                           SIMH/HP 3000 RELEASE NOTES
                        ================================
                        J. David Bryan <jdbryan@acm.org>
                             Last update: 2026-04-03


This file documents the release history of the simulator for the Hewlett-Packard
3000 Series III and Series 58 machines.

The home page for the HP simulators is:

  https://simh.trailing-edge.com/hp/

An HP 3000 "release" is made when one or more major changes have been
incorporated.  Each release is documented below and describes the changes (new
features and corrected errors) that have occurred since the prior release.  A
revised "HP 3000 Simulator User's Guide" accompanies every release where
user-visible changes were made.

A "release update" is made to fix minor errors that do not affect normal user
operation.  Examples of updates might be expansion or correction of source file
comments, minor algorithm improvements, or rewording of error messages.  Updates
are not documented here, although every change is reported in the change logs
that appear at the beginning of all HP 3000 source files.

The HP simulators were previously associated with the two "SIMH 4.0" projects
here:

  https://github.com/simh/simh
  https://github.com/open-simh/simh

...but are no longer.  Any simulator reporting itself as "V4.x" is not
authorized and not supported by your HP maintainer.  Regression testing with the
original HP diagnostics suites is performed only on the simulators available
from the trailing-edge site.  See the notes below for more information on this
transition.



===============================
Reporting Bugs in the Simulator
===============================

If you find a bug in the HP 3000 simulator, please report it directly to your HP
maintainer at the address shown at the top of these notes.  Please attach a
console log that shows the simulator version and contains a reproducible test
case that illustrates the problem.  See the SET CONSOLE LOG command in the
"Console Options" section of the "SIMH Users' Guide" for details on how to
enable logging and the SHOW VERSION command in the "Displaying Parameters and
Status" section.



=============================
The 4.x to 3.x SCP Transition
=============================

Internally, a SIMH simulator consists of a "front end," designated the Simulator
Control Program (SCP), and a "back end" that provides the machine-specific
personality.  SCP provides the simulator prompt, console commands such as ATTACH
and RUN, and common library modules for magnetic tape, terminal, and other
device support.  SCP manages command file execution, cooperates with the back
end to configure the CPU and I/O devices, and relinquishes control to the back
end to execute machine instructions when a RUN, GO, or CONTINUE command is
entered.

The SIMH project was created and led by Bob Supnik through SCP version 3.9.  In
2012, Mark Pizzolato assumed stewardship and substantially extended SCP for
version 4.0.  In 2019, Bob produced SCP version 3.10, which adopted some, but
not all, of the new features provided with version 4.0.  It also has a markedly
simpler internal structure compared to 4.0.  In 2022, version 4.0 was forked,
with the new version designated "Open SIMH" and maintained separately from
Mark's version by a steering group.

The HP 3000 simulator had been written for SCP 4.0, but the rapid development
cycle and greatly increased complexity introduced a number of errors and
incompatibilities that made it very difficult to ensure stable HP simulator
operation.  Regression testing became problematic; often the SCP would change
between simulator testing and code release.  This led to an untenable support
situation.

Therefore, starting with Release 8, the simulator has been retargeted to SCP
3.10 and its successors, which will be used for all future releases.  This does
not affect machine execution, i.e., once a RUN or GO command is given, but it
does have consequences for user-written command files, as SCP 3.10 does not
implement all of the new-for-4.0 commands.

The HP simulators provide a superset of the SCP 3.10 commands.  These are
documented in the "SIMH Users' Guide Supplement" that is provided in PDF format
in the "doc" subdirectory of the distribution archive.  Those with existing
user-written command files should consult this document for the ramifications of
the SCP transition.



===================
General Information
===================

The simulator passes the HP 32230 offline diagnostic suite and the applicable
diagnostics of the HP 32231 and 32341 Diagnostic/Utility Systems with some
expected failures due to unimplemented features.  For example, the disc
diagnostic error-correction logic tests and the tape diagnostic CRCC and LRCC
tests fail, as these features are not simulated.  However, all features that are
required for MPE operation pass their respective diagnostic tests.

The simulator has been tested with MPE V/P version E.00.01, MPE V/R version
E.01.00, and MPE V/E version G.3P.00.  Specifically:

 - MPE can be RELOADed to generate a new disc-based system from a Fundamental
   Operating System (FOS) tape.

 - MPE can be COOLSTARTed to run from a previously generated disc.

 - The MPE system console operates (by default) through the simulation console,
   and additional sessions may be connected to the ATC or ADCC via Telnet or
   host serial ports.

 - MPE FOS programs (EDITOR, QUERY) and SUBSYS programs (SPL, BASIC, BASICOMP)
   run properly.

 - The SYSDUMP program produces a valid tape image, and the system may be
   COLDSTARTed from it.

 - The operator and system manager can be logged in and out, and MPE can be
   SHUTDOWN through to a HALT 17.

The user's manual for the simulator is provided in PDF format in the "doc"
subdirectory of the distribution archive.


-----------------------
Compiling the Simulator
-----------------------

Compilation instructions are documented in Section 1 of the "SIMH Users' Guide
Supplement" that is provided in PDF format in the "doc" subdirectory of the
distribution archive.


------------------
Available Software
------------------

Ready-to-run MPE V/R and V/E software kits are available from the "Software
Kits" section of the simulator site listed above.  The kits contains bootable
disc images and associated command files that automate the system startup
process.  The disc images are preconfigured with the Fundamental Operating
Software (FOS), selected SUBSYS language processors (BASIC, BASICOMP, COBOL,
COBOLII, FORTRAN, PASCAL, RPG, and SPL), and example programs.  Command files to
perform new system generations from the FOS tape images are also included.

QCTerm, a free HP 700 terminal emulator for Microsoft Windows, is available from
the HP Computer Museum at:

  https://www.hpmuseum.net/display_item.php?sw=585

Manuals describing MPE operation are available from Bitsavers at:

  https://www.bitsavers.org/pdf/hp/3000/

HP created separate MPE V/E and MPE V/R manuals.  However, very few of the V/R
manuals survive.  In general, the MPE IV manuals describe a subset of MPE V/R
commands, whereas the MPE V/E manuals describe a superset.  Relying on the MPE
IV manuals and the online help available within MPE V/R for those commands that
do not appear in the manuals is perhaps the best compromise.


-----------------------
Bugs in MPE V/R E.01.00
-----------------------

Testing during simulator development revealed the presence of several bugs in
the MPE version used:

 - After a cold load from tape (COLDSTART/RELOAD/UPDATE), if a non-HP terminal
   such as the simulation console is used as the system console, MPE prints DATE
   (M/D/Y)? and then WED, NOV  1, 1972, 12:00 AM, as though the RETURN key had
   been pressed.  If an HP terminal emulator is used instead, MPE waits for the
   user to enter the date before proceeding.

   The problem is incorrect coding in the SPEEDSENSE procedure in module
   INITIAL.  As a result, the console baud rate is set to an invalid value, so
   console reads fail.  The resulting zero-length read is interpreted as though
   RETURN had been entered.

   This is MPE V/R SSB KPR Number 5000187104, "Foreign devices as SIII system
   consoles do not work correctly on V/R."  HP issued a patch for this, but it
   does not seem to have survived.  A simple workaround is to set local ENQ/ACK
   processing on ATC channel 0 (SET ATCD0 LOCALACK) when the system console is
   not an HP terminal.  This is the default setting, so the bug only manifests
   itself when SET ATCD0 REMOTEACK is done before booting.

   An alternate workaround that does not depend on the ATC configuration is to
   set memory location 01.112247 to octal value 021360 after cold loading is
   complete.  This changes the "LOAD P+22,I,X" instruction at that location to
   "LDI 360" to set the detected speed to 2400 baud unconditionally.  This
   workaround is present in the "mpe-1-reload.sim" simulator command file
   provided with the MPE V/R Operating System Software Kit mentioned above.
   However, the correction is applied only to the in-memory copy of MPE; the
   disc and tape images supplied in the kit are unaltered.


 - If a SHUTDOWN is performed while a logon read is pending on the system
   console, e.g., by pressing RETURN to obtain the colon prompt after logging
   OPERATOR.SYS off, the expected "ALL JOBS LOGGED OFF" message does not print.
   Instead, the first few characters of the message (which begins with the
   current time) are printed, followed as expected by SHUT and a HALT %17.  If
   no read is pending, either because RETURN was not pressed before entering the
   SHUTDOWN command or because the read timed out, the message is printed
   normally.

   The problem is that while the message is being sent to the ATC character-by-
   character, the I/O abort issued to cancel the logon read also cancels the
   message write.  The timing is such that only the first few characters of the
   message are printed before the rest of the output is cancelled.

   No SSB KPR has been located, but a later MPE version inserts an ABORTIO call
   for the system console immediately before logging all sessions off.  This
   clears any logon read that might exist, and therefore an abort will not be
   performed after the "ALL JOBS LOGGED OFF" message is output.  It is
   impossible to patch memory to add this call, so the only workarounds when
   shutting down are to avoid requesting the logon prompt, wait until the logon
   timeout expires (nominally two minutes), log on and then back off again,
   enter "=ABORTIO 20" to abort the read before entering SHUTDOWN, or accept
   that the message will be truncated.  The only consequence of this bug is the
   partial message; MPE shuts down properly otherwise, so it may be safely
   ignored.


 - After a RELOAD, running DPAN4.PUB.SYS produces a "CODE SEGMENT TOO LARGE
   (LOAD ERR 33)" error.  This is because MPE defaults to an 8K code segment
   size limit, and DPAN4 has three segments between 8K and 12K in size.  If the
   limit is subsequently raised via a SYSDUMP and COLDSTART reconfiguration,
   running DPAN4 produces a "FILE IS NOT A VALID PROGRAM FILE" error, which
   will persist until DPAN4.PUB.SYS is restored from the FOS tape.  However, if
   the reconfiguration is done before running DPAN4, it will run properly
   thereafter.

   The problem is that MPE incorrectly modifies the executable file's Segment
   Transfer Tables when it encounters a code segment that is larger than the
   configured limit.  This leaves the file in an inconsistent state, leading to
   the "NOT A VALID PROGRAM FILE" message after reconfiguration to raise the
   segment size limit.  If the limit is raised before running DPAN4, the file is
   internally consistent when the STTs are patched, and each segment's load
   succeeds, allowing the program to run.

   No SSB KPR has been located, but a later MPE version ensures that code
   segment size aborts occur before any of the STTs are modified, so the program
   file remains internally consistent.  A memory patch is impossible, but a
   workaround is to increase the code segment limit before running DPAN4.  This
   is done by the "mpe-3-sysdump.sim" simulator command file provided with the
   MPE V/R Operating System Software Kit mentioned above, and the supplied disc
   image contains the increased limit.


 - With an HP 7935 CS/80 disc configured as a foreign disc, FCOPYing a file to
   the disc reports "<n> RECORDS PROCESSED *** 0 ERRORS" but then prints
   "*103*CAN'T CLOSE TOFILE" and "INVALID OPERATION (FSERR 20)."  A test program
   that writes one sector reveals that calls to FOPEN, FREAD, and FWRITE
   succeed, but the call to FCLOSE fails with FSERR 20.  If the FREAD and FWRITE
   calls are replaced with FREADDIR and FWRITEDIR, the FCLOSE succeeds.

   The problem is in procedure FCLOSE, which treats foreign discs as serial I/O
   devices and attempts to write an EOF to the device if the prior EOF has
   moved.  The CS/80 driver rejects the call, leading to the FCLOSE failure.
   This problem does not occur with MAC drives (7905, 7906, etc.) because the
   MAC driver ignores the EOF write.

   This is MPE V/R SSB KPR Number 4700115527, "7935 not supported as foreign
   disc."  HP apparently never fixed this issue.  A workaround seems to be to
   ignore the error, as the file is correctly read and written.

   The error does not occur if FREADDIR and FWRITEDIR are used, because they do
   not update the EOF position (and they also make more operational sense with a
   foreign disc).  The error will not occur with HP-IB MAC drives, because the
   driver NOPs zero-length requests, rather than failing them.


 - MPE V SSB KPR 9999011435, "SYSDUMP/INITIAL not checking "HIGHEST DRT" if
   highest is ATC" affects system configurations where an ATC terminal is the
   final DRT entry.  The report text is:

     *** PROBLEM TEXT ***
     Sysdump and Initial do not check the "Highest DRT" correctly if it points
     to an Async Terminal Controller (ATC).  A system failure will result at
     logon time if a modem is connected to this ATC.

     *** CAUSE TEXT ***
     Two extra DRTs are associated with the ATC for full and half duplex modems
     although they are not specified in the configuration dialogue.

     *** TEMPORARY SOLUTION TEXT ***
     Add two (2) to the DRT of the ATC in response to the question "highest
     DRT."

   The system configurations supplied in the MPE V/R Operating System Software
   Kit mentioned above comply with the temporary solution.


 - Occasionally, DSCOPY will abort with a PROGRAM ERROR #4: INTEGER DIVIDE BY
   ZERO message.  Repeating the same DSCOPY command will often succeed.

   This is DS/3000 SSB KPR Number 5000112359, "DSCOPY intrinsic causes the
   program to fail with integer divide by zero."  The fix from April 1986 says:

     *** FIX TEXT ***
     This fix is written to correct existing holes in the code which calculates
     the '% of file transferred'.  Because no duplication method was ever
     received by the lab, it is unknown whether this fix will correct all
     instances of the 'Integer divide by zero' error which occasionally occurs
     during DSCOPY transfers.

   No fix was provided for DS/3000 under MPE V/R.



======================
Release 15, 2026-04-03
======================

This release of the HP 3000 simulator adds the following features:

 - A new SSLC device has been added.  This is a simulation of the HP 30055A
   Synchronous Single-Line Controller for the Series III.  It supports
   Distributed System/3000 software connections between HP 3000 simulators.  The
   full set of configurable options is detailed in a new section of the HP 3000
   Simulator User's Guide.

 - The new "\%" escape sequence has been added to quoted string parsing.  This
   renders as a single percent sign but also inhibits interpretation as the
   start of a substitution variable.  This simplifies automated REPLY commands
   that are used to send octal numbers to MPE.

 - Symbolic entry of instruction mnemonics has been added to the DEPOSIT
   command, allowing machine instructions to be patched into memory directly by
   specifying their mnemonics instead of first translating into their equivalent
   octal values.  Symbolic entry has also been extended to the EVAL command,
   providing an easy way to obtain the octal value of a machine instruction.

 - The ASSERT command has been enhanced to accept symbolic entry of the
   comparison value.  See the SIMH Users' Guide Supplement for details.

 - Tracing of internal simulator actions has been restructured to use an
   intermediate memory buffer to receive trace states, rather than logging
   states directly to the debug log file.  This reduces tracing overhead
   dramatically by deferring formatting and writing until program execution is
   complete.  The trace memory is a circular buffer of user-specified size, with
   several different triggering, storage, windowing, and counting options that
   control acquisition of trace data.  See Section 2.20 "TRACE Command" in the
   SIMH Users' Guide Supplement and the rewritten Section 2.5 "Tracing Simulator
   Operations" in the HP 3000 Simulator User's Guide for details on the new
   TRACE commands.

 - Tracing of SIO channel programs has been added to the Selector and
   Multiplexer Channels.

 - A new MCL device has been added.  This is a simulation of the HP 30007A and
   30172A Memory Control and Logging interfaces for the Series III and Series 58,
   respectively.  Currently, this device provides trace triggering on a
   specified address with optional data and read/write status qualifiers, and
   storage of memory accesses and GIC DMA cycles.  In the future, this device
   may also provide fault logging in support of the MEMLOGAN utility.  The
   device is described in a new section of the HP 3000 Simulator User's Guide.

 - The SCMB device now supports the creation of up to two maintenance board
   instances using the SET SCMB COUNT=<n> command.


--------------------
Implementation Notes
--------------------

 - The "\%" escape sequence permits simpler automated replies when supplying
   octal numbers to MPE programs.  For example:

              Prior Release                     This Release
     -------------------------------    -----------------------------
     GO UNTIL "?" ; REPLY "%%%%12\r"    GO UNTIL "?" ; REPLY "\%12\r"

   The two doubled percent-sign sequences are required because variable
   substitution occurs both when the GO command is entered and when the REPLY
   command is executed after the breakpoint.  The "\%" escape inhibits variable
   substitution.  See the "Quoted Strings" and "Variable Substitution" sections
   of the SIMH Users' Guide Supplement for details.

 - The MPE V/R software kit has been updated to include DS/3000 and two
   SSLC instances that can be used to connect between systems.  Example uses
   have been added to the "readme.txt" file that accompanies the kit.

 - The SSLC device supports the creation of up to seven serial controller
   instances using the SET SSLC COUNT=<n> command.

 - The "MPE V Commands Reference Manual" (32033-90006 February 1986) says, "All
   communication lines must be closed before issuing a =SHUTDOWN command.
   Otherwise, a manual halt of the system may be necessary."  When using
   DS/3000, be sure to issue a :DSCONTROL DS<n>;SHUT command before issuing a
   =SHUTDOWN command.

 - The Selector Channel Maintenance Board simulator previously provided two
   fixed devices named SCMB1 and SCMB2 that were disabled by default.  It now
   provides a single device named SCMB and supports a COUNT=<n> command to set
   the number of SCMB device instances.  When two devices instances are present,
   they are named SCMB1 and SCMB2 as before.  There is no operational difference
   between the old and new arrangements, except that a SET SCMB COUNT=2 command
   is needed, and the device number, interrupt priority, and service request
   number of the second instance must be set to values that do not conflict with
   other devices (e.g., with a SET SCMB2 DEVNO=66,INTPRI=11,SRNO=1 command).

 - The SCP commands SET CONSOLE DEBUG and SET <device> DEBUG are obsolete.  The
   former still exists, but nothing is written to the designated file.  The
   latter command is now rejected.  Both commands have been replaced with new
   TRACE commands.

 - The SCP commands SAVE and RESTORE currently do not save the complete state of
   the simulator, so restoring a saved copy of a running MPE system may or may
   not work.  In particular, the commands do not save any device copies created
   with the SET <device> COUNT command, so restoring an expanded system
   definitely will not work.  These commands should not be used currently.  A
   future release either will ensure that the commands work properly or will
   remove them as unsupported.


----------
Bugs Fixed
----------

  1. PROBLEM:  Attaching the LPA device without -N does not append.

     VERSION:  Release 14 Update 1.

     OBSERVATION:  Section 7.5 of the "HP 3000 Simulator User's Guide" says of
     the ATTACH LPA command:

       Adding the -N (new file) switch clears the contents of the image file if
       present.  Without the -N switch, printer output will be appended to any
       preexisting image file content.

     However, attaching without the -N switch overwrites the existing file
     content rather than appending.

     CAUSE:  When a read-only or read/write device is attached without the -N
     switch, the file is positioned at the start of the file.  When a write-only
     device is attached, the file is positioned at the end of the file.

     Write-only devices are indicated internally by the presence of the UNIT_SEQ
     ("sequential access") flag without the UNIT_ROABLE ("read-only") flag.  The
     LPA device was missing the UNIT_SEQ flag, so the device was considered
     readable, and so newly attached files were positioned at the start rather
     than the end of the file.

     RESOLUTION:  Modify the "UNIT_FLAGS" constant (hp3000_lpa.c) to add the
     UNIT_SEQ flag.

     STATUS:  Fixed in Release 15.


  2. PROBLEM: The console log gets a YES/NO prompt but not the user's response.

     VERSION:  Release 14 Update 1.

     OBSERVATION:  The SCP "get_yn" routine is called by the HP 3000 CPU
     simulator to get user confirmation when the memory size is being reduced.
     When console logging is enabled, the confirmation prompt is logged, but the
     user's response is not.  For example, starting with a 1024K memory size,
     this interaction at the simulation console:

       sim> deposit 17.0 1
       sim> set console log=truncate.log
       Logging to file "truncate.log"
       sim> set cpu 512k
       Really truncate memory [N]? yes
       sim> show cpu
       CPU, idle disabled, Series III, [...]
       sim> exit
       Goodbye
       Log file closed

     ...produces this listing in the log file:

       Logging to file "truncate.log"
       sim> deposit 17.0 1
       sim> set cpu 512k
       Really truncate memory [N]? sim> show cpu
       CPU, idle disabled, Series III, [...]
       sim> exit
       Goodbye
       Log file closed

     CAUSE:  The "get_yn" routine calls "sim_printf" to write the prompt to both
     the console and the log and accepts the response from the console but does
     not echo that response to the log.

     RESOLUTION:  Modify "get_yn" (scp.c) to write the response string if the
     console log file is open.

     STATUS:  Fixed in Release 15.


  3. PROBLEM:  TOGGLEINXFER assertion is missing after DEVEND on the last word.

     VERSION:  Release 14 Update 1.

     OBSERVATION:  For a normal Read or Write I/O order, the multiplexer channel
     asserts TOGGLEINXFER or TOGGLEOUTXFER at the start and the end of the data
     transfer to inform the I/O interface of the extent of the transfer.
     However, if the Read or Write operation is chained, then the TOGGLE signals
     are suppressed between the intermediate transfers; instead, they are
     asserted once at the start of the first chained operation and again at the
     end of the last chained operation.

     An interface may abort a transfer, including a chained transfer, by
     asserting the DEVEND signal to the multiplexer channel.  In response, the
     channel asserts the appropriate TOGGLE signal to the interface to indicate
     the end of the transfer.

     However, this does not occur if the DEVEND signal coincides with the final
     word of the transfer.  If DEVEND is asserted at any point prior to the
     final word, the interface receives the appropriate TOGGLE signal as
     expected.

     CAUSE:  The multiplexer channel simulator keeps track of chained transfers
     by setting an internal "in-block" flag.  This is used to suppress the
     TOGGLEINXFER and TOGGLEOUTXFER signals for intermediate transfers.  When
     DEVEND is asserted, the transfer aborts immediately, but the channel must
     then skip over any subsequent chained Read or Write orders that are part of
     the same block transfer.  The in-block flag is used for this purpose as
     well.

     For a DEVEND termination of a partial transfer, the simulator correctly
     clears the in-block flag when the final (unchained) Read or Write order is
     seen.  It also clears the flag when the final Read or Write order completes
     normally after the last word is transferred.  It does not clear the flag
     properly if DEVEND coincides with the last word.

     RESOLUTION: Modified "mpx_service" (hp3000_mpx.c) to clear the in-block
     flag after DEVEND assertion on the last word of a transfer.

     STATUS:  Fixed in Release 15.


  4. PROBLEM:  A console serial port is not closed when the simulator exits.

     VERSION:  Release 14 Update 1.

     OBSERVATION:  A SET CONSOLE SERIAL command extension that separates the
     system console from the simulation console is added to complement the
     existing SET CONSOLE TELNET command.  This permits the use of serial
     terminals in addition to terminal emulators as the system console.

     However, while a console Telnet connection will be closed automatically
     when the simulator exits, a serial port connection will not be closed.  If
     the host operating system does not close it automatically on program
     termination, the port will be unavailable to other processes.

     CAUSE:  After an EXIT command ends the command loop, SCP calls the
     "sim_set_notelnet" routine to close any existing console Telnet session
     before terminating.  There is no equivalent call to the "ex_set_serial"
     routine.

     RESOLUTION:  Modify "ex_exit_cmd" (sim_extension.c) to call "ex_set_serial"
     to close any existing console serial connection before calling the SCP exit
     handler to terminate the simulator.

     STATUS:  Fixed in Release 15.



===============================
Release 14 Update 1, 2024-11-30
===============================

This release update of the HP 3000 simulator does not add any new features.


--------------------
Implementation Notes
--------------------

 - The SIMH Users' Guide for version V3.12-3 dated 05-Dec-2022 is the current
   edition.  This document is updated only when user-visible changes are made to
   the Simulator Control Program (SCP -- the simulator front end).


----------
Bugs Fixed
----------

  1. PROBLEM:  The Series 58 SET CPU DUMP command is rejected erroneously.

     VERSION:  Release 14.

     OBSERVATION:  With the CPU configured as a Series 58, setting the control
     panel DUMP thumbwheel switch to a different value is rejected:

       sim> SET CPU S58
       sim> SET CPU DUMP=11;1
       Command not allowed
       sim>

     Setting the START and LOAD thumbwheel switches are accepted and processed
     normally.

     CAUSE:  Internally, device options are specified in a modifier table, which
     is searched linearly by the command parser in the SCP front end.  The
     parser matches command names using the (sub)string entered by the user;
     this allows the user to abbreviate commands to just their unique starting
     letters.

     In this case, the Series 58 DUMP command appears after the Series III
     DUMPDEV and DUMPCTL commands in the table.  Consequently, the entered DUMP
     string is seen as an abbreviation of DUMPDEV rather than as the thumbwheel
     configuration command.  As the CPU is configured as a Series 58 instead of
     a Series III, the (DUMPDEV) command is rejected.

     RESOLUTION:  Modify the "cpu_mod" table (hp3000_cpu.c) to move the
     "DUMPDEV" and "DUMPCTL" command entries after the "DUMP" command.

     STATUS:  Fixed in Release 14 Update 1.


  2. PROBLEM: The SET ADCC NOEXTENDER command exits the simulator under Unix.

     VERSION:  3.12-5

     OBSERVATION:  The HP 3000 simulator provides a command to reduce the
     terminal multiplexer (ADCC device) from eight ports to four, corresponding
     in hardware to removing the multiplexer extender card from the system.
     When issuing this configuration command on a Unix system that employs the
     "editline" library, the simulator exits immediately:

       Dave /opt/src/SIMH
       $ ./hp3000

       HP 3000 simulator V3.12-5.1 Release 14
       sim> set cpu s58
       sim> set adcc noextender
       sim>
       Dave /opt/src/SIMH
       $

     Note that the usual "Goodbye" message that accompanies simulator exit is
     not printed.

     CAUSE:  In the HP 3000 ADCC module, the upper four ports that are going to
     disappear are first disconnected by calling "tmxr_disconnect_ln" on each of
     the four disappearing lines.  This is done to ensure that any existing
     Telnet sessions won't be left hanging.  That routine calls "tmxr_reset_ln",
     which calls "tmxr_close" to close the port socket.

     Each of the intervening routines are protected internally from being called
     for a closed port.  However, "tmxr_close" (a pointer to the default
     "tmxr_local_close" routine) calls "sim_close_sock", which calls "shutdown"
     with the connection socket.  This call is not protected.

     When called for a closed port, "shutdown" is passed a socket value of 0.
     This is interpreted on Unix systems as a request to close the stdin file
     handle (on Windows systems, this call is rejected as passing an invalid
     socket handle).

     When execution returns to the "sim>" prompt and attempts to read from stdin
     via the "readline" routine, that routine returns NULL to the main command
     execution loop.  Because stdin has been closed, the subsequent "sim_isatty"
     call returns FALSE.  The two conditions necessary for an unceremonious exit
     from the command loop now exist, and the simulator quits silently.

     RESOLUTION:  Modify "tmxr_local_close" (sim_tmxr.c) to check that the port
     socket is open before calling "sim_close_sock".

     STATUS:  Fixed in Release 14 Update 1.



======================
Release 14, 2024-09-18
======================

This release of the HP 3000 simulator adds the following features:

 - The MPE V/E code segment table (CST) expansion firmware for the HP 3000
   Series 58 CPU is now available.  The new SET CPU CSTX and SET CPU NOCSTX
   commands enable and disable the firmware, respectively.  It is enabled by
   default but must be disabled to run MPE V/P and earlier versions of the
   operating system on the Series 58.

 - A new LPA device has been added.  This is a simulation of the HP 26069A HP-IB
   to Differential Translator and its connected HP 2611/13/17/18/19 line
   printer.  As with the Series III line printer, this simulation supports the
   use of custom VFU tape images, as well as the built-in HP-standard VFU tape.
   The full set of configurable options is detailed in a new section of the HP
   3000 Simulator User's Guide.

 - The preconfigured MPE V/E disc image has been updated to add the HP 2617 as
   the system line printer configured as LDEV 6 and to expand the CST for use
   with the new firmware.


--------------------
Implementation Notes
--------------------

 - The LPA device supports the creation of up to four line printer instances
   using the SET LPA COUNT=<n> command.

 - DETACHing media files from DC, LP, and LPA units now succeeds immediately if
   the CPU is halted, i.e., has executed a HALT instruction or has encountered a
   System Halt.  Previously, these units would request a release from MPE (DC
   units) or wait until printing completes (LP units), neither of which would be
   forthcoming if MPE had halted.  This would then require the user to enter a
   second DETACH with the -F (force) option.  This action now occurs
   automatically if the CPU is halted when the DETACH command is entered.

 - Tracing of the ADCC device has been improved.  Several trace messages have
   been expanded and clarified, and a new CMD option has been added to provide a
   higher-level overview of operations.

 - The "7970E HP-IB Tape Controller" section of the User's Guide failed to
   document the COUNT option.  This has been corrected.

 - Now that a system line printer is available, the MPE V/E kit configuration of
   ADCC port 7 has been changed from a non-HP serial printer to an HP terminal
   that is now part of the first ADCC connection group.


----------
Bugs Fixed
----------

  1. PROBLEM: EXAMINE CIR and EXAMINE STATE display CIR differently.

     VERSION:  Release 13.

     OBSERVATION:  When displaying registers without specifying any numeric
     override switches such as -D or -O on the command line, certain registers
     will display by default in a symbolic format (e.g., as a character or an
     instruction mnemonic).  For example, EXAMINE CIR with no override switches
     displays the content of the Current Instruction Register register in
     mnemonic form, e.g.:

       sim> EXAMINE CIR
       CIR:    HALT 10

     However, EXAMINE STATE with no override switches displays the register in
     octal:

       sim> EXAMINE STATE
       CIR:    030370
       NIR:    000000
       [...]

     Unless overridden, the CIR register should display its content in mnemonic
     form in both cases.

     CAUSE:  The test for display override switches is not excluding the
     SIM_SW_HIDE value that is added automatically by SCP when displaying the
     full device state.  Consequently, default symbolic display modes are being
     suppressed erroneously.

     RESOLUTION:  Modify "fprint_sym" (hp3000_sys.c) to use register defaults
     if no override switches from -A to -Z are specified.

     STATUS:  Fixed in Release 14.


  2. PROBLEM:  Intersegment COBOL-II calls abort with an STT Uncallable trap.

     VERSION:  Release 13.

     OBSERVATION:  Given this program in source file COBBUG:

       $CONTROL USLINIT
        IDENTIFICATION DIVISION.
        PROGRAM-ID.  COBOL-BUG.
        ENVIRONMENT DIVISION.
        DATA DIVISION.

        PROCEDURE DIVISION.

        MAIN-PROGRAM SECTION 01.

        000-START-PROGRAM.
            DISPLAY "Hello world!"
            PERFORM 001-PARA THRU 001-EXIT.
            DISPLAY "Back in START-PROGRAM."
            STOP RUN.

        SUB-PROGRAM SECTION 02.

        001-PARA.
            DISPLAY "Hello from Paragraph 1!"
            DISPLAY "Leaving Paragraph 1.".

        001-EXIT.
            EXIT.

     ...compiling, preparing, and running with these commands produces:

       :COBOLIIGO COBBUG

       PAGE 0001   HP32233A.02.05  [74] Copyright Hewlett-Packard CO. 1989

       [...]

       0 ERROR(s), 0 QUESTIONABLE, 0 WARNING(s)

           DATA AREA IS %000220 WORDS.
           CPU TIME = 0:00:00.  WALL TIME = 0:00:00.

       END OF COMPILE

       END OF PREPARE


       ABORT :$OLDPASS.OPERATOR.SYS.?.?:SYSL.%123.%177777
       PROGRAM ERROR #17 :STT UNCALLABLE

       PROGRAM TERMINATED IN AN ERROR STATE.  (CIERR 976)
       :

     Compiling, preparing, and running with the original COBOL compiler
     produces:

       :COBOLGO COBBUG

       PAGE 0001   HP32213C.02.05  (C) HEWLETT-PACKARD CO. 1980


           DATA AREA IS %000303 WORDS.
           CPU TIME = 0:00:00.  WALL TIME = 0:00:00.
       END COBOL/3000 COMPILATION.  NO ERRORS.  NO WARNINGS.

       END OF COMPILE

       END OF PREPARE

       Hello world!
       Hello from Paragraph 1!
       Leaving Paragraph 1.
       Back in START-PROGRAM.

       END OF PROGRAM
       :

     CAUSE:  The COBOL-II compiler generates an XBR instruction to call from
     000-START-PROGRAM to 001-PARA, and it generates its Segment Transfer Tables
     with the Uncallable bit set in the STT headers.  The XBR instruction
     constructs an external label that references STT 0 of segment 2.  Because
     the program is running in user mode, and STT 0 (the header) has its
     Uncallable bit set, the instruction traps with an STT Uncallable error.

     Setting the Uncallable bit in the STT header is intended to prevent an
     unprivileged PCAL 0 from specifying an external label for STT 0.  However,
     XBR (and PARC and ENDP) should not be checking the Uncallable bit in the
     header.

     RESOLUTION:  Modify "cpu_call_procedure" (hp3000_cpu.c) to skip the
     Uncallable check for the XBR, PARC, and ENDP instructions.

     STATUS:  Fixed in Release 14.


  3. PROBLEM:  Dataset terminals are dead after a DUMP-initiated WARMSTART.

     VERSION:  Release 13.

     OBSERVATION:  If a terminal session is currently connected to an ADCC port
     configured as subtype 1 (modem connection), and a DUMP command is entered
     (e.g., after a system crash) with the simulator configured as a Series 58,
     the port will be unresponsive after the DUMP-initiated WARMSTART completes.

     If the port is configured as subtype 0 (direct connection), or if the
     session is logged off and disconnected before the DUMP is done, then the
     port will operate normally after the WARMSTART.

     CAUSE:  DUMP issues an IOCL (I/O Clear) IMB command when it starts.  In
     hardware, IOCL clears the modem control register on the ADCC, which drops
     DTR to the datasets, which respond by disconnecting.  However, while the
     register is cleared in simulation, the DTR drop is not done.  That causes
     the MPE driver and the ADCC simulation to get out of synchronization with
     each other, leaving the port unresponsive.

     RESOLUTION:  Modify "adcc_reset" (hp3000_adcc.c) to disconnect all
     modem-connected ports when the modem control register is cleared.

     STATUS:  Fixed in Release 14.



======================
Release 13, 2024-04-16
======================

This release of the HP 3000 simulator adds the following features:

 - A simulation of the HP 3000 Series 58 CPU has been added.  This is an HP-IB
   system based on the Intermodule Bus.  As such, it supports and has been
   tested with MPE V/P and MPE V/E, although the latter currently runs without
   code segment table (CST) expansion.

 - New ADCC and MA devices have been added.  These represent the HP 31264A
   Asynchronous Data Communications Channel (Main and Extender), and the HP
   7970E HP-IB 1/2" Magnetic Tape Drive, respectively.  They are documented in
   new sections of the "HP 3000 Simulator User's Guide."

 - The SET <device> COUNT=<n> command has been extended to the ADCC and MA
   devices to support a user-specified number of copies of the terminal
   multiplexer and 7970E tape controller cards.  The complementary SHOW <device>
   COUNT command displays the current number of instances of the specified
   device.

 - The ADCC device supports connection groups, a new feature allowing multiple
   terminal multiplexer devices to be attached to the same listening port.
   Incoming connections to the common listening port will be distributed
   sequentially among the several ADCC devices within the group.

 - The DC device repertoire has been expanded to include the 7936H and 7937H
   disc drives and the 9144A cartridge tape drive.  These CS/80 devices are
   supported on MPE V/E.  Disc and cartridge tape image files are directly
   interchangeable between the simulator and the HPDrive program written by
   Ansgar Kckes.

 - New SET CPU START/LOAD/DUMP commands have been added to simulate setting the
   thumbwheel switches on the Series 58 system control panel that select the
   channel and device numbers.  A new SHOW CPU PANEL command displays the
   current thumbwheel settings, along with the status provided by LEDs on the
   panel.

 - A new START command has been added to simulate pressing the START button on
   the Series 58 system control panel.  This command takes an optional channel
   and device number that indicates the device on which the cold load is
   performed.  If the value is omitted, the device is determined by the setting
   of the START thumbwheel switches.

 - The DUMP and LOAD commands have been enhanced for the Series 58 to simulate
   pressing their respective buttons, as well as taking optional channel and
   device parameters with behavior as described above.  These commands retain
   their original behaviors when the CPU is configured as a Series III.

 - By default, following the hardware behavior, the Series 58 loading processes
   proceed directly into program execution once cold-loading completes.  The
   simulator may be stopped at the cold-load trap, e.g., to set up automated
   responses, by issuing the new SET CPU STOP=COLDLOAD command prior to
   executing the START, LOAD, or DUMP command.

 - A new SET CPP FILTER command has been added to specify one or more channel
   numbers to omit from any CPP trace.  This allows tracing of CPP operations on
   channels of interest while omitting those that are extraneous.

 - The IMBA now reports its channel number in a SHOW IMBA command.

 - The ECHO command now accepts quoted strings in addition to plain (verbatim)
   strings.  A quoted string echoes just the enclosed characters -- in
   particular, a newline is not automatically added unless it is included in the
   string.  Quoted strings also process character escape sequences, so control
   characters may now be echoed.

 - The new DATE_AA and DATE_AAAA predefined substitution variables are replaced
   by a year with the same calendar days as the current year but adjusted to the
   range 2000-2027.  These are needed by MPE V/E, which does not recognize dates
   beyond December 31, 2027.

 - An internal "Keyboard Poll" unit has been added to coordinate keyboard input
   polling.  This unit will be visible in the SHOW QUEUE display.


--------------------
Implementation Notes
--------------------

 - The firmware update for code segment table (CST) expansion is not supported
   with this release.  This will be added in a future release.

 - An ADCC port may be configured for use with a non-HP serial printer as the
   system line printer.  If logging has been enabled for the port, spooled
   output will be captured to the file.  If logging is disabled, then the output
   will be discarded silently.  An active Telnet connection on the port is not
   needed to capture spooled output.

 - There is no HP-IB system line printer simulation.  Configuring a serial line
   printer as the system line printer is a workaround.  Another workaround is to
   enter :OUTFENCE 14 at the console operator's session immediately after system
   startup.  A simulation of the HP 26069A HP-IB to Differential Translator
   connected to an HP 2613/17/18 line printer will be added in a future release.

 - Both disc and cartridge tape image files are directly interchangeable between
   the DC device and the HPDrive program written by Ansgar Kckes.  Cartridge
   tape image files are in SIMH Extended format; specify the HPDrive "-simh"
   command line option when using them.

 - Block-data cartridge tape images containing data without formatting may be
   converted to SIMH Extended format for simulator and HPDrive use with Ansgar's
   SimhTool program; specify the "-convert -fixed" format option.  Examples of
   block-data CTD images are HPDrive ".hpi" tape files and Bitsavers ".cart"
   files.

 - New sections have been added to the "HP 3000 Simulator User's Guide" that
   describe the new ADCC and MA devices and their various configuration
   options.  Note in particular that instruction execution will not begin if an
   addressing conflict is present on the simulated Intermodule Bus or HP
   Interface Bus.

 - The actions of the DUMP and LOAD commands now differ, depending on the
   current CPU model setting.  Specifically, the format of the optional
   parameters and the behavior when the parameters are omitted are CPU-specific.
   See the User's Guide for details.

 - The SHOW CPU SPEED command now displays a multiplier that reflects the
   simulation speed relative to the configured CPU model.

 - MPE V/E disc caching is supported, but it offers no benefit, as disc
   operations in the FASTTIME mode are two orders of magnitude faster than when
   realistic timing is selected.  When operating in REALTIME mode, MPE disc
   caching will have a performance benefit.


----------
Bugs Fixed
----------

  1. PROBLEM:  Burst reads of more than one burst terminate after the first.

     VERSION:  Release 12.

     OBSERVATION:  Burst transfers are a method of breaking up long read or
     write transactions on slow devices into smaller pieces ("bursts") that free
     the HP-IB between bursts.  This allows other devices on the bus to request
     service or execute their own channel programs.

     A channel program executing a Read instruction that specifies a burst read
     is expected to return to one of three locations, depending on how the burst
     terminates:

       Location  Reason for Read Termination
       --------  -----------------------------------------
        * + 0    End of transaction on EOI receipt
        * + 2    End of burst transfer but not transaction
        * + TD   End of transaction on Byte Count

     ...where "*" indicates the address of the next channel instruction, and
     "TD" indicates the termination displacement field within the Read
     instruction.  If a Read specifies a 256-byte transaction with 64-byte
     bursts, and assuming that the device does not assert EOI prematurely, the
     instruction returns to * + 2 three times to allow the program to pause
     until the device indicates that it has more data ready before looping back
     for another burst.  The fourth time, the transaction completes, and the
     instruction returns to * + TD.

     However, as implemented, the Read instruction returns to * + TD after the
     first burst.  The error does not occur with record reads, which are used
     exclusively with Starfish devices.

     CAUSE:  The remaining byte count is not being checked at the end of a
     burst read.  Record reads always return to * + 0 if a premature EOI was
     seen or to * + TD when the full record is complete.

     RESOLUTION:  Modify "execute_program" (hp3000_cpp.c) to use the remaining
     byte count to determine the return location.

     STATUS:  Fixed in Release 13.


  2. PROBLEM:  Write Relative Immediate writes to the wrong memory location.

     VERSION:  Release 12.

     OBSERVATION:  The Write Relative Immediate channel program instruction is
     intended to support self-modifying channel programs.  For instance, the
     ADCC diagnostic uses the instruction to write an initial zero value to the
     location where the Device Specified Jump instruction writes its obtained
     value.  This ensures that the diagnostic can verify that the DSJ value was
     returned from the ADCC under test.  However, this does not work, and the
     diagnostic reports a DSJ failure, even though the value is being returned
     correctly.  A trace of the channel program shows that the instruction is
     writing to the wrong location:

       >>CPP  cmd: Executing channel 2 Write Relative Immediate 076036 value 000000
       >>CPP data: 00.105436  000000    bank 0 write

     CAUSE:  The signed relative displacement of the target is contained in the
     lower byte of the first word of the instruction.  The instruction executor
     attempts to sign-extend the byte to a 16-bit value before adding it to the
     current instruction address, but it fails to mask off the instruction
     opcode in the upper byte first, resulting in the wrong displacement.

     RESOLUTION:  Modify "execute_program" (hp3000_cpp.c) to mask the
     displacement to the lower eight bits before sign extension.

     STATUS:  Fixed in Release 13.


  3. PROBLEM:  Cannot suppress address increment for burst reads and writes.

     VERSION:  Release 12.

     OBSERVATION:  When operating in burst mode with single-byte transfers, the
     Read and Write channel program instructions are not honoring the "No memory
     address increment" bit.  Normally, after the right-hand byte is read or
     written, the transfer address, which is kept in the fifth word of the
     instruction, is updated to point at the next memory word.  If the above bit
     is set, the address should not change, but it does.

     CAUSE:  The instruction executors check the "Do not update instruction
     words after execution" bit before deciding whether to modify the byte count
     in the second instruction word.  But then they are not checking "no
     increment" bit in the instruction before deciding whether to increment the
     address and write it back to the fifth instruction word.

     RESOLUTION:  Modify "execute_program" (hp3000_cpp.c) to check the "no
     increment" bit before incrementing the transfer address.

     STATUS:  Fixed in Release 13.


  4. PROBLEM:  EXAMINE -O CIR should override and print in octal, but it doesn't.

     VERSION:  Release 12.

     OBSERVATION:  In Section 3.1.5, "Registers," the HP 3000 Simulator User's
     Guide says, "The CIR and NIR registers default to CPU instruction mnemonic
     format, and the STA register defaults to CPU status mnemonic format for
     display and entry but may be overridden with a numeric-format switch, if
     desired."  However, attempting to use a numeric override fails:

       sim> EXAMINE CIR
       CIR:    HALT 10
       sim> EXAMINE -O CIR
       CIR:    HALT 10
       sim>

     CAUSE:  The "fprint_sym" routine is checking for symbolic overrides, so,
     e.g., "EXAMINE -C CIR" produces "CIR:    '0',\370" but is ignoring numeric
     overrides.  The default register format should be used only if the user
     does not specify any override switch.

     RESOLUTION:  Modify "fprint_sym" (hp3000_sys.c) to use register defaults
     only if no override switches are specified.

     STATUS:  Fixed in Release 13.


  5. PROBLEM: Executing undefined instructions produce unimplemented traps.

     VERSION:  Release 12.

     OBSERVATION:  In Section 3.1.3, "Simulation Stops," the HP 3000 Simulator
     User's Guide says:

       When the simulator examines the bit patterns of instructions to execute,
       each will fall into one of four categories:

         1. Defined (canonical) instruction encodings, where all bits are
            defined or all reserved bits are zero (e.g., LOAD).

         2. Undefined (non-canonical) instruction encodings, where reserved
            fields are don't care bits (e.g., MOVE).

         3. Undefined (non-canonical) instruction encodings, where reserved
            fields are decoded (e.g., IXIT).

         4. Unimplemented instruction encodings (e.g., stack opcode 072, or EADD
            without the EIS firmware option installed).

       Instructions in categories 1 and 2 are always executed.  The UNDEF option
       stops the simulator for instructions in category 3. The intent is to
       catch instructions containing reserved fields with values that change the
       meaning of those instructions.  The UNIMPL option stops the simulator for
       instructions in category 4.

     However, SET CPU STOP=UNDEF has no effect.  Executing the SED 1 instruction
     using the non-canonical encoding 030043 instead of 030041 produces an
     unimplemented instruction trap.  For example:

       sim> SET CPU STOP=UNDEF;UNIMPL
       sim> DEPOSIT PB  0
       sim> DEPOSIT PL  1000
       sim> DEPOSIT STA 100000
       sim> DEPOSIT 100 030043
       sim> EXAMINE -M 100
       000.000100:     sed 1
       sim> STEP 100

       Unimplemented instruction, P: 000100 (sed 1)
       sim>

     The SED instruction is printed in lower case, indicating that the encoding
     is non-canonical but that it will execute as SED.  However, executing it
     results in an unimplemented instruction trap instead.

     CAUSE:  The tests for undefined instructions are made correctly, as are the
     tests for the UNDEF stop setting.  However, the tests are returning
     STOP_UNIMPL status instead of the correct STOP_UNDEF status.

     RESOLUTION:  Modify the tests in hp3000_cpu_base.c to return STOP_UNDEF
     status for an undefined instruction execution when the UNDEF stop is set.

     STATUS:  Fixed in Release 13.



======================
Release 12, 2023-07-04
======================

This release of the HP 3000 simulator adds the following features:

 - Support for the 30341A HP-IB Interface Module has been added.  This allows
   one to eight HP 7911, 7912, 7933, or 7935 CS/80 disc drives to be connected
   to the Series III system.  Support extends to configuring a CS/80 disc as the
   system cold-load device.

 - New IMBA, CPP, GIC, and DC devices have been added.  These represent the HP
   30340A Intermodule Bus Adapter, Channel Program Processor, 31262A General I/O
   Channel, and CS/80 disc drives, respectively.  They are documented in a new
   section of the "HP 3000 Simulator User's Guide."

 - A new SET <device> COUNT=<n> command is added to support a user-specified
   number of copies of a device.  In this initial implementation, multiple GIC
   and DC devices are supported, e.g., SET GIC COUNT=3 adds two more GICs to the
   initial GIC device that exists by default.  The complementary SHOW <device>
   COUNT command displays the current number of instances of the specified
   device.

 - The EXAMINE command adds a new -L switch to display the contents of memory or
   an attached image file as channel program instructions.

 - The EXAMINE and DEPOSIT commands add a new -W switch to manipulate image
   files attached to inherently byte-oriented devices, such as the DC device, as
   16-bit words in numeric or symbolic format.

 - The SET ENVIRONMENT command has been extended to accept a comma-separated
   list of quoted <name>=<value> assignments.  This allows multiple variables to
   be set with a single command.  A quoted assignment also performs escape
   sequence substitutions so, e.g., control characters can be included in
   environment variable values.  See the "SIMH Users' Guide Supplement" for
   details.

 - Tracing of character data, e.g., by the ATCD device, now displays values from
   200-377 octal as character escapes instead of numeric values.

 - The diagnostics coverage is extended to the GICDIAG and CS80DIAG programs in
   the HP 32341 Diagnostic/Utility System III.  See the "hp3000_diag.txt" file
   for details.


--------------------
Implementation Notes
--------------------

 - Available documentation of the HP 30341A HP-IB Interface Module is sparse.  A
   new section has been added to the "readme.txt" file that is part of the
   MPE V/R Operating System Software Kit that describes how to configure HP-IB
   disc drives as system or peripheral discs.  New command files are also
   included that allow specification of the system disc drive model on the
   command line, thus permitting easy RELOADing and booting of CS/80-based
   systems.

 - Unlike most Series III interfaces, the Intermodule Bus Adapter is not
   controlled by an I/O driver.  Instead, MPE automatically detects the presence
   of the IMBA at system startup, regardless of whether or not HP-IB peripherals
   are configured into the system.  Therefore, the IMBA is disabled by default
   and must be enabled explicitly with a SET IMBA ENABLED command when HP-IB
   devices are to be used.  Disabling the IMBA effectively disables the CPP,
   GIC, and DC devices by severing the connection to the Series III.

 - The DC device provides a larger variety of CS/80 disc and tape models than
   were officially supported by HP under MPE V/R.  Also, the simulation supports
   multiple GICs with multiple drives, whereas HP officially supported only a
   single 7933 on a single GIC.

 - CS/80 disc image files are directly interchangeable between the new DC device
   and the HPDrive program written by Ansgar Kckes.

 - A new section has been added to the "HP 3000 Simulator User's Guide" that
   describes the new IMBA, CPP, GIC, and DC devices and their various
   configuration options.  Note in particular that instruction execution will
   not begin if an addressing conflict is present on the simulated Intermodule
   Bus or HP Interface Bus.

 - Issuing a DETACH DC<n> command to detach a CS/80 disc drive sends a Release
   request to MPE and waits for a positive response before actually detaching
   the disc image.  If MPE responds negatively, detaching will not occur.
   Detaching may be forced by specifying the "-F" switch with the DETACH
   command.  Detaching by force is necessary when MPE is not running.  See the
   DC device section of the User's Guide for details.

 - While the DC device supports eight CS/80 units, only the first unit (DC0) is
   enabled by default, as disabling unused units improves execution efficiency.
   Other units may be enabled as desired.

 - This initial CS/80 implementation does not implement the Spare Block command,
   as it is not used by MPE driver HIOMDSC2 in normal system operation.  Issuing
   this command, e.g., via the CS/80 External Exerciser program, will result in
   an Illegal Opcode error.

   The Initiate Utility commands are recognized, but only the specific utilities
   used by the driver are implemented.  These are:

     Read Revision Numbers (C3 hex)
     Read Drive Tables     (C4 hex)

   All other utilities are not implemented and will be rejected with a Parameter
   Bounds error.


----------
Bugs Fixed
----------

  (there are no known bugs)



======================
Release 11, 2022-04-06
======================

This release of the HP 3000 simulator adds the following features:

 - A new SET ATCD CONNECT command has been added to the Asynchronous Terminal
   Controller to wait for a terminal emulator to establish its connection before
   cold-loading MPE.

 - The simulator tape library now supports the new SIMH Extended tape format.
   The MS (HP 7970B/E) tape drive simulator now reads SIMH Extended tape image
   files in addition to SIMH Standard files, although it writes only
   standard-format files.


--------------------
Implementation Notes
--------------------

 - The new SET ATCD CONNECT command may be used in command files to establish
   terminal emulator connections prior to starting MPE.  For example, a command
   file might start three terminal emulator sessions before issuing the LOAD
   command.  Following each start command with a SET ATCD CONNECT command will
   ensure that each attached terminal emulator has completed its Telnet
   negotiation and is ready for use as soon as the subsequent cold load process
   completes.

 - The default address radix has been changed from octal to decimal for the DS
   device, providing easier user translation of CHS addresses to linear word
   addresses when examining or depositing disc image file values.


----------
Bugs Fixed
----------

  1. PROBLEM:  Attempting to use a Windows virtual serial port fails.

     VERSION:  Release 10.

     OBSERVATION:  In the Windows Bluetooth settings, one virtual serial port
     can be defined per Bluetooth connection.  The Windows device manager can be
     used to change the virtual port's baud rate, word length, parity, stop bits
     and flow control.

     However, attempting to use the virtual serial port fails.  For example:

       sim> attach ATCD1 COM1
       File open error
       sim>

     The same command works if COM1 is a real serial port.

     Stepping through with the debugger shows that the "GetDefaultCommConfig"
     call at the start of the "sim_open_serial" routine is failing with I/O
     error 87, which is ERROR_INVALID_PARAMETER.

     CAUSE:  "GetDefaultCommConfig" is called to obtain the default serial port
     settings.  These are used for an ATTACH command that does not specify an
     explicit configuration string.  It is not clear why the routine fails with
     a virtual port while succeeding with a real one.  However, initializing a
     port to the default configuration is a convenience, not a necessity.  If
     the routine is bypassed, the ATTACH succeeds.

     RESOLUTION:  Modify "sim_open_serial" (sim_serial.c) to move the call to
     "GetDefaultCommConfig" to the "sim_config_serial" routine, where it is
     called only if the user did not specify an explicit configuration string.
     Modify the latter routine to return SCPE_2FARG ("Too few arguments") if the
     "GetDefaultCommConfig" call fails, so that the user knows to reenter the
     ATTACH command with an explicit configuration.

     STATUS:  Fixed in Release 11.



======================
Release 10, 2021-04-30
======================

This release of the HP 3000 simulator adds the following features:

 - A new PAUSE command has been added to suspend command file execution for a
   user-specified time period.

 - The RUN and GO commands have been enhanced to provide execution for a
   user-specified (realistic) time or a specified number of event ticks.

 - The DELAY option for the BREAK, REPLY, RUN UNTIL, and GO UNTIL commands may
   now specify a (realistic) time period for the delay.

 - The IF command takes a new -E switch to indicate that the quoted strings
   should be parsed for escape sequences (i.e., that begin with a backslash).

 - The line printer may now be attached to a FIFO (pipe) file on Unix systems,
   allowing simulator output to be produced or consumed by external programs.


--------------------
Implementation Notes
--------------------

 - In prior releases, the IF command always parsed quoted strings for escapes.
   This resulted in problems on Windows systems when pathnames containing
   backslashes caused parsing errors.  For example, IF EXIST "\hp\2100.data"
   would result in an "Invalid argument" error because of the invalid octal
   escape (value > 177 octal).  IF now does not parse for escapes unless the new
   -E switch is present.  This new behavior might require changes to existing
   command files.

 - The external end of a FIFO (pipe) file must be connected before a simulated
   device unit is attached.  Otherwise, erroneous console operation will result.


----------
Bugs Fixed
----------

  1. PROBLEM:  IF with some pathname arguments can produce erroneous results.

     VERSION:  Release 9.

     OBSERVATION:  The IF EXIST command can be used to test for the existence of
     a filename.  However, if the filename contains a Windows path, the command
     can fail with an "Invalid argument" error without ever testing the file.
     For example:

       sim> if not exist "..\HP\3000\data" echo File does not exist!
       Invalid argument
       sim>

     A simple comparison can also fail with an error.  For example, assuming
     that the first substitution argument is "..\3000":

       sim> if "%1" == "" echo Path name is missing.
       Invalid argument

     The existence test can also produce erroneous results:

       sim> attach -n lpt .\newfile.txt
       sim> if not exist ".\newfile.txt" echo File does not exist!
       File does not exist!
       sim>

     CAUSE:  The IF command takes quoted strings as arguments.  Quoted strings
     are processed for escapes that start with backslash characters.  Windows
     paths contain subdirectory names separated by backslashes.  If the first
     character or characters of the next subdirectory or filename forms a valid
     escape, the escaped value will be substituted before the file existence
     test, resulting in a failing test.  If the characters form an invalid octal
     escape, i..e, resulting in a value > 177 octal, an "Invalid argument" error
     occurs.

     RESOLUTION:  Modify "parse_quoted_string" (sim_extension.c) to accept an
     "escape" argument that indicates whether escape substitution is to be
     performed on the quoted string.  Modify "ex_break_cmd" and "ex_reply_cmd"
     to pass TRUE for the escape argument.  Modify "ex_if_cmd" to pass TRUE if
     the new "-E" switch was present or FALSE if it was not.

     STATUS:  Fixed in Release 10.


  2. PROBLEM:  Concurrent DO following RUN/GO <pc> jumps to <pc> on resumption.

     VERSION:  Release 9.

     OBSERVATION:  A DO command may be entered in concurrent mode to execute a
     series of commands stored in a file.  When the command is entered,
     execution is suspended while each command in the file is performed and then
     resumed when the command file is exhausted.  However, if execution was
     started with a RUN or GO command that specified a new program counter
     value, execution will resume at that location rather than at the location
     where suspension occurred.  An example illustrates the problem:

       HP 2100 simulator V3.11-2 Release 30

       sim> deposit 0   JMP 10
       sim> deposit 1-7 NOP
       sim> deposit 10  JMP 0

       sim> deposit P 0
       sim> step

       Step expired, P: 00010 (JMP 0)
       sim> step

       Step expired, P: 00000 (JMP 10)
       sim> step

       Step expired, P: 00010 (JMP 0)
       sim> step

       Step expired, P: 00000 (JMP 10)
       sim>

     As can be seen, the two program instructions jump between locations 0 and
     10.  Starting execution with:

       sim> go 3

     ...causes the simulator to execute the no-operation instructions at
     locations 3 through 7, and then jump between locations 10 and 0 repeatedly.

     Now, given a command file "halt.sim" that contains:

       deposit 5 HLT 0
       set console debug=stdout
       set cpu debug=instr

     ...then issuing a DO command to perform the deposit should not affect
     simulator execution, because the halt instruction is bypassed by the jumps,
     and the instruction trace should show only the repeated jumps.  However:

       scp> do halt.sim

       Debug output to "STDOUT"
       >>CPU instr: - 0000 00003  000000  NOP
       >>CPU instr: - 0000 00004  000000  NOP
       >>CPU instr: - 0000 00005  102000  HLT 0
       >>CPU instr: - 0000 00005  102000  simulation stop: Programmed halt

       Programmed halt, T: 102000 (HLT 0), P: 00006 (NOP)
       sim>

     CAUSE: After stopping execution to perform the DO command, the run handler
     routine is reentered with the original command ("GO 3") rather than simply
     continuing.  In this case, the program counter is reset before execution
     continues.

     RESOLUTION:  Modify "ex_run_cmd" (sim_extension.c) to change the command to
     CONTINUE before execution is resumed following a concurrent DO.

     STATUS:  Fixed in Release 10.


  3. PROBLEM:  DS and MS have undocumented "u3", "u4", and "u5" registers.

     VERSION:  Release 9.

     OBSERVATION:  The "HP 3000 Simulator User's Guide" describes DS device
     registers named CYL, STATUS and OPCODE, but doing "EXAMINE DS STATE" lists
     no registers with those names.  Instead, there are undocumented registers
     named "u3", "u4", and "u5".  Similarly, the MS device is documented as
     having a register named STATUS, but instead there is one named "u4".

     CAUSE:  CYL, STATUS, OPCODE, and STATUS are macro aliases for "u3", etc.
     The register definitions use the same names and so are substituted during
     compilation.

     RESOLUTION:  Modify the disc and tape libraries (hp_disclib.c/h,
     hp_tapelib.c/h) to change the internal aliases from upper case to title
     case (e.g., from STATUS to Status).

     STATUS:  Fixed in Release 10.



=====================
Release 9, 2020-11-07
=====================

This release of the HP 3000 simulator adds the following features:

 - A new concurrent-mode FLUSH command has been added to flush terminal logs and
   attached device files that otherwise would be flushed only when the simulator
   is stopped.  This allows external examination of these files while the
   simulator continues to run.

 - Terminal multiplexer line logs are now flushed each time the simulator stops.
   Prior to this, closing and then reopening a line log was the only way to post
   all buffered writes to disc.

 - The Extended Instruction Set firmware is now available.  The new SET CPU EIS
   option enables the firmware.

 - A new LINEORDER option has been added to the ATCD device to allow a
   user-specified connection order or to restrict connections to a subset of the
   available lines.

 - The -N (new file) option has been added to the SET ATCD LOG command to create
   a new, blank log file.  Without the option, the command will append to an
   existing log file.

 - Microcode traps, such as bounds violations, now print the register values if
   the REG trace option is enabled.


--------------------
Implementation Notes
--------------------

 - Prior releases relied upon MPE to trap and simulate EIS instructions.  Those
   instructions are now implemented directly, resulting in a large reduction in
   execution time for the individual instructions.  Programs that made heavy use
   of double-precision floating-point calculations or decimal (BCD) arithmetic
   may see an increase in performance.

 - The HP 30012A Extended Instruction Set was standard equipment on the Series
   II and III.  As such, the simulator should reject a SET CPU NOEIS command
   with the "Command not allowed" message.  However, the NOEIS option is allowed
   to enable performance comparisons between hardware and software instruction
   emulations.  Executing SET CPU NOEIS will revert to emulation of the EIS
   instructions by MPE.


----------
Bugs Fixed
----------

  1. PROBLEM:  Breakpoint actions after an included true IF are discarded.

     VERSION:  Release 8.

     OBSERVATION:  If a breakpoint has actions that include an IF command
     followed by additional actions, and the IF command evaluates to TRUE, then
     the IF actions executed, but the remaining breakpoint actions are
     discarded.  For example:

       sim> set environment X=0
       sim> break 10 ; if "%X%" == "0" echo X is 0 ; echo Done
       sim> go

     One would expect to see:

       Breakpoint, P: 000010 (NOP,NOP)
       sim> if "0" == "0" echo X is 0
       sim> echo X is 0
       X is 0
       sim> echo Done
       Done
       sim>

     Instead, only the first ECHO is performed.  The second one is discarded.
     However, execution is correct if the IF condition is false:

       sim> set environment X=1
       sim> break 10 ; if "%X%" == "0" echo X is 0 ; echo Done
       sim> go

       Breakpoint, P: 000010 (NOP,NOP)
       sim> if "1" == "0" echo X is 0
       sim> echo Done
       Done
       sim>

     CAUSE:  IF actions are executed by setting the breakpoint action pointer to
     the action list and returning to the command loop.  While the IF command is
     executing, the pointer is pointing at the "echo Done" part of the
     breakpoint action list.  However, if the IF condition is true, the pointer
     is changed to point at the "echo X is 0" command, and the remaining
     breakpoint actions are lost.

     RESOLUTION:  Modify "if_cmd" (sim_extension.c) to append the remaining
     breakpoint actions to the actions specified by the IF command, so that the
     former are not lost.

     STATUS:  Fixed in Release 9.


  2. PROBLEM:  Linking with recent compilers results in duplicate symbol errors.

     VERSION:  Release 8.

     OBSERVATION:  If the simulator is compiled with a recent compiler version,
     the link step fails with duplicate symbol errors.  The symbols reported are
     "sim_vm_release", "vm_sim_vm_init", "vm_console_input_unit", and
     "vm_console_output_unit".

     CAUSE:  The VM hook extension mechanism is implemented with "tentative
     definitions" of the hook variables.  The C standard says:

       "If a translation unit contains one or more tentative definitions for an
        identifier, and the translation unit contains no external definition for
        that identifier, then the behavior is exactly as if the translation unit
        contains a file scope declaration of that identifier, with the composite
        type as of the end of the translation unit, with an initializer equal to
        0."

     This behavior is such that if no module contains a definition with an
     initializer, the hook will have a zero value.  However, if a module
     contains a definition with an initializer, the hook is assigned that value.
     This allows hooks to be set without changing the hook's tentative
     definition simply by including a VM module that declares it with an
     initializer.

     This mechanism relies on the linker to resolve the multiple definitions of
     a given hook to a single reference.  For this to occur, the compiler must
     mark tentative definitions as "common" allocations, e.g., with the
     "-fcommon" option to gcc.  Traditionally, gcc (and clang, etc.) defaults to
     common allocations for tentative definitions.  However, the gcc manual
     claims that, "This behavior is not required by ISO C, and on some targets
     may carry a speed or code size penalty on variable references."

     Newer versions (starting with gcc 10) default to data allocations instead
     ("-fno-common"), and multiple tentative definitions now result in duplicate
     symbol errors rather than merged accesses.

     RESOLUTION:  Modify sim_extension.h to declare "vm_sim_vm_init" only if the
     USE_VM_INIT symbol is defined.  Modify "ex_initialize" (sim_extension.c) to
     remove the tentative definition and to make the external "vm_sim_vm_init"
     call conditional on USE_VM_INIT.  Modify "one_time_init" (hp3000_sys.c) to
     set the "sim_vm_release" hook directly.  Modify "atcd_reset" (hp3000_atc.c)
     to set the console unit hooks directly.  This removes all tentative
     definitions from the simulators.

     STATUS:  Fixed in Release 9.


  3. PROBLEM:  Trace output to stdout on Unix results in stair-step output.

     VERSION:  Release 8.

     OBSERVATION:  Directing the trace output to "stdout" on a Unix system
     results in lines stair-stepping across the screen.  For example:

       sim> set console debug=stdout
       sim> set cpu debug=instr
       sim> step 2

     ...produces this output:

       >>CPU instr: 00.000000  000000  NOP,NOP
                                              >>CPU instr: 00.000001  000000  NOP,NOP

     CAUSE:  Trace statements are output with LF ('\n') line ends and depend on
     host-system translation to the proper line-end convention when the lines
     are written to the trace log.  However, while the simulator is executing
     instructions, the console is placed in "raw" mode so that output
     translation, which would interfere with the output from the target
     operating system, is not done.  As there are no carriage returns in the
     trace output stream when writing to stdout, the console cursor simply drops
     in place to the next line, so that each line begins at the same column
     where the previous line ended.

     RESOLUTION:  Modify "hp_trace" (hp3000_sys.c) to convert a terminating LF
     to a CR LF sequence if output is to stdout.  Also modify "sim_instr"
     (hp3000_cpu.c) and "edit" (hp3000_cpu_cis.c) to add CR characters to the
     stdout stream where line termination is done explicitly.

     STATUS:  Fixed in Release 9.


  4. PROBLEM:  CPU EXEC traces can include unrelated process clock events.

     VERSION:  Release 8.

     OBSERVATION:  When the SET CPU DEBUG=EXEC command is used to trace specific
     CPU instruction executions, process clock event traces may be embedded.
     For example, tracing the ABSD instruction is seen to produce:

       >>CPU  exec: *****************
       >>CPU   reg: 00.045172  000002    A 000005, B 000316, X 000001, M i t r o C CCG
       >>CPU fetch: 00.042440  000047    instruction fetch
       >>CPU instr: 00.042437  020477  ABSD 1
       >>CPU  data: 00.045172  020040    stack read
       >>CPU  data: 00.045171  020040    stack read
       >>CPU fetch: 00.042441  140003    instruction fetch
       >>CPU  opnd: 00.045113  000316    source 5,"12345D"
       >>CPU  data: 00.045114  056400    data read
       >>CPU  data: 00.045114  057400    data write
       >>CPU  opnd: 00.045113  000316    target 5,"12345F"
       >>CPU pserv: Process clock delay 3890 service entered on the user stack
       >>CPU pserv: Simulation rate 1x
       >>CPU   reg: 00.045170  000002    A 020040, B 020040, X 000001, M i t r o C CCL
       >>CPU  exec: *****************

     The PSERV trace is unrelated to instruction execution.

     CAUSE:  EXEC tracing works by enabling all trace options when the target
     instruction is present in the CIR.  However, it should enable just the
     trace options relevant to execution.

     RESOLUTION:  Modify the definition of DEB_ALL (hp3000_cpu.h) to exclude the
     DEB_PSERV trace option.

     STATUS:  Fixed in Release 9.


  5. PROBLEM:  A bounds violation can occur with valid CVND operands.

     VERSION:  Release 8.

     OBSERVATION:  The following valid SPL program:

       BEGIN
         BYTE ARRAY X (0:5) := "-31416";

         PROCEDURE CVND (DISPLAY);
           BYTE ARRAY DISPLAY;

         BEGIN
           BYTE ARRAY ASCII (0:5);

           TOS := @ASCII;
           TOS := DISPLAY;
           TOS := 6;
           ASSEMBLE (CON %020477;  << CVND LS,1 >>
                     CON %000021);
         END;

         CVND (X);
       END.

     ...produces this error:

       PROGRAM ERROR #24 :BOUNDS VIOLATION

     CAUSE:  Tracing the instruction execution shows:

       >>CPU   reg: 01.042453  000003    A 000006, B 000002, C 000042, X 000000, m I T r o c CCG
       >>CPU   reg: 01.000000  000301    PB 177630, PL 177653, DL 042274, DB 042430, Q 042447, Z 044714
       >>CPU fetch: 04.177644  000021    instruction fetch
       >>CPU instr: 04.177643  020477  CVND LS,1
       >>CPU  data: 01.042453  042430    stack read
       >>CPU fetch: 04.177645  031401    instruction fetch
       >>CPU   reg: 01.042452  000004    A 000006, B 000002, C 000042, D 042430, X 000000, m I T r o c CCG
       >>CPU instr: 04.177645  000000  bounds violation trap

     The HP 3000 microcode preloads four top-of-stack registers before calling
     any of the firmware extension instruction routines.  However, only three
     TOS values are pushed for the CVND instruction, so the fourth register
     actually contains a word from whatever was on the stack before the
     instruction was executed.  If the source or target buffer resides on the
     stack immediately below the three CVND parameters, preloading the fourth
     TOS register sets SM to point below the last word of the buffer, and a
     bounds violation results.

     In the above trace, the stack preload shows the fourth TOS register is read
     from location 042453.  This increments SR and decrements SM to point at
     042452, as shown in the REG trace two lines later.  The C register contains
     the relative byte address of the target array -- in this case, 42 (octal)
     relative to the DB register contents.  The starting word address is
     therefore 42 / 2 + 042430 = 042451.  The buffer is 6 bytes or 3 words long,
     so the ending address is 042453.  But because the preload pulled in a
     fourth stack word (that was never pushed), the end of the buffer is under
     SM, and a bounds violation occurs.

     RESOLUTION:  Modify the CVND executor in "cpu_cis_op" (hp3000_cpu_cis.c) to
     queue down (i.e., transfer from a register back to memory) the fourth TOS
     register value before checking the buffer legality.

     STATUS:  Fixed in Release 9.



=====================
Release 8, 2020-02-15
=====================

This release of the HP 3000 simulator adds the following features:

 - A new CONCURRENT option has been added to the SET CONSOLE command.  Entering
   CTRL+E with concurrent mode enabled allows the simulator to continue to run
   while presenting an "scp>" prompt for command entry.  This permits SCP
   commands, such as an ATTACH of a magnetic tape image, to be performed without
   causing the simulated system clock to lose time and without disturbing
   command file execution.

   Concurrent mode is enabled by default.  If the prior mode where CTRL+E stops
   the simulator is desired, a SET CONSOLE NOCONCURRENT command may be placed in
   the "simh.ini" global initialization file that is read automatically at
   startup.  See the "SIMH Users' Guide Supplement" for details.

 - The -N (new file) option to the ATTACH command for disc devices now creates a
   full-size image file, equivalent to formatting the new disc before use.


--------------------
Implementation Notes
--------------------

 - The change from SCP 4.0 to 3.x may affect user-written command files.  Be
   sure to review Section 3, "SCP 4.x-to-3.x Conversion," of the "SIMH Users'
   Guide Supplement."

 - The DO command now executes more quietly by default.  Specifically, the
   "Breakpoint" and "Step expired" messages that normally result from BREAK, GO
   UNTIL, and STEP command completions are suppressed, as are the informational
   messages from ATTACH and DETACH, such as "Creating new file."  This provides
   a cleaner console display log when automated prompts and responses are used.
   Adding the -A switch to the DO invocation will restore the previous noisier
   behavior.  See the "DO Command" section of the Supplement for details.

 - The previous behavior of the "ATTACH -N" command for disc devices, i.e.,
   creating a new zero-length image file, may be emulated by first deleting the
   file and then attaching it without specifying the -N switch.  For instance,
   the "DELETE <file>" and "ATTACH <unit> <file>" commands produce a new
   zero-length file as "ATTACH -N <unit> <file>" did before this change.  The
   "ATTACH -N" behavior of other devices, e.g., magnetic tape drives and
   printers, did not change; a zero-length file is still created.

 - Comments marking the locations where "switch" statement executions fall
   through from one case label to the following case now comply with the
   requirements of the GNU C compiler to avoid warnings when the compiler option
   "-Wimplicit-fallthrough" is used.


----------
Bugs Fixed
----------

  1. PROBLEM:  Simulation stops are reported improperly in CPU traces.

     VERSION:  Release 7.

     OBSERVATION:  A simulation stop that occurs while CPU tracing is enabled
     reports the cause of the stop in the trace log.  However, stop reasons
     specific to the HP simulator are not reported properly.  For example,
     tracing a halt instruction reports "simulation stop: Error 5" instead of
     "simulation stop: Programmed halt".

     CAUSE:  The "sim_error_text" routine called to obtain the error translation
     does not return simulator-specific messages.  Instead, the routine returns
     the generic message, "Error <n>", where <n> is the value of the simulator-
     specific stop code.

     RESOLUTION:  Modify the simulation stop trace at the end of the instruction
     postlude in "sim_instr" (hp3000_cpu.c) to call "sim_error_text" for SCP
     errors and to obtain HP-specific messages from the "sim_stop_messages"
     array.

     STATUS:  Fixed in Release 8.


  2. PROBLEM:  "Non-configured device" prints when mounting a magnetic tape.

     VERSION:  Release 7.

     OBSERVATION:  Occasionally, resuming simulation after mounting a magnetic
     tape produces this message on the system console:

       18:05/3/Interrupt received for non-configured device on DRT 6. Check I/O
       configuration.

     ...instead of the expected:

       17:59/10/Vol (unlabelled) mounted on LDEV# 7

     However, the I/O map produced as part of a system reload shows that all
     four magnetic tape units are configured properly.

     Tracing CPU execution after resumption shows that the error occurs when the
     mag tape controller interrupt (a result of the offline-to-online transition
     when the tape is mounted) is immediately followed by a system clock
     interrupt.  The wrong return address is stacked by the second interrupt, so
     the first instruction of the mag tape interrupt service routine (a TIO
     instruction for DRT 6) is skipped when the clock interrupt routine exits.
     As a result, the stack alignment is wrong, so the test for a configured
     device fails, resulting in the error message observed.

     CAUSE:  MPE executes a PAUS instruction to wait for an interrupt while
     idle.  The mag tape interrupt stacks a return address that points to the
     instruction after the PAUS, which is correct.  But before the mag tape
     interrupt handler can execute its first instruction, the higher-priority
     clock interrupt occurs.  This should stack a return address that points to
     the first instruction of the mag tape interrupt handler, which has not yet
     been executed.  But instead, the return address points to the second
     instruction.  Consequently, the first instruction will be skipped when the
     clock handler completes.

     The problem occurs because the "cpu_run_mode_interrupt" routine in
     "hp3000_cpu.c" must adjust the program counter (P register) when resuming
     from a simulation stop that occurred while a PAUS instruction was
     executing.

     Because of the Series III's two-stage instruction pipeline, the P register
     normally points two instructions past the instruction currently executing.
     When an interrupt occurs, P is decremented to point at the instruction
     after the current instruction, which is the correct point of return after
     the interrupt service routine completes.

     When the simulator is stopped, P is backed up to point at the next
     instruction to execute.  In the case of a PAUS instruction, the "next
     instruction" is the same PAUS instruction.  When simulation resumes, the
     PAUS instruction is fetched into the NIR (Next Instruction Register), and P
     is incremented.  If no interrupt is pending, the main instruction execution
     loop copies the NIR into the CIR (Current Instruction Register), prefetches
     the instruction following the PAUS into the NIR, and increments P again, so
     that it points two instructions beyond the current instruction.  At this
     point, everything is set up properly as before the simulation stop.

     However, in the error case, the tape controller has requested an interrupt
     that is pending when simulation is resumed.  Interrupts are checked before
     each instruction executes, so when the interrupt is acknowledged, P is
     still pointing to the next instruction instead of two instructions ahead.
     For things to work as expected, P needs to be advanced one more instruction
     before the interrupt is serviced.  So, in the special case of a PAUS
     instruction present in the CIR after resuming a simulator stop with an
     interrupt pending, the "cpu_run_mode_interrupt" routine increments P again
     before stacking the return address.

     That code does just what it is supposed to...except in the case of a higher
     priority device that immediately interrupts a lower priority device while a
     PAUS instruction is in the CIR.  In this case, the second interrupt causes
     a second entry into the "cpu_run_mode_interrupt" routine, and because it
     still sees the PAUS instruction in the CIR, P is incremented again.  This
     is wrong, because the instruction now being interrupted is not the PAUS but
     is the first instruction of the lower-priority interrupt routine, which
     never had a chance to execute.  The result is that when the lower-priority
     routine is resumed, the first instruction of that routine is skipped
     because P was incremented a second time.

     The problem does not occur if the higher-priority interrupt is delayed by
     one instruction, or if the higher-priority interrupt occurs before the
     lower-priority interrupt, or if the CPU is executing something other than a
     PAUS instruction when it was stopped.

     RESOLUTION:  Modify "cpu_run_mode_interrupt" (hp3000_cpu.c) to test a flag
     that is set in "halt_mode_interrupt" when resuming into a PAUS instruction.
     If the flag is set, increment P and clear it, so that a second entry will
     not increment P twice.

     STATUS:  Fixed in Release 8.


  3. PROBLEM:  DETACH -F LP will not detach if the print buffer is not empty.

     VERSION:  Release 7.

     OBSERVATION:  The 2607/13/17/18 line printers do not allow the operator to
     take the printer offline if unprinted characters remain in the print
     buffer.  Instead, the request is deferred until printing completes.

     The LP simulator follows this hardware behavior when processing a DETACH
     LP command, which simulates running out of paper.  If printing is still
     pending or, for the 2607 only, the paper position is not at the
     top-of-form, the message "Command not completed" is printed, and the detach
     is deferred until a print command empties the print buffer and paper
     movement ceases.

     A "force" option is provided to detach the printer paper image file
     immediately, regardless of the printer condition.  DETACH -F LP works if
     the paper position is not at the TOF.  However, it does not work if the
     print buffer contains unprinted characters; "Command not completed" is
     displayed instead.

     Entering RESET LP followed by DETACH LP works, but the partial print buffer
     is discarded rather than flushed to the output file.

     CAUSE:  The "lp_detach" routine sets TOF status if the -F switch is
     specified, but it does not alter the buffer state.

     RESOLUTION:  Modify "lp_detach" (hp3000_lp.c) to write a partial line to
     the output file before detaching when the -F option is specified.

     STATUS:  Fixed in Release 8.



=====================
Release 7, 2018-01-12
=====================

This release of the HP 3000 simulator adds the following features:

 - Reading and writing to terminal sessions connected to the ATC have been
   improved significantly.  File uploads via Telnet using the Reflection
   terminal emulator are now over 100 times faster than before, e.g., the
   transfer time for a one-megabyte file has decreased from 69 minutes to 30
   seconds.  Block mode reads show similar speed improvements.  Copy-and-paste
   into the terminal window, Reflection file downloads, and output to the
   terminal window in REMOTEACK mode show speed improvements of five to fifteen
   times.  Output in LOCALACK mode has been improved by around 50%.

 - Information regarding Reflection file transfers and serial port disconnection
   options has been added to Section 4.1.1, "Terminal Data Interface," of the HP
   3000 Simulator User's Guide.


--------------------
Implementation Notes
--------------------

 - File transfer using the Reflection terminal emulator requires an 8-bit data
   path.  To achieve this, the session must use MPE terminal type 12 (this may
   be configured either during a system reload or by specifying the TERM=12
   parameter when logging on with :HELLO), and the channel must be set to 8B,
   REMOTEACK, and NOCAPSLOCK modes.  Note that MPE's default terminal type 10
   writes 7-bit data with odd parity, and characters with the parity bit on may
   be displayed by the terminal emulator as extended characters in the Roman-8
   symbol set.  To avoid a garbled display when using the TERM=12 parameter to
   override the default, the channel should be set to 8B mode after logging on
   and back to 7B after logging off.

 - The MPE V/R software kit has been updated to increase the number of terminal
   buffers per port from 3 to 5.  Using the default of 3 may cause the system to
   report "MPE Table TBUF has overflowed!!!" to the system console while
   performing Reflection file uploads.


----------
Bugs Fixed
----------

  1. PROBLEM:  Serial port output stalls are not handled properly.

     VERSION:  Release 6.

     OBSERVATION:  The ATCD device supports I/O via host serial ports as well as
     via Telnet connections.  While output via Telnet works correctly, output
     via serial ports fails.  Attempting to output to the ATCD results in a few
     characters written, and then the line hangs.  Sometimes pressing ENTER at
     the system console (ATCD channel 0) causes a few more characters to appear
     on the serial terminal.  Eventually, the line hangs permanently.

     CAUSE:  The terminal multiplexer library (sim_tmxr.c, part of the SIMH
     framework) had provided a 256-byte output buffer for each line, independent
     of the connection type (Telnet or serial).  The library was changed to
     reduce the serial buffer size to one byte.  If the library output routine
     receives the second character before the first one has been written to the
     serial port, it returns SCPE_STALL status to indicate a buffer overflow.
     The ATCD simulation correctly responds to this status by rescheduling the
     output attempt.  However, it fails to call the "tmxr_poll_tx" routine to
     write to the serial port, so the rescheduled attempt fails as well.

     RESOLUTION:  Modify "line_service" (hp3000_atc.c) to call "tmxr_poll_tx" if
     a buffer overflow occurs.

     STATUS:  Fixed in Release 7.



=====================
Release 6, 2017-09-07
=====================

This release of the HP 3000 simulator adds the following features:

 - The new "-F" switch to the DETACH LP command forces an immediate detach,
   regardless of the current paper position.  This is the simulation equivalent
   of physically removing the paper from the printer.  Without the switch,
   detaching is the equivalent of running out of paper, which permits printing
   to continue to the end of the line (2613/17/18) or the page (2607) before the
   printer goes offline.

 - The HP 3000 Simulator User's Guide has been revised to add a new section
   describing the simulator commands corresponding to hardware actions and to
   rewrite the "Realistic, Calibrated, and Optimized Timing" section to describe
   the three timing modes more clearly.


--------------------
Implementation Notes
--------------------

 - The LP device's PCHR (punched channel character) and UPCHR (unpunched channel
   character) registers have been renamed to PUNCHR and UNPCHR, respectively,
   for compatibility with the HP 2100 simulator's LPT device.

 - The manual clarifies that the display radix for shift counts, bit positions,
   starting bits and counts, and the CIR values for the PAUS and HALT
   instructions may be overridden with command-line switches.


----------
Bugs Fixed
----------

  1. PROBLEM:  Cancelling a deferred detach with ATTACH LP is rejected.

     VERSION:  Release 5.

     OBSERVATION:  The line printer "Unit Options" section of the HP 3000
     Simulator User's Guide states that a DETACH LP command will be deferred if
     there are characters in the print buffer.  It further states that entering
     ATTACH LP without specifying a filename will cancel the action.  This does
     not work.  Entering ATTACH LP prints "Too few arguments" and does not alter
     a pending detach.

     CAUSE:  The SCP routine "attach_cmd" checks for the presence of a filename
     before calling the line printer simulator's "lp_attach" routine.  If the
     filename is omitted, "lp_attach" is never called to cancel the pending
     detach.

     RESOLUTION:  Modify "lp_set_on_offline" (hp3000_lp.c) to cancel a deferred
     detach, and modify the User's Guide to state that SET LP ONLINE is used to
     cancel both the deferred offline and deferred detach actions.

     STATUS:  Fixed in Release 6.


  2. PROBLEM:  Changing printer models does not change the REALTIME delays.

     VERSION:  Release 5.

     OBSERVATION:  In REALTIME mode, the line printer simulator attempts to
     model the print buffer load and print-and-space operation delays inherent
     in the physical hardware.  However, after setting a different model, the
     buffer load, print, and paper advance times have not been changed.

     CAUSE:  The "lp_set_model" routine that is called in response to a "SET
     LP <model>" command sets the realistic times to those of the current model
     rather than those of the new model.

     RESOLUTION:  Modify "lp_set_model" (hp3000_lp.c) to use the new model value
     to index into the realistic times array.

     STATUS:  Fixed in Release 6.


  3. PROBLEM:  Paper cannot be removed from a 2607 printer except at the TOF.

     VERSION:  Release 5.

     OBSERVATION:  Printing a few lines on a 2607 and then attempting to remove
     the paper with the DETACH LP command displays "Command not completed" on
     the simulation console.  The file remains attached and therefore cannot be
     manipulated externally.

     CAUSE:  The DETACH command simulates both running out of paper and removing
     the paper from the printer.  For the former, the 2607 continues to print
     until the current form is complete (i.e., the top of what would be the next
     form is reached).  For the latter, the paper may be physically removed by
     the operator while at any print position.  The simulator incorrectly
     forbids the latter operation unless the paper is positioned at the TOF.

     RESOLUTION:  Modify "lp_detach" (hp3000_lp.c) to add a "forced detach"
     option ("DETACH -F LP") to detach the printer regardless of print position.

     STATUS:  Fixed in Release 6.



=====================
Release 5, 2017-04-30
=====================

This release of the HP 3000 simulator does not add any new features.


--------------------
Implementation Notes
--------------------

 - The 2607 line printer simulation now defers an out-of-paper alarm until the
   paper reaches the top-of-form position, consistent with the hardware
   behavior.  The 2613/17/18 printers continue to defer only until the current
   line is printed.


----------
Bugs Fixed
----------

  1. PROBLEM:  Host file system seek errors are not caught.

     VERSION:  Release 4.

     OBSERVATION:  The MAC/ICD disc library checks for host file system read or
     write errors and returns Uncorrectable Data Error status if an error is
     indicated.  However, host file system seeks are simply assumed to succeed;
     no indication of an error is given if a call fails.  A failed seek should
     be detected, and a Drive Fault (positioner error) should be returned.

     CAUSE:  Oversight.

     RESOLUTION:  Modify "position_sector" (hp_disclib.c) to test the
     "sim_fseek" call for error status and to simulate a Drive Fault (AGC error)
     if the call fails.

     STATUS:  Fixed in Release 5.


  2. PROBLEM:  An interrupted EDIT instruction does not resume properly.

     VERSION:  Release 4.

     OBSERVATION:  The EDIT instruction is interruptible between operations.  If
     an interrupt is detected, two words are pushed onto the stack before the
     interrupt handler is called.  These words hold the current significance
     trigger, loop count, float character, and fill character.  This allows the
     instruction to resume from the point of suspension.  However, the
     significance trigger is not preserved properly; it is always clear after an
     interrupt.

     CAUSE:  The significance trigger is preserved in the MSB of the upper byte
     of the word pushed onto the stack, but a 16-bit value with the MSB set is
     used to set the upper byte.  As only the lower 8 bits of the value are used
     to set the byte, the MSB is lost.

     RESOLUTION:  Modify "edit" (hp3000_cpu_cis.c) to use the full 16-bit value
     when storing the significance trigger.

     STATUS:  Fixed in Release 5.


  3. PROBLEM:  Tracing a tape runaway error prints gibberish in the log file.

     VERSION:  Release 4.

     OBSERVATION:  Tracing tape controller commands or command initiations and
     completions reports the success or failure of calls to the simulator tape
     library, e.g., "write failed with no write ring."  A call that fails with
     Tape Runaway status, such as a read across a long erase gap, should report
     that the operation "failed with tape runaway."  Instead, it reports
     gibberish.

     CAUSE:  The descriptive lookup table is missing an entry for the MTSE_LEOT
     status that precedes MTSE_RUNAWAY.  Attempting to look up the description
     for MTSE_RUNAWAY indexes beyond the end of the table.

     RESOLUTION:  Modify the "status_name" array (hp_tapelib.c) to include
     descriptions for all of the possible simulator tape library status returns.

     STATUS:  Fixed in Release 5.


  4. PROBLEM: Commanding a VFU channel that is not punched causes a simulator
     stop.

     VERSION:  Release 4.

     OBSERVATION:  A format command that specifies a slew to a VFU channel that
     is not punched causes a tape fault, and the printer goes offline.  However,
     the simulator then incorrectly stops with a "System halt" message, rather
     than reflecting the "not ready" status back to MPE.

     CAUSE:  The return value from the "lp_set_alarm" routine is being passed
     back as the status of the "lp_service" call.  However, the return value is
     a Boolean and is TRUE if the printer successfully went offline.  When
     interpreted as a service status return value, TRUE is seen as STOP_SYSHALT
     and causes a system halt simulator stop.

     RESOLUTION:  Modify "lp_service" (hp3000_lp.c) to return SCPE_OK after the
     tape fault alarm is set, allowing the simulation to continue.

     STATUS:  Fixed in Release 5.


  5. PROBLEM:  The 2613/17/18 printers do not ignore characters exceeding the
     line length.

     VERSION:  Release 4.

     OBSERVATION:  When characters are output in excess of the defined line
     length, the printer performs an automatic print-and-space operation and
     prints the excess characters on the following line.  This operation is
     correct for the 2607 printer but not for the 2613/17/18 printers, which
     ignore output that exceeds the line length.

     CAUSE:  Excess character handling should be, but is not, model-specific.

     RESOLUTION:  Modify the "print_props" table (hp3000_lp.c) to add a field
     for automatic printing, and modify "lp_service" to check the field to
     decide if excess characters are printed or ignored.

     STATUS:  Fixed in Release 5.



=====================
Release 4, 2017-01-08
=====================

This release of the HP 3000 simulator adds the following features:

 - The HP 32234A COBOL II Extended Instruction Set firmware is now available.
   The new SET CPU CIS option enables the firmware.

 - Subprograms in memory associated with the EDIT instruction may be examined
   symbolically with the -E switch.

 - The new CPU "OPND" trace option traces memory byte operands.

 - The new CPU "EXEC" trace option turns on full tracing for instructions
   that match a value specified by the new "SET CPU EXEC=<match>{;<mask>}"
   command.

 - The diagnostics coverage is extended to the COBOL II firmware.


--------------------
Implementation Notes
--------------------

 - The MPE V/R software kit has been updated to add the COBOL II runtime
   routines to the system SL and COBOL example programs to the OPERATOR.SYS
   account.  The startup command files also enable the COBOL II instruction set.

 - If you are using a custom MPE configuration and want to run COBOL II
   programs, you must perform a SYSDUMP/COLDSTART to replace the three existing
   COBLIB segments in your SL.PUB.SYS with their COBOL II replacements.  The
   U00U232A.USL.SYS and COB68LIB.PUB.SYS files on the disc image from the
   software kit contain the replacement segments.  See Usage Note 6 in the
   "readme.txt" file and the "mpe-3-sysdump.log" file in the kit for details.

 - New "hp3000_cpu_cis.c" and "hp3000_mem.c" modules have been added.

 - For this release, checking for interrupts is not performed during execution
   of the COBOL II EDIT, TR, CMPS, and CMPT instructions.  A future release will
   add interruptibility to these instructions to comply with their hardware
   behavior.

 - The new OPND trace option does not currently trace byte operands for
   instructions in the base set (e.g., MOVB or CMPB).  Operands for the
   COBOL II firmware instructions are fully covered.

 - The command-line switch for the EXAMINE command to request display in
   status-register format has been changed from "-S" to "-T" to avoid conflict
   with the "-S" switch used to indicate an address offset from SBANK.


----------
Bugs Fixed
----------

  1. PROBLEM:  SETR prints a base register trace when values are not changed.

     VERSION:  Release 3

     OBSERVATION:  The SETR instruction may be used to change any combination of
     the SBANK, DB, DL, Z, STA, X, Q, and SM register values.  If the REG trace
     is active, the base register values will be printed after the instruction
     completes.  This occurs whether or not the base register values were
     actually changed.  In particular, the CPU diagnostic uses the SETR
     instruction to flush the stack to memory without changing any base
     registers.  The REG trace in this case is unnecessary.

     CAUSE:  The "cpu_segment_changed" flag is set unconditionally when the
     instruction completes.  It should be set only if the SETR instruction
     specifies one or more base registers to change.

     RESOLUTION:  Modify "cpu_move_spec_fw_imm_field_reg_op" (hp3000_cpu_base.c)
     to set the "cpu_segment_changed" flag only if one or more base register
     change bits are set in the instruction operand field.

     STATUS:  Fixed in Release 4.


  2. PROBLEM:  Invalid bank and offset values are accepted for address entry.

     VERSION:  Release 3

     OBSERVATION:  Bank-offset addresses with out-of-range the bank or offset
     values, e.g., EXAMINE 30.0 and EXAMINE 0.1777777, are accepted without
     complaint.  The bank value is taken modulo 20, and the higher order bits of
     the offset value are merged into the bank number.  Values out of range
     should be rejected with errors.

     CAUSE:  Incomplete range verification.

     RESOLUTION:  Modify "parse_addr" (hp3000_sys.c) to check the parsed bank
     and offset values against their respective maximums and return an "Invalid
     argument" error if either is exceeded.

     STATUS:  Fixed in Release 4.


  3. PROBLEM:  The "-S" (SBANK-offset) switch displays values in status-register
     format.

     VERSION:  Release 3

     OBSERVATION:  The HP 3000 User's Manual states that adding the "-S" switch
     to the EXAMINE command implies that the offset is from the bank number in
     the SBANK register.  The example given, "EXAMINE -S <sbank-offset>", should
     display the memory data value at the address <SBANK-number>.<offset> in
     octal format.  Instead, it displays the value in status-register format.

     CAUSE:  The "-S" switch is used for both SBANK and STA formats.  Section
     2.1.3 says that -S means that "The implied bank number is obtained from
     SBANK."  Section 2.1.2 says that -S means that "A CPU status mnemonic" is
     being displayed.  For EXAMINE -S, the latter interpretation causes the
     expected octal value to be displayed in status-register format.

     RESOLUTION:  Modify "fprint_sym" (hp3000_sys.c) to use the "-T" switch to
     designate status-register format.  Modify hp3000_sys.c, hp3000_cpu.c, and
     hp3000_defs.h to rename the "REG_S" format indicator to "REG_T" for
     consistency with the switch change.

     STATUS:  Fixed in Release 4.


  4. PROBLEM:  SCAL 0 and PCAL 0 instructions fail when a stack overflow occurs.

     VERSION:  Release 3

     OBSERVATION:  The SCAL 0 and PCAL 0 instructions transfer control via
     subroutine or procedure calls, respectively, through program labels
     residing on the top of the stack.  If a stack overflow occurs during
     instruction execution, the stack overflow trap handler is called to enlarge
     the stack, and the instruction is reexecuted.  However, the program label
     has been lost, so control transfers to a random location.

     CAUSE:  The instructions obtain the labels and then delete the TOS, flush
     the rest of the stack registers to memory, and then check that SM <= Z,
     i.e., that the current top of the stack in memory does not exceed the
     stack limit.  If SM > Z, a stack overflow has occurred, and the trap
     handler is called.  However, the label has not been restored to the stack,
     so when the instruction is reexecuted after the stack is enlarged, the
     wrong value is pulled from the TOS.

     RESOLUTION:  Modify "cpu_io_cntl_prog_imm_mem_op" SCAL and PCAL executors
     (hp3000_cpu_base.c) to push the label back onto the stack before taking the
     stack overflow trap.

     STATUS:  Fixed in Release 4.



=====================
Release 3, 2016-09-20
=====================

This release of the HP 3000 simulator adds the following features:

 - Cold dump is now available.  Entering the DUMP command simulates pressing
   the ENABLE and DUMP front panel buttons.  The contents of main memory are
   written to an attached magnetic tape in a format suitable for analyzing with
   the DPAN4 program.  The new SET CPU DUMPDEV and SET CPU DUMPCTL options
   specify the default device number and control byte for the dump.

 - The SHOW LP VFU command now displays the VFU channel definitions in
   addition to the VFU tape title.

 - The POWER FAIL and POWER RESTORE commands have been added to simulate losing
   and regaining system power.

 - The SET CPU ARS and SET CPU NOARS options have been added to simulate the
   power-fail/auto-restart switch on the back of the system front panel.

 - The CMD instruction has been implemented and passes section 4 of the CPU
   diagnostic.


--------------------
Implementation Notes
--------------------

 - In hardware, MPE execution cannot continue after a DUMP is performed.  This
   is because a cold dump performs an I/O reset before writing the contents of
   memory to the tape, and this clears the I/O device controllers to their
   initial power-on states.  However, execution can be continued if a SAVE is
   done to record the simulator state before the dump and a RESTORE is done
   after the dump completes.  This permits taking a "snapshot" of MPE operation
   without disturbing MPE.


----------
Bugs Fixed
----------

  1. PROBLEM:  An SIO READ or WRITE order with a 4K count displays as zero.

     VERSION:  Release 2

     OBSERVATION:  SIO READ and WRITE orders define bits 4-15 as the negative
     word count of the transfer.  If bits 4-15 are zero, the transfer is 4096
     words long.  However, an EXAMINE -I command displays the word count as
     zero.

     CAUSE:  The display value is being calculated incorrectly.

     RESOLUTION:  Modify "IOCW_COUNT" (hp3000_cpu_io.h) to sign-extend the
     12-bit count correctly to 16 bits, and modify "fprint_order" (hp3000_sys.c)
     to negate the values to display the counts as positive.  Also modify
     "mpx_interface" (hp3000_mpx.c) to display the correct count in the debug
     trace for the DREADSTB operation.

     STATUS:  Fixed in Release 3.


  2. PROBLEM:  An I/O reset does not clear a pending external interrupt.

     VERSION:  Release 2

     OBSERVATION:  A cold load begins with a CPU reset and an I/O reset.  A cold
     dump begins with an I/O reset only to preserve the CPU state for the dump
     operation.  The external interrupt flip-flop on the IOP is cleared by an
     I/O reset, which should clear the external interrupt bit in the CPX1
     register.  However, this does not occur, causing the interrupt generated by
     placing the tape drive online to be misinterpreted as the SIO program
     completion interrupt.  Because the SIO pointer is not set as expected, the
     cold dump microcode assumes that a tape error occurred and performs a
     retry.  This writes an erase gap at the beginning of the tape but otherwise
     produces a valid tape.

     CAUSE:  Oversight.

     RESOLUTION:  Add a new "iop_reset" routine (hp3000_iop.c) that is called
     during an I/O reset and that clears the external interrupt bit of the CPX1
     register.

     STATUS:  Fixed in Release 3.


  3. PROBLEM:  RESTORE of a file SAVEd with a different executable may abort the
     simulator.

     VERSION:  Release 2

     OBSERVATION:  Entering SAVE to save the simulator state on an executable
     compiled with one set of compiler options or compiler version and then
     entering RESTORE to restore the state on an executable compiled with a
     different set of compiler options or compiler version succeeds.  However,
     attempting to resume execution results in an access exception.

     CAUSE:  The simulator's internal Device Information Blocks contain pointers
     to the devices' I/O interface handlers, which are saved as part of the DIB
     structure in the simulator state file.  When restoring the state, the
     interface handler pointers are restored.  However, the addresses of one or
     more routines may have changed, due to differing memory layouts, so the
     restored values are no longer correct.  If they are not, and I/O is
     performed to the affected device(s), control transfers to an invalid code
     location.

     RESOLUTION:  Modify hp3000_io.h to add a new REG_DIB macro that defines the
     register entries needed to save the DIB state, and modify hp3000_atc.c,
     hp3000_clk.c, hp3000_ds.c, hp3000_lp.c, hp3000_mpx.c, hp3000_ms.c, and
     hp3000_scmb.c to change the REG entries referencing the DIB structures to
     use the REG_DIB macro.

     STATUS:  Fixed in Release 3.


  4. PROBLEM:  The LOAD command does not report "Cold load complete".

     VERSION:  Release 2

     OBSERVATION:  The LOAD command should report success after completion of a
     cold load operation, but it doesn't.  Instead, the SCP prompt returns with
     no indication of whether the command succeeded or failed.  Using the
     equivalent BOOT CPU command does print the expected "Cold load complete"
     message.

     CAUSE:  The "Cold load complete" message is printed by the simulator's
     "fprint_stopped" routine that is called via the "sim_vm_fprint_stopped"
     pointer from the "run_cmd_message" routine in SCP.  The latter is invoked
     via the "message" field of the command table.  The LOAD, DUMP, and POWER
     commands all invoke "sim_instr" via "run_cmd" but do not specify routine
     pointers for their message fields, so no completion messages are reported.

     RESOLUTION:  Modify "one_time_init" (hp3000_sys.c) to set the "message"
     fields of the LOAD, DUMP, and POWER commands to point at the same routine
     as is used by the system "CONTINUE" command.

     STATUS:  Fixed in Release 3.


  5. PROBLEM:  RESTOREing with the ATCD attached cancels active line services.

     VERSION:  Release 2

     OBSERVATION:  Doing a SAVE while the ATCD has line services scheduled,
     e.g., while outputting characters, and then following immediately with a
     RESTORE cancels the line services.  For example, after a SAVE, a SHOW QUEUE
     command prints:

       HP 3000 event queue status, time = 907247803
         CLK at 0
         ATCD unit 0 at 241
         CPU at 27917
         ATCD unit 16 at 27918
         DS unit 8 at 612615

     Entering RESTORE and then SHOW QUEUE prints:

       HP 3000 event queue status, time = 907247803
         CLK at 0
         CPU at 27917
         ATCD unit 16 at 27918
         DS unit 8 at 612615

     Note that ATCD unit 0 is no longer scheduled.

     CAUSE:  The "atcd_detach" routine is called during RESTORE if the listening
     port is currently attached in preparation for reattaching to the port
     specified in the SAVE file.  The routine detaches the listening port and
     then cancels each line to terminate any transfers in progress.  This is
     appropriate for DETACH ATCD and DETACH ALL, but not for RESTORE, as the
     terminal channels have already been rescheduled as indicated in the SAVE
     file, and canceling them hangs the channels.

     RESOLUTION:  Modify "atcd_detach" (hp3000_atc.c) to skip the channel
     termination loop if the SIM_SW_REST flag is set to indicate a RESTORE in
     progress.

     STATUS:  Fixed in Release 3.



=====================
Release 2, 2016-07-05
=====================

This release of the HP 3000 simulator adds the following device simulation:

 - 30209A Line Printer Controller with One 2607/13/17/18 Line Printer

The simulation supports the use of custom VFU tape images, as well as the
built-in HP-standard VFU tape.  The simulated device name is "LP".  The full set
of configurable options is detailed in a new section of the HP 3000 Simulator
User's Guide.

In addition, the preconfigured MPE V/R disc image has been updated to add the
following features:

 - The MPE cold load command files attach the line printer to the "lp.txt"
   output file and specify the "-n" option to clear the file before use.

 - Preinstalled User-Defined Commands (UDCs) provide access to the COBOL 74
   compiler with the MPE V/E :COBOLII, :COBOLIIPREP, and :COBOLIIGO commands,
   and to the COBOL 85 compiler with :COBOLIIX, :COBOLIIXPREP, and :COBOLIIXGO.
   However, see the implementation note below.


--------------------
Implementation Notes
--------------------

 - MPE requires a line printer, so it is recommended that the MPE startup
   simulator command file include an ATTACH LP <filename> command to load paper
   into the printer before cold loading.  If the printer is not attached, it
   will appear to MPE to be out of paper.

 - The line printer terminates each print line with an HP-standard CR/LF pair.
   If the output file is to be retained as a text file on a Unix system, removal
   of the carriage returns, e.g., via the "dos2unix" utility, may be desirable.

 - The simulator currently does not provide the HP 32234A COBOL II firmware
   instructions, so programs generated by the COBOLII compiler will abort at run
   time with an "ILLEGAL INSTRUCTION" error.  Programs generated by the COBOL
   compiler do not use these instructions and therefore are not affected.


----------
Bugs Fixed
----------

  1. PROBLEM:  The effective address of a byte pointer with a negative index is
     calculated incorrectly.

     VERSION:  Release 1

     OBSERVATION:  Defining a :WELCOME message in MPE appears to work, but when
     the next logon attempts to print the message, an infinite number of CRLFs
     are printed instead.

     CAUSE:  The welcome message is stored in an extra data segment.  The format
     for each message line is a line length stored in the lower byte of the word
     preceding the message string.  The code defines BYTE POINTER NEXTLINE and
     points NEXTLINE to the first message character.  The line length is set
     with NEXTLINE(-1) := IOCOUNT.  This generates a LOAD <IOCOUNT> ; LDXN 1 ;
     STB <NEXTLINE>,I,X sequence.

     In the "cpu_ea" routine, the indexing adds the X register value (-1) to the
     byte pointer (NEXTLINE).  This causes an overflow that is not masked to 16
     bits.  For a word access, this displacement is added to the base register
     and then masked to 16 bits, which gives the correct value.  However, for
     byte accesses, the displacement is divided by 2 and then added, and the sum
     is masked.  Dividing by 2 shifts the overflow bit into the MSB, causing the
     addition result to be off by 32K.  The STB goes to the wrong location, the
     original zero in the length byte location is retained, and when the welcome
     message is printed, a zero-length line is printed, and the byte pointer is
     incremented by zero, so the null line is printed forever.

     RESOLUTION:  Modify "cpu_ea" (hp3000_cpu.c) to mask indexed displacements
     to 16 bits after adding the X register value.

     STATUS:  Fixed in Release 2.


  2. PROBLEM:  An SMSK instruction may clear the interrupt mask flip-flop of a
     device that specifies that it is should be "always enabled."

     VERSION:  Release 1

     OBSERVATION:  If the TOS word is zero, an SMSK instruction will clear the
     interrupt mask flip-flop of a device whose mask jumper is set to "E"
     (always enabled).

     CAUSE:  In response to a DSETMASK signal, device interfaces set their
     interrupt mask flip-flops by "anding" the incoming data word with the
     interrupt mask jumper setting.  The jumper setting value for "always
     enabled" is %177777, which sets the mask flip-flop in all cases, except
     when the data word is zero.

     RESOLUTION:  Modify hp3000_atc.c, hp3000_ds.c, and hp3000_ms.c to set their
     mask flip-flops unconditionally if the jumper setting is "E".

     STATUS:  Fixed in Release 2.


  3. PROBLEM:  The "SET <dev> INTMASK=<n>" command sets the wrong bit in the
     device interface's interrupt mask jumper setting.

     VERSION:  Release 1

     OBSERVATION:  The interrupt mask jumper on a device interface is set by
     specifying the mask bit number in a "SET <dev> INTMASK=<n>" command.  This
     sets a bit in the device's interrupt mask jumper word corresponding to the
     bit number requested.  However, the bit numbering is incorrect; setting the
     jumper for bit 15, for example, sets bit 0 of the jumper word.  Therefore,
     the interface's mask flip-flop is not set as expected when an SMSK
     instruction is executed.

     CAUSE:  The bit numbers were counted from the wrong end of the word.

     RESOLUTION:  Modify "hp_set_dib" and "hp_show_dib" (hp3000_sys.c) to number
     the bits from the MSB instead of the LSB.

     STATUS:  Fixed in Release 2.


  4. PROBLEM:  The Multiplexer Channel is not generating the ACKSR signal
     correctly.

     VERSION:  Release 1

     OBSERVATION:  The line printer controller hangs when an SIO chained write
     is performed.  The first programmed write completes normally, but the
     second does not start.  The channel is waiting for a service request that
     does not occur.

     CAUSE:  The service request from the last write of the first block transfer
     is being cleared by an ACKSR generated by the Multiplexer Channel when it
     performs the IOCW fetch in State A for the second write request.  The
     channel should omit this ACKSR when the previous I/O order was a chained
     read or write.  However, the simulator is testing the order just fetched
     (Write) instead of the order that has just completed (Write Chained).

     RESOLUTION:  Modify "mpx_service" (hp3000_mpx.c) to test the correct I/O
     order in State A.

     STATUS:  Fixed in Release 2.



=====================
Release 1, 2016-03-07
=====================

This is the initial release of the HP 3000 simulator.  The following devices are
currently simulated:

 - 30003B Series III computer with up to 1024 KW of memory
 - 30003B I/O Processor
 - 30036B Multiplexer Channel
 - 30030C Selector Channel
 - 30033A Selector Channel Maintenance Board
 - 30032B Asynchronous Terminal Controller data interface
 - 30061B Asynchronous Terminal Controller control interface
 - 30135A System Clock/Fault Logging Interface
 - 30215A Tape Controller with four 7970B/E drives
 - 30229B Disc Controller with eight 7905/7906/7920/7925 drives

The "HP 3000 Simulator User's Guide" manual describes the configuration and
operation of each of these devices in detail.


--------------------
Implementation Notes
--------------------

 - IMPORTANT: There is no line printer simulation.  MPE cannot be configured to
   run without a printer; attempting to delete LDEV 6 produces "ERROR #115
   UNDEFINED CLASS LP USED AS OUTPUT DEVICE", and class LP cannot be deleted.
   With LDEV 6 present, MPE will boot and run, but doing, e.g., :STOPSPOOL 6
   causes "NON-RESPONDING DRT #14" and "SYSTEM FAILURE #201" when the printer
   doesn't respond.  Entering :OUTFENCE 14 at the console operator's session
   immediately after bootup is a workaround.  The LP simulator should be present
   in the next release.

 - The CPU is a hybrid of the Series II instruction set microcode and the Series
   III memory size and hardware behavior, because the Series III microcode is
   not available.

 - The CPU is currently missing a few "difficult" instructions (the CMD
   instruction, the Series II LOCK and UNLK instructions, and the entire
   Extended Instruction Set).  Although the EIS is not present, MPE has a
   software emulator for these instructions that is invoked transparently by the
   Unimplemented Instruction traps that occur when attempted execution of EIS
   instructions occurs.

 - The main memory Fault Logging Interface section of the 30135A is currently
   not simulated.  Although fault-control memory was standard on the Series II
   and later, the memory fault logger is smart enough to realize that the FLI is
   not there, so MPE will run without it.

 - Symbolic entry of CPU instructions, CPU status, and I/O instructions are not
   currently supported.
