Readiness: PiDP-11 Replica Minicomputer

Verdict: Ready with caveats · 2026-09-03 · est. parts cost $407–$540 Cybersecurity — software & network: Do not place on an open network

This is the cold check for this lab — there is no previous report, so everything below is the baseline the next check will measure drift against. The lab is buildable today on its primary path: the PiDP-11 kit is on sale direct from Obsolescence Guaranteed at $270 as a kit, +$125 assembled & tested, $45 shipping worldwide, and the instructor supplies any Raspberry Pi from a Pi 2 to a Pi 5, which are plentiful at $92–$100 for a bare Pi 4 Model B 4 GB. The two generic parts that were checked at a distributor — the panel LEDs and the 40-pin GPIO socket — are Active, cheap and deeply stocked. The caveats are structural rather than any one part being unobtainable. Four of the eight BOM lines (the toggle switches, the rotary control, the enclosure and the front-panel PCB) have no manufacturer part number anywhere in the uploaded materials and are obtainable only inside that one vendor's kit, which publishes no stock figure or lead time; the upload contains no schematic, layout or Gerber files, so the panel cannot be re-fabricated if the vendor stops selling. The optional FPGA host path is a separate problem: the Trenz CYC1000 is discontinued under one DigiKey order code and carries no price or stock under the other, so build the Raspberry Pi version.

Action required

Part	Problem	Recommended action
Trenz Cyc1000 FPGA board (alternative host)	No DigiKey product under the Trenz order code and no ECIA-authorized distributor lists it; under the product name, TEI0003-03-QFCR4A is "Discontinued at DigiKey" and TEI0003-03-QFCT4A is Active but returns no price and no stock. Manufacturer page could not be fetched.	Build the Raspberry Pi path instead — it is the primary configuration and fully sourceable. If the FPGA path is required, confirm with the PDP2011 project that its pre-compiled core targets the surviving board variant before ordering.
Front panel toggle switches (30), Rotary control (1)	No manufacturer part number exists in any source, so neither can be priced or substituted; actuator style and the momentary/maintained mix are hard requirements.	Order inside the $270 kit. For replacements, ask the vendor (oscar@ceds.dev) rather than guessing a generic subminiature toggle.
Injection-molded enclosure, PiDP-11 front-panel PCB	Single source, no separate SKU, no published stock or lead time; a shopping search found no third-party reseller at all. No Gerbers or layout files in the upload to re-fabricate from.	Order the kit early and treat vendor availability as the lab's key risk.

Cybersecurity — software & network

Do not place on an open network — A legacy default account reachable over SSH with no password step in the setup, cleartext telnet as the documented multi-user access path, and an undocumented rpcbind service enabled by the installer - all with mitigation only, since nothing in the stack is pinned to a version that could be patched.

Component	Version	How known	Support status
Ubuntu (tested host Linux for the command-line build)	24.04	inferred (README.md fetched this run states 'tested on Ubuntu 24.04'; it is a tested-on statement, not a pin - the install script fixes no OS version)	supported until 2029-05-31
Raspberry Pi OS (primary host OS, Wayland default)	not determined	not determined (No release version is stated in the snapshot or in any file fetched this run; the installer does not record or pin one)	—
PiDP-11 control software (obsolescence/pidp11, incl. BlinkenBone server mods, pdp11control, pdp11 CLI)	not determined	unpinned (Installed with 'sudo git clone https://github.com/obsolescence/pidp11.git' at the tip of main - no tag or commit lock. The install script's own header reads '# v20241127' (fetched/01-install.sh), but that versions the script, not the checkout)	—
Open SIMH PDP-11 simulator core (open-simh/simh)	not determined	unpinned (Built from the repository tip by install.sh; the repository root listing fetched this run shows no manifest, lockfile or version file to pin against)	—
GNU screen	not determined	unpinned (apt-installed unpinned by install.sh (fetched/01-install.sh); the version is whatever the host distribution ships)	—
apt build/runtime libraries (libsdl2-dev, libpcap-dev, libreadline-dev, libtirpc-dev, xz-utils)	not determined	unpinned (Extracted from install.sh in the sandbox this run; all five are installed with no version constraint)	—
rpcbind (RPC port-mapper service)	not determined	unpinned (Not named in the snapshot; found in install.sh, which runs 'sudo systemctl enable rpcbind' and 'sudo systemctl start rpcbind')	—
Terminal and display simulators (VT11/GT40, VT-52, Teletype Model 33)	not determined	unpinned (Shipped inside the pidp11 checkout and pulled from external project repositories; no version is stated anywhere in the sources)	—
Guest OS disk images (Unix V1/V5/V6/V7, 2.11BSD, RSX-11M/M-Plus, RSTS/E, RT-11, Ultrix-11)	not determined	unpinned (Downloaded at install time by install.sh; the script is designed to be re-run to pull the latest maintained images, so no fixed version exists)	—
PDP2011 FPGA soft core (alternative hardware path)	not determined	not determined (No version stated in the snapshot; nothing was fetched for it this run)	—

Component	Finding	Severity	Fix available?
Default 'pi' account and SSH	The project README tells users to reach the machine as 'ssh pi@pidp11.local' - the legacy Raspberry Pi default account - and nothing in the setup sets or forces a change of its password, so a machine left on defaults can be logged into by anyone on the same network who knows the well-known default.	posture	Mitigation only - set a strong password or key-only SSH for the pi account, and change the default hostname, before the device touches a shared network
PiDP-11 front-panel daemons	The installer sets the setuid bit on two front-panel binaries (scansw and pidp1170_blinkenlightd) so they always run with root privileges for GPIO access, which means a bug in either one is a direct route to full control of the machine for anyone who can run code on it.	posture	Mitigation only - keep the Pi a single-purpose appliance with no other user accounts or untrusted code on it
PiDP-11 install script / guest OS images	The installer downloads the system image bundle over unencrypted HTTP (http://obsolescence.dev/pidp11/systems.tar.gz) and unpacks it with tar, and pulls further disk images over anonymous cleartext FTP, with no checksum or signature check anywhere in the script - so anyone able to intercept either connection can put their own files onto the machine.	posture	Mitigation only - install from a trusted network, and verify the downloaded archives against the vendor out of band before running the script
rpcbind	The installer enables and starts rpcbind, a network-listening RPC port-mapper that is not mentioned anywhere in the lab's own documentation, so the machine ends up with an open network service the instructor was never told about.	posture	Mitigation only - disable rpcbind unless the guest-OS file sharing that needs it is actually used, and keep the device off shared networks
Telnet access to the simulated PDP-11	The documented way to open extra terminal sessions into the multi-user guest operating systems is telnet on TCP port 23 (or SimH's own terminal ports), which sends logins and everything typed across the network in clear text.	posture	Mitigation only - isolate the device on its own network segment and use SSH rather than telnet for anything off-machine
Whole software stack	Dependencies unpinned: all 6 apt packages in install/install.sh carry no version, and both source projects (the PiDP-11 repository and Open SIMH) are taken from the tip of their git branches, so no build has a fixed version that can be checked against a vulnerability database - including on the next re-check of this lab.	posture	Mitigation only - record the git commit and the installed package versions at build time so the machine can be re-checked later

What this means for your lab

Treat this machine as something to keep off the general campus or office network. Three things stack up. The setup instructions have students reach it as the standard 'pi' account over SSH and nothing in the install makes anyone set a password, so a machine left on defaults can be logged into by anyone nearby who knows that default. The documented way to open extra terminal sessions into the historic operating systems is telnet, which sends the password and every keystroke across the network as readable text that anyone on the same wired or wireless segment can capture. And the installer quietly switches on an extra network service (rpcbind) that the lab's own documentation never mentions, so the machine listens on more ports than the instructor expects. On top of that, the installer fetches the operating system images over a plain, unverified connection, so a hostile network could feed it different files than the vendor intended - install it on a network you trust. None of this has a patch to apply, because the project pins no software versions at all; the fixes are all things you do rather than things you install. Practically: change the pi account's password (or switch to SSH keys) before the first boot on a network, put the machine on an isolated network segment or a lab VLAN, use SSH rather than telnet for anything beyond the machine itself, and mention it to campus IT before connecting it to a shared network. We could not check any component against a vulnerability database this run, so nothing here should be read as saying the software is free of known flaws - only that no version exists to check.

Not checked

• PiDP-11 control software (obsolescence/pidp11): Cloned at git tip with no tag or commit - there is no version to look up
• Open SIMH simulator core: Built from repository tip; no manifest or version file exists to pin against, and source-only C projects have no registry to query
• GNU screen and the five apt build libraries: Installed unpinned by the system package manager - the version is whatever the host distribution ships, so no exact version could be checked against OSV
• rpcbind: Enabled by the installer at whatever version the distribution ships; no version determined, so no advisory lookup was possible
• Raspberry Pi OS: No release version stated anywhere in the sources, so no support-status lookup could be made
• Terminal and display simulators (VT11/GT40, VT-52, Teletype 33): No versions stated and the external projects are source-only checkouts with no advisory database
• Guest OS disk images (Unix V1-V7, 2.11BSD, RSX-11M+, RSTS/E, RT-11, Ultrix-11): Historic retrocomputing images pulled fresh at install time; no vulnerability database covers them and they run inside the simulator, not on the host
• PDP2011 FPGA soft core: No version stated and no manifest was available for the alternative FPGA hardware path

Parts

Host and processing platforms

Part	Spec/Package	Status	Stock	Price	Source
Raspberry Pi Single Board Computer (any 40-pin model)	Standard Pi form factor, 40-pin 2.54 mm GPIO header, 5.0 V DC in, 3.3 V LVCMOS I/O	Readily available	Many sellers	$100.00 bare Pi 4 B 4 GB; also $91.86	DigiKey listing / eBay (shopping) — not included in the kit
Trenz Electronic Cyc1000 FPGA board (alternative host)	Cyclone 10 LP 10CL025YU256C8G, 61.5 x 25 mm DIP module, 5.0 V via Micro-USB	Hard to obtain — one order code discontinued, the other unpriced	None returned	—	TEI0003-03-QFCT4A (Active, no price/stock) · TEI0003-03-QFCR4A (Discontinued at DigiKey)

Front panel components

Part	Spec/Package	Status	Stock	Price	Source
Front panel indicator lamps, 64 off — Kingbright WP710A10IT (representative)	T-1 (3 mm) radial through-hole, 2.90 mm dia, Vf 2 V typ at 20 mA	Readily available (representative part; clear lens, not the DEC-tinted kit lamp)	1,907	$0.25 ea (~$16 for 64)	DigiKey, Active
Front panel toggle switches, 30 off	Subminiature PCB/panel toggle, mixed 2-position maintained and 3-position momentary, dry contact ≤ 10 mA	not checked	—	—	No manufacturer part number in any source; supplied in the kit
Rotary control / selector knob, 1 off	Panel/PCB rotary switch or encoder, 6 mm or 6.35 mm shaft, DEC-style fluted knob	not checked	—	—	No manufacturer part number in any source; supplied in the kit

Enclosure, PCB and interconnect

Part	Spec/Package	Status	Stock	Price	Source
Injection-molded replica enclosure	Custom molded PDP-11/70 chassis and bezel	Available — single source, no separate SKU	Not published	Inside the $270 kit (+$125 assembled, +$45 shipping)	Obsolescence Guaranteed, direct only
PiDP-11 front panel PCB	Full-size panel PCB, BlinkenBone driver matrix, 40-pin GPIO interface	Available — single source, no separate SKU	Not published	Inside the $270 kit	Obsolescence Guaranteed, direct only
40-pin GPIO interconnect — Samtec SSW-120-01-T-D (representative)	2x20 female socket, 0.100" (2.54 mm) pitch and row spacing, through hole, 4.7 A/contact	Readily available	323	$4.11	DigiKey, Active

Substitutes

For part	Substitute	Differences	Verified	Judgment
Trenz Cyc1000, order code TEI0003-03-QFCR4A (Discontinued at DigiKey)	TEI0003-03-QFCT4A	Same manufacturer and identical DigiKey product description ("CYC1000 CYCLONE 10 LP FPGA BRD"); it is DigiKey's own MFR Recommended replacement. Status Active, but DigiKey returned no stock figure and no price, so cost and delivery are unknown. No parametrics were returned for either order code, so module footprint and pinout are unconfirmed.	verified: manufacturer + product identity (DigiKey lookup, this run). not verified: price, stock, module footprint/pinout, and whether the pre-compiled PDP2011 core targets this exact variant	Plausible, unverified — the only surviving CYC1000 order code at this distributor, but confirm the variant with the PDP2011 project and get a price quote before ordering

Verify any substitute against its datasheet — and, for the FPGA board, against the PDP2011 project's own board list — before ordering.

Other dependencies

• Vendor project pages — obsolescence.dev/pdp11 (overview) and the direct order page: both fetched successfully this run, live, and the order page quotes current prices. This is the lab's critical external link — the kit, and therefore four BOM lines, exist only here.
• PiDP-11 manual PDF (obsolescence.dev/pidp11/PiDP-11_Manual.pdf): not checked this run.
• User community forum (groups.google.com/g/pidp-11): not checked.
• Joerg Hoppe's BlinkenBone project page (retrocmp.com/projects/blinkenbone): not checked.
• Historical PDP-11 literature — four reference PDFs on bitsavers.org and gordonbell.azurewebsites.net: not checked; background reading, not build-critical.
• Fabrication specifications: not checkable. The snapshot records that board dimensions and layer count are not stated and that no schematics or Gerber packages are present in the upload, so nothing can be quoted to a board house from what is on file.

Watch list

• The PiDP-11 kit itself — one small vendor, direct order only, no third-party reseller found, and no published stock level or lead time. Four BOM lines depend entirely on it, and with no Gerbers or layout files in the upload the front panel cannot be reproduced if it goes away. This is the single item most likely to change the verdict.
• Trenz Cyc1000 — already discontinued under one DigiKey order code with the survivor carrying no price or stock; expect the alternative FPGA path to become fully unavailable through authorized distribution.
• Raspberry Pi model availability — the lab tolerates any Pi 2 through Pi 5, so this is low risk today, but the Pi 4 Model B specifically has been through supply squeezes before; the wide model latitude is what protects this line.
• Front-panel switches and knob — no part numbers on record anywhere. If the vendor ever stops supplying spares, there is no documented specification to re-source from, and the momentary/maintained mix would have to be reverse-engineered from the hardware.