                           SIMH/HP 2100 RELEASE NOTES
                           ==========================
                             Last update: 2018-05-23


This file documents the release history of the simulator for the Hewlett-Packard
2114, 2115, 2116, 2100, 1000-M, 1000-E, and 1000-F machines.

The SIMH project does not issue discrete releases.  Instead, the current
simulator code base is available at:

  https://github.com/simh/simh

...and may be downloaded at any time.  A code snapshot is identified by the "git
commit ID" that is displayed in the simulator welcome banner.

Therefore, HP 2100 releases are simply documentation checkpoints that describe
the changes that have occurred since the last checkpoint.  Generally, a release
is written when one or more major changes have been incorporated.  Minor bug
fixes will be available immediately from the repository but only noted as part
of the next release document.



===============================
Reporting Bugs in the Simulator
===============================

If you find a bug in the HP 2100 simulator, please report it either to the SIMH
issue tracker on github at:

  https://github.com/simh/simh/issues

...or to the SIMH mailing list; see:

  http://mailman.trailing-edge.com/mailman/listinfo/simh

...for subscribing information.  In either case, please include a console log
that contains a reproducible test case that illustrates the problem.  See the
"Recording Simulator Activities" section of the "SIMH User's Guide" for details.



===================
General Information
===================

The simulator passes the HP 24396 offline diagnostic suite with some expected
failures due to unimplemented features.  For example, the disc diagnostic
error-correction logic tests and the tape diagnostic CRCC and LRCC tests fail,
as these features are not supported.  However, all features that are required
for operation of the supported HP operating systems pass their respective
diagnostic tests.  See the accompanying "hp2100_diag.txt" file for details.

The simulator has been tested with the following operating systems:

 - SIO, BCS, and MTS.

 - 2000E, 2000F, and 2000 Access Time-Shared BASIC.

 - DOS, DOS-M, and DOS-III.

 - RTE, RTE-B, RTE-C, RTE-II, RTE-III, RTE-IV, RTE-IVB, and RTE-6/VM.

The user's manual for the simulator is provided in Microsoft Word format in the
"doc" subdirectory of the code base snapshot downloaded from the github site.  A
PDF version of the same manual is available at:

  http://alum.mit.edu/www/jdbryan/hp2100_doc.pdf

For those intending to run 2000F or 2000/Access Time-Shared BASIC, a monograph
entitled "Running HP 2000 Time-Shared BASIC on SIMH" is available at:

  http://simh.trailing-edge.com/docs/running_hp_2000_tsb.pdf

It discusses the requirements for successful TSB startup and operation and the
issues involved in synchronizing the dual-CPU simulation setup required by TSB.
TSB has run successfully on SIMH for many years, but the advent of multi-core
host machines has increased the difficulty in getting the two SIMH instances to
coordinate properly.  The paper presents some configuration guidelines that
improve the probability of successfully running TSB.


------------------
Available Software
------------------

A preconfigured RTE-6/VM disc image containing the operating system, the MACRO
assembler and Fortran 77 compiler, a selection of tape backup and restore
programs (READT/WRITT, READR/SAVER, FC, TF, and FST), an example programs
(/KENC/HELLO.FTN), and the Mystery Mansion game (MMM) is available from
Bitsavers at:

  http://www.bitsavers.org/bits/HP/tapes/rte-6vm/rte6200/

The archive contains instructions and simulator command files that allow
ready-to-run operation.

The Computer History Museum has graciously arranged with HP to offer the HP 1000
Software Collection with a sublicense for non-commercial use by private
individuals.  The Collection is hosted by Bitsavers at:

  http://www.bitsavers.org/bits/HP/HP_1000_software_collection/

A preconfigured RTE-IVB disc image containing the operating system, the ASMB
assembler and FORTRAN IV compiler, and the READR/SAVER and FC tape backup and
restore programs is available from the HP Computer Museum at:

  http://www.hpmuseum.net/display_item.php?sw=565

The archive contains instructions and a simulator command file.

Preconfigured 2000E, 2000F, and 2000 Access software kits are available from the
SIMH software repository here:

  http://simh.trailing-edge.com/software.html

Each kit contains a bootable disc image and associated command files that
automate the system startup process.  Command files to perform new system
generations are also included.

QCTerm, an HP 700 terminal emulator for Microsoft Windows, is available from the
HP Computer Museum at:

  http://www.hpmuseum.net/display_item.php?sw=585

Use of an HP terminal via a serial port or terminal emulator via Telnet enables
more advanced screen editing features of the RTE operating systems.

Manuals describing the operation of HP software are available from Bitsavers at:

  http://www.bitsavers.org/pdf/hp/1000/
  http://www.bitsavers.org/pdf/hp/2000TSB/
  http://www.bitsavers.org/pdf/hp/21xx/

...and from the HP Computer Museum at:

  http://www.hpmuseum.net/collection_document.php


----------------
Year 2000 Issues
----------------

RTE-6/VM Revision 6200 is Y2K compliant, except for the READR and SAVER
programs.  The errors are cosmetic only.

RTE-IVB Revision 5010 is not Y2K compliant.  All of the failures are in
subsystems; the operating itself (time-of-day clock) accommodates dates through
2059.  All of the errors are cosmetic.  Typically, punctuation characters appear
in the years, e.g., "19:0" for 2000.  The RTE-IVB software kit from the HP
Computer Museum includes fixes for the affected modules to bring the system into
compliance.

All other HP operating systems are not Y2K compliant.


-----------------------------
Bugs in RTE-IVB Revision 5010
-----------------------------

Testing during simulator development revealed the presence of a bug in RTE-IVB
Revision 5010:

 - The $BALC module in the system library has a bug that causes memory
   corruption.  This module is used by the ACCTS program and manifests itself by
   printing gibberish after the "PLEASE LOG ON:" prompt.

   Specifically, the internal MXEV routine performs a cross-store indirect via a
   location in Table Area II (XSA $MAXI+0,I).  This fails because the indirect
   chain is resolved in the user map, but TA II is not in the user map of
   large-background programs, such as ACCTS.  Therefore, the location in the
   user map corresponding to $MAXI in the system map is used as the pointer to
   the location to store.

   A corrected version of $BALC is present on cartridge GF of the disc image
   supplied with the RTE-IVB software kit at the HP Computer Museum.



======================
Release 28, 2018-05-23
======================

This release of the HP 2100 simulator adds the following features:

 - The IPLI and IPLO devices now use shared memory instead of network sockets to
   simulate the 12875A Processor Interconnect kit that is used to communicate
   between the System Processor and the I/O Processor of the HP 2000B, C, F, and
   Access Time-Shared BASIC operating systems.  This change, in addition to a
   new, adaptive service scheduling routine, improves data transfer time between
   the processes by a factor of 7 to 1.

 - Commands have been added to the IPL device to permit synchronization between
   the two simulator processes running the HP 2000 Time-Shared BASIC operating
   system.  This greatly improves system startup reliability and permits the use
   of the HP-documented startup procedure of cross-loading the I/O Processor
   program from the System Processor.

 - The DIAGNOSTIC options of the IPLI and IPLO devices have been reworked to
   permit testing with the HP General Register Diagnostic as well as the
   Processor Interconnect Cable Diagnostic.

 - The DEBUG options of the IPLI and IPLO devices have been expanded.

 - The BOOT command now installs the correct binary loader for the CPU model.
   For example, BOOT PTR installs and runs the Basic Binary Loader (BBL) if the
   CPU is configured as a 2114/15/16 or 2100, or the 12992K Paper Tape Loader
   ROM if the CPU is configured as a 1000 M/E/F-Series.  Prior releases
   installed the HP 1000 loader ROM regardless of the CPU model.

 - The LOAD command has been extended to permit copying of internal device boot
   loaders into memory.  LOAD <dev> is identical to BOOT <dev> except that the
   CPU is neither preset nor run.  In particular, LOAD CPU is the equivalent of
   pressing the IBL button on the HP 1000 front panel.

 - The new SET CPU ROMS command permits altering the set of preinstalled boot
   loader ROMs for 1000 CPUs.  The new SHOW CPU ROMS command displays the
   currently installed set.

 - The -N (new file) option to the ATTACH command for disc devices now creates a
   full-size image file, equivalent to formatting the new disc before use.


--------------------
Implementation Notes
--------------------

 - The abbreviated "SET CPU 21MX" command no longer sets the CPU to an E-Series
   model (i.e., to a 21MX-E, a.k.a. 1000-E); instead, it configures the CPU as
   an original 21MX (a.k.a. 1000-M).  If an E-Series configuration is desired,
   it must be requested explicitly with the "SET CPU 21MX-E" command.

 - The "RESET -P CPU" command no longer restores the BBL to the protected memory
   area of 21xx machines.  The "LOAD PTR" command may be used to perform this
   function.

 - The previous behavior of the "ATTACH -N" command for disc devices, i.e.,
   creating a new zero-length image file, may be emulated by first deleting the
   file and then attaching it without specifying the -N switch.  For instance,
   the "DELETE <file>" and "ATTACH <unit> <file>" commands produce a new
   zero-length file as "ATTACH -N <unit> <file>" did before this change.  The
   "ATTACH -N" behavior of other devices, e.g., magnetic tape drives and
   printers, did not change; a zero-length file is still created.

 - With the change to a shared-memory implementation, only a single "ATTACH IPL"
   command is required per instance to establish communication.  The System
   Processor instance issues an "ATTACH -S IPL <code>" command, and the I/O
   Processor instance must issue a corresponding "ATTACH -I IPL <code>" command,
   where the <code> parameter is a user-selected decimal number that identifies
   the instance pair.  The prior "ATTACH [-L | -C] [ IPLI | IPLO ] <port>"
   commands are deprecated but retained, so that existing command files will
   still work.  However, they too will use shared memory rather than network
   connections.  Consequently, the SP and IOP instances are now required to
   execute on the same machine, and the <ip-address> option is no longer
   supported.

 - Multiple consecutive CLC 0 instruction executions now cause only a single CRS
   assertion to the I/O devices.  Therefore, IOBUS tracing when running HP 2000
   Time-Shared BASIC systems no longer generates a pair of trace lines for each
   of the 131,072 consecutive CLC 0 executions typically used to initialize the
   12920A Asynchronous Multiplexer.

 - The 12875A Processor Interconnect section of the HP2100 User's Guide has been
   revised to describe the new ATTACH protocol and process synchronization
   commands.

 - A list of device boot loaders installed for given device/CPU combinations has
   been added to the user's guide.

 - The "21MX-M" and "21MX-E" CPU options that had been inadvertently omitted
   from the last release of the user's guide have been restored.

 - The "Running HP 2000 Time-Shared BASIC on SIMH" monograph has been revised to
   cover the application of the new process synchronization commands to TSB
   startup command files.

 - Preconfigured software kits for 2000E, 2000F, and 2000 Access that employ
   the new shared memory and process synchronization commands are now available;
   see the "Available Software" section above for details.


----------
Bugs Fixed
----------

  1. PROBLEM:  Serial port output stalls are not handled properly.

     VERSION:  Release 27.

     OBSERVATION:  The TTY, BACI, MPX, and MUX devices support I/O via host
     serial ports as well as via Telnet connections.  While TTY, BACI, and MPX
     output via Telnet works correctly, output via serial ports fails.  TTY
     output drops characters if the serial port stalls.  Attempting to output to
     the BACI results in "Console Telnet output stall" and a simulator stop.
     Output to the MPX results in dropped characters and eventually an "IOPE"
     (parity error) message from RTE.

     CAUSE:  The terminal multiplexer library (sim_tmxr.c, part of the SIMH
     framework) had provided a 256-byte output buffer for each line, independent
     of the connection type (Telnet or serial).  The library was changed to
     reduce the serial buffer size to one byte.  The BACI and MPX devices are
     internally buffered and default to a "FASTTIME" mode that sends the entire
     internal buffer to the library output routine.  When the routine receives
     the second character, it returns SCPE_STALL status to indicate a buffer
     overflow.  The device simulations did not expect and did not properly
     handle this status.

     The TTY and MUX devices are not buffered internally and were not affected
     by the loss of serial buffering.  However, the TTY would drop output
     characters if the host serial buffer overflowed.

     RESOLUTION:  Modify "tto_svc" (hp2100_stddev.c), "baci_term_svc"
     (hp2100_baci.c), and "line_service" (hp2100_mpx.c) to handle terminal
     multiplexer library buffer overflows properly.

     STATUS:  Fixed in Release 28.


  2. PROBLEM:  The PTR device DIAGNOSTIC option shown in the user's guide does
     not exist.

     VERSION:  Release 27.

     OBSERVATION:  The "HP2100 Simulator User's Guide" says that specifying the
     DIAGNOSTIC option for the PTR device "converts the attached paper tape
     image into a continuous loop" for use by the paper tape reader diagnostic
     program.  However, entering a "SET PTR DIAGNOSTIC" command gives a
     "Non-existent parameter" error.

     CAUSE:  The option name specified in the PTR device's modifier table is
     "DIAG".  It should be "DIAGNOSTIC" to match the option names used in the
     other device simulations.

     RESOLUTION:  Modify "ptr_mod" (hp_stddev.c) to use the correct option name.

     STATUS:  Fixed in Release 28.


  3. PROBLEM:  First Status is not cleared properly on the DP device.

     VERSION:  Release 27.

     OBSERVATION:  Execution of the RTE-I paper tape bootstrap for the 7900A and
     the 2000F loader for the 7900A halts with disc errors.  The offending disc
     status word is 040001 octal, which denotes First Status and Any Error.
     Both programs expect disc status to be clear after an initial Seek and Read
     are performed.  However, the disc drive and interface manuals state that
     First Status is cleared by a Status Check command, which is not being
     issued.

     CAUSE:  Examination of the schematics in the 7900A Disc Drive Operating and
     Service Manual (07900-90002 February 1975) and the 13210A Disc Drive
     Interface Kit Operating and Service Manual (13210-90003 November 1974)
     shows that, contrary to the documentation, First Status is cleared on a
     Read, Write, Check Data, or Initialize command, as well as on a Status
     Check command.  The current DP implementation follows the manual
     description rather than the schematics, so it fails to clear First Status
     when the initial Read is performed.

     RESOLUTION:  Modify "dp_goc" (hp2100_dp.c) to clear First Status as well as
     Attention when one of the applicable commands is performed.

     STATUS:  Fixed in Release 28.


  4. PROBLEM:  2000F and Access will not boot from a 7900 drive using the BMDL.

     VERSION:  Release 27.

     OBSERVATION:  Attempting to boot Time-Shared BASIC from a 7900 using the
     Basic Moving-Head Disc Loader for the HP 2100 CPU results in a HLT 1
     (unrecoverable disc error) in the TSB loader.  Booting the same system with
     the 12992A loader ROM for the HP 1000 succeeds.

     The BMDL configures DMA for an oversize (~32000 word) transfer and expects
     the disc to terminate the operation with End of Cylinder (EOC) status.  The
     TSB bootstrap successfully loads into memory.  When it starts, it issues a
     CLC 0,C followed by a Check Status command that is expected to return zero,
     i.e., all status bits clear.  However, the EOC bit is set, and the
     bootstrap halts with a HLT 1.

     CAUSE:  The "Disc Interface 1 PCA Schematic Diagram" in the HP 13210A Disc
     Drive Interface Kit Operating and Service Manual (13210-90003, August 1974)
     shows that the CRS signal, which is generated by the CLC 0 instruction,
     does not affect the Status Register contents.  However, examination of an
     actual hardware interface PCA shows that CRS assertion does clear the
     register.

     RESOLUTION:  Modify "dpcio" (hp2100_dp.c) to clear the status register on
     receipt of a CRS signal.  Note that later versions of the service manual
     (May 1975 and May 1978) show the correct CRS connection.

     STATUS:  Fixed in Release 28.


  5. PROBLEM:  Forcibly disconnected 2000E multiplexer ports are unresponsive.

     VERSION:  Release 27.

     OBSERVATION:  The HP Time-Shared BASIC system sets a limit on the time
     allowed between dataset connection and login.  By default, this is 120
     seconds but may be changed by the PHONES system operator command.  If the
     user does not complete a login within the time allowed, the dataset will be
     disconnected.

     This action occurs as expected on the 2000E system, but while reconnecting
     to the port succeeds, the line is unresponsive.  More importantly,
     attempting to SLEEP the system hangs after responding to the "MAG TAPE
     SLEEP?" question.

     CAUSE:  Examining the source code where the SLEEP hang occurs shows that
     the system is waiting in a loop for output to complete on the disconnected
     port.  The forced disconnect code, which is shared by the PHONES, KILLID,
     and SLEEP commands, calls the BYE processor to log out an active user.
     However, for a PHONES disconnect, the user is not logged in.  The BYE
     processor handles this condition correctly, but it returns to a common
     routine (LLEND) that outputs a line feed to the port.  The multiplexer
     simulation omits a write to a disconnected port but also erroneously omits
     the output completion interrupt request.  Consequently, TSB believes that
     the output is still in progress and therefore waits, in an infinite loop,
     for the completion interrupt that never occurs.  Also, while the port is in
     output mode, input is turned off, so the port appears to be unresponsive
     when reconnected.

     RESOLUTION:  Modify "muxo_svc" (hp2100_mux.c) to set "mux_xdon" to 1 to
     trigger the completion interrupt regardless of whether or not the port is
     connected to a Telnet session.

     STATUS:  Fixed in Release 28.



======================
Release 27, 2017-09-06
======================

This release of the HP 2100 simulator adds the following features:

 - Support for the HP 2613, 2617, and 2618 line printers has been added to the
   LPT device.  The default printer remains the HP 2607.

 - The LPT device simulation has been rewritten to support realistic and
   optimized timing, compact and expanded output modes, custom VFU tape images,
   and tracing of internal operations.

 - The LOAD command has been rewritten to load files containing absolute binary
   loaders into the protected address space of the 21xx machines and configure
   the I/O instructions.  For the 1000, LOAD can also be used to load boot
   loader ROM images other than those provided directly by the simulator.

 - The DUMP command has been added to write the binary loader currently resident
   in memory to an absolute binary file.

 - The TTY punch unit and the LPS, LPT, and PTP devices now position a newly
   attached file at the end of the file rather than at the start.  As a result,
   output will append to, rather than overwrite, the existing content.

 - The DA, DP, DQ, and DS disc devices add the PROTECT and UNPROTECT options.
   These replace the now-deprecated LOCKED and WRITEENABLED options and more
   accurately reflect the labelling of the data protection switches on the disc
   drives.

 - The simulator message that is displayed when a programmed halt occurs has
   been changed to indicate that the halt code comes from the T-register value.

 - The Basic Binary Loader (BBL) is now installed by default in the 21xx
   machines.  It is automatically configured to the select code of the paper
   tape reader.  It may be overwritten with a different loader (e.g., the Basic
   Binary Disc Loader or Basic Moving-head Disc Loader) using the LOAD command.
   Performing a power-on reset of the CPU reinstalls the BBL.

 - Symbolic display and entry has been rewritten to improve efficiency and
   expanded to cover the full instruction set including optional microcode
   extensions that are currently enabled.

 - CPU instruction execution and data accesses may be selectively traced.  The
   resulting trace listing is similar to the output of a logic analyzer
   connected to the CPU and I/O buses.

 - DMA/DCPC commands, status, and data accesses may be selectively traced.

 - TBG commands, status, and service entries may be selectively traced.

 - The DIAG option of the TBG device has been replaced with the REALTIME, W1A,
   W1B, W2A, and W2B options.  Configuring the TBG to run its diagnostic now
   uses the REALTIME and W2B options, and restoring the normal configuration
   uses the CALTIME and W2A options.  The W1A and W1B options extend the
   software compatibility of the TBG.

 - The MUXM device has been renamed MUXC to reflect that it is the multiplexer
   control card.  The previous MUXM name is deprecated but will still work in
   existing simulation command files.

 - The multiplexer control card (MUXC) may be enabled and disabled independently
   of the upper and lower data cards (MUX and MUXL), reflecting its optional
   status in hardware configurations.

 - Memory address parsing for commands has been changed to add <page>.<offset>
   format for physical addresses, where both the page and the offset range from
   0 to 1777 octal.  Linear addressing is now restricted to the 32K logical
   address space (0 to 77777 octal).  Memory display uses linear addressing for
   locations within the logical address space; locations above 32K use the
   physical address format.

 - The previously separate STOP_INST, STOP_DEV, STOP_IOE, and INDMAX
   pseudo-registers used to stop the simulator under certain conditions have
   been replaced by the SET CPU STOP=<stopname>[,<stopname>...] and the SET CPU
   INDIR=<limit> commands.  Stops may be temporarily bypassed by adding the -B
   switch to the command that resumes execution.

 - The HP 2100 Simulator User's Guide has been rewritten and significantly
   expanded.


--------------------
Implementation Notes
--------------------

 - The simulator passes the HP 2613/17/18 line printer diagnostic as described
   in the "hp2100_diag.txt" file.

 - The line printer terminates each print line with the HP-standard CR/LF pair.
   If the output file is to be retained as a text file on a Unix system, removal
   of the carriage returns, e.g., via the "dos2unix" utility, may be desirable.

 - The LOAD command can no longer be used to read general absolute binary paper
   tape images into memory.  The ATTACH PTR and BOOT PTR commands must now be
   used to read paper tapes.

 - The OS, OSTBG, VMA, EMA, VIS, and SIGNAL CPU debug flags have been removed.
   Tracing of these firmware instructions is now performed by specifying SET CPU
   DEBUG=EXEC and SET CPU EXEC with the appropriate opcode range and mask, as
   follows:

     * SET CPU DEBUG=OS     => SET CPU EXEC=105340;177760
     * SET CPU DEBUG=VMA    => SET CPU EXEC=105240;177760
     * SET CPU DEBUG=EMA    => SET CPU EXEC=105240;177760
     * SET CPU DEBUG=VIS    => SET CPU EXEC=101460;173760
     * SET CPU DEBUG=SIGNAL => SET CPU EXEC=105600;177760

 - The separate tracing of time-base generator interrupt instructions provided
   by the OS and OSTBG CPU debug flags is no longer supported.  Entering the
   replacement command above traces all OS instructions, including the TBG
   interrupt instructions.

 - The TIMER, RRR 16, .FLUN, and the OS/VMA, VIS, and SIGNAL self-test
   instructions are no longer exempt from the undefined/unimplemented
   instruction stop tests.  Attempted execution of these instructions without
   the appropriate firmware options installed will cause simulation stops if the
   UNDEF (TIMER and RRR) or UNIMPL (.FLUN and self-tests) option is enabled.
   Because of this change, the default state of the unimplemented instruction
   stop has been reversed from "on" to "off".

 - The "stop on I/O error" features controlled by the STOP_IOE register values
   have been removed from the DR, LPS, LPT, MSC, MTC, and PTP devices, as all of
   these report I/O error status to the CPU via their interface input registers.
   STOP_IOE has been removed from the PTR device and replaced with SET CPU
   STOP=IOERR, as this device does not report I/O error status to the CPU
   through its interface.

 - The LOCKED and WRITEENABLED options for the MSC and MTC devices are
   deprecated.  The supported method of write-protecting a tape drive is to
   attach the tape image with the -R (read-only) switch or by setting the host
   operating system's read-only attribute on the tape image file.  This
   simulates removing the write ring from the tape reel before mounting it on
   the drive.  There is no hardware method of write-protecting a mounted and
   positioned tape reel.

 - If the previous ATTACH behavior (overwriting rather than appending) is
   desired for the TTY punch unit and the LPS, LPT, and PTP devices, set the
   device's (P)POS register to 0 after attaching.


----------
Bugs Fixed
----------

  1. PROBLEM:  EXAMINE -M for addresses > 32K displays misleading operands.

     VERSION:  Release 26.

     OBSERVATION:  Current-page memory references of instructions residing above
     the 32K logical address space are printed as though they reside at their
     locations modulo 32K.  For example, DEPOSIT 170001 026020 and EXAMINE -M
     170001 displays JMP 70020, and DEPOSIT 200001 026020 displays JMP 20.

     CAUSE:  The printed addresses assume that the instructions will be executed
     from their respective pages (modulo 32).  However, instructions can be
     executed only when they are mapped into the logical address space, and any
     given physical page may be mapped to any arbitrary logical page.
     Therefore, the address printed may not represent the actual logical address
     after mapping.

     RESOLUTION:  Modify "fprint_cpu" (hp2100_sys.c) to use Z/C address notation
     for memory references in instructions residing in physical memory above
     32K.

     STATUS:  Fixed in Release 27.


  2. PROBLEM:  Enabling IOP firmware should not be allowed on the 1000 F-Series.

     VERSION:  Release 26.

     OBSERVATION:  The command "SET CPU 1000-F,IOP" is allowed, but it should
     not be, as the IOP firmware is not supported on this machine.

     CAUSE:  The F-Series does not provide the firmware mapping table entries
     that permit operation of the 2000/Access I/O Processor firmware.  IOP
     instruction opcodes 10x400-17 and 10x420-37 are marked as "HP Reserved" in
     the F-Series mapping table, and opcodes 10x460-77 are dedicated to the VIS
     microcode.

     RESOLUTION:  Modify the "cpu_features" array (hp2100_cpu.c) to remove the
     IOP option from the 1000 F-Series entry.

     STATUS:  Fixed in Release 27.


  3. PROBLEM:  A rejected model change still changes the CPU options.

     VERSION:  Release 26.

     OBSERVATION:  Changing to a CPU model that does not support the current
     memory size will reduce memory to the maximum supported by the new model.
     If the truncated portion contains non-zero values, the simulator will ask
     for confirmation before proceeding.  If the truncation is rejected, the CPU
     options are still set to those of the new model, even though the old model
     is retained.  For example:

       sim> SET CPU 1000-F,128K
       sim> SHOW CPU
       CPU     idle disabled
               128KW, 1000-F, EAU
               FP, no IOP, DMS
               FFP, DBI, no EMA/VMA
               no VIS, no SIGNAL
       sim> DEPOSIT 100000 1
       sim> SET CPU 2116
       Really truncate memory [N]?NO
       Command not completed
       sim> SHOW CPU
       CPU     idle disabled
               128KW, 1000-F, no EAU
               no FP, no IOP, no DMS
               no FFP, no DBI, no EMA/VMA
               no VIS, no SIGNAL

     CAUSE:  The CPU options are set before the memory size is changed, so when
     the size change is rejected, the new CPU options are retained.

     RESOLUTION:  Modify "cpu_set_model" (hp2100_cpu.c) to perform the memory
     size change first, so that if it is rejected, the CPU options have not been
     changed.

     STATUS:  Fixed in Release 27.


  4. PROBLEM:  Virtual memory mapping fails for accesses above 126 MB.

     VERSION:  Release 26.

     OBSERVATION:  A program using virtual memory provided by the RTE-6/VM
     operating system may access up to 128 MB of data, although VMA programs
     default to a 16 MB limit.  Accesses to data in virtual memory are mapped
     through the last two DMS user map registers.  Normally, each VMA access
     maps in the memory page corresponding to the virtual address plus the
     following memory page.  This allows access to single items up to 1024 words
     in size starting at any offset within the (first) page.

     If a data item resides in the last 2 MB of virtual memory, access to an
     item that crosses the page boundary is incorrect.  Instead of accessing
     words in the second page, the accesses wrap around within the first page.

     CAUSE:  The suit number part of the virtual address is not restored before
     checking the allocation status of the page table entry corresponding to the
     second (spillover) page.  As a result, an unallocated second page in the
     last 2 MB of virtual memory is seen as beyond the VM area limit, and
     instead of generating a page fault to allocate the second page, the map
     registers are set up to prevent access to the second page by setting the
     first page address into both map registers.

     RESOLUTION:  Modify "cpu_vma_lbp" (hp2100_cpu5.c) to check for spill page
     allocation correctly.

     STATUS:  Fixed in Release 27.


  5. PROBLEM:  Memory expansion is not disabled when DMS is disabled.

     VERSION:  Release 26.

     OBSERVATION:  If the Memory Expansion Module in a 1000-Series CPU has been
     enabled, and then the DMS firmware option is disabled or the CPU is changed
     to a model that does not support memory expansion (e.g., a 2100), memory
     expansion remains enabled.  In this case, memory accesses should revert to
     physical addressing, but instead logical-to-physical address translation
     through the currently enabled map remains in effect.

     CAUSE:  Disabling DMS should set the "dms_enb" flag to 0, but it does not.

     RESOLUTION:  Modify "set_model" and "set_option" (hp2100_cpu.c) to clear
     the "dms_enb" flag if DMS is not enabled after the model or option change.

     STATUS:  Fixed in Release 27.



======================
Release 26, 2017-05-01
======================

This release of the HP 2100 simulator does not add any new features.


--------------------
Implementation Notes
--------------------

 - Starting with the next release, the LOAD command will be rewritten to load
   files containing absolute binary loaders into the protected address space of
   the 21xx machines and configure the I/O instructions.  The LOAD command is
   not designed for general loading of absolute binary files, as it does not
   initialize the A and B registers as some HP software expects.  It is intended
   only to install bootstrap loaders.  The BOOT PTR command is the proper
   simulation of the hardware absolute paper tape loader.


----------
Bugs Fixed
----------

  1. PROBLEM:  The RWCS debug option shown in the user's guide does not exist.

     VERSION:  Release 25.

     OBSERVATION:  The "HP2100 Simulator User's Guide" says that the RWCS debug
     option may be specified for the DS and DA devices to trace "disk read/
     write/control/status commands."  However, entering a SET DS DEBUG=RWCS
     command gives an "Invalid argument" error.

     CAUSE:  The option name is misspelled; the correct option is RWSC.

     RESOLUTION:  Modify "hp2100_doc.doc" to list the correct option name.

     STATUS:  Fixed in Release 26.


  2. PROBLEM:  Halt opcodes 1060xx and 1070xx do not display in mnemonic form.

     VERSION:  Release 25.

     OBSERVATION:  Halt instructions 106000-106077 and 107000-107077 are not
     displayed in mnemonic form, either directly with an EXAMINE -M command
     or in the message displayed for a programmed halt.  These instruction
     ranges are displayed in octal only.

     CAUSE:  Section 3.20, "Input/Output Instructions," of the "HP 1000
     M/E/F-Series Computers Technical Reference Handbook" (HP 5955-0282, March
     1980) says, in part, "Bit 11, where relevant, specifies the A- or
     B-register or distinguishes between set control and clear control;
     otherwise, bit 11 may be a logic 0 or a logic 1 without affecting the
     instruction (although the assembler will assign zeros in this case)."  The
     HLT instruction does not specify the A/B register, so the valid opcodes are
     102000-102077, 103000-103777, 106000-106077, and 107000-107077.  However,
     the latter two ranges are omitted from the "opcode" and "opc_val" tables
     used for decoding.

     RESOLUTION:  Add the 1060xx/107xx range to the "opc_val" table and a second
     "HLT" string to the "opcode" table (hp2100_sys.c) to permit mnemonic
     display of this instruction range.

     STATUS:  Fixed in Release 26.


  3. PROBLEM:  The SFB (scan for byte) opcode displays as SBT (store byte).

     VERSION:  Release 25.

     OBSERVATION:  Entering the "EVAL -M 105767" command should display the
     "SFB" mnemonic.  Instead, it displays "SBT".

     CAUSE:  The entry in the opcode mnemonic table corresponding to the 105767
     value is "SBT", which is incorrect.  It should be "SFB" (SBT is 105764).

     RESOLUTION:  Modify the "opcode" table (hp2100_sys.c) to use the correct
     mnemonic for the SFB instruction.

     STATUS:  Fixed in Release 26.


  4. PROBLEM:  Host file system seek errors are not caught.

     VERSION:  Release 25.

     OBSERVATION:  The MAC/ICD disc library checks for host file system read or
     write errors and returns Uncorrectable Data Error status if an error is
     indicated.  However, host file system seeks are simply assumed to succeed;
     no indication of an error is given if a call fails.  A failed seek should
     be detected, and a Drive Fault (positioner error) should be returned.

     CAUSE:  Oversight.

     RESOLUTION:  Modify "position_sector" (hp2100_disclib.c) to test the
     "sim_fseek" call for error status and to simulate a Drive Fault (AGC error)
     if the call fails.

     STATUS:  Fixed in Release 26.


  5. PROBLEM:  Set Flow Control and Cancel commands fail if port key is not set.

     VERSION:  Release 25.

     OBSERVATION:  HP 8-channel multiplexer commands that refer to ports do so
     indirectly by passing a port key, rather than a port number.  The
     key-to-port translation is established by the "Set Port Key" command, which
     must be executed before any port-specific commands.  If a port key has not
     been established, then all port-specific commands should be ignored.
     However, the "Cancel first receive buffer" and "Set flow control" commands
     cause program corruption if the key has not been set.

     CAUSE:  The test for key validity is improperly applied for these commands.

     RESOLUTION:  Modify "exec_command" (hp2100_mpx.c) to ignore these commands
     if the port key has not been set.

     STATUS:  Fixed in Release 26.


  6. ENHANCEMENT:  Improve the EAU shift and rotate instruction simulations.

     VERSION:  Release 25.

     OBSERVATION:  The shift and rotate instructions (ASL, ASR, LSL, LSR, RRL,
     and RRR) perform 32-bit operations on the combined B and A registers.  The
     original implementation treated the 16-bit registers independently.
     However, it is faster and smaller to form a 32-bit operand, apply the
     operation, and then split the operand back into the B and A registers.
     Modern compilers, such as gcc, recognize the shifting and masking patterns
     necessary for a rotation and generate a single rotate-left or rotate-right
     machine instruction.

     RESOLUTION:  Modify "cpu_eau" (hp2100_cpu1.c) to reimplement the shift and
     rotate instructions as 32-bit operations.

     STATUS:  Fixed in Release 26.



======================
Release 25, 2017-01-11
======================

This is the initial checkpoint release of the HP 2100 simulator, corresponding
to the 25th set of changes to the 4.0 code base.  The following devices are
currently simulated:

 - 2114C CPU with up to 16 KW of memory
 - 2115A CPU with up to 8 KW of memory
 - 2116C CPU with up to 32 KW of memory
 - 2100A CPU with up to 32 KW of memory
 - 1000 M/E/F-Series CPU with up to 1024 KW of memory
 - EAU, FP, IOP, DMS, FFP, DBI, VIS, and SIGNAL microcode extensions
 - RTE-IV EMA or RTE-6/VM OS and VMA microcode extensions
 - 12531C Buffered Teleprinter Interface with one 2752 Teleprinter
 - 12539C Time Base Generator
 - 12557A Disc Controller with four 2870 drives
 - 12559C Magnetic Tape Controller with one 3030 drive
 - 12565A Disc Controller with two 2883 drives
 - 12566B Microcircuit Interface with a loopback connector
 - 12578A Direct Memory Access Controller
 - 12581A Memory Protect
 - 12597A Duplex Register Interface with one 2748 Paper Tape Reader
 - 12597A Duplex Register Interface with one 2895 Paper Tape Punch
 - 12606B Fixed Head Disc Controller with one 2770/2771 drive
 - 12607B Direct Memory Access Controller
 - 12610B Drum Controller with one 2773/2774/2775 drive
 - 12620A Privileged Interrupt Fence
 - 12653A Printer Controller with one 2767 Line Printer
 - 12792C 8-Channel Asynchronous Multiplexer
 - 12821A Disc Interface with four 7906H/7920H/7925H drives
 - 12845B Printer Controller with one 2607 Line Printer
 - 12875A Interprocessor Link
 - 12892B Memory Protect
 - 12895A Direct Memory Access Controller
 - 12897B Dual-Channel Port Controller
 - 12920A 16-Channel Terminal Multiplexer
 - 12936A Privileged Interrupt Fence
 - 12966A Buffered Asynchronous Communications Interface
 - 13037D Disc Controller with eight 7905/7906/7920/7925 drives
 - 13181A Magnetic Tape Controller with four 7970B drives
 - 13183A Magnetic Tape Controller with four 7970E drives
 - 13210A Disc Controller with four 7900 drives

The "HP 2100 Simulator User's Guide" manual describes the configuration and
operation of each of these devices in detail.


--------------------
Implementation Notes
--------------------

 - New bug fixes will now be listed in this file under the associated release
   rather than in their previous location (hp2100_bugfixes.txt).

 - Starting with the next release, the LOAD command will restrict its operation
   to the addresses occupied by the bootstrap loaders, i.e., the last 64
   locations in memory (up to 32K).  The LOAD command is not designed for
   general loading of absolute binary files, as it does not initialize the A and
   B registers as some HP software expects.  It is intended only to install
   bootstrap loaders.  The BOOT PTR command is the proper simulation of the
   hardware absolute paper tape loader.


----------
Bugs Fixed
----------

  1. PROBLEM:  DPC device documentation uses the wrong disc drive model number.

     VERSION:  Release 24.

     OBSERVATION:  The comments in the hp2100_dpc.c source file and Section 2 of
     the "HP2100 Simulator User's Guide" say that the DPC device supports the
     2871 disc drive, while Section 2.6.1 of the User's Guide says that the
     support is for the 2781 disc drive.  Neither of these model numbers is
     correct.

     Contemporaneous literature (e.g., the "2116B Computer Price List," dated
     June 1970) states that the disc memory subsystem consists of the HP 2870A
     Moving Head Disc, HP 2871A Disc Controller, HP 2881A Power Supply, and HP
     2882A Cabinet.

     CAUSE:  The controller model number is used instead of the drive model
     number, while the "2781" number is a transposition of "2871."

     RESOLUTION:  Modify the initial comments in the DPC device source file
     (hp2100_dpc.c) and modify the sections of the HP2100 Simulator User's Guide
     to use the correct disc drive model number (2870).

     STATUS:  Fixed in Release 25.


  2. PROBLEM:  The BOOT DRC command does not execute correctly.

     VERSION:  Release 24.

     OBSERVATION:  Attempting to boot DOS from a fixed-head disc or drum does
     not work.  The CPU sits in a loop waiting for DMA to finish, but it never
     does.

     CAUSE:  The DMA control word in the DR device bootstrap is not configured
     during BOOT DRC processing, so DMA is communicating with the wrong device.

     RESOLUTION:  Modify "drc_boot" (hp2100_dr.c) to set the fixed disc/drum
     select code into the DMA control word before returning.

     STATUS:  Fixed in Release 25.


  3. PROBLEM:  The valid command "DEPOSIT 2000 JMP 2001" is rejected.

     VERSION:  Release 24.

     OBSERVATION:  Regarding symbolic input, the HP2100 User's Manual says that
     the "C" and "Z" flags, signifying a current-page or zero-page reference,
     respectively, are not needed "...when entering [memory reference]
     instructions into CPU memory; the simulator figures out from the target
     address what mode to use."  While the valid command "DEPOSIT 1000 JMP 1001"
     correctly enters a zero-page jump into memory, the valid command "DEPOSIT
     2000 JMP 2001" does not enter a current-page jump.  Instead, an "Invalid
     argument" error occurs.

     CAUSE:  The "parse_sym" routine looks for the optional "C" or "Z" flag when
     parsing memory reference instructions and sets a flag if either is
     specified.  The test for a current-page reference is performed only if the
     reference type was not explicitly specified.  However, the sense of the
     test is reversed.

     RESOLUTION:  Modify "parse_sym" (hp2100_sys.c) to correct the test for C/Z
     option specification.

     STATUS:  Fixed in Release 25.


  4. PROBLEM:  The invalid command "DEPOSIT 2000 JMP C 2001" is accepted.

     VERSION:  Release 24.

     OBSERVATION:  Regarding symbolic input, the HP2100 User's Manual says that
     "The address is an octal number in the range 0 - 77777; if C or Z is
     specified, the address is a page offset in the range 0 - 1777."  However,
     specifying a page offset > 1777 is accepted without complaint if it is
     within the current page range.

     CAUSE:  Error checking for memory reference instruction entry is
     incomplete.

     RESOLUTION:  Modify "parse_sym" (hp2100_sys.c) to ensure that the range
     check is enforced if either C or Z is specified.

     STATUS:  Fixed in Release 25.


  5. PROBLEM:  Punched output does not appear on TTY devices lacking a paper
     tape punch.

     VERSION:  Release 24.

     OBSERVATION:  Running the HP contributed library program "HP 2000F BASIC
     for DOS-M/DOS III" does not produce any console output when using terminal
     driver DVR00 as required by the program.  When using alternate terminal
     driver DVR05, console output appears but console input does not work
     properly.

     CAUSE:  DOS-M and DOS-III support two modes of console I/O: ASCII mode and
     binary mode.  ASCII mode appends carriage-return/line-feed characters on
     output and strips them on input.  Binary mode sends and receives bytes
     exactly as supplied.

     DVR00 is required because DVR05 does not support the binary I/O mode
     required by the program.  However, DVR00 assumes that a binary write is to
     be directed to the console's paper tape punch rather than the console
     printer and therefore sets the TTY interface's "punch flip-flop" instead of
     the "print flip-flop" to accompany the text output.  The simulation of the
     HP 12531 interface card associated with the TTY device discards output if
     the punch flip-flop is set and the punch unit (TTY2) is not attached.

     The problem occurs because only a connected HP 2754 teleprinter (a modified
     Teletype ASR35) reacts to the print and punch flip-flop signals.  All other
     supported terminal devices ignore the signals and print whatever output is
     supplied (an HP 2752 -- a rebadged ASR33 -- has a manual control for the
     punch, but the punch and printer operate together when the punch is on).
     The 2000F BASIC program apparently was designed for use with one of these
     other terminals, which print normally even though only the punch flip-flop
     is set.

     RESOLUTION:  Modify "tto_out" (hp2100_stddev.c) to honor the print and
     punch flip-flop settings and separate the output as directed only if the
     console punch unit is attached (simulating an HP 2754).  When the unit is
     detached, all output is delivered to the console printer, regardless of the
     flip-flop settings (simulating all other console devices).

     STATUS:  Fixed in Release 25.
