diff --git a/doc/CHANGELOG.md b/doc/CHANGELOG.md
index 93e91ac9..a20853fd 100644
--- a/doc/CHANGELOG.md
+++ b/doc/CHANGELOG.md
@@ -28,6 +28,7 @@ The full set of tests is only run for tagged releases.
 
 ### Summary
 ### New features
+- tools/xxdp: add directory with xxdp setup and patch scripts
 ### Changes
 - tools changes
   - tools/asm-11/lib/push_pop.mac: add push2
diff --git a/tools/README.md b/tools/README.md
index 0c2cd8b6..838fbc53 100644
--- a/tools/README.md
+++ b/tools/README.md
@@ -21,3 +21,4 @@ This directory tree contains **many tools** and is organized in
 | [tests](tests)   | test programs |
 | [tcl](tcl)       | TCL sources for rlink backend |
 | [vivado](vivado) | scripts for Xilinx Vivado |
+| [xxdp](xxdp) | startup and patch scripts for xxdp test execution |
diff --git a/tools/tcode/cpu_basics.mac b/tools/tcode/cpu_basics.mac
index 5b1b7af3..a2b6ddba 100644
--- a/tools/tcode/cpu_basics.mac
+++ b/tools/tcode/cpu_basics.mac
@@ -19,6 +19,19 @@
         .include        |lib/defs_kwl.mac|
 ;
 ; Section A: ccops + flow control bxx, sob, jmp, jsr, rts, mark ==============
+;   A1    ccop + bbx
+;   A1.1    ccop + psw
+;   A1.2    ccop + bxx
+;   A2    sob
+;   A3    jmp
+;   A3.1    jmp + dsta
+;   A3.2    jmp + cc
+;   A4    jsr + rts
+;   A4.1    jsr + dsta
+;   A4.2    jsr + cc
+;   A4.3    jsr r0-r5
+;   A4.4    jsr sp and rts sp
+;   A5    mark
 ;
 ; Test A1:  ccop + bxx +++++++++++++++++++++++++++++++++++++++++++++++++++++++
 ;   This sub-section verifies
@@ -1028,6 +1041,20 @@ ta0501: mov     #123456,r5      ; token
 9999$:  iot                     ; end of test A5.1
 ;
 ; Section B: unary instructions (word) =======================================
+;   B1    inc
+;   B2    dec
+;   B3    com
+;   B4    neg
+;   B5    adc
+;   B6    sbc
+;   B7    tst
+;   B8    ror
+;   B9    rol
+;   B10   asr
+;   B11   asl
+;   B12   clr
+;   B13   sxt
+;   B14   swab
 ;
         jmp     tb0101
 ;
@@ -1634,6 +1661,13 @@ tb1401: clr     cp.psw
 9999$:  iot                     ; end of test B14.1
 ;
 ; Section C: binary instructions (word) ======================================
+;   C1    add
+;   C2    sub
+;   C3    bic
+;   C4    bis
+;   C5    cmp
+;   C6    bit
+;   C7    mov
 ;
         jmp     tc0101
 ;
@@ -2114,6 +2148,18 @@ tc0701: clr     cp.psw
 9999$:  iot                     ; end of test C7.1
 ;
 ; Section D: unary instructions (byte) =======================================
+;   D1    incb
+;   D2    decb
+;   D3    comb
+;   D4    negb
+;   D5    adcb
+;   D6    sbcb
+;   D7    tstb
+;   D8    rorb
+;   D9    rolb
+;   D10   asrb
+;   D11   aslb
+;   D12   clrb
 ;
         jmp     td0101
 ;
@@ -2651,6 +2697,11 @@ td1201: clr     cp.psw
 ;
 ;
 ; Section E: binary instructions (byte) ======================================
+;   E1    bicb
+;   E2    bisb
+;   E3    cmpb
+;   E4    bitb
+;   E5    movb
 ;
         jmp     te0101
 ;
@@ -2914,6 +2965,14 @@ te0501: clr     cp.psw
 9999$:  iot                     ; end of test E5.1
 ;
 ; Section F: miscellaneous (spl, reset) ======================================
+;   F1    spl
+;   F1.1    spl in kernel mode
+;   F1.2    spl in supervisor and user mode
+;   F2    reset
+;   F2.1    reset in kernel mode
+;   F2.2    reset in supervisor and user mode
+;   F2.3    reset settling time
+;   F3      trap instructions: bpt,iot,emt,trap
 ;
 ; Test F1:  spl ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
 ;   This sub-section verifies
diff --git a/tools/tcode/cpu_details.mac b/tools/tcode/cpu_details.mac
index dbaf2b94..e5a39556 100644
--- a/tools/tcode/cpu_details.mac
+++ b/tools/tcode/cpu_details.mac
@@ -44,6 +44,52 @@
        p6base = <6*20000>               ; page 6
 ;
 ; Section A: CPU registers ===================================================
+;   A1    PIRQ
+;   A1.1    PIRQ + spl
+;   A1.2    PIRQ  and immediate interrupt
+;   A2    CPUERR
+;   A2.1    CPUERR cp.hlt
+;   A2.2    CPUERR cp.odd
+;   A2.3    CPUERR cp.nxm
+;   A2.4    CPUERR cp.iot
+;   A2.5    CPUERR cp.ysv
+;   A2.6    CPUERR cp.rsv
+;   A2.7    CPUERR cp.odd + stack error
+;   A2.8    CPUERR cp.nxm + stack error
+;   A2.9    CPUERR cp.ito + stack error
+;   A2.10   CPUERR mmu abort + stack error
+;   A3    STKLIM + stack traps and aborts
+;   A3.1    STKLIM write/read test
+;   A3.2    yellow trap + red abort boundary
+;             part 1: sequence of yellow traps and a final red stack abort
+;             part 2: check that red zone does not have yellow islands
+;             part 3: check red zone PSW protection
+;   A3.3    stack trap conditions
+;             part 1: test instructions that should trap
+;             part 2: test instructions that should not trap
+;             part 3: test that interrupt (from PIRQ) vector push traps
+;   A3.4    red stack abort conditions
+;   A4    PSW + tbit traps
+;   A4.1    PSW direct write/read test
+;             part 1: all bits except register set (cp.ars)
+;             part 2: PSW(11) - register set
+;             part 3: PSW(cm) and stack registers
+;   A4.2    PSW write/read via RTI/RTT
+;             part 1: from cm=0,rset=0: set cm=11 and rset=1 (fine!)
+;             part 2: from cm=s,rset=1 mode: set cm=0 and rset=0 (fail!)
+;             part 3: from cm=s,rset=0 mode: set cm=u and rset=1 (fine!)
+;             part 4: from cm=u,rset=1 mode: set cm=0 and rset=0 (fail!)
+;   A4.3    RTI/RTT tbit basics
+;             part 1: tbit after RTI
+;             part 2: tbit after RTT
+;   A4.4    Test A4.4 -- tbit trace tests
+;             part 1: simple instruction sequence
+;             part 2: tracing of trap instructions (EMT tested)
+;             part 3: tbit vs interrupt precedence (via PIRQ)
+;             part 4: traced WAIT and tbit
+;             part 5: WAIT and SPL in user mode
+;             part 6: tbit trap after continuation over s_idle
+;             part 7: no tbit trap after an abort
 ;
 ; Test A1:  PIRQ +++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
 ;   This sub-section verifies operation of PIRQ register
@@ -1246,6 +1292,13 @@ ta0404: mov     #vhtbpt,v..bpt          ; BPT handler
 9999$:  iot                                     ; end of test A4.4
 ;
 ; Section B: Stress tests ====================================================
+;   B1    address mode torture tests
+;   B1.1    src-dst update hazards with (r0)+,(r0)
+;   B1.2    (pc)+ as destination
+;   B1.3    pc as destination in clr, mov, and add
+;   B2    pipeline torture tests
+;   B2.1      self-modifying code, use (pc), -(pc)
+;   B2.2      self-modifying code, use (pc) case 2
 ;
 ; Test B1:  address mode torture tests +++++++++++++++++++++++++++++++++++++++
 ;   This sub-section tests peculiar address node usage
@@ -1402,6 +1455,10 @@ tb0202: mov     #2,r5
 9999$:  iot                     ; end of test B2.2
 ;
 ; Section C: 11/70 specifics =================================================
+;   C1    Implementation differences
+;   C1.1    Register used as source and changed in dst flow
+;   C1.2    PC used as source
+;   C1.3    Registers accessible via 177700-1777717
 ;
 ; Test C1:  Implementation differences +++++++++++++++++++++++++++++++++++++++
 ;   This sub-section verifies that w11 shows 11/70 behavior in cases
diff --git a/tools/tcode/cpu_eis.mac b/tools/tcode/cpu_eis.mac
index 60f768c4..fc6d028b 100644
--- a/tools/tcode/cpu_eis.mac
+++ b/tools/tcode/cpu_eis.mac
@@ -15,6 +15,10 @@
 ;   This section verifies
 ;     x xxx xxx xxx xxx xxx NZVC Instruction / Remark
 ;     0 111 001 rrr sss sss NZVC DIV
+;
+;   A1.1    div test basics
+;   A1.2    div test systematic
+;   A1.3    div odd register
 ;
 
         jmp     ta0101
@@ -328,6 +332,9 @@ ta0103: mov     #1000$,r4       ; setup data pointer
 ;     x xxx xxx xxx xxx xxx NZVC Instruction / Remark
 ;     0 111 000 rrr sss sss NZ0C MUL
 ;
+;    B1.1    mul even and odd
+;    B1.2    mul+div (and adc,adc,sxt)
+;
 ; Test B1.1 -- mul even and odd ++++++++++++++++++++++++++++++++++++++
 ;   check that mul works with even and odd destination register
 ;
@@ -510,6 +517,9 @@ tc0101: mov     #1000$,r4       ; setup data pointer
 ;     x xxx xxx xxx xxx xxx NZVC Instruction / Remark
 ;     0 111 011 rrr sss sss NZVC ASHC
 ;
+;    D1.1    ashc even register
+;    D1.2    ashc odd register
+;
 ; Test D1.1 -- ashc even register  +++++++++++++++++++++++++++++++++++
 ;
 td0101: mov     #1000$,r4       ; setup data pointer
@@ -658,6 +668,9 @@ td0102: mov     #1000$,r4       ; setup data pointer
 ;     x xxx xxx xxx xxx xxx NZVC Instruction / Remark
 ;     0 111 100 rrr ddd ddd NZ0- XOR
 ;
+;    E1.1    xor znvc=0
+;    E1.2    xor znvc=1
+;
 ; Test E1.1 -- xor znvc=0 ++++++++++++++++++++++++++++++++++++++++++++
 ;   check xor with all ccs cleared; memory destination
 ;
diff --git a/tools/tcode/cpu_mmu.mac b/tools/tcode/cpu_mmu.mac
index 468995a4..5266b26d 100644
--- a/tools/tcode/cpu_mmu.mac
+++ b/tools/tcode/cpu_mmu.mac
@@ -68,6 +68,8 @@
        p7base = <7*20000>               ; page 7
 ;
 ; Section A: pdr,par registers ===============================================
+;   A1.1    test that pdr/par are 16 bit write/readable
+;   A1.2    set up MMU default configuration
 ;
 ; Test A1:  ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
 ;
@@ -198,6 +200,19 @@ ta0102:
 ; Section B: mmr0,mmr3 registers, mapping, instructions ======================
 ;   Test whether address mapping works (traps and aborts avoided)
 ;
+;    B1    mmr0, mmr3 write/read and clear by RESET
+;    B1.1    test mmr0 write/read
+;    B1.2    test mmr3 write/read
+;    B2    kernel mode mapping
+;    B2.1    test 1-to-1 kernel mode mapping
+;    B2.2    test variable kernel mode mapping
+;    B3    user and supervisor mode
+;    B3.1    run code in user/supervisor mode
+;    B3.2    run code in user mode with D space enabled
+;    B4    invalid cpu mode 10
+;    B4.1    check that cmode=10 causes abort
+;    B4.2    check MFPI/MTPI SP response for pmode=10
+;
 ; Test B1:  ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
 ;   Test mmr0, mmr3 write/read and clear by RESET
 ;
@@ -683,6 +698,21 @@ tb0402: tstb    systyp          ; skip if not on w11
 9999$:  iot
 ;
 ; Section C: mmr1+mmr0 register, aborts ======================================
+;   C1    MMU response in mmr1 after a write to that fakes an abort
+;   C2    MMU abort response in mmr0 and mmr1
+;   C2.1    test unary/binary instructions
+;             part 1: unary instructions; test acf to mmr0(15:13) mapping
+;             part 2: unary instructions; fail in second access
+;             part 3: binary instructions; fail in src field
+;             part 4: binary instructions; fail in dst field
+;             part 5: multiple abort flags
+;   C2.2    test MFPI,MFPD,MTPI,MFPD dst aborts
+;             part 1: MFPI, MFPD
+;             part 2: MTPD, MTPI
+;   C2.3    test aborts in implied push/pop
+;             part 1: JSR, MFPI, MFPD (push)
+;             part 2: RTS, MTPI, MTPD (pop)
+;   C2.4    mmu abort vs nxm abort
 ;
 ; Test C1:  ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
 ;   Verify MMU response in mmr1 after a write to that fakes an abort
@@ -1164,7 +1194,7 @@ tc0202: mov     #vhmmua,v..mmu
         clr     v..mmu+2
 9999$:  iot                     ; end of test C2.2
 ;
-; Test C2.3 -- test aborts in implied push/pop; ++++++++++++++++++++++
+; Test C2.3 -- test aborts in implied push/pop +++++++++++++++++++++++
 ;   jsr,mfp* have an implied push; rts,mft* have an implied pop
 ;   This must be tested in supervisor mode to separate 'stack under test'
 ;   from the kernel stack used in MMU 250 vector handling
@@ -1439,6 +1469,13 @@ td0101:
 9999$:  iot                     ; end of test D1.1
 ;
 ; Section E: traps and pdr aia and aiw bits ==================================
+;   E1    basic MMU trap and PDR aia/aiw logic
+;   E1.1    test m0.trp, pdr aia/aiw transitions
+;   E1.2    systematic abort/trap testing for all valid afc
+;   E1.3    test trap request logic (trap on non-last access)
+;   E1.4    test trap request after prefetched instructions
+;   E2    MMU trap priority behavior
+;   E2.1    mmu trap + interrupt priority
 ;
 ; Test E1:  ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
 ;   Check basic MMU trap and PDR aia/aiw logic
@@ -1850,6 +1887,8 @@ te0201: mov     #m0.ent!m0.ena,mmr0     ; enable mmu with traps  ;! MMU 18
         clr     v..pir+2
 ;
 ; Section F: miscellaneous ===================================================
+;   F1.1  test D-to-I mapping for (PC) address modes I
+;   F1.2  test D-to-I mapping for (PC) address modes II
 ;
 ; Test F1:  ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
 ;
diff --git a/tools/tcode/cpu_selftest.mac b/tools/tcode/cpu_selftest.mac
index 644767a3..5ed727c9 100644
--- a/tools/tcode/cpu_selftest.mac
+++ b/tools/tcode/cpu_selftest.mac
@@ -12,6 +12,8 @@
         .include        |lib/tcode_std_base.mac|
 ;
 ; Section A: Self-Test codes
+;   A1    11/34 self test
+;   A2    11/70 self test
 ;
 ; Test A1 -- 11/34 self test ++++++++++++++++++++++++++++++++++++++++++
 ;  adopted from tb_pdp11core_stim.dat code 34
diff --git a/tools/xxdp/.gitignore b/tools/xxdp/.gitignore
new file mode 100644
index 00000000..be4c8378
--- /dev/null
+++ b/tools/xxdp/.gitignore
@@ -0,0 +1,8 @@
+to_lda
+*.log
+
+# simulation stuff
+rlink_cext_conf
+rlink_cext_fifo_rx
+rlink_cext_fifo_tx
+sysmon_stim
diff --git a/tools/xxdp/README.md b/tools/xxdp/README.md
new file mode 100644
index 00000000..4a466d6c
--- /dev/null
+++ b/tools/xxdp/README.md
@@ -0,0 +1,71 @@
+This directory tree contains startup scripts and patch files for the
+execution of `xxdp` test programs in w11, SimH and e11.
+
+## Summary of available tests
+
+| Test | Purpose |
+| ---- | ------- |
+| [ekbad0](ekbad0_README.md) | 11/70 cpu diagnostic part 1 |
+| [ekbbf0](ekbbf0_README.md) | 11/70 cpu diagnostic part 2 |
+| [ekbee1](ekbee1_README.md) | 11/70 memory management |
+| [eqkce1](eqkce1_README.md) | 11/70 CPU exerciser |
+
+The directory provides for each test platform-specific startup scripts
+- `_test_run.tcl`: w11 startup script
+- `_test_run.scmd`: SimH startup script (optional)
+- `_test_run.ecmd`: e11 startup script (optional)
+
+Typical usage is (replace xxxxxx with the test name):
+```
+ti_w11 -c7 @xxxxxx_run.tcl                      # w11 on GHDL, using cmoda7
+ti_w11 -tuD,12M,break,xon @xxxxxx_run.tcl       # w11 on FPGA, arty as example
+pdp11 xxxxxx_run.scmd                           # SimH simulator
+e11 /initfile:xxxxxx_run.ecmd                   # e11  simulator
+```
+The tests run in an endless loop. To end them after some iterations use
+```
+.qq             # for w11
+^E q            # for SimH (^E is the default break character)
+^E q            # for e11  (^E is defined as break character)
+```
+
+## Logic of startup scripts and preparation of test binaries
+Some `xxdp` test programs require patches for successful execution on
+w11 or the SimH and e11 simulators, see next section for details.
+The general workflow used by the startup scripts is therefore
+- load a test program into memory
+- apply patches to modify the memory image of the test
+- execute the program
+
+To support that workflow the relevant `xxdp` programs are exported from the
+xxdp22 or xxdp25 oskit in _absolute binary loader_ format in a SimH session
+with commands like
+```
+R UPD2
+^E
+att ptp ekbee1.lda
+c
+PIP PP0:=DL1:EKBEE1.BIC
+```
+
+The startup scripts expect these `.lda` files in the `to_lda` directory.
+These files are for copyright reasons not part of the w11 project.
+
+## Concept of _approved patches_ (APs)
+The w11 is an as precise as feasible replica of an 11/70 KB11-C processor, but
+has several differences to the real 11/70, see
+[w11 differences](../../doc/w11a_known_differences.md).
+The SimH and the e11 simulators also have a significant number of differences
+to the real 11/70,
+see [SimH differences](../../doc/simh_diff_summary.md)
+and [e11 differences](../../doc/e11_diff_summary.md).
+The `xxdp` test programs use in some cases _maintenance mode_ features that
+are not available in w11 or the simulators, and in some cases are sensitive
+to very implementation-specific behavior.
+Last but not least, w11 and the simulators lack some features of a real 11/70
+that are not essential for normal operation.
+For these reasons, some `xxdp` test programs need some patches to execute on
+w11 or the simulators. Each patch file is a commented sequence of `dep`
+statements. Each patch section has a comment header that explains why the
+modifications are required, what they do, and why this is a well-understood
+and acceptable solution.
diff --git a/tools/xxdp/ekbad0_README.md b/tools/xxdp/ekbad0_README.md
new file mode 100644
index 00000000..958d8e40
--- /dev/null
+++ b/tools/xxdp/ekbad0_README.md
@@ -0,0 +1,26 @@
+# EKBAD0 - 11/70 cpu diagnostic part 1
+
+### Documentation
+- [DiagnosticsHandbook](http://www.bitsavers.org/pdf/dec/pdp11/xxdp/PDP11_DiagnosticHandbook_1988.pdf) p18
+- [EKBEE0 source listing](http://www.bitsavers.org/pdf/dec/pdp11/microfiche/Diagnostic_Program_Listings/Listings/CEKBAD0__PDP-11-70__11-70_CPU_1__AH-7963D-MC__SEP_1980_bw.pdf)
+
+### Usage
+```
+ti_w11 -c7 @ekbad0_run.tcl                      # w11 on GHDL, using cmoda7
+ti_w11 -tuD,12M,break,xon @ekbad0_run.tcl       # w11 on FPGA, arty as example
+pdp11 ekbad0_run.scmd                           # SimH simulator
+e11 /initfile:ekbad0_run.ecmd                   # e11  simulator
+```
+
+### Expected output (code halts in case of an error)
+```
+AA
+CEKBAD0 11/70 CPU #1
+
+END PASS
+END PASS
+...
+```
+
+### Remarks
+Runs without patches on w11, SimH and e11.
diff --git a/tools/xxdp/ekbad0_run.ecmd b/tools/xxdp/ekbad0_run.ecmd
new file mode 100644
index 00000000..42071d39
--- /dev/null
+++ b/tools/xxdp/ekbad0_run.ecmd
@@ -0,0 +1,13 @@
+; $Id: ekbad0_run.ecmd 1318 2022-11-21 09:27:32Z mueller $
+; SPDX-License-Identifier: GPL-3.0-or-later
+; Copyright 2022- by Walter F.J. Mueller <W.F.J.Mueller@gsi.de>
+;
+; e11 starter for ekbad0 - PDP 11/70 cpu diagnostic part 1
+;
+@setup_w11a_basic.ecmd
+;
+mount pr: to_lda/ekbad0.lda
+boot/halt pr:
+;
+pc=200
+go
diff --git a/tools/xxdp/ekbad0_run.scmd b/tools/xxdp/ekbad0_run.scmd
new file mode 100644
index 00000000..78fa5b0d
--- /dev/null
+++ b/tools/xxdp/ekbad0_run.scmd
@@ -0,0 +1,21 @@
+; $Id: ekbad0_run.scmd 1318 2022-11-21 09:27:32Z mueller $
+; SPDX-License-Identifier: GPL-3.0-or-later
+; Copyright 2022- by Walter F.J. Mueller <W.F.J.Mueller@gsi.de>
+;
+do setup_w11a_basic.scmd
+;
+echo PDP 11/70 cpu diagnostic part 1; 
+echo ..from ekbad0 (from xxdp22)
+;
+echo output to be expected: 
+echo ..AA
+echo ..CEKBAD0 11/70 CPU #1
+echo ..
+echo ..END PASS    (repeating)
+echo ---------------------------------------------
+echo
+;
+dep pc 200
+load to_lda/ekbad0.lda
+;
+cont
diff --git a/tools/xxdp/ekbad0_run.tcl b/tools/xxdp/ekbad0_run.tcl
new file mode 100644
index 00000000..0ce20a4f
--- /dev/null
+++ b/tools/xxdp/ekbad0_run.tcl
@@ -0,0 +1,19 @@
+# $Id: ekbad0_run.tcl 1319 2022-11-21 14:20:45Z mueller $
+# SPDX-License-Identifier: GPL-3.0-or-later
+# Copyright 2022- by Walter F.J. Mueller <W.F.J.Mueller@gsi.de>
+#
+puts "PDP 11/70 cpu diagnostic part 1"
+puts "..from ekbad0 (from xxdp22)"
+#
+cpu0 ldabs to_lda/ekbad0.lda
+#
+# set console to 7bit mode
+cpu0tta0 set to7bit 1
+#
+# ensure console interrupt not immediate
+cpu0tta  set txrlim 5
+#
+# check for debug hook
+rutil::dohook "ekbad0_hook"
+#
+.csta 0200
diff --git a/tools/xxdp/ekbbf0_README.md b/tools/xxdp/ekbbf0_README.md
new file mode 100644
index 00000000..cf94cd52
--- /dev/null
+++ b/tools/xxdp/ekbbf0_README.md
@@ -0,0 +1,36 @@
+# EKBBF0 - 11/70 cpu diagnostic part 2
+
+### Documentation
+- [DiagnosticsHandbook](http://www.bitsavers.org/pdf/dec/pdp11/xxdp/PDP11_DiagnosticHandbook_1988.pdf) p19
+- [EKBBF0 source listing](http://www.bitsavers.org/pdf/dec/pdp11/microfiche/Diagnostic_Program_Listings/Listings/CEKBBF0__PDP11-70__11-70_CPU_2__AH-7968F-MC__SEP_1980_bw.pdf)
+
+### Usage
+```
+ti_w11 -c7 @ekbbf0_run.tcl                      # w11 on GHDL, using cmoda7
+ti_w11 -tuD,12M,break,xon @ekbbf0_run.tcl       # w11 on FPGA, arty as example
+pdp11 ekbbf0_run.scmd                           # SimH simulator
+e11 /initfile:ekbbf0_run.ecmd                   # e11  simulator
+```
+
+### Expected output when no errors are reported
+```
+CEKBBF0 11/70 CPU #2
+BR 4 TESTS DISABLED
+BR 5 TESTS DISABLED
+BR 6 TESTS DISABLED
+
+CPU UNDER TEST FOUND TO BE A KB11-B/C OR KB11-CM                
+OPR TEST DISABLED
+
+END PASS #     1  TOTAL ERRORS SINCE LAST REPORT      0
+END PASS #     2  TOTAL ERRORS SINCE LAST REPORT      0
+```
+
+### w11 remarks
+Requires [patch](ekbbf0_patch_w11a.tcl).
+
+### SimH remarks (tested with V3.12-3 RC2)
+Requires [patch](ekbbf0_patch_1170.scmd).
+
+### e11 remarks
+_to come_
diff --git a/tools/xxdp/ekbbf0_patch_1170.scmd b/tools/xxdp/ekbbf0_patch_1170.scmd
new file mode 100644
index 00000000..63e3c939
--- /dev/null
+++ b/tools/xxdp/ekbbf0_patch_1170.scmd
@@ -0,0 +1,72 @@
+; $Id: ekbbf0_patch_1170.scmd 1319 2022-11-21 14:20:45Z mueller $
+; SPDX-License-Identifier: GPL-3.0-or-later
+; Copyright 2022- by Walter F.J. Mueller <W.F.J.Mueller@gsi.de>
+;
+; Patch set ekbbf0 for SimH -- SimH -- SimH -- Simh -- Simh -- Simh
+;
+; AP: patch test 014: DIV ----------------------------------------------------
+;   fails in section 7: 100000 000000 / 2
+;   expects NZVC = 1110  Z=1
+;   SimH sets Z=0 for overflows -> patch comparison
+;
+dep 012074 000012
+;
+;   fails in section  8: 177776 177777 / -1
+;   test specific result register values
+;   SimH does not reproduce 11/70 registers after overflow
+;   skip over this section
+;
+dep 012112 000137
+dep 012114 012204
+;
+;   fails in section 12: 000100 000200 / -177
+;   expects NZVC = 0010  N=0
+;   SimH sets N based on real result sign -> patch comparison
+;
+dep 012532 000012
+;
+; AP: skip test 032: UNIBUS timeout ------------------------------------------
+;   test after 15644 trap priority and uses at 015730 that instruction after
+;   SPL always executed. This SPL semantics not implemented in SimH
+;   Test therefore skipped.
+;
+dep 015510 000137
+dep 015512 016620
+;
+; AP: skip test 036: yellow zone trap ----------------------------------------
+;   It checks yellow zone traps. It uses 'mov r0,(sp)' and 'clr (sp)' to
+;   trigger traps. SimH implements only the J11 behavior, essentially -(sp).
+;   Test therefore skipped.
+;
+dep 017376 000137
+dep 017400 017766
+;
+; AP: skip test 040: red zone trap -------------------------------------------
+;   It check red zone aborts. It uses 'mov r0,(sp)' and 'clr (sp)' to
+;   trigger aborts. SimH implements only the J11 behavior, essentially -(sp).
+;   Same theme as for test 036, therefore test skipped.
+;   Note: the statements of test 040 disable tbit in case it's on, like in odd
+;         passes starting with pass 3 . The next test 041 fails if tbit is on.
+;         Therefore the skip to test 041 is done after the tbit disable code.
+;
+dep 020450 000137
+dep 020452 021136
+;
+; AP: skip test 042: SL comparator test 1 ------------------------------------
+;   Systematically checks STKLIM vs SP and generated traps and aborts.
+;   This test is only executed when switch 03 is set (badly documented!)
+;   If enabled, the test fails for all combinations because the instuction
+;   under test is 'mov (sp),(sp)'. SimH implements only the J11 behavior for
+;   stack limit tests, see test 036. The test can be executed when the
+;   instruction is replaced by 'mov (sp)+,-(sp)'.
+;
+dep 021534  012646
+;
+; AP: skip test 063: WAIT ----------------------------------------------------
+;   It checks that no tbit trap is done after a WAIT.
+;   Only LSI11, 11/45 and 11/70 behave like this, all other modes trap.
+;   SimH implements the general behavior for all models.
+;   Test therefore skipped.
+;
+dep 031540 000137
+dep 031542 032024
diff --git a/tools/xxdp/ekbbf0_patch_w11a.tcl b/tools/xxdp/ekbbf0_patch_w11a.tcl
new file mode 100644
index 00000000..1520f978
--- /dev/null
+++ b/tools/xxdp/ekbbf0_patch_w11a.tcl
@@ -0,0 +1,28 @@
+# $Id: ekbbf0_patch_w11a.tcl 1320 2022-11-22 18:52:59Z mueller $
+# SPDX-License-Identifier: GPL-3.0-or-later
+# Copyright 2022- by Walter F.J. Mueller <W.F.J.Mueller@gsi.de>
+#
+# Patch set ekbbf0 for w11a -- w11a -- w11a -- w11a -- w11a -- w11a
+#
+# Note: Tcl has default radix 10 --> all octal numbers must start with !!
+#
+# AP: patch test 014: DIV ----------------------------------------------------
+#   fails in section 7: 100000 000000 / 2
+#   expects NZVC = 1110  Z=1
+#   w11 sets Z=0 for overflows -> patch comparison
+#
+dep 012074 000012
+#
+#   fails in section  8: 177776 177777 / -1
+#   test specific result register values
+#   w11 does not reproduce 11/70 registers after overflow
+#   skip over this section
+#
+dep 012112 000137
+dep 012114 012204
+#
+#   fails in section 12: 000100 000200 / -177
+#   expects NZVC = 0010  N=0
+#   w11 sets N based on real result sign -> patch comparison
+#
+dep 012532 000012
diff --git a/tools/xxdp/ekbbf0_run.scmd b/tools/xxdp/ekbbf0_run.scmd
new file mode 100644
index 00000000..28151050
--- /dev/null
+++ b/tools/xxdp/ekbbf0_run.scmd
@@ -0,0 +1,41 @@
+; $Id: ekbbf0_run.scmd 1318 2022-11-21 09:27:32Z mueller $
+; SPDX-License-Identifier: GPL-3.0-or-later
+; Copyright 2022- by Walter F.J. Mueller <W.F.J.Mueller@gsi.de>
+;
+do setup_w11a_basic.scmd
+;
+echo PDP 11/70 cpu diagnostic part 2
+echo ..from ekbbf0.lda
+;
+echo output to be expected: 
+echo ..CEKBBF0 11/70 CPU #2
+echo ..END PASS #     1  TOTAL ERRORS SINCE LAST REPORT     0
+;
+echo setup switches:
+;;;; 100000  15  halt on error
+;;;; 040000  14  loop on test
+;;;; 020000  13  inhibit error type outs
+;;;; 010000  12  inhibit T-bit trapping
+echo 004000  11  inhibit iterations
+;;;; 002000  10  ring bell on error
+;;;; 001000  09  loop on error
+;;;; 000400  08  loop on test in SW <07:00>
+;;;; 000200  07  not used
+echo 000100  06  skip bus request 6 test
+echo 000040  05  skip bus request 5 test
+echo 000020  04  skip bus request 4 test
+echo 000010  03  enables test 042
+;;;; 000004  02  test selector (with switch 8)
+;;;; 000002  01  test selector (with switch 8)
+echo 000001  00  skip operator intervention testing
+echo ------
+echo 004171
+echo ---------------------------------------------
+dep sr 4171
+;
+dep pc 200
+load to_lda/ekbbf0.lda
+;
+do ekbbf0_patch_1170.scmd
+;
+cont
diff --git a/tools/xxdp/ekbbf0_run.tcl b/tools/xxdp/ekbbf0_run.tcl
new file mode 100644
index 00000000..697afec9
--- /dev/null
+++ b/tools/xxdp/ekbbf0_run.tcl
@@ -0,0 +1,32 @@
+# $Id: ekbbf0_run.tcl 1319 2022-11-21 14:20:45Z mueller $
+# SPDX-License-Identifier: GPL-3.0-or-later
+# Copyright 2017-2022 by Walter F.J. Mueller <W.F.J.Mueller@gsi.de>
+#
+puts "PDP 11/70 cpu diagnostic part 2"
+puts "..from ekbbf0.ld"
+#
+cpu0 ldabs to_lda/ekbbf0.lda
+#
+# set console to 7bit mode
+cpu0tta0 set to7bit 1
+#
+# apply patches
+source patch_dep.tcl
+source ekbbf0_patch_w11a.tcl
+#
+# set switch register
+puts "setup switches"
+puts "004000  11  inhibit iterations"
+puts "000100  06  skip bus request 6 test"
+puts "000040  05  skip bus request 5 test"
+puts "000020  04  skip bus request 4 test"
+puts "000010  03  enables test 042"
+puts "000001  00  skip operator intervention testing"
+puts "------"
+puts "004171"
+.d sdreg/r 004171
+#
+# check for debug hook
+rutil::dohook "ekbbf0_hook"
+#
+.csta 0200
diff --git a/tools/xxdp/ekbee1_README.md b/tools/xxdp/ekbee1_README.md
new file mode 100644
index 00000000..056d3d6c
--- /dev/null
+++ b/tools/xxdp/ekbee1_README.md
@@ -0,0 +1,42 @@
+# EKBEE1 - 11/70 memory management
+
+### Documentation
+- [DiagnosticsHandbook](http://www.bitsavers.org/pdf/dec/pdp11/xxdp/PDP11_DiagnosticHandbook_1988.pdf) p22
+- [EKBEE0 source listing](http://www.bitsavers.org/pdf/dec/pdp11/microfiche/Diagnostic_Program_Listings/Listings/CEKBEE0__PDP-11-70__11-70_MEM_MGMT__AH-7976E-MC__SEP_1980_bw.pdf) (only EKBEE0 available, all code addresses identical)
+
+### Usage
+```
+ti_w11 -c7 @ekbee1_run.tcl                      # w11 on GHDL, using cmoda7
+ti_w11 -tuD,12M,break,xon @ekbee1_run.tcl       # w11 on FPGA, arty as example
+pdp11 ekbee1_run.scmd                           # SimH simulator
+e11 /initfile:ekbee1_run.ecmd                   # e11  simulator
+```
+
+### Expected output when no errors are reported
+```
+CEKBEE0 11/70 MEM MGMT
+CPU UNDER TEST FOUND TO BE A KB11-B/C
+
+END PASS #     1  TOTAL ERRORS SINCE LAST REPORT      0
+END PASS #     2  TOTAL ERRORS SINCE LAST REPORT      0
+...
+```
+
+### w11 remarks
+Requires [patch](ekbee1_patch_w11a.tcl). Still two diagnostics
+```
+  TMCE KT BEND DOESN'T GO LOW ON TMCD SL RED
+  ERRORPC TEST NUMBER
+  076414  000122  
+  
+  SSRA PS RESTORE(1) DOESN'T GET TO RACK E63
+  OR E63(5) BAD
+  ERRORPC TEST NUMBER
+  077344  000124  
+```
+
+### SimH remarks (tested with V3.12-3 RC2)
+Requires [patch](ekbee1_patch_1170.scmd).
+
+### e11 remarks
+_to come_
diff --git a/tools/xxdp/ekbee1_patch_1170.scmd b/tools/xxdp/ekbee1_patch_1170.scmd
new file mode 100644
index 00000000..9c6b2bc2
--- /dev/null
+++ b/tools/xxdp/ekbee1_patch_1170.scmd
@@ -0,0 +1,106 @@
+; $Id: ekbee1_patch_1170.scmd 1323 2022-12-01 08:00:41Z mueller $
+; SPDX-License-Identifier: GPL-3.0-or-later
+; Copyright 2022- by Walter F.J. Mueller <W.F.J.Mueller@gsi.de>
+;
+; Patch set ekbee1 for SimH -- SimH -- SimH -- Simh -- Simh -- Simh
+;
+;   Note: see HACK and DEBUG section at end, especially for setting breaks
+;
+; AP: skip test 046: 18-bit mapping adder ------------------------------------
+;   uses maintenance bit, unsupported in SimH
+;   Note: all par/pdr setup's done, only tests skiped
+;         the next tests seem to depend on the par/pdr settings
+;
+dep 047720 000412
+dep 050006 000412
+dep 050074 000412
+dep 050162 000412
+dep 050250 000412
+dep 050336 000412
+dep 050424 000412
+dep 050512 000412
+dep 050600 000412
+dep 050666 000412
+dep 050754 000412
+dep 051042 000412
+;
+; AP: patch test 50: 22-bit mapping carry propagation ------------------------
+;   The test does an access to 17000000, the first word of the UNIBUS
+;   window. It expects CPUERR 020 because UBMAP is disabled in MMR3.
+;   SimH doesn't simulate the UNIBUS window and is configured to have a
+;   memory hole instead. So access aborts with NXM instead of timeout.
+;   Patch the testing instruction to it expects NXM in CPUERR
+;
+dep 052212 000040
+;
+; AP: patch test 55: ACF = 1 -------------------------------------------------
+; AP: patch test 56: ACF = 4 -------------------------------------------------
+; AP: patch test 57: ACF = 5 -------------------------------------------------
+;   Tests 055, 056, and 057 verify trap response and check mmr0(6:1) which
+;   isn't frozen for traps. The instruction is 'mov mmr0,pmmr0' with the
+;   scr page 7 (IO page) and dst page 1 (where variables are). The test from
+;   expects for mmr0 011003, the destination page. With SimH one gets 011011,
+;   the last explicit update of MMR0. SimH only updates MMR0 when relevant
+;   and not on every access as a real 11/70 or w11 does.
+;   Patch the locations to avoid the diagnostic message
+;
+dep 054152 011011
+dep 054302 011011
+dep 054366 011011
+dep 054564 011011
+;
+; AP: skip test 061: no MMU trap when MMU reg accessed -----------------------
+;   Test verifies that no MMU traps are issued when MMU regs are accessed.
+;   This is not implemented in SimH, thus test skipped.
+;
+dep 054764 000137
+dep 054766 055204
+;
+; AP: skip test 063: proper timing of MMU traps ------------------------------
+;   Test tests also the trap behavior when MMU registers are accessed
+;   This suppression is not implemented in SimH, thus test skipped.
+;
+dep 055404 000137
+dep 055406 055554
+;
+; AP: skip test 067: verify MMR0(7) ------------------------------------------
+;   Tests verifies MMR0(7) instruction complete. Not implemented in SimH.
+;   The test loops-up.
+;
+dep 056536 000137
+dep 056540 057120
+;
+; AP: patch test 122: KT BEND ------------------------------------------------
+;   Tests MMU vs NXM,ODD,RED behavior
+;   The 1st part tests NXM vs MMU. On a KB11-C handles NXM earlier then MMU (!) 
+;   On a KB11-E MMU takes precedence (as one expects and SimH, e11, and w11 do).
+;   Patch the test such that is checks KB11-E behavior (beq 20$ -> nop)
+;
+dep 076224 000240
+;
+;   The 2nd part tests RED vs MMU. On a 11/70 the MMR0 abort bits are not set
+;   in case of a stack in a non-resident page with an address below STKLIM.
+;   Simh, e11, and w11 do set the MMR0 abort bit, and take a fatal stack error.
+;   Patch test to
+;   - change instruction under test 'clr (sp) -> clr -(sp)'
+;   - ignore that (beq 10$ -> br 10$). And change 'clr (sp) 
+;
+dep 076366 005046
+dep 076376 000407
+;
+; AP: skip test 123: SL register comparator test 2 ---------------------------
+;   Prints message title, but no failed combinations
+;   Fails for same reasons as ekbbf0 test 042.
+;   ekbee1 error print out is buggy, only prints the header and not the table,
+;   therefore only header seen.
+;   Patch test 123 like for for ekbbf0, use 'mov (sp)+,-(sp)'.
+;
+dep 076666 012646
+;
+; HACKS and DEBUG ++++++++++++++++++++++++++++++++++++++++++++++++++++
+;
+; HP: skip test 071: MMR2 pattern test ---------------------------------------
+;   this test tries all PC's in user mode --> skip to ease setting breakpoints
+;
+;; dep 057532 000137
+;; dep 057534 057766
diff --git a/tools/xxdp/ekbee1_patch_w11a.tcl b/tools/xxdp/ekbee1_patch_w11a.tcl
new file mode 100644
index 00000000..7444c178
--- /dev/null
+++ b/tools/xxdp/ekbee1_patch_w11a.tcl
@@ -0,0 +1,82 @@
+# $Id: ekbee1_patch_w11a.tcl 1324 2022-12-01 11:24:20Z mueller $
+# SPDX-License-Identifier: GPL-3.0-or-later
+# Copyright 2022- by Walter F.J. Mueller <W.F.J.Mueller@gsi.de>
+#
+# Patch set ekbee1 for w11a -- w11a -- w11a -- w11a -- w11a -- w11a
+#
+# Note: Tcl has default radix 10 --> all octal numbers must start with '0' !!
+#
+# AP: skip test 046: 18-bit mapping adder ------------------------------------
+#   uses maintenance bit, unsupported in SimH
+#   Note: all par/pdr setup's done, only tests skiped
+#         the next tests seem to depend on the par/pdr settings
+#
+dep 047720 000412
+dep 050006 000412
+dep 050074 000412
+dep 050162 000412
+dep 050250 000412
+dep 050336 000412
+dep 050424 000412
+dep 050512 000412
+dep 050600 000412
+dep 050666 000412
+dep 050754 000412
+dep 051042 000412
+#
+# AP: patch test 50: 22-bit mapping carry propagation ------------------------
+#   The test does an access to 17000000, the first word of the UNIBUS
+#   window. It expects CPUERR 020 because UBMAP is disabled in MMR3.
+#   w11 doesn't simulate the UNIBUS window and has a memory hole instead.
+#   So access aborts with NXM instead of timeout.
+#   Patch the testing instruction to it expects NXM in CPUERR.
+;
+dep 052212 000040
+#
+#  AP: patch test 55: ACF = 1 -------------------------------------------------
+#  AP: patch test 56: ACF = 4 -------------------------------------------------
+#  AP: patch test 57: ACF = 5 -------------------------------------------------
+#    Tests 055, 056, and 057 verify trap response and check mmr0(6:1) which
+#    isn't frozen for traps. The instruction is 'mov mmr0,pmmr0' with the
+#    scr page 7 (IO page) and dst page 1 (where variables are). The test
+#    expects for mmr0 011003, the destination page. On w11 one gets 011017,
+#    the source page. Simply different flows. Certainly not an error.
+#    Patch the locations to avoid the diagnostic message.
+#
+dep 054152 011017
+dep 054302 011017
+dep 054366 011017
+dep 054564 011017
+#
+# AP: skip test 061: no MMU trap when MMU reg accessed -----------------------
+#   Test verifies that no MMU traps are issued when MMU regs are accessed.
+#   This is not implemented in w11, thus test skipped.
+#
+dep 054764 000137
+dep 054766 055204
+#
+# AP: skip test 063: proper timing of MMU traps ------------------------------
+#   Test tests also the trap behavior when MMU registers are accessed
+#   This suppression is not implemented in w11, thus test skipped.
+#
+dep 055404 000137
+dep 055406 055554
+#
+# AP: skip test 067: verify MMR0(7) ------------------------------------------
+#   Tests verifies MMR0(7) instruction complete. Not implemented in w11.
+#   The test loops-up.
+#
+dep 056536 000137
+dep 056540 057120
+#
+#
+# HACKS and DEBUG
+#
+# HP: skip test 071: MMR2 pattern test ---------------------------------------
+#   this test tries all PC's in user mode --> skip to ease setting breakpoints
+#   and skip in GHDL simulation, it's just a waste of time
+#
+if {[rlink::issim]} {
+  dep 057532 000137
+  dep 057534 057766
+}
diff --git a/tools/xxdp/ekbee1_run.scmd b/tools/xxdp/ekbee1_run.scmd
new file mode 100644
index 00000000..86b96c62
--- /dev/null
+++ b/tools/xxdp/ekbee1_run.scmd
@@ -0,0 +1,35 @@
+; $Id: ekbee1_run.scmd 1318 2022-11-21 09:27:32Z mueller $
+; SPDX-License-Identifier: GPL-3.0-or-later
+; Copyright 2022- by Walter F.J. Mueller <W.F.J.Mueller@gsi.de>
+;
+do setup_w11a_basic.scmd
+;
+echo EKBE - 11/70 memory management
+echo ..from ekbee1.lda
+;
+echo output to be expected:
+echo ..CEKBEE0 11/70 MEM MGMT
+echo ..CPU UNDER TEST FOUND TO BE A KB11-B/C
+echo ..END PASS #     1  TOTAL ERRORS SINCE LAST REPORT      0
+;
+echo setup switches:
+;;;; 100000  15  halt on error
+;;;; 040000  14  loop on test
+;;;; 020000  13  inhibit error typeouts
+;;;; 010000  12  inhibit trace trapping
+echo 004000  11  inhibit iterations
+;;;; 002000  10  ring bell on error
+;;;; 001000  09  loop on error
+;;;; 000400  08  loop on test in SW <06:00>
+;;;; 000200  07  inhibit multiple error typeouts
+;;;;      06-00  test number to loop on
+echo ------
+echo 004000
+dep sr 004000
+;
+dep pc 200
+load to_lda/ekbee1.lda
+;
+do ekbee1_patch_1170.scmd
+;
+cont
diff --git a/tools/xxdp/ekbee1_run.tcl b/tools/xxdp/ekbee1_run.tcl
new file mode 100644
index 00000000..6f930b23
--- /dev/null
+++ b/tools/xxdp/ekbee1_run.tcl
@@ -0,0 +1,27 @@
+# $Id: ekbee1_run.tcl 1318 2022-11-21 09:27:32Z mueller $
+# SPDX-License-Identifier: GPL-3.0-or-later
+# Copyright 2022- by Walter F.J. Mueller <W.F.J.Mueller@gsi.de>
+#
+puts "EKBE - 11/70 memory management"
+puts "..from ekbee1.lda"
+#
+cpu0 ldabs to_lda/ekbee1.lda
+#
+# apply patches
+source patch_dep.tcl
+source ekbee1_patch_w11a.tcl
+#
+# set console to 7bit mode
+cpu0tta0 set to7bit 1
+#
+# set switch register
+puts "setup switches"
+puts "004000  11  inhibit iterations"
+puts "------"
+puts "004000"
+.d sdreg/r 004000
+#
+# check for debug hook
+rutil::dohook "ekbee1_hook"
+#
+.csta 0200
diff --git a/tools/xxdp/eqkce1_README.md b/tools/xxdp/eqkce1_README.md
new file mode 100644
index 00000000..cae53a72
--- /dev/null
+++ b/tools/xxdp/eqkce1_README.md
@@ -0,0 +1,47 @@
+# EQKCE1 - 11/70 CPU exerciser
+
+### Documentation
+- [DiagnosticsHandbook](http://www.bitsavers.org/pdf/dec/pdp11/xxdp/PDP11_DiagnosticHandbook_1988.pdf) p27
+- [EQKCE1 source listing](http://www.bitsavers.org/pdf/dec/pdp11/microfiche/Diagnostic_Program_Listings/Listings/MD-11-DEQKC-B__PDP11-70__CPU_INSTRUCTION_EXERCISER__EP-DEQKC-B-DL-A__NOV_1976_bw.pdf)
+
+### Usage
+```
+ti_w11 -c7 @eqkce1_run.tcl                      # w11 on GHDL, using cmoda7
+ti_w11 -tuD,12M,break,xon @eqkce1_run.tcl       # w11 on FPGA, arty as example
+pdp11 eqkce1_run.scmd                           # SimH simulator
+e11 /initfile:eqkce1_run.ecmd                   # e11  simulator
+```
+
+### Expected output when no errors are reported
+```
+CEQKC-E...PDP 11/70 CPU EXERCISER
+
+CPU UNDER TEST FOUND TO BE A KB11-B/C
+
+PROCESSOR ID REGISTER =110234 (OCTAL)  -28516 (DECIMAL) 
+OPT.CP=145406
+
+**NOTE** SWITCH REG BIT 8 HAS BEEN REVERSED IN REV D
+NOTE THAT SWR BIT 8 SET NOW ALLOWS I/O RELOCATION
+
+THIS PROGRAM SUPPORTS I/O RELOCATION ONLY WITH THE FOLLOWING DEVICES:
+RP03,RK05,RP04/5/6,RS03/4
+1THE QUICK BROWN FOX JUMPED OVER THE LAZY DOGS BACK 0123456789
+2THE QUICK BROWN FOX JUMPED OVER THE LAZY DOGS BACK 0123456789
+3THE QUICK BROWN FOX JUMPED OVER THE LAZY DOGS BACK 0123456789
+4THE QUICK BROWN FOX JUMPED OVER THE LAZY DOGS BACK 0123456789
+5THE QUICK BROWN FOX JUMPED OVER THE LAZY DOGS BACK 0123456789
+000:00:00
+
+END PASS #     1  TOTAL ERRORS SINCE LAST REPORT      0
+...
+```
+
+### w11 remarks
+Runs without patches
+
+### SimH remarks (tested with V3.12-3 RC2)
+Requires [patch](eqkce1_patch_1170.scmd).
+
+### e11 remarks
+_to come_
diff --git a/tools/xxdp/eqkce1_patch_1170.scmd b/tools/xxdp/eqkce1_patch_1170.scmd
new file mode 100644
index 00000000..a367ac59
--- /dev/null
+++ b/tools/xxdp/eqkce1_patch_1170.scmd
@@ -0,0 +1,20 @@
+; $Id: eqkce1_patch_1170.scmd 1319 2022-11-21 14:20:45Z mueller $
+; SPDX-License-Identifier: GPL-3.0-or-later
+; Copyright 2022- by Walter F.J. Mueller <W.F.J.Mueller@gsi.de>
+;
+; Patch set eqkce1 for SimH -- SimH -- SimH -- Simh -- Simh -- Simh
+;
+; AP: skip test 041: check stack overflow ------------------------------------
+;   fails for example at 024632 mov (sp)+,@-(sp) which aborts but shouldn't
+;   because mode 3,5, and 7 don't trap/abort on a 11/70.
+;   SimH implements a different set of STKLIM address modes
+;
+dep 024440 000137
+dep 024442 025130
+;
+; AP: skip test 065: check stack limit register ------------------------------
+;   fails for example at 032542 clr 336(sp) which should abort but didn't
+;   SimH implements a different set of STKLIM address modes
+;
+dep 032354 000137
+dep 032356 032700
diff --git a/tools/xxdp/eqkce1_run.scmd b/tools/xxdp/eqkce1_run.scmd
new file mode 100644
index 00000000..ff6eefe2
--- /dev/null
+++ b/tools/xxdp/eqkce1_run.scmd
@@ -0,0 +1,39 @@
+; $Id: eqkce1_run.scmd 1318 2022-11-21 09:27:32Z mueller $
+; SPDX-License-Identifier: GPL-3.0-or-later
+; Copyright 2022- by Walter F.J. Mueller <W.F.J.Mueller@gsi.de>
+;
+do setup_w11a_basic.scmd
+;
+echo EQKC - instruction exerciser
+echo ..from eqkce1.lda
+;
+;
+echo output to be expected:
+echo ..CEQKC-E...PDP 11/70 CPU EXERCISER
+echo ..1THE QUICK BROWN FOX JUMPED OVER THE LAZY DOGS BACK 0123456789
+echo ..2THE QUICK BROWN FOX JUMPED OVER THE LAZY DOGS BACK 0123456789
+echo ..3THE QUICK BROWN FOX JUMPED OVER THE LAZY DOGS BACK 0123456789
+echo ..4THE QUICK BROWN FOX JUMPED OVER THE LAZY DOGS BACK 0123456789
+echo ..5THE QUICK BROWN FOX JUMPED OVER THE LAZY DOGS BACK 0123456789
+echo ..000:00:00
+echo ..END PASS #     1  TOTAL ERRORS SINCE LAST REPORT      0
+;
+echo setup switches:
+echo 010000  12  INHIBIT UBE
+echo 004000  11  INHIBIT ITTERATIONS
+;;;; 000400   8  ALLOW RELOCATION VIA I/O DEVICE
+echo 000200   7  INHIBIT TYPEOUT OF THIS TEXT AND SYS SIZE
+echo 000100   6  INHIBIT RELOCATION
+echo 000040   5  INHIBIT ROUND ROBIN RELOCATION
+echo 000020   4  INHIBIT RANDOM DISK ADDRESS
+echo 000010   3  INHIBIT MBT
+echo ------
+echo 014370
+dep sr 014370
+;
+dep pc 200
+load to_lda/eqkce1.lda
+;
+do eqkce1_patch_1170.scmd
+;
+cont
diff --git a/tools/xxdp/eqkce1_run.tcl b/tools/xxdp/eqkce1_run.tcl
new file mode 100644
index 00000000..8726f8de
--- /dev/null
+++ b/tools/xxdp/eqkce1_run.tcl
@@ -0,0 +1,36 @@
+# $Id: eqkce1_run.tcl 1320 2022-11-22 18:52:59Z mueller $
+# SPDX-License-Identifier: GPL-3.0-or-later
+# Copyright 2022- by Walter F.J. Mueller <W.F.J.Mueller@gsi.de>
+#
+puts "EQKC - instruction exerciser"
+puts "..from eqkce1.lda"
+#
+cpu0 ldabs to_lda/eqkce1.lda
+#
+# set console to 7bit mode
+cpu0tta0 set to7bit 1
+#
+# ensure console interrupt not immediate
+cpu0tta  set txrlim 4
+#
+# set switch register
+puts "setup switches"
+puts "010000  12  INHIBIT UBE"
+puts "004000  11  INHIBIT ITTERATIONS"
+puts "000200   7  INHIBIT TYPEOUT OF THIS TEXT AND SYS SIZE"
+puts "000100   6  INHIBIT RELOCATION"
+puts "000040   5  INHIBIT ROUND ROBIN RELOCATION"
+puts "000020   4  INHIBIT RANDOM DISK ADDRESS"
+puts "000010   3  INHIBIT MBT"
+puts "------"
+puts "014370"
+puts ""
+puts ""
+puts ""
+puts ""
+.d sdreg/r 014370
+#
+# check for debug hook
+rutil::dohook "eqkce1_hook"
+#
+.csta 0200
diff --git a/tools/xxdp/patch_dep.tcl b/tools/xxdp/patch_dep.tcl
new file mode 100644
index 00000000..29c52027
--- /dev/null
+++ b/tools/xxdp/patch_dep.tcl
@@ -0,0 +1,15 @@
+# $Id: patch_dep.tcl 1318 2022-11-21 09:27:32Z mueller $
+# SPDX-License-Identifier: GPL-3.0-or-later
+# Copyright 2022- by Walter F.J. Mueller <W.F.J.Mueller@gsi.de>
+#
+#  Revision History:
+# Date         Rev Version  Comment
+# 2022-09-93  1292   1.0    Initial version
+#
+
+# defines 'dep' to 'cpu0 dep' forwards
+# convenient for patch files common for w11, SimH, and e11
+#
+proc dep {addr val} {
+  cpu0 dep $addr $val
+}
diff --git a/tools/xxdp/setup_w11a_basic.ecmd b/tools/xxdp/setup_w11a_basic.ecmd
new file mode 100644
index 00000000..8fd50ae9
--- /dev/null
+++ b/tools/xxdp/setup_w11a_basic.ecmd
@@ -0,0 +1,23 @@
+; $Id: setup_w11a_basic.ecmd 1314 2022-11-09 10:55:29Z mueller $
+; SPDX-License-Identifier: GPL-3.0-or-later
+; Copyright 2022- by Walter F.J. Mueller <W.F.J.Mueller@gsi.de>
+;
+; minimal configuration for xxdp tests. No devices except console
+;   set nouwin to disable UNIBUS window (17000000-17757777) to UNIBUS map
+;   set memory to 3840kB
+;   this way e11 behaves like w11 and SimH, which simplifies testing
+;
+set cpu 70
+set cpu nouwin
+set memory 3840
+set cpu nofpp
+set idle delay=1
+; set ^E as break character (like in SimH)
+set break 005
+; enable PC value logging (inspect with show pclog)
+set pclog on
+; set sysid, leading '1' indicates simulator, next '2' e11
+set cpu SYSID=0120345
+; set console to 7bit mode
+set tt0: mode=9600,N,7,1
+log tt0: e11_tt0.log
diff --git a/tools/xxdp/setup_w11a_basic.scmd b/tools/xxdp/setup_w11a_basic.scmd
new file mode 100644
index 00000000..78708e8a
--- /dev/null
+++ b/tools/xxdp/setup_w11a_basic.scmd
@@ -0,0 +1,40 @@
+; $Id: setup_w11a_basic.scmd 1314 2022-11-09 10:55:29Z mueller $
+; SPDX-License-Identifier: GPL-3.0-or-later
+; Copyright 2022- by Walter F.J. Mueller <W.F.J.Mueller@gsi.de>
+;
+; minimal configuration for xxdp tests. No devices except console
+;
+set cpu 11/70
+set cpu nofpp
+set cpu 3m
+set cpu oct
+set cpu idle
+; set sysid, leading '1' indicates simulator, next '1' SimH
+dep sysid 110234
+;
+; disable simulator stop conditions, especially "read stack trap"
+;
+dep STOP_TRAPS 0
+dep STOP_SPA   0
+;
+set cpu history=100000
+;
+; terminal interface options
+! rm -f simh_dl0.log
+set cons log=simh_dl0.log
+set tto 7b
+;
+; DISABLE all else
+;
+set rk  disabled
+set dz  disabled
+set rl  disabled
+set rp  disabled
+set tm  disabled
+set xu  disabled
+;
+set cr  disabled
+set hk  disabled
+set rx  disabled
+set rq  disabled
+set tq  disabled