TLCS-900/H Instruction Set – Status and what is not described

Documented, reserved and illegal encodings, the check results and the open questions

Statuses

StatusMeaningShown as
documentedAn encoding of the instruction set as the decoder knows it (the first-byte map and the second-byte maps of the opcode maps), with a defined operand.no highlight
reservedThe bytes decode and have a length, but the combination is outside the definition: a block instruction (LDI, CPI…) with a prefix other than the ones it is defined with, RET cc with a prefix other than $B0, a register code that names no register of the size, a post-increment or pre-decrement step code of 3, an LDX whose zero bytes are not zero. RACE decodes some of them anyway (312 of them) and rejects others (512), so no one behaviour is claimed.reserved highlight and a note
illegalAn undefined encoding: the first byte $1F, $50–$57, $C6, $D6, $E6, $F6, or a prefix with a second byte that its class does not define. The CPU takes the illegal-instruction trap (the vector is not listed here); the viewer shows a one-byte .BYTE and decodes the next byte on its own.illegal highlight

The viewer adds a column with the status in words as well as the colour, and the legend on the page of a ROM lists the statuses present in the region.

Differences between the decoder and the RACE core

Running every encoding in the RACE core found these places where the core does something other than the decoder declares. The decoder follows its reading of the manual; each is a place where a different source could settle it.

InstructionRACE doesThe decoder declares
INC, DEC on a word in memorysets S Z H V Nno flag changes for a word or long operand (the register forms of RACE agree)
RLD, RRDclears CC unchanged
MULA with a $C7/$D7/$E7 register codealways uses the register of the low 3 bits of the first byte, so the code is ignoredthe register of the code
CCF, ZCFH unchangedH undefined (?): the decoder’s first reading, that H takes the old C, did not agree with RACE and could not be settled
BIT, TSETS and V unchangedS and V undefined (?)
Register slot 1A after $C7, $C8–$CFa BIOS-call hook of the emulatorundefined (not an instruction)
Block instructions with prefixes other than $83/$85/$93/$95takes the pointer pair from bit 1 of the prefix (any prefix works); the word forms are defined only for prefixes $90–$97, not $98–$9Freserved with the same length

Check results

  • Definedness against RACE’s dispatch tables (read from tlcs900h.c): 256 first bytes and 39,424 (prefix, operand form, second byte) combinations: 0 differences apart from the register-table slot 1A (10 combinations).
  • Execution in RACE: 131,652 runs of 29,370 encodings from random states: 129,076 length checks (the PC after the instruction, or the decoder’s target address for a branch), 357,624 comparisons of the registers, flags and memory RACE changed with what the decoder declares written (0 failures apart from the differences above), and 528 checks that each flag the decoder declares changed did change in some run.
  • Real code: 800,000 instructions of the two Neo Geo Pocket Color homebrew ROMs Snake and Fractal executed in RACE (29 different mnemonics): each decoded from the bytes at the PC, 0 undefined, 0 reserved, 0 wrong lengths or targets.

What this cannot show: RACE and the decoder could share a misreading of the manual, since both come from the same documentation. The decoder’s names (which register an encoding means) are checked only through the registers RACE changes, and the flags only in the direction of RACE’s behaviour.

Not described

Known

  • The instruction lengths and operand forms of every encoding listed on the opcode maps (confirmed by running them).
  • The register banks, the register codes and the status register layout, as used by the RACE core.
  • The memory operand forms, including the step of the pre-decrement and post-increment forms.

Unknown

  • Cycle (state) counts: none are given. RACE has numbers, but they are an emulator’s, not a manual’s.
  • The TLCS-900/L (the older core of the TMP96C series) is not covered: no source for its differences was found, so the decoder has one variant, the /H.
  • The manual itself: no Toshiba manual could be read here (the data sheet is named, not read). The flag effects of the less common instructions and the one-line semantics are from memory and RACE.
  • The illegal-instruction trap and the interrupt vector layout of the TMP95C061 are not described; a CALL or SWI is shown without its stack frame.
  • MAX mode and the DMA control registers beyond their names.
  • Pair registers of byte MUL/DIV: the table says which register RACE uses for each 3-bit code; whether the manual defines the odd and even codes the same way was not confirmed.
  • Absent in RACE but possibly defined by the manual: CP (mem),#3 and other forms RACE leaves undefined cannot be told from the manual here, so they are shown as illegal.