[TNO-logo]

Control Data 6000 series
CPU instructions

Instruction Operation Variable Description
0000K PS K Program stop
0100K RJ K Return jump to K
011jK RL Bj+/-K Block copy K plus (Bj) words from SCM to LCM
CYBER 76, 7600 and 176 only
011jK RE Bj+/-K Read Extended Core Storage (ECS)
012jK WL Bj+/-K Block copy K plus (Bj) words from LCM to SCM
CYBER 76, 7600 and 176 only
012jK WE Bj+/-K Write Extended Core Storage (ECS)
013jK XJ Bj+/-K Central Exchange jump to (Bj)+/-K
014jK RXj Xk Read LCM at (Xk) to Xj
CYBER 76, 7600 and 8x5 systems only
015jK WXj Xk Write (Xj) into LCM at (Xk)
CYBER 76, 7600 and 8x5 systems only
01600-
01777
various   Various instructions for 76-types
02i0K JP Bi+K Jump to K + (Bi)
030jK ZR Xj,K Jump to K when (Xj) = 0
031jK NZ Xj,K Jump to K when (Xj) <> 0
032jK PL Xj,K Jump to K when (Xj) sign is plus
033jK MI or NG Xj,K Jump to K when (Xj) sign is minus
034jK IR Xj,K Jump to K when (Xj) in range
035jK OR Xj,K Jump to K when (Xj) not in range
036jK DF Xj,K Jump to K when (Xj) definite0
037jK ID Xj,K Jump to K when (Xj) indefinite
0400K EQ K (unconditional) jump to K
04ijK EQ Bi,Bj,K Branch to K when (Bi) = (Bj)
04i0K ZR Bi,K Branch to K when (Bi) = 0
05ijK NE Bi,Bj,K Branch to K when (Bi) unequal (Bj)
05i0K NZ Bj,K Branch to K when (Bi) non-zero
06ijK GE Bi,Bj,K Branch to K when (Bi) >= (Bj)
06i0K EQ Bi,Bj,K Branch to K when (Bi) >= 0
06ijK LE Bj,Bi,K Branch to K when (Bj) <= (Bi)
060jK LE Bj,K Branch to K when (Bj) <= 0
07ijK LT Bi,Bj,K Branch to K when (Bi) < (Bj)
07i0K LT or NG Bi,K Branch to K when (Bi) < 0
07ijK GT Bj,Bi,K Branch to K when (Bi) > (Bj)
070jK GT or MI Bj,K Branch to K when (Bi) > 0
10ijj BXi Xj Copy (Xj) to Xi
11ijk BXi Xj*Xk Logical product (AND) of (Xj) and (Xk) to Xi
12ijk BXi Xj+Xk Logical sum of (Xj) and (Xk) to Xi
13ijk BXi Xj-Xk Logical difference of (Xj) and (Xk) to Xi
14ijj BXi -Xj Copy complement of (Xj) to Xi
15ijk BXi -Xk*Xj Logical product of (Xj) and complement (Xk) to Xi
16ijk BXi -Xk+Xj Logical sum of (Xj) and complement (Xk) to Xi
17ijk BXi -Xk-Xj Logical difference of (Xj) and complement (Xk) to Xi
20ijk LXi jk Logical shift (Xi) by jk (left shift)
21ijk AXi jk Arithmetic shift (Xi) by jk (right shift)
22ijk LXi Bj, Xk Logical shift (Xk) by (Bj) to Xi
22iji LXi Bj Logical shift (Xi) by (Bj) to Xi
22i0k LXi Xk Transmit (Xk) to Xi
23ijk AXi Bj, Xk Arithmetic shift (Xk) by (Bj) to Xi
23iji AXi Bj Arithmetic shift (Xi) by (Bj) to Xi
23i0k AXi Xk Transmit (Xk) to Xi
24ijk NXi, Bj Xk Normalize (Xk) to Xi and Bj
24i0i NXi   Normalize (Xi) to Xi
24iji NXi, Bj   Normalize (Xi) to Xi and Bj
24i0k NXi Xk Normalize (Xk) to Xi
25ijk ZXi, Bj Xk Round and normalize (Xk) to Xi and Bj
25i0i ZXi   Round and normalize (Xi) to Xi
25iji ZXi, Bj   Round and normalize (Xi) to Xi and Bj
25i0k ZXi Xk Round and normalize (Xk) to Xi
26ijk UXi, Bj Xk Unpack (Xk) to Xi and Bj
26i0i UXi Unpack (Xi) to Xi
26iji UXi, Bj   Unpack (Xi) to Xi and Bj
26i0k UXi Xk Unpack (Xk) to Xi
27ijk PXi Xk,Bj Pack (Xk) and (Bj) to Xi
27i0i PXi Pack (Xi) to Xi
27iji PXi Bj; Pack (Xi) and (Bj) to Xi
27i0k PXi Xk Pack (Xk) to Xi
30ijk FXi Xj+Xk Sum of (Xj) plus (Xk) to Xi
31ijk FXi Xj-Xk Difference of (Xj) minus (Xk) to Xi
32ijk DXi Xj+Xk Double-precision sum of (Xj) plus (Xk) to Xi
33ijk DXi Xj-Xk Double-precision difference of (Xj) minus (Xk) to Xi
34ijk RXi Xj+Xk Rounded sum of (Xj) plus (Xk) to Xi
35ijk RXi Xj-Xk Rounded difference of (Xj) minus (Xk) to Xi
36ijk IXi Xj+Xk Integer sum of (Xj) plus (Xk) to Xi
37ijk IXi Xj-Xk Integer difference of (Xj) minus (Xk) to Xi
40ijk FXi Xj*Xk Product of (Xj) times (Xk) to Xi
41ijk RXi Xj*Xk Rounded product of (Xj) times (Xk) to Xi
42ijk IXi Xj*Xk Integer product of (Xj) times (Xk) to Xi
42ijk DXi Xj*Xk Double-precision product of (Xj) times (Xk) to Xi
43ijk MXi jk Mask of +/-jk bits to Xi
44ijk FXi Xj/Xk Divide(Xj) by (Xk) to Xi
45ijk RXi Xj/Xk Rounded divide (Xj) by (Xk) to Xi
46000 NO   No-operation
47ikk CXi Xk Population count of (Xk) to Xi (see note)
50ijK SAi Aj+K (Aj) plus K to Ai
51ijK SAi Bj+K (Bj) plus K to Ai
51i0K SAi K K to Ai
52ijK SAi Xj+K (Xj) plus K to Ai
53ijk SAi Xj+Bk (Xj) plus (Bk) to Ai
53ij0 SAi Xj (Xj) to Ai
54ijk SAi Aj+Bk (Aj) plus (Bk) to Ai
54ij0 SAi Aj (Aj) to Ai
55ijk SAi Aj-Bk (Aj) minus (Bk) to Ai
56ijk SAi Bj+Bk (Bj) plus (Bk) to Ai
56ij0 SAi Bj (Bj) to Ai
57ijk SAi Bj-Bk (Bj) minus (Bk) to Ai
57i0k SAi -Bk Minus (Bk) to Ai
60ijK SBi Aj+K (Aj) plus K to Bi
61ijK SBi Bj+K (Bj) plus K to Bi
61i0K SBi K K to Bi
62ijK SBi Xj+K (Xj) plus K to Bi
63ijk SBi Xj+Bk (Xj) plus (Bk) to Bi
63ij0 SBi Xj (Xj) to Bi
64ijk SBi Aj+Bk (Aj) plus (Bk) to Bi
64ij0 SBi Aj (Aj) to Bi
65ijk SBi Aj-Bk (Aj) minus (Bk) to Bi
660jk CR Xj,Xk Read central memory
8x5 models only
66ijk SBi Bj+Bk (Bj) plus (Bk) to Bi
66ij0 SBi Bj (Bj) to Bi
670jk CW Xj,Xk Write central memory
8x5 models only
67ijk SBi Bj-Bk (Bj) minus (Bk) to Bi
67i0k SBi -Bk (Bj) to Bi
70ijK SXi Aj+K (Aj) plus K to Xi
71ijK SXi Bj+K (Bj) plus K to Xi
71i0K SXi K K to Xi
72ijK SXi Xj+K (Xj) plus K to Xi
73ijk SXi Xj+Bk (Xj) plus (Bk) to Xi
73ij0 SXi Xj (Xj) to Xi (18 bit transfer!)
74ijk SXi Aj+Bk (Aj) plus (Bk) to Xi
74ij0 SXi Aj (Aj) to Xi
75ijk SXi Aj-Bk (Aj) minus (Bk) to Xi
76ijk SXi Bj+Bk (Bj) plus (Bk) to Xi
76ij0 SXi Bj (Bj) to Xi
77ijk SXi Bj-Bk (Bj) minus (Bk) to Xi
77i0k SXi -Bk (Bj) to Xi
CMU:      
4640K IM K Move indirect data to word at K
464jK IM Bj+K Move data to word at (Bj)+K
464j000000 IM Bj Move data to word at (Bj)
4650K DM K Move direct data to word at K
466 CC & Compare collated
467 CU & Compare un collated

 

Legenda  
0, i,j,k Register numbers
K 18 bit address field
(Bi) value in 18-bit register Bi
(Xi) value in 60-bit register Xi
jk 6 bit value

Logical operations

Note about Pop-count or "sideways add" [from]:

Seymour Cray's first supercomputer (the Control Data 6600) sported such an instruction, as did all subsequent Control Data machines until the advent of the 180 series in the mid '80s. It was almost a tradition that one of the first of any new faster CDC machine was delivered to a "good customer" - picked up at the factory by an anonymous truck, and never heard from again. We always wondered what such an instruction might be useful for - until one of the first of the 180 series (n'th generation successor to the 6600) was delivered to such a customer, and cries of anguish erupted that this machine didn't have such an instruction. We scrambled and had to create a very tight code sequence within the instruction stack that could be generated via a Fortran intrinsic function. Simon Lavington also mentions in his book that the venerable 6600 inherited some ideas from the Manchester Atlas. I never found out what specifically - did the Atlas sport such an instruction? - perhaps also inherited from Mark I? I'm not sure if Cray's other machines (built after he left Control Data) had such an instruction, but I'm told they did.

However, and without boring through detail, I can perhaps give a flavor of how it was used a long time ago and in a manner that is interesting from a cryptanalysis perspective - and given that it jibes with similar discussion in the papers mentioned above. In one of the first "interactive" environments supported on the 6600 - the Intercom time-sharing system, we had a utility that allowed one to search a text file for some arbitrary character string - much as any text editor allows today.
This was implemented approx. as follows. Each line of text in the file had appended to it a 60-bit word, the contents of which were a bit vector. If there were one or more of the letter "A" in the line, bit 1 was set, if there were one or more of the letter "B" in the line, then bit 2 was set, etc... thus setting some sub-set of 36 bits corresponding to the characters A..Z and 0..9.
Let's call this word appended to each line its "thumbprint". There are 24 bits left - more about that later. Now to search for any line containing some search string, all you have to do is create a similar thumbprint for the search string, and loop through the thumbprints of the lines in the text file, checking each against your search thumbprint. "Checking" in this sense means doing a logical "AND" between the two to extract matching bits, and then counting how many bits matched - hence the pop-count instruction. A "hit" would of course only be tentative. It does not tell you that the line in question contains the actual string you are looking for - only that the line contains somewhere some (count of) the characters contained in your search string.
This little loop could however be coded in an extremely tight manner to fit in the instruction stack (equivalent to instruction cache in today's technology) thus allowing a very fast winnowing of interesting text lines that can then be examined more closely. The actual instructions used within the loop also made good use of the parallelism offered by the separate functional units of the 6600 cpu - and in later machines - pipelining. The extra 24 bits were used in other applications (of similar ilk) to reflect not single characters, but the occurrence of certain digraphs in the text line. Thus bit 40 in the thumbprint might indicate whether a given "interesting" digraph did or did not occur in a given line. Later the border between the 36 bits and 24 bits within the 60-bit word was moved and successively tuned. Certain bits of the original 36 were commoned up - i.e. a particular bit might indicate the presence of any of Z, X, or Q because maybe they are relatively uncommon. This would free up two more bits for use as digraph flags - and so on. Then, in another place, the whole mechanism was turned on its head. It wasn't used to *look for* a certain character string, but rather to *reject* certain lines of text as being uninteresting (others might use the word "implausible" here.) The concept of a thumbprint per "line of text" was refined to support differing granularity of the thumbprinting, and of course the size of the thumbprint itself, as 64 bits became a more common word-size.
Some thirty years later, I find the paper cited by Steve Bellovin on "Probable Plaintext Cryptanalysis" to be extrememely interesting - in particular it cites another paper about "A Programmable Plaintext Recognizer". This is the only open documentation I have ever come across that discusses this kind of mechanism in any detail. .

Jitze Couperus, Control Data Systems

For years, I had heard the story about National Security Agency (NSA) liking that instruction. But I never understood why, until I started working on plaintext recognizers, and independently derived the need for it. There are other instruction types that are useful for cryptanalysts. The CDC Star had a lovely set of vector operations under masks. And the Harvest add-on to the IBM 7030 (Stretch), described in a book by Buchholz ("Planning a Computer System", McGraw-Hill, 1962) was intended for NSA as well.

Steve Bellovin

For what it's worth, the same instruction was taken out of the widely-released versions of the Digital Equipment VAX, at the request of the NSA. Allegedly, there were versions that had the opcode in the machine for that same customer.

Jon Callas


CPU Error Modes

Error modes were the most frustrating errors that could occur to a programmer. It meant that the system detected one of the following errors or a combination thereof:
4 = Indefinit operand
2 = Operand out-of-range
1 = Address out-of-range

 



Museum logo