diff --git a/doc/ECO-034-MMU_d-space-pc.md b/doc/ECO-034-MMU_d-space-pc.md
index 6f3047e8..5f5ac5a1 100644
--- a/doc/ECO-034-MMU_d-space-pc.md
+++ b/doc/ECO-034-MMU_d-space-pc.md
@@ -1,4 +1,4 @@
-# ECO-033: D space used instead of I space for some PC specifiers  (2022-09-08)
+# ECO-034: D space used instead of I space for some PC specifiers  (2022-09-08)
 
 ### Scope
 - was in w11a since 2009
diff --git a/doc/ECO-035-stklim-tbit-fixes.md b/doc/ECO-035-stklim-tbit-fixes.md
new file mode 100644
index 00000000..9ab1b233
--- /dev/null
+++ b/doc/ECO-035-stklim-tbit-fixes.md
@@ -0,0 +1,79 @@
+# ECO-035:  STKLIM, yellow and tbit trap fixes (2022-12-06)
+
+### Scope
+- mostly in w11a since 2008
+- affects: all w11a systems
+
+### Symptom summary
+The w11 had several deficits in the stack protection, the yellow stack trap,
+and T-bit trace trap logic. They caused diagnostic messages in `ekbee1` and
+`eqkce1` xxdp tests.
+
+### Background
+The 11/70, and also the 11/45, differ from most other PDP-11 models in the
+implementation of the stack protection and trace traps.
+The 11/70 does stack protection checks for write accesses in mode 1,2,4, and 6,
+while for example the J11 only checks for mode 2 and 3.
+The service order for trap and interrupt processing also differs, on the 11/70
+interrupts have priority over tbit traps, while on the J11 and most other
+models interrupts have lowest priority.
+The SimH simulator uses J11 semantics in both cases, even in 11/70 mode.
+In some cases, the w11 implementation followed the SimH implementation, and
+as a result, some J11 behaviors crept into the w11.
+
+### Issues and Fixes
+- do `STKLIM` check for mode 1,2,4,6 in `dstr` flows
+  - issue: stack limit checks were only done in the `dstw` flow used for `MOV`
+    and `CLR` instructions, but not in the `dstr` flow used for all instructions
+    that perform destination read-modify-write, like `ADD` or `BIS`.
+  - fix: stack limits checks are now done in both `dstw` and `dstr` flows for
+    all instructions that write to memory.
+- correct red/yellow zone boundary
+  - issues: detection logic for the yellow and red zone was faulty and produced
+      yellow islands in the red area. Highly unlikely to detect that in normal
+      operation, it was found in a code review.
+  - fix: the first 16 words below the stack limit are now detected as yellow
+      zone, all below as red zone.  
+- correct ysv flow implementation
+  - issues: the w11 implementation used a hack to prevent that the vector flow
+      caused by a yellow stack trap causes another yellow stack trap and did
+      yellow stack traps only if the respective bit in `CPUERR` was zero.
+      That caused several xxdp diagnostics for missing traps.
+  - fix: the hack is removed and replaced by proper protection logic.
+- correct mmu trap handing in `s_idecode`
+  - issues: in case of register-register operate instructions, like `INC R0`
+      or `ADD R1,R1`, that execute in two cycles, the w11 starts in `s_idecode`
+      the fetch of the next instruction. That logic checked for interrupts but
+      not for MMU traps. MMU traps were therefore only taken at the first
+      instruction that was fetch pipelined.
+  - fix: correct prefetch logic, suppress prefetch also in case of pending
+      traps.
+- correct mmu trap vs interrupt priority
+  - issues: the w11 had an incorrect service order, and interrupts had higher
+      precedence than traps.
+  - fix: implemented correct 11/70 style precedence, with tbit trap lowest,
+      interrupts above tbit traps, and all other traps above interrupts.
+- trace trap logic overhaul
+  - issues: the w11 decided at the end of an instruction whether tbit trap
+      must be taken and the deferral of tbit trap of the `RTT` instruction
+      was implanted by ignoring any break condition. This gives the expected
+      behavior in all most all cases but deviates in a few corner cases like
+      single stepping code.
+  - fix: implement the approach used by 11/70, but also J11, to set a request
+      flag at the beginning of instruction processing, in state `s_idecode`,
+      and take the tbit trap decision based on that flag at the end of
+      instruction execution.
+- `RESET` wait time
+  - issues: on the w11 the `RESET` instruction caused a one-cycle `breset`
+      pulse and continued immediately. The clearing of pending interrupts takes
+      2 cycles until it is visible in the CPU trap and interrupt dispatch logic.
+      If there was an interrupt pending when a `RESET` was executed it was
+      taken due to this delay. This is visible with a carefully constructed
+      `SPL` and `RESET` sequence and was not relevant for normal operation.
+  - fix: the `RESET` instruction now waits for 7 cycles after the `breset`
+      pulse was generated. That is long enough for all implemented devices.
+
+### Hindsight
+All deficits had no impact on OS operation and had therefore low priority.
+However, the goal of the w11 is to be an as precise as feasible replica of
+the 11/70, and it was overdue to fix them.
diff --git a/rtl/sys_gen/w11a/arty/sys_w11a_arty.vhd b/rtl/sys_gen/w11a/arty/sys_w11a_arty.vhd
index 98216f57..c9da7a34 100644
--- a/rtl/sys_gen/w11a/arty/sys_w11a_arty.vhd
+++ b/rtl/sys_gen/w11a/arty/sys_w11a_arty.vhd
@@ -1,4 +1,4 @@
--- $Id: sys_w11a_arty.vhd 1247 2022-07-06 07:04:33Z mueller $
+-- $Id: sys_w11a_arty.vhd 1325 2022-12-07 11:52:36Z mueller $
 -- SPDX-License-Identifier: GPL-3.0-or-later
 -- Copyright 2018-2022 by Walter F.J. Mueller <W.F.J.Mueller@gsi.de>
 --
@@ -29,6 +29,7 @@
 --
 -- Synthesized:
 -- Date         Rev  viv    Target       flop  lutl  lutm  bram  slic
+-- 2022-12-06  1324 2022.1  xc7a35t-1l   6851  8991   872  17.5  3133
 -- 2022-07-05  1247 2022.1  xc7a35t-1l   6842  9218   872  17.5  3210
 -- 2019-05-19  1150 2017.2  xc7a35t-1l   6838 10574   923  17.5  3392 +dz11
 -- 2019-04-27  1140 2017.2  xc7a35t-1l   6706 10249   898  17.0  3380 +*buf
diff --git a/rtl/sys_gen/w11a/arty/sys_w11a_arty.vmfset b/rtl/sys_gen/w11a/arty/sys_w11a_arty.vmfset
index ee25a43c..7b0ae2da 100644
--- a/rtl/sys_gen/w11a/arty/sys_w11a_arty.vmfset
+++ b/rtl/sys_gen/w11a/arty/sys_w11a_arty.vmfset
@@ -1,4 +1,4 @@
-# $Id: sys_w11a_arty.vmfset 1242 2022-05-27 17:08:43Z mueller $
+# $Id: sys_w11a_arty.vmfset 1325 2022-12-07 11:52:36Z mueller $
 #
 # Validated code/tool version combinations
 #   Date          rev   viv   
@@ -47,7 +47,6 @@ i [Synth 8-3331] pdp11_psr .* DIN[(8|9|10)]
 # --> not all moni fields used                                  # OK 2018-12-28
 i [Synth 8-3331] pdp11_mmu_ssr12 .* MONI[(idone|trace_prev)]
 # --> not all CNTL fieds used; also 6 LSBs from vaddr           # OK 2018-12-28
-i [Synth 8-3331] pdp11_mmu .* CNTL[trap_done]
 i [Synth 8-3331] pdp11_mmu .* VADDR[(0|1|2|3|4|5)]
 # --> so far no usage of usec and msec pulse                    # OK 2018-12-28
 i [Synth 8-3331] rlink_sp2c .* (CE_USEC|CE_MSEC)
@@ -78,7 +77,6 @@ i [Synth 8-7129] DIN[(8|9|10)] .* pdp11_psr
 # --> not all moni fields used                                  # OK 2022-05-26
 i [Synth 8-7129] MONI[(idone|trace_prev)] .* pdp11_mmu_ssr12
 # --> not all CNTL fieds used; also 6 LSBs from vaddr           # OK 2022-05-26
-i [Synth 8-7129] CNTL[trap_done] .* pdp11_mmu
 i [Synth 8-7129] VADDR[(0|1|2|3|4|5)] .* pdp11_mmu
 # --> so far no usage of usec and msec pulse                    # OK 2022-05-26
 i [Synth 8-7129] (CE_USEC|CE_MSEC) .* rlink_sp2c
diff --git a/rtl/sys_gen/w11a/arty_bram/sys_w11a_br_arty.vmfset b/rtl/sys_gen/w11a/arty_bram/sys_w11a_br_arty.vmfset
index 6eb53de9..1ea672cb 100644
--- a/rtl/sys_gen/w11a/arty_bram/sys_w11a_br_arty.vmfset
+++ b/rtl/sys_gen/w11a/arty_bram/sys_w11a_br_arty.vmfset
@@ -1,4 +1,4 @@
-# $Id: sys_w11a_br_arty.vmfset 1242 2022-05-27 17:08:43Z mueller $
+# $Id: sys_w11a_br_arty.vmfset 1325 2022-12-07 11:52:36Z mueller $
 #
 # Validated code/tool version combinations
 #   Date          rev   viv   
@@ -46,7 +46,6 @@ i [Synth 8-3331] pdp11_psr .* DIN[(8|9|10)]
 # --> not all moni fields used                                  # OK 2018-11-18
 i [Synth 8-3331] pdp11_mmu_ssr12 .* MONI[(idone|trace_prev)]
 # --> not all CNTL fieds used; also 6 LSBs from vaddr           # OK 2018-11-18
-i [Synth 8-3331] pdp11_mmu .* CNTL[trap_done]
 i [Synth 8-3331] pdp11_mmu .* VADDR[(0|1|2|3|4|5)]
 # --> so far no usage of usec and msec pulse                    # OK 2018-11-18
 i [Synth 8-3331] rlink_sp2c .* (CE_USEC|CE_MSEC)
@@ -77,7 +76,6 @@ i [Synth 8-7129] DIN[(8|9|10)] .* pdp11_psr
 # --> not all moni fields used                                  # OK 2022-05-26
 i [Synth 8-7129] MONI[(idone|trace_prev)] .* pdp11_mmu_ssr12
 # --> not all CNTL fieds used; also 6 LSBs from vaddr           # OK 2022-05-26
-i [Synth 8-7129] CNTL[trap_done] .* pdp11_mmu
 i [Synth 8-7129] VADDR[(0|1|2|3|4|5)] .* pdp11_mmu
 # --> so far no usage of usec and msec pulse                    # OK 2022-05-26
 i [Synth 8-7129] (CE_USEC|CE_MSEC) .* rlink_sp2c
diff --git a/rtl/sys_gen/w11a/artys7/sys_w11a_as7.vmfset b/rtl/sys_gen/w11a/artys7/sys_w11a_as7.vmfset
index f08e497b..9395c9ca 100644
--- a/rtl/sys_gen/w11a/artys7/sys_w11a_as7.vmfset
+++ b/rtl/sys_gen/w11a/artys7/sys_w11a_as7.vmfset
@@ -1,4 +1,4 @@
-# $Id: sys_w11a_as7.vmfset 1242 2022-05-27 17:08:43Z mueller $
+# $Id: sys_w11a_as7.vmfset 1325 2022-12-07 11:52:36Z mueller $
 #
 # Validated code/tool version combinations
 #   Date          rev   viv   
@@ -44,7 +44,6 @@ i [Synth 8-3331] pdp11_psr .* DIN[(8|9|10)]
 # --> not all moni fields used                                  # OK 2019-01-12
 i [Synth 8-3331] pdp11_mmu_ssr12 .* MONI[(idone|trace_prev)]
 # --> not all CNTL fieds used; also 6 LSBs from vaddr           # OK 2019-01-12
-i [Synth 8-3331] pdp11_mmu .* CNTL[trap_done]
 i [Synth 8-3331] pdp11_mmu .* VADDR[(0|1|2|3|4|5)]
 # --> so far no usage of usec and msec pulse                    # OK 2019-01-12
 i [Synth 8-3331] rlink_sp2c .* (CE_USEC|CE_MSEC)
@@ -77,7 +76,6 @@ i [Synth 8-7129] DIN[(8|9|10)] .* pdp11_psr
 # --> not all moni fields used                                  # OK 2022-05-26
 i [Synth 8-7129] MONI[(idone|trace_prev)] .* pdp11_mmu_ssr12
 # --> not all CNTL fieds used; also 6 LSBs from vaddr           # OK 2022-05-26
-i [Synth 8-7129] CNTL[trap_done] .* pdp11_mmu
 i [Synth 8-7129] VADDR[(0|1|2|3|4|5)] .* pdp11_mmu
 # --> pdp11_hio70_arty doesn't use MEM_ACT                      # OK 2022-05-26
 i [Synth 8-7129] MEM_ACT_(R|W) .* pdp11_hio70_artys7
diff --git a/rtl/sys_gen/w11a/artys7_bram/sys_w11a_br_as7.vmfset b/rtl/sys_gen/w11a/artys7_bram/sys_w11a_br_as7.vmfset
index d4dbf7f8..6869a35f 100644
--- a/rtl/sys_gen/w11a/artys7_bram/sys_w11a_br_as7.vmfset
+++ b/rtl/sys_gen/w11a/artys7_bram/sys_w11a_br_as7.vmfset
@@ -1,4 +1,4 @@
-# $Id: sys_w11a_br_as7.vmfset 1242 2022-05-27 17:08:43Z mueller $
+# $Id: sys_w11a_br_as7.vmfset 1325 2022-12-07 11:52:36Z mueller $
 #
 # Validated code/tool version combinations
 #   Date          rev   viv   
@@ -46,7 +46,6 @@ i [Synth 8-3331] pdp11_psr .* DIN[(8|9|10)]
 # --> not all moni fields used                                  # OK 2018-11-18
 i [Synth 8-3331] pdp11_mmu_ssr12 .* MONI[(idone|trace_prev)]
 # --> not all CNTL fieds used; also 6 LSBs from vaddr           # OK 2018-11-18
-i [Synth 8-3331] pdp11_mmu .* CNTL[trap_done]
 i [Synth 8-3331] pdp11_mmu .* VADDR[(0|1|2|3|4|5)]
 # --> so far no usage of usec and msec pulse                    # OK 2018-11-18
 i [Synth 8-3331] rlink_sp2c .* (CE_USEC|CE_MSEC)
@@ -79,7 +78,6 @@ i [Synth 8-7129] DIN[(8|9|10)] .* pdp11_psr
 # --> not all moni fields used                                  # OK 2022-05-26
 i [Synth 8-7129] MONI[(idone|trace_prev)] .* pdp11_mmu_ssr12
 # --> not all CNTL fieds used; also 6 LSBs from vaddr           # OK 2022-05-26
-i [Synth 8-7129] CNTL[trap_done] .* pdp11_mmu
 i [Synth 8-7129] VADDR[(0|1|2|3|4|5)] .* pdp11_mmu
 # --> so far no usage of usec and msec pulse                    # OK 2022-05-26
 i [Synth 8-7129] (CE_USEC|CE_MSEC) .* rlink_sp2c
diff --git a/rtl/sys_gen/w11a/basys3/sys_w11a_b3.vhd b/rtl/sys_gen/w11a/basys3/sys_w11a_b3.vhd
index 9c906562..e258a16f 100644
--- a/rtl/sys_gen/w11a/basys3/sys_w11a_b3.vhd
+++ b/rtl/sys_gen/w11a/basys3/sys_w11a_b3.vhd
@@ -1,4 +1,4 @@
--- $Id: sys_w11a_b3.vhd 1247 2022-07-06 07:04:33Z mueller $
+-- $Id: sys_w11a_b3.vhd 1325 2022-12-07 11:52:36Z mueller $
 -- SPDX-License-Identifier: GPL-3.0-or-later
 -- Copyright 2015-2022 by Walter F.J. Mueller <W.F.J.Mueller@gsi.de>
 --
@@ -26,6 +26,7 @@
 --
 -- Synthesized:
 -- Date         Rev  viv    Target       flop  lutl  lutm  bram  slic
+-- 2022-12-06  1324 2022.1  xc7a35t-1    3050  5501   267  48.0  1829
 -- 2022-07-05  1247 2022.1  xc7a35t-1    3011  5669   267  48.0  1906
 -- 2019-05-19  1150 2017.2  xc7a35t-1    2968  6360   273  48.0  1963 +dz11
 -- 2019-04-27  1140 2017.2  xc7a35t-1    2835  6032   248  47.5  1879 +*buf
diff --git a/rtl/sys_gen/w11a/basys3/sys_w11a_b3.vmfset b/rtl/sys_gen/w11a/basys3/sys_w11a_b3.vmfset
index 5dffef70..92258b85 100644
--- a/rtl/sys_gen/w11a/basys3/sys_w11a_b3.vmfset
+++ b/rtl/sys_gen/w11a/basys3/sys_w11a_b3.vmfset
@@ -1,4 +1,4 @@
-# $Id: sys_w11a_b3.vmfset 1242 2022-05-27 17:08:43Z mueller $
+# $Id: sys_w11a_b3.vmfset 1325 2022-12-07 11:52:36Z mueller $
 #
 # Validated code/tool version combinations
 #   Date          rev   viv   
@@ -47,7 +47,6 @@ i [Synth 8-3331] pdp11_psr .* DIN[(8|9|10)]
 # --> not all moni fields used                                  # OK 2018-11-18
 i [Synth 8-3331] pdp11_mmu_ssr12 .* MONI[(idone|trace_prev)]
 # --> not all CNTL fieds used; also 6 LSBs from vaddr           # OK 2018-11-18
-i [Synth 8-3331] pdp11_mmu .* CNTL[trap_done]
 i [Synth 8-3331] pdp11_mmu .* VADDR[(0|1|2|3|4|5)]
 # --> so far no usage of usec and msec pulse                    # OK 2018-11-18
 i [Synth 8-3331] rlink_sp2c .* (CE_USEC|CE_MSEC)
@@ -78,7 +77,6 @@ i [Synth 8-7129] DIN[(8|9|10)] .* pdp11_psr
 # --> not all moni fields used                                  # OK 2022-05-26
 i [Synth 8-7129] MONI[(idone|trace_prev)] .* pdp11_mmu_ssr12
 # --> not all CNTL fieds used; also 6 LSBs from vaddr           # OK 2022-05-26
-i [Synth 8-7129] CNTL[trap_done] .* pdp11_mmu
 i [Synth 8-7129] VADDR[(0|1|2|3|4|5)] .* pdp11_mmu
 # --> so far no usage of usec and msec pulse                    # OK 2022-05-26
 i [Synth 8-7129] (CE_USEC|CE_MSEC) .* rlink_sp2c
diff --git a/rtl/sys_gen/w11a/cmoda7/sys_w11a_c7.vhd b/rtl/sys_gen/w11a/cmoda7/sys_w11a_c7.vhd
index 44e2ef84..7c71f237 100644
--- a/rtl/sys_gen/w11a/cmoda7/sys_w11a_c7.vhd
+++ b/rtl/sys_gen/w11a/cmoda7/sys_w11a_c7.vhd
@@ -1,4 +1,4 @@
--- $Id: sys_w11a_c7.vhd 1247 2022-07-06 07:04:33Z mueller $
+-- $Id: sys_w11a_c7.vhd 1325 2022-12-07 11:52:36Z mueller $
 -- SPDX-License-Identifier: GPL-3.0-or-later
 -- Copyright 2017-2022 by Walter F.J. Mueller <W.F.J.Mueller@gsi.de>
 --
@@ -28,6 +28,7 @@
 --
 -- Synthesized:
 -- Date         Rev  viv    Target       flop  lutl  lutm  bram  slic
+-- 2022-12-06  1324 2022.1  xc7a35t-1    3447  5998   278  50.0  1992
 -- 2022-07-05  1247 2022.1  xc7a35t-1    3411  6189   279  50.0  2021
 -- 2019-05-19  1150 2017.2  xc7a35t-1    3369  6994   285  50.0  2099 +dz11
 -- 2019-04-27  1140 2017.2  xc7a35t-1    3243  6618   260  50.0  2009 +ibtst
diff --git a/rtl/sys_gen/w11a/cmoda7/sys_w11a_c7.vmfset b/rtl/sys_gen/w11a/cmoda7/sys_w11a_c7.vmfset
index 05a5b48d..1cc8d434 100644
--- a/rtl/sys_gen/w11a/cmoda7/sys_w11a_c7.vmfset
+++ b/rtl/sys_gen/w11a/cmoda7/sys_w11a_c7.vmfset
@@ -1,4 +1,4 @@
-# $Id: sys_w11a_c7.vmfset 1242 2022-05-27 17:08:43Z mueller $
+# $Id: sys_w11a_c7.vmfset 1325 2022-12-07 11:52:36Z mueller $
 #
 # Validated code/tool version combinations
 #   Date          rev   viv   
@@ -55,7 +55,6 @@ i [Synth 8-3331] pdp11_psr .* DIN[(8|9|10)]
 # --> not all moni fields used                                  # OK 2018-11-18
 i [Synth 8-3331] pdp11_mmu_ssr12 .* MONI[(idone|trace_prev)]
 # --> not all CNTL fieds used; also 6 LSBs from vaddr           # OK 2018-11-18
-i [Synth 8-3331] pdp11_mmu .* CNTL[trap_done]
 i [Synth 8-3331] pdp11_mmu .* VADDR[(0|1|2|3|4|5)]
 # --> so far no usage of usec and msec pulse                    # OK 2018-11-18
 i [Synth 8-3331] rlink_sp2c .* (CE_USEC|CE_MSEC)
@@ -88,7 +87,6 @@ i [Synth 8-7129] DIN[(8|9|10)] .* pdp11_psr
 # --> not all moni fields used                                  # OK 2022-05-26
 i [Synth 8-7129] MONI[(idone|trace_prev)] .* pdp11_mmu_ssr12
 # --> not all CNTL fieds used; also 6 LSBs from vaddr           # OK 2022-05-26
-i [Synth 8-7129] CNTL[trap_done] .* pdp11_mmu
 i [Synth 8-7129] VADDR[(0|1|2|3|4|5)] .* pdp11_mmu
 # --> so far no usage of usec and msec pulse                    # OK 2022-05-26
 i [Synth 8-7129] (CE_USEC|CE_MSEC) .* rlink_sp2c
diff --git a/rtl/sys_gen/w11a/nexys2/sys_w11a_n2.vhd b/rtl/sys_gen/w11a/nexys2/sys_w11a_n2.vhd
index 90e80e0c..60d05587 100644
--- a/rtl/sys_gen/w11a/nexys2/sys_w11a_n2.vhd
+++ b/rtl/sys_gen/w11a/nexys2/sys_w11a_n2.vhd
@@ -1,6 +1,6 @@
--- $Id: sys_w11a_n2.vhd 1181 2019-07-08 17:00:50Z mueller $
+-- $Id: sys_w11a_n2.vhd 1325 2022-12-07 11:52:36Z mueller $
 -- SPDX-License-Identifier: GPL-3.0-or-later
--- Copyright 2010-2019 by Walter F.J. Mueller <W.F.J.Mueller@gsi.de>
+-- Copyright 2010-2022 by Walter F.J. Mueller <W.F.J.Mueller@gsi.de>
 --
 ------------------------------------------------------------------------------
 -- Module Name:    sys_w11a_n2 - syn
@@ -21,10 +21,11 @@
 -- Test bench:     tb/tb_sys_w11a_n2
 --
 -- Target Devices: generic
--- Tool versions:  xst 8.2-14.7; ghdl 0.26-0.35
+-- Tool versions:  xst 8.2-14.7; ghdl 0.26-2.0.0
 --
 -- Synthesized (xst):
 -- Date         Rev  ise         Target      flop lutl lutm slic t peri
+-- 2022-12-06  1324 14.7  131013 xc3s1200e-4 3225 9040  638 5848 ok:         67%
 -- 2019-05-19  1150 14.7  131013 xc3s1200e-4 3219 8981  638 5796 ok: +dz11   66%
 -- 2019-04-27  1140 14.7  131013 xc3s1200e-4 3087 ????  588 5515 ok: +*buf   63%
 -- 2019-03-02  1116 14.7  131013 xc3s1200e-4 3024 8246  526 5322 ok: +ibtst  61%
diff --git a/rtl/sys_gen/w11a/nexys3/sys_w11a_n3.vhd b/rtl/sys_gen/w11a/nexys3/sys_w11a_n3.vhd
index 8e48c6f6..871a42d5 100644
--- a/rtl/sys_gen/w11a/nexys3/sys_w11a_n3.vhd
+++ b/rtl/sys_gen/w11a/nexys3/sys_w11a_n3.vhd
@@ -1,6 +1,6 @@
--- $Id: sys_w11a_n3.vhd 1181 2019-07-08 17:00:50Z mueller $
+-- $Id: sys_w11a_n3.vhd 1325 2022-12-07 11:52:36Z mueller $
 -- SPDX-License-Identifier: GPL-3.0-or-later
--- Copyright 2011-2019 by Walter F.J. Mueller <W.F.J.Mueller@gsi.de>
+-- Copyright 2011-2022 by Walter F.J. Mueller <W.F.J.Mueller@gsi.de>
 --
 ------------------------------------------------------------------------------
 -- Module Name:    sys_w11a_n3 - syn
@@ -21,10 +21,11 @@
 -- Test bench:     tb/tb_sys_w11a_n3
 --
 -- Target Devices: generic
--- Tool versions:  xst 13.1-14.7; ghdl 0.29-0.35
+-- Tool versions:  xst 13.1-14.7; ghdl 0.29-2.0.0
 --
 -- Synthesized (xst):
 -- Date         Rev  ise         Target      flop lutl lutm slic t peri
+-- 2022-12-06  1324 14.7  131013 xc6slx16-2  3227 6368  254 2182 ok:         95%
 -- 2019-05-19  1150 14.7  131013 xc6slx16-2  3167 6052  248 2130 ok: +dz11   93%
 -- 2019-05-01  1143 14.7  131013 xc6slx16-2  3062 5761  232 2057 ok: +m9312  90%
 -- 2019-04-27  1140 14.7  131013 xc6slx16-2  3053 5742  232 2050 ok: +dlbuf  89%
diff --git a/rtl/sys_gen/w11a/nexys4/sys_w11a_n4.vmfset b/rtl/sys_gen/w11a/nexys4/sys_w11a_n4.vmfset
index 97b6ae50..347bb118 100644
--- a/rtl/sys_gen/w11a/nexys4/sys_w11a_n4.vmfset
+++ b/rtl/sys_gen/w11a/nexys4/sys_w11a_n4.vmfset
@@ -1,4 +1,4 @@
-# $Id: sys_w11a_n4.vmfset 1242 2022-05-27 17:08:43Z mueller $
+# $Id: sys_w11a_n4.vmfset 1325 2022-12-07 11:52:36Z mueller $
 #
 # Validated code/tool version combinations
 #   Date          rev   viv   
@@ -48,7 +48,6 @@ i [Synth 8-3331] pdp11_psr .* DIN[(8|9|10)]
 # --> not all moni fields used                                  # OK 2018-11-18
 i [Synth 8-3331] pdp11_mmu_ssr12 .* MONI[(idone|trace_prev)]
 # --> not all CNTL fieds used; also 6 LSBs from vaddr           # OK 2018-11-18
-i [Synth 8-3331] pdp11_mmu .* CNTL[trap_done]
 i [Synth 8-3331] pdp11_mmu .* VADDR[(0|1|2|3|4|5)]
 # --> so far no usage of usec and msec pulse                    # OK 2018-11-18
 i [Synth 8-3331] rlink_sp2c .* (CE_USEC|CE_MSEC)
@@ -78,7 +77,6 @@ i [Synth 8-7129] DIN[(8|9|10)] .* pdp11_psr
 # --> not all moni fields used                                  # OK 2022-05-26
 i [Synth 8-7129] MONI[(idone|trace_prev)] .* pdp11_mmu_ssr12
 # --> not all CNTL fieds used; also 6 LSBs from vaddr           # OK 2022-05-26
-i [Synth 8-7129] CNTL[trap_done] .* pdp11_mmu
 i [Synth 8-7129] VADDR[(0|1|2|3|4|5)] .* pdp11_mmu
 # --> so far no usage of usec and msec pulse                    # OK 2022-05-26
 i [Synth 8-7129] (CE_USEC|CE_MSEC) .* rlink_sp2c
diff --git a/rtl/sys_gen/w11a/nexys4d/sys_w11a_n4d.vhd b/rtl/sys_gen/w11a/nexys4d/sys_w11a_n4d.vhd
index 9e7515ab..5e0ed2d5 100644
--- a/rtl/sys_gen/w11a/nexys4d/sys_w11a_n4d.vhd
+++ b/rtl/sys_gen/w11a/nexys4d/sys_w11a_n4d.vhd
@@ -1,4 +1,4 @@
--- $Id: sys_w11a_n4d.vhd 1247 2022-07-06 07:04:33Z mueller $
+-- $Id: sys_w11a_n4d.vhd 1325 2022-12-07 11:52:36Z mueller $
 -- SPDX-License-Identifier: GPL-3.0-or-later
 -- Copyright 2019-2022 by Walter F.J. Mueller <W.F.J.Mueller@gsi.de>
 --
@@ -28,6 +28,7 @@
 --
 -- Synthesized:
 -- Date         Rev  viv    Target       flop  lutl  lutm  bram  slic MHz
+-- 2022-12-06  1324 2022.1  xc7a100t-1   6852  8773   868  17.5  3240  80
 -- 2022-07-05  1247 2022.1  xc7a100t-1   6805  8961   869  17.5  3282  80
 -- 2019-08-10  1201 2019.1  xc7a100t-1   6850 10258   901  17.5  3563  80
 -- 2019-05-19  1150 2017.2  xc7a100t-1   6811 10322   901  17.5  3496  80 +dz11
diff --git a/rtl/sys_gen/w11a/nexys4d/sys_w11a_n4d.vmfset b/rtl/sys_gen/w11a/nexys4d/sys_w11a_n4d.vmfset
index 61b36af0..8da43c2a 100644
--- a/rtl/sys_gen/w11a/nexys4d/sys_w11a_n4d.vmfset
+++ b/rtl/sys_gen/w11a/nexys4d/sys_w11a_n4d.vmfset
@@ -1,4 +1,4 @@
-# $Id: sys_w11a_n4d.vmfset 1242 2022-05-27 17:08:43Z mueller $
+# $Id: sys_w11a_n4d.vmfset 1325 2022-12-07 11:52:36Z mueller $
 #
 # Validated code/tool version combinations
 #   Date          rev   viv   
@@ -49,7 +49,6 @@ i [Synth 8-3331] pdp11_psr .* DIN[(8|9|10)]
 # --> not all moni fields used                                  # OK 2019-01-02
 i [Synth 8-3331] pdp11_mmu_ssr12 .* MONI[(idone|trace_prev)]
 # --> not all CNTL fieds used; also 6 LSBs from vaddr           # OK 2019-01-02
-i [Synth 8-3331] pdp11_mmu .* CNTL[trap_done]
 i [Synth 8-3331] pdp11_mmu .* VADDR[(0|1|2|3|4|5)]
 # --> so far no usage of usec and msec pulse                    # OK 2019-01-02
 i [Synth 8-3331] rlink_sp2c .* (CE_USEC|CE_MSEC)
@@ -80,7 +79,6 @@ i [Synth 8-7129] DIN[(8|9|10)] .* pdp11_psr
 # --> not all moni fields used                                  # OK 2022-05-26
 i [Synth 8-7129] MONI[(idone|trace_prev)] .* pdp11_mmu_ssr12
 # --> not all CNTL fieds used; also 6 LSBs from vaddr           # OK 2022-05-26
-i [Synth 8-7129] CNTL[trap_done] .* pdp11_mmu
 i [Synth 8-7129] VADDR[(0|1|2|3|4|5)] .* pdp11_mmu
 # --> so far no usage of usec and msec pulse                    # OK 2022-05-26
 i [Synth 8-7129] (CE_USEC|CE_MSEC) .* rlink_sp2c
diff --git a/rtl/sys_gen/w11a/nexys4d_bram/sys_w11a_br_n4d.vmfset b/rtl/sys_gen/w11a/nexys4d_bram/sys_w11a_br_n4d.vmfset
index 4c838c51..e394b780 100644
--- a/rtl/sys_gen/w11a/nexys4d_bram/sys_w11a_br_n4d.vmfset
+++ b/rtl/sys_gen/w11a/nexys4d_bram/sys_w11a_br_n4d.vmfset
@@ -1,4 +1,4 @@
-# $Id: sys_w11a_br_n4d.vmfset 1242 2022-05-27 17:08:43Z mueller $
+# $Id: sys_w11a_br_n4d.vmfset 1325 2022-12-07 11:52:36Z mueller $
 #
 # Validated code/tool version combinations
 #   Date          rev   viv   
@@ -43,7 +43,6 @@ i [Synth 8-3331] pdp11_psr .* DIN[(8|9|10)]
 # --> not all moni fields used                                  # OK 2018-11-18
 i [Synth 8-3331] pdp11_mmu_ssr12 .* MONI[(idone|trace_prev)]
 # --> not all CNTL fieds used; also 6 LSBs from vaddr           # OK 2018-11-18
-i [Synth 8-3331] pdp11_mmu .* CNTL[trap_done]
 i [Synth 8-3331] pdp11_mmu .* VADDR[(0|1|2|3|4|5)]
 # --> so far no usage of usec and msec pulse                    # OK 2018-11-18
 i [Synth 8-3331] rlink_sp2c .* (CE_USEC|CE_MSEC)
@@ -74,7 +73,6 @@ i [Synth 8-7129] DIN[(8|9|10)] .* pdp11_psr
 # --> not all moni fields used                                  # OK 2022-05-26
 i [Synth 8-7129] MONI[(idone|trace_prev)] .* pdp11_mmu_ssr12
 # --> not all CNTL fieds used; also 6 LSBs from vaddr           # OK 2022-05-26
-i [Synth 8-7129] CNTL[trap_done] .* pdp11_mmu
 i [Synth 8-7129] VADDR[(0|1|2|3|4|5)] .* pdp11_mmu
 # --> so far no usage of usec and msec pulse                    # OK 2022-05-26
 i [Synth 8-7129] (CE_USEC|CE_MSEC) .* rlink_sp2c
diff --git a/rtl/sys_gen/w11a/s3board/sys_conf.vhd b/rtl/sys_gen/w11a/s3board/sys_conf.vhd
index 7317df94..13d90dac 100644
--- a/rtl/sys_gen/w11a/s3board/sys_conf.vhd
+++ b/rtl/sys_gen/w11a/s3board/sys_conf.vhd
@@ -1,15 +1,16 @@
--- $Id: sys_conf.vhd 1181 2019-07-08 17:00:50Z mueller $
+-- $Id: sys_conf.vhd 1325 2022-12-07 11:52:36Z mueller $
 -- SPDX-License-Identifier: GPL-3.0-or-later
--- Copyright 2007-2019 by Walter F.J. Mueller <W.F.J.Mueller@gsi.de>
+-- Copyright 2007-2022 by Walter F.J. Mueller <W.F.J.Mueller@gsi.de>
 --
 ------------------------------------------------------------------------------
 -- Package Name:   sys_conf
 -- Description:    Definitions for sys_w11a_s3 (for synthesis)
 --
 -- Dependencies:   -
--- Tool versions:  xst 8.1-14.7; ghdl 0.18-0.35
+-- Tool versions:  xst 8.1-14.7; ghdl 0.18-2022.1
 -- Revision History: 
 -- Date         Rev Version  Comment
+-- 2022-12-05  1324   1.4.2  disable dmhbpt,dmcmon,m9312 for timing closure
 -- 2019-04-28  1142   1.4.1  add sys_conf_ibd_m9312
 -- 2019-02-09  1110   1.4    use typ for DL,PC,LP; add dz11,ibtst
 -- 2019-01-27  1108   1.3.7  drop iist
@@ -45,8 +46,8 @@ package sys_conf is
   constant sys_conf_ibtst         : boolean := true;
   constant sys_conf_dmscnt        : boolean := true;
   constant sys_conf_dmpcnt        : boolean := true;
-  constant sys_conf_dmhbpt_nunit  : integer := 2; -- use 0 to disable
-  constant sys_conf_dmcmon_awidth : integer := 8; -- use 0 to disable
+  constant sys_conf_dmhbpt_nunit  : integer := 0; -- use 0 to disable
+  constant sys_conf_dmcmon_awidth : integer := 0; -- use 0 to disable
 
   -- configure w11 cpu core --------------------------------------------------
   constant sys_conf_mem_losize     : natural := 8#037777#; --   1 MByte
@@ -62,7 +63,7 @@ package sys_conf is
   constant sys_conf_ibd_dz11   : integer :=  5;    -- DZ11
   constant sys_conf_ibd_pc11   : integer :=  4;    -- PC11
   constant sys_conf_ibd_lp11   : integer :=  5;    -- LP11
-  constant sys_conf_ibd_deuna  : boolean := true;  -- DEUNA
+  constant sys_conf_ibd_deuna  : boolean := false; -- DEUNA
 
   -- configure mass storage devices
   constant sys_conf_ibd_rk11   : boolean := true;  -- RK11
@@ -72,7 +73,7 @@ package sys_conf is
 
   -- configure other devices
   constant sys_conf_ibd_iist   : boolean := false; -- IIST
-  constant sys_conf_ibd_kw11p  : boolean := true;  -- KW11P
-  constant sys_conf_ibd_m9312  : boolean := true;  -- M9312
+  constant sys_conf_ibd_kw11p  : boolean := false; -- KW11P
+  constant sys_conf_ibd_m9312  : boolean := false; -- M9312
 
 end package sys_conf;
diff --git a/rtl/sys_gen/w11a/s3board/sys_w11a_s3.vhd b/rtl/sys_gen/w11a/s3board/sys_w11a_s3.vhd
index 0320ff1c..f423c53a 100644
--- a/rtl/sys_gen/w11a/s3board/sys_w11a_s3.vhd
+++ b/rtl/sys_gen/w11a/s3board/sys_w11a_s3.vhd
@@ -1,6 +1,6 @@
--- $Id: sys_w11a_s3.vhd 1181 2019-07-08 17:00:50Z mueller $
+-- $Id: sys_w11a_s3.vhd 1325 2022-12-07 11:52:36Z mueller $
 -- SPDX-License-Identifier: GPL-3.0-or-later
--- Copyright 2007-2019 by Walter F.J. Mueller <W.F.J.Mueller@gsi.de>
+-- Copyright 2007-2022 by Walter F.J. Mueller <W.F.J.Mueller@gsi.de>
 --
 ------------------------------------------------------------------------------
 -- Module Name:    sys_w11a_s3 - syn
@@ -20,10 +20,11 @@
 -- Test bench:     tb/tb_sys_w11a_s3
 --
 -- Target Devices: generic
--- Tool versions:  xst 8.2-14.7; ghdl 0.18-0.35
+-- Tool versions:  xst 8.2-14.7; ghdl 0.18-2.0.0
 --
 -- Synthesized (xst):
 -- Date         Rev  ise         Target      flop lutl lutm slic t peri
+-- 2022-12-06  1324 14.7  131013 xc3s1000-4  2620 7940  542 4929 OK: -dm,deu 64%
 -- 2019-05-19  1150 14.7  131013 xc3s1000-4  3019 8764  574 5558 OK: +dz11   72%
 -- 2019-04-27  1140 14.7  131013 xc3s1000-4  2890 8306  524 5252 OK: +*buf   68%
 -- 2019-03-02  1116 14.7  131013 xc3s1000-4  2830 8045  462 5086 OK: +ibtst  66%
@@ -73,6 +74,8 @@
 --
 -- Revision History: 
 -- Date         Rev Version  Comment
+-- 2022-12-06  1324   2.2.2  remove dmhbpt,dmcmon,deuna,kw11p,m9312 to mitigate
+--                           recurring timing closure problems
 -- 2019-02-16  1112   2.2.1  set BTOWIDTH 7 (was 6, must > vmbox atowidth (6))
 -- 2018-10-13  1055   2.2    use DM_STAT_EXP; IDEC to maxisys; setup PERFEXT
 -- 2016-03-19   748   2.1.1  define rlink SYSID
diff --git a/rtl/w11a/pdp11.vhd b/rtl/w11a/pdp11.vhd
index 1297fcf9..d5099d3c 100644
--- a/rtl/w11a/pdp11.vhd
+++ b/rtl/w11a/pdp11.vhd
@@ -1,4 +1,4 @@
--- $Id: pdp11.vhd 1323 2022-12-01 08:00:41Z mueller $
+-- $Id: pdp11.vhd 1325 2022-12-07 11:52:36Z mueller $
 -- SPDX-License-Identifier: GPL-3.0-or-later
 -- Copyright 2006-2022 by Walter F.J. Mueller <W.F.J.Mueller@gsi.de>
 --
@@ -11,6 +11,8 @@
 --
 -- Revision History: 
 -- Date         Rev Version  Comment
+-- 2022-12-05  1324   1.5.19 add cpustat_type treq_tbit and resetcnt;
+--                           use op_rti rather op_rtt;
 -- 2022-11-29  1323   1.5.18 rename cpuerr_type adderr->oddadr, mmu_mmr0_type
 --                           dspace->page_dspace; drop mmu_cntl_type.trap_done
 -- 2022-11-24  1321   1.5.17 add cpustat_type intpend
@@ -266,7 +268,7 @@ package pdp11 is
     is_rmwop : slbit;                   -- read-modify-write operation
     is_bytop : slbit;                   -- byte operation
     is_res : slbit;                     -- reserved operation code
-    op_rtt : slbit;                     -- RTT instruction
+    op_rti : slbit;                     -- RTI instruction
     op_mov : slbit;                     -- MOV instruction
     trap_vec : slv3;                    -- trap vector addr bits 4:2
     force_srcsp : slbit;                -- force src register to be sp
@@ -382,8 +384,10 @@ package pdp11 is
     intack : slbit;                     -- INT_ACK pulse
     intpend : slbit;                    -- interrupt pending
     intvect  : slv9_2;                  -- current interrupt vector
+    resetcnt : slv3;                    -- RESET wait timer counter
     treq_mmu : slbit;                   -- mmu trap requested
     treq_ysv : slbit;                   -- ysv trap requested
+    treq_tbit : slbit;                  -- tbit trap requested
     prefdone : slbit;                   -- prefetch done
     do_grwe : slbit;                    -- pending gr_we
     in_vecser : slbit;                  -- in fatal stack error vector flow
@@ -398,8 +402,8 @@ package pdp11 is
     "00000","000",                      -- cpfunc, cprnum
     '0',                                -- waitsusp
     '0','0','0','0','0',                -- itimer,creset,breset,intack,intpend
-    (others=>'0'),                      -- intvect 
-    '0','0','0',                        -- treq_(mmu|ysv), prefdone
+    (others=>'0'),"111",                -- intvect,resetcnt
+    '0','0','0','0',                    -- treq_(mmu|ysv|tbit), prefdone
     '0','0','0'                         -- do_grwe, in_vec(ser|ysv)
   );
 
diff --git a/rtl/w11a/pdp11_decode.vhd b/rtl/w11a/pdp11_decode.vhd
index 1c2ba262..a2e246b6 100644
--- a/rtl/w11a/pdp11_decode.vhd
+++ b/rtl/w11a/pdp11_decode.vhd
@@ -1,4 +1,4 @@
--- $Id: pdp11_decode.vhd 1310 2022-10-27 16:15:50Z mueller $
+-- $Id: pdp11_decode.vhd 1325 2022-12-07 11:52:36Z mueller $
 -- SPDX-License-Identifier: GPL-3.0-or-later
 -- Copyright 2006-2022 by Walter F.J. Mueller <W.F.J.Mueller@gsi.de>
 --
@@ -12,6 +12,7 @@
 -- Tool versions:  ise 8.2-14.7; viv 2014.4-2022.1; ghdl 0.18-2.0.0
 -- Revision History: 
 -- Date         Rev Version  Comment
+-- 2022-12-02  1324   1.0.9  use op_rti rather op_rtt
 -- 2022-10-25  1309   1.0.8  rename _gpr -> _gr
 -- 2022-10-03  1301   1.0.7  add STAT.is_dstpcmode1
 -- 2011-11-18   427   1.0.6  now numeric_std clean
@@ -93,7 +94,7 @@ begin
     nstat.is_rmwop := '0';
     nstat.is_bytop := '0';
     nstat.is_res := '1';
-    nstat.op_rtt := '0';
+    nstat.op_rti := '0';
     nstat.op_mov := '0';
     nstat.trap_vec := "000";
     nstat.force_srcsp := '0';
@@ -165,6 +166,7 @@ begin
               nstat.do_fork_op := '1';
               
             when "010" =>               -- RTI
+              nstat.op_rti := '1';
               nstat.force_srcsp := '1';
               nstat.fork_op := c_fork_op_rtti;
               nstat.do_fork_op := '1';
@@ -184,7 +186,6 @@ begin
               nstat.do_fork_op := '1';
 
             when "110" =>               -- RTT
-              nstat.op_rtt := '1';
               nstat.force_srcsp := '1';
               nstat.fork_op := c_fork_op_rtti;
               nstat.do_fork_op := '1';
diff --git a/rtl/w11a/pdp11_sequencer.vhd b/rtl/w11a/pdp11_sequencer.vhd
index 479285b6..1eae24ee 100644
--- a/rtl/w11a/pdp11_sequencer.vhd
+++ b/rtl/w11a/pdp11_sequencer.vhd
@@ -1,4 +1,4 @@
--- $Id: pdp11_sequencer.vhd 1323 2022-12-01 08:00:41Z mueller $
+-- $Id: pdp11_sequencer.vhd 1325 2022-12-07 11:52:36Z mueller $
 -- SPDX-License-Identifier: GPL-3.0-or-later
 -- Copyright 2006-2022 by Walter F.J. Mueller <W.F.J.Mueller@gsi.de>
 --
@@ -13,6 +13,8 @@
 --
 -- Revision History: 
 -- Date         Rev Version  Comment
+-- 2022-12-05  1324   1.6.23 tbit logic overhaul; use treq_tbit; cleanups
+--                           use resetcnt for 8 cycle RESET wait
 -- 2022-11-29  1323   1.6.22 rename adderr -> oddadr, don't set after err_mmu
 -- 2022-11-28  1322   1.6.21 BUGFIX: correct mmu trap vs interrupt priority
 -- 2022-11-24  1321   1.6.20 BUGFIX: correct mmu trap handing in s_idecode
@@ -407,13 +409,12 @@ begin
                            pbytop   : in slbit := '0';
                            pmacc    : in slbit := '0';
                            pispace  : in slbit := '0';
-                           kstack   : in slbit := '0') is
+                           pkstack  : in slbit := '0') is
     begin
       pnvmcntl.dspace := not pispace;
---      bytop := R_IDSTAT.is_bytop and not is_addr;
       pnvmcntl.bytop  := pbytop;
       pnvmcntl.macc   := pmacc;
-      pnvmcntl.kstack := kstack;
+      pnvmcntl.kstack := pkstack;
       pnvmcntl.req    := '1';
       pnstate := pwstate;
     end procedure do_memread_d;
@@ -539,13 +540,14 @@ begin
                            pnstatus  : inout cpustat_type;
                            pnmmumoni : inout mmu_moni_type) is
     begin
-      pnmmumoni.idone := '1';
-      if R_STATUS.treq_mmu='1' or pnstatus.treq_mmu='1' or
-            R_STATUS.treq_ysv='1' or pnstatus.treq_ysv='1' or
-            PSW.tflag='1' then
+      pnmmumoni.idone := '1';                           -- priority order
+      if pnstatus.treq_mmu='1' or                       -- mmu trap
+           pnstatus.treq_ysv='1' then                   -- ysv trap
         pnstate := s_trap_disp;
-      elsif unsigned(INT_PRI) > unsigned(PSW.pri) then
+      elsif unsigned(INT_PRI) > unsigned(PSW.pri) then  -- interrupts
         pnstate := s_idle;
+      elsif pnstatus.treq_tbit='1' then                 -- tbit trap
+        pnstate := s_trap_disp;
       elsif R_STATUS.cpugo='1' and        -- running
             R_STATUS.cpususp='0' and      --   and not suspended
             not R_STATUS.cmdbusy='1' then --   and no cmd pending
@@ -563,13 +565,14 @@ begin
     begin
       pndpcntl := pndpcntl;             -- dummy to add driver (vivado)
       pnvmcntl := pnvmcntl;             -- "
-      pnmmumoni.idone := '1';
-      if R_STATUS.treq_mmu='1' or pnstatus.treq_mmu='1' or
-            R_STATUS.treq_ysv='1' or pnstatus.treq_ysv='1' or
-            PSW.tflag='1' then
+      pnmmumoni.idone := '1';                           -- priority order
+      if pnstatus.treq_mmu='1' or                       -- mmu trap
+            pnstatus.treq_ysv='1' then                  -- ysv trap
         pnstate := s_trap_disp;
-      elsif unsigned(INT_PRI) > unsigned(PSW.pri) then
+      elsif unsigned(INT_PRI) > unsigned(PSW.pri) then  -- interrupts
         pnstate := s_idle;
+      elsif pnstatus.treq_tbit='1' then                 -- tbit trap
+        pnstate := s_trap_disp;
       elsif R_STATUS.cpugo='1' and       -- running
             R_STATUS.cpususp='0' and      --   and not suspended
             not R_STATUS.cmdbusy='1' then --   and no cmd pending
@@ -780,9 +783,12 @@ begin
               if R_STATUS.cpugo = '1' then -- if already running
                 nstatus.cmderr := '1';       -- reject
               else                         -- if not running
-                nstatus.creset  := '1';      --  do cpu reset
-                nstatus.breset  := '1';      -- and bus reset !
-                nstatus.suspint := '0';      -- clear suspend
+                nstatus.creset    := '1';     --  do cpu reset
+                nstatus.breset    := '1';     -- and bus reset !
+                nstatus.suspint   := '0';     -- clear suspend
+                nstatus.treq_mmu  := '0';     -- cancel trap requests
+                nstatus.treq_ysv  := '0';
+                nstatus.treq_tbit := '0';
                 nstatus.cpurust := c_cpurust_init;
               end if;
               nstate := s_idle;                  
@@ -860,15 +866,20 @@ begin
           nstate := s_op_wait;            --waitsusp is cleared in s_op_wait
 
         elsif R_STATUS.cpugo = '1' and    -- running
-              R_STATUS.cpususp='0' then   --   and not suspended
-          if int_pending = '1' then         -- interrupt pending
-            nstatus.intack  := '1';           -- acknowledle it
-            nstatus.intvect := INT_VECT;      -- latch vector address
-            nstate := s_int_ext;              -- and handle
+               R_STATUS.cpususp='0' then   --   and not suspended
+                                           -- proceed in priority order
+          if R_STATUS.treq_mmu='1' and         -- mmu trap
+              R_STATUS.treq_ysv='1' then       -- ysv trap
+            nstate := s_trap_disp;
+          elsif R_STATUS.intpend = '1' then    -- interrupts
+            nstatus.intack  := '1';              -- acknowledle it
+            nstatus.intvect := INT_VECT;         -- latch vector address
+            nstate := s_int_ext;                 -- and handle
+          elsif R_STATUS.treq_tbit = '1' then  -- tbit trap
+            nstate := s_trap_disp;
           else
-            nstate := s_ifetch;               -- otherwise fetch intruction
+            nstate := s_ifetch;                -- otherwise fetch intruction
           end if;
-          
         end if;
 
       when s_cp_regread =>              -- -----------------------------------
@@ -893,8 +904,6 @@ begin
         ndpcntl.dres_sel := c_dpath_res_vmdout;  -- DRES = VMDOUT
         if (VM_STAT.ack or VM_STAT.err or VM_STAT.fail)='1' then
           nstatus.cmdack   := '1';
-          nstatus.treq_ysv := '0';               -- suppress traps on console
-          nstatus.treq_mmu := '0';
           nstatus.cmdmerr  := VM_STAT.err or VM_STAT.fail;
           nstate := s_idle;
         end if;
@@ -904,8 +913,6 @@ begin
         nstate := s_cp_memw_w;
         if (VM_STAT.ack or VM_STAT.err or VM_STAT.fail)='1' then
           nstatus.cmdack   := '1';
-          nstatus.treq_ysv := '0';               -- suppress traps on console
-          nstatus.treq_mmu := '0';
           nstatus.cmdmerr  := VM_STAT.err or VM_STAT.fail;
           nstate := s_idle;
         end if;
@@ -939,24 +946,29 @@ begin
         nvmcntl.dspace := '0';
         ndpcntl.vmaddr_sel := c_dpath_vmaddr_pc;       -- VA = PC
 
-        -- The prefetch decision path can be critical (and was on s3).
-        -- It uses R_STATUS.intpend instead of int_pending, using the status
-        -- latched at the previous state is OK. It uses R_STATUS.treq_mmu
-        -- because no MMU trap can occur during this state (only in *_w states).
-        -- It does not check treq_ysv because pipelined instructions can't
-        -- trigger ysv traps, in contrast to MMU traps.
-        if ID_STAT.do_pref_dec='1' and          -- prefetch possible
-          PSW.tflag='0' and                     -- no tbit traps
-          R_STATUS.intpend='0' and              -- no interrupts
-          R_STATUS.treq_mmu='0' and             -- no MMU trap request
-          R_STATUS.cpugo='1' and                -- CPU on go
-          R_STATUS.cpususp='0' and              -- CPU not suspended
-          not R_STATUS.cmdbusy='1'              -- and no command pending
-        then                                    -- then go for prefetch
-          nvmcntl.req := '1';
-          ndpcntl.gr_pcinc := '1';                     -- (pc)++
-          nmmumoni.istart := '1';
-          nstatus.prefdone := '1';
+        nstatus.resetcnt := "111";      -- set RESET wait timer
+
+        if PSW.tflag='1' then           -- if PSW tbit set
+          nstatus.treq_tbit := '1';     --   request tbit
+        else
+          -- The prefetch decision path can be critical (and was on s3). It uses
+          -- R_STATUS.intpend instead of int_pending, using the status latched
+          -- at the previous state is OK. It uses R_STATUS.treq_mmu because
+          -- no MMU trap can occur during this state (only in *_w states).
+          -- It does not check treq_ysv because pipelined instructions can't
+          -- trigger ysv traps, in contrast to MMU traps.
+          if ID_STAT.do_pref_dec='1' and          -- prefetch possible
+            R_STATUS.intpend='0' and              -- no interrupts
+            R_STATUS.treq_mmu='0' and             -- no MMU trap request
+            R_STATUS.cpugo='1' and                -- CPU on go
+            R_STATUS.cpususp='0' and              -- CPU not suspended
+            not R_STATUS.cmdbusy='1'              -- and no command pending
+          then                                    -- then go for prefetch
+            nvmcntl.req := '1';
+            ndpcntl.gr_pcinc := '1';                     -- (pc)++
+            nmmumoni.istart := '1';
+            nstatus.prefdone := '1';
+          end if;
         end if;
         
         if ID_STAT.do_fork_op = '1' then
@@ -1213,7 +1225,7 @@ begin
         do_memread_d(nstate, nvmcntl, s_dstr_def_w,
                      pbytop=>R_IDSTAT.is_bytop, pmacc=>R_IDSTAT.is_rmwop,
                      pispace=>R_IDSTAT.is_dstpcmode1,
-                     kstack=>is_kstackdst1246 and R_IDSTAT.is_rmwop);
+                     pkstack=>is_kstackdst1246 and R_IDSTAT.is_rmwop);
 
       when s_dstr_def_w =>              -- -----------------------------------
         nstate := s_dstr_def_w;
@@ -1239,7 +1251,7 @@ begin
         bytop := R_IDSTAT.is_bytop and not DSTDEF;
         do_memread_d(nstate, nvmcntl, s_dstr_inc_w,
                      pbytop=>bytop, pmacc=>macc, pispace=>R_IDSTAT.is_dstpc,
-                     kstack=>is_kstackdst1246 and R_IDSTAT.is_rmwop);
+                     pkstack=>is_kstackdst1246 and R_IDSTAT.is_rmwop);
         
       when s_dstr_inc_w =>              -- -----------------------------------
         nstate := s_dstr_inc_w;
@@ -1275,7 +1287,7 @@ begin
         bytop := R_IDSTAT.is_bytop and not DSTDEF;
         do_memread_d(nstate, nvmcntl, s_dstr_inc_w,
                      pbytop=>bytop, pmacc=>macc,
-                     kstack=>is_kstackdst1246 and R_IDSTAT.is_rmwop);
+                     pkstack=>is_kstackdst1246 and R_IDSTAT.is_rmwop);
 
       when s_dstr_ind =>                -- -----------------------------------
         do_memread_i(nstate, ndpcntl, nvmcntl, s_dstr_ind1_w);
@@ -1302,7 +1314,7 @@ begin
         bytop := R_IDSTAT.is_bytop and not DSTDEF;
         do_memread_d(nstate, nvmcntl, s_dstr_ind2_w,
                      pbytop=>bytop, pmacc=>macc,
-                     kstack=>is_kstackdst1246 and R_IDSTAT.is_rmwop);
+                     pkstack=>is_kstackdst1246 and R_IDSTAT.is_rmwop);
 
       when s_dstr_ind2_w =>             -- -----------------------------------
         nstate := s_dstr_ind2_w;
@@ -1628,16 +1640,24 @@ begin
           nstatus.itimer  := '1';       -- itimer will stay 1 during a WAIT
        end if;
 
-      when s_op_trap =>                 -- traps -----------------------------
+      when s_op_trap =>                 -- trap instructions (IOT,BPT,..) ----
         idm_idone := '1';                      -- instruction done
         lvector := "0000" & R_IDSTAT.trap_vec; -- vector
         do_start_vec(nstate, ndpcntl, lvector);
         
       when s_op_reset =>                -- RESET -----------------------------
+        nstate := s_op_reset;           -- default is spin till timer expire
+        nstatus.resetcnt := slv(unsigned(R_STATUS.resetcnt) - 1);  -- dec timer
         if is_kmode = '1' then          -- if in kernel mode execute
-          nstatus.breset := '1';          -- issue bus reset
+          if R_STATUS.resetcnt = "111" then   -- in first cycle
+            nstatus.breset := '1';            -- issue bus reset
+          end if;
+          if R_STATUS.resetcnt = "000" then   -- in last cycle
+            nstate := s_idle;                 -- done, continue via s_idle
+          end if;
+        else                             -- if not in kernel mode
+          nstate := s_idle;                -- nop, continue via s_idle
         end if;
-        nstate := s_idle;
         
       when s_op_rts =>                  -- RTS -------------------------------
         ndpcntl.ounit_asel := c_ounit_asel_ddst;   -- OUNIT A=DDST
@@ -2183,8 +2203,9 @@ begin
         else
           lvector := "0000011";         -- trace trap: vector (14)
         end if;
-        nstatus.treq_mmu := '0';        -- clear trap request flags
-        nstatus.treq_ysv := '0';        -- 
+        nstatus.treq_mmu  := '0';       -- clear trap request flags
+        nstatus.treq_ysv  := '0';       --
+        nstatus.treq_tbit := '0';       --
         do_start_vec(nstate, ndpcntl, lvector);
 
       when s_int_ext =>                 -- -----------------------------------
@@ -2195,6 +2216,7 @@ begin
 
       when s_vec_getpc =>               -- -----------------------------------
         idm_vfetch := '1';              -- signal vfetch
+        nstatus.treq_tbit := '0';       -- cancel pending tbit request
         nvmcntl.mode := c_psw_kmode;    -- fetch PC from kernel D space
         do_memread_srcinc(nstate, ndpcntl, nvmcntl, s_vec_getpc_w, nmmumoni);
 
@@ -2339,6 +2361,10 @@ begin
         end if;
 
       when s_rti_newpc =>               -- -----------------------------------
+        if R_IDSTAT.op_rti = '1' and            -- if RTI instruction
+           PSW.tflag = '1' then                 --   and PSW tflag set now
+          nstatus.treq_tbit := '1';             --   request immediate tbit
+        end if;
         ndpcntl.ounit_asel := c_ounit_asel_ddst;  -- OUNIT A=DDST
         ndpcntl.ounit_bsel := c_ounit_bsel_const; -- OUNIT B=const (0)
         ndpcntl.dres_sel := c_dpath_res_ounit;    -- DRES = OUNIT
@@ -2346,11 +2372,7 @@ begin
         ndpcntl.gr_we := '1';                     -- load new PC
         idm_pcload := '1';                        -- signal flow change
         idm_idone := '1';                         -- instruction done
-        if R_IDSTAT.op_rtt = '1' then             -- if RTT instruction
-          nstate := s_ifetch;                       -- force fetch
-        else                                      -- otherwise RTI
-          do_fork_next(nstate, nstatus, nmmumoni);
-        end if;
+        do_fork_next(nstate, nstatus, nmmumoni);
 
   -- exception abort states ---------------------------------------------------
 
@@ -2365,8 +2387,9 @@ begin
         ndpcntl.gr_mode := c_psw_kmode;           -- set kmode SP to 4
         ndpcntl.gr_adst := c_gr_sp;
         
-        nstatus.treq_mmu := '0';                  -- cancel mmu trap request
-        nstatus.treq_ysv := '0';                  -- cancel ysv trap request
+        nstatus.treq_mmu  := '0';                 -- cancel mmu  trap request
+        nstatus.treq_ysv  := '0';                 -- cancel ysv  trap request
+        nstatus.treq_tbit := '0';                 -- cancel tbit trap request
 
         if R_VMSTAT.fail = '1' then               -- vmbox failure
           nstatus.cpugo   := '0';                   -- halt cpu
diff --git a/tools/asm-11/lib/push_pop.mac b/tools/asm-11/lib/push_pop.mac
index 9d7a5a2e..567dcb98 100644
--- a/tools/asm-11/lib/push_pop.mac
+++ b/tools/asm-11/lib/push_pop.mac
@@ -1,4 +1,4 @@
-; $Id: push_pop.mac 1264 2022-07-30 07:42:17Z mueller $
+; $Id: push_pop.mac 1325 2022-12-07 11:52:36Z mueller $
 ; SPDX-License-Identifier: GPL-3.0-or-later
 ; Copyright 2022- by Walter F.J. Mueller <W.F.J.Mueller@gsi.de>
 ;
@@ -10,6 +10,11 @@
         .macro  pushb,src
         movb    src,-(sp)
         .endm
+;
+        .macro  push2,src1,src2
+        mov     src1,-(sp)
+        mov     src2,-(sp)
+        .endm
 ;
         .macro  pop,dst
         mov     (sp)+,dst
diff --git a/tools/tbench/w11a/test_w11a_inst_quick.tcl b/tools/tbench/w11a/test_w11a_inst_quick.tcl
index 44510bc2..09c34d5c 100644
--- a/tools/tbench/w11a/test_w11a_inst_quick.tcl
+++ b/tools/tbench/w11a/test_w11a_inst_quick.tcl
@@ -1,9 +1,10 @@
-# $Id: test_w11a_inst_quick.tcl 1254 2022-07-13 06:16:19Z mueller $
+# $Id: test_w11a_inst_quick.tcl 1325 2022-12-07 11:52:36Z mueller $
 # SPDX-License-Identifier: GPL-3.0-or-later
 # Copyright 2022- by Walter F.J. Mueller <W.F.J.Mueller@gsi.de>
 #
 # Revision History:
 # Date         Rev Version  Comment
+# 2022-12-04  1324   1.0.1  use creset option to clear pending traps
 # 2022-07-12  1254   1.0    Initial version
 #
 # Quick instruction test.
@@ -185,7 +186,8 @@ rw11::asmrun  $cpu sym  r0 0 \
                         r5 $sym(chkcc) \
                         sp $sym(stack) \
                         pc $sym(start) \
-                        ps 020
+                        ps 020 \
+                        creset 1
 rw11::asmwait $cpu sym 
 rw11::asmtreg $cpu  r1 0004711 \
                     r2 0123456 \
@@ -328,7 +330,8 @@ rw11::asmrun  $cpu sym  r0 0 \
                         r5 $sym(chkcc) \
                         sp $sym(stack) \
                         pc $sym(start) \
-                        ps 020
+                        ps 020 \
+                        creset 1
 rw11::asmwait $cpu sym 
 rw11::asmtreg $cpu  r1 0000123 \
                     r2 0000321 \
diff --git a/tools/tcl/rw11/asm.tcl b/tools/tcl/rw11/asm.tcl
index e5603e43..15528ff3 100644
--- a/tools/tcl/rw11/asm.tcl
+++ b/tools/tcl/rw11/asm.tcl
@@ -1,9 +1,10 @@
-# $Id: asm.tcl 1177 2019-06-30 12:34:07Z mueller $
+# $Id: asm.tcl 1325 2022-12-07 11:52:36Z mueller $
 # SPDX-License-Identifier: GPL-3.0-or-later
 # Copyright 2013-2019 by Walter F.J. Mueller <W.F.J.Mueller@gsi.de>
 #
 #  Revision History:
 # Date         Rev Version  Comment
+# 2022-12-04  1324   1.0.1  asmrun: add creset option (active with ps option)
 # 2019-04-06  1126   1.0.6  asmwait: allow alternate stop symbol
 # 2017-02-04   784   1.0.5  asmrun: allow 'ps' in initializer list
 # 2015-07-25   704   1.0.4  asmrun,asmtreg,asmtmem: use args in proc definition
@@ -27,7 +28,7 @@ namespace eval rw11 {
   # 
   proc asmrun {cpu symName args} {
     upvar 1 $symName sym
-    array set opts {r0 0 r1 0 r2 0 r3 0 r4 0 r5 0}
+    array set opts {r0 0 r1 0 r2 0 r3 0 r4 0 r5 0 creset 0}
     array set opts $args
 
     if {![info exists opts(pc)]} {
@@ -53,6 +54,10 @@ namespace eval rw11 {
       lappend clist "-w${key}" $opts($key)
     }
     if {[info exists opts(ps)]} {
+      if {$opts(creset)} {
+        rlc log "CRESET"
+        lappend clist "-creset"
+      }
       lappend clist "-wpc" $opts(pc)
       lappend clist "-wps" $opts(ps)
       lappend clist "-start"
diff --git a/tools/tcode/cpu_basics.mac b/tools/tcode/cpu_basics.mac
index e56c617a..5b1b7af3 100644
--- a/tools/tcode/cpu_basics.mac
+++ b/tools/tcode/cpu_basics.mac
@@ -1,10 +1,10 @@
-; $Id: cpu_basics.mac 1316 2022-11-18 15:26:40Z mueller $
+; $Id: cpu_basics.mac 1325 2022-12-07 11:52:36Z mueller $
 ; SPDX-License-Identifier: GPL-3.0-or-later
 ; Copyright 2015-2022 by Walter F.J. Mueller <W.F.J.Mueller@gsi.de>
 ;
 ; Revision History:
 ; Date         Rev Version  Comment
-; 2022-07-25  1263   1.0    Initial version
+; 2022-12-06  1324   1.0    Initial version
 ; 2015-08-30   710   0.1    First draft
 ;
 ; Test CPU basics: most instructions except traps, EIS and FPP
@@ -3040,6 +3040,28 @@ tf0202: mov     #cp.psw,r0
 ;
 9999$:  iot                     ; end of test F2.2
 ;
+; Test F2.3 -- reset settling time +++++++++++++++++++++++++++++++++++
+;   This test checks whether interrupt requests are canceled when the
+;   reset instruction completes. Done with PIRQ, checks that not
+;   interrupt taken after reset.
+;
+tf0203: cmpb    systyp,#sy.sih          ; skip on SimH (no SPL 11/70 semantics)
+        beq     9999$
+        mov     #100$,v..pir            ; set up PIRQ handler
+        mov     #cp.pr7,v..pir+2
+        spl     7
+        movb    #bit01,cp.pir+1         ; request PIRQ 1
+        spl     0                       ; SPL enforces execution of next inst
+        reset                           ; cancel PIRQ
+        br      200$                    ; no interrupt should happen
+;
+100$:   halt
+;
+200$:   mov     #v..pir+2,v..pir
+        clr     v..pir+2
+
+9999$:  iot                     ; end of test F2.3
+;
 ; Test F3: trap instructions: bpt,iot,emt,trap +++++++++++++++++++++++++++++++
 ;   This sub-section verifies
 ;     x xxx xxx xxx xxx xxx NZVC Instruction / Remark
@@ -3138,7 +3160,7 @@ tf0301: mov     #v..iot+2,v..iot ; block iot handler
 ; END OF ALL TESTS - loop closure ============================================
 ;
         mov     tstno,r0        ; hack, for easy monitoring ...
-        hcmpeq  tstno,#53.      ; all tests done ?
+        hcmpeq  tstno,#54.      ; all tests done ?
 ;
         jmp     loop
 ;
diff --git a/tools/tcode/cpu_details.mac b/tools/tcode/cpu_details.mac
index fc1d4384..dbaf2b94 100644
--- a/tools/tcode/cpu_details.mac
+++ b/tools/tcode/cpu_details.mac
@@ -1,10 +1,10 @@
-; $Id: cpu_details.mac 1323 2022-12-01 08:00:41Z mueller $
+; $Id: cpu_details.mac 1325 2022-12-07 11:52:36Z mueller $
 ; SPDX-License-Identifier: GPL-3.0-or-later
 ; Copyright 2022- by Walter F.J. Mueller <W.F.J.Mueller@gsi.de>
 ;
 ; Revision History:
 ; Date         Rev Version  Comment
-; 2022-11-29  1323   1.0    Initial version
+; 2022-12-06  1324   1.0    Initial version
 ; 2022-07-18  1259   0.1    First draft
 ;
 ; Test CPU details
@@ -391,9 +391,9 @@ ta0210: cmpb    systyp,#sy.sih  ; SimH uses J11 semantics
 ; end of A2.* tests, restore iit handler
         mov     v..iit+2,v..iit ; restore iit handler
 ;
-; Test A3:  STKLIM +++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
-;   This sub-section verifies operation of STKLIM register
-;   and the yellow stack trap and red stack abort functionality.
+; Test A3:  STKLIM + stack traps and aborts ++++++++++++++++++++++++++++++++++
+;   This sub-section verifies operation of STKLIM register,
+;   the yellow stack trap, and the red stack abort functionality.
 ;
 ; Test A3.1 -- STKLIM write/read test ++++++++++++++++++++++++++++++++
 ;   STKLIM is a 16 bit register, upper byte is retained, lower reads always 0
@@ -773,6 +773,478 @@ ta0304:
 ;
 9999$:  iot                                     ; end of test A3.4
 ;
+; Test A4:  PSW + tbit traps +++++++++++++++++++++++++++++++++++++++++++++++++
+;   This sub-section verifies operation of PSW register and tbit traps.
+;
+; helper macro for JMP via RTI with new PS,PC
+        .macro  rtijmp,newps,newpc
+        push2   newps,newpc
+        rti
+        halt
+        .endm
+;
+; helper macro for JMP via RTT with new PS,PC
+        .macro  rttjmp,newps,newpc
+        push2   newps,newpc
+        rtt
+        halt
+        .endm
+;
+; helper macro for trace area check setup
+        .macro  htinit,buf,nent
+        hcmpeq  #buf+<4*nent>,r5
+        mov     #buf,r5
+        .endm
+;
+; helper macro for trace area check entry
+        .macro  htitem,tvec,tadr
+        hcmpeq  tvec,(r5)+
+        hcmpeq  tadr,(r5)+
+        .endm
+;
+; Test A4.1 -- PSW direct write/read test ++++++++++++++++++++++++++++
+;
+ta0401:
+;
+; part 1: all bits except register set (cp.ars) ----------------------
+;
+        mov     #cp.psw,r0              ; ptr to PSW
+        mov     #200$,r1                ; ptr to data
+        mov     #cpnzvc,r2              ; NZVC mask
+100$:   mov     (r1)+,r3                ; next value
+        beq     2000$                   ; if 0 end of test
+        mov     r3,(r0)                 ; write PSW
+        mov     (r0),r3                 ; read  PSW
+        bic     r2,r3                   ; clear NZVC
+        cmp     (r1)+,r3                ; check value
+        beq     100$
+        clr     (r0)                    ; if error force kernel
+        halt                            ; and halt
+;
+200$:   .word   cp.t,0                  ; tbit (not direct writable)
+        .word   cp.pr7,cp.pr7           ; prio bits
+        .word   bit10!bit09!bit08,0     ; bit 10:8 unused
+        .word   bit12,bit12             ; pm(0)
+        .word   bit13,bit13             ; pm(1)
+        .word   bit14,bit14             ; cm(0)
+        .word   bit15,bit15             ; cm(1)
+        .word   0
+;
+; part 2: PSW(11) - register set -------------------------------------
+;
+2000$:  mov     #1000,r0                ; write to set 0
+        mov     #1001,r1
+        mov     #1002,r2
+        mov     #1003,r3
+        mov     #1004,r4
+        mov     #1005,r5
+        mov     #cp.ars,cp.psw          ; select set 1
+        hbitne  #cp.ars,cp.psw          ; check PSW write
+        mov     #1010,r0                ; write to set 1
+        mov     #1011,r1
+        mov     #1012,r2
+        mov     #1013,r3
+        mov     #1014,r4
+        mov     #1015,r5
+        clr     cp.psw                  ; select set 0
+        hbiteq  #cp.ars,cp.psw          ; check PSW write
+        hcmpeq  #1000,r0                ; check set 0
+        hcmpeq  #1001,r1
+        hcmpeq  #1002,r2
+        hcmpeq  #1003,r3
+        hcmpeq  #1004,r4
+        hcmpeq  #1005,r5
+        mov     #cp.ars,cp.psw          ; select set 1
+        hcmpeq  #1010,r0                ; check set 0
+        hcmpeq  #1011,r1
+        hcmpeq  #1012,r2
+        hcmpeq  #1013,r3
+        hcmpeq  #1014,r4
+        hcmpeq  #1015,r5
+        clr     cp.psw                  ; select set 0
+;
+; part 3: PSW(cm) and stack registers --------------------------------
+;
+        mov     #cp.psw,r0              ; ptr to PSW
+        clr     (r0)                    ; cm=k
+        mov     #0006,sp
+        mov     #cp.cms,(r0)            ; cm=s
+        mov     #0106,sp
+        mov     #cp.cmu,(r0)            ; cm=u
+        mov     #1106,sp
+        clr     (r0)                    ; cm=k
+        hcmpeq  #0006,sp                ; check
+        mov     #cp.cms,(r0)            ; cm=s
+        mov     sp,r1
+        mov     #cp.cmu,(r0)            ; cm=u
+        mov     sp,r2
+        clr     (r0)                    ; cm=k
+        hcmpeq  #0106,r1                ; check in kernel to allow halt
+        hcmpeq  #1106,r2                ; check in kernel to allow halt
+;
+        clr     (r0)
+        mov     #stack,sp
+;
+9999$:  iot                                     ; end of test A4.1
+;
+; Test A4.2 -- PSW write/read via RTI/RTT ++++++++++++++++++++++++++++
+;   Verifies cm and rset priviledge escalation protection
+;
+ta0402:
+;
+; part 1: from cm=0,rset=0: set cm=11 and rset=1 (fine!) -------------
+;
+        rtijmp  #cp.cmu!cp.ars,#1200$   ; new PS cm=u and rs=1
+;
+1100$:  .word   0                       ; saved PS
+;
+1200$:  mov     cp.psw,1100$            ; save PS (use memory, rset=1!)
+        clr     cp.psw                  ; back to kernel
+        mov     #stack,sp               ; restore stack
+        bic     #cpnzvc,1100$           ; discard NZVC
+        hcmpeq  #cp.cmu!cp.ars,1100$    ; check expected PS
+;
+; part 2: from cm=s,rset=1 mode: set cm=0 and rset=0 (fail!) ---------
+;
+        rtijmp  #cp.cms!cp.ars,#2200$   ; PS cm=s and rs=1
+;
+        .word   0,0                     ; temporary stack
+2100$:  .word   0                       ; 1st saved PS
+2110$:  .word   0                       ; 2nd saved PS
+;
+; now in supervisor mode, try sneak to cm=k and rs=0
+2200$:  mov     cp.psw,2100$            ; save PS
+        mov     #2100$,sp               ; set up stack
+        rtijmp  #0,#2300$               ; new PS cm=k and rs=0
+;
+; lands here after rti from cm=s -> still in cm=s
+2300$:  mov     cp.psw,2110$            ; save PS
+        clr     cp.psw                  ; back to kernel
+        mov     #stack,sp               ; restore stack
+        bic     #cpnzvc,2100$           ; discard NZVC
+        hcmpeq  #cp.cms!cp.ars,2100$    ; check expected 1st PS
+        bic     #cpnzvc,2110$           ; discard NZVC
+        hcmpeq  #cp.cms!cp.ars,2110$    ; check expected 2nd PS (same !)
+;
+; part 3: from cm=s,rset=0 mode: set cm=u and rset=1 (fine!) ---------
+;
+        rtijmp  #cp.cms,#3200$          ; PS cm=s and rs=0
+;
+        .word   0,0                     ; temporary stack
+3100$:  .word   0                       ; 1st saved PS
+3110$:  .word   0                       ; 2nd saved PS
+;
+; now in supervisor mode, continue to cm=u and rs=1
+3200$:  mov     cp.psw,3100$            ; save PS
+        mov     #3100$,sp               ; set up stack
+        rtijmp  #cp.cmu!cp.ars,#3300$   ; new PS cm=u and rs=1
+;
+; lands here after rti from cm=s -> now cm=u
+3300$:  mov     cp.psw,3110$            ; save PS
+        clr     cp.psw                  ; back to kernel
+        mov     #stack,sp               ; restore stack
+        bic     #cpnzvc,3100$           ; discard NZVC
+        hcmpeq  #cp.cms,3100$           ; check expected 1st PS
+        bic     #cpnzvc,2110$           ; discard NZVC
+        hcmpeq  #cp.cmu!cp.ars,3110$    ; check expected 2nd PS (now user)
+;
+; part 4: from cm=u,rset=1 mode: set cm=0 and rset=0 (fail!) ---------
+;
+        rtijmp   #cp.cmu!cp.ars,#4200$  ; PS cm=u and rs=1
+;
+        .word   0,0                     ; temporary stack
+4100$:  .word   0                       ; 1st saved PS
+4110$:  .word   0                       ; 2nd saved PS
+;
+; now in user mode, try sneak to cm=k and rs=0
+4200$:  mov     cp.psw,4100$            ; save PS
+        mov     #4100$,sp               ; set up stack
+        rtijmp  #0,#4300$               ; new PS cm=k and rs=0
+;
+; lands here after rti from cm=u -> still in cm=u
+4300$:  mov     cp.psw,4110$            ; save PS
+        clr     cp.psw                  ; back to kernel
+        mov     #stack,sp               ; restore stack
+        bic     #cpnzvc,4100$           ; discard NZVC
+        hcmpeq  #cp.cmu!cp.ars,4100$    ; check expected 1st PS
+        bic     #cpnzvc,4110$           ; discard NZVC
+        hcmpeq  #cp.cmu!cp.ars,4110$    ; check expected 2nd PS (same !)
+;
+9999$:  iot                                     ; end of test A4.2
+;
+; Test A4.3 -- RTI/RTT tbit basics +++++++++++++++++++++++++++++++++++
+;   Verifies that tbit trap comes immediately after RTI and delayed after RTT
+;
+ta0403:
+;
+; part 1: tbit after RTI ---------------------------------------------
+;
+        mov     #200$,v..bpt
+        rtijmp  #cp.t,#100$             ; PS: tbit; PC 100$
+100$:   nop                             ; should not execute
+        halt
+;
+; here in local BPT handler
+200$:   hcmpeq  #stack-4,sp             ; check single frame
+        hcmpeq  #100$,(sp)              ; check saved PC before nop
+        mov     #stack,sp               ; restore
+        mov     #v..bpt+2,v..bpt
+;
+; part 2: tbit after RTT ---------------------------------------------
+;
+2000$:  mov     #2200$,v..bpt
+        rttjmp  #cp.t,#2100$            ; PS: tbit; PC 2100$
+2100$:  nop                             ; should execute
+        halt
+;
+; here in local BPT handler
+2200$:  hcmpeq  #stack-4,sp             ; check single frame
+        hcmpeq  #2100$+2,(sp)           ; check saved PC after nop
+        mov     #stack,sp               ; restore
+        mov     #v..bpt+2,v..bpt
+;
+9999$:  iot                                     ; end of test A4.3
+;
+; Test A4.4 -- tbit trace tests ++++++++++++++++++++++++++++++++++++++
+;
+ta0404: mov     #vhtbpt,v..bpt          ; BPT handler
+        mov     #cp.pr7,v..bpt+2        ;  run at PR7 (lockout PIRQ)
+        mov     #vhtemt,v..emt          ; EMT handler
+        clr     v..emt+2                ;  run at PR0 (no PIRQ competion)
+        mov     #vhtpir,v..pir          ; PIRQ handler
+        mov     #cp.pr7,v..pir+2        ;  run at PR7 (lockout PIRQ)
+        mov     #vhttrp,v..trp          ; TRAP handler
+        clr     v..trp+2                ;  run at PR0 (no PIRQ competion)
+;
+; part 1: simple instruction sequence --------------------------------
+;   Checks that trace traps are taken instructions which allow prefetch
+;   and that the destination PC is saved for flow control instructions.
+;
+        mov     #1200$,r5
+        mov     #1300$,vhtend
+        rtijmp  #cp.t,#1100$            ; RTI used to see bpt before 1st inst
+;
+1100$:  inc     r0                      ; 1st inst, shouldnt prefetch
+1110$:  dec     r0                      ; 2nd inst, shouldnt prefetch
+1120$:  cmp     #1,#2                   ; 3rd inst
+1130$:  bne     1160$                   ; 4th inst
+        halt
+1140$:  return                          ; 6th inst
+        halt
+1150$:  jmp     1180$                   ; 8th inst
+        halt
+1160$:  call    1140$                   ; 5th inst
+1170$:  br      1150$                   ; 7th inst
+1180$:  trap    100                     ; 9th inst
+1190$:
+;
+1200$:  .word   0,0
+        .word   0,0
+        .word   0,0
+        .word   0,0
+        .word   0,0
+        .word   0,0
+        .word   0,0
+        .word   0,0
+        .word   0,0
+        .word   0,0
+        .word   -1,-1
+;
+1300$:  htinit  1200$,10.               ; expect 10 items
+        htitem  #014,#1100$             ; bpt before inc
+        htitem  #014,#1110$             ; bpt after  inc
+        htitem  #014,#1120$             ; bpt after  dec
+        htitem  #014,#1130$             ; bpt after  cmp
+        htitem  #014,#1160$             ; bpt after  bne (PC is bne target)
+        htitem  #014,#1140$             ; bpt after  jsr (PC is jsr target)
+        htitem  #014,#1170$             ; bpt after  rts (PC is rts target)
+        htitem  #014,#1150$             ; bpt after  br  (PC is br  target)
+        htitem  #014,#1180$             ; bpt after  jmp (PC is jmp target)
+        htitem  #036,#1190$             ; final trap
+;
+; part 2: tracing of trap instructions (EMT tested) ------------------
+;
+2000$:  mov     #2200$,r5
+        mov     #2300$,vhtend
+        rttjmp  #cp.t,#2100$            ; RTT used, no before BPT
+;
+2100$:  dec     r0
+2110$:  emt     100
+2120$:  nop
+2130$:  trap    100
+2140$:
+;
+2200$:  .word   0,0
+        .word   0,0
+        .word   0,0
+        .word   0,0
+        .word   0,0
+        .word   -1,-1
+;
+2300$:  htinit  2200$,5.                ; expect 5 items
+        htitem  #014,#2110$             ; bpt after dec
+        htitem  #032,#2120$             ; emt (with return address)
+        htitem  #014,#2120$             ; bpt after emt (taken after emt)
+        htitem  #014,#2130$             ; bpt after nop
+        htitem  #036,#2140$             ; final trap
+;
+; part 3: tbit vs interrupt precedence (via PIRQ) --------------------
+;   Checks that interrupt has precedence over tbit traps.
+;   Skipped on SimH which implements J11 precedence (tbit over interrupt).
+;
+3000$:  cmpb    systyp,#sy.sih          ; skip on SimH (different service order)
+        beq     4000$
+        cmpb    systyp,#sy.e11          ; skip on e11 (different service order
+        beq     4000$
+;
+3001$:  mov     #3200$,r5
+        mov     #3300$,vhtend
+        rttjmp  #cp.t,#3100$
+;
+3100$:  movb    #bit01,cp.pir+1         ; request PIRQ 1
+3110$:  trap    100
+3120$:
+;
+3200$:  .word   0,0
+        .word   0,0
+        .word   0,0
+        .word   0,0
+        .word   0,0
+        .word   -1,-1
+;
+3300$:  htinit  3200$,3.                ; expect 3 items
+        htitem  #240,#3110$             ; pirq (with return address)
+        htitem  #014,#3110$             ; bpt after movb
+        htitem  #036,#3120$             ; final trap
+;
+; part 4: traced WAIT and tbit ---------------------------------------
+;   Checks that traced WAIT does not produce tbit trap.
+;   Checks that SPL does not produce a tbit trap.
+;   Skipped on SimH which implements J11 semantics for SPL, WAIT, precedence.
+;
+4000$:  cmpb    systyp,#sy.sih          ; skip on SimH
+        beq     5000$
+        cmpb    systyp,#sy.e11          ; skip on e11 (for precedence)
+        beq     5000$
+;
+4001$:  mov     #4200$,r5
+        mov     #4300$,vhtend
+        rttjmp  #cp.t+cp.pr7,#4100$     ; enable tbit, block interrupts
+;
+4100$:  movb    #bit05,cp.pir+1         ; request PIRQ 5
+4110$:  spl     4                       ; allow interrupts, not traced !!
+        wait                            ; also not traced !!
+4120$:  trap    100
+4130$:
+;
+4200$:  .word   0,0
+        .word   0,0
+        .word   0,0
+        .word   0,0
+        .word   -1,-1
+;
+4300$:  htinit  4200$,4.                ; expect 4 items
+        htitem  #014,#4110$             ; bpt after movb
+        htitem  #240,#4120$             ; pirq (with return address)
+        htitem  #014,#4120$             ; bpt after wait
+        htitem  #036,#4130$             ; final trap
+;
+; part 5: WAIT and SPL in user mode ----------------------------------
+;   Checks that WAIT and SPL in user mode are traced (are nop)
+;
+5000$:  mov     #5200$,r5
+        mov     #5300$,vhtend
+        rttjmp  #cp.cmu+cp.t,#5100$     ; user mode, enable tbit
+;
+5100$:  wait
+5110$:  spl     7
+5120$:  trap    100
+5130$:
+;
+5200$:  .word   0,0
+        .word   0,0
+        .word   0,0
+        .word   -1,-1
+;
+5300$:  htinit  5200$,3.                ; expect 3 items
+        htitem  #014,#5110$             ; bpt after wait
+        htitem  #014,#5120$             ; bpt after spl
+        htitem  #036,#5130$             ; final trap
+;
+; part 6: tbit trap after continuation over s_idle -------------------
+;   Checks instructions that complete via s_idle are properly traced
+;   Four instructions branch at completion to s_idle
+;     WAIT      s_op_wait (after interrupt)
+;     RESET     s_op_reset
+;     MOV/CLR   s_opg_gen if is_dstw_pc
+;
+6000$:  mov     #137,@#0                ; write jmp @#6130$ to location 0,2
+        mov     #6130$,@#2
+;
+        mov     #6200$,r5
+        mov     #6300$,vhtend
+        rttjmp  #cp.t,#6100$            ; enable tbit
+;
+6100$:  reset
+6110$:  mov     #6120$,pc
+        halt
+6120$:  clr     pc                      ; continue via jmp @#6130$ at 0,2
+        halt
+6130$:  trap    100
+6140$:
+;
+6200$:  .word   0,0
+        .word   0,0
+        .word   0,0
+        .word   0,0
+        .word   0,0
+        .word   -1,-1
+;
+6300$:  htinit  6200$,5.                ; expect 5 items
+        htitem  #014,#6110$             ; bpt after reset
+        htitem  #014,#6120$             ; bpt after mov
+        htitem  #014,#0                 ; bpt after clr
+        htitem  #014,#6130$             ; bpt after jmp
+        htitem  #036,#6140$             ; final trap
+;
+        clr     @#0
+        clr     @#2
+;
+; part 7: no tbit trap after an abort --------------------------------
+;   Checks that an aborted instruction doesnt tbit trap.
+;   Uses a bus timeout as abort reason (access to 160000).
+;
+7000$:  mov     #7300$,v..iit           ; setup local vector 4 handler
+        mov     #7200$,r5
+        rttjmp  #cp.t,#7100$            ; enable tbit
+;
+7100$:  clr     cp.err                  ; clear CPUERR (will trace trap)
+7110$:  clr     @#160000                ; will fail
+        halt
+;
+7200$:  .word   0,0
+        .word   -1,-1
+;
+7300$:  mov     #stack,sp               ; discard frame
+        hcmpeq  #cp.ito,cp.err          ; check CPUERR
+        htinit  7200$,1.                ; expect 1 item
+        htitem  #014,#7110$             ; bpt after 1st clr
+;
+        mov     #v..iit+2,v..iit        ; restore
+
+; restore ------------------------------------------------------------
+;
+        mov     #v..bpt+2,v..bpt        ; restore v..bpt to catcher
+        clr     v..bpt+2
+        mov     #v..emt+2,v..emt        ; restore v..emt to catcher
+        clr     v..emt+2
+        mov     #v..pir+2,v..pir        ; restore v..pir to catcher
+        clr     v..pir+2
+        mov     #v..trp+2,v..trp        ; restore v..trp to catcher
+        clr     v..trp+2
+;
+9999$:  iot                                     ; end of test A4.4
+;
 ; Section B: Stress tests ====================================================
 ;
 ; Test B1:  address mode torture tests +++++++++++++++++++++++++++++++++++++++
@@ -983,7 +1455,7 @@ tc0103: mov     #vhugen,v..iit  ; set iit handler
 ; END OF ALL TESTS - loop closure ============================================
 ;
         mov     tstno,r0        ; hack, for easy monitoring ...
-        hcmpeq  tstno,#24.      ; all tests done ?
+        hcmpeq  tstno,#28.      ; all tests done ?
 ;
         jmp     loop
 ;
@@ -1001,5 +1473,50 @@ vhugen: add     #4,sp           ; discard vector frame
 100$:   .word   0
 vhustp: .word   vhuhlt
 vhuhlt: halt
+;
+; vhtbpt - handler for BPT tracing +++++++++++++++++++++++++++++++++++++++++++
+;   Writes signature to data area (ptr in r5).
+;   Signature is vector address + return PC  (PC to test proper context).
+;
+vhtbpt: htstge  (r5)            ; r5 at fence ?
+        mov     #014,(r5)+      ; track BPT vector
+        mov     (sp),(r5)+      ; track PC
+        rtt                     ; end with RTT (!)
+;
+; vhtemt - handler for EMT tracing +++++++++++++++++++++++++++++++++++++++++++
+;   Writes signature to data area (ptr in r5).
+;   Signature is vector address + return PC  (PC to test proper context).
+;
+vhtemt: htstge  (r5)            ; r5 at fence ?
+        mov     #032,(r5)+      ; track EMT vector
+        mov     (sp),(r5)+      ; track PC
+        rti
+;
+; vhtpir - handler for PIRQ interrupt tracing ++++++++++++++++++++++++++++++++
+;   Writes signature to data area (ptr in r5).
+;   Signature is vector address + return PC  (PC to test proper context).
+;   Clears all PIRQ requests to prevent interrupt loop.
+;
+vhtpir: htstge  (r5)            ; r5 at fence ?
+        clr     cp.pir          ; clear all PIRQ interrupts
+        mov     #240,(r5)+      ; track PIRQ vector
+        mov     (sp),(r5)+      ; track PC
+        rti
+;
+; vhttrp - handler for TRAP, ends tracing ++++++++++++++++++++++++++++++++++++
+;   Writes signature to data area (ptr in r5).
+;   Returns to address stored in vhtend
+;   vhtend must be set for each execution
+;
+vhttrp: htstge  (r5)            ; r5 at fence ?
+        mov     #036,(r5)+      ; track TRAP vector
+        mov     (sp),(r5)+      ; track PC
+        mov     vhtend,100$     ; remember vhtend
+        mov     #200$,vhtend    ; restore blocker
+        mov     #stack,sp       ; restore stack
+        jmp     @100$           ; return or block
+100$:   .word   200$            ; value of vhtend at entry
+200$:   halt                    ; blocker
+vhtend: .word   0               ; registered return address
 ;
         .end    start