Introduction
RT-11 was Digital’s single-user real-time operating system for the PDP-11. A program is a .SAV file: not a header and sections, but an
image of memory saved from address 0 upwards, in 512-byte blocks. The first block is the zero page: the first words of the PDP-11’s memory, which the monitor and the program share, and
which RT-11 calls the system communication area. The program’s code starts after it, normally at address 01000, and the monitor loads the file into memory as it is, reads a few words of the zero
page, and starts the program at the address in word 040.
A program asks the monitor for a service with the instruction emt (the programmed requests). The explorer disassembles the code
with the PDP-11 decoder, names the zero-page words and names each request.
Structure
The file is a whole number of 512-byte blocks, the memory image from address 0. Word n of memory is bytes n and n+1 of the file (little-endian). Block 0 holds the zero page; the program’s
blocks follow, up to the high memory limit (word 050). A file may hold more blocks than the high limit says: overlays, which the program reads from its own file when it needs them.
The zero page
The words below are described from the real programs: the 33 .SAV files of the RT-11 V4.0 disk image that ships with the PDP-11 emulator on this site (what they contain is stated for each),
and from the V4.0 system macro library SYSMAC.SML on the same disk. Locations are octal.
| Location | Word | What the real files show |
|---|---|---|
000–037 | trap and interrupt vectors | Two words (new PC, new PSW) for each of the vectors 0, 4, 10, 14, 20, 24, 30, 34 (the vectors). All zero in the files: the monitor fills them in. |
040 | start address | Where the program starts: even, between 0400 and the high limit in all 33 files (01000 in four of them). |
042 | initial stack pointer | SP when the program starts; the stack grows down from it. 01000 in 30 files, 0730, 01200 or 01400 in the other three; never above the start address. |
044 | job status word (JSW) | Flags of the job. Values seen: 0 (13 files), 0100 (1), 01000 (8), 020000 (7), 021000 (4). The meaning of the bits is not described here: no source was read for them. (A program in the disk’s FORTH sources sets bits 6 and 12 of this word before reading the terminal with .TTINR.) |
046 | USR load address | 0 in 31 files; DIR and SRCCOM set an address (06234 and 03316). |
050 | high memory limit | The highest address the program uses: even, at or above the start address, inside the file’s blocks. |
052 | (not described) | Zero in the files. |
054 | resident monitor pointer | The address of the resident monitor. The macro library’s .DRFIN reads it with MOV @#54,R5; it is zero in the files, so the monitor sets it when it loads the program. |
056 | (not described) | Zero in the files. |
360–377 | block bit map | Sixteen words: bit n is set when block n of the image is used. In the 33 files no more bits are set than the file has blocks (in 17 exactly as many; in 16 fewer: those carry overlays). |
The rest of block 0, from 0400, is free: it is where the stack lives (it grows down from 01000 towards 0400).
Recognising a .SAV file
There is no magic number, and .sav is also the extension of the saved games of hundreds of programs, so the explorer accepts a file as an RT-11 program only when all these rules hold, taken from the zero page of the real programs: the size is a whole number of 512-byte
blocks; the start address is even and at least 0400; the stack pointer is even, not zero, not in the I/O page and not above the start address; the high limit is even, not below the start address and inside the file; the first block is not mostly printable text; and the block bit map (0360 to 0377) has at least one bit set and no more bits than the file has blocks (true of all 33 real programs; random data sets about 64 bits).
Measured false claims: none in 500,000 random files of 512, 1,024, 2,502, 4,722 and random sizes, none of the 230 other .sav files found on one Mac (Civilization II, Tyrian, SPSS-style data, a virtual machine configuration), and all 33 real programs accepted; a file built to pass the cheap rules (mostly zeros with a plausible start, stack and limit) is accepted, so the rules prove nothing against a deliberate lookalike.
A file that fails one of them stays what it was (Tyrian saves are still Tyrian’s). The rules are a test, not a proof: a file that is not a program could pass them, and a program the rules do not fit would be refused.
In the explorer
The viewer shows block 0 field by field and as a table, the program image, the blocks beyond the high limit (overlays), and the program disassembled from address 01000 (or the start address, if lower) to the high limit, with the start address as the entry. The words
040 to 054 are named in the listing (START, STACK, JSW, USR, HIGH, RMON) and every emt carries the request it makes, using the mov #n,r0 before it. The decoder was checked by running the 33 real programs, instruction by instruction, in a PDP-11 emulator core.
Not described
Known, not yet covered
- Reference: the bits of the job status word, the other words of the system communication area (
052,056and060to357), the overlay mechanism, the.REL,.SYSand.BOTfiles, and the RT-11 file system around the programs. - Reference: RT-11 versions after V4.0 (their programmed requests and extended memory forms were not read).
- Viewer: every even address in the code range is decoded as an instruction; data is not told from code; the overlays are bytes.
Unknown
- What the zero-page words other than 040 to 054 and the bit map hold in programs that use them.
Links
Reference
- PDP-11 instruction set – the processor
- pdp11-js – Paul Nankervis’s PDP-11/70 emulator; its RK05 disk image carries RT-11 V4.0, whose programs and macro library were read for these pages