## 3 Proposed Testbed for Cybersecurity Analysis of Nuclear Power Plants
### Asherah NPP Simulator (ANS) and Its Adapted Modbus Communications Interface  
The Asherah NPP Simulator (ANS) was specially developed for cybersecurity assessments, by the University of Sao Paulo, Brazil [4,7]; in the framework of an international cooperation project sponsored by the International Atomic Energy Agency (IAEA). It has a core design that mathematically simulates the nuclear physics of the Three Mile Island (TMI) reactor, the 2772 Mwt Pressurized Water Reactor (PWR) Babcock and Wilcox (B&W). In addition to the core, it also simulates the various instrumentation and control (IC) modules required to operate the several subsystems commonly found in a real nuclear power plant [4]. Its unique features and the absence of similar research software availability determined the choice of ANS for our testbed. The high degree of complexity and realism of ANS could only be achieved by the developing work [35,36], and the verification and validation activities [4] performed by the developers with the support of experts involved in the IAEA CRP Enhancing Computer Security Incident Analysis at Nuclear Facilities. The proprietary software Simulink/MATLAB provided the adequate environment for the development of the ANS' 3200 blocks and more than 250 scripts. Simulink/MATLAB is the one of the two proprietary software used in our setup (the other being the OS Windows 10). In spite of this, the Simulink/MATLAB software is widely available in university laboratories around the world. ANS itself can be provided to IAEA member states upon formal request at [6]. In its current version, ANS can be deployed without the need of Matlab/Simulink, as a \begin{table}
\begin{tabular}{c c c} \hline \hline
**Function Code (Decimal)** &
\begin{tabular}{c} **Function Code** \\ **(Hexadecimal)** \\ \end{tabular} & **Description** \\ \hline
01 & 0 \(\times\) 01 & Read Coil Status \\
02 & 0 \(\times\) 02 & Read Input Status \\
03 & 0 \(\times\) 03 & Read Holding Registers \\
04 & 0 \(\times\) 04 & Read Input Registers \\
05 & 0 \(\times\) 05 & Write Single Coil \\
06 & 0 \(\times\) 06 & Write Single Register \\
15 & 0 \(\times\) 0F & Write Multiple Coils \\
16 & 0 \(\times\) 10 & Write Multiple Registers \\ \hline \hline \end{tabular}
\end{table} 
Table 2: Common Modbus function codes. \begin{table}
\begin{tabular}{c c c c} \hline \hline
**Section Designation** & **Read** & **Write** & **Address Range** \\ \hline Coils & YES & YES & 00001–09999 \\ Discrete Inputs & YES & NO & 10001–19999 \\ Input Registers & YES & NO & 30001–39999 \\ Holding Registers & YES & YES & 40001–49999 \\ \hline \hline \end{tabular}
\end{table} 
Table 3: Modbus addressing scheme. runtime standalone version or in a docker/container [37] application (also without the need of any proprietary software). In Figure 5, we can see a general view of the ANS subsystems, divided into three subsections. The two above, from left to right, show: (a) the control loops and protection system; and (b) primary and secondary loops. The bottom subsection shows the external interface, comprised mainly by the Comm Module and Matlab Historian. In the version used (Windows--Release 14 dec 20), ANS was specially prepared to communicate via the OPC UA protocol (Open Platform Communications Unified Architecture).