Digital PDFs

XX-205A3-D8

April 2000

50 pages

Original

0.2MB

Document:	PDP10/X System Manual
Order Number:	XX-205A3-D8
Revision:
Pages:	50
Original Filename:	http://www.fpgaretrocomputing.org//pdp10x/arch10x.pdf

OCR Text

PDP-10/X System Manual

Dave Conroy (dgc@fpgaretrocomputing.org)
April 24, 2012

12-Jan-2008

Initial version. Based on the text from the LaTeX version, but considerably reworked to include all of the thinking about how the APR device should work, how
traps and errors should work, and so on. None of the hardware that has been
designed so far conforms to this specification, although its not wrong by much.

30-Jan-2008

I finally figured out the right way for the address mapping while the ROM is
running to work (and I got to use the word moby in one of the canonical ways).
Major changes to the section on PAG, and the section that describes how the ROM
works.

02-Apr-2008

Minor revisions, mainly around the implementation of floating point, including
KA-style double precision. Some reformatting of the opcode table to make it more
readable.

21-May-2008

Changed the way the APR interrupts for bus and paging errors get generated. In
the old design there were flags for bus error and paging error. In the new design
there are flags for soft error and hard error, and a soft error is sometimes turned
into a hard error. This works better because a soft error generated in a PI routine
will get transformed into a hard error (and get into DDT) rather than halting.

01-Jun-2008

Changed the RTC device to include the 36-bit free-running timer.

08-Jun-2008

Changed the RTC device to so that the 36-bit free-running timer is reset by the
power-on reset, not the I/O reset. This allows the ROM to read the date/time
clock once, rather than having to teach ITS how to read it after every I/O reset.

23-Jun-2008

Changed the way APR interrupts work again, this time to make it easy to context
switch the trap enables and (possibly) ask for a fake soft error (needed by code
that uses XCTRI) with a single CONO.

14-Jul-2008

Changed all of the ASCII art for instructions and registers to use tables in a clever
way. There are still some ugly page breaks, but overall the idea of using tables
with no edge lines in some cases works.

17-Jul-2008

Eliminated previous mode. XCTR and XCTRI always redirect into user mode.
This is what ITS really wanted. Removed a bunch of JRSTF instructions from
ITS whose only purpose was to force PM = 1.

27-Sep-2009

Switched to the DS1337 real-time clock. The DS1337 does not have the DS1338s 56
bytes of non-volatile memory, but does come in a wider array of packaging options,
including an 8-bit DIP option that is well suited to being used on a prototype.

20-Mar-2011

Added a new section to describe the ETH interface, including details of how the
16-bit and 32-bit packing and unpacking works.

18-Feb-2012

Switching from LaTeX was a mistake, so I switched back. Added the TA bit to
the TTY device so that the transmit side could be flushed before an I/O reset.
Added a new section to APR that describes how software can determine that this
is indeed a new implementation of the architecture.

Chapter 1

Introduction
This document describes the PDP-10/X, a new implementation of the venerable PDP-10 architecture from Digital
Equipment Corporation.
This document describes the PDP-10/X at a level appropriate for assembly language programmers, and includes
considerable information regarding low-level I/O device programming. It is not a complete description of the PDP10 architecture (the original DEC manuals serve this function), although does describe details of the architecture in
places where the DEC manuals are unclear and/or there is a tradition of variation from model to model. It is also
not a complete description of some of the I/O components (the manufacturer’s data sheets and external standards
serve this function), although it does describe how the components are interconnected.
The PDP-10/X has three major blocks.
The first block is the processor (APR). The APR block is a new hardwired model of the PDP-10 that most closely
resembles a KA10 to which ITS paging has been added (for example, it implements KA10-style floating point
arithmetic, it has one block of ACs, the MUUO and PI instructions are read from fixed locations in memory, and
APR conditions such as traps and page failures are reported using the PI system) but which is not exactly compatible
with the KA10 (for example, some of the quirks of the KA10s implementation that were fixed in all later models are
fixed).
The second block is the pager and memory controller (PAG). The PAG block responds to all memory references made
by the APR block, translating virtual memory addresses into physical memory addresses, in a way that is appropriate
for ITS, when necessary. The PAG block implements 22-bit addressing, but the PDP-10/X only implements 512KW
of memory (using five 512Kx8 55ns SRAMs) so only 19 address bits are actually used. It might seem more appropriate
to perform address translation in the APR block, but putting it in the PAG block allows the in-memory structures
used when translating addresses to be accessed more efficiently.
The third block is the basic I/O system (BIO). The BIO block contains the I/O devices needed by a basic, but
complete, ITS system; a line frequency clock, an real-time clock with a battery backup (to keep track of the date and
time, even when the system is not running), a console terminal interfaces, a disk interface, and an ethernet interface.

The line frequency clock does not actually run off the line (it runs off the crystal used to generate the bit clock for
the console terminal) so it always runs at 60 Hz, even if the system is running off a battery.
The console terminal interface communicates with 2-wire RS-232 devices at 9600 bits per second. The programming
model is more like a traditional DEC interface than any industry-standard interface, and is designed to simplify the
modifications to the ITS terminal driver (a previous PDP-10 design used an industry-standard 16450/16550 UART,
and the modifications to the ITS terminal driver to handle such a UART were harder to do than they first appeared
to be; its hard to make a 16450/16550 generate a transmit-side PI on demand).
The disk interface drives one or two ATA-2 disks. All disk transfers are performed using programmed I/O (programmed I/O is almost as good as DMA in a system like the PDP-10/X, since an ATA-2 disk contains a sector buffer,
and provides data in a long burst that would monopolize the memory and cause the APR to stop dead anyway), and
since disk DMA is not used, disk-like devices that are more-or-less compatible with the ATA-2 standard but do not
support DMA (like compact flash cards) can be used. The disk interface does not resemble any traditional PDP-10
design.
The ethernet interface drives a WizNet WIZ830MJ embedded ethernet module, which uses the WizNet W5300
ethernet controller. The controller can be run either in a mode where it is little more than an ethernet chip with
128KB of shared buffering or in a mode where it contains a complete, albeit fairly simple, TCP/UDP/ICMP/IP
stack (which is useful when writing simple stand-alone applications that need to talk to the network). The ethernet
interface can transfer data between the APR and the W5300 in either big-endian or little-endian order, both of which
are used by the CHAOSNET.
The three blocks (APR, PAG, BIO) are fairly independent, and at one point in time the PDP-10/X plan was to place
them in three separate FPGAs, and generate clocks and resets using MSI components. However, all three blocks
ended up fitting (with quite a lot of space to spare) in a single FPGA, and this is how the PDP-10/X is actually
constructed.
The PDP-10/X runs a custom version of the Incompatible Timesharing System (ITS), created and maintained at
MIT between 1966 and 1990. The PDP-10/X runs ITS both for its obvious hack value, and because a complex
project like the PDP-10/X is best tackled in stages, and ITS will run on a somewhat simpler system than either
TOPS-10 or TOPS-20/TENEX. Some thought has been given to running TOPS-10 and/or TOPS-20/TENEX, and
the structure of the system is suitable for building a version of the PDP-10/X capable of running a modified version
of TOPS-10 and/or TOPS-20/TENEX (the vast majority of the changes to the hardware are, of course, in the PAG
block).

Chapter 2

APR
2.1

Instruction Formats

The APR implements the user-mode architecture of the KA10 (including the somewhat odd KA10 double-precision
floating point), although it does not replicate the quirks of the KA10 that were eliminated from all later models (for
example, the fact that adjustments to things like stack and byte pointers were done with fullword adds and subtracts,
and that a carry in the right half could ripple into the left half), nor does it replicate the incorrect answers that were
generated by some KA10 instructions when presented with corner-case operands (usually 400000000000).
Non-I/O instructions use the standard PDP-10 instruction format.
0

I/O instructions have bits [00..02] = 111, and use the old-style I/O instruction format.
0

1
7

6
D

11
C

13
I

26
Y

The D field specifies the device and the C field specifies the I/O command in the traditional way. The APR does not
implement BLKI (C = 0) or BLKO (C = 2), and the behavior of an instruction with a C field of 0 or 2 is undefined
(the implementation treats BLKI as DATAI and treats BLKO as DATAO). By convention, bits D[03..05] specifies
the major device, and bits D[06..09] specifies the register within the device, if needed.
ITS was originally desiged for the KA10 (and its predecessor, the 166), and although ITS can (and was) made to
work on newer models of the PDP-10, the executive mode architecture of those newer models (process tables, page
failures that are not reported via a PI) is somewhat at odds with the design. For this reason the executive mode
architecture of the APR resembles that if the KA10, albeit one with paged memory management; there is a single
block of ACs, the MUUO and PI vectors are in fixed locations in low memory, and traps and errors are reported

using the PI system.
The APR blocks internal I/O devices (APR, PI) are considerably different from that of the KA10; the set of traps
and errors is different, any trap or error can be assigned to one of two PI levels, and there are some special features
to simplify the ITS context switch.

2.2

Flags and PC

A
O
V

C
Y
0

C
Y
1

F
O
V

F
P
D

C
M

F
X
U

D
C
K

The APR has no public mode, so bit [00] is always the AOV flag, and bit [07] is always 0. The APR has no user
I/O mode nor previous mode, so bit [06] is always 0. The APR has no address failure inhibit, so bit [08] is always
0. The APR has a KA10-like APR trap architecture, so bits [09..10] (the TRAP1 and TRAP2 flags) are always 0.
The FPD flag is used by ILDB and IDPB to distinguish between the case where the byte pointer needs to be
incremented before the byte is loaded or deposited (FPD = 0), and the case where the increment is not needed
because it has already happened (FPD = 1), because the ILDB and IDPB instructions can be interrupted after the
byte pointer has been incremented (BLKI and BLKO would have a similar problem if they were implemented, but
they are not). ILDB and IDPB set FPD = 1 if they are interrupted after the byte pointer has been incremented,
and set FPD = 0 if they run to completion. A few other insttructions (IBP, PUSHJ, JSR, JSP) also set FPD = 0 if
they run to completion (the fake JSR that is part of a PI sequence sets FPD to 0 just like a real JSR).
A user mode program (CM = 1) can only set CM to 0 by taking an interrupt or executing an MUUO.

2.3

JRST

The APR, like the KA10, treats the AC field of JRST as a set of bits, each of which enables a special function.
[09]

If one or more priority interrupt levels are active dismiss the highest priority level; do nothing if no priority
interrupt levels are active

[10]

Halt.

[11]

Restore the flags from the left half of the word last read by the effective address calculation, be it an indirect
address word or an accumulator used as an index register. If the effective address calculation does not read
any words (if the initial instruction word does not specify indirection or indexing) the flags are restored
from the left half of the instruction word. A JRST with bit [11] set to 1 only loads CM if CM is set to 0; a
program running in user mode, with CM set to 1, cannot set CM to 0.

[12]

Set CM to 1 (user mode).

In executive mode (CM = 0) all special functions are allowed, although bit [12] is ignored if both bit [11] and bit
[12] are set to 1.
In user mode (CM = 1) only the special function enabled by bit [11] is allowed. A JRST with any or all of bits [09],
[10], or [12] set to 1 is treated as an MUUO.
The APR implements JRST with bit [11] set to 1 by keeping track of the left half of the last word as a side effect
of the evaluation of the effective address. Some implementations (for example, the KS10), re-evaluated the effective
address assuming that PC-1 was the address of the JRST, which is incorrect in some cases (for example, when the
JRST is the target of an XCT).

2.4

MUUO and LUUO

The APR handles LUUO and MUUO instructions in almost the same way. A word containing the LUUO/MUUO
opcode in bits [00..08], the LUUO/MUUO accumulator field in bits [09..12], zeros in bits [13..17], and the effective
address in bits [18..35] is stored in some location 000040, and then the instruction in some location 000041 is executed.
If the instruction is an MUUO then the instruction word is stored in location 000040 of the executive mode address
space, and the instruction in location 000041 of the executive mode address space is read and executed in (temporarily
forced) executive mode; if the instruction in location 000041 is a JSR to the MUUO handler it will store FL,,PC+1 in
the usual way and the return address will be that of the instruction immediately after the MUUO. If the instruction
is a jump the APR will remain in executive mode; the CM flag will be set to 0 (JSR and JSP, as always, also set the
FPD flag to 0).
If the instruction is an LUUO then the instruction word is stored in location 000040 of the current mode address
space, and the instruction in location 000041 of the current mode address space is read and executed as an ordinary
(non-interrupt) instruction in the current mode; if the instruction in location 000041 is a JSR to the LUUO handler
it will store FL,,PC+1 in the usual way and the return address will be that of the instruction immediately after the
LUUO.
Note that an LUUO and an MUUO end up being identical in executive mode, although their processing details are
different.
If an MUUO is executed, and the instruction in location 000041 of the executive mode virtual address space contains
an LUUO, the APR will execute the LUUO in (temporarily forced) executive mode, which will effectively make it
an MUUO.

2.5

XCTR and XCTRI

Executive mode software needs to be able to access system call parameters in the user mode address space. The
APR makes this straightforward by allowing executive mode software to modify the behavior of the XCT instruction
so that a variety of useful subsets of the memory references made by the executed instruction use the user mode

address space, even if the CM bit of the flags specifies executive mode.
0

256

11
A

13
I

The XCTR and XCTRI instructions execute the instruction in the memory location specified by the effective address,
and use the A field to hold a code that specifies which of the memory references made by the executed instruction
should reference the user mode address space.
Each memory reference made during the execution of an instruction belongs to one of five memory reference classes.
IF

Instruction fetches.

Index register references and memory references that are part of the effective address calculation of instructions, including the index register in the original instruction word.

Memory references that are simple memory operands, including the source operand of PUSH, the destination
operand of POP, the destination operand of BLT, and the (first) byte pointer word.

Index register references and memory references that are part of the effective address calculation of byte
pointers, including the index register reference in the (first) byte pointer word (this bit would also control
source effective address calculations and operands in EXTEND, but the APR does not implement EXTEND.

Memory references that are byte data, and the source operand in BLT (this bit would also control destination
effective address calculations and operands in EXTEND, but the APR does not implement EXTEND).

These are the same meanings of E1, D1, E2, and D2 that are used by the Tenex/TOPS-20 PXCT instruction, and
inside the APR block itself.
Bits [10..12] of the A field encode several interesting selections of the E1, D1, E2, and D2 bits. The encoding is as
follows.
ITS Name

A[10..12]

XR,XW,XRW,XBW

XBR

XBRW

XEA

XBYTE

Bit [09] of the A field specifies how errors on I/O and relocated memory cycles should be reported. If this bit is 0
(XCTR) then errors are reported in the normal fashion; the current instruction is flushed, the HE or SE flag in the
APR device is set, and a PI is generated if enabled. If this bit is 1 (XCTRI) then the current instruction is flushed
and the PC is incremented by 2 so that the instruction after the current instruction is skipped. The status register
in PAG is updated on soft errors in both cases; PI routines that use XCTRI will need to save and restore the status
register in PAG to avoid confusion.
Note that the XCTR instruction encodes the A field in a way that is different from the encoding used by the A field
of DEC-style PXCT. It exploits the fact that ITS uses only a subset of the legal PXCT A field values in order to
find space in the A field for the bit that is used to distinguish between XCTR and XCTRI.
XCTRI skips on both hard and soft errors. XCTRI is normally used to read/write a location in user space from
executive mode, with the skip telling the executive mode program that the read/write failed for some PAG-related
reason. One might argue that XCTRI should only skip on soft errors, so that hard errors are not lost. On the other
hand, if XCTRI skips on both hard and soft errors it can be used by the ROM program to avoid a double hard error
halt should an E or D command be aimed at a non-existent location. The second design was selected, but its not
quite the right thing.
I/O cycles are treated as relocated cycles to allow the console program to use XCTRI to avoid a double hard error
halt if an E or D command is aimed at a device register that does not exist. Normal software might find this feature
useful for things like testing for the existence of a device.
The XCTR instruction only performs its relocation function when executed in executive mode. The A field is ignored
in user mode.
Relocated references to locations 0-17 normally access locations 0-17 of the user mode address space (the shadow
locations, normally hidden by the accumulators), but the PAG block has the ability to redirect these references to a
special AC block. ITS uses this feature to relocate references to these locations to one of the two AC blocks in the
per-job variables (UUOACS, AC0S-AC17S).
The APR does not optimize the BLT case where the destination address is equal to the source address + 1 (the
filling memory with a constant value case). It does not, therefore, need to do anything special to deal with the case
where the BLT is the target of an XCTR or XCTRI and the code is XBR or XBW.

2.6

Traps and Errors

The APR has six condition flags that capture various exceptional events.
The E1 and U1 flags capture trap-1 (arithmetic overflow) events. The E1 flag captures trap-1 events that happen in
executive mode, and the U1 flag captures trap-1 events that happen in user mode.
The E2 and U2 flags capture trap-2 (push-down overflow) events. The E2 flag captures trap-2 events that happen
in executive mode, and the U2 flag captures trap-2 events that happen in user mode.
The SE flag captures soft error events. The SE flag becomes set when the PAG block cannot successfully translate
8

a virtual address into a physical address (that is, if it gets a page failure).
The HE flag captures hard error events. The HE flag becomes set when the BIO block cannot map an I/O reference
onto one of it’s I/O devices (that is, if D[03..05] does not specify a legal I/O device). The HE flag also becomes set
when the PAG block cannot successfully translate a virtual address into a physical address and the SE flag is already
set (double soft error).
Software can arrange (by setting the appropriate bits in the APR device) that any of these six condition flags generate
PI requests on one or both of two PI levels; having two levels allows conditions that correspond to fatal events to
use a high-priority PI level and conditions that correspond to non-fatal events to use a low-priority PI level.
The APR guarantees that if an instruction sets a flag, the flag is configured to generate a PI, and the PI can be
recognized, then the PI will be recognized before the next instruction begins execution. Traps and errors are reported
using interrupts, but from a practical point of view, they can be treated as precise. The next instruction is not read
and ignored (even though this would have simplified the implementation) so software does not need to handle the
troublesome situation where an instruction gets a trap, the read of the next instruction (which is is ignored) gets
another error, and both the trap and the (bogus) error get reported.
The trap flags (U1, U2, E1, E2) are set when the instruction that caused the trap completes, so if one of these flags
causes a PI, the PC saved by the PI will point to the instruction after the instruction that set the trap flag. The
error flags (HE, SE) are set when the instruction that caused the error is abandoned, so if one of these flags causes
a PI, the PC saved by the PI will point to the instruction that set the error flag, and when the PI is dismissed the
instruction that set the error flag will be re-executed.
The PI level assignments for trap and/or error handlers must be chosen so that the PI routines run at a higher
priority than any code that might actually cause the events. At best, a trap will stick around until the JEN, when
the trap PI handler will run, and promptly get very confused, since the saved PC has nothing to do with the PC at
the time of the trap. At worst, an error will cause the APR re-execute the failing instruction, get another error, and
get a double-error halt.
TOPS10 6.03 runs the APRs PI handler at high priority. There are comments in the code that say happens only if
user is enabled when monitor causes condition and store offending PC so we can fix code, which suggests that user
jobs that enabled trapping were rare enough that occasional the occasional trap in the monitor was not a big deal
(this code is just after the label APRER0 in CLOCK1.MAC). TENEX 134 does essentially the same thing. ITS
does the same sort of thing as well (look at the code after the labels AROV and/or ARFOV) but it runs the APR
PI handler at low priority (CLKCHN = 7) so it seems that traps in PI handlers could confuse things.

2.7

Priority Interrupts

A priority interrupt (PI) request on a level can be generated by hardware (the request signal from an I/O device
is true) or by software (the software request signal associated with the level is asserted). The APR recognizes a PI
request on a level if a PI is not already in progress on the level or on any higher priority level, the PI system is
enabled, and the PI level is enabled.

The KL10, and the KS10 with microcode revisions before revision 47, recognized a software interrupt on a level even
if the level was not enabled. The APR requires that the level be enabled, making it compatible with the KC10, and
with the KS10 with microcode revision of 47 or later. ITS is not sensitive to this difference, since the trouble it
caused was resolved long ago, and requiring the level to be enabled is the more modern interpretation.
The APR checks for PI requests just before it begins reading an initial instruction word, just before it begins reading
the target instruction word of an XCT, just before it begins writing the F/A/EA word into location 000040 on
a UUO, and just before it begins reading any indirect addressing word (including any byte pointer word, which
can be considered to be a kind of indirect addressing word). The APR also checks for PI requests just before it
loops back to move an additional word on a BLT. These checks ensure that is possible for a PI to break out of a
within-an-instruction loop.
If the APR finds one or more PI requests it picks the one having the highest priority, and begins recognizing that PI
request. The APR recognizes a PI request on level N by setting the in-progress flag for level N, reading an instruction
from executive mode location 000040+2*N, and executing the instruction in (temporarily forced) executive mode.
The interrupt instruction is not really executed by the APR. The only instruction that is legal as an interrupt
instruction is JSR (264000,,EA), and it is easier to execute the JSR using a dedicated logic sequence (all it needs to
do is write FL,,PC into executive mode location EA, update FL in the manner of a JSR, and write EA+1 into PC).
Restricting the set of legal interrupt instructions to simplify their PI handling was commonplace in PDP-10 designs;
the KS10, for example, only allowed JSR and XPCW as interrupt instructions.
If the APR begins recognizing a PI request, but cannot complete recognizing the PI request (because it cannot read
the instruction from executive mode location 000040+2*N, or the instruction is not of the form 264000,,EA, or it
cannot write FL,,PC to executive mode location EA) the APR halts.

2.8

Halts

The PDP-10 architecture allows a APR to halt; when halted a APR does not execute instructions until it is restarted
by some explicit command, either from a switch on a front panel, or by a command executed by a front-end processor,
depending on the implementation.
The PDP-10/X APR supports halt, but barely. When the APR halts it stops executing instructions, but there is no
way to restart it other than resetting the entire system. This is acceptable because the APR is only halted in the
most desperate of situations; in slightly less desperate situations control gets passed to EDDT, which supports the
same kind of low-level debugging as a front panel, but with a nicer interface.
A normal halt happens when a HALT instruction is executed.
An abnormal halt happens when the APR gets into a state in which forward progress is impossible. Currently forward
progress is considered to be impossible if a hard error is detected and the HE flag is set (double hard error), or if the
APR begins but cannot complete a PI entry sequence (either because of a hard or soft error on any of the memory
references associated with the PI entry sequence, or because the interrupt instruction is not a JSR instruction).

There is no way to force the APR to halt; such a switch would not be terribly useful. There is also no way to
determne the address at which the APR has halted; it would be nice to be able to do so, but there is no obvious way
to do it.

2.9

Identification

Sometimes it is necessary for software to identify the implementation of the PDP-10 architecture upon which it is
running. This is done with code sequences that deliberately touch corner-cases of each implementation, and identify
the implementation by understanding exactly how each implementation behaves.
The usual code sequences identify the APR as a KI10; it does not have a PC-change flag (so it’s not a PDP-6), a
carry from the right half of an AOBJN does not effect the left half (so it’s not a KA10 or a FOONLY), and the
sequence MOVEI T,0 / BLT T,0 leaves 0 in T (the traditional hallmark of the KI10; the KL10 and the KS10 leave
1,,1 in T).
The APR and the KI10 can be distinguished by the fact that the APR has a 10-bit floating point exponent path,
whereas the KI10 has a 9-bit path, and as such, mis-reports certain corner-cases of floating point exponent overflow/underflow (the sequence MOVSI T,201400 / FSC T,377 results in a floating point overflow on the APR, but
does not on the KI10, even though it should).

2.10
0

CONI APR,E
2

70024

Read the status of the APR into location E. The word read has the following format.
0

E
H
E

E
S
E

E
E
2

E
E
1

E
U
2

E
U
1

7
E
I
A

T
H
E

T
S
E

T
E
2

T
E
1

T
U
2

T
U
1

T
I
A

F
H
E

F
S
E

F
E
2

F
E
1

F
U
2

F
U
1

E
I
R

T
I
R

EHE

Error interrupt enable for the hard error flag.

ESE

Error interrupt enable for the soft error flag.

EE2

Error interrupt enable for the executive mode trap-2 flag.

EE1

Error interrupt enable for the executive mode trap-1 flag.

EU2

Error interrupt enable for the user mode trap-2 flag.

EU1

Error interrupt enable for the user mode trap-1 flag.

EIA

The PI assignment for the error interrupt. If EIA is 0 the error interrupt is not connected to the PI system.

THE

Trap interrupt enable for the hard error flag.

TSE

Trap interrupt enable for the soft error flag.

TE2

Trap interrupt enable for the executive mode trap-2 flag.

TE1

Trap interrupt enable for the executive mode trap-1 flag.

TU2

Trap interrupt enable for the user mode trap-2 flag.

TU1

Trap interrupt enable for the user mode trap-1 flag.

TIA

The PI assignment for the trap interrupt. If EIA is 0 the trap interrupt is not connected to the PI system.

FHE

The hard error flag.

FSE

The soft error flag.

FE2

The executive mode trap-2 flag.

FE1

The executive mode trap-1 flag.

FU2

The user mode trap-2 flag.

FU1

The user mode trap-1 flag.

EIR

Indicates that an error interrupt is pending, even if the error interrupt is not connected to the PI system
because EIA is 0.

TIR

Indicates that a trap interrupt is pending, even if the trap interrupt is not connected to the PI system
because TIA is 0.

2.11

CONO APR,E

70020

Perform the function specified by the effective conditions E (an immediate quantity).
0

S
S
E

R
I
O

C
S
E

S
F

C
F

L
E

L
T

M
H
E

M
S
E

M
E
2

M
E
1

M
U
2

M
U
1

I
A

SSE

Set the soft error flag.

RIO

Reset the I/O system. This does not effect anything associated with device 0, which means it does not
reset anything in the APR or the PAG device.

CSE

Clear the soft error flag.

Set the flags corresponding to the bits that are set in the mask (bits [25..30]).

Clear the flags corresponding to the bits that are set in the mask (bits [25..30]).

Load the error interrupt enables from the mask (bits [25..30]) and load the error interrupt PI assignment
from the IA field (bits[33..35]).

Load the trap interrupt enables from the mask (bits [25..30]) and load the trap interrupt PI assignment
from the IA field (bits[33..35]).

MHE

Mask bit for hard error enables and/or flags.

MSE

Mask bit for soft error enables and/or flags.

ME2

Mask bit for executive mode trap-2 enables and/or flags.

ME1

Mask bit for executive mode trap-1 enables and/or flags.

MU2

Mask bit for user mode trap-2 enables and/or flags.

MU1

Mask bit for user mode trap-1 enables and/or flags.

The value that can be loaded into the PI assignments for the error and/or trap interrupts.

The effect of a CONO APR that attempts to both set and clear a flag is undefined; the current design gives setting
a flag priority over clearing a flag.
The SE bit is treated specially (that is, there is a SSE bit and a CSE bit) to allow a single CONO APR (the one in
the context switch) to both load the trap enables for a job and set the SE flag should a high-priority PI routine wish
to cause a fake soft error because an XCTRI detected an error.

2.12
0

CONSZ APR,E
2

70030

Read the status of the APR (a word with the same format as described for CONI), mask it with the effective address
E (an immediate quantity), and skip if the result is zero.

2.13
0

CONSO APR,E
2

6
70034

13
I

Read the status of the APR (a word with the same format as described for CONI), mask it with the effective address
E (an immediate quantity), and skip if the result is non-zero.
13

2.14
0

CONI PI,E
2

70064

Read the status of the PI system into location E. The word read has the following format.
0

S
R
1

S
R
2

S
R
3

S
R
4

S
R
5

S
R
6

S
R
7

I
P
1

I
P
2

I
P
3

I
P
4

I
P
5

I
P
6

I
P
7

G
E

L
E
1

L
E
2

L
E
3

L
E
4

L
E
5

L
E
6

L
E
7

SR1-7

Software request flags for levels 1-7.

IP1-7

In-progress flags for levels 1-7. The in-progress flag for level n is set when an interrupt request is accepted
on level n, and the highest priority (lowest n) in-progress flag is reset by JRST 10 or JRST 12.

The global enable flag.

LE1-7

Enable flags for levels 1-7.

At reset all of the software request flags, all of the in-progress flags, the global enable flag, and all of the enable flags
are set to 0.
An SRn bit makes a request on a level even if the LEn bit for the level is clear; only GE needs to be set. This is
compatible with the last models of the PDP-10 running the newest microcode, but is incompatible with the KA10,
which required that the LEn bit be set. ITS always sets the LEn bits.
An SRn bit remains set until it is cleared by software. This is compatible with all models of the PDP-10 except the
KA10, which cleared SRn upon delivery of a PI at level n. ITS conditionalizes the explicit clearing of SRn bits on a
model-by-model basis.

2.15
0

CONO PI,E
2

70060

Perform the function specified by the effective conditions E (an immediate quantity).
0

C
S
R

R
P
I

S
S
R

S
L
E

C
L
E

C
G
E

S
G
E

L
1

L
2

L
3

L
4

L
5

L
6

L
7

CSR

Clear the software request(s) corresponding to the bit(s) that are set in the mask (bits [29..35]).

RPI

Reset the PI system. All of the software request bits, all of the in-progress bits, the global enable bit, and
all of the level enable bits are cleared.
14

SSR

Set the software request(s) corresponding to the bit(s) that are set in the mask (bits [29..35]).

SLE

Set the level enable bit(s) corresponding to the bit(s) that are set in the mask (bits [29..35]).

CLE

Clear the level enable bit(s) corresponding to the bit(s) that are set in the mask (bits [29..35]).

CGE

Clear the global enable.

SGE

Set the global enable.

L1-7

Mask bits for levels 1-7.

The effect of a CONO PI that attemts to both set and clear a flag is undefined; the current design gives setting a
flag priority over clearing a flag.

2.16
0

CONSZ PI,E
2

70070

Read the status of the PI system (a word with the same format as described in CONI PI), mask it with the effective
address E (an immediate quantity), and skip if the result is zero.

2.17
0

CONSO PI,E
2

6
70074

13
I

Read the status of the PI system (a word with the same format as described in CONI PI), mask it with the effective
address E (an immediate quantity), and skip if the result is non-zero.

Chapter 3

PAG
PAG is the pager and the memory controller. It responds to all memory references generated by APR, translating
virtual memory addresses into physical memory addresses in a way that is appropriate for ITS, when necessary.
When paging is disabled programs can only reference some (usually the lowest) 256KW of the 4096KW physical
address space. When paging is enabled programs can reference up to 256K words of virtual address space, consisting
of up to 256 1K word virtual pages, each mapped to any of the 4096 1K word physical pages in the 4096K word
physical address space.
The mapping between virtual pages and physical pages is stored in page tables located in physical memory. Each page
table is 64 words long and contains mappings for 128 virtual pages. Page tables are aligned on 64-word boundaries in
the physical address space; this causes no trouble for ITS (which stores page tables in the front of the user variable
block, which is easily aligned, since on the KL10/KS10 it also served as the UPT, which had alignment requirements),
and eliminates the need for an adder in a critical path.
There are four page tables; two page tables map the low and high 128K words of the executive mode virtual address
space, and two page tables map the low and high 128K words of the user mode virtual address space. The four page
tables are pointed to by four page table base registers.
The left half of each word in a page table contains the mapping for an even page (that is, a page with VA[10]=0) and
the right half of each word in the page table contains the mapping for an odd page (that is, a page with VA[10]=1).
0

1
P

4
A

PFN

19
P

22
A

PFN

The P field is the protection code. No access is allowed if the protection code is 0. Read access is allowed if the
protection code is 1, 2, or 3, Write access is allowed if the protection code is 3. Read-only pages normally have
protection code 1; protection code 2, usually called read/write first, is used to trap the first write to pages that would
normally have protection code 3.

The A field is the age flag. It does not participate in translation or protection, but it is set to 0 when the page table
entry is used by the PAG block to translate an address (when the pager sets the A bit to 0 is disturbs no other bits
in the page table entry, including bits [02..03] and bit [05]).
The PPN field is the physical page number. The PPN field is 12 bits wide, so there can be 4096 physical pages,
which is enough to address up to 4096KW of memory.
PAG contains two 256-entry RAMS which cache the most recently fetched page table entry for each of the virtual
pages in each of the address spaces. The entry in the RAM corresponding to the virtual page is loaded any time a
page table entry is fetched from a page table. When a virtual to physical translation is needed, PAG first looks in
the RAM to see if it contains a page table entry that can satisfy the translation. If it does then the memory access
proceeds. If it does not (either because the entry was not valid, or because the protection check failed) the page
table lookup process begins.
Software can invalidate individual entries and/or all 256 entries in either or both of the page table entry cache RAMS
using the DATAO PAG+1 instruction. In addition, any time a page table base register is updated using a DATAO
PAG+4, DATAO PAG+5, DATAO PAG+6, or DATAO PAG+7 instruction all 256 entries in the RAM associated
with the virtual address space mapped by the updated page table base are invalidated.
Note that because the page table lookup process is begun anytime the page table entry cache cannot satisfy the
request, it is not necessary to invalidate an entry in the page table entry cache if a page table entry is changed
from invalid to valid, or from a state which does not allow writing into a state that does allow writing. It is only
necessary to invalidate an entry in the page table entry cache when a page table entry is switches to a more restrictive
protection code.
Bulk invalidations of the page table entry cache are performed in a way that minimizes the impact of doing so. When
a page table entry cache RAM needs to be bulk invalidated, it is placed into the invalidating state. In this state the
cache is invalidating one entry per cycle, so the whole RAM is invalidated in 256 cycles. If software makes a request
that requires the use of the RAM while it is invalidating the request is processed via a full page table lookup, and
the page table entry is not written into the RAM. Instructions continue to be executed during the invalidation, but
memory operates at about half speed. Note also that accesses made to the executive mode address space are not
stalled while the user mode page table entry cache RAM is invalidating, so when the operating system switches jobs,
some of the invalidation time is overlapped with the executive mode code that is restoring the state of the job.
APR does not check write access for the memory operand of an instruction that both reads and writes memory until
the write actually happens; a DIVM whose memory operand is 0 and in a location that cannot be written will get a
no divide trap rather than an error from PAG on the failed write.
When PAG detects that a cycle generated by the currently executing instruction cannot be completed it captures
some information about the cycle in a register within PAG, and completes the read or write with a soft error. The
APR abandons the currently executing instruction without updating any state (so the PC is left pointing at the
instruction that could not be completed). The soft error acknowledge normally sets the SE flag and generates a PI.
If a PI is not generated the instruction is re-executed, which may result in a double soft error (which normally sets
the HE flag and generates a PI) or a double hard error (which generates a halt).

3.1
0

CONI PAG+0,E
2

70424

H
M

P
E

R
E

Read the status of PAG into location E. The word read has the following format.
0

Highest moby. Determines which 256KW region of the physical address space referenced by reads/writes
when the PE bit is 0. If the HM bit is 1 then the highest 256KW is referenced. If the HM bit is 0 then the
lowest 256KW is referenced.

Paging enable. If the PE bit is 1 reads/writes reference (up to) 256KW of virtual address space directed to
(up to) 256 1KW pages located anywhere in the 4096KW (512KW) physical address space. If the PE bit is
0 reads/writes reference 256KW of virtual address space redirected to the 256KW of the physical address
space specified by the HM bit.

ROM enable. If the RE bit is 1 reads from virtual locations 400000-777777 reference 128 copies of the
1KW ROM, and writes to virtual locations 400000-777777 are ignored. If the RE bit is 0 virtual locations
400000-777777 receive no special treatment.

The normal paging off configuration has HM = 0, PE = 0, and RE = 0. The normal paging on configuration has
PE = 1, and RE = 0. The console and bootstrapping ROM has HM = 1, PE = 0, and RE = 1/0.
Power-up reset sets HM to 1, PE to 0, and RE to 1. A software-generated I/O reset (caused by CONO APR, 200000)
does not effect HM, PE, or RE.
The layout of the bits in this register anticipates adding a PAG interrupt at some point in the future; bit [31] would
be the IE flag, bit [32] would be the IR flag, and bits [33..35] would be the PI level assignment.

3.2
0

CONO PAG+0,E
2

70420

H
M

P
E

R
E

Set up the PAG device from the effective conditions E as shown.
0

Highest moby.
18

Paging enable.

ROM enable.

The layout of the bits in this register anticipates adding a PAG interrupt at some point in the future; bit [31] would
be the IE flag, bit [32] would be unused, and bits [33..35] would be the PI level assignment.

3.3
0

CONSZ PAG+0,E
2

70430

Read the status of PAG (a word with the same format as described in CONI PAG), mask it with the effective address
E (an immediate quantity), and skip if the result is zero.

3.4
0

CONSO PAG+0,E
2

70434

Read the status of PAG (a word with the same format as described in CONI PAG), mask it with the effective address
E (an immediate quantity), and skip if the result is non-zero.

3.5
0

DATAI/DATAO PAG+0,E
2

70404

70414

Read/write the register that describes the most recent soft error encountered by PAG. The register has the following
format.
0

W
R

U
M

V
A

Set to 1 if the error happened on a write, and set to 0 if the error happened on a read.

Set to 1 if the error happened on a user mode read/write, and set to 0 if the error happened on an executive
mode read/write. Executive mode programs can generate traps with UM = 1 with XCTR or XCTRI.

The P field of the page table entry that was accessed and determined that the read/write should complete
with a soft error.

The virtual address of the read/write that generated the error.

Bits [06..17] are unused, so there are enough bits for a full 30-bit VA in some future extended addressing design,
even though it is unlikely that any such design would be done, since ITS does not understand extended addressing.
This register is updated on any error generated by PAG, even errors that are generated by an instruction under an
XCTRI that causes the APR to skip instead of generating APR PI (it needs to work this way to allow the code at
label INTPFL to be written).
This register is read/write to allow a high-priority PI routine that uses XCTRI instructions to save and restore this
register, since ITS processes page failures in a low-priority interrupt handler (APRCHN = 7). This is actually how
ITS works when using a Systems Concepts paging box, but it is not obvious that this is the case (the save and restore
is a side effect of SPM and LPMR instructions executed by the PI routine).
Power-up reset sets UM to 0, WR to 0, P to 0, and VA to 0. A software-generated I/O reset (caused by CONO
APR, 200000) does not effect UM, WR, P, or VA.

3.6
0

DATAO PAG+1,E
2

70454

Invalidate entries in PAGs page table entry cache specified by the contents of location E. The word read from location
E has the following format.
0

E
I
E

U
I
E

I
S

I
A

EIE

Set to 1 to enable invalidation of the executive mode virtual address space.

UIE

Set to 1 to enable invalidation of the user mode virtual address space.

Set to 1 if this is an invalidate single (only the page table entry cache location that maps the virtual address
specified by the IA field) and set to 0 if this is an invalidate all (all page table entry cache locations).

The address being invalidated if the IS field is set to 1.

The ITS CLRPGM macro (flush the entire page table entry cache) can be implemented with DATAO PAG+1,[600000,,000000].
20

The standard CLRPT E instruction (flush the single page table entry cache location associated with address E in
both address spaces) can be implemented with DATAO PAG+1,[700000,,E].

3.7
0

DATAI/DATAO PAG+2,E
2

70504

70514

Read/write the AC-block enable and the AC-block base register (the base register that ITS doesnt ever really name,
but which the Systems Concepts ITS pager stored in word 7 of the 8-word LPMR/SPM block). The word has the
following format.
0

A
E

A
B

The AC-block enable. If the AE bit is 1 reads/writes to virtual locations 0-17 are mapped to the 16-word
block in physical memory whose address is specified by the AB field. If the AE bit is 0 reads/writes to
virtual locations 0-17 are mapped in the standard way. Reads/writes to virtual locations 0-17 can only be
generated using XCTR and XCTRI.

The AC-block base. Set to bits [14..31] of the physical address of the 16-word AC block in memory. Bits
[32..35] are unused, which means the 16-word AC block in memory must be aligned on a 16-word boundary.

The 16-word alignment restriction saves an adder in the critical path to getting a physical address to the memory,
and causes no trouble, since the only values ITS ever puts in this register are fixed offsets from the start of the job
variables (UUOACS and AC0S), and it’s easy to align the job variables.
Power-up reset sets AE to 0 and AB to 0. A software-generated I/O reset (caused by CONO APR, 200000) does not
effect AE or AB.

3.8
0

DATAI/DATAO PAG+3,E
2

70544

6
70554

13
I

26
Y

Read/write the quantum timer, which is an 18-bit timer that increments every 4 microseconds (that is, by the 16
MHz system clock divided by 64) any time the APR is running at level 0 (that is, no PI is active). Nothing special
happens when the quantum timer overflows (the quantum timer in the Systems Concepts ITS paging box for the
KA10 generated an interrupt for this condition, but ITS did not use it, and actually went to considerable trouble to
ensure that the interrupt did not happen).
The quantum timer in the Systems Concepts paging box was 19 bits wide and incremented at 1 MHz, but this
size/rate was never really used; any time the value in the quantum timer was read it was immediately shifted right
by 2 bits. The quantum timer in PAG increments at the desired rate, and as a side effect of doing so, is actually 1
bit wider than the one in the Systems Concepts paging box.
The word written/read has the following format.
0

T
M
R

Power-up reset sets TMR to 0. A software-generated I/O reset (caused by CONO APR, 200000) does not effect
TMR.
The simulator does not increment the quantum timer by 1 every 4 microseconds, but by 2500 every 10 milliseconds.

3.9
0

DATAI/DATAO PAG+4,E
2

70604

70614

Read/write the executive mode low segment base register (the base register ITS normally calls DBR4). The word
written/read has the following format.
0

E
L
B

Note that bits [30..35] are unused, which means the 64-word page table must be 64-word aligned.
The 64-word alignment restriction saves an adder in the critical path to getting a physical address to the memory,
and causes no trouble, since the only value ITS ever puts in this register is a constant.
All 256 entries in the executive mode page table entry cache are invalidated any time the executive mode low segment
base register is written.
Power-up reset sets ELB to 0. A software-generated I/O reset (CONO APR, 200000) does not effect ELB.

3.10
0

DATAI/DATAO PAG+5,E
2

70644

70654

Read/write the executive mode high segment base register (the base register ITS normally calls DBR3). The word
written/read has the following format.
0

E
H
B

Note that bits [30..35] are unused, which means the 64-word page table must be 64-word aligned.
The 64-word alignment restriction saves an adder in the critical path to getting a physical address to the memory,
and causes no trouble, since the only value ITS ever puts in this register is a constant.
All 256 entries in the executive mode page table entry cache are invalidated any time the executive mode high
segment base register is written.
Power-up reset sets EHB to 0. A software-generated I/O reset (CONO APR, 200000) does not effect EHB.

3.11
0

DATAI/DATAO PAG+6,E
2

70704

70714

Read/write the user mode low segment base register (the base register ITS normally calls DBR1). The word
written/read has the following format.
0

U
L
B

All 256 entries in the user mode page table entry cache are invalidated any time the user mode low segment base
register is written.
Power-up reset sets ULB to 0. A software-generated I/O reset (CONO APR, 200000) does not effect ULB.

3.12
0

DATAI/DATAO PAG+7,E
2

70744

70754

Read/write the user mode high segment base register (the base register ITS normally calls DBR2). The word
written/read has the following format.
0

U
H
B

Note that bits [30..35] are unused, which means the 64-word page table must be 64-word aligned.
The 64-word alignment restriction saves an adder in the critical path to getting a physical address to the memory,
and causes no trouble, since the only value ITS ever puts in this register is a fixed offset from the start of a job’s
variables (UPGMP+100), and it’s easy to align the start of a job’s variables (since the job’s variables contain a UPT
on some machines, and on some of these machines, the UPT needs to be aligned).
All 256 entries in the user mode page table entry cache are invalidated any time the user mode high segment base
register is written.
Power-up reset sets UHB to 0. A software-generated I/O reset (CONO APR, 200000) does not effect UHB.

Chapter 4

RTC
The RTC device, which is part of the BIO block, is a periodic 60 Hz interrupt, a free-running timer that works in 60
Hz ticks, and a date/time clock with battery backup.
The free-running timer is a 36-bit register that increments at a 60 Hz rate if its value is not 0. By convention if
the timer contains 0 it means the timer is not valid; a side effect of this definition is that the timer becomes invalid
any time it overflows. By convention the timer holds the date/time, encoded as a number of 60 Hz ticks since
01-Jan-2001, 00:00:00, in the local standard (not daylight) time zone, for use by ITS.
The date/time clock is a Dallas Semiconductor DS1337, accessed over a bit-banged I2C bus. The DS1337 contains
a date/time clock, with battery backup, that works in HH:MM:SS DD:MM:YY format. The date/time clock is read
by the ROM, which uses it to initialize the free-running timer.
The RTC device generates the 60 Hz clock used by both the 60 Hz interrupt and by the timer by dividing a 1.8432
MHz clock (the same clock that is used by the TTY device to generate serial line bit-rate clocks) by 30720. A design
that used the 60 Hz power line as the time base was rejected because it would not allow battery operation.

4.1
0

CONI RTC,E
2

71024

D
O

C
O

I
E

I
R

Read the status of RTC into location E. The word read has the following format.
0

I
A

The value that is on the SDA signal of the I2C bus, without regard for which device (RTC, DS1337, or
25

both) is actually driving.
DO

The value that RTC is driving onto the SDA signal of the I2C bus. The RTCs driver is open-drain, so RTC
drives the SDA signal to 0 when DO is 0, and does not drive the SDA signal when DO is 1.

The value that is on the SCK signal of the I2C bus, without regard for which device (RTC, DS1337, or
both) is actually driving.

The value that RTC is driving onto the SCK signal of the I2C bus. The RTCs driver is open-drain, so RTC
drives the SCK signal to 0 when CO is 0, and does not drive the SCK signal when CO is 1.

The clock flag, set by the 60 Hz time base, and cleared by CONO RTC with the CF bit set.

The PI enable.

The PI request, set if F is 1 and IE is 1, even if the RTC device is not assigned to any PI level.

The PI assignment.

Reset (which can be a power-up reset, or a software-generated I/O reset caused by a CONO APR, 200000) sets DO
to 1, CO to 1, F to 0, IE to 0, and IA to 0. This causes D to be 1 and C to be 1 (nothing is driving the SDA and
SCK signals, so they become 1 because of the I2C pull-up resistors) and IR to be 0 (since IE is 0). Because F is set
every 1/60th of a second, observing that F is set to 0 by reset requires effort.

4.2
0

CONO RTC,E
2

71020

C
O

C
F

I
E

Set up the RTC device from the effective conditions E as shown.
0

D
O

I
A

The value that RTC should drive onto the SDA signal of the I2C bus. The RTCs driver is open-drain, so
RTC drives the SDA signal to 0 when DO is 0, and does not drive the SDA signal when DO is 1.

The value that RTC should drive onto the SCK signal of the I2C bus. The RTCs driver is open-drain, so
RTC drives the SCK signal to 0 when CO is 0, and does not drive the SCK signal when CO is 1.

The clear flag command; the flag is cleared by a CONO with CF set to 1.

The PI enable.

The PI assignment.

4.3
0

CONSZ RTC,E
2

71030

Read the status of the RTC (as described in CONI RTC), mask it with the effective address E (an immediate
quantity), and skip if the result is zero.

4.4
0

CONSO RTC,E
2

71034

Read the status of the RTC (as described in CONI RTC), mask it with the effective address E (an immediate
quantity), and skip if the result is non-zero.

4.5
0

DATAI RTC,E
2

71004

Read the free-running timer into memory location E.
Power-up reset sets the free-running timer to 0. Software-generated I/O reset (caused by CONO APR, 200000) does
not reset the free-running timer; the date and time set by the ROM persists through any software-generated I/O
reset.

4.6
0

DATAO RTC,E
2

6
71014

13
I

27
Y

Write memory location E into the free-running timer.

Chapter 5

TTY
The TTY device, which is part of the BIO block, is a simple double-buffered full-duplex 2-wire UART intended for
use as the console terminal.
The receiver and transmitter are hardwired to operate at 9600 bits/second (the 16x9600 Hz clock needed by the
transmitter and receiver is generated by dividing a 1.8432 MHz crystal clock by 12), with eight data bits, with one
stop bit, and with no parity. The configuration of the transmitter and receiver is hardwired, so bootstrap software
can use the TTY device in a busy-wait style without any initialization.
The definition of status bits and interrupt enables has been designed to work well with ITS terminal service. Receive
is initialized by a CONO TTY, RIE, which sets RIE. Any time a character becomes available RBF becomes set.
which immediately generates a PI, and the PI routine does a DATAI TTY, which reads the character and clears
RBF. Transmit is initialized by the same CONO TTY, RIE, which clears TIE. Transmit is started by a CONO
TTY, TIE+RIE executed from the TTYST (signal that output is available on a previously idle TTY) table, which
immediately generates a PI. The transmit side is continued by a DATAO TTY executed from the TTYDO (output
one character) table, and stopped by a CONO TTY, RIE, which clears TIE, executed from the TTYDFF (tell TTY
to stop interrupting) table.

5.1
0

CONI TTY,E
2

72024

T
A

T
B
E

T
I
E

T
I
R

R
B
F

R
I
E

R
I
R

Read the status of the DSK device into location E as shown.
0

I
A

The transmit active status, set if the transmit buffer register is holding a character or if the transmit shift
register is actively shifting a character out. This status bit is provided mainly to allow software to drain
the transmitter (with a simple spin loop, waiting for TA = 0) before issuing an I/O reset (CONO APR,
200000).

TBE

The transmit buffer empty status, set if the transmit buffer register is not holding a character. Writing
a character into the transmit side (with a DATAO TTY) clears this bit; the bit re-sets as soon as the
character is moved from the transmit buffer register into the transmit shift register.

TIE

The transmit PI enable.

TIR

The transmit PI request, set if the TBE and TIE bits are set, even if the TTY device is not connected to
any PI level (that is, if the IA field is 0).

RBF

The receive buffer full status, set if the receive buffer register is holding a character. Reading a character
from the receive side (with a DATAI TTY) clears this bit; the bit re-sets as soon as the next character is
moved from the receive shift register into the receive buffer register.

RIE

The receive PI enable.

RIR

The receive PI request, set if the RBF and RIE bits are set, even if the TTY device is not connected to
any PI level (that is, if the IA field is 0).

The transmit/receive PI assignment.

Reset (which can be a power-up reset, or a software-generated I/O reset caused by a CONO APR, 200000) sets TBE
to 1, TIE to 0, RBF to 0, RIE to 0, and IA to 0. This forces TIR to 0 (because TIE is 0) and RIR to 0 (because
RIE is 0).

5.2
0

CONO TTY,E
2

72020

Set up the TTY device from the effective conditions E as shown.
0

T
I
E

TIE

The transmit PI enable.

RIE

The receive PI enable.

The transmit/receive PI assignment.

R
I
E

I
A

5.3
0

CONSZ TTY,E
2

72030

Read the status of the TTY device (as described in CONI TTY), mask it with the effective address E (an immediate
quantity), and skip if the result is zero.

5.4
0

CONSO TTY,E
2

72034

Read the status of the TTY device (as described in CONI TTY), mask it with the effective address E (an immediate
quantity), and skip if the result is non-zero.

5.5
0

DATAI DSK,E
2

72004

Read the TTY receive buffer register into bits [28..35] of memory location E. Bits [00..27] are unpredictable. Clear
the RBF bit in the TTY status.
This instruction does not check for a possible soft error on location E before it reads the TTY receive buffer register,
so if there is a soft error data can be lost. This is not a problem if E specifies an accumulator or a location in
wired-down memory, which is expected to always be the case.

5.6
0

DATAO DSK,E
2

6
72014

13
I

Write bits [28..35] of memory location E to the TTY transmit buffer register. Bits [00..27] of memory location E are
ignored. Clear the TBE bit in the TTY status. Restart the transmitter if it is not running.

Chapter 6

DSK
The DSK device, which is part of the BIO block, provides an interface to a single string of ATA-2 disks (one or two
disks).
The DSK device always uses programmed I/O; this reduces performance on disks, but allows a number of disk-like
devices that implement a subset of the ATA-2 interface that does not include DMA, like Compact Flash cards, to
also be used (this means the ATA-2 DMARQ signal is ignored, and the ATA-2 DMACK signal is always driven false).
Nothing prevents a future version of DSK from implementing DMA on disks and disk-like devices that support it,
and there is lots of free space in the BIO FPGA. It is expected that the DMA registers for DSK (D[03..05] = 100)
would have D[03..05] = 101.
The DSK device always uses mode 0 (8-bit) and mode 2 (16-bit) PIO cycles, and assumes that the disk never needs
to delay a cycle, which means the IORDY signal can be ignored. The DSK device does not support ancient ATA-2
disks, and assumes that the disk supports true 16-bit accesses to its data register, which means the IOCS16 signal
can be ignored.
The INTRQ signal is pulled down by a 10K resistor; this ensures that INTRQ is false when the interrupt is disabled
by the IEN bit in the device control register (when the ATA-2 specification talks about enabling and disabling
interrupts it means enabling and disabling the tri-state buffer driving the INTRQ signal).

6.1
0

CONI DSK,E
2

6
74024

13
I

27
Y

Read the status of the DSK device into location E as shown.

30
I
R
Q

I
E

I
R

I
A

IRQ

The raw ATA-2 interrupt request, set if the INTRQ signal on the ATA-2 bus is true, even if the DSK device
does not have the PI enabled (that is, if the IE bit is 0) or is not connected to any PI level (that is, if the
IA field is 0).

The PI enable.

The PI request, set if the IRQ bit is set and the IE bit is set, even if the DSK device is not connected to
any PI level (that is, if the IA field is 0).

The PI assignment.

Reset (which can be a power-up reset, or a software-generated I/O reset caused by a CONO APR, 200000) sets IE
to 0, and IA to 0. This forces IR to 0 (because IE is 0) and IRQ to 0 (because reset implies an ATA-2 reset, which
causes the disk to tri-state the INTRQ signal, which causes the INTRQ signal to get pulled false by the 10K resistor).

6.2
0

CONO DSK,E
2

74020

Set up the DSK device from the effective conditions E as shown.
0

I
E

The PI enable.

The PI assignment.

6.3

CONSZ DSK,E

6
74030

13
I

I
A

Read the status of the DSK device (as described in CONI DSK), mask it with the effective address E (an immediate
quantity), and skip if the result is zero.

6.4
0

CONSO DSK,E
2

74034

Read the status of the DSK device (as described in CONI DSK), mask it with the effective address E (an immediate
quantity), and skip if the result is non-zero.

6.5
0

DATAI DSK+R,E
2

74004+(R<<3)

Read the contents of the ATA-2 register specified by the R field into location E. Bits R[07..09] supply A[02..00] to
the ATA-2 bus, and bit R[06] specifies if the register is in the command block (R[06] = 0) or the control block (R[06]
= 1).
If the R field specifies the data register in the command block (R[06] = 0, R[07..09] = 0) then the DSK device reads
the ATA-2 register four times, using a 16-bit PIO mode 2 read cycle, assembles the read data into a 36-bit word,
and writes the word into location E. Each read of the ATA-2 register contributes 9 bits to the word (from ATA-2
D[08..00]), with the first read contributing bits [00..08] to the word, and the last read contributing bits [27..35] to
the word.
If the R field specifies anything else then the interface reads the disk register once, using an 8-bit PIO mode 0 read
cycle, and writes the read data into bits [28..35] of location E; bits [00..27] of location E are unpredictable.
This instruction does not check for a possible soft error on location E before it reads any ATA-2 register; if the
ATA-2 register read has a side effect and there is a soft error data can be lost. This is not a problem if E specifies
an accumulator or a location in wired-down memory, which is expected to always be the case.

6.6
0

DATAO DSK+R,E
2

74014+(R<<3)

13
I

Write the contents of location E into the ATA-2 register specified by the R field. Bits R[07..09] supply A[02..00] to
the ATA-2 bus, and bit R[06] specifies if the register is in the command block (R[06] = 0) or the control block (R[06]
= 1).
If the R field specifies the data register in the command block (R[06] = 0, R[07..09] = 0) then the DSK device reads
a 36-bit word from location E, disassembles the word into four 9-bit chunks, and writes each chunk to the ATA-2
bus using four 16-bit PIO mode 2 write cycles. Each 9-bit chunk supplies D[08..00] to the ATA-2 bus; D[15..09] are
33

forced to 0. The first chunk comes from bits [00..08] of the word, and the fourth chunk comes from bits [27..35] of
the word.
If the R field specifies anything else the DSK device reads a 36-bit word form location E, and writes bits [28..35] of
the word to the ATA-2 bus using an 8-bit PIO mode 0 write cycle. The word supplied D[07..00] to the ATA-2 bus;
D[15..08] are forced to 0.

Chapter 7

ETH
The ETH device, which is part of the BIO block, provides an interface to a WIZnet WIZ830MJ 10/100-base-T
embedded ethernet module.
The WIZ8300MJ module was selected because the WIZnet W5300 controller upon which it is based can be run in a
mode where it is little more than an ethernet chip with 128KB of shared buffering (which can be used by operating
systems) or in a mode where it contains a complete, albeit fairly simple, TCP/UDP/ICMP/IP stack (which can be
used by a future version of the ROM that implements network booting and/or by a stand-alone program that allows
network updates of the disk).
The ETH device runs the WIZ830MJ in indirect register mode and with an 8-bit data bus; the BIT16EN pin is
connected to ground, the A[09..03] pins are connected to ground, and the D[15..08] pins are floating.

7.1
0

CONI ETH,E
2

76024

I
N
T

I
E

I
R

Read the status of the ETH device into location E as shown.
0

I
A

INT

The raw interrupt request, set if the interrupt request pin (/INT) pin of the WIZ830MJ is true (low), even
if the ETH device does not have the PI enabled (that is, if the IE bit is 0) or is not connected to any PI
level (that is, if the IA field is 0).

The PI enable.
35

The PI request, set if the INT bit is set and the IE bit is set, even if the ETH device is not connected to
any PI level (that is, if the IA field is 0).

The PI assignment.

Reset (which can be a power-up reset, or a software-generated I/O reset caused by a CONO APR, 200000) sets IE to
0, sets IA to 0, resets the WIZ830MJ. Setting IE to 0 causes IR to be set to 0, and resetting the WIZ830MJ causes
INT to be set to 0.

7.2
0

CONO ETH,E
2

76020

Set up the ETH device from the effective conditions E as shown.
0

I
E

The PI enable.

The PI assignment.

7.3

CONSZ ETH,E

76030

I
A

Read the status of the ETH device (as described in CONI ETH), mask it with the effective address E (an immediate
quantity), and skip if the result is zero.

7.4
0

CONSO ETH,E
2

6
76034

13
I

Read the status of the ETH device (as described in CONI ETH), mask it with the effective address E (an immediate
quantity), and skip if the result is non-zero.

7.5
0

DATAI ETH+R,E
2

76004+(R<<3)

Read the contents of the WIZ830MJ register specified by the R field into location E.
If R[06]=0 then a 16-bit value is read, as two 8-bit values, from the WIZ830MJ and written into bits [00..15] of
location E, and bits [16..35] of location E are set to 0. If R[06]=1 then two 16-bit values are read, as four 8-bit values,
from the WIZ830MJ and written into bits [00..15] (the first 16-bit value) and bits [16..31] (the second 16-bit value)
of location E, and bits [32..35] of location E are set to 0.
If R[07]=0 then the 16-bit values are read from the WIZ830MJ in big-endian order (the most significant 8-bit value
is read first, and the least significant 8-bit read is read second). If R[07]=0 then the 16-bit values are read from
the WIZ830MJ in big-endian order (the most significant 8-bit value is read first, and the least significant 8-bit read
is read second). Big-endian order is used when reading bytes and when reading 16-bit words in ARPANET order.
Little-endian order is used when read 16-bit words in CHAOSNET order.
R[08..09] supplies A[02..01] to the WIZ830MJ. A[00] to the WIZ830MJ is sequenced automatically based on R[06..07].
This instruction does not check for a possible soft error on location E before it reads any WIZ830MJ register; if the
WIZ830MJ register read has side effects and there is a soft error data can be lost. This is not a problem if E specifies
an accumulator or a location in wired-down memory, which is expected to always be the case.

7.6
0

DATAO ETH+R,E
2

76014+(R<<3)

13
I

Write the contents of location E into the WIZ830MJ register specified by the R field.
If R[06]=0 then the 16-bit value in bits [00..15] of location E is written, as two 8-bit values, into the WIZ830MJ.
If R[06]=0 then two 16-bit values, the first one in bits [00..15] of location E, and the second one in bits [16..31] of
location E, is written, as four 8-bit values, into the WIZ830MJ.
If R[07]=0 then the 16-bit values are written into the WIZ830MJ in big-endian order (the most significant 8-bit
value is written first, and the least significant 8-bit value is written second). If R[07]=1 then the 16-bit values are
written into the WIZ830MJ in little-endian order (the least significant 8-bit value is written first, and the most
significant 8-bit value is written second). Big-endian order is used when writing bytes and when writing 16-bit words
in ARPANET order. Little-endian order is used when writing 16-bit words in CHAOSNET order.
R[08..09] supplies A[02..01] to the WIZ830MJ. A[00] to the WIZ830MJ is sequenced automatically based on R[06..07].

Chapter 8

ROM
The PDP-10/X does not have a tradition switches-and-lights front panel, nor does it have a second small (front end)
processor that implements some complicated console interface. Instead, it has a 1KW ROM and some simple logic
in PAG that allows the initial instructions executed by APR to come from the ROM, and implements its bootstrap
and console functions (mainly a loader for system images) as a PDP-10 program.
Implementing bootstrap and console functions as a PDP-10 program is more difficult that it first appears. When
ITS is read from the disk it is loaded into several disjoint regions of the lowest 256KW of memory; ITS at the low
end, NSALV in the middle, and DDT at the high end. It is difficult to find a place in the lowest 256KW to hide the
bootstrap and console program while it is executing. The PDP-10/X solves this problem with some simple logic in
PAG that allows the console program to run out of the highest 256KW of memory, but be able to load ITS into the
lowest 256KW of memory; there are no conflicts between the bootstrap and console program and any program that
would normally run with paging disabled.
When PAG is reset PE is 0, RE is 1, and HM is 1. Since PE is 0 paging is disabled, but since RE is 1 and HM
is 1 addresses in the range 000000 to 377777 reference the lowest 128KW of the highest 256KW of memory, and
addresses in the range 400000 to 777777 reference 128 copies of the 1KW ROM. When APR is reset FL is 0 and PC
is 400000, so the first instruction executed comes from the first word of the ROM.
The ROM is written so that it runs at addresses 000000 to 001777. The first few instructions of the ROM, which
are executed out-of-place, copy the ROM image from the high 128KW of the address space to the low 128KW of
the address space, then jump into the low 128KW of the address space. Once control is in the low 128KW of the
address space the ROM is no longer needed, so RE is set to 0.
LOC
HRLZI
HRRI
BLT
JRST

0
A,400020
A,20
A,1777
L20

; COPY 400020-401777
; INTO 000020-001777

L20:

LOC 20
CONO

PAG+0,HM

; SET RE=0, TURN OFF ROM

The ROM command language can be very simple, because its only function is to load standalone programs into
the lowest 256KW of memory and jump to them. There are commands to read and write device registers and/or
locations in the lowest 256KW of memory, but these are intended to be used only in desperation; it is expected
that serious debugging will be done using a standalone version of DDT, loaded into memory by the ROM with the
program being debugged. The ROM commands are as follows.
B [/N:v][/P:dpn] [bpn]

Boot. Load the contents of the boot partition specified by bpn, which defaults to
the first boot partition in the disks partition table, into the low 256KW of memory,
and jump to the starting address of the boot partition. The /N option, if present,
specifies the boot flags; if there is no /N option then the boot flags are 0. The /P
option, if present, specifies the name of the associated disk partition; if there is no
/P option then the name of the associated disk partition defaults to the name of
the boot partition.

D[/C][/D][/N:v] a d

Deposit.

E[/C][/D][/N:v] a

Examine.

Initialize the I/O system.

L bpn

Load boot partition.

Read a binary file from the terminal and load it into the specified locations in the
low 256KW of memory. The file is essentially a DECSAV file (in that load data
consists of blocks beginning by a -n,,a-1 word) but it ends with a single JRST
word, rather than with two JRST words.

S/[/P:dpn][/N:v] [sa]

Start.

Zero memory.

The ROM sends jumps to the standalone program by copying a trampoline program into the accumulators (a CONO
PAG+0,0 to set HM=0, and a JRST to the start address of the standalone program) and then jumping into the
accumulators. Some useful information is in accumulators A-D (1-4).
A=1

The boot flags. Specified by the /N option on the B or S command, or 0 if there was no /N option on the
B or S command.

B=2

Unused. Always 0.

C=3

The base of the associated disk partition, in cylinders, or 0 if the ROM was unable to find the associated
disk partition.

D=4

The size of the associated disk partition, in cylinders, or 0 if the ROM was unable to find the associated
disk partition.

The starting address of a boot partition containing ITS (or, to be more precise, a copy of ITS, NSALV, and DDT)
points to the label BEG in ITS. The following code is located at that label.
BEG:

BEG1:

BEG2:

MOVEM
MOVEM
MOVEM
MOVEM

A,BINFO+0
B,BINFO+1
C,BINFO+2
D,BINFO+3

; SAVE USEFUL INFO

TRNN
JRST
MOVEI
HRLI
MOVEM
MOVEI
MOVEM
JRST

A,1
BEG1
T,[0]
T,440700
T,MACCR
T,BEG1
T,@DDT-6
DDT

; [35]=1 => STOP BOOT AT DDT

MOVE
CAIE
BUG

T,BINFO+3
; CHECK SIZE OF DISK
T,NCYLS+XCYLS
AWFUL,[DISK IS WRONG SIZE]

SKIPN
BUG
JSR

SALV
; CHECK IF NSALV IS PESENT
AWFUL,[NO NSALV]
SALV+1
; NSALV, NO QUESTIONS

; SET EMPTY MACRO COMMAND STRING

; SET <ALT>P ADDRESS

...

By default the system will run NSALV in no-questions mode and start up the system. If the system is booted with
bit [35] set to 1 the system will enter DDT immediately after it boots, and if a <ALT>P command is given in DDT,
the system will proceed to run NSALV in no-questions mode and start up the system. If, for some reason, one wants
to bring up the system without running NSALV then the system should be booted with bit [35] set to 1, and then
started at label BEG2 explicitly from DDT.

Chapter 9

Disk Layout
PDP-10 software is often aware of the physical geometry of the disk. The DSK uses ATA-2 disks run in LBA (logical
block address) mode, so that the actual physical geometry of the disk is hidden, and uses standardized artificial
geometry to satisfy any PDP-10 software that actually cares.
The DSK packs 64 PDP-10 words into each 512-byte disk block. This means that the natural sector of the DSK is
64 words long, which is half the size of the natural sector on all DEC disks (128 words, or 576 bytes). This causes
no problems for ITS, which always works in 1K-word blocks, but might cause trouble for software that works in
128-word blocks and assumes that the size of a block and the size of a sector are the same.
Each track of the DSK is assumed to contain 64 sectors. Each track, therefore, contains 64*64 = 4096 words. This
is the same track size as the DEC RMxx disks (the RM02, RM03, RM05, and RM80 disks all used 128-word sectors
and had 32 sectors per track).
Each cylinder of the DSK is assumed to contain 16 tracks. Each cylinder, therefore, contains 4096*16 = 65536
words. This is a slightly larger cylinder size than the RM80 (which had 14 tracks per cylinder) and a slightly smaller
cylinder size than the RM05 (which had 19 tracks per cylinder).
The fact that both the sectors/track and tracks/cylinder are powers of two means that a cylinder can be divided
exactly into 1K-word ITS blocks; each cylinder contains 1024 sectors, and each 1K-word ITS block is 16 sectors, so
there are 64 ITS blocks per cylinder. On some DEC disks (this is not true, and space is wasted.
Modern ATA-2 disks are much larger than any PDP-10 disk. To allow a single modern disk to serve as multiple
smaller PDP-10 disks each physical disk is partitioned into one or more smaller logical disks, with each logical disk
assigned some number of (65536 word) cylinders. The locations and sizes of the partitions is kept in a partition table
located in the very first sector of the physical disk. In addition to holding the locations and sizes of the logical disk
partitions, the partition table holds the locations and sizes of 256K-word boot images and space on the physical disk
that is not allocated.
The partition table has the following format.

446353

DISK SIZE (CYLINDERS)

..
.
0

TYPE CODE

SIZE (CYLINDERS)

VARIES BY TYPE CODE

..
.
CHECKSUM

The partition table begins with a three word header. Word 0 of the header contains an identifying tag (the letters
DSK in SIXBIT) in its left half, and a partition table version number (currently 0) in its right half. Word 1 of
the header contains the size of the disk, in (65536 word) cylinders. Word 2 of the header is unused in a version 0
partition table, and is always 0.
Immediately following the three-word header are fifteen four-word entries. The right half of word 0 of each entry is
always a type code. Word 1 of each entry is always the size of the piece of the disk described by the entry, in (65536
word) cylinders.
The first entry is always a partition table entry (reserving the cylinder whose first sector contains the partition table).
Following the partition table are any number of free space entries, boot partition entries, and disk partition entries.
Following those entries are enough unused entries to fill up the table. The partition table entries must describe the
entire disk, including any free space at the end.
The partition table ends with word containing a checksum of all of the previous words in the partition table. The
SBLK algorithm is used. The following code fragment computes the checksum of words BUF+0 to BUF+62, and
writes the result into word BUF+63.
WRC:
WRC1:

MOVE
MOVEI
ROT
ADD
AOBJN
MOVEM
POPJ

A,[-63.,,BUF]
B,0
B,1
B,(A)
A,WRC1
B,(A)
P,

Unused entries, with a type of 0, mark entries in the partition table that are not used for something else. They are
only allowed to appear at the end of the partition table, after the last entry that reserves any space on the disk.

A partition table entry, with a type of 1, describes the cylinder that holds the partition table in its very first sector.
The size is always 1.
0

An empty space entry, with a type of 2, describes cylinders that are not currently allocated.
0

SIZE (CYLINDERS)

A PDP-10 boot partition entry, with a type of 3, describes cylinders that contain a boot image. The size is always 4,
since a bootstrap image is always 256KW in length (it holds the entire contents of the lowest 256K words of memory).
The name should be restricted to the alpha-numeric subset of the SIXBIT character set (0-9, A-Z), since various
command parsers cannot deal with characters outside this range (without this kind of restriction, a command like
B/P:N/N:3 is ambiguous).
0

NAME (SIXBIT)

START ADDRESS

A PDP-10 disk partition entry, with a type of 4, describes cylinders that contain a disk image. Once again, the name
should be restricted to the alpha-numeric subset of the SIXBIT character set (0-9, A-Z).

27
4

SIZE (CYLINDERS)

NAME (SIXBIT)

Chapter 10

Opcodes
10.1

000-077: LUUOs and MUUOs
0x0

0x1

0x2

0x3

0x4

0x5

0x6

0x7

00x

MUUO

LUUO

01x

LUUO

02x

LUUO

02x

LUUO

04x

MUUO

05x

MUUO

06x

MUUO

07x

MUUO

10.2

100-177: Byte and Floating Point Operations
1x0

1x1

1x2

1x3

1x4

1x5

1x6

1x7

MUUO
(GFSB)

MUUO
(JSYS)

MUUO
(ADJSP)

MUUO
(GFMP)

MUUO
(GFDV)

10x

MUUO

MUUO
(GFAD)

11x

MUUO
(DFAD)

MUUO
(DFSB)

MUUO
(DFMP)

MUUO
(DFDV)

MUUO
(DADD)

MUUO
(DSUB)

MUUO
(DMUL)

MUUO
(DDIV)

12x

MUUO
(DMOVE)

MUUO
(DMOVN)

MUUO
(FIX)

MUUO
(EXTEND)

MUUO
(DMOVEM)

MUUO
(DMOVNM)

MUUO
(FIXR)

MUUO
(FLTR)

13x

UFA

DFN

FSC

IBP

ILDB

LDB

IDPB

DPB

14x

FAD

FADL

FADM

FADB

FADR

FADRI

FADRM

FADRB

15x

FSB

FSBL

FSBM

FSBB

FSBR

FSBRI

FSBRM

FSBRB

16x

FMP

FMPL

FMPM

FMPB

FMPR

FMPRI

FMPRM

FMPRB

17x

FDV

FDVL

FDVM

FDVB

FDVR

FDVRI

FDVRM

FDVRB

10.3

200-277: Moves and Integer Operations
2x0

2x1

2x2

2x3

2x4

2x5

2x6

2x7

20x

MOVE

MOVEI

MOVEM

MOVES

MOVS

MOVSI

MOVSM

MOVSS

21x

MOVN

MOVNI

MOVNM

MOVNS

MOVM

MOVMI

MOVMM

MOVMS

22x

IMUL

IMULI

IMULM

IMULB

MUL

MULI

MULM

MULB

22x

IDIV

IDIVI

IDIVM

IDIVB

DIV

DIVI

DIVM

DIVB

24x

ASH

ROT

LSH

JFFO

ASHC

ROTC

LSHC

MUUO

25x

EXCH

BLT

AOBJP

AOBJN

JRST

JFCL

XCT

MUUO
(MAP)

26x

PUSHJ

PUSH

POP

POPJ

JSR

JSP

JSA

JRA

27x

ADD

ADDI

ADDM

ADDB

SUB

SUBI

SUBM

SUBB

10.4

300-377: Compares, Skips, Jumps
3x0

3x1

3x2

3x3

3x4

3x5

3x6

3x7

30x

CAI

CAIL

CAIE

CAILE

CAIA

CAIGE

CAIN

CAIG

31x

CAM

CAML

CAME

CAMLE

CAMA

CAMGE

CAMN

CAMG

32x

JUMP

JUMPL

JUMPE

JUMPLE

JUMPA

JUMPGE

JUMPN

JUMPG

32x

SKIP

SKIPL

SKIPE

SKIPLE

SKIPA

SKIPGE

SKIPN

SKIPG

34x

AOJ

AOJL

AOJE

AOJLE

AOJA

AOJGE

AOJN

AOJG

35x

AOS

AOSL

AOSE

AOSLE

AOSA

AOSGE

AOSN

AOSG

36x

SOJ

SOJL

SOJE

SOJLE

SOJA

SOJGE

SOJN

SOJG

37x

SOS

SOSL

SOSE

SOSLE

SOSA

SOSGE

SOSN

SOSG

10.5

400-477: Boolean Operations
4x0

4x1

4x2

4x3

4x4

4x5

4x6

4x7

40x

SETZ

SETZI

SETZM

SETZB

AND

ANDI

ANDM

ANDB

41x

ANDCA

ANDCAI

ANDCAM

ANDCAB

SETM

SETMI

SETMM

SETMB

42x

ANDCM

ANDCMI

ANDCMM

ANDCMB

SETA

SETAI

SETAM

SETAB

42x

XOR

XORI

XORM

XORB

IOR

IORI

IORM

IORB

44x

ANDCB

ANDCBI

ANDCBM

ANDCBB

EQV

EQVI

EQVM

EQVB

45x

SETCA

SETCAI

SETCAM

SETCAB

ORCA

ORCAI

ORCAM

ORCAB

46x

SETCM

SETCMI

SETCMM

SETCMB

ORCM

ORCMI

ORCMM

ORCMB

47x

ORCB

ORCBI

ORCBM

ORCBB

SETO

SETOI

SETOM

SETOB

10.6

500-577: Half-Word Operations
5x0

5x1

5x2

5x3

5x4

5x5

5x6

5x7

50x

HLL

HLLI

HLLM

HLLS

HRL

HRLI

HRLM

HRLS

51x

HLLZ

HLLZI

HLLZM

HLLZS

HRLZ

HRLZI

HRLZM

HRLZS

52x

HLLO

HLLOI

HLLOM

HLLOS

HRLO

HRLOI

HRLOM

HRLOS

52x

HLLE

HLLEI

HLLEM

HLLES

HRLE

HRLEI

HRLEM

HRLES

54x

HRR

HRRI

HRRM

HRRS

HLR

HLRI

HLRM

HLRS

55x

HRRZ

HRRZI

HRRZM

HRRZS

HLRZ

HLRZI

HLRZM

HLRZS

56x

HRRO

HRROI

HRROM

HRROS

HLRO

HLROI

HLROM

HLROS

57x

HRRE

HRREI

HRREM

HRRES

HLRE

HLREI

HLREM

HLRES

10.7

600-677: Bit-Test Operations
6x0

6x1

6x2

6x3

6x4

6x5

6x6

6x7

60x

TRN

TLN

TRNE

TLNE

TRNA

TLNA

TRNN

TLNN

61x

TDN

TSN

TDNE

TSNE

TDNA

TSNA

TDNN

TSNN

62x

TRZ

TLZ

TRZE

TLZE

TRZA

TLZA

TRZN

TLZN

62x

TDZ

TSZ

TDZE

TSZE

TDZA

TSZA

TDZN

TSZN

64x

TRC

TLC

TRCE

TLCE

TRCA

TLCA

TRCN

TLCN

65x

TDC

TSC

TDCE

TSCE

TDCA

TSCA

TDCN

TSCN

66x

TRO

TLO

TROE

TLOE

TROA

TLOA

TRON

TLON

67x

TDO

TSO

TDOE

TSOE

TDOA

TSOA

TDON

TSON

10.8

700-777: I/O Operations
7x0

7x1

7x2

7x3

7x4

7x5

7x6

7x7

70x

IO-APR

71x

IO-RTC

72x

IO-TTY

72x

74x

IO-DSK

75x

76x

IO-ETH

77x