PDP-11 Instruction Set

Introduction

The PDP-11 is Digital Equipment Corporation’s 16-bit minicomputer, introduced in 1970 and built in many models for twenty years. UNIX was written on it, and so were RT-11, RSX-11 and RSTS/E. It has eight 16-bit registers (R6 is the stack pointer and R7 the program counter), byte-addressable memory in which a word sits at an even address, and an instruction set built around two ideas: every operand is named by the same 6-bit field of three bits of mode and three bits of register, and the program counter is just another register, so immediate, absolute and relative addressing need no extra machinery.

An instruction is one 16-bit word, stored low byte first, followed by up to two operand words (one for each operand that is an immediate, absolute, relative or indexed form). So it is 2, 4 or 6 bytes long and always starts at an even address. The explorer’s disassembler decodes at every byte, as it does for the other processors; a byte at an odd address is shown as a one-byte misaligned entry.

The pages: registers, the status word and memory, the eight addressing modes, the instructions, the floating-point instructions, the opcode map and the differences between models. Each instruction has an anchor, so a disassembled instruction links to its entry. The decoder is also used for the processor in ELF files (machine 23) and for the UNIX a.out and RT-11 .SAV programs, once those pages exist: see in the explorer.

Statuses

The explorer marks each word with a status:

Status	Meaning
Documented	An instruction of the model chosen in the options.
Not in this model	An instruction of another model (the EIS on an 11/20, SPL on an 11/40, MFPS on an 11/70): on the chosen model it is a reserved instruction and traps through vector 10. The text is still the instruction’s.
Reserved	A word that no model of the decoder defines. It traps through vector 10 on the machine that was read for this work (the emulator core), and is shown as `.word`.
Illegal	An instruction with an operand it does not allow: `jmp r0` and `jsr pc,r0` (a register has no address) trap through vector 4; a floating-point operand in mode 0 that names R6 or R7 raises floating-point error 2.
Odd address	A byte at an odd address: an instruction cannot start there.

There are no instructions that jam the processor, and none the sources read call undocumented but useful. The one-instruction behaviour of the reserved words is that of the emulator core, which may differ from a real model (see the models page).

Notation

The default is DEC’s MACRO-11: lower-case mnemonics, # for immediate, @ for deferred, @# for absolute, and numbers in octal as the PDP-11 world writes them: mov #5,r0, mov (r1)+,-(sp), mov @#177564,r0, mov 4(r5),r1, jsr pc,@#2000. A branch, a jmp and a PC-relative operand are shown as the address they name (not the offset). The options of the viewer are:

Model: which instructions are available (all by default: the union of the models; see models).
Syntax: MACRO-11 or the UNIX assembler as ($5 immediate, * deferred, *$addr absolute, sys for trap, movf for ldf and stf).
Numbers: octal (default) or hexadecimal (0x1f).

In the explorer

The decoder is our own, written from the instruction set as the handbooks describe it. It was checked against two other things: the PDP-11/70 emulator core of Paul Nankervis, which executed every one of the 65,536 instruction words in several operand contexts and was compared for length, branch target, trap vector, registers written, condition codes changed and memory touched; and the small PDP-11 disassembler of this site’s debugger, which agrees on every word it knows. Two opcode tables, written separately from the handbook layout, agree with the decoder and with each other on all 65,536 words. The checks cannot say what a model other than the 11/70 does: the other models’ instruction sets come from the sources named under Links.

Not described

Known, not yet covered

Reference: cycle counts and instruction timing (they differ for every model; none is given), the memory-management unit and the unibus map, the I/O page devices, the trap and interrupt sequence in detail, and the commercial instruction set (CIS) of the 11/23 and 11/44: the words 076000–076777 are shown as reserved.
Reference: the models LSI-11, F-11 (11/23), T-11, 11/04, 11/34 and 11/44 as separate choices: only the 11/20, 11/40, 11/70 and J-11 are listed.
Viewer: every even offset is decoded as code; code is not told from data and jumps are not followed; the floating-point mode (F or D) changes nothing in the listing, so SETD and SETF are not tracked.

Unknown

Reference: what the reserved words do on a real model (several early models executed some of them), and the exact flags of CSM, TSTSET and WRTLCK.
Reference: the model that each of MARK, SXT, XOR, MFPI and the others first appeared in was taken from sources that disagree in places (see models); the 11/34 and 11/35 are not separated from the 11/40.