Heitor Nigro Lopes
email: lopes@fem.unicamp.br

Daniel Candeloro Cunha

Renato Pavanello

Jarir Mahfoud

Numerical and experimental investigation on topology optimization of an elongated dynamic system

Minimizing vibration levels of dynamic components at their operating frequency range has been a widely studied topic in engineering. However, the design of structures that satisfy geometric constraints and technical performances is an ongoing challenge. In this work, a topology optimization procedure based on the Bi-directional Evolutionary Structural Optimization (BESO) algorithm is performed to maximize the natural frequency separation interval of an elongated structure. The issues of disconnected and trivial solutions are solved using a connectivity constraint. It is imposed by a proposed procedure based on the heat flux solution of an auxiliary system. An assessment of the feasibility of the structure is done by verifying its accordance with manufacturing and design constraints. The optimized structure was manufactured and validated experimentally. The implemented process produces topologies that maximize the natural frequency separation and reduce the mass of the structure. The obtained results demonstrate the effectiveness of the proposed procedure at satisfying geometric design constraints and technical performances.

Introduction

In engineering problems, excessive vibration is usually associated with undesirable consequences, such as failure. Usually, for rotating systems, operating frequencies are chosen far from resonance speeds. In some applications, it is not easy to maintain a constant speed, especially when undergoing variable loads. For this reason, it is advantageous to ensure a large enough separation margin between the operating frequency and the nearby resonance frequencies. Therefore, controlling the natural frequencies of a structure is the objective of many optimization applications [START_REF] Zargham | Topology optimization: A review for structural designs under vibration problems[END_REF].

The topology optimization method is a well-established method for structural optimization. First introduced by Bensøe and Kikuchi [START_REF] Bendsøe | Generating optimal topologies in structural design using a homogenization method[END_REF] as a shape optimization algorithm based on the homogenization method, this procedure promptly started a new branch in structural optimization. The need for the homogenization method was removed after the introduction of continuous relaxation functions and penalization when defining the properties of the structure. This yielded the well-established Solid Isotropic Material with Penalization (SIMP) method [START_REF] Bendsøe | Optimal shape design as a material distribution problem[END_REF][START_REF] Zhou | The COC algorithm, part II: topological, geometrical and generalized shape optimization[END_REF][START_REF] Rozvany | Generalized shape optimization without homogenization[END_REF]. The topology optimization method was then extended to a discrete form as the Evolutionary Structural Optimization (ESO) [START_REF] Xie | A simple evolutionary procedure for structural optimization[END_REF]. Its main advantage is the absence of elements with intermediary properties, which carry no physical meaning. Then, the Bi-directional Evolutionary Structural Optimization (BESO) method was proposed as an alternative to allow both the addition and removal of elements [START_REF] Querin | Evolutionary structural optimisation (ESO) using a bidirectional algorithm[END_REF].

1

These algorithms require additional procedures to avoid usual problems related to dynamic system optimization. A numerical filter is needed to avoid mesh-dependent topologies and checkerboard patterns [START_REF] Díaz | Checkerboard patterns in layout optimization[END_REF][START_REF] Huang | Convergent and mesh-independent solutions for the bi-directional evolutionary structural optimization method[END_REF]. Additionally, as demonstrated by Pedersen [START_REF] Pedersen | Maximization of eigenvalues using topology optimization[END_REF], the SIMP interpolation scheme results in non-physical topologies due to the dynamic behavior of void elements. A new interpolation scheme was then proposed to avoid such problem, which was subsequently adapted for the BESO [START_REF] Huang | Evolutionary topological optimization of vibrating continuum structures for natural frequencies[END_REF]. With these adjustments, topology optimization algorithms proved to be robust enough for several problems. Among others, it has been implemented for fluid-structure interaction [START_REF] Picelli | Evolutionary topology optimization for natural frequency maximization problems considering acoustic-structure interaction[END_REF][START_REF] Vicente | Topology optimization of frequency responses of fluid-structure interaction systems[END_REF], multiscale analyses [START_REF] Chen | Microstructural topology optimization for minimizing the sound pressure level of structural-acoustic systems with multi-scale bounded hybrid uncertain parameters[END_REF][START_REF] Zhang | Multiscale topology optimization for minimizing frequency responses of cellular composites with connectable graded microstructures[END_REF], design of piezoelectric harvesters [START_REF] De Almeida | Topology optimization of bimorph piezoelectric energy harvesters considering variable electrode location[END_REF] and acoustic insulators [START_REF] Chen | Creating acoustic topological insulators through topology optimization[END_REF].

When optimizing dynamic systems, one can desire either to increase or to reduce vibration. When working with energy harvesting, clustering the natural frequencies of a system can be beneficial, because it increases the performance of the harvester [START_REF] Lin | Design of piezoelectric energy harvesting devices subjected to broadband random vibrations by applying topology optimization[END_REF]. When dealing with dangerous resonances, however, the separation of natural frequencies is desired. The maximization of this separation is also beneficial on the design of controllable structures [START_REF] Sultan | Designing structures for dynamical properties via natural frequencies separation[END_REF].

In the context of topology optimization for reducing vibration of dynamic systems, there are two main alternatives: either the natural frequencies or the frequency response is optimized. Ma et al. [START_REF] Ma | Structural topology and shape optimization for a frequency response problem[END_REF][START_REF] Ma | Structural design for obtaining desired eigenfrequencies by using the topology and shape optimization method[END_REF] performed a topology optimization process based on the homogenization method to solve both types of problems. Xie and Steven [START_REF] Xie | A simple approach to structural frequency optimization[END_REF] implemented a simple natural frequency optimization algorithm using the ESO, which was then extended to the BESO [START_REF] Huang | Evolutionary topological optimization of vibrating continuum structures for natural frequencies[END_REF]. Jensen and Pedersen [START_REF] Jensen | On maximal eigenfrequency separation in two-material structures: The 1D and 2D scalar cases[END_REF] maximized the separation interval between adjacent natural frequencies for 1D and 2D scalar cases. Du and Olhoff [START_REF] Du | Topological design of freely vibrating continuum structures for maximum values of simple and multiple eigenfrequencies and frequency gaps[END_REF] proposed a robust algorithm for several different cases of natural frequency optimization. Two common problems in these algorithms are mode shifting and local modes. Li et al. [START_REF] Li | Eliminate localized eigenmodes in level set based topology optimization for the maximization of the first eigenfrequency of vibration[END_REF] performed the optimization of dynamic responses using the Level-set method to eliminate local modes. Li et al. [START_REF] Li | Topology optimization of vibrating structures with frequency band constraints[END_REF] and Lopes et al. [START_REF] Lopes | High natural frequency gap topology optimization of bi-material elastic structures and band gap analysis[END_REF] proposed methods for the optimization of natural frequency separation interval that solve both problems.

For dynamic response optimization, damping could be considered using the proportional damping model or other models with diagonal modal damping matrix [START_REF] Adhikari | Damping modelling using generalized proportional damping[END_REF]. These models have been used in the context of topology optimization [START_REF] Liu | Topology optimization of viscoelastic materials on damping and frequency of macrostructures[END_REF], but it is important to emphasize that, even in non-diagonal damping systems, an approximated proportional one can be built [START_REF] Sultan | Proportional damping approximation using the energy gain and simultaneous perturbation stochastic approximation[END_REF].

In recent years, additive manufacturing has gained popularity. Despite the many challenges for successful integration of topology optimization procedures and additive manufacturing, they are powerful tools for designing and prototyping. Ma et al. [START_REF] Ma | Experimental validation and prototyping of optimum designs obtained from topology optimization[END_REF] utilized a topology optimization procedure to maximize natural frequencies of a structure, which was subsequently manufactured and tested experimentally. To impose certain restrictions on the optimal design, a multidomain topology optimization technique was employed, calibrated by the user.

For structures with high geometric aspect ratio, such as bridges, aircraft and missiles, topology optimization procedures for natural frequencies often fail. This is due either to local optima occurring for disconnected topologies or to the presence of a trivial solution, such as reducing the length of the structure. One way to avoid this problem is to include a non-structural mass on set locations, guaranteeing their connectivity [START_REF] Zhao | Evolutionary natural frequency optimization of two-dimensional structures with additional non-structural lumped masses[END_REF]. Another alternative is the addition of a compliance term in the objective function [START_REF] Zuo | An improved bi-directional evolutionary topology optimization method for frequencies[END_REF]. Munk et al. [START_REF] Munk | A bi-directional evolutionary structural optimisation algorithm with an added connectivity constraint[END_REF] proposed an elegant alternative, via the implementation of a connectivity filter. However, while this solution solved the connectivity problem, it lead to mesh-dependent topologies. Liu et al. [START_REF] Liu | An identification method for enclosed voids restriction in manufacturability design for additive manufacturing structures[END_REF] proposed the Virtual Temperature Method (VTM) to avoid enclosed void regions, which may lead to manufacturing difficulties. This method was recently extended to the Nonlinear Virtual Temperature Method (N-VTM) [START_REF] Luo | Additive manufacturing oriented topology optimization of structures with self-supported enclosed voids[END_REF], which was employed to satisfy overhang angle constraints.

This work performs the topology optimization design of a structure through the following the steps: optimization, simulation and experimental validation. The main challenges of each step are assessed. First, the structure is optimized based on a frequency separation criterion. A novel connectivity approach that uses energy balance properties, similarly to the VTM, is proposed to satisfy geometric design constraints. Then, a close examination on the optimization hypotheses is done by simulating the obtained solution in a three-dimensional analysis. Finally, an experimental test is performed to validate the proposed procedures. This structure is produced via additive manufacturing and tested using a sweep harmonic excitation and measuring the displacements with a laser Doppler vibrometer. Results show correspondence between both the experimental and simulated results. The developed procedures enable a satisfactory increase of the initial frequency separation margin.

Procedure for structure design

In this section, the optimization problem is presented and the connectivity constraint is formulated. The algorithm for the topology optimization procedure using the BESO method is also presented.

Frequency separation interval maximization

The maximization of natural frequency separation interval of elastic structures is considered in this section. As the present problem concerns the optimization of natural frequencies, the system is modeled as undamped. This hypothesis is not too restrictive, since the damped natural frequencies and resonance frequencies change little for systems with small structural damping.

The undamped linear dynamic system can be represented by the following eigenproblem:

-𝑴𝜔 2 𝑗 𝜙 𝑗 + 𝑲𝜙 𝑗 = 0 (1)
where 𝜔 𝑗 and 𝜙 𝑗 are the 𝑗th eigenvalue and eigenvector of the system. The matrices 𝑴 and 𝑲 are the global mass and stiffness matrices, obtained via the Finite Element Method. The system is assumed to be linear elastic isotropic, under the two-dimensional plane stress hypothesis, that is, the stress tensor components outside the studied plane are negligible.

In this work, the optimization goal is obtaining a structure that maximizes the natural frequency separation interval around a given operating frequency. This is done by finding the optimal material distribution along the domain. The corresponding optimization problem [START_REF] Ma | Structural design for obtaining desired eigenfrequencies by using the topology and shape optimization method[END_REF] is stated as:

max 𝑓 (𝑥 𝑖 ) = 𝜔 2 0 + ⎡ ⎢ ⎢ ⎢ ⎣ 𝑛 m ∑ 𝑗=1 1 ( 𝜔 2 𝑗 -𝜔 2 0 ) 2 ⎤ ⎥ ⎥ ⎥ ⎦ -1∕2 s.t. 𝑉 * - 𝑁 ∑ 𝑖=1 𝑉 𝑖 𝑥 𝑖 = 0 𝑥 𝑖 = 1 𝑜𝑟 𝑥 min (2)
where 𝜔 0 is the operating frequency around which the frequency separation interval is maximized. The parameter 𝑛 𝑚 is the number of considered eigenvalues. Its choice process consists in finding a value large enough so that the highest eigenvalues influence little on the optimization process. However, the computational cost of the optimization procedure increases proportionally to 𝑛 𝑚 , and, therefore, it must be properly adjusted by the user. In this work, this is done by choosing a value so that at least half of the 𝑛 𝑚 natural frequencies are greater than 𝜔 0 . The design variable 𝑥 𝑖 represents the current configuration of the 𝑖th finite element, which can be either 1, for a solid element, or 𝑥 min , for a void one. 𝑉 * is the imposed final volume and 𝑉 𝑖 is the volume of the 𝑖th element.

Compared to directly maximizing the difference between adjacent eigenvalues, this function has the advantage of avoiding both mode-shift and close eigenvalues problems. It is more robust to the emergence of local modes and instabilities along the process. Additionally, it can be implemented with mode tracking procedures [START_REF] Lopes | High natural frequency gap topology optimization of bi-material elastic structures and band gap analysis[END_REF].

Having defined the objective function, the sensitivity analysis is performed via the differentiation of 𝑓 (𝑥 𝑖 ):

𝛼 𝑖 = ⎡ ⎢ ⎢ ⎢ ⎣ 𝑛 𝑚 ∑ 𝑗=1 1 ( 𝜔 2 𝑗 -𝜔 2 0 ) 2 ⎤ ⎥ ⎥ ⎥ ⎦ -3∕2 𝑛 𝑚 ∑ 𝑗=1 1 ( 𝜔 2 𝑗 -𝜔 2 0 ) 3 [ 𝜙 𝑇 𝑗 ( 𝜕𝑲 𝜕𝑥 𝑖 -𝜔 2 𝑗 𝜕𝑴 𝜕𝑥 𝑖 ) 𝜙 𝑗 ] (3)
where the eigenvectors 𝜙 𝑗 are normalized with respect to the mass matrix 𝑴.

The derivatives of the mass and stiffness matrices are obtained from the interpolation schemes of the density and Young's Modulus:

𝜌(𝑥 𝑖 ) = 𝑥 𝑖 𝜌 0 (4) 𝐸(𝑥 𝑖 ) = [ 𝑥 min -𝑥 𝑝 min 1 -𝑥 𝑝 min ( 1 -𝑥 𝑝 𝑖 ) + 𝑥 𝑝 𝑖 ] 𝐸 0 (5)
where 𝜌 0 and 𝐸 0 are the density and Young's modulus of the base material. This interpolation scheme is used to avoid local modes in void elements [START_REF] Huang | Evolutionary topological optimization of vibrating continuum structures for natural frequencies[END_REF]. In continuous methods, the penalization exponent 𝑝 is usually defined based on the Hashin-Shtrikmann bounds [START_REF] Hashin | A variational approach to the theory of the elastic behaviour of multiphase materials[END_REF]. In the BESO, a calibration must be done by the user, testing several different values and analyzing the evolution and the final topology. Usual values for 𝑝 are around 3 [START_REF] Huang | Convergent and mesh-independent solutions for the bi-directional evolutionary structural optimization method[END_REF]. The derivatives of the finite element matrices are:

𝜕𝑴 𝜕𝑥 𝑖 = 𝑴 0 (6) 𝜕𝑲 𝜕𝑥 𝑖 = 1 -𝑥 min 1 -𝑥 𝑝 min 𝑝𝑥 𝑝-1 𝑖 𝑲 0 (7)
where 𝑴 0 and 𝑲 0 are the mass and stiffness matrices of a solid element. This sensitivity analysis is necessary for the update procedure of the BESO algorithm, which will be presented in Section 2.3.

Connectivity constraint for elongated structures

Optimization problems can have trivial, degenerated solutions. The maximization of the objective function given in Eq. ( 2) may present such an issue, as there are cases where the optimal topologies correspond to disconnected structures, that is, structures in which regions of the design domain become disconnected.

In this work, a novel method for measuring and imposing connectivity between two given regions is developed. At each iteration, solid elements that are essential to maintain a minimal structural connectivity are identified. These elements are prevented from turning into void elements during the update procedure of the BESO.

A heat conduction equation is used to measure the importance of each element in keeping the given regions connected. The following are considered: only solid elements are thermally conductive, and a unitary heat transfer rate enters the domain through a surface 𝛤 𝑎 and leaves through a surface 𝛤 𝑏 . Under these conditions, the heat flux will be greater in thin connections between 𝛤 𝑎 and 𝛤 𝑏 . As a consequence, the heat flux passing through a solid element can be used to measure its importance in keeping both surfaces connected. In order to compute the heat flux, an auxiliary Finite Element Analysis is performed to solve the following equation:

∇ ⋅ (𝑘(𝒔)∇𝑇 (𝒔)) = 0 , 𝒔 ∈ 𝛺 ∇𝑇 (𝒔) ⋅ 𝒏(𝒔) = 0 , 𝒔 ∈ 𝛤 𝑜 𝑘(𝒔)∇𝑇 (𝒔) ⋅ 𝒏(𝒔) = -𝑞 𝑎 , 𝒔 ∈ 𝛤 𝑎 𝑘(𝒔)∇𝑇 (𝒔) ⋅ 𝒏(𝒔) = -𝑞 𝑏 , 𝒔 ∈ 𝛤 𝑏 𝑇 (𝒔) = 0 , 𝒔 ∈ {𝒔 0 } (8)
where 𝑇 (𝒔) represents the temperature field in a spatial point 𝒔; 𝒏(𝒔) represents the unit normal vector, orthogonal to the boundary surfaces and pointing outward; 𝑞 𝑎 and 𝑞 𝑏 represent the imposed fluxes. The conductivity 𝑘(𝒔) is adopted as 1 for solid elements and 𝑥 min for void ones, ensuring that the heat flux passes only through solid elements. The domain 𝛺 is the optimization domain; the surfaces 𝛤 𝑎 and 𝛤 𝑏 are the regions that must be connected; the adiabatic boundary 𝛤 𝑜 comprises any other boundary point; 𝒔 0 can be any point of 𝛺, it serves only to make the problem well-posed. ∇ is the gradient operator.

Since a unitary heat transfer rate is considered, 𝑞 𝑎 and 𝑞 𝑏 must satisfy the conditions:

∫ 𝛤 𝑎 𝑞 𝑎 𝑑𝐴 = -1 (9)
∫ 𝛤 𝑏 𝑞 𝑏 𝑑𝐴 = 1 (10)
Once the scalar field 𝑇 (𝒔) is obtained, the vector field 𝒒(𝒔) can be calculated as:

𝒒(𝒔) = -𝑘(𝒔)∇𝑇 (𝒔) (11)
Finally, the value 𝑞 𝑖 = ‖𝒒‖, evaluated at the center of the 𝑖th element, is used as a measure of its importance in keeping connectivity. By defining a maximal value 𝑞 max , elements with 𝑞 𝑖 ≥ 𝑞 max are excluded from the update procedure.

The parameter 𝑞 max can be obtained by specifying a minimal surface area, 𝐴 min , connecting 𝛤 𝑎 and 𝛤 𝑏 . Assuming that 𝒒(𝒔) is uniform and orthogonal to the minimal connecting surface, 𝑞 max is given by:

𝑞 max = 1 𝐴 min (12)
The essential elements are taken out from the design domain by setting their sensitivity values to the maximal value obtained in the current optimization iteration. This procedure is given by:

𝛼 𝑐 𝑖 = 𝛼 𝑖 + 𝑐(𝑞 𝑖 ) [ max(𝜶) -𝛼 𝑖 ] ( 13
)
where 𝛼 𝑐 is the modified sensitivity vector, which is employed to update the topology, and 𝑐(𝑞 𝑖 ) is an activation parameter.

To define a soft-activation, a minimal threshold must be considered. By specifying a reference surface area 𝐴 max connecting 𝛤 𝑎 and 𝛤 𝑏 , 𝑞 min is defined by:

𝑞 min = 1 𝐴 max (14)
Thus, the function 𝑐(𝑞 𝑖 ) can be defined as a linear soft-activation:

𝑐(𝑞 𝑖 ) = ⎧ ⎪ ⎨ ⎪ ⎩ 0 , 𝑞 𝑖 ≤ 𝑞 min 𝑞 𝑖 -𝑞 min 𝑞 max -𝑞 min , 𝑞 𝑖 ∈ (𝑞 min , 𝑞 max ) 1 , 𝑞 𝑖 ≥ 𝑞 max (15)
In this work, the imposed boundary fluxes 𝑞 𝑎 and 𝑞 𝑏 are set as uniform through 𝛤 𝑎 and 𝛤 𝑏 . Since bi-dimensional structures under plane stress hypothesis are considered, the area parameters correspond to length parameters. 𝐴 max is set to be the height of the rectangular design domain, and 𝐴 min is defined based on the problem specifications. The connectivity constraint imposes that the left and right extremities of the design domain are kept connected.

Fig. 1 illustrates the flux 𝒒(𝒔) passing through the structure. The activation function is low in the low flux region, represented with blue arrows. In this part of the structure, the topology optimization is performed with little influence of the connectivity constraint. The activation function is high in the high flux region, represented with red arrows. In this part of the structure, topology changes are limited by the connectivity constraint.

Topology optimization method

The topology optimization method is based on finding the design that maximizes the desired criterion via successive changes to the topology. To each element, a design variable is assigned. As the BESO is a discrete procedure, these design variables can only assume discrete values, meaning that elements can only be either solid (𝑥 𝑖 = 1) or void (𝑥 𝑖 = 𝑥 min ). Void elements are considered as really flexible, instead of absent, to avoid numerical problems along the process. These design variables are updated at each iteration based on a sensitivity analysis, where the influence of each element on the objective function is evaluated.

The BESO is a well-established algorithm for topology optimization and was chosen due to its simplicity and robustness. The BESO is a gradient-based optimization procedure, meaning the sensitivity analysis is done based on the derivative of the objective function, as previously presented in Eq. ( 3). Despite having no convergence guarantees, the BESO proved to be a powerful method for topology optimization. When used properly, it usually leads to local minima and produces feasible topologies at each iteration. The BESO procedure is shown in Algorithm 1. 3)) Filter sensitivity numbers (Eqs. ( 16) and ( 17)) Perform connectivity procedure (Eq. ( 13

𝑖

In Algorithm 1, the parameters defined at the ''Input'' field must be given by the user. 𝐸𝑅 is the Evolutionary Rate, which corresponds to the rate of change in the volume for each iteration, and 𝐴𝑅 max is the maximum Addition Ratio, indicating the maximum percentage of element addition at a given iteration. Both parameters must be calibrated by the user. Higher values of 𝐸𝑅 and 𝐴𝑅 max may reduce the number of iterations required, but they can also destabilize the procedure. Thus, they must remain low enough to ensure a stable and coherent evolution. The parameter 𝑉 * is the final volume imposed by the design constraints.

The stopping criterion is based on the historical average and calculated via the expression shown in Algorithm 1. The parameters 𝜏 and 𝑁 represent, respectively, the tolerance and the number of previous iterations considered in the averaging process. The filtering scheme is implemented as presented by Huang and Xie [START_REF] Huang | Convergent and mesh-independent solutions for the bi-directional evolutionary structural optimization method[END_REF]. It is required to avoid both checkerboard patterns and mesh-dependent solutions. The former is a numerical problem originating from the bilinear finite elements, the latter must be avoided to prevent exceedingly thin components in the optimized structure, which hinder manufacturability. It requires defining a parameter 𝑟 min , which is usually interpreted as the minimum admissible thickness of the topology. Its application is based on performing two successive transforms on the sensitivity. Initially, a nodal sensitivity 𝛼 𝑗 is defined by averaging the elemental sensitivity to its nodes:

𝛼 𝑗 = 𝑀 ∑ 𝑖=1 1 𝑀 -1 ( 1 - 𝑟 𝑖𝑗 ∑ 𝑀 𝑖=1 𝑟 𝑖𝑗 ) 𝛼 𝑖 ( 16
)
where 𝑀 is the number of elements that have the node 𝑗. The value 𝑟 𝑖𝑗 is the distance between the center of the 𝑖th element and the 𝑗th node, and 𝛼 𝑖 is the elemental sensitivity calculated in Eq. ( 3). If 𝑀 is equal to 1, then 𝛼 𝑗 is defined as equal to 𝛼 𝑖 . These nodal sensitivities are then averaged back to the elements, weighted by the distance between the center of the elements and the nodes: where 𝑃 is the total number of nodes.

𝛼 𝑖 = ∑ 𝑃 𝑗=1 max(0, 𝑟 min -𝑟 𝑖𝑗 )𝛼 𝑗 ∑ 𝑃 𝑗=1 max(0, 𝑟 min -𝑟 𝑖𝑗 ) (17)

Optimization results

This section presents the first part of the design, aiming at adjusting the optimization procedures for the studied structure. During this step, the system is optimized and initial assessments on its manufacturability are done. The heat flux connectivity constraint is used to that end.

The studied domain is an elongated cantilever beam, as shown in Fig. 2. This structure is modeled using the properties of the Polylactic acid (PLA), the polymer that will be used during the experimental analysis. Its mechanical properties are: E = 3.5 GPa, 𝜈 = 0.36 and 𝜌 = 1250 kg/m 3 . The other optimization parameters are shown in Table 1.

The operating frequency is set to f 0 = 𝜔 0 ∕2𝜋 = 400 Hz. As such, the optimization procedure is performed to increase the frequency range free of resonance around it.

Preliminary results

As stated in Section 2.2, to apply the connectivity constraint, an input and an output surfaces must be defined. The proposed ones are shown in Fig. 2, corresponding to an inflow on the left extremity and an outflow on the right one.

With the previously defined parameters, the optimization procedure is performed. After 40 iterations, the stop criteria from Algorithm 1 are met, yielding the topology shown in Fig. 3.

An inspection of this topology indicates two main regions where the connectivity constraint operates, both are circled in Fig. 3. The two regions have a width of roughly 3.7 mm, which is around the imposed minimum length A min of 4 mm. For further investigation, the activation parameter presented in Eq. ( 15) is plotted in Fig. 4.

The contrast between high and low values of the activation parameter illustrates the functionality of this process. The parameter maintains the connectivity where necessary without compromising the rest of the domain.

To evaluate the performance of the obtained structure, the dynamic response to a sinusoidal 1 kN excitation is calculated and shown in Fig. 5. Both the force and measurement points are placed vertically at the free end. The excitation frequency is sweeped from 0 to 900 Hz.

The separation interval between the two natural frequencies around f 0 is increased by 28%, passing from 611.3 Hz to 785.4 Hz. Furthermore, the optimized structure is 60% lighter than the initial one.

Optimization with design domain constraints

The results obtained in the previous section show the effectiveness of the proposed procedures. However, we aim at validating the proposed procedures experimentally. To realize the experiments under the same conditions, the displacements should be measured along the same external surface. Consequently, an exterior frame of 2 mm thickness is defined, and the optimization procedures should concern only the inner volume.

Additionally, a manufacturing constraint of a minimum thickness of 1.5 mm is considered. This is implemented by changing the sensitivity filter parameter r min to 1.5 mm. All other parameters are kept unchanged from the preliminary result.

Initially, the topology optimization procedure is performed without the connectivity procedure. Fig. 6 shows the optimized topology.

This topology is not a feasible solution. This structure would be both challenging to manufacture and could also present structural problems during experimentation.

This indicates that, despite the imposed fixed 2 mm layer, the connectivity procedure is necessary to obtain a proper solution. The input surface of the connectivity procedure is maintained as the left end, however, due to the fixed layer constraint, the output one is changed to the entire right extremity. The minimum connectivity width A min is also changed to 1.5 mm. Fig. 7 presents the obtained optimized structure.

Much like the preliminary analysis, the connectivity coefficient of each element is calculated and shown in Fig. 8. While the values of the coefficient are not as high as those previously noted, they still pose an important effect on the procedure. The three most significant regions are shown in Fig. 8. A consequence of this procedure is that, although not strictly necessary to maintain connectivity in this case, it guarantees the minimum thickness required by the design constraints.

The evolution of the two first natural frequencies is shown in Fig. 9. It is observed that the first natural frequency varies little, while the second one changes more. From the beginning, the connectivity procedure maintains the connection near the base of the topology. Around iteration 25, a large decrease on the second natural frequency is observed due to the removal of internal bars. However, the procedure manages to increase it again by reinforcing other regions of the topology.

The natural frequency separation interval is visualized in Fig. 10. The separation interval changes from 610 Hz to 703 Hz, totaling a 15% increase. This topology presents a satisfactory trade-off between design constraints and performance. Therefore, this result is chosen to proceed to the following analyses.

Three dimensional model

The three dimensional models are generated by extruding the two dimensional structures along the 𝑍 axis by a thickness of 𝑡 = 20 mm. It is worth mentioning that this thickness was the suitable one following several simulations with different thicknesses.

Topology optimization procedures are applied during the preliminary design stage of an engineering project. Thus, the optimized topologies obtained from it are still subjected to alterations that aim at specific goals, such as guaranteeing manufacturability. Usually, smoothing techniques are employed to this end, enlarging or removing small features to ensure that the desired manufacturing process can produce it. In this work, two changes are implemented. First, sharp edges are smoothed, and internal bars are adjusted to guarantee a minimum thickness of 1.5 mm, ensuring the manufacturability of the specimens. Additionally, a rectangular base is added at the fixed end as an extension to the clamping device.

The Ansys ® Workbench 17.0 software is employed to simulate the system and to generate the appropriate STL files for the 3D printer. The resulting model for the optimized structure is shown in Fig. 11.

A model for the initial structure is generated via a similar procedure. The FRFs of both structures are compared in Fig. 12. To study these new peaks, the eigenvalues and eigenvectors of the optimized topology are calculated. The mode shapes are shown in Fig. 13, along with their corresponding natural frequencies.

Modes 1, 5 and 6 are those that were optimized by the two dimensional topology optimization procedure and that were seen in both FRFs. Modes 2, 3 and 4, on the other hand, are the modes exclusive to the three dimensional analysis. Modes 2 and 4 correspond to the first and second bending modes in the 𝑋-𝑍 plane and Mode 3 is the first torsional mode. During the experimental analysis, as long as the force is as centered and as aligned to the 𝑍 direction as possible, these modes will be only slightly excited, so they are expected to exert little influence.

Having obtained a topology that satisfies the desired criteria, the experimental analysis can begin.

Experimental analysis

The experimental conditions and procedures will be presented first, then we will discuss the results obtained.

Experimental procedure

To manufacture the samples, a Lulzbot ® Taz 6 printer was used. The specimens were built using a layer resolution of 0.1 mm, the printing direction was set parallel to the length of the structures (𝑋 axis), thereby the mechanical properties would be as close to the nominal ones possible in this direction. The two manufactured structures are shown in Fig. 14.

The structures were clamped at one end and excited by using an electromagnetic shaker 40 mm from this clamped edge (Fig. 15). A force transducer placed between the push-rod and the structure enabled the measurement of the applied force. Decoupling the effects of the clamping support and the shaker from the dynamic behavior of the structure was a hard operation due to the small dimensions and mass of the samples. The shaker was suspended by elastic links, supervising that its influence would not affect the studied frequency range.

The laser vibrometer was set to sweep through several points on the structure surface to measure their velocity. It was placed 1.5 m from the surface of the sample, and its lens was aligned at 50 mm from the clamped end. White noise signal from 0 to 2000 Hz was used. It covered the studied frequency range and enabled easy and rapid measurements.

The measurement points were chosen in a distribution with a 13 × 5 grid along the surface of the structure (Fig. 16). The vibrometer was commanded and controlled via a software provided by the manufacturer. The sampling frequency was 2.5 kHz. The velocities and the force were measured and processed through 10 repetitions for each assessed point. The final responses were obtained by averaging each measurement. The list of equipment is shown in Table 2.

A general view of the setup and the equipment used is shown in Fig. 16.

Results and analysis

The post-treatment of the measured responses and the excitation enabled the representation of the FRFs, identifying the resonances and the corresponding mode shapes. The comparison between simulation and experimental FRFs is shown in Fig. 17.

For low frequency, due to the flexibility of the test rig and the shaker flexible suspensions, several peaks appeared. However, those suspension modes were low and were outside the studied frequency range.

The experimental response had a more complex dynamic behavior and several modes that had not been observed in the numerical simulations appeared. Those modes were due to the environment of the experiment. Numerical and measured resonance frequencies, for the considered frequency range, were similar as shown in Table 3.

The mode shapes of the identified resonances are shown in Fig. 18.

Comparing the experimental mode shapes with the numerical ones (Fig. 13), shows a good agreement. The modes in the orthogonal plan cannot be clearly seen in the experimentation. This is due to the capacity of the vibrometer. The fact that the predicted behavior of the optimized structure matches correctly the measured one is important for the development of further studies on more complex structures.

Finally, the measured responses from both initial and optimized structures were compared experimentally, as illustrated in Fig. 19.

The first two bending frequencies of the initial and optimized structures are shown in Table 4.

The method produced a clear improvement of the dynamic response at the desired frequency range, as the frequency separation interval increased by 24%. Additionally, the optimized structure has a mass 40% lower than the initial one, decreasing from 108.0 g to 64.8 g.

The developed methodology enabled an increase of the frequency separation interval. The vibration levels, for almost all resonances in the studied frequency range decreased. Furthermore, the optimized topology had the desired behavior with a lower mass, which is of interest from a cost and an environmental points of view.

Conclusion

In this work, the design of an optimized elongated structure was performed. The optimization was done via the BESO method and was based on natural frequency separation criterion. The multi-domain topology optimization technique was employed to consider certain restrictions due to the manufacturing constraints. Also, a connectivity procedure based on the energy balance of an auxiliary problem was proposed to avoid non-physical solutions and to maintain certain geometric constraints.

The topology optimization analyses were performed on 2D structure. A 3D model was then generated by extruding the optimized 2D structures, considering several constraints in order to obtain a feasible topology for the experimental analysis. Numerical simulations were performed to compare the dynamic behavior of the initial and the optimized structure. An increase of 24% on the separation interval was obtained. Additional modes were observed in the analyzed frequency range for the optimized structure. This was expected when passing from 2D to 3D analysis.

Several prototypes were manufactured for the experimental analysis. The same trends were observed, few differences were noted due to the boundary conditions but they did not modify the obtained conclusions. The structure was excited by an electromagnetic shaker placed near the clamped end. In order to obtain the modal shapes for the studied frequency range, the displacements were measured using a laser Doppler vibrometer, along a grid of 5 × 13 points uniformly distributed.

Then, numerical predictions and experimental results were compared. The model describes the studied phenomena satisfactorily. The experimental response had a more complex dynamic behavior and several modes that were not observed in the numerical simulations appeared. Those modes were due to the environment of the experiment that could not be considered in the numerical simulations. This step was important in order to validate the proposed optimization strategy for further studies.

Finally, the measured dynamic responses of the initial and optimized structures were compared, and the frequency separation range increased by 133 Hz. Also, the vibration levels for almost all the observed modes decreased. The mass of the system was reduced by 40%.

The optimization algorithm can be readily applied for more complex structures. Further investigations must be conducted for more complete design problems. For example, techniques to couple dynamic and static requirements, such as stress constraints. Moreover, additional studies must be made on the BESO method and on the connectivity procedure to improve their robustness at producing feasible final topologies.

CRediT authorship contribution statement

Fig. 1 .

 1 Fig. 1. Connectivity constraint soft-activation.

Algorithm 1 :

 1 BESO procedure Input: Define parameters: 𝑥 min , 𝑝, 𝐸𝑅, 𝐴𝑅 max , 𝑉 * , 𝑟 min , 𝐴 min , 𝜏, 𝑁, 𝑛 𝑚 Define boundary conditions and mesh Start iteration counter: k = 0 Calculate eigenvalues and eigenvectors while error < 𝜏 or 𝑉 (𝑘) ≠ 𝑉 * do k = k + 1 Evaluate sensitivities 𝛼 (𝑘) 𝑖 (Eq. (

  Optimized topology 𝑥(𝑘)

Fig. 2 .

 2 Fig. 2. Optimization domain.

Fig. 3 .

 3 Fig. 3. Optimal topology of the preliminary result.

Fig. 4 .

 4 Fig. 4. Activation parameter on the final topology.

Fig. 5 .

 5 Fig. 5. Optimal topology frequency response.

Fig. 6 .

 6 Fig. 6. Optimal topology without connectivity constraint.

Fig. 7 .Fig. 8 .

 78 Fig. 7. Optimal topology with design constraints.

Fig. 9 .

 9 Fig. 9. Evolution of the first two natural frequencies with intermediary topologies.

Fig. 10 .

 10 Fig. 10. Frequency response of optimal topology with design constraints.

Fig. 11 .

 11 Fig. 11. Three-dimensional model of the optimized structure. A and B represent the points of force application and displacement measurement, respectively.

Fig. 12 .

 12 Fig. 12. Simulated FRFs from 3D initial and optimized structures.

Fig. 13 .

 13 Fig. 13. Mode shape for the simulated model.

Fig. 14 .

 14 Fig. 14. Initial (a) and optimized (b) structures.

Fig. 15 .

 15 Fig. 15. Representation of the experimental setup.

Fig. 16 .

 16 Fig. 16. General view of the experimental setup.

Fig. 17 .

 17 Fig. 17. Comparison between experimental and simulated FRFs, optimized structure.

Fig. 18 .

 18 Fig. 18. Mode shape of the studied frequencies.

Fig. 19 .

 19 Fig. 19. FRFs of the optimized and the initial structures.

  Nigro Lopes: Conceptualization, Methodology, Software, Investigation, Writing -original draft. Daniel Candeloro Cunha: Conceptualization, Methodology, Formal analysis, Writing -review & editing. Renato Pavanello: Conceptualization, Writing -review & editing, Supervision, Project administration, Funding acquisition. Jarir Mahfoud: Investigation, Resources, Writing -review & editing, Funding acquisition.

Table 1

 1 Optimization parameters.

	Parameter	Value
	AR max	2%
	ER	2%
	r min	2 mm
	x min	10 -6
	p	5
	A min	4 mm
	V *	60%
	𝜏	0.1%
	𝑁	5
	𝑛 𝑚	10

Table 2

 2 List of equipment.

	Equipment	Model
	Laser Doppler vibrometer	Polytec PSV-400
	Force shaker	TIRA Vibration Exciter S 50018
	Power amplifier	TIRA Power Amplifier BAA 60
	Force transducer	Bruel & Kjaer Type 8200
	Signal conditioner	Nexus Charge Conditioning Amplifier 2692-A

Table 3

 3 First two bending frequencies (Hz).

	Numerical	Experiment	Difference
	simulation
	104.5	107.0	2.4%
	789.2	790.0	0.1%

Table 4

 4 First two bending frequencies (Hz).

		Resonance 1	Resonance 2	Difference
	Initial structure	110.2	660.2	550.0
	Optimized structure	107.0	790.0	683.0
	Frequency separation interval increase	133.0

Acknowledgments

This work was supported by FAPESP (São Paulo Research Foundation, grant numbers 2013/08293-7, 2019/19237-7 and 2019/05393-7) and CNPq (National Council for Scientific and Technological Development, grant number 130636/2019-3).

Declaration of competing interest

The authors declare that they have no known competing financial interests or personal relationships that could have appeared to influence the work reported in this paper.


Enka Blanchard
email: enka.blanchard@cnrs.fr

L Gabasova

Minimalist approaches to enforce privacy by design in surveys

Keywords: Privacy by design, Survey, Methodology, Anonymisation, User experience

Public institutions and private companies both frequently rely on user surveys for a variety of assessments (e.g. equality issues or quality of work environment). However, many such surveys struggle to garner sufficient responses, especially when they ask about sensitive subjects (such as work harassment), which also makes them exist in a legal grey area when it comes to data protection laws. One important factor in this issue is the perceived threat of deanonymisation, compounded by the frequent lack of transparency on how the data is used. The proposals seeking to address this issue often focus on complex cryptography (e.g. homomorphic encryption), without addressing the fears of non-technical users.

This paper explores a radically different approach which minimises data collection on multiple fronts, partially by limiting the power of survey organisers. By design, it prevents generic attempts to deanonymise participants, as the server never stores even pseudonymised information. We also try to address questions of inclusivity, once again through a minimalist approach. Finally, we report on the first live test of a prototype developed following this approach.

INTRODUCTION

Workplace surveys are seeing increased use in both public institutions and private companies, to get employee feedback on indicators ranging from the quality of the work environment to diversity or harassment issues [START_REF] Paul | The employee survey: More than asking questions[END_REF]. Those surveys suffer from multiple issues, especially low and further declining response rates (unless the survey is mandatory) and the risk of self-censorship [START_REF] Dillman | Towards Survey Response Rate Theories That No Longer Pass Each Other Like Strangers in the Night[END_REF]. This is particularly true when there is a risk that participants could be deanonymised, which has led to a lot of work in the field of differential privacy [START_REF] Dwork | Differential privacy: A survey of results[END_REF].

Due to the specificities of workplace surveys and the varying and sometimes conflicting regulations, some of the questions asked can also be in a legal grey area (despite the rise of legal frameworks such as GDPR). For example, although medical data is subject to strict confidentiality rules, some institutions approve the use of questions about discrimination which ask the reason for such discrimination 1 (with the option to choose medical reasons or disability status). Certain questions can also create some friction depending on how they're phrased. For example, asking the participant's gender is generally seen as mandatory, but runs into multiple issues on questions regarding inclusivity and politicisation [START_REF] Mathieu Trachman | Putting LGBT and non-binary people in boxes. Statistical categorization and criticism of gender and sexuality assignations in a study on violence[END_REF].

An additional important reason to be mindful with the phrasing and inclusion of specific questions is that, even if the immediate impact of a given survey is limited, its framework may be reused in the future, especially in public institutions. This means that any badly phrased elements will be carried forth into an indeterminate number of future surveys, become standardised and have long-lasting consequences [START_REF] Mathieu Trachman | Putting LGBT and non-binary people in boxes. Statistical categorization and criticism of gender and sexuality assignations in a study on violence[END_REF]. This situation can then be hard to correct, as simply removing a badly phrased question from a survey can lead to knock-on changes due (for instance) to priming. This echoes ethical issues with datasets with personal information used in computer science, which can continue being used despite major flaws being found [START_REF] Keyes | Feeling fixes: Mess and emotion in algorithmic audits[END_REF].

This paper stems from an experiment done in 2022. The authors were tasked by a French university with designing and developing a survey system that had stronger privacy guarantees than off-the-shelf systems 2 . This was an opportunity to follow privacy-by-design minimalist approaches and best practices from both usable security and social sciences [START_REF] Spiekermann | The challenges of privacy by design[END_REF][START_REF] Langheinrich | Privacy by design-principles of privacy-aware ubiquitous systems[END_REF]. We propose the following contributions:

• reflections on minimalist approaches in survey system design;

• one proposed design of an anonymous survey system with potential extensions;

• summary feedback from a live test of a prototype of said system.

This article is structured as follows. We start by general questions on survey design and how this interacts with questions of transparency, data handling, and privacy. We then look at how minimalist approaches can help propose an alternative to existing survey systems by focusing on anonymity and the various components and questions that must be addressed when doing so. We then move on to questions beyond pure anonymity such as usability and inclusion, as they can have negative interactions with the former. We conclude with summary feedback from the first live test of the prototype and future work.

SETTING GOALS

The first task of any survey planner is to decide what the exact goals of the survey are, impacting the design constraints and hence the question of which survey systems are adequate. This is not a trivial task, for multiple reasons. First, there can be competing interests in the outcome of the survey. For example, in practice, there can be a difference between the announced goal of surveys on workplace harassment -finding it if it exists -and the real goal: showing that it is rare or non-existent. This means that some potential objectives such as transparency (e.g., promising to make the results entirely public) can be resisted by stakeholders wanting to avoid bad publicity.

Second, many workplace surveys are not designed in a fashion similar to surveys intended for purely research purposes, which start from a research question and seek to answer it. Instead, they can come from many different considerations: legal requirements or corporate incentives to enquire about mental health, desire for data/feedback to improve the company's practices to help employee retention, or even the public relations bonus coming from acting on a perceived issue... The people designing the survey can also be entirely removed from the initial decision to have a survey, all of which can increase the confusion as to the objectives.

We observed one one notable consequence of this in past surveys: many of them were designed in an ad hoc fashion. This involved adding questions that seemed interesting without necessarily looking at interactions between them, priming effects -or even whether any given question contributes information that cannot be inferred from other questions. This is crucial when considering the main two objectives of such surveys: either getting a description of how things are (with both quantitative aspects and open-ended qualitative approaches), or finding correlations and anomalies between groups of participants. As statistical analysis may not always be possible due to small sample size or low response rate, questions that rely on returning a quantitative measurement can be useless to the survey's goals. The presence of such questions goes against good usability practices, as more questions translate directly to higher user cost and therefore a higher dropout rate.

This ad hoc approach to survey creation often falls under the paradigm and characteristic patterns of big data and data mining. It silently assumes that data speaks for itself and that, by collecting as much data as can possibly be collected, one can sift through it for meaning and correlations [START_REF] Geri | The Information Age Measurement Paradox: Collecting Too Much Data[END_REF][START_REF] Levenson | Human capital analytics: too much data and analysis, not enough models and business insights[END_REF]. This already becomes problematic at the data collection stage due to the above-mentioned user cost. Then, with the wealth of data, the researcher -or survey organiser -is free to test all the possible correlations until they find interesting ones, without necessarily following good statistical practices (such as Holm-Bonferroni methods [START_REF] Abdi | Holm's Sequential Bonferroni Procedure[END_REF]). This encourages bad practices such as p-hacking, which may not even need to be carried out consciously [START_REF] Gelman | The garden of forking paths: Why multiple comparisons can be a problem, even when there is no "fishing expedition" or "p-hacking" and the research hypothesis was posited ahead of time[END_REF], and can be compounded by organisers whose expertise lies in psychology and not statistics, as some bad statistical practices have been considered standard by professional organisations [START_REF] Borsboom | The attack of the psychometricians[END_REF]. This is not just bad scientific practice, but can also have an impact on the results. Any survey with sufficiently many questions (10 is enough in practice) and respondents will statistically find differences between groups of people (e.g., following gender or age), encouraging the organisers to start policies to address effects that can be pure statistical noise.

To address this, one option is to adopt a fully transparent approach and, following social science methods, pre-register the analyses [START_REF] Logg | Pre-registration: Weighing costs and benefits for researchers[END_REF]. This means that the methods, stated goals and planned observations and correlations should be recorded before it is conducted, and ideally made available to participants (e.g., on the survey's welcome page).

The following sections will develop a design methodology and a proposed system that seeks to address these issues by enforcing such transparency and pre-registration following a privacy-by-design approach.

MINIMALIST APPROACHES AND ANONYMITY

In almost all cases, the survey's organisers' goals include having both a high response rate and good-quality answers with minimal self-censorship. This depends on many aspects, including trust -both in the organisers and the survey system. Although surveys should always leave open the possibility of declining to answer, and some users can choose to answer inaccurately, both options reduce the information that can be gathered and do not give strong privacy guarantees. Indeed, one of the main risks when handling workplace surveys concerns some of the sensitive data being attributable to specific individuals, especially if the data gets leaked. A survey organiser with access to full answer sheets for each participant can find it trivial to identify the single person who answered a certain way, which increases the barrier to reporting sensitive information. Even when people do not have access to full answer sheets, it can still be possible to deanonymise participants by looking at correlation chains. For example, let's suppose we have a single participant reporting harassment 3 .

If one has access to the average age and gender of people reporting harassment, one has initial elements which, if that person is the only one in their age-gender category, allow one to get increasingly more information and to eventually build a profile.

Before detailing our proposed system, we should give a quick warning about attack frameworks. A first constraint is that, if the full set of survey organisers have bad intentions, no design system can address the issue. Indeed, the organisers could simply lie as to which system is used -especially if they have full control of the servers. Similarly, any person with physical access to the server has a high chance of being able to obtain the data -unless everything is secured through trusted platform modules with correct cryptography, and even this supposes resistance to side-channel attacks which is not guaranteed [START_REF] Moghimi | {TPM-FAIL}:{TPM} meets Timing and Lattice Attacks[END_REF][START_REF] Goodin | Trusted platform module security defeated in 30 minutes, no soldering required[END_REF]. Thus, a reasonable attacker's profile in such a context is someone -potentially a manager or an employee from human resources -trying to access data about their colleagues, hence with reasonably limited technical ability.

The central idea behind the system proposed is to fully get rid of answer sheets. If correctly implemented, this boosts anonymity and has multiple positive consequences.

First, we can observe that any system that does not rely on answer sheets needs to store data in separate non-linked bases (or equivalently, in a single base with no relationships between columns). If done naively, this only allows some descriptive statistics -getting the proportion of people unhappy about a particular element -and qualitative feedback. However, it does not allow the study of any between-groups differences -such as whether one gender has different work experiences. While one can compute arbitrary correlations when one has full answer sheets, a minimalist decorrelated approach makes it impossible.

This means that one requires two types of columns: those containing raw data (such as the answers to the question "are you in a management position") and those containing more complex information. For example, if one wants to study the correlation between being a manager and being overworked, there can be the two raw data columns, plus one additional column corresponding to the correlation between the two: a list of data pairs, each of which can be computed on the participant's side. From a technical perspective, the system can be implemented by filling an answer sheet on the user's side and, upon submission of the filled answer sheet, computing all the correlations on the user's side and sending each as a separate update of one of the database's columns. Correlations between more than 2 variables can also be recorded but each additional variable makes deanonymisation easier. Even with only 2-variable correlations, care should also be taken to avoid correlation chains when designing the questionswhile keeping the context in mind and how a single question could deanonymise certain persons if the sample set is small enough.

As any correlation must be planned in advance, this approach forces a reflection on the part of survey designers, who cannot simply compile a list of questions and then explore the data for links. The minimalist approach requires starting with a clear set of objectives and constraints. It also means that, once an initial set of questions is considered, a necessary step is to compute whether -if response rates are reasonable -these questions will give actionable information. It also makes transparency less costly (as the costs are paid upfront). Indeed, to facilitate trust, the organisers can choose to publish in advance the full list of questions and correlations -and optionally even open a consultation on whether some questions should be added/removed/reworded. This comes at no cost to the organisers as it does not hinder their future analyses any more than the system already does. This is also a first step to ensure privacy-by-default as it strongly restricts the type of information that can be obtained from any single answer. Fully preventing correlation chains is generally not possible from within the system, as doing so requires contextual information, such as the number of people from a certain demographic who occupy a specific position. It can sometimes be possible to ensure that a correlation chain is impossible no matter the context, but this requires larger survey populations -and is the context where differential privacy is often explored [START_REF] Dwork | Differential privacy: A survey of results[END_REF][START_REF] Erlingsson | Amplification by shuffling: From local to central differential privacy via anonymity[END_REF]. In the case of small survey populations (i.e., around 100), we thankfully have multiple ways to address deanonymisation shown below, still following a minimalist approach.

Nominative information

The easiest way to deanonymise is to obtain nominative data, such as the participant's email or IP. This is not always stored as part of the answer sheet, but a unique identifier or password is commonly sent to users to prevent spamming and limit answers to one per person. Naturally, any privacy-oriented system should prevent the storage of directly identifiable data (or its access by the organisers when storing it is unavoidable).

If the password is sent by email, it creates the opportunity for organisers to directly attribute answers to known email addresses, and participants can then have legitimate privacy concerns as they cannot know whether organisers are able to track their answers.

One way to address this is to use simple passwords or passphrases -for example, two common words -and to tell users that they are free to exchange them with colleagues (although each code can only be used once). Moreover, those passwords should be checked once when the survey data is submitted (or when access is granted), but should not be stored as part of the same database to avoid it being correlated with any other information. Another option (especially with emails if the potential list is of sufficient size) is to compute an expensive hash (e.g., with Argon 2 [START_REF] Biryukov | Argon2: new generation of memory-hard functions for password hashing and other applications[END_REF]) and check if the hash is already present in the database, with the hash being made costly enough to dissuade brute-force attacks.

Some other elements can also contain nominative information.

For example, open-ended questions (such as requests for "potential improvements to the workspace") allow participants to refer to arbitrary information and can make it very easy to identify them. As correlating such answers with any others seldom gives usable information, the natural option is to prevent any correlation with such open-ended questions. It is also worth stating that this is the case in the survey's welcome page to encourage participants to give detailed answers.

Decorrelating answers

Once the nominative data is removed, the next step to avoid deanonymisation is not just to avoid storing full answer sheets, but to make sure that such answer sheets cannot be obtained from the database even with full (a posteriori) access. Thus, not only should each question be stored separately, the n-th line of each column should not just consist of the n-th participant's answers. Thus, each time data is stored for a question (that isn't a counter), the column should be reordered randomly. Instead of reordering the whole array, it is thankfully enough to only permute the last element added with another (including itself) uniformly, akin to a reversed Fisher-Yates shuffle [START_REF] Black | Fisher-Yates shuffle[END_REF].

Avoiding partial results

There is one way to deanonymise participants even if the system uses the previous elements. By observing the results at multiple points in time (ideally between each participant), it becomes possible to infer the full answer sheets. A way to prevent this is to only make the results available once the survey is finished.

If, as above, we don't consider attackers with physical access to the server, a solution is to host the survey externally, or at least on a server administered by someone with no direct links to the participants -as external hosting is not always legally allowed for sensitive data. We can then differentiate between the person with complete server access -who has arbitrary power over the survey but no motive 4 -and the organisers. The latter should only be authorised to input the questions as well as the list of participants' emails (to access the survey), end the survey, and publish or download the results.

Post-survey correlation chain elimination and question twinning

If one is given preliminary contextual data (such as demographic information), it can become possible to perform additional correlation checks at the end of the survey. For example, let's suppose a sensitive question is correlated to a few demographic categories including gender and age, and let's suppose it is known that only three 60 year-old men work for the company and no 60-year old women do. If no women answer yes to the question but the three men do, they can be deanonymised (thanks to the contextual knowledge). The correlation by itself is not necessarily at fault as the uncertainty would remain if one of them did not answer (or answered differently).

These considerations should come into account when designing the data requested. For example, instead of asking for age, having age brackets tailored to the expected data limits the data accuracy but also prevents many forms of deanonymisation.

Another potential method is to automatically detect potential deanonymisation cases, either by feeding the system some contextual information initially or by guaranteeing that everyone in the population participated in the survey, giving it total demographic information.

In any case, simply removing the deanonymising question from the survey is not always a solution. Indeed, as sometimes only one answer set can be deanonymising, removing the question can be just as deanonymising as leaving it. One option is then to analyse a priori which questions could lead to such cases and to twin them: if at least one of them is removed, then the other also is. This eliminates the risk by creating an ambiguity, although at the expense of additional data loss.

USABILITY AND INCLUSION

Enforcing the anonymity of participants using the methods discussed above creates both new opportunities and new hurdles in terms of usability. Some common constraints or improvements to generic surveys can either be made impossible by this or can negate the design's advantages. This section will then go over three such questions: participant's self-identification, cookie-handling and data modification or deletion.

Self-identification

As social norms evolve, certain demographics questions can become both more complex and more politically loaded and can create some friction depending on which categories are available. For example, asking for the participants' gender/sex runs into multiple issues, beyond the simple possibility of the participant refusing to answer:

• If only two options (e.g., "man" and "woman") are available, this excludes some participants (e.g., the ones who are queer, intersex, non-binary, etc.) [START_REF] Mathieu Trachman | Putting LGBT and non-binary people in boxes. Statistical categorization and criticism of gender and sexuality assignations in a study on violence[END_REF].

• If more than two options are available, their very presence can make it a political issue and cause strife as some participants can react negatively to these options being presented 5 . Moreover, this does not solve the question of which options to show (as just adding a field marked "other" is -literally -othering [START_REF] Bauer | Making Sure Everyone Counts: Considerations for Inclusion, Identification and Analysis of Transgender and Transsexual Participants in Health Surveys[END_REF]).

• Both of these alternatives can create legal issues as increasingly many jurisdictions implement legal recognition of more than two gender options [START_REF] Amy | The normativity of recognition: Non-binary gender markers in Australian law and policy[END_REF]. Some policies can also come into potential conflict, such as local or national policies taking one stance (e.g., mandating or forbidding having 3 options) while supranational or federal rules mandate the opposite in evolving political landscapes [START_REF]Sexe, genre et santé[END_REF].

One potential solution to this issue is to leave an open field for all participants (and not just for those who'd choose "other"). This allows for self-identification without pushing the inclusivity to the forefront (and thus limiting the political strife it creates).

This method has two main drawbacks. First, it reduces usability by converting an "easy" question with a radio button into an open text field. This increases the chance of users not understanding the question, declining to answer it or accidentally skipping it.

A second issue is that it complexifies the analysis by offering a number of categories unknown in advance. Thus, it requires finding a way to handle the correlations when one has an open field to correlate.

If one keeps the correlation with the open text field, it can allow anyone with the full dataset to reconstruct some answer sheets. These can easily help identify someone if they're the only non-binary employee, but also for anyone else with a unique answer (up to white-space) as it allows multi-variable correlations. It keeps the highest level of detail at the cost of privacy, and can make future analyses more complex (depending on how the data is eventually clustered into a reduced number of categories 6 ).

Another option is to parse the data immediately on the client's side(with an extensive but non-exhaustive initial list) into a few categories, for example "Woman", "Man", "Other" and "Did not respond" (the latter two can be combined). This is somewhat more inclusive than just having an "Other" option within the survey (as participants aren't directly facing it) and facilitates the correlation analyses. However, it adds noise depending on the parser's accuracy, as some participants will be put into the "Other" category despite indicating clearly (albeit with a rare formulation) that they belong in the first two. This noise can thankfully have one positive impact, as it helps improve the privacy of the people who give less common answers (who can also be clustered with those who refuse to answer).

Cookies

Due to the survey not saving full user sheets, any problem in the database could corrupt the data in a way that cannot be handled by simply simulating the inputs on the server side. More importantly, if a correlation that was meant to be measured failed, it is impossible to get it back from the available data -unlike with the standard database structure where the organisers can choose what to analyse a posteriori.

One of the solutions is to ask the participants to retake the whole survey, but that has a high user cost and compounds with the dropout risk. Another option is to store all the participants' data on the client's side (as a full sheet in a cookie). In case of a server-side issue, it then becomes possible to update the code then ask users to go back to the survey page and resubmit their original data -plus eventual new correlations computed on the client's side.

This does create some security and privacy risk depending on the exact context. It can also have a small usability cost as the cookie storage requires compliance with various regulations such as GDPR7 [START_REF] Nokhbeh | The effect of the GDPR on privacy policies: Recent progress and future promise[END_REF]. The cookie information being available in cleartext on the client machine is also a non-negligible privacy risk, which can be mitigated by encrypting the cookie data. This can be done either in an asymmetric way -in which case the server is asked to decrypt the data upon a second login -or using symmetric encryption without storing the key on the client's machine except during the session. If there is a risk of a participant stealing another participant's cookies, the password should be different for all users (and could be partially based on the user's password).

Data modification and deletion

Another issue with avoiding user sheets is that it becomes not directly possible to remove or modify one user's data. However, if one is using cookies as above, then an option becomes available -with an additional security risk if anyone has full access to the server, although as stated above this renders most points moot. In addition to the decorrelated user data, the server can store a hash8 of each sheet (including the password).

Then if a user tries to login back into the system, they can go into a special modification mode where the client keeps the old cookie with the old answers, and sends one message to the server with the initial list of answers, the corresponding hash (which the server checks before deleting each answer from the corresponding database), and the corrected list of answers. The list of hashes should in any case not be public and should be deleted when the final results are computed to prevent future bruteforce attempts.

CONCLUSION

This paper proposes a minimalist approach to workplace surveys that focuses on anonymity by following a privacy-bydefault approach. This is not just a theoretical contribution, as the ideas above were used in a prototype system that was tested in a French university in 2022 with plans to eventually make it open-source after further rounds of testing. Some proposals -such as question twinning and data modification through hashes -were left out because they seemed too complex for the task at hand.

Although we cannot give details on the test that was performed, we can still report some feedback. First, the response rate was substantially higher than similar surveys in similar contexts we are aware of, although this can come from a variety of causes, including the extended discussions about the system within the community and the frequent reminders to participate. Some of the discussions were focused on privacy (as it was a "selling point" of the system), which then became more of a public issue, with multiple users contacting the organisers to express doubt and mistrust in the system. Finally, the open text field for gender did lead to non-negligible noise (more than 10%), partially because of a much higher non-response rate compared to other demographics question, and partially because the range of answers went far beyond the parser's planned list.

We also found multiple questions, social and technical, for which we have no good answers and which could be investigated in the future. Here are the main ones:

• To what extent would pre-registering the correlations and letting the participants see those in advance affect their responses?

• As transparency is good for trust, we advocate for publishing in advance the question and correlation list. However, the question remains of whether to automatically make public (to the participants) the results of the study once it is completed, and the corresponding trade-offs deserve an analysis.

• The approaches shown above can be made compliant with legislation such as GDPR (and were made so in the case of the deployed prototype). Indeed, as the data truly is anonymised and not pseudonymised, it follows different regulatory constraints (especially regarding the "right to be forgotten"). However, doing so is non-trivial: it requires fully separate data handling for the email part (which is not anonymised, even if it is only used to send an initial invitation to the survey) and for the survey's responses. As such, it might be too costly for administrators and organisers, and more work is needed on the cost-benefit analysis, including for the participants who might prefer having the possibility of deleting their data to just having stronger privacy guarantees that no-one can know that it is their data.

• Our model assumes that an attacker does not have direct access to the server (as it is generally beyond the technical purview of the survey organisers to prevent such attacks).

For situations where higher security is required, this vulnerability needs to be addressed. A simple method is to have a double system where two machines in different locations are in continuous contact with each other and the Internet. If contact is broken at any point or if someone tries to access one of the machines physically, a public alert is sent (for example by email, on Twitter or a blockchain). This is already a better system, but it is extremely prone to false alarms (and to denial-of-service attacks). Using systems such as proactive secret sharing [START_REF] Frankel | Optimal-resilience proactive public-key cryptosystems[END_REF] as well as TPMs, could a distributed encrypted system avoid this issue while being able to recover when one machine fails?

We have observed surveys which allow one to report harassment while also giving demographics information. Although there should generally be a way to anonymously report harassment, observing victimisation rates in systematic surveys can also play a role.

Of course, it might be possible to bribe or coerce the administrator. However, this means that the bribing party exposes themself if the administrator reveals the attempt. Keeping the administrator's identity private to most would also limit the exposure -and reduce the set of potential guilty parties if a bribe is attempted.

Although offering multiple options can be a step for inclusivity, it can also in turn create risks for the affected people as it can lead to adverse reactions, up to harassment in the workplace of both participants and survey organisers[START_REF] Jaroszewski | Genderfluid" or "Attack Helicopter": Responsible HCI Practice with Non-Binary Gender Variation in Online Communities[END_REF]

If the data is not meant to be clustered at all, then one can question whether it should be correlated at all.

One option is to have at the end of the survey a checkbox with the option to store the data locally if the user wants to, in which case a GDPR cookie warning on the front page wouldn't be necessary.

It would be preferable to use a costly hash to resist bruteforce (e.g., Argon2[START_REF] Biryukov | Argon2: new generation of memory-hard functions for password hashing and other applications[END_REF]), especially if the survey is short.