title: T81 Foundation Specification — TISC nav:
Version 1.1 — Stable
Status: Stable
Last Revised: 2026-03-01
Applies to: T81VM, T81Lang, Axion, Cognitive Tiers
Freeze Exception — 2026-03-01
Scope: Additive corrections only — no existing opcode semantics changed.
Authorized by: @t81dev
Rationale: §5.14 adds seven bitwise opcodes (BITAND, BITOR, BITXOR, BITNOT, BITSHL, BITSHR, BITUSHR) that are implemented in the VM and emitted by the T81Lang compiler’s lowering pass but were absent from the normative spec, causing external readers to miss valid instruction-set surface.
This document defines the Ternary Instruction Set Computer (TISC) for the T81 Ecosystem.
It is normative for all instruction encoding, execution semantics, and VM integration.
T81 is a ternary semantic architecture executed on binary hardware. This is an intentional architectural layer. TISC operates semantically as a ternary computer, yet the implementation relies on 2-bit packed trits and SWAR vectorization to interface with the binary substrate of host systems. This approach achieves maximum performance on x86 and ARM while preserving bit-exact, deterministic ternary state.
TISC MUST satisfy:
Deterministic Execution
Each instruction has a single, total, unambiguous semantic definition.
Base-81 / Balanced Ternary Semantics
Arithmetic and logic are ternary-native; binary implementation shortcuts MUST NOT change observable behavior.
Zero Undefined Behavior
Every operand combination either:
Axion Visibility
All state changes, faults, and privileged operations MUST be observable by the Axion kernel.
Layer Compatibility
TISC must:
The abstract TISC machine state is:
STATE = (R, PC, SP, FLAGS, MEM, META)
R — Register file (mandatory architectural window R0–R80, with optional implementation-defined extension banks)PC — Program counterSP — Stack pointerFLAGS — Condition flags and ternary statusMEM — Memory segments (code, stack, heap, tensor, meta)META — Axion-visible metadata (trace, tags, fault history)The T81VM is responsible for hosting and evolving this state; TISC defines how each instruction transforms it.
A simple TISC program to add two numbers might look like this:
; Load the integer value 5 into register R0
LOADI R0, 5
; Load the integer value 10 into register R1
LOADI R1, 10
; Add the values in R0 and R1, store the result in R2
ADD R2, R0, R1
; Halt the machine
HALT
; Floating point arithmetic
LOADI R0, 1.5 ; Load float handle
LOADI R1, 2.5 ; Load another float handle
FADD R2, R0, R1 ; R2 = 4.0 handle
; Comparison and conditional jump
LOADI R3, 10
CMP R2, R3 ; Compare 4.0 with 10
JN label_less ; Jump if negative (4.0 < 10)
HALT
label_less:
LOADI R4, 1
HALT
; Assuming handles are pre-loaded or created via language frontend
LOADI R1, 1 ; Tensor handle 1
LOADI R2, 2 ; Tensor handle 2
TVECADD R0, R1, R2 ; Elementwise vector add
HALT
; main entry
LOADI R0, 42 ; Argument for function
PUSH R0 ; Push argument to stack
LOADI R1, label_func ; Function address
CALL R1 ; Call function
POP R2 ; Pop result from stack (assuming ABI uses stack for return)
HALT
label_func:
POP R3 ; Pop argument from stack
LOADI R4, 1
ADD R5, R3, R4 ; result = arg + 1
PUSH R5 ; Push result to stack
RET ; Return to caller
; Read current instruction count from Axion
; IMM_TAG 0: Instruction Count (hypothetical tag)
AXREAD R0, 0
; Set a new stack limit for current context
; IMM_TAG 1: Max Stack Depth (hypothetical tag)
LOADI R1, 1024
AXSET 1, R1
; Verify current state against ethical constraints
AXVERIFY R2
JZ R2, label_unsafe ; If result is zero (fail), jump to handler
HALT
label_unsafe:
TRAP 1 ; Trigger security trap
HALT
TISC defines a mandatory architectural register window of 81 registers,
indexed R0 through R80.
R0: Hardwired zero.R1–R74: General-purpose registers. Specific caller- and callee-save conventions are defined at the ABI level.Registers R75 through R80 form the fixed Axion System Window. These registers are managed by the VM and Axion kernel to provide high-visibility architectural state.
| Register | Purpose |
|---|---|
| R75 | Global Tick |
| R76 | Lineage Root Hash |
| R77 | Current Entropy Signature |
| R78 | Active Constitutional Mask |
| R79 | Recursion Depth Counter |
| R80 | Axion Seal / Capability Word |
Any attempt by unprivileged instructions to directly modify registers in the
R75–R80 range MUST be ignored or trigger a deterministic Security Fault,
depending on the active Axion policy.
Implementations MAY expose additional internal registers beyond R80
(for example, implementation-local scratch/context banks), but they are
non-portable and outside the mandatory architectural contract.
Requirements:
R0–R80 MUST remain unchanged and portable.R0–R80.R0–R80.Memory is a flat, addressable ternary space partitioned into segments:
The exact physical representation is implementation-defined, but:
For the current canonical runtime/toolchain profile (v1.1), each TISC instruction is encoded as a fixed-width 13-byte record:
[ OPCODE:u8 | A:i32 | B:i32 | C:i32 ] // little-endian i32 operands
OPCODE — instruction selector (uint8_t)A, B, C — signed 32-bit operandsThe byte-level encoding above is the normative interchange representation used
by encode/decode in the current implementation profile.
Conceptual ternary field decompositions MAY still be used for architectural reasoning, but they MUST map deterministically to the canonical 13-byte form.
Decoding requirements:
T81’s long-term direction includes native ternary instruction-word execution. To preserve compatibility and auditability during that transition:
R0–R80 and opcode behavior MUST remain unchanged across
encoding profiles.This section defines the normative opcode classes and their semantics. Implementations MAY add extensions via future RFCs but MUST NOT alter existing behavior.
For each instruction:
Operands specify input/output registers or memory locationsSemantics define the exact state transitionFaults specify when a deterministic fault MUST occurR[x] — value in register xMEM[a] — value at memory address a→ — denotes state transition⊥ — denotes a deterministic faultAll arithmetic uses T81BigInt semantics unless otherwise noted. Registers that
refer to T81Float or T81Fraction values SHALL contain canonical pool
handles (1-based indices into the literal/value pools defined by the program
image). Any opcode that dereferences a handle MUST fault with
IllegalInstruction if the handle is zero, negative, or out of range.
ADD RD, RS1, RS2R[RD] := canonical(R[RS1] + R[RS2])SUB RD, RS1, RS2R[RD] := canonical(R[RS1] − R[RS2])MUL RD, RS1, RS2R[RD] := canonical(R[RS1] × R[RS2])DIV RD, RS1, RS2R[RS2] = 0 → fault.
Else: R[RD] := canonical(trunc_div(R[RS1], R[RS2]))MOD RD, RS1, RS2R[RS2] = 0 → fault.
Else: R[RD] := canonical(R[RS1] mod R[RS2])NEG RD, RSR[RD] := canonical(−R[RS])INC RD / DEC RDINC: R[RD] := canonical(R[RD] + 1)
DEC: R[RD] := canonical(R[RD] − 1)FADD RD, RS1, RS2 (and analogous FSUB, FMUL, FDIV)R[RS1] and R[RS2] as handles into the float pool.T81Float arithmetic (Section 2.3 of Data Types).R[RD]. The VM MAY
reuse an existing equal value but MUST do so deterministically.FDIV currently relies on host double precision and may not be bit-exact across platforms.IllegalInstruction.FDIV with canonical zero divisor) → DivideByZero.FRACADD RD, RS1, RS2 (and analogous FRACSUB, FRACMUL,
FRACDIV)R[RS1] and R[RS2] as handles into the fraction pool.T81Fraction operations (add, sub, mul, div) per
Data Types Section 2.4, including normalization of numerator/denominator.R[RD] (with deterministic
deduplication if implemented).IllegalInstruction.FRACDIV with zero numerator in divisor or canonical zero
denominator) → DivideByZero.CHKSHAPE RD, RS1, RS2R[RS1] MUST contain a tensor handle, R[RS2] a canonical shape handle.1t81 to R[RD],
otherwise 0t81.IllegalInstruction.MAKE_OPTION_SOME RD, RSOption[T]::Some variant by reading the value stored in
R[RS] (respecting its ValueTag), interning it in the VM’s option pool, and
writing the resulting 1-based handle into R[RD]. The VM MUST deduplicate
identical (tag, payload) pairs so equality compares semantic contents.IllegalInstruction.MAKE_OPTION_NONE RDOption[T]::None into R[RD]. A VM
MUST reuse a single handle for all None occurrences.IllegalInstruction.MAKE_RESULT_OK RD, RSResult[T, E]::Ok payload stored in R[RS], intern it in the
result pool, and write the deduplicated handle into R[RD].IllegalInstruction.MAKE_RESULT_ERR RD, RSMAKE_RESULT_OK but marks the handle as the error variant.IllegalInstruction.OPTION_IS_SOME RD, RSR[RS], write 1t81 to R[RD] when it
represents Option::Some, otherwise write 0t81. Flags follow the canonical
integer written to R[RD].R[RS] is not tagged as
an option handle.OPTION_UNWRAP RD, RSOption::Some handle from R[RS] into R[RD],
preserving the payload’s canonical tag (int, float handle, fraction handle,
symbol handle, etc.). Attempting to unwrap None MUST fault.None
handle → IllegalInstruction.RESULT_IS_OK RD, RSR[RS] and write 1t81 to R[RD] when
it is Result::Ok, otherwise 0t81. Flags mirror the integer result.RESULT_UNWRAP_OK RD, RSResult::Ok handle from R[RS] into R[RD] while
preserving its payload tag. The VM MUST fault if R[RS] refers to an error
variant.Err handle.RESULT_UNWRAP_ERR RD, RSRESULT_UNWRAP_OK, but unwraps the Err payload. Fault if the handle
represents Ok.Ok handle.Conformance programs:
spec/conformance/tisc/arithmetic-determinism.t81·division-truncation.t81·fraction-normalization.t81
Logical operations operate over Trits or T81BigInt viewed as vectors of trits.
TNOT RD, RST̄ ↔ T1, T0 → T0TAND RD, RS1, RS2Conformance program:
spec/conformance/tisc/ternary-logic-canonical.t81
Form: CMP RS1, RS2
Semantics:
Compare R[RS1] and R[RS2] as canonical T81BigInt, T81Float, T81Fraction,
Symbol, Option, or Result handles (types MUST match). Symbol comparisons MUST
dereference both handles into the immutable symbol pool and compare the
canonical symbol text lexicographically. Option comparisons order None < Some and recursively compare payloads. Result comparisons order Err < Ok and
likewise compare payloads recursively.
R[RS1] < R[RS2] → FLAGS := {NEG = 1, ZERO = 0, POS = 0}R[RS1] = R[RS2] → FLAGS := {NEG = 0, ZERO = 1, POS = 0}R[RS1] > R[RS2] → FLAGS := {NEG = 0, ZERO = 0, POS = 1}Faults: Type mismatch fault if types are incompatible or if a symbol handle is zero/invalid.
SETF RDR[RD] := FLAGS encoded as a canonical small integer. The VM MUST encode NEG
as -1, ZERO as 0, and POS as +1.Conformance program:
spec/conformance/tisc/comparison-total-order.t81
MOV RD, RSR[RD] := R[RS] (no modification, purely copy).LOADI RD, IMMR[RD] := canonical(IMM) where IMM is a base-81 literal.LOAD RD, [RS]R[RS] as an address;
R[RD] := MEM[R[RS]] (canonicalized on load).STORE [RS], RDMEM[R[RS]] := R[RD]PUSH RS / POP RDPUSH: decrement SP, store R[RS] at MEM[SP]
POP: load from MEM[SP] into R[RD], increment SPConformance program:
spec/conformance/tisc/bounds-fault-contract.t81
All jumps are deterministic and MUST NOT permit self-modifying code.
JMP RSPC := R[RS]JZ RS (jump if ZERO), JNZ RS (jump if not ZERO)PC := R[RS], else PC := PC + 1.JMP.CALL RS / RETCALL: push PC+1, then PC := R[RS]
RET: pop target into PCAct on canonical tensor/matrix representations as defined in Data Types.
TVECADD RD, RS1, RS2TMATMUL RD, RS1, RS2TTENDOT RD, RS1, RS2Conversions MUST be explicit and deterministic.
I2F RD, RS / F2I RD, RSI2F: convert canonical integer R[RS] to a canonical T81Float, append
(or deterministically reuse) it in the float pool, and return the handle in
R[RD].F2I: resolve the handle in R[RS], truncate toward zero per T81Float
rules, and write the canonical integer into R[RD].I2FRAC RD, RS / FRAC2I RD, RSI2FRAC: convert canonical integer R[RS] to a normalized T81Fraction
handle.FRAC2I: resolve the handle in R[RS], ensuring the denominator is 1,
and write the canonical integer into R[RD].Conformance program:
spec/conformance/tisc/conversion-determinism.t81
These instructions are only valid in Axion-supervised or privileged contexts.
AXREAD RD, IMM_TAGIMM_TAG into R[RD].AXSET IMM_TAG, RSR[RS].AXVERIFY RSR[RS] as a canonical code.Any attempt to execute Axion instructions from non-privileged context MUST be treated as a Security Fault.
Tier restriction (cross-reference): AXREAD and AXSET are restricted to
Tier 2 and above per cognitive-tiers.md §1.
AXVERIFY is the only Axion privileged instruction permitted in Tier 1.
Conformance program:
spec/conformance/tisc/tier-restriction.t81
Trigonometric operations on canonical T81Float values.
FSIN RD, RS / FCOS RD, RS / FTAN RD, RSR[RS] as a handle to a T81Float.R[RD].double precision (std::sin, std::cos, etc.) and may not be bit-exact across platforms.IllegalInstruction.FTAN with asymptotic input -> VM defined behavior (large value or fault).NOPHALTTRAP IMM_TAGInstructions that interact with content-addressed storage (CanonFS) under Axion governance.
TLOADHASH RD, RSR[RS] MUST contain a valid handle to a string symbol representing a CanonHash.allowed-tensor-hashes list.CanonFS, deserializes it into a canonical tensor, and stores the handle in R[RD].DecodeFault: Invalid RS handle or malformed object.SecurityFault: Hash not allowed by Axion policy.BoundsFault: Object not found in CanonFS.These instructions perform standard binary bitwise operations on T81BigInt
operands. Operands are interpreted as two’s-complement binary integers for
the purpose of bit-level manipulation; the result is stored as a canonical
T81BigInt.
Freeze Exception addition — 2026-03-01. These opcodes are emitted by the T81Lang compiler lowering table (§5 of
t81lang-spec.md) and implemented incore/vm/vm.cpp. They were omitted from previous spec versions.
BITAND RD, RS1, RS2R[RD] := canonical(R[RS1] & R[RS2]) — bitwise AND of T81BigInt operands.BITOR RD, RS1, RS2R[RD] := canonical(R[RS1] | R[RS2]) — bitwise OR.BITXOR RD, RS1, RS2R[RD] := canonical(R[RS1] ^ R[RS2]) — bitwise XOR.BITNOT RD, RSR[RD] := canonical(~R[RS]) — bitwise complement.BITSHL RD, RS, R_AMTR[RD] := canonical(R[RS] << (R[R_AMT] & 0x3F)) — left shift;
shift amount is masked to 6 bits before use.BITSHR RD, RS, R_AMTR[RD] := canonical(R[RS] >> (R[R_AMT] & 0x3F)) — arithmetic
(sign-preserving) right shift; shift amount masked to 6 bits.BITUSHR RD, RS, R_AMTR[RD] := canonical(unsigned_right_shift(R[RS], R[R_AMT] & 0x3F)) —
logical (unsigned, zero-fill) right shift.Conformance programs:
spec/conformance/tisc/bitwise-determinism.t81·bitwise-shift-masking.t81
These instructions are Tier 2+ only. All operate on TensorHandle registers.
All are subject to Axion pre-instruction verification before execution begins.
Hardware floating-point is prohibited; all arithmetic uses the canonical
T81Float soft-float path defined in spec/t81-data-types.md §4.
Freeze Exception addition — 2026-03-07 (RFC-0026 AI-M1–M5). These opcodes are emitted by AI inference workload compilation paths and implemented in
core/vm/vm.cpp. Opcode byte assignments: ATTN=0xBB, QMATMUL=0xBC, EMBED=0xBD, WLOAD=0xBE, GATHER=0xBF, SCATTER=0xC0.
When two register indices must be passed in a single 32-bit operand field, the PACK(X, Y) encoding is used:
packed = (X & 0xFF) | ((Y & 0xFF) << 8)
Both X and Y are decoded as unsigned 8-bit values. This encoding is used
by ATTN, QMATMUL, GATHER, and SCATTER.
ATTN RD, PACK(R_QK, R_V), 0R[RD] := softmax(Q · Kᵀ / √dₖ) · V
where R_QK holds Q and K handles (packed), R_V holds the value tensor.√dₖ MUST use the canonical T81Float square-root algorithm
from spec/t81-data-types.md §4. Hardware FPU is prohibited.attn guard AxionEvent with shape metadata before execution.TypeFault on incompatible head dimensions; ShapeFault on
shape mismatch.QMATMUL RD, PACK(R_ACT, R_WT), R_SCALER[RD] := dequantize(R[R_WT], R[R_SCALE]) · R[R_ACT]
Dequantize-then-multiply order is normative; multiply-then-dequantize is
non-conformant.R_WT provenance matches the loaded model policy.TypeFault on shape mismatch; CanonFault if scale is outside
the canonical range defined by the active Axion policy.EMBED RD, R_TABLE, R_IDXR[RD] := gather_rows(R[R_TABLE], R[R_IDX])
R_TABLE has shape [vocab, dim]; R_IDX is a T81BigInt or
Vector[T81BigInt] of token indices. Output shape: [len(R_IDX), dim].BoundsFault on any out-of-bounds index.WLOAD RD, R_SRC, R_POLICYR[R_SRC]. R[R_POLICY] is reserved for follow-on policy
dispatch and is not yet enforced by the current VM implementation.meta slot axion event segment=meta addr=<n> action=WeightLoad
via log_canonfs_operation(). This audit event is absent when no CanonFS
driver is present.TypeFault.GATHER RD, R_SRC, PACK(R_IDX, R_AXIS)R[R_SRC] at index R[R_IDX]
along axis R[R_AXIS]. For rank-2 tensors:
R[R_IDX] of R[R_SRC]R[R_IDX] of R[R_SRC]BoundsFault on out-of-bounds index; TypeFault if index or
axis registers hold non-integer values.SCATTER RD, R_DST, PACK(R_IDX, R_SRC)R[RD] := scatter_add(R[R_DST], R[R_IDX], R[R_SRC])
Adds R[R_SRC] into R[R_DST] at index R[R_IDX]; R[R_DST] is not
mutated in-place. R[RD] receives the updated tensor.(dst_handle, axis, index) tuple within a single execution frame.
Detection raises SecurityFault before any state mutation occurs. The
tracking set (ThreadContext::scatter_used) is scoped to the current
execution frame.SecurityFault (aliasing violation), BoundsFault,
TypeFault.Tests:
tests/cpp/vm_ai_phase1_wload_canonfs_audit_test.cpp·tests/cpp/vm_ai_phase1_gather_axis1_test.cpp·tests/cpp/vm_ai_phase1_scatter_aliasing_test.cpp
All faults are deterministic and Axion-visible. TISC MUST NOT allow silent corruption or undefined behavior.
Decode Fault Invalid opcode, mode, or encoding.
Type Fault Incompatible operand types (e.g., mixing T81Float and T81Fraction without explicit conversion).
Bounds Fault Out-of-range memory access, invalid tensor indices.
Stack Fault Stack underflow/overflow.
Division Fault Division/modulo by zero.
Security Fault Unauthorized Axion/system operation.
Shape Fault Incompatible shapes for tensor/matrix operations.
On any fault:
T81VM MUST stop normal instruction execution.
Fault record MUST be stored in Axion-visible metadata.
Axion MAY decide to:
No fault may leave the machine in an unspecified or partially-updated state; either:
t81-overview.mdt81-overview.mdt81-data-types.mdt81-data-types.mdt81-data-types.mdt81vm-spec.mdt81vm-spec.mdt81vm-spec.mdCurrent spec version: v1.2 (updated 2026-03-01).
t81lang-spec.mdt81lang-spec.mdt81lang-spec.mdaxion-kernel.mdaxion-kernel.mdaxion-kernel.mdcognitive-tiers.mdcognitive-tiers.md