dbrll/ll-34Circuit-level PDP-11/34 emulator
ll/34 is a circuit-level emulator for the PDP-11/34A (1976), running a virtual CPU reverse-engineered from the schematics, microcode, and logic captures of an actual PDP-11/34A.
It was originally designed as a digital replica of the real CPU to assist with troubleshooting at the signal level. Circuit-level (ROM truth tables + combinatorial logic) was chosen over gate-level (Verilog) because it is low-level enough to reproduce hardware bugs, yet fast enough to run programs.
The source tree is organized as follows:
| Directory | Description |
|---|---|
pdp11/ | The machine: CPU, UNIBUS, peripherals, boot ROM, programmer console model, logic analyzer probe. machine.c assembles and runs it. |
frontends/ | User interfaces: cli/ (terminal), wasm/ (browser GUI), tty/ (host side of the serial line). |
demos/ | Disk images and programs. |
docs/ | DEC documentation. |
The virtual CPU (pdp11/kd11ea/) replicates the clock generator, logic gates and ALU (simulated in C logic), stepping through the original microcode dumped from the ROMs.
It is composed of the following components:
| File | Description |
|---|---|
roms/ | ROM dumps (combinational and microcode). |
kd11ea.c | CPU core. Steps through the microcode one micro-word per cycle. The 74xx gates and 74S181 bit-slice ALUs are modeled here. |
rom_wiring.h | Address wiring and output decoding for the combinatorial ROMs. |
ucode_rom.h | Documents and assembles the CPU microcode into 512×48-bit micro-words. |
clockgen.c | Clock generator. Models the original delay line pacing the CPU. |
mmu.c | Memory management. Kernel/user address spaces, and the 16-bit to 18-bit memory translation. |
int.c | Interrupt arbiter. Implements the priority queue and approximates the UNIBUS daisy-chain grant order. |
clock.c | Internal emulator clock. Keeps simulated time in sync with wall-clock time. |
The following devices have been implemented. As the Unibus is asynchronous, not all devices need to be timing or signal accurate.
The Programmer Console, in particular, uses a high-level emulation of its behavior rather than a low-level reconstruction of the Intel 8008 and wiring from its board.
Devices are plugged into the UNIBUS backplane (unibus.c), which performs address decoding, timing, and bus cycles.
The Programmer Console emulates the front panel switches and indicators of the PDP-11/34A. It allows initializing the bus, booting the CPU, single-stepping through code, examining and depositing data at arbitrary addresses, and quitting the emulator.
The console automatically spawns whenever the CPU is halted (power-up, HALT instruction, or Ctrl-P).
The frontend is decoupled from the engine, so a photorealistic front panel GUI is also provided in WebAssembly.
The Debug Console provides an interactive debugger for both microcode-level and instruction-level code:
s [n]: single-step n micro-instructions with full state dump (MPC, ALU, bus, registers)b addr: set PC breakpoint (octal), bl to list, bd n to deleteg: resume executionu [addr] [n]: disassemble instructionsc [addr] [n]: memory dump (octal)mmu: show MMU state (kernel + user PAR/PDR, current mode marked)r: register dump
Debug console in the Web Assembly GUI.
Troubleshooting ll-34 during its development turned out to be so similar to troubleshooting the real hardware that an internal logic analyzer was implemented to trace the signals and probe the datapath. This proved instrumental in tracking down subtle ROM and timing bugs in the virtual CPU.
The logic analyzer allows the probing of 107 signals, including 72 from the DEC schematics, 31 composite signals (registers, buses and flags), and 4 timing values from the emulator. Future versions will allow the capture of most signals from the schematics.
Sample rate is the real-time CPU clock (5,555,556 Hz) with a resolution of 180 ns per sample. A configurable divider reduces the sample rate for longer capture windows.
Captures use a ring buffer (up to 64K samples) with configurable trigger on any signal, adjustable trigger position (pre/post ratio), and CSV export for offline analysis.
ll-34’s logic analyzer (bottom) can be used to troubleshoot the real hardware (top), just as the real hardware was used to troubleshoot ll-34.
ll-34 comes with a few programs and systems to try: a Game of Life, V6 UNIX, RT-11 V4 with the original Tetris game, and ATTN/11, a small trainable Transformer with self-attention.
./ll-34 --rk ./demos/rtv4_rk.dsk
The boot ROM will automatically load from the RK11 and start the operating
system. DIR will list files, HELP will print help, RUN TETRIS
will start the Tetris demo (although the $TERM will probably be wrong?).
RUN ADVENT will start the Colossal Cave Adventure,
built on a real PDP-11/34.
./ll-34 --rk ./demos/v6bin.rk
The bootloader will print a minimal @ prompt. Type rkunix and
hit enters and a few seconds later you should get a login: prompt.
Enter the username root with no password and you're in!
One note is that cd is named chdir in early UNIX.
make + a C11 compiler, there are no other dependencies.
Verified to compile with no warnings on Linux (x86_64 and aarch64) with both musl and glibc, macOS aarch64, and NetBSD 10 aarch64.