Mathias Gerbaux

Pauline Ascher

Audric Husson

Antoine De Roubin

Philippe Alfaurt

Mehdi Aouadi

Bertram Blank

Soufian Laurent Daudin

El Abbeir

Mathieu Flayol

S El Abbeir

H Guérin

S Grévy

M Hukkanen

B Lachacinski

D Lunney

S Perard

B Thomas

The General Purpose Ion Buncher: a radiofrequency quadrupole cooler-buncher for DESIR at SPIRAL2

Keywords:

  L'archive ouverte pluridisciplinaire

Introduction

The progress in the knowledge of the atomic nucleus has for decades been strongly correlated to the advances of the production of more and more exotic nuclei. Among the new generation of facilities presently under construction is the SPIRAL2 one at GANIL which will make new regions of the chart of nuclides accessible and deliver beams of exotic nuclei with sufficiently high production rates to make precision studies possible where only limited measurements were feasible up to now. A new low-energy experimental hall will be constructed from 2023 onwards in the framework of this project. As pictured in Fig. 1, the DESIR hall [START_REF] Blank | The DESIR facility at SPIRAL2[END_REF][START_REF] Thomas | The DESIR facility at SPIRAL2, in: Nuclear Structure Problems[END_REF] will receive beams from the upgraded SPIRAL1 [START_REF] Delahaye | New exotic beams from the SPIRAL 1 upgrade[END_REF] installation, from the low-energy branch of the new Super Separator Spectrometer (S 3 ) [START_REF] Déchery | The super separator spectrometer S3 and the associated detection systems: SIRIUS and LEB-REGLIS3[END_REF] also part of SPIRAL2 and from a production building that could be constructed on a longer timescale. All these beams are ISOL-like, being extracted either from a target-ion source system or from a gas catcher. These beams thus have a low energy (typically below 60 keV), a good optical quality and generally a 1+ charge state (potentially also 2+ for cryogenic temperature gas catchers). SPIRAL1 will produce mostly light ions from fragmentation and possibly heavier ions with fusion-evaporation reactions. S 3 will produce neutron-deficient nuclei from light N=Z nuclei up to superheavy ones that will be stopped in a gas cell. The production building would deliver mainly fission fragments but possibly also fusion-evaporation products. DESIR will accordingly benefit from a large variety of exotic nuclei with high intensities and in a very wide range of masses to investigate nuclear structure, nuclear astrophysics or fundamental interactions. For these purposes, state of the art setups are being developed to use decay or laser spectroscopy as well as various electromagnetic traps (Paul, Penning and MR-ToF-MS).

Most of these setups put strong constraints on the beam characteristics as will be detailed in the next section. A low transverse emittance is also often desirable be it only for efficient transport at low energy through the beamlines. This is the reason why it was decided to develop a general purpose ion cooler and buncher (referred to as "GPIB" 1 LP2i Bordeaux was known as Centre d'Études Nucléaires de Bordeaux-Gradignan (CENBG) before the name was changed in 2022 Email address: gerbaux@lp2ib.in2p3.fr ( M. Gerbaux) ORCID(s): 0000-0002-3852-2643 ( M. Gerbaux) Figure 1: Overview of the future DESIR hall in GANIL. The beams coming from S 3 and SPIRAL1 arrive respectively from left and bottom left, can pass (or not) through a high-resolution magnetic separator (HRS) and then enter the DESIR hall passing through the GPIB (circled in red). Many parts of the hall equipment (HV cages, cranes, laser room, some detectors...) have been omitted for clarity.

hereafter 1 ) that will be placed at the entrance of the DESIR hall and through which all the beams delivered to DESIR will pass.

Radiofrequency quadrupole (RFQ) coolers were first developed for Penning-trap mass spectrometry and laser spectroscopy by the ISOLTRAP collaboration [START_REF] Herfurth | A linear radiofrequency ion trap for accumulation, bunching, and emittance improvement of radioactive ion beams[END_REF] and the JYFL-IGISOL team [START_REF] Nieminen | Beam cooler for low-energy radioactive ions[END_REF]. These devices are now widespread and have become standard tools at radioactive-ion-beam facilities delivering low-energy beams. RFQ coolers provide a transverse radiofrequency (RF) quadrupole field to confine injected ions that cool from collisions with buffer gas. An axial DC field is also required to push the cooled ions towards the end of the structure where an accumulation volume can be present if the cooler has also a bunching function. Many designs exist [START_REF] Maier | Stopping, trapping and cooling of radioactive fission fragments in an ion catcher device[END_REF][START_REF] Ban | First tests of a linear radiofrequency quadrupole for the cooling and bunching of radioactive light ions[END_REF][START_REF] Schwarz | A second-generation ion beam buncher and cooler[END_REF][START_REF] Block | the SHIP-TRAP Collaboration, The ion-trap facility SHIPTRAP[END_REF][START_REF] Sun | Commissioning of the ion beam buncher and cooler for LEBIT[END_REF][START_REF] Lunney | COLETTE: A linear paul-trap beam cooler for the on-line mass spectrometer MIS-TRAL[END_REF][START_REF] Brunner | TITAN's digital RFQ ion beam cooler and buncher, operation and performance[END_REF][START_REF] Schwarz | The LEBIT ion cooler and buncher[END_REF] with a large variety of inner diameter and length, in the shape and segmentation of the electrodes providing the axial DC and/or RF potentials, in the waveform of the radiofrequency signal or in the temperature of operation. Among these, ISCOOL [START_REF] Podadera-Aliseda | Design of a second generation RFQ ion cooler and buncher (RFQCB) for ISOLDE[END_REF][START_REF] Podadera-Aliseda | Preparation of cooled and bunched ion beams at ISOLDE-CERN[END_REF][START_REF] Podadera-Aliseda | New developments on preparation of cooled and bunched Radioactive Ion beams at ISOL facilities: the ISCOOL project and the rotating wall cooling[END_REF][START_REF] Frånberg | Off-line commissioning of the isolde cooler[END_REF] was devised as a general-purpose cooler and buncher for the High Resolution Separator beamline at the ISOLDE facility and features segmented DC electrodes that are separate from the (continuous) RF system avoiding the need of a matching circuit. It also has rather large dimensions which is beneficial to reduce space charge effects, especially when bunching is desired. Apart from a few minor improvements, the GPIB follows the same mechanical design choice as ISCOOL while a different option was chosen concerning the radiofrequency generation so as to allow higher RF-voltage amplitudes and frequencies to improve the confining power. 1 Not to be confused with the old IEEE-488 interface bus

Setups

Energy dispersion Time dispersion Repetition rate Laser spectroscopy Rough estimates of the characteristics of the ion bunches needed for various types of setups.

Requirements

Radiation safety constraints limit the incoming beam intensity in DESIR to around 10 8 ions per second for most of the produced radionuclides though it can go up to 10 10 ions per second in some specific cases. The GPIB was then designed to handle up to some nA of continuous beam while maintaining a high transmission. In addition, many of the experiments in the DESIR hall require bunched beam with up to 10 5 ions per bunch and repetition rates between one and a few hundreds bunches per second. The GPIB has thus to be able to trap large samples of ions for durations ranging from milliseconds to seconds and release them in a well controlled way. Such a large capacity is also desirable in the case of highly contaminated beams (as is often the case for very exotic nuclei) though in the present version of the layout the incoming beam can be cleaned by passing through a high resolution magnetic dipole separator (see Fig. 1) if desired.

The quality of a particle beam can be described by both transverse and longitudinal emittances. The first one, taking into account both the transverse spread of the ions and their angular deviation to the beam axis, is crucial as low emittance is necessary to limit the beam losses during the transport especially when injection in a strong magnetic field is needed as in a Penning trap. The spatial spread of an ion cloud after injection in a trap is directly linked to the beam transverse emittance and it is desirable to limit this spread to avoid probing both the electric and magnetic field imperfections that increase away from the center of the traps. The different setups in the DESIR hall need a transverse emittance lower than a few .mm.mrad be it in continuous or bunched mode. The incoming beam will typically have a transverse emittance of the order of several tens of .mm.mrad if it has not been cooled before. The GPIB specifications were defined so as to reduce the transverse emittance from 80 down to 3 .mm.mrad for a 60 keV beam.

For bunched beams, the longitudinal emittance combines energy and time spread. In these domains, the various setups have different needs rough estimates of which are given in table 1. The most stringent requirements for energy dispersion are due to laser spectroscopy as the precision of the measurement is directly linked to this spread. The MR-ToF-MS is the most demanding application concerning time dispersion for the same reason. Concerning the Penning traps the specification on these spreads is mainly a matter of efficiency. Some other experiments need continuous beam and the GPIB can thus be operated in cooling-only mode. As all the beams used in the DESIR hall will pass through the GPIB, it is crucial to keep a good transmission be it in continuous or bunching mode. Finally, as the incoming beam can be continuous hence preventing the use of a pulsed drift tube to slow it down without losses, the GPIB must be operated on a high-voltage platform.

Mechanical design

The mechanical design of the GPIB (see Fig. 2) is very close to the ISCOOL cooler and buncher developed at CERN and in operation on the HRS beamline at ISOLDE since 2008. ISCOOL is extensively described in [START_REF] Podadera-Aliseda | Design of a second generation RFQ ion cooler and buncher (RFQCB) for ISOLDE[END_REF]. The They are mechanically separated from the rest of the RFQ and the small apertures ensure both a good confinement of the buffer gas and a reduced fringe field out of the RFQ.

The first main difference with ISCOOL is the alignment system which was identified as a weakness. The new The buer gas is injected through the 12 ℎ electrode (the feeding pipe is not pictured).

system of the GPIB has been designed at LP2iB so that the alignment can be performed from outside the vacuum chamber. The DC segments, RF rods and end plates form a rigid assembly attached to the vacuum chamber lid by a mechanical system allowing for lateral and longitudinal movement. The first two injection and last two extraction electrodes are connected to the vacuum chamber itself.

The second modification is the connection between the RF supply system and the quadrupole rods. Since much higher voltages are applied to the rods compared to ISCOOL, the connectors had to be moved from the extremity to the middle of the rods (passing through DC electrodes). Bigger insulators had also to be used to avoid sparking. The twenty-five DC segments have various lengths along the beam axis, depending on the precision needed on the shape of the DC gradient that guides the ions towards the exit of the GPIB. spacers on the outer part of the assembly as can be seen in Fig. 2.

Gas injection and pumping systems

Helium injection system

The buffer gas injection system uses a standard 50 L gas cylinder lying on the side of the vacuum chamber (at high voltage) with a standard pressure regulator which is then connected to a mass flow controller (Brooks SLA5850S) to regulate the amount of He injected inside the GPIB. A stainless steel tube is used between the mass flow controller and the vacuum chamber to ensure a leak-tight connection and thereby keep the He (grade 6.0) pure. Inside the chamber a PEEK tube carries the gas to the mid-point of the RFQ to ensure both flexibility for alignment and electrical insulation.

The RFQ has a closed geometry so the gas is quite well confined inside the trapping volume and escapes mainly from the two ends. The response time of the flow regulation is of the order of a second. At its maximum opening, the flow controller delivers 50 cm 3 min -1 of He in standard conditions for temperature and pressure. According to Molflow+ simulations [START_REF] Kersevan | Recent Developments of Monte-Carlo Codes Molflow+ and Synrad+[END_REF] this corresponds to a pressure in the center of the GPIB of roughly 1.6 Pa (i.e. 1.6 × 10 -2 mbar).

Molflow+ is a Monte-Carlo code the optimal reliability domain of which is when collisions can be neglected (ballistic regime). This is clearly not the case in the center of the GPIB as it operates at typical pressures for which the gas flow can be considered neither viscous nor molecular. The agreement between simulations and experimental results (Fig. 9) however shows the MolFlow+ value is probably not too bad.

Pumping system

The pumping system is crucial as He gas is continuously injected in the center of the GPIB while good vacuum must be maintained elsewhere in the beamline. Primary vacuum is achieved in the chamber by means of two dry scroll pumps of respectively 15 m 3 /h and 35 m 3 /h. High vacuum is maintained by three turbomolecular pumps:

• one ⌀ 250 mm 2200 L/s pump mounted directly on the main vacuum chamber (see Fig. 2)

• two ⌀ 200 mm 1600 L/s pumps attached to the 4-way crosses on either sides of the main chamber

These are able to maintain a pressure around a few 10 -7 mbar in the beamline out of the GPIB chamber while He is injected in the RFQ at full flow.

Electrical design

HV platform

The GPIB sits on a high-voltage platform the voltage of which (typically 29.9 kV for a 30 keV beam) is set in reference to the ion source HV platform through a 0-400 V DC power supply (Delta Elektronica SM 400-AR-4).

This way the ion energy is subject only to the small fluctation of this power supply (ripple and noise of the order of 15 mV) and independent of the stability of the HV power supply (ripple of the order of 30 V). Two 5 kV A isolation transformers, one for the ion source and one for the GPIB, decouple the electronics from the wall-plug ground. A third platform is used downstream that can be either grounded to transport the beam at the nominal energy or set 3 kV below the voltage of the GPIB platform. In this last case, the ions are extracted from the GPIB at 3 keV which is useful for two main reasons:

• when injecting into a Penning trap the final energy of the ion when reaching the center of the trap must be smaller than its charge times the trapping voltage (typically a few 10 V). With an initial energy of 3 keV rather than 30 keV the deceleration can be smoother allowing low losses in the transfer,

• electrostatic (i.e. mass independent) ion optics can more easily be used to deflect and focus the beam after the GPIB extraction electrodes.

RF circuit

Frequency range

The equations of motion of an ion inside the RFQ take the form of Mathieu's differential equations [START_REF] Mathieu | Mémoire sur le mouvement vibratoire d'une membrane de forme elliptique[END_REF][START_REF] Paul | Das elektrische Massenfilter[END_REF][START_REF] Blaum | High-accuracy mass spectrometry with stored ions[END_REF]. These have stable (i.e. not diverging) solutions only for limited ranges of the two Mathieu dimensionless parameters and linking the trap parameters and the ion mass to charge ratio as follows

⎧ ⎪ ⎪ ⎨ ⎪ ⎪ ⎩ = 2 2 0 2 = 2 2 0 2 (1)
where and are the charge and mass of the ion, is the amplitude of the RF voltage applied with 180°phase difference to the two pairs of rods, 0 is the distance between the axis and the RF poles, is the frequency and can either be a DC voltage applied between the pair of rods or between axial electrodes. When no DC voltage is applied between the pairs of RF rods and if the DC gradient along the axis is neglected (i.e. = 0), a stable trajectory can be achieved if 0 ⩽ ≲ 0.908.

If one looks for a stronger confinement to counter the effect of Coulomb explosion when a high number of ions are accumulated in the trap, a higher is needed as in the low region the maximum density of ions that can be trapped scales with the square of and inversely with the square of [START_REF] Douglas | Linear ion traps in mass spectrometry[END_REF]. To keep the stability it follows from the condition on that must also be increased. This can be simply understood as if the confining force due to the RF electric field is higher in one plane, the deconfining force in the orthogonal plane is similarly higher. It is then necessary to switch the polarity faster to keep the ions confined in a small distance from the axis. The lighter the ions are the higher the frequency must be.

A widely used quantity to estimate the cooler confining power is the pseudopotential, classically defined by:

= 2 4 2 2 0 2 = 4 (2)
In this approximation, it is considered that the average effect of the oscillating RF potential over one period results in a simple harmonic restoring force confining the ions around the axis. The ion motion is then simply approximated by a fast and low-amplitude motion at the RF driving frequency (micromotion) superimposed with a slow and largeamplitude oscillation in the potential well (secular motion). The depth of the potential well thus gives an estimate of the strength of the confinement that can be compared directly to the transverse energy per charge unit of the ions. It should however be pointed out that the aforementioned approximation is fully valid only while the micromotion amplitude is negligible compared to the secular motion one, i.e. while and 2 ≪ 1. This is usually not the regime in which the GPIB works (see subsection 7.3). If one calculates the pseudopotential regardless of this, the depth obtained as an example for 39 K and = 0.7 is ≈ 200 V if = 1125 V and ≈ 500 V if = 2900 V (maximum value of the RF voltage for such a mass). At its highest RF voltage for such a mass and value, the pseudopotential in ISCOOL would in comparison be around 35 V.

The GPIB being designed to handle large samples of ions with masses from a few up to a few hundreds of atomic mass units, the maximum voltage amplitude was chosen to be ( ) = 3.9 kV (7.8 kV difference at max between two adjacent rods). Keeping this voltage at all times would result in minimal working frequencies ranging from 600 kHz ( = 250 u) to 4.7 MHz ( = 5 u) to stay in the stability region. It is also worth mentioning that this can be worsened when the ion density is increased as space-charge has a similar effet as adding a DC potential between the pairs of poles (meaning the Mathieu parameter is no longer 0). This thereby tends to reduce the range of the parameter for which ion trajectories are stables down to ≈ 0.68 at which value the maximum charge density the RFQ can confine is reached [START_REF] Belov | Optimal pressure conditions for unbiased external ion accumulation in a two-dimensional radio-frequency quadrupole for Fourier transform ion cyclotron resonance mass spectrometry[END_REF]. Such an upper limit on would shift the minimal working frequency range to 700 kHz-5.4 MHz if a 4 kV amplitude was kept. As will be seen in section 5.2.2, this exceeds the circuit's capabilities and such an amplitude will be accessible only below 1MHz as illustrated in figure 3.

Design

The RF power circuit of the GPIB was designed taking inspiration from the SHIRaC2 RFQ cooler [START_REF] Boussaid | Experimental study of a high intensity radio-frequency cooler[END_REF] developed at LPC Caen in the framework of the SPIRAL2 project. As can be seen in Fig. 4 it is composed of the following elements:

• A function generator (Agilent 33500B) which drives the frequency with 10 V maximal output.

• A 500W class-A solid-state amplifier (Prâna GN500). Its frequency band extends from 100 kHz to 200 MHz which covers the whole range of frequency needed. As the power at the input must be limited to 10 dBm (i.e.

10 mW) which is lower than what the function generator can deliver, an attenuator is placed in between for safety purpose. A second one is used at the output of the amplifier when working at intermediate voltages ( ≲ 2 kV) to minimize the wear of the amplifier that works best around full power. It can be removed within minutes if very high RF voltages are needed.

• A custom-made transformer balun circuit (see Fig. 5) so as to both balance the signal between the two pairs of rods in the RFQ and rise the voltage. It is a RLC circuit the capacitance of which is the combination of the intrinsic RFQ capacitance and the one of a motorized accordable capacitor ranging from 50 to 2200 pF (National Electronics CVB 2300AS/15). This latter enables tuning the circuit so that it operates at resonance whatever The upper frequency bound corresponds to the maximal frequency reachable with the S24-24 windings while the lower bound is the minimal frequency for the S38-38 windings. For the last plot, the frequency range is cut at 1 MHz as 3.9 kV is the maximal voltage reachable by the S32-32 circuits and cannot be reached by the S24-24 one (see table 2). the frequency needed to confine the ions in the RFQ. The inductance part is that of the transformer coils formed 209 around a PTFE hollow cylinder (air-coupling). The resulting coupling coefficient is close to 60%. Air coupling 210 was chosen to avoid heating of the core which was found to be enough to demagnetize ferrites.

211

Three different air-coupled windings have been designed to be able to reach resonance for frequencies between Characteristics of the three circuits used to cover the whole frequency range of the GPIB. The mass range is indicative and calculated for = 0.5 and

= 2 kV.
Note that the mass ranges indicated in the table correspond to a specific value and a given RF voltage. The mass ranges can be shifted for example downwards either by choosing a higher value or by decreasing the RF voltage. Each circuit is mounted inside an air-cooled plastic box that is directly plugged into banana plug sockets connected to the RF rods so that it can be changed very easily and within a few minutes.

• Two HV probes (LeCroy PPE4KV) with a divider ratio of 100:1 are connected to the symmetrized branches of the secondary circuit to monitor on an oscilloscope both the voltage and the symmetry on the two pairs of rods inside the RFQ. The ground of the secondary circuit can be adjusted (by translation along a copper bar connecting the two secondary windings) to restore the symmetry between both pairs if needed. Above 4 kV peak-to-peak ( =2 kV) applied on the rods, these probes could be damaged and other probes based on Rogowski coils are under development to overcome this limitation.

• A -50 dB directional coupler is placed in between the amplifier and the balun circuit to measure the transmitted and reflected powers with an oscilloscope. At the maximum power delivered by the amplifier (57 dBm) the substracted power is no more than 7 dBm (5 mW) that represents a voltage amplitude of only 0.7 V on the 50 Ω input of an oscilloscope. Minimizing the reflected power by changing the capacitance of the accordable capacitor enables tuning the balun circuit so as to reach the best impedance matching at the desired working frequency.

The maximum voltage amplitude that can be applied to the rods is given in good approximation by:

= √ 2 = √ 2 2 + (3)
where is the maximum power transmitted to the balun circuit, is the maximal output power of the amplifier, = 50 Ω its output impedance, ≈ 500 Ω is the impedance of the balun circuit close to resonance and is the transformer ratio that depends on the chosen windings. This maximum amplitude can also be found in table 2.

DC circuit

In addition to the four RF rod-electrodes, the GPIB is composed of 3 injection electrodes, 25 DC segments and 3 extraction electrodes (see Fig. 2) that can be biased independently to create voltage gradients to guide the ions in and assembly associated with a bootstrap capacitor which provides a virtual reference for the correct operation of the transistor in the upper part of the half-bridge. This is based on MOSFET technology components (STP11NM60ND from STMicroelectronics) able to withstand up to 600 V amplitude. The switching dynamics (90-10% criterion) is optimized by an RC load integrated at both inputs and at the common output of the board so that:

• the rise time from the switching to the blocking state is less than 15 ns when the amplitude is greater than 100 V,

• the reciprocal fall time is at maximum 90 ns and of the order of 30 ns for amplitudes greater than 100 V,

• both dynamics are associated with low ripples (<5% over 7 µs) and negligible over-or undershoot voltages (<10% over 10 ns),

• the noise is attenuated by at least -50 dB relative to signal (-80 dB on average for amplitudes greater than 50 V) over the bandwidth from 20 Hz to 100 MHz.

Though it can operate at higher rate, the main constraint of the switching circuit is at very low duty cycle operation: 1 Hz to 10 Hz sequences of opening gates between 10 µs to 100 µs as in such a situation the MOSFET transistor controlling the switch must be kept closed most of the time (>99%). A high capacitive load (1 µF) is therefore used to provide the necessary energy reserve so that the gate-source bias of this transistor is maintained. The switch is controlled via an optical coupler (PC817) by a TTL logic signal doubly rectified by a logic gate (CD4011BE) in order to ensure the best possible dynamic control signal. The latter drives a power component ("driver" IR2113BPF) which provides the gate-source bias voltages necessary for opening and/or closing the transistors. The control signal is a 3.3 V "low TTL" type coming from modules (National Instruments NI9215) of a CompactRio Programmable Logic Controllers (PLC) associated with the pulse pattern generator (PPG) through which the user defines the time sequence of the switching. Since this module does not have enough current to activate the photodiode of the optical coupler of the switch, an intermediate TTL signal amplification board had to be installed. The amplification level thus allows the switching delay of each switch to be adjusted and fixed by an integrated potentiometer.

Operating system 6.1. Instrumentation

DESIR beamlines and setups are mainly composed of electrostatic devices and as described in subsection 5.3, the GPIB itself requires 36 High-Voltage DC Power Supplies (HV-DC PS). ISEG Multichannel crates are used for several reasons. The first one is the large variety of low noise, precise and stable HV PS proposed with module ranges from 500 V to 30 kV maximum voltages. The second one is its ability to concentrate a large number of HV channels in a single crate. The GPIB Electronics is in a dedicated rack on a 30 kV HV Platform: a small 19" crate is used to host the GPIB HV PS. The third reason is the CC-24 ISEG crate controller with its built-in EPICS Server (see 6.2). We developed a SPIRAL2-like EPICS Records Database used on all DESIR ISEG Crates.

The GPIB RF field generation is described in section 5.2. The instruments controlled are the function generator, the RF power amplifier and the AKM Kollmorgen brushless motor equipped with an absolute encoder to tune the RF circuit capacitor. Measurements to adjust and monitor the RF circuit resonance (both transmitted and reflected RF voltage amplitude and phase) are done using a standard oscilloscope. Beam measurements are done downstream and upstream from the GPIB using Faraday cups (FC), beam profile monitors (BPM) and chevron-stack Topag MCP-MA33/2 microchannel plates (MCP). The beam position and size are monitored with GANIL-SPIRAL2 BPM [START_REF] Vignet | The beam profile monitors for SPIRAL 2[END_REF] based on secondary electron emission (PREMS) from a mesh of 47 tungsten wires (0.5 mm steps) in both horizontal and vertical directions.

The beam current is measured on GANIL-SPIRAL2 Faraday cups with a -90 V biased electron repeller. These Faraday cups are equipped with high sensitivity "Picolin" transimpedance amplifiers developed by GANIL for the low-intensity CW SPIRAL2 beamline measurements. The highest gain (1 pA V -1 ) with a filtered signal of 0.5 Hz bandwidth makes it possible to observe variations of 10 f A on Faraday cups. The output signal is acquired with a National Instruments NI9215 ADC module used with a 9012 CompactRio controller. Another Digital I/O module is also used to select remotely one of the 8 possible ranges from 1 pA V -1 to 10 µA V -1 .

A second variable gain and high speed transimpedance amplifier (Femto DHPCA-100) is used on the Faraday cup downstream from the GPIB to monitor bunched beams. GPIB bunches with sufficient intensity are "scoped" with a Red Pitaya acquiring this Femto amplifier output signal. This amplifier is also controlled by the Red Pitaya since FPGA developments have been done at LP2iB. The Australian Synchrotron EPICS driver support (see next subsection) has been completed and is used to run the FaradayCup EPICS server in the Red Pitaya itself. Another Red Pitaya development named "RedpiToF" [START_REF] Daudin | CENBG Control System and Specific Instrumentation Developments for SPIRAL2-DESIR Setups[END_REF] has been conducted in our lab to implement high speed counting and time-of-flight capabilities. We are now using this new development coupled with the MCP detector to measure the low-intensity GPIB bunched beam and time dispersion.

Control System

The experimental physics and industrial control system (EPICS) [START_REF] Dalesio | The experimental physics and industrial control system architecture: past, present, and future[END_REF] was chosen to be the basic framework for the SPIRAL2 control system in 2006 [START_REF] Lécorché | Overview of the GANIL Control Systems for the Different Projects Around the Facility[END_REF]. As the GPIB will be part of the main SPIRAL2/DESIR hall beamline, all the equipment needed to operate the GPIB has to be remotely controlled under EPICS [START_REF] Daudin | CENBG Control System and Specific Instrumentation Developments for SPIRAL2-DESIR Setups[END_REF].

EPICS is based on clients (operator interfaces) and servers (input/output controllers or IOC) communicating together sharing process variables (PVs) on an Ethernet network using a dedicated communication protocol named channel access (CA). The architecture of the GPIB EPICS control system is illustrated on Fig. EPICS with its CA protocol makes it easily possible to monitor and control any beamline equipment through its process variables in many programming languages. Specific Python GUIs needed for the commissioning phase of the GPIB have been developed. For example the homemade "Plotpot" application plots in real time the longitudinal electric field seen by the ions along the GPIB axis with respect to the voltage applied on the 31 DC electrodes.

Automation

The SPIRAL2 vacuum systems and interlocks are controlled using dedicated Siemens S7-1500 programmable logic controllers (PLC). The Profibus field bus is used by the GPIB vacuum PLC to communicate with turbo-molecular pumps and Profinet (Profibus on Ethernet Network) is deployed to manage input-ouput terminal modules (ET 200S) distributed along the beam-line and on the high-voltage platforms. Each PLC has its own HMI (Human Machine Interface) on a dedicated Touch Panel. These local HMI can be managed from authorized people on distant machines through a remote desktop or a WinCC user interface. For the commissioning phase of this project, the Profinet network shares the laboratory Ethernet network but at DESIR a dedicated Profinet network will be deployed to secure and harden this Automation system. The Modbus-TCP protocol is used to share parameters managed by the PLC such as the vacuum pressures and beamline valves status with an EPICS Server (soft IOC running on a Linux machine). The control of the GPIB buffer gas injection system, valves or diagnostics insertions are thus easy to reach from any EPICS Client interface.

Simulations and first experimental tests 7.1. PIPERADE beamline at LP2iB

The GPIB is being developed at LP2iB in parallel and close collaboration with the PIPERADE Penning trap [START_REF] Ascher | Piperade: A double Penning trap for mass separation and mass spectrometry at DESIR/SPIRAL2[END_REF] which will also be installed in the DESIR hall. A beamline, pictured on Fig. 7, has been mounted at LP2iB to test both devices with stable beams and to compare the results with simulations that are presented below in subsection 7.2. A Forced Electron Beam Induced Arc Discharge (FEBIAD) ion source is first used to generate ions either from the alkali elements naturally present on the inner surfaces of the source or from gas injected in the source with a regulated flow.

During the measurements reported below, it was used exclusively in the first mode (surface ionization) producing a nat K beam. The source is on a high-voltage platform set typically at 30 kV so that ions are naturally accelerated to 30 keV towards the grounded beamline downstream. All the ion optical elements are electrical so that the settings are massindependent. The beam first goes through two pairs of horizontal and vertical steerers enabling rectification of both a misalignment and a tilt of the source with respect to the beamline axis. One of the steering electrodes can be quickly switched to deflect the beam towards the beam pipe so as to form a poor man's beam gate. A first quadrupole triplet If the deector [START_REF] Chauveau | PILGRIM, a multi-reflection time-of-flight mass spectrometer for Spiral2-S3 at GANIL[END_REF] on the far right is not used the cooled beam goes straight to the PIPERADE Penning traps [START_REF] Ascher | Piperade: A double Penning trap for mass separation and mass spectrometry at DESIR/SPIRAL2[END_REF].

Otherwise the beam can be made to turn 90°either to the left where an emittancemeter will be placed or to the right to the SPIRAL2 High Resolution Separator [START_REF] Kurtukian-Nieto | SPIRAL2/DESIR high resolution mass separator[END_REF][START_REF] Michaud | Status on the DESIR High Resolution Separator Commissioning[END_REF] also developed at LP2iB.

follows immediately to be able to focus the beam on a first retractable Faraday cup allowing for current measurement.

Another X-Y steerer and a second quadrupole triplet follow. The latter is the prototype of the triplets that will be used in the DESIR hall beamlines. The beam profile can be imaged about 20 cm downstream with the help of a retractable multiwire secondary emission monitor ("BPM" on Fig. 7). The beam finally goes through a grounded electrode formed of a conical outer part in which a central cylindrical electrode can be slided (see Fig. 2) to precisely set the potential close to the entrance of the RFQ which follows immediately. The GPIB itself sits on a second HV platform operated a few tens of volts below the one of the source as described in subsection 5.1.

Everything after the GPIB is on a third platform that can be either grounded if a 30 keV beam is wanted or biased with a 3 kV power supply with respect to the first one to extract the beam at 3 keV (the platform voltage with respect to earth is then ≈ 27 kV). At this energy a 90°deflector [START_REF] Chauveau | PILGRIM, a multi-reflection time-of-flight mass spectrometer for Spiral2-S3 at GANIL[END_REF] can be used to make the beam turn towards either a pepper-pot emittance scanner (Pantechnik 1D EMD-PP V02) or the SPIRAL2 High Resolution Separator [START_REF] Kurtukian-Nieto | SPIRAL2/DESIR high resolution mass separator[END_REF][START_REF] Michaud | Status on the DESIR High Resolution Separator Commissioning[END_REF] also developed at LP2iB. If no bending voltage is applied in the deflector the beam goes straight to the PIPERADE Penning traps located about 2 m downstream.

Ion optics simulations

Simulations of ion trajectories were conducted with the SIMION code [START_REF] Dahl | SIMION for the personal computer in reflection[END_REF] that uses a finite difference method to solve the Laplace equation for an array of points and hence calculate the electric field at these points. Both the RF oscillation of the electric field and the effect of the buffer gas are included via an external LUA script called by SIMION. In the simple hard sphere model we used, the collisions of ions with He atoms are purely elastic with no charge exchange, the gas atom velocities follow a Maxwell-Boltzmann distribution and the buffer gas is not affected by the collisions.

The GPIB being designed to cope with high-charge bunches, a special attention was paid to the space charge effects.

This can be handled by SIMION at the cost of much heavier and longer calculations but this becomes impractical on a standard computer for numbers of ions larger than ∼ 10 4 . A much lighter solution is offered by SIMION with a scaling procedure that assigns a + charge to each of the ions flown to simulate the Coulomb effects in a × ions cloud. We first benchmarked the reliability of the scaling method in our case up to ∼ 10 4 ions (see table 3) and found an agreement on the simulated emittance for a given total charge well within the error bar (that was of the order of 10% for 1000 ions). This shows that simulations with 1000 particles are enough to get reliable trends when scanning the parameters and as we are not seeking better precision we thus performed most of the simulations with 1000 particles with a scaling factor of 100 on the Coulomb effects to simulate bunches of 10 Illustration of the consistency of the scaling method for Coulomb repulsion in the SIMION simulations. The ve simulations were performed under the same conditions of initial ion geometric and velocity distributions, buer gas pressure and voltages.

Only the number of particles actually own and the scaling factor is changed. 6-RMS (i.e. including 95% of the ions) and on the transmission through the whole GPIB when the beam is extracted at 3 keV. The emittance ( √ 6-RMS) of the incoming 30 keV beam before entering the GPIB is set at 25 .mm.mrad. The buer gas pressure is xed at 2 Pa. The frequency is varied from 0.489 to 1 MHz so that the Mathieu parameter remains constant at = 0.5 for a mass = 102 u. 10 3 particles were own in the simulations with a scaling factor of 100 representing 10 5 singly-charged ions. The lines are only a guide for the eye. An experimental point measured with a natural potassium beam is also displayed for comparison, however as the 2 Pa pressure can not be reached with the current ow meter, the value was extrapolated using the trend of Fig. 9.

the GPIB, the effect on the emittance is small when the number of ions is increased (a few %) as can also be seen in table [START_REF] Delahaye | New exotic beams from the SPIRAL 1 upgrade[END_REF]. It can nonetheless be seen for the simulations with 10 4 particles as the uncertainty is then only 0.4%.

Simulations were performed to get the trends on transmission and tranverse emittance after the GPIB as a function of the buffer gas pressure, the quadrupole field frequency and the RF voltage. The extraction was chiefly simulated at 3 keV but as we are in a non-relativistic regime the emittance at that energy can simply be converted to what it would be at 30 or 60 keV by:

( 2 ) = √ 1 2 ( 1 ) (4)
where ( ) denotes the emittance at energy . The emittances reported in Fig. 8 and 9 must thus be divided by a factor of respectively ≈ 3.2 and ≈ 4.5 to compare them with the specifications at 30 keV and 60 keV.

GPIB in CW mode

The first tests of the GPIB were performed in continuous beam (CW) mode as it is less demanding for material (no HV fast switches needed) as well as for the control system. It is anyhow a mode in which the GPIB will have to 6-RMS (95% of the ions) and on the transmission through the whole GPIB when the beam is extracted at 3 keV. For these simulations, the emittance ( √ 6-RMS) of the incoming beam before entering the GPIB is set at 25 .mm.mrad, = 2 kV, = 979 kHz ( = 0.5 for mass = 102 u). 10 3 particles were own in the simulations with a scaling factor of 100 representing 10 5 singly-charged ions. The lines are only a guide for the eye. An experimental scan using a natural potassium beam is also displayed for comparison, the coloured band indicating the 1 condence interval. In that case, the pressure is deduced from the ow controller settings as described in section 4.1.

work for some of the experiments that do not want bunched beams in DESIR. In such a configuration, transmission is one of the key issues while the cooling is expected to be worse than in bunched mode as the ions spend less time in the buffer gas (a few 100 µs, depending on initial energy, gas pressure, DC ramp...). It was however not observed to depend strongly on the beam current up to at least a few nA (i.e. the upper limit of what is expected for DESIR radioactive ion beams) as the ion density stays low in CW mode.

An electrical sweep type emittance scanner [START_REF] Billen | Continuously displayed emittance measurements[END_REF] initially built for testing the COLETTE RFQ emittance reduction [START_REF] Lunney | COLETTE: A linear paul-trap beam cooler for the on-line mass spectrometer MIS-TRAL[END_REF][START_REF] Bachelet | Mesure de masse de noyaux à halo et refroidissement de faisceaux avec l'expérience MISTRAL[END_REF][START_REF] Henry | Direct evidence of beam emittance reduction using a gas-filled radiofrequency quadrupole ion guide[END_REF] was used to measure the transverse emittance before and after the GPIB in both the horizontal and vertical planes. It was first installed after the quadrupole triplet immediately following the ion source (see Fig. 7) and then 1 m after the GPIB. The ion source has an emittance of 18 .mm.mrad (± 25%) in each plane at 30 keV quite typical of a FEBIAD source but a little lower than what is expected from the GANIL accelerators. When the line is grounded downstream from the GPIB (meaning the ions have a 30 keV energy) the measured emittance (Fig. 10) is (2.9 ± 0.5)

.mm.mrad consistent with what was expected from the simulations and in compliance with the needs of the setups downstream in the DESIR hall.

The transmission was measured as a function of various parameters (HV platform voltage, buffer gas pressure, frequency, RF voltage, beam current...) and especially the Mathieu parameter with a nat K + beam using the Faraday cups before and after the GPIB to get an absolute measurement of the beam current. These are wide enough (40 mm diameter) to intercept all the ions with the correct optical settings. For the parameter scans the frequency was kept constant as it is difficult to adjust quickly due to the balun circuit and the voltage was thus varied. The transmission depends on all the aforementioned parameters but it was systematically observed to be bad below = 0.2 and frequently an optimum was found close to = 0.65 (see Fig. 11). In addition to the intrinsic transmission of the GPIB, the injection through the narrow opening has also been observed to be a key point for the global transmission. This last point can be tricky as it is not perfectly reproducible from one measurement to another if the source has been switched off in between. This is probably due to the combination of thermal effects playing on the aligment of the beam with respect to the beamline axis and of the small opening of the first quadrupole triplet. A record transmission efficiency of 96(1) % was observed in CW mode after patiently optimizing all the optics upstream from the GPIB but transmissions above 70% are routinely achieved without much effort. The transmission was also studied with an extraction at 3 keV and similar efficiencies were observed. It is also worth noting that this transmission curve is not much affected by the beam ′ ) at 30 keV. The absolute color scale is not directly comparable between the two images as the control and command system was modied in between to help reduce the uctuations. A much shorter time was thus necessary to obtain the same statistical precision on each point. The √ 6-RMS emittance (95% of the ions) is 18 .mm.mrad before the GPIB while it is only 3 .mm.mrad after. The same reduction is observed in the vertical plane with quite similar pictures. During these measurements, the beam current was 1.2 nA.

current up to at least a few nA, the measured curves fitting inside the bounds of the "long-term fluctuations" of Fig. 11.

The experimental transmission data is plotted as a function of buffer gas pressure in Fig. 9 only above 0.16 Pa (10% of the range of the He flow controller). At this value the number of collisions is large enough to disturb the ion motion but not to cool it efficiently leading to a very poor transmission. The latter then improves as the cooling gets more efficient with increasing pressure as expected from the simulations. We did not investigate specifically charge exchange issues as it is expected to be negligible with a singly-charged potassium beam in ultra-pure helium at the low energies involved.

Preliminary studies of the GPIB in bunching mode

Though the final control system will enable switching five electrodes at a time at the exit of the GPIB the first bunching tests have hitherto been carried out switching only one electrode as all the fast switches needed were not yet available. In bunching mode, the time of flight distribution of the ions is measured either with the Faraday cup (large peak current) or with the MCP (if the number of ions is lower than a few 10/bunch). Typical bunch durations are in agreement with what was expected from the simulations with only one switched electrode (∼1 µs).

The energy distribution can also be investigated using a retarding grid placed in front of the MCP detector. Due to the compact geometry of the detector and in order to avoid sparks, the grid can not be biased much higher than parameter (assuming =39 u) for = 900 kHz, ≈ 0.8 Pa for a beam current of 300 pA (1.9 × 10 9 ions∕s) corresponding to ≈ 7.5 × 10 5 ions inside the volume of the GPIB at once. The coloured band labelled "short-term uctuation" indicate the 1 condence interval for each measurement point while the hatched one shows an estimate of the reproducibility based on measurements performed in apparently similar conditions but several days apart (the beamline being shut down, restarted and retuned in the meantime). It can be noted that the transmission does not fall to 0 at the higher limit of the rst stability region ( > 0.908) due to the small fraction of 41 K (also observed in the Penning traps) for which the parameter is lower meaning the true limit above which no transmission should be seen is ≈ 0.908 × 39∕41 ≈ 0.95. A measurement performed with a beam current of 2 nA (1.3 × 10 10 ions∕s) is also displayed showing there is little transmission loss if any.

2 kV. The energy spread measurements are thus performed with an extraction energy below 2 keV (downstream HV platform biased at a voltage >28 kV). An example of simultaneous measurements with the MCP of the time and energy distributions is shown in Fig. 12. Note that the observed energy spread may be somewhat overestimated due to inhomogeneities of the voltage in the grid plane that are currently under investigation on a dedicated test bench. SIMION simulations have shown the GPIB should be able to meet the requirements of the experiments foreseen in the DESIR hall. Either time or energy dispersion can be favoured playing especially on the timing sequence of the switching of the five exit electrodes. Many other parameters have nonetheless an impact on the time and energy distributions of the extracted ion bunch: number of trapped ions, RF voltage, shape and amplitude of the DC ramp inside the GPIB, width and depth of the potential well created at the end of the GPIB, gas pressure... A detailed study concerning the extensive tests in progress will be published later.

Conclusion and perspectives

The future cooler and buncher of the soon-to-be-built DESIR low-energy hall at GANIL has been assembled at LP2i-Bordeaux and tested with a 30 keV nat K + beam. The transmission and reduction of the emittance expected based on SIMION simulations have been demonstrated in continuous mode even with the highest beam current that will be authorized in DESIR. The systematic characterization of the GPIB is however still ongoing in particular concerning the effect of higher voltages on the performances and the different bunching modes to fit the needs of each of the setups in DESIR. None of the data collected so far however indicate that the GPIB would not be able to reach the requirements eventually. The development is at the moment focused on the coupling with the PIPERADE double Penning trap as the whole beamline at LP2iB is now operational. The move to GANIL is presently planned for 2025.

  RF and DC voltages are decoupled as RF is applied on four unsegmented rods while a DC gradient along the beam axis is created thanks to 25 electrodes surrounding the rods with four wedges entering the quadrupole structure. Far from the entrance and exit the DC part of the potential on axis is approximately one quarter of the potential applied to the electrode at the same axial position. Two plates (last injection and first extraction electrodes) close the structure with holes having 9 mm diameter at the entrance and 3 mm at the exit. The overall length of this closed structure is 796 mm. The minimal distance between the optical axis and the RF rods is 0 = 20 mm. Additional pairs of aperture electrodes are placed immediately before and after the structure to ensure good injection and extraction of the beam.

Figure 2 :

 2 Figure 2: CAD view of the GPIB showing the dierent electrodes and the new alignment system going through the vacuum chamber lid. The beam is coming from the left and goes rst through a conical grounded electrode electrically connected to a hollow cylinder with an exit aperture of 12 mm diameter. It then enters the GPIB itself through three injection electrodes whose central holes have diameters of 8, 4 and 9 mm. Inside the GPIB, the twenty-ve DC segments can be seen (light blue). Finally the beam exits the GPIB through three extraction electrodes whose central holes have diameters of 3, 3 and 10 mm and a grounded electrode similar to the entrance one. The top-left inset is a cut showing only the central part of the GPIB to highlight the shape of the DC segments and show the RF feedings (in orange) to the quadrupole rods (in dark grey) through the 13 ℎ (top and bottom rods, also visible on the global drawing) and 14 ℎ (left and right rods) segments.The buer gas is injected through the 12 ℎ electrode (the feeding pipe is not pictured).

Figure 3 :

 3 Figure3: The coloured bands represent the frequency range for which the Mathieu parameter meets the condition 0.2 ≤ ≤ 0.68 (see subsection 5.2.1 for details) as a function of the mass of the singly-charged ions trapped in the GPIB shown for dierent RF voltage amplitudes. The upper frequency bound corresponds to the maximal frequency reachable with the S24-24 windings while the lower bound is the minimal frequency for the S38-38 windings. For the last plot, the frequency range is cut at 1 MHz as 3.9 kV is the maximal voltage reachable by the S32-32 circuits and cannot be reached by the S24-24 one (see table2).

Figure 4 :

 4 Figure4: Schematic of the RF system of the GPIB. The measurement channels are pictured in gray. The rst attenuator is to ensure that the maximum input voltage of the amplier can not be reached. The second one is removable and only used to minimize the wear of the amplier when working at intermediate voltages ( ≲ 2 kV).

  along the RFQ and trap or release them at the end. Grounded electrodes placed immediately upstream and downstream complete this electrode system. The 25 segments as well as the last injection and first extraction electrodes (INJ03 and EXT 01) are biased using a 32 channels 0-500 V power supply (ISEG EHS 20105p) with positive polarity. The 4 outer injection and extraction electrodes are biased with a 4 channels 0-10 kV power supply (ISEG EHS 40100n) with negative polarity. Both power supplies have a ripple and noise level below 10 mV peak-to-peak. The last four segments and the first extraction electrode can be pulsed to bunch the beam. Two bias states -an "open" one at low voltage (a few volts) and a "closed" one at high voltage (>100 V) -switch alternately on a common output channel connected to the chosen electrodes of the GPIB by a RG59 BNC cable with 75 Ω characteristic impedance and low linear capacitance. The switching is obtained using a half-bridge transistor

Figure 5 :

 5 Figure 5: (Left) Global view of the balun circuit corresponding to the right-hand side of Fig. 4. The air-coupled windings are inside the ventilated plastic box on the left, the tunable capacitor is in the middle and its motor inside the metal box on the right. One of the HV probes is visible in the foreground. (Right) The three dierent windings respectively suited for very high frequencies i.e. low masses (top), high frequencies/intermediate masses (middle) and low frequencies/heavy masses (bottom).

6 .

 6 Most of the GPIB electronics is embedded on its high-voltage platform. An optical fiber coupled with Ethernet switches ensures galvanic isolation and TCP communication of the equipment with the EPICS IOCs running on a CentOS Linux PC. Some IOCs are embedded in equipment: this is the case of the ISEG HV multichannel crate (ISEG CC24 Controller) and the Red Pitaya used for beam intensity and time dispersion measurements. Shared software development tools are used such as the SPIRAL2 version of CSS/BOY (CSS-Dev) for defining most of the graphical user interfaces (GUIs) and central services like the data archiver or the alarm handler systems. The SPIRAL2 EPICS distribution and equipment databases already used at GANIL are shared using GANIL Subversion (SVN) Server.

Figure 6 :

 6 Figure 6: GPIB control system layout. Black lines represent Ethernet connections while the orange one symbolizes an optical ber, the green ones the Pronet network and the purple one the Process Field Bus. The CentOS Linux PC on which the EPICS IOCs are running is pictured as a green box.

Figure 7 :

 7 Figure 7: CAD view of the PIPERADE test beamline at LP2iB with the main optical elements and beam diagnostics.If the deector[START_REF] Chauveau | PILGRIM, a multi-reflection time-of-flight mass spectrometer for Spiral2-S3 at GANIL[END_REF] on the far right is not used the cooled beam goes straight to the PIPERADE Penning traps[START_REF] Ascher | Piperade: A double Penning trap for mass separation and mass spectrometry at DESIR/SPIRAL2[END_REF]. Otherwise the beam can be made to turn 90°either to the left where an emittancemeter will be placed or to the right to the SPIRAL2 High Resolution Separator[START_REF] Kurtukian-Nieto | SPIRAL2/DESIR high resolution mass separator[END_REF][START_REF] Michaud | Status on the DESIR High Resolution Separator Commissioning[END_REF] also developed at LP2iB.

Figure 8 :

 8 Figure 8: Simulated eect of the RF voltage on the tranverse emittance at

√

Figure 9 :

 9 Figure 9: Simulated eect of the pressure of buer gas on the tranverse emittance at

√

Figure 10 :

 10 Figure 10: Emittance measured with an electrical sweep type emittance scanner before (a) and after (b) the GPIB in the horizontal plane ( ,′) at 30 keV. The absolute color scale is not directly comparable between the two images as the control and command system was modied in between to help reduce the uctuations. A much shorter time was thus necessary to obtain the same statistical precision on each point. The

Figure 11 :

 11 Figure 11: Example of measured transmission of a nat K beam through the GPIB in CW mode as a function of the Mathieuparameter (assuming =39 u) for = 900 kHz, ≈ 0.8 Pa for a beam current of 300 pA (1.9 × 10 9 ions∕s) corresponding to ≈ 7.5 × 10 5 ions inside the volume of the GPIB at once. The coloured band labelled "short-term uctuation" indicate the 1 condence interval for each measurement point while the hatched one shows an estimate of the reproducibility based on measurements performed in apparently similar conditions but several days apart (the beamline being shut down, restarted and retuned in the meantime). It can be noted that the transmission does not fall to 0 at the higher limit of the rst stability region ( > 0.908) due to the small fraction of 41 K (also observed in the Penning traps) for which the parameter is lower meaning the true limit above which no transmission should be seen is ≈ 0.908 × 39∕41 ≈ 0.95. A measurement performed with a beam current of 2 nA (1.3 × 10 10 ions∕s) is also displayed showing there is little transmission loss if any.

Figure 12 :

 12 Figure 12: Time and energy distributions of nat K + bunches released by the GPIB, simply switching the rst extraction electrode with an extraction energy of 1.89 keV as measured with the MCP detector and its retarding grid. The cooling time inside the GPIB was 20 ms, the RF parameters were = 999 kHz and = 1125 V corresponding to = 0.71 for = 39 u and the buer gas ow was set at 50% of the controller range (≈0.8 Pa according to simulations). The energy FWHM is Δ = 27 eV while the time of ight FWHM is Δ = 0.7 µs.

Table 1

 1

		< 1 eV	< 10 µs	1 -200 Hz
	Penning trap	a few eV	∼ µs	1 -30 Hz
	MR-ToF-MS	< a few 10 eV	< 100 ns	50 -100 Hz

Table 2

 2

	Circuits	S38-38	S32-32	S24-24
	Mandrel ⌀ (mm)	40	40	20
	Primary (turns)	2	2	2
	Secondary (turns)	2 × 38	2 × 32	2 × 24
	Inductance ( H)	≈ 165	≈ 85	≈ 17
	Frequency range (kHz) 260-720 350-1000 750-2150
	RF power transmission 92-100 eciency (%)	97-100	75-85
	Max voltage (V)	±4600	±3900	±2900
	Mass range (u)	>190	>100	20-170

Table 3

 3 5 ions. Due to the large dimensions of

	Number of	Simulated emittances ( .mm.mrad)
	simulated ions 10 3 particles own 10 4 particles own
	10 3	4.41 ± 0.44	-
	10 4	4.36 ± 0.44	4.48± 0.02
	10 5	4.68 ± 0.47	4.72± 0.02

and 2150 kHz corresponding to masses between 10 and several hundred atomic mass units (see table2).

Acknowledgements

Funding: The PIPERADE project including the GPIB was supported by Région Aquitaine (convention 2011 1604 001), Agence Nationale de Recherche (ANR-2011-BS04-020-02) and the Max Planck Society.

The technical drawings of ISCOOL on which the mechanical design of the GPIB was based were provided by CERN. Expert advices given by J.-F. Cam from LPC Caen have been a great help in designing the RF system of the GPIB as was the assistance provided by L. Lasne from the University of Bordeaux with both the balun circuit and the electronics of the switches. We are also grateful to F. Delalee and L. Serani for their help in the early stages of the project.


Fatma-Zohra El

Rania Talbi

Sara Bouchenak

Vlad Nitu

Towards Mitigating Poisoning Attacks in Federated Learning

Federated learning is a new machine learning trend that, guided by privacy goals, distributes learning across multiple participants who train the model collaboratively without sharing their data. Nonetheless, it is vulnerable to a variety of attacks such as data and model poisoning. In these attacks, adversaries attempt to inject a backdoor task in the model along with its main task during the training phase. After that, the injected backdoor is exploited at inference-time given a specific trigger. Many state-of-the-art mechanisms that rely on model update auditing have been proposed to mitigate poisoning attacks. We show in this paper that attackers are still capable to evade such detectors by crafting model updates that mimic benign ones. In this paper, we propose ARMOR, a novel mechanism that successfully detects these backdoor attacks in Federated Learning. We describe the design principles of ARMOR based on generative adversarial networks. And we present ARMOR's evaluation results on a real world dataset, which demonstrates that it outperforms its competitors.

Introduction

Federated Learning (FL) is a trending framework that allows to carry orchestrated collaborative machine learning without explicitly exchanging training data, thus, improving user data privacy [START_REF] Yang | Federated machine learning : Concept and applications[END_REF]. Due to its interesting guarantees, it was rapidly adopted in many thriving application domains such as next-word prediction [START_REF] Yang | Applied federated learning : Improving google keyboard query suggestions[END_REF], speech recognition [START_REF] Guliani | Training speech recognition models with federated learning : A quality/cost framework[END_REF], self-driving cars [START_REF] Pokhrel | A decentralized federated learning approach for connected autonomous vehicles[END_REF], and many more. Nonetheless, despite its advantages, it has been demonstrated that Federated Learning is highly vulnerable to many client-side attacks since it is user-driven [START_REF] Lyu | Threats to federated learning : A survey[END_REF]. In this work, we mainly focus on data and model poisoning attacks that target FL robustness [START_REF] Bagdasaryan | How to backdoor federated learning[END_REF][START_REF] Fung | Mitigating sybils in federated learning poisoning[END_REF][START_REF] Mhamdi | The hidden vulnerability of distributed learning in byzantium[END_REF]. In these attacks, adversaries attempt to inject a backdoor task in the FL model along with its main task. This backdoor assigns an attacker-chosen label to input data with a specific trigger. For instance an attacker can bypass a facial-recognition-based authentication system by assigning to his images a wrong identity-label that is authorized to access the system. Detecting poisoning attacks in Federated Learning is a challenging problem since participants only send model updates to the FL server instead of sending their raw training data. Consequently, the FL server holds less information about user behavior to detect malicious participants. Many state-of-the-art mechanisms have been proposed to mitigate poisoning attacks [START_REF] Blanchard | Machine learning with adversaries : Byzantine tolerant gradient descent[END_REF][START_REF] Pillutla | Robust aggregation for federated learning[END_REF][START_REF] Sun | Can you really backdoor federated learning ?[END_REF]. Even though these mechanisms have various poisoning detection rules, they all rely on auditing the shape of model updates sent by FL participants to find suspicious ones. In this paper, we show that attackers are still capable of evading such detectors by crafting model updates that mimic benign FL participants' updates. We propose ARMOR, a novel attack detector that is based on GANs, in order to analyze the information that model updates capture about user data, instead of monitoring model updates' geometric shapes.

The rest of this paper is organized as follows. Background and problem statement are introduced in Section 2. ARMOR design principles are described in Section 3. We carry an empirical evaluation comparing ARMOR with state-of-the-art detectors in Section 4, present related work in Section 5, and conclude in Section 6.

Background and Motivation

Background on Federated Learning

Federated Learning (FL) is a new trend for machine learning that provides better user data privacy, by distributing learning across multiple participants who train the model on their local data [START_REF] Yang | Federated machine learning : Concept and applications[END_REF]. For example, multiple participants can jointly train a next-word predictor for keyboards without revealing their information, the data is kept on the participant's device and only the model parameters are transferred to a FL server (a.k.a. aggregator). This allows participants to compute their model updates locally and independently, while maintaining a level of privacy. Federated learning consists of several global rounds, where a typical learning round includes the following sequence : (i) A random subset of participants (i.e., clients) is selected to receive the global model synchronously from the server ; (ii) Each selected client trains the model on its local data and updates it ; (iii) Model updates are sent from the selected clients to the server ; (iv) The server aggregates the received model updates (usually by averaging) to build an improved global model.

Attacks and Threat Model

In this paper, we are interested in poisoning attacks where an active attacker takes over one or multiple user devices in order to carry targeted poisoning attacks throughout the training process, to provoke misclassification of a subset of particular data samples S to a target class C t . The attacker crafts his data samples by overlaying a pattern P * over existing data points and changing their labels to his target class. We consider two types of poisoning attacks proposed by Bagdasaryan et al. in [START_REF] Bagdasaryan | How to backdoor federated learning[END_REF]. The first one, being the naive approach (data poisoning attacks), consists in training the model simply on backdoor data as well as correctly labeled data, the attacker can also play on the parameters of the model, such as the learning rate as well as the number of local training epochs, etc. in order to maximize the overfitting on the backdoor data.

FIGURE 1 -Attack effectiveness under various attack frequencies

The second approach relies on model replacement, where the attacker ambitiously attempts to replace the global model with a malicious one by computing the value of the gradient descent that allows poisoning the model. This method guarantees that the attacker's contribution remains effective when aggregated with those of benign participants. Moreover, the results show that this approach allows 'oneshot attack' i.e. the global model has a high accuracy on the backdoor task immediately after its poisoning. Furthermore, [START_REF] Bagdasaryan | How to backdoor federated learning[END_REF] demonstrates that model poisoning attacks are much more effective than data poisoning in FL environments, where a single, non-complicit malicious participant aims to make the model misclassify a set of chosen inputs with high confidence.

Problem Illustration

The goal of poisoning attack is to produce a model that achieves high accuracy on both the main task and a backdoor task chosen by the attacker to avoid the detection. Furthermore, the model must maintain high accuracy on the backdoor task for several rounds after the attack, because the attacker is not always selected in the federated learning process. In Figure 1, even with 10% of malicious participants in the system, the attack target task is sustainfully injected in the model without impacting the main task accuracy. However, higher attackers' percentage can deteriorate the model utility.

Design Principles of ARMOR

Generative Adversarial Networks

Generative Adversarial Networks (GANs) are models that try to generate the input distribution of a given model in a way that is as realistic as possible. Roughly speaking, the goal of a GAN is to predict the features of data samples given a label instead of predicting a label based on input data's features. A GAN consists of two models, the first model is called a Generator (G), and the second is a Discriminator (D). On one hand, the Generator aims to build a model that generates fake inputs of specific targets that are as realistic as possible. On the other hand, the Discriminator has the objective of distinguishing between the fake data of the generative model and the real data. The adversarial training of GANs is done in a way that maximizes both of the aforementioned objectives until a Nash equilibrium is reached.

Overview of ARMOR

We propose a novel FL data poisoning detection mechanism called ARMOR that addresses the threat model described in Section 2.2. Our solution does not make any assumptions neither on the proportion of attackers in the system, nor on their data distributions.

The insight behind ARMOR is as follows. Let T be a backdoor task that aims to misclassify a subset of data samples that belong to a source class C s and that hold a particular data pattern P * into a target class C t . At an FL round i, if the backdoor task T is successfully injected within the model w i , the class-representatives of the target class C t that can be generated based on this model, would tend to be confused with the source class C s , when they are fed to the models of the previous rounds. Based on this intuition, when auditing a model w i , ARMOR monitors the difference between the loss obtained when feeding class representatives to this model w i and the testing loss obtained when feeding the same data samples to the models of the two previous rounds. If this difference is too high compared to a given threshold, the current model is considered to be corrupted and a rollback to the previous version of the model is necessary. Thus, the detection formula is the following :

f(w i , w i-1 , w i-2 ) = 1, if L(D,w i )-L(D,w i-1 ) max(L(D,w i ),L(D,w i-1 ) > γ 1 and L(D,w i )-L(D,w i-2 ) max(L(D,w i ),L(D,w i-2 ) > γ 2 0, otherwise (1)
In order to generate class-representatives, ARMOR relies on a set of Generative Adversarial Networks (GANs) that are trained on the server-side based on users' model updates. The total number of these GAN models is equal to the number of target classes of the FL model, where each GAN is trained to generate data samples of a given class at a round i. In ARMOR, each GAN network GAN ki used to build representatives of a class C k at an FL round i consists of a generator and a discriminator. The generator outputs data points that look like data of a given label. The discriminator has an identical structure as the federated model except that it is augmented with an additional class that represents fake data samples. The generator is trained while maximizing the number of data points that bypass the discriminator while the latter has the opposite objective. The adversarial training of the two models is carried through multiple epochs, where each epoch consists of three phases. First, the discriminator is updated based on real data samples. Since the server does not hold real data points, the latter is gradually updated using the local user updates. After that, the discriminator is updated using fake data samples obtained from the generator, and last, the generator is updated based on the output of the discriminator when observing fake data. The process is repeated until the generator outputs data samples that are classified to the target class with high accuracy. The resulting class representatives are then fed to the current model w i and the last two models from previous rounds w i-1 , and w i-2 . The testing loss is computed for each one these model versions and then used to detect poisoning via formula 1. If a poisoning is detected a rollback to the previous model version is done. The detailed detection process implemented in ARMOR is provided in Algorithm 3.2.

Algorithm 1 ARMOR Poisoning Detection

Inputs : Model at current round w i , models at previous rounds w i-1 , and w i-2 At each iteration i do : Generate a random noise vector X (t) ← Random()

1: for k ∈ 1..K do 2: Consider GAN ik = (G ik , D ik
6:
Feed the random noise X (t) to the generator to get fake data F (t) ← G ik (X (t) )

7:

Feed the fake data F (t) to the discriminator p (t) ← D ik (F (t) )

8:

Update D ik by computing L(p (t) , C fake )

9:
Update G ik by computing L(p (t) , k) Output the class-representatives Z k ← F (t)

13:

Feed the class-representatives to w i , w i-1 , and w i-2

14:

y i ← w i (Z k ), y i-1 ← w i-1 (Z k ), y i-2 ← w i-2 (Z k ) 15:
Compute the testing loss for w i , w i-1 , and w i-2

16:

L i ← L(y i , k), L i-1 ← L(y i-1 , k), L i-2 ← L(y i-2 , k) 17: if f(w i , w i-1 , w i-2 ) =1 then : 18:
Rollback to the previous model version w i = w i-1

19: break 20: end for

Experimental Evaluation

Experimental Setup

Our experiments are conducted using the real-world Fashion-MNIST dataset, which contains 50,000 training images and 10,000 test images [START_REF] Xiao | Fashion-mnist : a novel image dataset for benchmarking machine learning algorithms[END_REF]. We trained a model with 10 clients selected each round. We employ a 4-layer Convolutional Neural Network and simulate a non-IID data ComPAS'2021 : Parallélisme/ Architecture/ Système / Temps Réel MILC -Lyon, France, 5-9 juillet 2021 distribution using the Dirichlet distribution [START_REF] Hsu | Measuring the effects of non-identical data distribution for federated visual classification[END_REF]. In each learning epoch, the clients train the models with 10 local epochs, and with a learning rate λ = 0.1. To evaluate our detector, we have implemented an attack that consists in modifying the classification for the images that contain an artificial pattern, added on the images in the attacker's dataset. Furthermore, we trained the model with the projected gradient descent (PGD) [START_REF] Wang | Attack of the tails : Yes, you really can backdoor federated learning[END_REF] so that the attacker's model does not diverge much from the global model in each epoch.

Evaluation Results

To test the efficiency of our detector, we analyzed three state-of-the-art detectors MultiKrum [START_REF] Blanchard | Machine learning with adversaries : Byzantine tolerant gradient descent[END_REF], Trimmed Mean [START_REF] Mhamdi | The hidden vulnerability of distributed learning in byzantium[END_REF] and Norm Difference Clipping (NDC) [START_REF] Sun | Can you really backdoor federated learning ?[END_REF]. For each detector, we examine the accuracy of the main task, and the success rate of the attack with different poisoning methods (i) blackbox (data poisoning) where the attacker only alters the data in order to insert a backdoor, but respects the FL optimization algorithm, (ii) whitebox (model poisoning) : the attacker disobeys the protocol and relies on model replacement to substitute the global model with their local model. we can observe that ARMOR is able to detect the attack even if it occurs in every epoch. Due to label flipping, the features of class representatives are modified and therefore, a loss difference between the model at epoch t and epoch t -1 helps to detect the attack.

Related Work

Detecting attacks is generally much more challenging than attacking the FL framework. Many of the protection mechanisms are coming from the domain of distributed ML and rely on robust statistic mechanisms such as trimmed mean or geometric median. One of the most prominent and popular protection mechanisms of this kind is Krum [START_REF] Blanchard | Machine learning with adversaries : Byzantine tolerant gradient descent[END_REF] which relies on the robust property of the median to measure the central tendency of the gradient. At the end of each epoch and for every received model update, the FL server will sum the distance to its n -f -2 closest neighbours. Finally, the server will compute a gradient step with the update that minimize the above computed sum. In the geometric representation of the model updates, this is the vector closest to the barycenter. The authors also presented an improved variant (called Multi-Krum) which interpolates between Krum and averaging, thereby allowing to mix the resilience properties of Krum with the convergence speed of averaging. Pillutla et al. [START_REF] Pillutla | Robust aggregation for federated learning[END_REF] introduces RFA, an algorithm which aggregates the local models by computing a weighted geometric median using the smoothed Weiszfeld's algorithm. However, these mechanisms based on geometric median rely on a central assumption which is often not true in FL setups. They assume that all training participants have similar learning objectives therefore their model updates will point to similar directions. Due to its relatively different objective, the vector sent by an attacker will differentiate from the other honest participants and can be filtered out. However, in FL, the data is non independent and identically distributed (non-IID) among the paritcipants so their update vectors will be more scattered in space. Sun et al. [START_REF] Sun | Can you really backdoor federated learning ?[END_REF] relies on the assumption that attackers will send model updates with larger norms and therefore introduces a protection mechanism based on norm-clipping. The model updates with large norms will be reduced so that their magnitude will become comparable with all other model updates. In the same paper, the authors introduced another model protection mechanisms based on differential privacy. The FL server perturbs all model updates received from the FL workers with Gaussian noise. Therefore, the attack objective of a malicious user will be slightly diverged, but with the cost of also degrading the quality of honest updates. ARMOR relies on a more elaborate detection mechanisms so the malicious model updates can be individually identified and filtered out. Unlike the detection mechanisms presented above, ARMOR does not rely on auditing the shape of model updates, but instead focuses on their informational essence and the impact that they have on the trained model. As we have shown in Section 4, ARMOR overpasses all state-ofthe-art detection mechanisms.

Conclusion and Future Work

In this paper we propose ARMOR a GAN-based detection mechanism that mitigates targeted data and model poisoning attacks in Federated Learning. ARMOR analyzes the information captured by model updates about user data, instead of monitoring their geometric shapes like other state-of-the-art mechanisms. Therefore, we have demonstrated the effectiveness of our detection mechanism against various poisoning attack scenarios that state-of-the-art detection mechanisms fail to detect. In future work, we intend to extend our evaluation by considering other machine learning tasks such text analysis. We are also exploring other improved poisoning detection strategies that determine the exact attack source as well as reduce the computational overhead induced by our solution.

ComPAS' 2021 :

 2021 Parallélisme/ Architecture/ Système / Temps Réel MILC -Lyon, France, 5-9 juillet 2021

ComPAS' 2021 :

 2021 Parallélisme/ Architecture/ Système / Temps Réel MILC -Lyon, France, 5-9 juillet 2021

  )

3 :

 3 for e ∈ 1..Epochs do 4: D ik ← AverageModels(w i * 1 epochs , D ik ) 5:

FIGURE 2 -

 2 FIGURE 2 -Attack effectiveness under various state-of-the-art defenses