629f0f0 Jan 10, 2017
685 lines (491 sloc) 30 KB
Last update: 2017-01-08
This file documents the release history of the Hewlett-Packard 3000 simulator.
The SIMH project does not issue discrete releases. Instead, the current
simulator code base is available at:
...and may be downloaded at any time. A code snapshot is identified by the "git
commit ID" that is displayed by the simulator welcome banner.
Therefore, HP 3000 releases are simply documentation checkpoints that describe
the changes that have occurred since the last checkpoint. Generally, a release
is written when one or more major changes have been incorporated. Minor bug
fixes will be available immediately but only noted as part of the next release
General Information
The simulator passes the HP 32230 offline diagnostic suite with some expected
failures due to unimplemented features. For example, the disc diagnostic
error-correction logic tests and the tape diagnostic CRCC and LRCC tests fail,
as these features are not supported. However, all features that are required
for MPE operation pass their respective diagnostic tests.
The simulator has been tested with MPE-V/R version E.01.00. Specifically:
- MPE can be RELOADed to generate a new disc-based system from a FOS tape.
- MPE can be COOLSTARTed to run from a previously generated disc.
- The MPE system console operates (by default) through the simulation console,
and additional sessions may be connected to the ATC via Telnet or host
serial ports.
run properly.
- The SYSDUMP program produces a valid tape image, and the system may be
COLDSTARTed from it.
- The operator and system manager can be logged in and out, and MPE can be
SHUTDOWN through to a HALT 17.
The user's manual for the simulator is provided in Microsoft Word format in the
"doc" subdirectory of the code base snapshot downloaded from the github site. A
PDF version of the same manual is available at:
A preconfigured MPE-V/R disc image containing the Fundamental Operating Software
(FOS), selected SUBSYS language processors (BASIC, BASICOMP, COBOL, COBOLII,
FORTRAN, PASCAL, RPG, and SPL), and example programs is available from Bitsavers
The archive contains instructions and simulator command files that allow
ready-to-run operation.
Manuals describing MPE operation are also available from Bitsavers at:
HP created MPE-V/R-specific manuals. However, very few of them survive. In
general, the MPE-IV manuals describe a subset of MPE-V/R commands, whereas the
MPE-V/E manuals describe a superset. Relying on the MPE-IV manuals and the
online help available within MPE for those commands that do not appear in the
manuals is perhaps the best compromise.
Bugs in MPE V/R E.01.00
Testing during simulator development revealed the presence of several bugs in
the MPE version used:
- After a cold load from tape (COLDSTART/RELOAD/UPDATE), if a non-HP terminal
such as the simulation console is used as the system console, MPE prints DATE
(M/D/Y)? and then WED, NOV 1, 1972, 12:00 AM, as though RETURN had been
entered, but it wasn't. If an HP terminal emulator is used instead, MPE
waits for the user to enter the date before proceeding.
The problem is incorrect coding in the SPEEDSENSE procedure in module
INITIAL. As a result, the console baud rate is set to an invalid value, so
console reads fail. The resulting zero-length read is interpreted as though
RETURN had been entered.
This is MPE V/R SSB KPR Number 5000187104, "Foreign devices as SIII system
consoles do not work correctly on V/R." HP issued a patch for this, but it
does not seem to have survived. A simple workaround is to set local ENQ/ACK
processing on ATC channel 0 (SET ATCD0 LOCALACK) when the system console is
not an HP terminal. This is the default setting, so the bug only manifests
itself when SET ATCD0 REMOTEACK is done before booting. An alternate
workaround that does not depend on the ATC setting is to set memory location
01.112247 to octal value 021360. This changes the "LOAD P+22,I,X"
instruction at that location to "LDI 360" to set the detected speed to 2400
baud unconditionally.
- If a SHUTDOWN is performed while a logon read is pending on the system
console, e.g., by pressing RETURN to obtain the colon prompt after logging
OPERATOR.SYS off, the expected "ALL JOBS LOGGED OFF" message does not print.
Instead, the first few characters of the message (which begins with the
current time) are printed, followed as expected by SHUT and a HALT %17. If
no read is pending, either because RETURN was not pressed before entering the
SHUTDOWN command or because the read timed out, the message is printed
The problem is that while the message is being send to the ATC character-by-
character, the I/O abort issued to cancel the logon read also cancels the
message write. The timing is such that only the first few characters of the
message are printed before the rest of the output is cancelled.
No SSB KPR has been located, but a later MPE version inserts an ABORTIO call
for the system console immediately before logging all sessions off. This
clears any logon read that might exist, and therefore an abort will not be
performed after the "ALL JOBS LOGGED OFF" message is output. It is
impossible to patch memory to add this call, so the only workarounds when
shutting down are to avoid requesting the logon prompt, wait until the logon
timeout expires (nominally two minutes), log on and then back off again,
enter "=ABORTIO 20" to abort the read before entering SHUTDOWN, or accept
that the message will be truncated. The only consequence of this bug is the
partial message; MPE shuts down properly otherwise, so it may be safely
- After a RELOAD, running DPAN4.PUB.SYS produces a "CODE SEGMENT TOO LARGE
(LOAD ERR 33)" error. This is because MPE defaults to an 8K code segment
size limit, and DPAN4 has three segments between 8K and 12K in size. If the
limit is subsequently raised via a SYSDUMP and COLDSTART reconfiguration,
running DPAN4 produces a "FILE IS NOT A VALID PROGRAM FILE" error. However,
if the reconfiguration is done before running DPAN4, it will run properly
The problem is that MPE incorrectly modifies the executable file's Segment
Transfer Tables when it encounters a code segment that is larger than the
configured limit. This leaves the file in an inconsistent state, leading to
the "NOT A VALID PROGRAM FILE" message after reconfiguration to raise the
segment size limit. If the limit is raised before running DPAN4, the file is
internally consistent when the STTs are patched, and each segment's load
succeeds, allowing the program to run.
No SSB KPR has been located, but a later MPE version ensures that code
segment size aborts occur before any of the STTs are modified, so the program
file remains internally consistent. A memory patch is impossible, but
workarounds are to increase the code segment limit before running DPAN4 and
to restore DPAN4.PUB.SYS from the FOS tape if it has been damaged.
Release 4, 2017-01-08
This release of the HP 3000 simulator adds the following features:
- The HP 32234A COBOL II Extended Instruction Set firmware is now available.
The new SET CPU CIS option enables the firmware.
- Subprograms in memory associated with the EDIT instruction may be examined
symbolically with the -E switch.
- The new CPU "OPND" trace option traces memory byte operands.
- The new CPU "EXEC" trace option turns on full tracing for instructions
that match a value specified by the new "SET CPU EXEC=<match>{;<mask>}"
- The diagnostics coverage is extended to the COBOL II firmware.
Implementation Notes
- The MPE-V/R software kit has been updated to add the COBOL II runtime
routines to the system SL and COBOL example programs to the OPERATOR.SYS
account. The startup command files also enable the COBOL II instruction set.
- New "hp3000_cpu_cis.c" and "hp3000_mem.c" modules have been added.
- For this release, checking for interrupts is not performed during execution
of the COBOL II EDIT, TR, CMPS, and CMPT instructions. A future release will
add interruptibility to these instructions to comply with their hardware
- The new OPND trace option does not currently trace byte operands for
instructions in the base set (e.g., MOVB or CMPB). Operands for the
COBOL II firmware instructions are fully covered.
- The command-line switch for the EXAMINE command to request display in
status-register format has been changed from "-S" to "-T" to avoid conflict
with the "-S" switch used to indicate an address offset from SBANK.
Bugs Fixed
1. PROBLEM: SETR prints a base register trace when values are not changed.
VERSION: Release 3
OBSERVATION: The SETR instruction may be used to change any combination of
the SBANK, DB, DL, Z, STA, X, Q, and SM register values. If the REG trace
is active, the base register values will be printed after the instruction
completes. This occurs whether or not the base register values were
actually changed. In particular, the CPU diagnostic uses the SETR
instruction to flush the stack to memory without changing any base
registers. The REG trace in this case is unnecessary.
CAUSE: The "cpu_base_changed" flag is set unconditionally when the
instruction completes. It should be set only if the SETR instruction
specifies one or more base registers to change.
RESOLUTION: Modify "cpu_move_spec_fw_imm_field_reg_op" (hp3000_cpu_base.c)
to set the "cpu_base_changed" flag only if one or more base register change
bits are set in the instruction operand field.
STATUS: Fixed in Release 4.
2. PROBLEM: Invalid bank and offset values are accepted for address entry.
VERSION: Release 3
OBSERVATION: Bank-offset addresses with out-of-range the bank or offset
values, e.g., EXAMINE 30.0 and EXAMINE 0.1777777, are accepted without
complaint. The bank value is taken modulo 20, and the higher order bits of
the offset value are merged into the bank number. Values out of range
should be rejected with errors.
CAUSE: Incomplete range verification.
RESOLUTION: Modify "parse_addr" (hp3000_sys.c) to check the parsed bank
and offset values against their respective maximums and return an "Invalid
argument" error if either is exceeded.
STATUS: Fixed in Release 4.
3. PROBLEM: The "-S" (SBANK-offset) switch displays values in status-register
VERSION: Release 3
OBSERVATION: The HP 3000 User's Manual states that adding the "-S" switch
to the EXAMINE command implies that the offset is from the bank number in
the SBANK register. The example given, "EXAMINE -S <sbank-offset>", should
display the memory data value at the address <SBANK-number>.<offset> in
octal format. Instead, it displays the value in status-register format.
CAUSE: The "-S" switch is used for both SBANK and STA formats. Section
2.1.3 says that -S means that "The implied bank number is obtained from
SBANK." Section 2.1.2 says that -S means that "A CPU status mnemonic" is
being displayed. For EXAMINE -S, the latter interpretation causes the
expected octal value to be displayed in status-register format.
RESOLUTION: Modify "fprint_sym" (hp3000_sys.c) to use the "-T" switch to
designate status-register format. Modify hp3000_sys.c, hp3000_cpu.c, and
hp3000_defs.h to rename the "REG_S" format indicator to "REG_T" for
consistency with the switch change.
STATUS: Fixed in Release 4.
4. PROBLEM: SCAL 0 and PCAL 0 instructions fail when a stack overflow occurs.
VERSION: Release 3
OBSERVATION: The SCAL 0 and PCAL 0 instructions transfer control via
subroutine or procedure calls, respectively, through program labels
residing on the top of the stack. If a stack overflow occurs during
instruction execution, the stack overflow trap handler is called to enlarge
the stack, and the instruction is reexecuted. However, the program label
has been lost, so control transfers to a random location.
CAUSE: The instructions obtain the label and then delete the TOS, flush
the rest of the stack registers to memory, and then check that SM <= Z,
i.e., that the current top of the stack in memory does not exceed the
stack limit. If SM > Z, a stack overflow has occurred, and the trap
handler is called. However, the label has not been restored to the stack,
so when the instruction is reexecuted after the stack is enlarged, the
wrong value is pulled from the TOS.
RESOLUTION: Modify "cpu_io_cntl_prog_imm_mem_op" SCAL and PCAL executors
(hp3000_cpu_base.c) to push the label back onto the stack before taking the
stack overflow trap.
STATUS: Fixed in Release 4.
Release 3, 2016-09-20
This release of the HP 3000 simulator adds the following features:
- Cold dump is now available. Entering the DUMP command simulates pressing
the ENABLE and DUMP front panel buttons. The contents of main memory are
written to an attached magnetic tape in a format suitable for analyzing with
the DPAN4 program. The new SET CPU DUMPDEV and SET CPU DUMPCTL options
specify the default device number and control byte for the dump.
- The SHOW LP VFU command now displays the VFU channel definitions in
addition to the VFU tape title.
- The POWER FAIL and POWER RESTORE commands have been added to simulate losing
and regaining system power.
- The SET CPU ARS and SET CPU NOARS options have been added to simulate the
power-fail/auto-restart switch on the back of the system front panel.
- The CMD instruction has been implemented and passes section 4 of the CPU
Implementation Notes
- In hardware, MPE execution cannot continue after a DUMP is performed. This
is because a cold dump performs an I/O reset before writing the contents of
memory to the tape, and this clears the I/O device controllers to their
initial power-on states. However, execution can be continued if a SAVE is
done to record the simulator state before the dump and a RESTORE is done
after the dump completes. This permits taking a "snapshot" of MPE operation
without disturbing MPE.
Bugs Fixed
1. PROBLEM: An SIO READ or WRITE order with a 4K count displays as zero.
VERSION: Release 2
OBSERVATION: SIO READ and WRITE orders define bits 4-15 as the negative
word count of the transfer. If bits 4-15 are zero, the transfer is 4096
words long. However, an EXAMINE -I command displays the word count as
CAUSE: The display value is being calculated incorrectly.
RESOLUTION: Modify "IOCW_COUNT" (hp3000_cpu_ims.h) to sign-extend the
12-bit count correctly to 16 bits, and modify "fprint_order" (hp3000_sys.c)
to negate the values to display the counts as positive. Also modify
"mpx_interface" (hp3000_mpx.c) to display the correct count in the debug
trace for the DREADSTB operation.
STATUS: Fixed in Release 3.
2. PROBLEM: An I/O reset does not clear a pending external interrupt.
VERSION: Release 2
OBSERVATION: A cold load begins with a CPU reset and an I/O reset. A cold
dump begins with an I/O reset only to preserve the CPU state for the dump
operation. The external interrupt flip-flop on the IOP is cleared by an
I/O reset, which should clear the external interrupt bit in the CPX1
register. However, this does not occur, causing the interrupt generated by
placing the tape drive online to be misinterpreted as the SIO program
completion interrupt. Because the SIO pointer is not set as expected, the
cold dump microcode assumes that a tape error occurred and performs a
retry. This writes an erase gap at the beginning of the tape but otherwise
produces a valid tape.
CAUSE: Oversight.
RESOLUTION: Add a new "iop_reset" routine (hp3000_iop.c) that is called
during an I/O reset and that clears the external interrupt bit of the CPX1
STATUS: Fixed in Release 3.
3. PROBLEM: RESTORE of a file SAVEd with a different executable may abort the
VERSION: Release 2
OBSERVATION: Entering SAVE to save the simulator state on an executable
compiled with one set of compiler options or compiler version and then
entering RESTORE to restore the state on an executable compiled with a
different set of compiler options or compiler version succeeds. However,
attempting to resume execution results in an access exception.
CAUSE: The simulator's internal Device Information Blocks contain pointers
to the devices' I/O interface handlers, which are saved as part of the DIB
structure in the simulator state file. When restoring the state, the
interface handler pointers are restored. However, the addresses of one or
more routines may have changed, due to differing memory layouts, so the
restored values are no longer correct. If they are not, and I/O is
performed to the affected device(s), control transfers to an invalid code
RESOLUTION: Modify hp3000_io.h to add a new REG_DIB macro that defines the
register entries needed to save the DIB state, and modify hp3000_atc.c,
hp3000_clk.c, hp3000_ds.c, hp3000_lp.c, hp3000_mpx.c, hp3000_ms.c, and
hp3000_scmb.c to change the REG entries referencing the DIB structures to
use the REG_DIB macro.
STATUS: Fixed in Release 3.
4. PROBLEM: The LOAD command does not report "Cold load complete".
VERSION: Release 2
OBSERVATION: The LOAD command should report success after completion of a
cold load operation, but it doesn't. Instead, the SCP prompt returns with
no indication of whether the command succeeded or failed. Using the
equivalent BOOT CPU command does print the expected "Cold load complete"
CAUSE: The "Cold load complete" message is printed by the simulator's
"fprint_stopped" routine that is called via the "sim_vm_fprint_stopped"
pointer from the "run_cmd_message" routine in SCP. The latter is invoked
via the "message" field of the command table. The LOAD, DUMP, and POWER
commands all invoke "sim_instr" via "run_cmd" but do not specify routine
pointers for their message fields, so no completion messages are reported.
RESOLUTION: Modify "one_time_init" (hp3000_sys.c) to set the "message"
fields of the LOAD, DUMP, and POWER commands to point at the same routine
as is used by the system "CONTINUE" command.
STATUS: Fixed in Release 3.
5. PROBLEM: RESTOREing with the ATCD attached cancels active line services.
VERSION: Release 2
OBSERVATION: Doing a SAVE while the ATCD has line services scheduled,
e.g., while outputting characters, and then following immediately with a
RESTORE cancels the line services. For example, after a SAVE, a SHOW QUEUE
command prints:
HP 3000 event queue status, time = 907247803
CLK at 0
ATCD unit 0 at 241
CPU at 27917
ATCD unit 16 at 27918
DS unit 8 at 612615
Entering RESTORE and then SHOW QUEUE prints:
HP 3000 event queue status, time = 907247803
CLK at 0
CPU at 27917
ATCD unit 16 at 27918
DS unit 8 at 612615
Note that ATCD unit 0 is no longer scheduled.
CAUSE: The "atcd_detach" routine is called during RESTORE if the listening
port is currently attached in preparation for reattaching to the port
specified in the SAVE file. The routine detaches the listening port and
then cancels each line to terminate any transfers in progress. This is
appropriate for DETACH ATCD and DETACH ALL, but not for RESTORE, as the
terminal channels have already been rescheduled as indicated in the SAVE
file, and canceling them hangs the channels.
RESOLUTION: Modify "atcd_detach" (hp3000_atc.c) to skip the channel
termination loop if the SIM_SW_REST flag is set to indicate a RESTORE in
STATUS: Fixed in Release 3.
Release 2, 2016-07-05
This release of the HP 3000 simulator adds the following device simulation:
- 30209A Line Printer Controller with One 2607/13/17/18 Line Printer
The simulation supports the use of custom VFU tape images, as well as the
built-in HP-standard VFU tape. The simulated device name is "LP". The full set
of configurable options is detailed in a new section of the HP 3000 Simulator
User's Guide.
In addition, the preconfigured MPE-V/R disc image has been updated to add the
following features:
- The MPE cold load command files attach the line printer to the "lp.txt"
output file and specify the "-n" option to clear the file before use.
- Preinstalled User-Defined Commands (UDCs) provide access to the COBOL 74
compiler with the MPE-V/E :COBOLII, :COBOLIIPREP, and :COBOLIIGO commands,
and to the COBOL 85 compiler with :COBOLIIX, :COBOLIIXPREP, and :COBOLIIXGO.
However, see the implementation note below.
Implementation Notes
- MPE requires a line printer, so it is recommended that the MPE startup
simulator command file include an ATTACH LP <filename> command to load paper
into the printer before cold loading. If the printer is not attached, it
will appear to MPE to be out of paper.
- The line printer terminates each print line with an HP-standard CR/LF pair.
If the output file is to be retained as a text file on a Unix system, removal
of the carriage returns, e.g., via the "dos2unix" utility, may be desirable.
- The simulator currently does not provide the HP 32234A COBOL II firmware
instructions, so programs generated by the COBOLII compiler will abort at run
time with an "ILLEGAL INSTRUCTION" error. Programs generated by the COBOL
compiler do not use these instructions and therefore are not affected.
Bugs Fixed
1. PROBLEM: The effective address of a byte pointer with a negative index is
calculated incorrectly.
VERSION: Release 1
OBSERVATION: Defining a :WELCOME message in MPE appears to work, but when
the next logon attempts to print the message, an infinite number of CRLFs
are printed instead.
CAUSE: The welcome message is stored in an extra data segment. The format
for each message line is a line length stored in the lower byte of the word
preceding the message string. The code defines BYTE POINTER NEXTLINE and
points NEXTLINE to the first message character. The line length is set
with NEXTLINE(-1) := IOCOUNT. This generates a LOAD <IOCOUNT> ; LDXN 1 ;
STB <NEXTLINE>,I,X sequence.
In the "cpu_ea" routine, the indexing adds the X register value (-1) to the
byte pointer (NEXTLINE). This causes an overflow that is not masked to 16
bits. For a word access, this displacement is added to the base register
and then masked to 16 bits, which gives the correct value. However, for
byte accesses, the displacement is divided by 2 and then added, and the sum
is masked. Dividing by 2 shifts the overflow bit into the MSB, causing the
addition result to be off by 32K. The STB goes to the wrong location, the
original zero in the length byte location is retained, and when the welcome
message is printed, a zero-length line is printed, and the byte pointer is
incremented by zero, so the null line is printed forever.
RESOLUTION: Modify "cpu_ea" (hp3000_cpu.c) to mask indexed displacements
to 16 bits after adding the X register value.
STATUS: Fixed in Release 2.
2. PROBLEM: An SMSK instruction may clear the interrupt mask flip-flop of a
device that specifies that it is should be "always enabled."
VERSION: Release 1
OBSERVATION: If the TOS word is zero, an SMSK instruction will clear the
interrupt mask flip-flop of a device whose mask jumper is set to "E"
(always enabled).
CAUSE: In response to a DSETMASK signal, device interfaces set their
interrupt mask flip-flops by "anding" the incoming data word with the
interrupt mask jumper setting. The jumper setting value for "always
enabled" is %177777, which sets the mask flip-flop in all cases, except
when the data word is zero.
RESOLUTION: Modify hp3000_atc.c, hp3000_ds.c, and hp3000_ms.c to set their
mask flip-flops unconditionally if the jumper setting is "E".
STATUS: Fixed in Release 2.
3. PROBLEM: The "SET <dev> INTMASK=<n>" command sets the wrong bit in the
device interface's interrupt mask jumper setting.
VERSION: Release 1
OBSERVATION: The interrupt mask jumper on a device interface is set by
specifying the mask bit number in a "SET <dev> INTMASK=<n>" command. This
sets a bit in the device's interrupt mask jumper word corresponding to the
bit number requested. However, the bit numbering is incorrect; setting the
jumper for bit 15, for example, sets bit 0 of the jumper word. Therefore,
the interface's mask flip-flop is not set as expected when an SMSK
instruction is executed.
CAUSE: The bit numbers were counted from the wrong end of the word.
RESOLUTION: Modify "hp_set_dib" and "hp_show_dib" (hp3000_sys.c) to number
the bits from the MSB instead of the LSB.
STATUS: Fixed in Release 2.
4. PROBLEM: The Multiplexer Channel is not generating the ACKSR signal
VERSION: Release 1
OBSERVATION: The line printer controller hangs when an SIO chained write
is performed. The first programmed write completes normally, but the
second does not start. The channel is waiting for a service request that
does not occur.
CAUSE: The service request from the last write of the first block transfer
is being cleared by an ACKSR generated by the Multiplexer Channel when it
performs the IOCW fetch in State A for the second write request. The
channel should omit this ACKSR when the previous I/O order was a chained
read or write. However, the simulator is testing the order just fetched
(Write) instead of the order that has just completed (Write Chained).
RESOLUTION: Modify "mpx_service" (hp3000_mpx.c) to test the correct I/O
order in State A.
STATUS: Fixed in Release 2.
Release 1, 2016-03-07
This is the initial release of the HP 3000 simulator. The following devices are
currently simulated:
- 30003B Series III computer with up to 1024 KW of memory
- 30003B I/O Processor
- 30036B Multiplexer Channel
- 30030C Selector Channel
- 30033A Selector Channel Maintenance Board
- 30032B Asynchronous Terminal Controller data interface
- 30061B Asynchronous Terminal Controller control interface
- 30135A System Clock/Fault Logging Interface
- 30215A Tape Controller with four 7970B/E drives
- 30229B Disc Controller with eight 7905/7906/7920/7925 drives
The "HP 3000 Simulator User's Guide" manual describes the configuration and
operation of each of these devices in detail.
Implementation Notes
- IMPORTANT: There is no line printer simulation. MPE cannot be configured to
run without a printer; attempting to delete LDEV 6 produces "ERROR #115
UNDEFINED CLASS LP USED AS OUTPUT DEVICE", and class LP cannot be deleted.
With LDEV 6 present, MPE will boot and run, but doing, e.g., :STOPSPOOL 6
causes "NON-RESPONDING DRT #14" and "SYSTEM FAILURE #201" when the printer
doesn't respond. Entering :OUTFENCE 14 at the console operator's session
immediately after bootup is a workaround. The LP simulator should be present
in the next release.
- The CPU is a hybrid of the Series II instruction set microcode and the Series
III memory size and hardware behavior, because the Series III microcode is
not available.
- The CPU is currently missing a few "difficult" instructions (the CMD
instruction, the Series II LOCK and UNLK instructions, and the entire
Extended Instruction Set). Although the EIS is not present, MPE has a
software emulator for these instructions that is invoked transparently by the
Unimplemented Instruction traps that occur when attempted execution of EIS
instructions occurs.
- The main memory Fault Logging Interface section of the 30135A is currently
not simulated. Although fault-control memory was standard on the Series II
and later, the memory fault logger is smart enough to realize that the FLI is
not there, so MPE will run without it.
- Symbolic entry of CPU instructions, CPU status, and I/O instructions are not
currently supported.