1:40 AM 8/30/13 92064-18002 RTE-M executive module rev. 1650 contains: MIC SVR,105620B,2 MIC RSR,105621B,2 will use three microcoded instructions: - 105620 SVR -- save registers - 105621 RSR -- restore registers - 105622 LRR -- verify legality of EXEC parameters see code at "MIC" labels 92064-18003 RTE-M I/O control module rev. 1901 contains: MIC SVR,105360B,2 SAVE REGISTERS MIC RSR,105361B,2 RESTORE REGISTERS MIC STR,105363B,1 SEQUENTIAL STORE VALUE MIC INT,105364B,1 INTERRUPT TABLE SEARCH MIC LNK,105365B,2 I/O REQUEST LINK 92064-18004 RTE-M dispatcher rev. 1726 contains: MIC STR,105623B,1 SEQUENTIAL STORE VALUE HP 21xx/1000 Microcode Notes ============================ The Computing History Simulator (SIMH) emulates a number of historic computers, including the HP 21xx. Currently, the base sets of the 2100 and 21MX-M are implemented, along with the TIMER instruction from the 21MX-E. Floating point (optional on the 2100, standard on the 21MX) is implemented. No additional microcoded options have been implemented so far. The original primary advantage of microcoded instructions, namely, a two to twenty-fold improvement in execution time, is valid as well with simulation, as only a single instruction's overhead (e.g., breakpoint checking, simulated interrupt and DMA execution, instruction decoding) would be incurred, versus numerous multiples of this for the software library emulations. However, current host machines are so fast that the improvement in real time is negligible; the simulated system already executes many times faster than the original. However, the secondary advantage of smaller code size is still important. For example, the 92832A Pascal compiler will not quite load on a system that has a three-page driver partition (which is necessary if the 8-channel multiplexer driver has several device drivers). To reduce the size enough to load, either Fast FORTRAN Processor or Double Integer instructions must be provided. Other legacy programs may have just fit in the address space with microcoded instructions and will not fit with software emulations. An additional requirement for microcode support comes when trying to load and run old system generations. A given generation may have been run on a system with firmware support and so will have microcoded instructions present throughout the instruction stream. Regeneration is possible, providing the original generation files are still available. If they are not, then that system generation is irrecoverable. The greatest problem in implementing microcode options is the lack of primary source documentation. No source listing of the microcode exists. The function may be replicated by referring to the software library emulations and the published calling sequences, but quirks or hidden features in the microcode will be lost. Reverse assemblies of the microcode are possible but are difficult to understand. The following firmware options were available for the HP 1000 and are candidates for support under SIMH: CPU Product Description ROM Modules Addresses Inst Codes ---- ------- ------------------------------------ --- ------- ----------- ---------- 2100 12901A Floating Point 1K 1 400-777 105000-120 2100 13206A 2000 Communications Processor 1K 1 400-777 105000-362 2100 12907A Fast FORTRAN Processor 1K 2-3 1000-1777 105200-237 M 12976B Dynamic Mapping System 4K 2 1000-1377 105700-737 M 12977B Fast Fortran Processor 4K 3-5 1400-2777 105200-237 M 13207A 2000 Communications Processor 1K 8 4000-4377 105400-437 9 4400-4777 105460-477 M 91740A Distributed System Firmware 4K 10-11 5000-5777 105520-537 E 13307B Dynamic Mapping System 4K 32-33 20000-20777 105700-737 E 13306B Fast Fortran Processor 4K 34-35 21000-21777 105200-237 E 22702A 2000 Communications Processor ĽK 39 23420-23420 10x400-437 23400-23777 105460-477 F 12824A Vector Instruction Set for RTE-IVB 8K 12-15 06000-07777 105460-477 F 12829A Vector Instruction Set for RTE-6/VM 8K 12-15 06000-07777 105460-477 F std Dynamic Mapping / Fast Fortran 8K 32-35 20000-20377 105700-737 20400-21777 105200-237 F 12823A Scientific Instruction Set 8K 40-43 24000-25777 105320-337 F 92835A SIGNAL/1000 Digital Signal Processing 8K 56-59 34000-35777 105600-617 EF 92067A RTE-IVA/B Extended Memory Array 4K 36-37 22000-22777 105240-257 EF 92084A RTE-6/VM EMA/VMA Firmware 4K 36-37 22000-22777 105240-257 EF 91740B Distributed System Firmware 4K 38-39 23000-24777 105300-317 EF 92084A RTE-6/VM Operating System Firmware 4K 44-45 26000-26777 105340-357 Note that the 2100 IOP opcodes overlap both FP and FFP and are different from the 21MX IOP instruction codes. Note also that the mapping for the E-Series IOP instructions 10x400-10x437 is non-standard. The base set jump table maps this entire instruction range to firmware address 23420. This is indicated on page G-11 of the E-Series microcoding manual (base set listing); the control store mapping table on page 6-4 of the same manual has incorrect values for these instruction codes. 2100 Floating Point -- ROMs are 1K (256 x 4) ============================================ Part Number Bits Mod Loc ----------- ----- --- ---- 1816-0054 3-0 1 XU37 1816-0055 7-4 1 XU35 1816-0056 11-8 1 XU25 1816-0057 15-12 1 XU65 1816-0058 19-16 1 XU27 1816-0059 23-20 1 XU26 Name Instr Documentation Description ---- ------ ------------- ----------------------------------- FAD 105000 2100 Oper/Ref Single-precision add FSB 105020 2100 Oper/Ref Single-precision subtract FMP 105040 2100 Oper/Ref Single-precision multiply FDV 105060 2100 Oper/Ref Single-precision divide FIX 105100 2100 Oper/Ref Single-precision fix to integer FLT 105120 2100 Oper/Ref Single-precision float from integer Name Instr Format Operand Flags ---- ------ ---------------- ------------- FAD 105000 FAD ; DEF op[,I] ADR FSB 105020 FSB ; DEF op[,I] ADR FMP 105040 FMP ; DEF op[,I] ADR FDV 105060 FDV ; DEF op[,I] ADR FIX 105100 FIX NUL FLT 105120 FLT NUL 2100 FFP -- ROMs are 1K (256 x 4) ================================= Part Number Bits Mod Loc ----------- ----- --- --- 1816-0368 3-0 2 U42 1816-0369 7-4 2 U12 1816-0370 11-8 2 U22 1816-0371 15-12 2 U52 1816-0372 19-16 2 U32 1816-0373 23-20 2 U62 1816-0490 3-0 3 U41 1816-0491 7-4 3 U11 1816-0492 11-8 3 U21 1816-0493 15-12 3 U51 1816-0494 19-16 3 U31 1816-0495 23-20 3 U61 2100 IOP -- ROMs are 1K (256 x 4) ================================= Part Number Bits Mod Loc ----------- ----- --- ---- 1816-0532 3-0 1 XU37 1816-0533 7-4 1 XU35 1816-0534 11-8 1 XU25 1816-0535 15-12 1 XU65 1816-0536 19-16 1 XU27 1816-0537 23-20 1 XU26 Name Instr Documentation Description ----- ---------- ------------- ------------------------------------------------------ ILIST 105000 Access Intern Indirect address list (similar to $SETP) LAI 105020-057 Access Intern Load A indexed by B (± offset in bits 4-0 of IR) SAI 105060-117 Access Intern Store A indexed by B (± offset in bits 4-0 of IR) MBYTE 105120 Access Intern Move bytes CRC 105150 Access Intern Generate CRC TRSLT 105160 Access Intern Translate character MWORD 105200 Access Intern Move words READF 105220 Access Intern Read F register (stack pointer) PRFIO 105221 Access Intern Power fail I/O PRFEI 105222 Access Intern Power fail exit with I/O PRFEX 105223 Access Intern Power fail exit ENQ 105240 Access Intern Enqueue PENQ 105257 Access Intern Priority enqueue DEQ 105260 Access Intern Dequeue SBYTE 105300 Access Intern Store byte LBYTE 105320 Access Intern Load byte REST 105340 Access Intern Restore registers from stack SAVE 105362 Access Intern Save registers to stack 1000-M IOP (13207A) =================== Modules: 8 Address: 04000 Opcodes: 10x400-10x437 ROM Size: 256 x 4 Part Number Bits ----------- ----- 1816-0545 3-0 1816-0539 7-4 1816-0540 11-8 1816-0541 15-12 1816-0542 19-16 1816-0543 23-20 Modules: 9 Address: 04400 Opcodes: 105460-105477 ROM Size: 256 x 4 Part Number Bits ----------- ----- 1816-0538 3-0 1816-0544 7-4 1816-0549 11-8 1816-0548 15-12 1816-0547 19-16 1816-0546 23-20 1000-E IOP (22702A) =================== Modules: 39 Address: 23400 Opcodes: 10x400-10x437, 105460-105477 ROM Size: 256 x 4 Part Number Bits ----------- ----- 1816-0996 3-0 1816-0997 7-4 1816-0998 11-8 1816-0999 15-12 1816-1000 19-16 1816-1001 23-20 Name Instr Documentation Description ----- ---------- ------------- -------------------------------------------------- SAI 101400-037 Access Intern Store A indexed by B (± offset in bits 4-0 of IR) LAI 105400-037 Access Intern Load A indexed by B (± offset in bits 4-0 of IR) CRC 105460 Access Intern Generate CRC REST 105461 Access Intern Restore registers from stack READF 105462 Access Intern Read F register (stack pointer) INS 105463 Access Intern Initialize F register (stack pointer) ENQ 105464 Access Intern Enqueue PENQ 105465 Access Intern Priority enqueue DEQ 105466 Access Intern Dequeue TRSLT 105467 Access Intern Translate character ILIST 105470 Access Intern Indirect address list (similar to $SETP) PRFEI 105471 Access Intern Power fail exit with I/O PRFEX 105472 Access Intern Power fail exit PRFIO 105473 Access Intern Power fail I/O SAVE 105474 Access Intern Save registers to stack FFP: Name Instr CPU Documentation Description ----- ------ ---- ------------- -------------------------------------------------- [---] 105200 F CE Handbook [FFP self test] DBLE 105201 0MEF Reloc Library Real to extended real SNGL 105202 0MEF Reloc Library Extended real to real .XMPY 105203 0ME Reloc Library Extended real multiply .XDIV 105204 0ME Reloc Library Extended real divide .DFER 105205 0MEF Reloc Library Transfer extended real .XPAK 105206 MEF Reloc Library Normalize and pack extended real XADD 105207 0ME Reloc Library Extended real add .BLE 105207 F Reloc Library Real to double real XSUB 105210 0ME Reloc Library Extended real subtract XMPY 105211 0ME Reloc Library Extended real multiply XDIV 105212 0ME Reloc Library Extended real divide .XADD 105213 0ME Reloc Library Extended real add .XSUB 105214 0ME Reloc Library Extended real subtract .NGL 105214 F Reloc Library Double real to real .XCOM 105215 MEF Reloc Library Complement extended real ..DCM 105216 MEF Reloc Library Complement and normalize extended real DDINT 105217 MEF Reloc Library Truncate extended real .XFER 105220 0MEF Reloc Library Transfer extended real .GOTO 105221 0MEF Reloc Library Transfer control ..MAP 105222 0MEF Reloc Library Compute array element address .ENTR 105223 0MEF Reloc Library Transfer parameter addresses .ENTP 105224 0MEF Reloc Library Transfer parameter addresses .PWR2 105225 MEF Reloc Library X times 2 to the power N .FLUN 105226 MEF Reloc Library Unpack real $SETP 105227 0MEF Reloc Library Set a table .PACK 105230 MEF Reloc Library Normalize real .CFER 105231 EF Reloc Library Transfer double real ..FCM 105232 F Reloc Library Complement and normalize real ..TCM 105233 F Reloc Library Complement and normalize double real VIS: Name Instr Documentation Description ----- ------ ------------- -------------------------------------------------- .VECT 101460 Reloc Library Word 1 for 2-word VIS opcodes, single-precision VPIV 101461 Reloc Library Vector pivot, single-precision VABS 101462 Reloc Library Vector absolute value, single-precision VSUM 101463 Reloc Library Vector sum, single-precision VNRM 101464 Reloc Library Vector norm, single-precision VDOT 101465 Reloc Library Vector dot product, single-precision VMAX 101466 Reloc Library Vector maximum value, single-precision VMAB 101467 Reloc Library Vector maximum absolute value, single-precision VMIN 101470 Reloc Library Vector minimum value, single-precision VMIB 101471 Reloc Library Vector minimum absolute value, single-precision VMOV 101472 Reloc Library Vector move, single-precision VSWP 101473 Reloc Library Vector swap, single-precision .ERES 101474 Reloc Library Calculate 2-word offset for EMA .ESEG 101475 Reloc Library Set multiple map registers .VSET 101476 Reloc Library Calculate map table from .ERES info .DVCT 105460 Reloc Library Word 1 for 2-word VIS opcodes, double-precision DVPIV 105461 Reloc Library Vector pivot, double-precision DVABS 105462 Reloc Library Vector absolute value, double-precision DVSUM 105463 Reloc Library Vector sum, double-precision DVNRM 105464 Reloc Library Vector norm, double-precision DVDOT 105465 Reloc Library Vector dot product, double-precision DVMAX 105466 Reloc Library Vector maximum value, double-precision DVMAB 105467 Reloc Library Vector maximum absolute value, double-precision DVMIN 105470 Reloc Library Vector minimum value, double-precision DVMIB 105471 Reloc Library Vector minimum absolute value, double-precision DVMOV 105472 Reloc Library Vector move, double-precision DVSWP 105473 Reloc Library Vector swap, double-precision [---] 105477 CE Handbook [VIS self test] F-Series FPP Name Instr Documentation Description ----- ------ ------------- -------------------------------------------------- .XADD 105001 Reloc Library Extended real add .TADD 105002 Reloc Library Double real add [---] 105004 CE Handbook [FPP self test] .DAD 105014 Reloc Library Double integer add .XSUB 105021 Reloc Library Extended real subtract .TSUB 105022 Reloc Library Double real subtract .DSB 105034 Reloc Library Double integer subtract .XMPY 105041 Reloc Library Extended real multiply .TMPY 105042 Reloc Library Double real multiply .DMP 105054 Reloc Library Double integer multiply .XDIV 105061 Reloc Library Extended real divide .TDIV 105062 Reloc Library Double real divide .DDI 105074 Reloc Library Double integer divide .DINT 105101 Reloc Library Extended real to integer fix .XFXS 105101 Reloc Library Extended real to integer fix .TINT 105102 Reloc Library Double real to integer fix .TXFS 105102 Reloc Library Double real to integer fix .FIXD 105104 Reloc Library Real to double integer fix .XFXD 105105 Reloc Library Extended real to double integer fix .TFXD 105106 Reloc Library Double real to double integer fix .DSBR 105114 Reloc Library Double integer subtraction (reversed) .IDBL 105121 Reloc Library Integer to extended real float .XFTS 105121 Reloc Library Integer to extended real float .ITBL 105122 Reloc Library Integer to double real float .TFTS 105122 Reloc Library Integer to double real float .FLTD 105124 Reloc Library Double integer to real float .XFTD 105125 Reloc Library Double integer to extended real float .TFTD 105126 Reloc Library Double integer to double real float .DDIR 105134 Reloc Library Double integer divide (reversed) .DNG 105203 Reloc Library Double integer negate .DCO 105204 Reloc Library Double integer compare .DIN 105210 Reloc Library Double integer increment .DDE 105211 Reloc Library Double integer decrement .DIS 105212 Reloc Library Double integer increment and skip if zero .DDS 105213 Reloc Library Double integer decrement and skip if zero SIS: Name Instr Documentation Description ----- ------ ------------- -------------------------------------------------- TAN 105320 Reloc Library Tangent SQRT 105321 Reloc Library Square root ALOG 105322 Reloc Library Natural logarithm ATAN 105323 Reloc Library Arctangent COS 105324 Reloc Library Cosine SIN 105325 Reloc Library Sine EXP 105326 Reloc Library Exponential ALOGT 105327 Reloc Library Common logarithm TANH 105330 Reloc Library Hyperbolic tangent DPOLY 105331 Reloc Library Polynomial evaluation /CMRT 105332 Reloc Library Range reduction function /ATLG 105333 Reloc Library Compute (1-x)/(1+x) double real .FPWR 105334 Reloc Library Exponentiation real to integer .TPWR 105335 Reloc Library Exponentiation double real to integer [---] 105337 CE Handbook [SIS self test] RTE-IVB EMA: Name Instr Documentation Description ----- ------ ------------- -------------------------------------------------- .EMIO 105240 Prog Ref Map EMA for I/O MMAP 105241 Prog Ref Map physical to logical address [---] 105242 CE Handbook [EMA self test] .EMAP 105257 Prog Ref Resolve array element access RTE-6/VM VMA: Name Instr Documentation Description ----- ------ ------------- -------------------------------------------------- .PMAP 105240 Microcode Src Map EMA/VMA page in map register $LOC 105241 Microcode Src Memory resident nodes load on call [---] 105242 Microcode Src [VMA self-test] .SWAB 105243 Microcode Src Swap A and B registers .SWSP 105244 Microcode Src Swap A and B registers and load A with SP .LDSP 105245 Microcode Src Load A with SP [---] 105246 Microcode Src [unused] .UMPY 105247 Microcode Src Unsigned 16 bit * 16 bit MPY + 16 bit ADD .IMAP 105250 Prog Ref Resolve and map integer subscript access .IMAR 105251 Microcode Src Single int subscript array calc. .JMAP 105252 Prog Ref Resolve and map double integer subscript access .JMAR 105253 Microcode Src Double int subscript array calc. .LPXR 105254 Prog Ref Convert virtual address plus offset to logical .LPX 105255 Prog Ref Convert virtual address plus offset to logical .LBPR 105256 Prog Ref Convert virtual address to logical .LBP 105257 Prog Ref Convert virtual address to logical RTE-6/VM OS: Name Instr Documentation Description ----- ------ ------------- -------------------------------------------------- $LIBR 105340 Reloc Library Emulate system entry $LIBR $LIBX 105341 Reloc Library Emulate system entry $LIBX .TICK 105342 Microcode Src TBG tick EQT timeout processor .TNAM 105343 Microcode Src Find ID segment that matches a name .STIO 105344 Tech Specs Configure I/O instructions for drivers .FNW 105345 Tech Specs Find word with user increment .IRT 105346 Microcode Src Interrupt return processing .LLS 105347 Tech Specs Linked list search .SIP 105350 Microcode Src Skip if interrupt pending .YLD 105351 Microcode Src .SIP completion return point .CPM 105352 Reloc Library Compare words in memory .ETEQ 105353 Microcode Src Setup base page EQT values .ENTN 105354 Reloc Library Entry point resolver [---] 105355 Microcode Src [OS self-test] .ENTC 105356 Reloc Library Entry point resolver .DSPI 105357 Microcode Src Show low 6 bits of A register in the display indicator register on front panel SIGNAL/1000: Name Instr Documentation Description ----- ------ ------------- -------------------------------------------------- %FFTRP in $HPFFT contains rpls %RPTBL in 91711 Floating Point Processor instruction decoding --------------------------------------------- FAD 105000 105020 105040 105060 LB01400 JMP LB01476 .XADD 105001 105021 105041 105061 JMP LB01440 .TADD 105002 105022 105042 105062 JMP 21026B [---] 105003 105023 105043 105063 JMP STFL LB01440 5 word add [tst] 105004 105024 105044 105064 JMP LB01644 base set pre-test [---] 105005 105025 105045 105065 JMP LB01635 expanded exponent [---] 105006 105026 105046 105066 RTN MPP1 reset FPP [---] 105007 105027 105047 105067 JMP LB01717 process stack of operands [---] 105010 105030 105050 105070 JMP LB01770 - 105011 105031 105051 105071 READ RTN - 105012 105032 105052 105072 READ RTN - 105013 105033 105053 105073 READ RTN .DAD 105014 105034 105054 105074 JMP J74 21020B - 105015 105035 105055 105075 READ RTN - 105016 105036 105056 105076 READ RTN - 105017 105037 105057 105077 READ RTN FIX 105100 105120 LB01420 JMP LB01514 .DINT 105101 105121 JMP LB01521 .TINT 105102 105122 JMP LB01521 [---] 105103 105123 JMP STFL LB01521 5 word FIXS .FIXD 105104 105124 JMP LB01531 .XFXD 105105 105125 JMP LB01535 .TFXD 105106 105126 JMP LB01535 [---] 105107 105127 JMP STFL LB01535 5 word FIXD - 105110 105130 READ RTN - 105111 105131 READ RTN - 105112 105132 READ RTN - 105113 105133 READ RTN .DSBR 105114 105134 JMP J74 21020B - 105115 105135 READ RTN - 105116 105136 READ RTN - 105117 105137 READ RTN ========================= IOFF and ION Micro-Orders ========================= The JSB,I and JMP,I instructions, as well as most I/O instruction, defer pending interrupts until the following instruction executes. On the 1000, this is implemented in microcode by executing an explicit IOFF instruction to clear the INTEN (interrupt enable) flip-flop. The JTAB that dispatches the following instruction sets the INTEN flip-flop, as does the third successive INCI micro-order if the MP accessory is installed. The latter prevents an infinite indirect chain from inhibiting instructions. Note, though, that if the "following instruction" explicitly tests for pending interrupts, they will be recognized, due to the JTAB reset. The "IOFF defers until completion of the following instruction" is true ONLY if that following instruction does not test for interrupts itself. =============================== E-Series I/O Processor Firmware =============================== Documentation for the IOP microcode appears to be limited to prose descriptions in the "HP 2000 Computer System Sources and Listings Documentation" manual (22687-90020) starting at Section 3 page 2-74 (PDF page 407) and the 2100 and 21MX (13207-18001) firmware diagnostics. The base-set jump table maps these instructions to microcode addresses 23400-23417: Instr Opcode Description ----- ------ ------------------------------------- CRC 105460 Generate CRC REST 105461 Restore registers from stack READF 105462 Read F register (stack pointer) INS 105463 Initialize F register (stack pointer) ENQ 105464 Enqueue PENQ 105465 Priority enqueue DEQ 105466 Dequeue The original simulator implementation of ENQ seems to be wrong. The instruction calling sequence is: LDA QPTR ADDRESS OF QUEUE CONTROL BLOCK (HEAD, TAIL) LDB EPTR ADDRESS OF ELEMENT TO QUEUE ENQ or PENQ ENQUEUE OR PRIORITY-ENQUEUE ... RETURN FOR "QUEUE WAS EMPTY" ... RETURN FOR "QUEUE WAS NOT EMPTY" According to the manual: "Register A addresses the pair of queue control words and register B addresses the element to be added to the queue. (The link word for an element is assumed to be at the address in B minus one.) The microprogram causes a skip whenever the element is added to a non-empty queue. Normally, the enqueue microprogram places the element at the end of the linked list (via the tail). However, the element may optionally be placed at the beginning of the linked list. This is referred to as a priority enqueue. Registers A and B are not altered." "The first word [of the queue control pair] addresses the first element in the queue (the head), and the second word addresses the last element in the queue (the tail). An empty queue is defined such that the head is 0 and the tail points to itself." To determine the skip condition, the simulation checks that the head is 0 only. The microcode, however, checks that the tail points to itself. Specifically, the microcode does this, beginning at address 23470: S5 := M S2 := A + 1 A points at the tail pointer [PENQ jumps here] M := S2, READ S1 := TAB S1 = tail pointer TAB := B, WRITE tail now points at the new element S3 := S1 - 1 S3 points at the link word of the prior tail element M := S3 TAB := B, WRITE prior tail element link (or head!) points at new element S4 := 0 S3 := B - 1 S3 points at link word of new element M := S3 TAB := S4, WRITE link word of new element set to zero L := S2 t-bus = S1 XOR S2 compare address of tail pointer with value of tail pointer if 0, M := S5, rtn P+1 if tail pointed to itself (i.e., queue was empty), return P+1 else return P+2 otherwise queue was not empty, so return to P+2 PENQ at address 23571 is almost the same: S5 := M M := A, READ S1 := TAB S1 = head pointer if 0, goto ENQ line 2 if queue is empty, handle as normal enqueue TAB := B, WRITE head pointer now points at new element S2 := B - 1 S2 points at new element link word M := S2 TAB := S1, WRITE new element link work now points at prior head element return P+2 queue was not empty, so return to P+2 DEQ at address 23522: S5 := M M := A, READ B := TAB B points to the head element if 0, M := S5, P+1 rtn if queue is empty, return P+1 S1 := B - 1 S1 points to element link word M := S1, READ S2 := A + 1 S2 points to the tail pointer S1 := TAB S1 is the element's link word M := A TAB := S1, WRITE head now points where link pointed if not 0, return P+2 queue is not empty, return P+2 M := S2 TAB := S2, WRITE queue is now empty, set tail pointer to point at itself return P+1 queue was not empty, return P+2 --------- NOTE 11/16/19: >>CPU reg: - **** 00000 001400 A 036557, B 036557, X 000000, Y 000000, e o I >>CPU instr: - 0001 02633 105466 DEQ >>CPU data: - 0017 36557 000000 data read >>CPU fetch: - 0001 02634 026656 instruction fetch >>CPU reg: - **** 00000 001400 A 036557, B 000000, X 000000, Y 000000, e o I >>CPU exec: ******************** >>CPU exec: - 0006 15026 000005 simulation stop: (null) >>CPU exec: - 0017 36501 050015 simulation stop: (null) >>CPU exec: - 0006 15022 040000 simulation stop: (null) >>CPU exec: - 0006 15024 000007 simulation stop: (null) null entries are SCPE_EXEC command stops! But SCPE_EXEC = SCPE_BASE - 1, so lookup is via sim_stop_messages, and we index off the end of the array!!! Must define SCPE_EXEC in sim_extensions.h and skip the trace if seen. scp> set cpu exec=105464;177774 scp> set cpu debug=exec scp> set debug d.log