b + 1
In particular we have, lim

A→∞ E[T A ] = E[T ∞ ] = +∞ and lim A→∞ E[R A ] = E[R ∞ ] < +∞
Hence, in the non-stopping Nakamoto double spend strategy where A = +∞, we have Γ ∞ = 0 and any integrable strategy beats Nakamoto non-stopping strategy. Moreover, since E[R ∞ ] < +∞ and E[T ∞ ] = +∞ Nakamoto's strategy leads to almost sure ruin when considering mining costs.

Another interesting asymptotic is when q → 0, z ≥ 1,

I 4pq (z, 1/2) ∼ 2 2z -1 z q z And if we assume A ≥ 2, A ≥ z ≥ 1, E[R A ] b ∼ 2 2z -1 z v b + 1 + 2 B(z, z) q z and E[T A ] τ 0 ∼ 1 q Therefore, we have when q → 0, Γ A ∼ b τ 0 2 2z -1 z v b + 1 + 2 B(z, z) q z+1
It is remarkable that this asymptotic is uniform on A. From this we prove the following practical Corollary. The A-Nakamoto double spend is profitable when Γ A ≥ Γ H and plugging the asymptotics in this profitability inequality we get, Corollary 1.5. When q → 0 the minimal amount to make profitable a Nakamoto double spend with z ≥ 1 confirmations is asymptotically

v ≥ q -z 2 2z-1 z b = v 0 .
For example, with q = 0.01 and only z = 1 we need to double spend more than v 0 /b = 50 coinbases. For the optimal strategy, the minimal spend for these parameters is v 0 /b = 49.2513 coinbases as we will see in another article. With the actual reward of b = 12.5 B and the actual prize of $8.600, this represents more than $5.375.000. With z = 2 this will be more than 1.666 coinbases or more than more than 179 million dollar. These figures are far from the general belief. Nevertheless, we should note that there are sharper strategies and, if ran continuously, we can merge double spend attacks with other blockwithholding strategies that exploit the difficulty adjustment formula and this will increase the profitability.

We observe that since Γ A → 0 when A → +∞, there is a value A 0 = A 0 (q, v, z) ≥ z that maximizes the revenue ratio:

Γ A 0 = max A≥z Γ A Also, lim z→+∞ Γ A 0 < Γ H ,
so given the amount of the purchase (in coinbase b units), we can compute the number z of confirmations that make the A-Nakamoto double spend attack non-profitable. This is an important data for the vendor or the recipient of the transaction that can set the number of confirmations z accordingly to our formulas.

We keep the analysis for this simplest strategy as simple as possible. We assume no difficulty adjustment during the attack, and instant block propagation in the network. Other more sophysticated strategies, where A ≤ z, with important pre-mining, or the optimal strategy, or other hybrid strategies wich combine selfish mining and double spend will be analyzed elsewhere.

The techniques at the core of the results presented in this article are a combination the techniques developed in [START_REF] Grunspan | Double spend races[END_REF] and [START_REF] Grunspan | On profitability of Selfish Mining[END_REF].

Nakamoto double spend strategy.

Let z be the number of confirmations required by the merchant and v the value of a double spend. We fix a maximal lag A ≥ z relative to the public blockchain after which the attacker gives-up. The relative hashrate of the attacker (resp. honest miners) is q (resp. p). Apparently Nakamoto in [15] wants to prevent pre-mining by the attacker but the generation of fresh keys as he proposes does not prevent it. Also his formulas are only correct pre-mining one block, for example when he states that the probability is 1 for z = 0 confirmations. The reader can consult [START_REF] Grunspan | Commentary on Section 11 of Bitcoin paper[END_REF] for a discussion on Section 11 of [15]. Pre-mining one block is often named as a "Finney attack" because of the clarification that H. Finney provided in 2011 (see [START_REF] Finney | Best practice for fast transaction acceptance -how high is the risk?[END_REF] bitcointalk post). We can generalize the preparation of the attack by pre-mining an arbitrary number k of blocks before launching the attack. The precise algorithm employed by the attacker in this (A, k)-Nakamoto double spend strategy is the following:

(A, k)-Nakamoto double spend strategy 0. Start of the attack cycle (goto 1). 1. The attacker mines honestly on top of the official blockchain k blocks with a transaction that returns the payment funds to an address he controls (goto 2). 2. If the honest miners take advantage before he pre-mines k blocks, then he restarts mining on top of the new last block of the official blockchain (goto 1). 3. If he succeeds in pre-mining k blocks lading the honest miners, he keeps his fork secret, sends the purchasing transaction to the vendor, and keeps up mining on his secret fork. (goto 4). 4. If the lag with the official blockchain gets larger than A then the attacker gives-up and the double spend fails (goto 6). 5. If the secret fork of the attacker gets longer than the official blockchain that has added z confirmations to the vendor transaction, then the attacker releases his fork and the double spend is successful (goto 6). 6. End of the attack cycle (goto 0).

We assume that at z confirmations the attacker receives the goods from the vendor. Hence, when the attack is successful, the revenue is v plus all the block rewards. When the attack fails, the revenue is 0 (we assume that he can recover the original bitcoins from the purchase). A fundamental observation for the application of the profitability model is that the cost per unit of time is the same as the cost of mining honestly. Each time the attacker goes to step 0, he can start a new attack cycle that ends when he reaches step 6.

We observe that the strategy has three phases:

• The first phase is a pre-mine phase (steps 1 -2).

• The attacker sends a conflicting transaction to a merchant and mines on his secret fork until the honest miners have validated z blocks. • The attacker keeps on mining on his secret fork until his lag is A or his fork gets longer than the official blockchain.

During the second phase, the attacker's lag is always less than A since we consider in this article that we choose A ≥ z. So, the attack cycle cannot terminate before the end of the second phase. Notice also that there are more general Nakamoto strategies by changing the algorithm in the pre-mining phase, and the last phase. The simple (A, 1)-Nakamoto strategy seems to be the closest profitable strategy to the one described by Nakamoto's Bitcoin paper and is the one we study in this article. Furthermore, as we will show, there are simple closed forms formulas for this strategy.

The study of the general (A, k)-Nakamoto strategy is postponed to another article as well as the general optimal strategy attack.

Probability of Success

We use the same notations and mining model from [START_REF] Grunspan | Double spend races[END_REF]. The number of blocks mined by the attacker is a Poisson process (N (t)) t≥0 and S z is the random variable of the time taken to the honest miners to mine z blocks. The random variable N (S z ) is a (z, p) negative binomial random variable [START_REF] Grunspan | Double spend races[END_REF], for j ≥ 0, P[N (S z ) = j] = p z q j z + j -1 j

Recall the basic Euler identity for the Beta function which justifies the Beta distribution,

B(a, b) = 1 0 t a-1 (1 -t) b-1 dt = Γ(a)Γ(b) Γ(a + b)
We need a couple more of combinatorial identities stated in the next Lemma.

Lemma 3.1. For integers m ≥ 1 and z ≥ 0, and for p, q > 0 with q = 1 -p, we have,

m-1 j=0 p z q j z + j -1 j = I p (z, m) (1) m-1 j=0 p z q j z + j -1 j • j = qz p I p (z, m) - p z-1 q m B(z, m) (2)
Proof. The first identity is classical (see [START_REF] Abramovitch | Hanbook of Mathematical Functions[END_REF], (6.6.3) and (26.5.26), or [START_REF] Dlmf | Digital Library of Mathematical Functions[END_REF], (8.17.24), or [START_REF] Grunspan | Double spend races[END_REF] section 6). The second equation follows from the first one differentiating with respect to p,

∂I p (z, m) ∂p = z p I p (z, m) - 1 q m-1 j=0 p z q j z + j -1 j • j and observing that ∂I p (z, m) ∂p = p z-1 q m-1 B(z, m) . Proposition 3.2.
If X is a negative binomial random variable with parameters (p, z), then we compute,

z-1 j=0 P[X = j] = I p (z, z) (3) z-1 j=0 P[X = j] (q/p) z-j = I q (z, z) (4) z-1 j=0 P[X = j] • j = qz p I p (z, z) - p z-1 q z B(z, z) (5) z-1 j=0 P[X = j] j (q/p) z-j = pz q I q (z, z) - q z-1 p z B(z, z) (6)
Proof. Identities (3) and ( 5) follow from Lemma 3.1. The two other ones follow from these two using, for j ≥ 0, p z q j z + j -1 j (q/p) z-j = q z p j z + j -1 j which means that P[X = j] (q/p) z-j = P[Y = j] for Y a (q, z)-negative binomial random variable.

Note also that ( 1) and ( 2) can be restated as

P[X < m] = I p (z, m) E[X|X < m] = qz p - p z-1 q m B p (z, m)
where B x (a, b) is the incomplete Beta function. Now we prove Theorem 1.1.

Proof of Theorem 1.1. Recall that the attacker has premined one block. So, if he has added z blocks more to his secret fork during the second phase of the attack, then at the end of this phase his secret fork is longer than the official blockchain. In this case, he publishes his fork and the attack cycle takes end successfully. Otherwise, the attacker has mined j blocks during the second phase with j < z and he starts a third phase with a lag of z -j -1. The evolution of this lag is a biased random walk (Z n ) with a probability p (resp. q) to move to the right (resp. left). The cycle ends when there is n ∈ N such that Z n = A (the attack cycle fails) or Z n = -1 (the attack cycle is successful). Hence, according to the gambler's ruin problem formula (see [START_REF] Feller | An introduction to probability theory and its applications[END_REF]), and using formulas ( 3) and ( 4) from Corollary 3.2, we have

P A (z) = P[N (S z ) z] + z-1 j=0 P[N (S z ) = j] λ z-j -λ A+1 1 -λ A+1 = 1 - z-1 j=0 P[N (S z ) = j] + z-1 j=0 P[N (S z ) = j] λ z-j -λ A+1 1 -λ A+1 = 1 -1 + λ A+1 1 -λ A+1 z-1 j=0 P[N (S z ) = j] + 1 1 -λ A+1 z-1 j=0 P[N (S z ) = j] λ z-j = 1 - I p (z, z) 1 -λ A+1 + I q (z, z) 1 -λ A+1
I q (z, z) = 1 2 I 4pq (z, 1/2)
See for instance [START_REF] Dlmf | Digital Library of Mathematical Functions[END_REF] (8.17.4) and (8.17.6). Proposition 4.1. We assume that the attacker has already pre-mined one block. Then, the mean duration time for the end of an attack cycle is

E[T ] τ 0 = A + 1 p -q • 1 1 -λ A+1 - p z-1 q z (p -q)B(z, z) + z p - 2(A + 1) (p -q)(1 -λ A+1 ) I q (z, z)
Proof. We follow the proof of Theorem 1.1. By definition of the strategy, the attack cycle cannot end before the honest miners have mined z blocks since we consider in this article that A ≥ z. So, T ≥ S z (the initial date t = 0 is the start of the second phase). Moreover, T = S z if the attacker has mined z blocks or more during the second phase of the attack. Otherwise, the attacker tries to build a fork whose length is greater than the official blockchain, starting with an initial lag of z -N (S z ) -1 and gives up if this lag becomes greater or equal than A (third phase of the attack). So, we have:

T = S z + 1 N (Sz)<z • TA+1-(z-N (Sz)),z-N (Sz) with TX,Y = Inf {t ∈ R + ; Ñ(t) = Ñ (t) + X ∨ Ñ (t) = Ñ(t) + Y } for X, Y ∈ R, Ñ(t) = N(t + S z ) -N(S z ) and Ñ (t) = N (t + S z ) -N (S z )
. By the Markov property, Ñ and Ñ are two Poisson processes with parameters p τ 0 and q τ 0 independent of S z and TX,Y is also independent of S z . Moreover, we have:

E[ TX,Y ] τ 0 = X + Y p -q 1 -λ Y 1 -λ X+Y - Y X + Y
This computation is classical and can be found in Appendix A of [START_REF] Grunspan | On profitability of Trailing Mining[END_REF] for example (see Theorem A.1). So, we have using Proposition 3.2 together with [START_REF] Grunspan | Double spend races[END_REF] and ( 8),

E[T ] τ 0 = E[S z ] + z-1 j=0 P[N (S z ) = j] • E[ TA+1-(z-j),z-j ] = z p + A + 1 p -q 1 1 -λ A+1 - z A + 1 z-1 j=0 P[N (S z ) = j] - A + 1 p -q 1 1 -λ A+1 z-1 j=0 P[N (S z ) = j] λ z-j + 1 p -q z-1 j=0 P[N (S z ) = j] j = z p + A + 1 p -q 1 1 -λ A+1 - z A + 1 I p (z, z) - A + 1 p -q • 1 1 -λ A+1 I q (z, z) + 1 p -q qz p I p (z, z) - p z-1 q z B(z, z) = A + 1 p -q 1 1 -λ A+1 - p z-1 q z (p -q)B(z, z) + z p - 2(A + 1) (p -q)(1 -λ A+1 ) I q (z, z) 4.2.
Expected revenue by cycle.

Proposition 4.2. The expected revenue per cycle is

E[R A ] b = qz 2p I 4pq (z, 1/2)- (A + 1)λ A+1 p(1 -λ) 3 [A + 1] 2 I (p-q) 2 (1/2, z)+ 2 -λ + λ A+2 (1 -λ) 2 [A + 1] p z-1 q z B(z, z) +P A (z)(v+1) with [A + 1] = 1-λ A+1 1-λ
Proof. We will use the following notations. If Z is a biased simple random walk starting at Z 0 = k with a probability p (resp. q) to go right (resp. left), we denote by ν k i with i ∈ Z the hitting time of i and ν k i,j = ν k i ∧ ν k j with j ∈ Z. We also denote by L(n) the number of steps to the left between 0 and n, that is,

L(n) = n i=1 1 Z i =Z i-1 -1 .
After the premining phase, the attacker waits for the honest miners to mine z blocks. Suppose that he has mined j blocks during this second phase. If j ≥ z, then the attack cycle takes end and the attacker has won the double spend amount v and all the j +1 blocks he has mined. Otherwise, there is a third phase. The attack cycle still goes on and doesn't end before the attacker has built a fork whose length is greater than the official blockchain or his lag became greater or equal than A. We denote by Z n the lag of the attacker plus one at the time when n blocks have been discovered by the attacker or the honest miners since the start of the third phase. Then, Z 0 = z -j and (Z n ) n∈N is a biased simple random walk as above. The attack cycle ends when there is n such that Z n = 0 or Z n = A + 1. Therefore, we have:

E[R A ] b = ∞ j=z P[N (S z ) = j](j + 1 + v) + z-1 j=0 P[N (S z ) = j] • P[ν z-j 0,A+1 = ν z-j 0 ] • (j + 1 + v + E[L(ν z-j 0,A+1 )|ν z-j 0,A+1 = ν z-j 0 ]) = E[[N ((S z )] - z-1 j=0 P[N (S z ) = j]j + P A (z)(v + 1) + z-1 j=0 P[N (S z ) = j]j • P[ν z-j 0,A+1 = ν z-j 0 ] + z-1 j=0 P[N (S z ) = j] • P[ν z-j 0,A+1 = ν z-j 0 ] • E[L(ν z-j 0,A+1 )|ν z-j 0,A+1 = ν z-j 0 ]
Now we use again the classical relation for the gambler's ruin formula

P[ν m 0,M = ν m 0 ] = λ m -λ M
1-λ M (see for instance [START_REF] Feller | An introduction to probability theory and its applications[END_REF]) and

E[L(ν m 0,M )|ν m 0,M = ν m 0 ]) = m 2 + mλ m -(2M -m) λ M + (2M -m) λ M +m -mλ 2M 2p(1 -λ)(λ m -λ M )(1 -λ M )
from [START_REF] Grunspan | On profitability of Trailing Mining[END_REF] (See Corollary 2.5) which is a consequence of Stern's formula [START_REF] Stern | Conditional expectation of the duration in the classical ruin problem[END_REF]. So, using Proposition 3.2 we compute,

E[R A ] b = qz p + P A (z)(v + 1) - (2(A + 1) -z)λ A+1 + zλ 2(A+1) 2p(1 -λ)(1 -λ A+1 ) 2 + λ A+1 1 -λ A+1 • z 2 z-1 j=0 P[N (S z ) = j] + z + (2(A + 1) -z)λ A+1 2p(1 -λ)(1 -λ A+1 ) 2 + 1 1 -λ A+1 • z 2 z-1 j=0 P[N (S z ) = j]λ z-j - 1 1 -λ A+1 + λ A+1 -λ 2(A+1) 2p(1 -λ)(1 -λ A+1 ) 2 - λ A+1 1 -λ A+1 • 1 2 z-1 j=0 P[N (S z ) = j]j + 1 1 -λ A+1 - 1 -λ A+1 2p(1 -λ)(1 -λ A+1 ) 2 - 1 1 -λ A+1 • 1 2 z-1 j=0 P[N (S z ) = j]jλ z-j

Related work

In [START_REF] Rosenfeld | Analysis of hashrate-based double spending[END_REF] the author proposes the correct formula for the computation of the probability of success of the Nakamoto double spend attack from [15], which is proved and computed in closed-form using special functions in [START_REF] Grunspan | Double spend races[END_REF]. As Corollary of this closedform formula, it is proved in [START_REF] Grunspan | Double spend races[END_REF] that the probability decays exponentially to 0 with the number of confirmations z → +∞. In [START_REF] Georgiadis | A combinatorial-probabilistic analysis of bitcoin attacks[END_REF] asymptotics at higher orders are computed by more combinatorical methods (classical also from the integral expression in [START_REF] Grunspan | Double spend races[END_REF]). Also, in this article, the authors have some discussion of the initial assumptions of the Nakamoto double spend strategy. It is true that Section 11 of [15] contains several incoherences (we have written a detailed discussion on Section 11 of [15] in [START_REF] Grunspan | Commentary on Section 11 of Bitcoin paper[END_REF]). All authors consider z to be the number of confirmations, which assumes a 1 block pre-mining (see [START_REF] Rosenfeld | Analysis of hashrate-based double spending[END_REF], [START_REF] Hinz | A Note on Optimal Double Spending Attacks[END_REF] or [START_REF] Grunspan | Double spend races[END_REF]). In [15], the authors look for the best security protocol that a merchant should adopt to counter a double spend attack. They consider attacks long enough to have an impact on the difficulty adjustment parameter. They also propose to merge double spend attacks with selfish mining or other blocks witholding strategies (it is proven in [START_REF] Grunspan | On profitability of Selfish Mining[END_REF] that these attacks are profitable on the long term after an adjustment of the difficulty parameter). All these articles only consider the double spend attack from the point of view of probabilities. The duration time of the attack is considered in [START_REF] Grunspan | Commentary on Section 11 of Bitcoin paper[END_REF]. The author computes the conditional probability density function of the time before an attacker catches up the honest miner knowing that the honest miners have already mined z blocks. In [START_REF] Hinz | A Note on Optimal Double Spending Attacks[END_REF], the authors introduce a profitability setup and look for the optimal number of blocks that an attacker should pre-mine before launching a double spend attack. We will answer this question in a forthcoming article. In [START_REF] Bissias | An Analysis of Attacks on Blockchain Consensus[END_REF], the authors study the profitability of a double-spend attack with a cut-off time strategy, S z+1 ∧ S z+1 (in our notation). In [START_REF] Jang | Profitable double-spending attacks[END_REF] the authors consider a fixed cut-off time (in case of failure, the attack ends at a fixed time).

Corollary 1 . 2

 12 (G.-P.M., 2017). The probability of success of the ∞-Nakamoto attack is P ∞ (z) = I 4pq (z, 1/2) .

  Finally we use the two classical relations for the incomplete regularized beta function: (7) I x (a, b) + I 1-x (b, a) = 1 for x ∈]0, 1[, a, b ∈ R * + and (8)

Figure 1 . 4 . 4 . 1 .

 1441 Figure 1. Graph of q → P A (2), A = 3, 5, 10 and asymptotics A → +∞

Figure 3 .

 3 Figure 3. Graph of q → Γ A , z = 2, v = b for A = 3, 5, 10.

and

We note that

So, using again ( 7) and ( 8), we get

In Figures 2 and3 we plot the graphs of q → E[R A ] and q → Γ A In figure 3 Γ H is the dashed line. We have lim q→0.5 Γ 10 (q) = 139 286 < 1 2 and Γ 10 (q) < q for any q. So, (10, 1)-Nakamoto Double Spend strategy with z = 2 and v = b is always less profitable than honest mining. What was lacking in the literature is a rigorous model of profitability to make exact comparisation of profitabilities of different mining strategies, in particular with the honest strategy, as done in [START_REF] Grunspan | On profitability of Selfish Mining[END_REF]. This is what we provide in the present article.


S Legand

I Danard

D Durand

D Lebeau

S Esnouf

Superplasticizers degradation in a deep geological

Keywords: Superplasticizers, radiolysis, hydrolysis, degradation, analytical investigation

published or not. The documents may come   L'archive ouverte pluridisciplinaire

Introduction

The conditioning by solidification in a cementitious matrix of radioactive waste coming from French nuclear industries is a widely used solution. For safety reasons it is important to evaluate and control the production of hazard flammable gas such as dihydrogen. Yet water in cementitious matrices exposed to ionizing radiation emitted by waste (radiolysis phenomenon) can contribute significantly to dihydrogen formation. The main objective of the Matrice project (Materials resistant to irradiation based on cement) with Leon Grosse, Vicat, CEA and Andra as partners is to optimize the formulations of cementitious materials to limit dihydrogen emissions to an acceptable level while optimizing the conditioning of highly radioactive waste. Most of investigated approaches require the addition of superplasticizers (SPs), which are water-reducing agents. Thus, it is important to study degradation of these compounds in the nuclear waste context. [START_REF] Lezane | Incidence des adjuvants pour béton sur le confinement des radioéléments et la tenue sous rayonnement des matrices ciment[END_REF] Radiolysis and/or alkaline conditions can potentially induce formation of small organic molecules that can form stable complexes with radionuclides or affect radionuclide mobility. [START_REF] Fromentin | On the radiooxidation, at high doses, of an industrial polyesterurethane and its pure resin[END_REF] The objective of this study is to characterize the molecules degradation of two types of SPs: a polyaromatic sulphonate (radioresistant but with poor plasticizing properties) and a polyether based superplasticizer (less radioresistant but with excellent plasticizing properties). [START_REF] Aymes-Chodur | Radiation effects on a linear model compound for polyethers Polymer[END_REF]

Hydrolysis and radiolysis degradation of superplasticizers

Solutions at 1% in weight of SPs in concrete simulated solutions porewater (0.114 mol.L -1 KOH, 0.18 mol.L -1 NaOH, 2.3 mmol.L -1 Ca(OH)2, pH 13.4-13.5) were deaerated and sealed under inert atmosphere (nitrogen). Hydrolysis degradation was performed under inert atmosphere at 60°C. The solution was characterized after one month. The impact of radiolysis was evaluated after irradiation of the solutions under gamma rays irradiation (150-300 kGy; 1000 Gy/h; anaerobic conditions). After irradiation, gas analysis were performed. After degradation, the solutions were analyzed by infrared and ultravioletvisible spectroscopies to highlight new chemicals functions, size exclusion chromatography to determine the evolution of the molecular weight, ionic chromatography to quantify small carboxylic acids and the gas chromatographymass spectrometry coupling to identify the volatile organic molecules.

Conclusion

For both SPs, almost no impact of hydrolysis was observed. After irradiation, degradation and crosslinking are clearly observed. An evolution of the average molar mass of the polymer and small organic molecules are observed in solution. The impact of the identified SPs degradation molecules on radionuclide complexation will be discussed.

Acknowledgment

The authors are grateful to M. Cornaton and D. Chartier from CEA for their technical contributions.