Breaking 6502 Eng A6
Breaking 6502 Eng A6
6502 Core
andkorzh, HardWareMan, org
A book on how the MOS 6502 processor works, but basically just a copy of the
wiki from the GitHub.
Rev. A6
Foreword
This book would probably be the best choice for reading on long winter evenings, in front of a
warm fireplace with wood crackling and a snowstorm blowing outside the window at the same
time.
2
Contents
Overview…………………………………………………………………………………………………….. ……………………………..4
Pinout…………………………………………………………………………………………………………. ……………………………14
Clock…………………………………………………………………………………………………………... ……………………………18
Top Part
Instruction Register……………………………………………………………………………………. ……………………………..24
Extended Cycle Counter…………………………………………………………………………….. ……………………………..27
Decoder……………………………………………………………………………………………………… ……………………………..30
Pre-decode………………………………………………………………………………………………… ……………………………..41
Interrupt Processing…………………………………………………………………………………… ……………………………..45
Random Logic……………………………………………………………………………………………. ……………………………..51
Registers Control……………………………………………………………………………….. ……………………………..55
ALU Control……………………………………………………………………………………….. ……………………………..60
Program Counter Control………………………………………………………………….. ……………………………..67
Bus Control………………………………………………………………………………………… ……………………………..71
Dispatcher………………………………………………………………………………………….. ……………………………..80
Flags Control……………………………………………………………………………………… ……………………………..88
Flags…………………………………………………………………………………………………… ……………………………..93
Branch Logic………………………………………………………………………………………. ……………………………..99
Control Commands……………………………………………………………………………………. …………………………...102
Bottom Part
Address Bus………………………………………………………………………………………………. ……………………………107
Data Bus……………………………………………………………………………………………………. ……………………………111
Registers……………………………………………………………………………………………………. ……………………………114
ALU……………………………………………………………………………………………………………. ……………………………117
Program Counter………………………………………………………………………………………. ……………………………130
3
This page is needed so that the schematics on the spreads start on even pages.
4
6502 Overview
The 6502 processor was developed by MOS. It was based on the architecture of the Motorola
6800 processor:
6502 6800
In both cases the top part is occupied by the decoder and random logic, and the whole bottom
part of the processor is occupied by the context and the ALU.
Architecture
The processor is divided into two parts: the upper part and the lower part.
The upper part contains the control logic, which issues a number of control lines ("commands")
to the lower part. The lower part contains the context of the processor: internal buses and regis-
ters, with one exception - the flags register (P) is in the upper part in a "spread out" form.
The processor is clocked by the PHI0 clock pulse, both half-cycles are used. During the first half-
cycle (PHI1) the processor is in "talking" mode. At this time the processor is outputting data to
the outside. During the second half-cycle (PHI2) the processor is in "listening" mode, during this
half-cycle external devices can put data on the data bus for the processor to process it.
5
6
7
Registers
The following registers are directly available to the programmer: A (accumulator), X, Y, S, P, PC.
External Buses
There are only two external buses: a 16-bit address bus (ADDR) and an 8-bit data bus (DATA).
The address bus is one-way - only the processor can write to it. The data bus is bidirectional.
Internal Buses
During the second half-step (PHI2) all internal buses are precharged and have a value of 0xff.
This is done because it is faster to "discharge" the transistor at the right moment than to
"charge" it (the change of 1=>0 is faster than the change of 0=>1).
8
Register-Bus Connections
By connecting buses and registers in series, the processor executes a variety of instructions. The
variety of connections provides a variety of processor instructions, and the division of instruc-
tions into clock cycles allows complex actions to be performed. In addition, the ALU is controlled
(addition, logical operations, etc.).
Software Model
Addressing Modes
Addressing modes are described here because they should be kept in mind when analyzing
circuits.
Addressing is a way to get the operand to (or load it from) the desired memory location. The
developers of the 6502 were very generous and added as many as two X and Y index registers to
the context.
"Indexed" means that an offset is added to the memory address in a certain way to get a new
address. This is usually needed to access arrays. In this case the beginning of the array will be a
fixed address and the value in the index register will be the array index (offset).
9
List of addressing modes:
• Immediate (immediate operand). In this case the operand is stored in the instruction itself
(usually the second byte, after the operation code). Example LDA #$1C: A = 0x1C
• Absolute (absolute addressing). The instruction specifies the full 16-bit address from which
to get the operand. For example LDA $1234: A = [$1234]
• Zero Page Absolute: Developers have made an optimized version of absolute addressing by
adding the ability to address only page zero (pages are 256 bytes in size). Example LDA
$56: In this case the processor itself makes the highest 8 bits of the address equal to 0x00,
while the lowest 8 bits are taken from the instruction. The final address is 0x0056. A =
[0x0056]. This is done to save instruction size (one byte is saved).
• Indexed: In this addressing mode an offset from the X or Y register is added to the constant
address value. For example LDA $1234, X: A = [$1234 + X]
• Zero Page Indexed: Similar to Indexed but only the X register can be used. Example LDA
$33, X: A = [$0033 + X]
• Pre-indexed Indirect: The value of the operand which is the address in page zero is added
to the value of register X and the indirect address is obtained. The address the indirect
address refers to is then used to get the value of the operand. Example LDA ($34, X): A
= [[$0034 + X]]. Important: When you add an address and a value in the X register, it
"wraps" around 256 bytes. That is, it does not wrap to the higher half of the address. (0xFF
+ 0x02 will be 0x0001, not 0x0101). Indirect means "take address by address".
• Post-indexed Indirect: Different from the previous one in that the indirect address from
page zero is selected first, and then the index register Y value is added to it. Example LDA
($2A), Y: A = [[$002A] + Y].
10
Instruction Set
The 6502 has all the necessary instructions and also includes such rather handy instructions as
bit rotation (ROL/ROR) and bit testing (BIT). Not all processors of the time contained such in-
structions.
The instruction type and address mode are fully contained in the operation code, to simplify
decoding, but the bus width (8 bits) does not allow all instructions to be executed in a single
clock cycle. Also, the decoder is somewhat unoptimized, so the minimum instruction execution
time is 2 clock cycles, with the first clock cycle always taken by sampling the operation code (the
first byte of the instruction).
Summary of instructions:
ADC Add Memory to Accumulator with Carry ROL Rotate One Bit Left (Memory or Accumulator)
AND "AND" Memory with Accumulator ROR Rotate One Bit Right (Memory or Accumulator)
ASL Shift Left One Bit (Memory or Accumulator) RTI Return from Interrupt
BCS Branch on Carry Set SBC Subtract Memory from Accumulator with
BIT Test Bits in Memory with Accumulator SED Set Decimal Mode
CLI Clear interrupt Disable Bit TXS Transfer Index X to Stack Pointer
NOP No Operation
11
The developers chose the encoding so that it would be easier to process by decoder and random
logic.
You can find a description of the instructions in any Reference Manual for 6502.
Interrupts
6502 interrupts:
• IRQ: hardware interrupt. Can be disabled with flag I (interrupt disable), if flag I=1 the inter-
rupt is "disabled" and does not go to the CPU.
• NMI: non-maskable interrupt. It has higher priority than IRQ, triggered on falling edge.
• RES: hardware reset. After powering up the 6502 it is necessary to set the /RES pin to 0 for a
few cycles so that the processor "comes to its senses".
• BRK: software interrupt. It is initiated by the BRK instruction.
12
Note on Transistor Circuits
The transistor circuits of each component are chopped into component parts so that they don't
take up too much space.
To keep you from getting lost, each section includes a special "locator" at the beginning that
marks the approximate location of the component being studied on the large 6502 "family por-
trait" (https://github.com/emu-russia/breaks/blob/master/Docs/6502/6502.jpg)
Example locator:
For convenience, the logical variant of DLatch has two outputs (out and /out), since the current
value of DLatch (out) is often used as an input of a NOR operation.
13
Pinout
The study of any integrated circuit begins with the pinout.
R/W 6502 => Data bus direction (R/W=1: processor reads data, R/W=0: processor writes)
14
Vcc/Vss
From the official datasheet we know that the operating range of Vcc = +5.0 volts +/- 5%.
Clock Generator
The clock signals are described in a separate section (see clock generator).
Each contact contains a FF where the interrupt arrival event is stored. The FF value corresponds
to the control signals /NMIP, /IRQP and RESP (the value from FF for contact /RES is output as
direct value). The "P" in the name of the control signals stands for "Pad" (contact).
RDY
The RDY pin goes to the internal RDY signal and also through the DLATCH delay chain as the /
PRDY ("Previous Ready") signal. /PRDY goes to the decoder input Branch T0.
The RDY pin can be used to temporarily suspend the processor, e.g. while an external device
performs a DMA.
15
SYNC
The SYNC signal comes from the internal T1 signal (opcode fetch).
SO
The internal signal SO is fed to the flag V input to process the control signal 1/V.
R/W
The WR signal comes from dispatcher and defines the operating mode of the processor (WR:1 -
processor writes data, WR:0 - processor reads data).
Address Bus
See Address Bus.
Data Bus
See Data Bus.
16
Notes in the margins for future revisions of the book.
17
Clock Generator
The 6502 includes two clock reference circuits: an external and an internal one.
The processor inputs one clock signal, PHI0, and outputs two clock signals, PHI1 and PHI2.
This principle is based on the fact that each clock cycle of the processor consists of two
"modes" (or "states"): write mode and read mode.
During write mode the PHI1 signal is high. During this time, external devices can use the ad-
dress set on the external address bus of the processor.
During read mode the signal PHI2 is high. During this time external devices can write data to
the processor's data bus so that the processor can use it for its own purposes.
The signals PHI1 and PHI2 are called half-cycles and are derived from the original clock sig-
nal PHI0 as follows:
• When PHI0 is low - the processor is in write mode and the PHI1 signal is high
• When PHI0 is high - the processor is in read mode and the PHI2 signal is also high
0 1 0
1 0 1
Internal Clock
18
The circuit is quite complicated, because it is not quite "digital". The numerous transistors that
act as inverters slightly delay the PHI0 signal, so the PHI1 and PHI2 signals going inside the pro-
cessor are a bit "laggy". Here is the logical representation of the circuit:
Logical analysis:
The simulation in Altera Quartus shows "lag", but does not show the elongated lower level (it is
hand-drawn in the picture above).
19
BigEd from the 6502.org forum suggested that he ran a simulation on the 6502 FPGA netlist and
got the following sweeps:
The signal designations are as follows: clk0 = PHI0, cp1 = PHI1, cclk = PHI2 (according to the
netlist with Visual6502)
The schematic on which his simulation was based corresponds to the one in Balasz's documenta-
tion:
http://forum.6502.org/viewtopic.php?f=8&t=2208&start=195
It turns out that because of the asymmetrical inverter stage the rising edge is delayed, so the
lower level is as if "delayed".
20
The official documentation gives the following diagram:
External Clock
The PHI1/PHI2 reference signals are also output to the outside for consumers.
The logic circuit of the external wiring of the clock signals does not differ from the internal wiring
circuit, except that the outputs of PHI1/PHI2 go to the same contacts through the "comb" of
powerful transistors.
Why PHI
In the official 6502 datasheet the half-cycles are called "phases", respectively the name of these
signals is Φ1 and Φ2. For unification we use the designations PHI1 and PHI2.
21
Notes in the margins for future revisions of the book.
22
23
Instruction Register
The Instruction Register (IR) stores the current operation code, for processing on decoder. The
operation code is loaded into the IR from predecode logic.
Transistor Circuit
The outputs in the schematic are on the left because the decoder is topologically located on the
left side.
• IR0 and IR1 are combined into one common line IR01 to save lines
• IR0 is used only for the 128th decoder line (IMPL) (this operation with IR0 is part of the
random logic)
• /IR5 goes additionally to flags and is used in set/clear flags instructions (SEI/CLI, SED/CLD,
SEC/CLC)
24
Logic
• During PHI1 the IR value is overloaded from the Predecode (PD) latch, but only if
the FETCH command is active
• During PHI2 the IR is "refreshed" (this is not shown in logic circuit)
It should be noted that an inverted operation code (PD) value is fed to the IR input and is also
stored on the latch in an inverted form.
25
Notes in the margins for future revisions of the book.
26
Extended Cycle Counter
• The base counter, used for short instructions (Counts T0-T1 cycles)
• Extended counter (which we will talk about here) used for long instructions (Counts cycles
T2-T5)
• Counter for very long instructions (Counts cycles T5-T6)
One cycle (T) refers to two consecutive half-cycles (PHI1 + PHI2) of the processor.
Transistor Circuit
27
Logic
28
Notes in the margins for future revisions of the book.
29
Decoder
The decoder is an ordinary demultiplexer, but a very large one. The formula for the demultiplex-
er is 21-to-130. Sometimes the 6502 instruction decoder is also called a PLA.
Topologically, the decoder is divided by ground lines into several groups, so we'll stick to the
same division, for convenience.
• /T0, /T1X: current cycle for short (2 clock) instructions. These signals are output
from dispatch logic.
• /T2, /T3, /T4, /T5: current cycle for long instructions. Signals are output from extended cycle
counter.
• /IR0, /IR1, IR01: the lower bits of the operation code from instruction register. To reduce the
number of lines 0 and 1 bits are combined into one control line IR01.
• IR2-IR7, /IR2-/IR7: direct and inverse values of the remaining bits. The direct and inverse
forms are needed to check the bit for 0 and 1.
The decoder logic is based on the exclusion principle. Schematically, each output is a multi-input
NOR element, which means that if at least one of the inputs has a 1, the whole line will NOT
work.
That is, the decoder outputs are not in inverse logic (as is usual), but in direct logic.
30
Special Lines
Additional logical operations are applied to some decoder outputs, which although territorially
are in the decoder area, are actually part of random logic. Most likely this logic got into the de-
coder simply because it was more convenient to split the connections that way.
List:
• Internal Push/Pull line: a special (129th) line that does not extend beyond the decoder. It is
used to "cut off" Push/pull instructions when selecting instructions. It is used in three lines:
83, 90, and 128. Appears on the schematic in duplicate, for different parts of the decoder.
• /PRDY: this line goes to decoder line 73 (Branch T0)
• IR0: normally the common signal IR01 is used to check the two lowest bits of the operation
code, but exclusively for the 128th line (IMPL), IR0 is used (IR0 is not included in the mask
for the table below).
31
PLA Contents
Cy
Grou Decoded
N Mask value (Raw bits) cle Comments Where to use
p mask value
(T)
B01 6 000000100010000001000 XXX1X1XX T2 OP zpg, X/Y & OP abs, X/Y Register control
32
C
33
D
34
E
35
F
36
G
37
H
38
What Raw bits mean
If you think of a decoder as a 21x130 ROM, where each bit repre-
sents a transistor, then the Raw bits value will represent one line
of the decoder. This is why it is called the mask value.
For example, the picture shows the 5th line of the decoder. The bit
counting starts from bottom to top. 0 means no transistor, 1 means
present.
Online Decoder
You can use an online decoder to highlight opcodes: http://
breaknes.com/files/6502/decoder.htm (You can also find it
here: https://github.com/emu-russia/breaks/blob/master/
Docs/6502/decoder.htm)
In the Raw bits field you can insert the mask value from the table
above and when you press the Make IR Mask button you will get
the decoded mask value (e.g. 11X00X00). The decoded mask value
can be inserted into the IR field and when the Decode button is
pressed, the opcodes that correspond to the specified IR mask will
be highlighted in the table.
Branch T0 Skip
From pin RDY a special line /PRDY comes through the delay line. If the processor was not ready
when the previous instruction finished, then if the next instruction is a conditional branch, its
cycle 0 (T0) is skipped. The meaning of this operation is not known yet.
The decoder was compiled according to the requirements of random logic. Random logic is
divided into several parts (domains) and each part corresponds to its own zone in the decoder,
which was specially chosen so that the necessary opcodes were processed.
In other words - it is not random logic that adjusts to decoder, but vice versa. The impression
that the decoder is "more important" is formed simply because it is above random logic.
39
Notes in the margins for future revisions of the book.
40
Predecode
41
The operation code received from the external data bus (D0...D7) is stored on the PREDECODE
latch (PD) during PHI2 (in inverted form), after which the precoding logic immediately deter-
mines the instruction class (the circuit is combinatorial).
The output /TWOCYCLE is used by a short cycle counter. The output /IMPLIED is used by the
PC increment logic.
The PD latch value is fed to the instruction register input in inverted form.
Also the control line 0/IR is fed to the Predecode logic input which "injects" the BRK operation
into the instruction stream. This occurs during interrupt processing, to initialize the BRK se-
quence (all interrupts simply mimic the BRK instruction, with slight modifications).
The pre-decode circuit works closely with the dispatcher, all control signals go there.
Logic
The corresponding gates are marked on the transistor schematic:
42
The predecoding logic is self-descriptive:
• 2-cycle instructions are: Direct operand instructions OR all single-byte instructions EXCEPT
push/pull instructions (specified by mask XXX010X1 + 1XX000X0 + XXXX10X0 - 0XX0XX0X)
• Single-byte instructions are set by mask XXXX10X0
TWOCYCLE instructions:
IMPLIED instructions:
43
Notes in the margins for future revisions of the book.
44
Interrupt Processing
Three signals /NMIP, /IRQP and RESP come to the input of the circuits from the corresponding
input pads.
NMI Processing
Transistor circuit (includes cycle counter 6-7 and NMI edge detector):
45
Interrupt vector address and Reset FF
Transistor circuit:
The circuit for getting the control signal DORES ("Do Reset") (which is binned to all other inter-
nals) is combined here with the interrupt vector setting circuit to save space.
46
B Flag
Transistor circuit:
47
Logic
Interrupt handling schematic:
48
To handle interrupts an additional circuit is required to generate cycles 6 and 7 (because they do
not come from the decoder) (control signals BRK6E and BRK7). And the control signal BRK6E
("Break Cycle 6 End") starts during PHI2 of cycle 6 and ends during PHI1 of cycle 7. This is done
to determine the edge of the /NMI signal.
The detection of the /NMI edge is done by a classic edge detection circuit based on two RS trig-
gers.
The /RES signal is additionally stored on RESET FLIP/FLOP, because it is required for other ran-
dom logic circuits (particularly for special control of the R/W pin).
The arrival of any interrupt is reflected on flag B, the output of which (B_OUT) forces the proces-
sor to execute a BRK instruction (operation code 0x00). This way the developers have unified the
handling of all interrupts.
The last small circuit forms the address (or vector) of the interrupts (control signals 0/ADL0, 0/
ADL1 and 0/ADL2), which control the lowest 3 bits of the address bus.
49
Notes in the margins for future revisions of the book.
50
Random Logic
The name has nothing to do with random numbers, it simply reflects the essence of randomly
scattered circuits here and there.
This logic is the thinking organ of the processor and completely determines its behavior when
processing and executing instructions.
From the hardware point of view, the random logic is a "handmade" product of MOS engineers,
which is a mess of transistors and wires. Therefore, it would be more correct to use the name
"chaotic logic" instead of random logic.
There is no need to give a full-size transistor circuit here, because it will be easier to master it by
component parts.
Below you can see all the function blocks of the random logic:
• Register control
• ALU control
• Program counter (PC) control
• Bus control
• Execution logic (dispatch)
• Flags control logic
• Flags
• Conditional branch logic
51
Principle of Operation
In general, the operation of the logic is quite complex (did you think I would say simple
again? :smiley:):
• The execution logic (dispatch) conducts the work of the entire processor. It determines
when to terminate an instruction and also controls the PC increment and the cycle counter.
Additionally it includes a processor readiness circuit (RDY) which is controlled by the RDY
pin.
• After the execution logic has started executing the next instruction - the code of that in-
struction as well as the current cycle is fed to the decoder
• Depending on the results of decoding the control circuitry of registers, ALU, PC and buses
give outward to the lower part special control commands
• Additionally, the behavior of the processor is affected by its flags as well as interrupt han-
dling logic. And flags are also affected by executable instructions.
All this is closely coupled to control the lower part of the processor, where its context (registers),
ALU and communication with the outside world via buses are located.
52
Notes in the margins for future revisions of the book.
53
Auxiliary Signals
This section contains a table of auxiliary signals exchanged between all parts of the random logic (for reference):
AND ALU Control Bus Control Used when forming an ALU ANDS command
BRK5 Decoder Interrupts, Regs Control Used to obtain the STKOP signal and also goes into the interrupt handling circuit
BRK6E Interrupts ALU Control, Bus Control BRK6 (cycle 6 of the interrupt sequence), during the half-step PHI2
IMPL Decoder ALU Control Decoder X128. Additionally modified with Push/Pull (X129) and IR0 signals.
PC/DB PC Control Dispatch Auxiliary output signal for the RW Control circuit that is part of the dispatcher
RTI/5 Decoder Regs Control, ALU Control Used to obtain STKOP and NOADL signals
SBXY Regs Control Bus Control Intermediate signal ("SB Bus X,Y")
STK2 Decoder Regs Control, ALU Control Auxiliary signal from decoder (X35)
54
Registers Control
Most likely this control circuit will be observed first, so I will write here: be prepared to see a
large number of intermediate signals in the control circuits, which can come sometimes from all
other parts of the random logic. A summary table of all the intermediate signals can be found in
the main section with the random logic overview.
The register control circuit is responsible for generating control commands to exchange registers
with the internal buses.
55
Inputs:
Signal Description
STK2 Just an auxiliary signal from another part of the decoder (X35)
Outputs:
Signal Description
STKOP Intermediate signal ("Stack Operation") for the ALU control circuit
BRK5 Output X22 from decoder. Used to obtain the STKOP signal and also goes to the interrupt circuitry
RTI/5 Output X26 from decoder. Used to obtain STKOP and NOADL signals
The TXS (X13) signal is used within this circuit and does not go outside.
56
The intermediate signals from the register control circuitry go to the input of the control com-
mand latches:
Command Description
S/S Refresh the value of the S register. The S/S control command is obtained by a complement of the SB/S signal
57
Logic
58
Notes in the margins for future revisions of the book.
59
ALU Control
Intermediate Signals
/ROR SR AND CSET
60
Table of auxiliary and intermediate signals, which are found further in the schematics:
Signal Description
SR Intermediate signal
CSET Intermediate signal ("Carry Set"), used in the main ALU control circuit
/BR3 Decoder X93 (inverted value). The inversion circuit was lost somewhere in the optimization process.
INC_SB Intermediate signal ("Increment SB"), used in the main control circuitry as well as in the bus control circuitry
61
ALU Сontrol (Main Part)
The circuit is a mess of gates and 4 latches to generate the input carry for the ALU (control sig-
nal /ACIN).
62
BCD Correction Control
BCD correction is applied in the following cases:
• If the BCD mode is enabled with flag D and the current instruction SBC (control signal
DSATemp)
• If the BCD mode is enabled with flag D and the current instruction ADC (control signal
DAATemp)
ADD/SB7
The attentive reader will notice that the processor has support for bit rotation instructions (ROL/
ROR). The additional processing associated with these instructions is just handled by this circuit.
63
ALU Control Commands
Command Description
ADD/SB06 Place the value of the ADD latch on the SB bus (bits 0-6)
ADD/SB7 Place the value of the ADD latch on the SB bus (bit 7)
Additional signals
64
Logic
65
Notes in the margins for future revisions of the book.
66
Program Counter Control
The program counter (PC) control circuitry is designed to generate control commands to ex-
change the PC value and the internal buses ADL, ADH and DB.
Nearby is the PC increment circuit, which is discussed in another section on dispatcher.
67
Output latches and control commands:
Inputs:
Signal Description
Outputs:
Signal Description
PC/DB Auxiliary output signal for the RW Control circuit that is part of the dispatcher
Control commands:
Command Description
ADL/PCL Load the ADL bus value into the PCLS latch
68
Logic
69
Notes in the margins for future revisions of the book.
70
Bus Control
Bus control is most of all "scattered" around the processor surface. It is easiest to describe all the
bus control commands first, and then to look at the corresponding circuits individually.
Command Description
ADH/ABH Set the high 8 bits of the external address bus, in accordance with the value of the internal bus ADH
ADL/ABL Set the low-order 8 bits of the external address bus, in accordance with the value of the internal bus ADL
SB/AC Place the value from the SB bus/BCD correction circuit into the accumulator
DL/DB Exchange the value of the DL and the internal bus DB. The direction of the exchange depends on the operating mode of
• The control circuits get a lot of input from the decoder and other auxiliary signals
• All circuits are mostly combinatorial (no triggers, just a mess of gates)
• The outputs from the control circuits go to the output latches of the commands to control
the lower part of the processor.
71
Auxiliary Signals
Circuits for obtaining auxiliary signals:
In the IND circuit the decoder output X90 is additionally modified by the Push/Pull signal (X129).
72
The other auxiliary and intermediate signals that can be found in the schematics in this section:
Signal Description
T2 Decoder X28
SBA The signal comes out of the #SB/ADH circuit, used in the #ADH/ABH circuit
SBXY Comes from a register control circuit (not to be confused with STXY)
IMPL Decoder X128. Additionally modified with Push/Pull (X129) and IR0 signals.
The signals are arranged in the order they appear in the schematics.
73
External Address Bus Control
Circuits for the generation of intermediate signals:
The first piece of the #ADH/ABH circuit is to the right of flag B, the second piece is in the inter-
rupt address generation circuitry. The #ADH/ABH signal connects directly between these two
pieces.
74
ALU Connection to SB, DB
Circuits for the generation of intermediate signals:
75
SB, DB, ADH Control
Circuits for generating intermediate signals (for 0/ADH0 you get the control command at once):
(0/ADH0 above)
76
External Data Bus Control
Circuits for the generation of intermediate signals:
#DL/ADL #DL/DB (1) #DL/DB (2)
The first piece of #DL/DB circuitry is next to the ACR Latch, the second piece is right inside the ALU control
circuitry. The #DL/DB signal connects directly between these two pieces.
77
Logic
78
Notes in the margins for future revisions of the book.
79
Dispatcher
The execution logic (dispatcher) is the key mechanism of the processor that "directs" the execu-
tion of instructions.
Intermediate Signals
Intermediate signals are obtained from the decoder outputs without any regularity. It was very
difficult to separate them from the intermediate signals of the other control circuits, because of
the chaotic connections.
80
Processor Readiness
The /ready is the global ready signal of the processor, derived from the RDY input signal which
comes from the corresponding contact.
R/W Control
81
Short Cycle Counter
82
Instruction Completion
83
ACR Latch
84
Increment PC
The circuit contains 3 "branches" of combinatorial logic, which finally form the control command
to increment PC (#1/PC).
The circuit also generates the following signals:
Opcode Fetch
85
Logic
86
Notes in the margins for future revisions of the book.
87
Flags Control
The flag control circuits are divided into two parts for convenience:
As you can guess, the purpose of the circuit is to control processor flags, depending on the cur-
rently executed instruction.
I think it makes sense to show here the relevant part of the wonderful 6502 circuit made by Don-
ald F. Hanson:
88
Opcode Selection
Input signals:
Output signals:
!POUT 98,99 Working with flags outward (saving context after interrupt, PHP instruction)
The 110th decoder output (instructions CLC, SEC), for convenience is left in these circuits. It just goes on to the main
X110 110
flag control circuitry.
AVR/V 112 Instructions ADC, SBC. This signal is the control signal for flag V
/ARIT 107,112,116-119 Matrix of comparison (CMP, CPX, CPY) and shift instructions (ASL, ROL) where flags are used
!PIN 114,115 Working with flags inside (context loading after RTI, instruction PLP)
All of these control signals (except AVR/V) are intermediate signals and are not used anywhere
else except for the flag control circuitry.
89
Flags Control
Input signals:
Signal Purpose
90
Output Flag control signals:
Signal Flag Purpose
IR5/C C Change the value of the flag according to the IR5 bit
ACR/C C Change the value of the flag according to the ACR value
DBZ/Z Z Change the value of the flag according to the /DBZ value
IR5/I I Change the value of the flag according to the IR5 bit
IR5/D D Change the value of the flag according to the IR5 bit
P/DB All Place the value of the flags register P on the DB bus
The control signal 1/V is obtained by the input contact SO and is not shown here.
Logic
91
Notes in the margins for future revisions of the book.
92
Flags
The flags (bits of the P register) are in "scattered" form, as several circuits of the upper part of
the processor.
Flag B is treated separately in the section on interrupt handling. Topologically it is also located in
another part of the processor.
C Flag
• IR5/C: Change the flag value according to the IR5 bit (applies during execution of the SEC
and CLC instructions)
• ACR/C: Change the flag value according to the ACR value
• DB/C: Change the value of the flag according to the bit DB0
• /IR5: Inverted IR5 value
• /DB0: Input value from DB bus, in inverted form
• ACR: Result of a carry from the ALU (/ACR: in inverted form for dispatcher)
• /C_OUT: Output value of flag C, in inverted form
93
D Flag
• Change the flag value according to the IR5 bit (applied during execution of SED and CLD
instructions)
• DB/P: Common control signal, place the DB bus value on the flag register P
• /IR5: IR5 bit value, in inverted form
• /DB3: Input value from the DB bus, in inverted form
• /D_OUT: Output value of flag D, in inverted form
I Flag
• IR5/I: Change the flag value according to the IR5 bit (applied during execution of SEI and
CLI instructions)
• DB/P: Common control signal, place the DB bus value on the flag register P
• /IR5: IR5 bit value, in inverted form
• /DB2: Input value from the DB bus, in inverted form
• /I_OUT: Output value of flag I, in inverted form. This signal goes to two places: to the inter-
rupt processing circuit and to the circuit for exchanging flag register values with the DB bus
(below).
94
N Flag
• DB/N: Change the flag value according to DB7
• /DB7: Input value from DB bus, in inverted form
• /N_OUT: Output value of flag N, in inverted form
V Flag
Z Flag
95
Flags I/O
• C_OUT: Flag C value in direct form, used in ALU control circuit (in the circuit to form the
ADD/SB7 signal)
• D_OUT: Flag D value in direct form, used in the ALU control circuit (to form BCD correction
signals DAA/DSA)
• P/DB: Place the P flag register value on the DB bus
• /DB0-7: The value of the DB bus bits, in inverted form. It is fed to the input of the corre-
sponding bits of the P register.
• /DBZ: Check that all DB bus bits are 0 (i.e. checking the value to 0). It is used by the Z flag.
Correspondence of the bits of the DB bus and the flag register P:
DB Bit Flag
0 C
1 Z
2 I
3 D
4 B
5 -
6 V
7 N
Flag 5 is not used. The DB5 bit is not changed (not connected) when saving the register P to the
DB bus. However, the value of the DB5 bit is checked by the /DBZ control signal (to compare the
value on the DB bus with zero).
96
Logic
97
Notes in the margins for future revisions of the book.
98
Branch Logic
The branch direction is determined by the 7th bit of the branch instruction operand (relative
offset) which is stored on the internal data bus (DB). If the 7th bit is 1, it means that branch is
made "backwards" (PC = PC - offset).
The branch is checked according to the branch instruction (which differs by 6 and 7 bit of the
operation code) as well as the flags: C, V, N, Z.
Branch Forward
The BRFW trigger is updated with the value D7 during BR3.PHI1. The rest of the time the trigger
stores its current value. The value of the trigger is output as a BRFW control signal to the Pro-
gram Counter (PC) control circuit.
99
Branch Taken
The combinatorial logic first selects by IR6/IR7 which group the branch instruction belongs to
(i.e. which flag it checks) and the subsequent XOR selects how the branch instruction is triggered
(flag set/reset). The output of /BRTAKEN is in inverse logic, that is, if branch is triggered, then /
BRTAKEN = 0. The consumer of the /BRTAKEN signal is also the PC control circuit.
Inputs /IR6 and /IR7 are decoder outputs X121 and X126 respectively. The /IR5 input comes
directly from the instruction register.
Note: The Branch Taken logic operates continuously and the value of the /BRTAKEN control line
is updated every cycle, regardless of which instruction is being processed by the processor at the
time.
Logic
100
Notes in the margins for future revisions of the book.
101
Control Commands
"Control Commands" is the conventional name for the large number of control signals that go
from the top of the processor to the bottom and control the context (registers, buses, and ALU).
102
The control commands for the flag register are discussed in the corresponding section on flag
management, since they do not go beyond the top of the processor.
Each control signal usually contains an output latch and sometimes a special "cutoff" transistor
that turns the signal off at a certain half-cycle (usually some of the signals are turned off during
PHI2). This is because the internal buses are pre-charged during PHI2, and the registers are usu-
ally "refreshed" at that time.
Most signals have names like A/B which means that the line "connects" A to B. For example SB/X
means that the value from the internal bus SB is placed in register X.
103
List
All commands are discussed in more detail in their respective sections. The summary table is just
for reference.
Name PHI1 PHI2 Description
Y/SB √ Y => SB
SB/Y √ SB => Y
X/SB √ X => SB
SB/X √ SB => X
S/SB √ √ S => SB
SB/S √ SB => S
The S/S command is active if the SB/S command is inactive. This command simply "refreshes" the
S/S √
current state of the S register.
DB/ADD √ DB => BI
0/ADD √ 0 => AI
SB/ADD √ SB => AI
/ACIN √ √ ALU input carry. The ALU also returns the result of carry (ACR) and overflow (AVR)
ANDS √ √ AI & BI
EORS √ √ AI ^ BI
ORS √ √ AI
SRS √ √ >>= 1
SUMS √ √ AI + BI
ADD/SB7 √ √ ADD[7] => SB[7]. Be careful, all output values are inverse latch values, except for ADD/SB7.
SB/AC √ SB => AC
AC/SB √ AC => SB
AC/DB √ AC => DB
104
Program counter (PC) control
0/ADL0, 0/ADL1, 0/ADL2 √ √ Reset some of the ADL bus bits. Used to set the interrupt vector.
DL/DB √ √ DL <=> DB
PHI2 Pullup
On the left side is a small circuit to pull up PHI2 (which is used by a lot of cutoff transistors, so it
must be quite powerful):
105
106
Address Bus
Although the 6502 communicates with the outside world on a 16-bit address bus, but because
the processor is 8-bit in nature, the address bus is internally divided into two 8-bit halves: an
upper (ADH) and a lower (ADL).
The internal ADH/ADL address bus connects to the external 16-bit bus (pins A0-A15) through
registers ABH/ABL, which contain the last written value (address that has been set).
107
ABH bits:
Control commands:
• 0/ADL0, 0/ADL1, 0/ADL2: The lower 3 bits of the ADL bus can be forced to zero by com-
mands when setting interrupts vector
• ADL/ABL: Place the value of the internal ADL bus on the ABL register
• ADH/ABH: Place the ADH internal bus value on the ABH register
108
Circuit Flow
Consider the behavior of the circuit when ADL = 0:
• The flip/flop of the ABL bit is organized on two inverters (not2 and not3) with not2 acting
simultaneously as a DLatch (whose input Enable is connected to PHI2)
• PHI2: FF is "refreshed" in this half-step.
• PHI1: In this half-step the old FF value is "cut off" by the PHI2 tristate (located to the left of
not2) and the new FF value is loaded from the ADL bus (inverted, see not1) but only if an
ADL/ABL command is active
• The output from not2 organizes the final generation of the output value for the external
address bus. This part of the circuit contains an inverter not3 to form the FF and also an
inverter not4 which controls the amplifier "comb" of the Ax contacts
Logic
On the logic circuits PHI2 is not used, and FF organized on two inverters is replaced by a regular
trigger.
109
Notes in the margins for future revisions of the book.
110
Data Bus
The circuits for working with the external data bus consist of 8 identical pieces:
(The circuit is shown for bit 0, the rest are the same)
• DOR: The DOR latch stores the output value to be placed on the D0-D7 bus pins. If RD=1
the complementary output lines with DOR are cut off, so the whole output part becomes
floating.
• DL: The DL latch stores the input value
• Next to the control signal DL/DB you can see the precharge transistor for the internal bus
DB
Control signals:
The external data bus (pins D0-D7) is also directly connected to the input of the predecode cir-
cuit.
111
WR Latch
From the R/W control circuit, the latch circuit receives a control signal WR. The circuit outputs a
control signal RD which controls the direction of the external data bus.
112
Notes in the margins for future revisions of the book.
113
Registers
The X and Y registers are used for index addressing. Register S is a stack pointer and the stack is
located at addresses 0x100 ... 0x1FF (on the first page).
(In the schematic above, replace SB0 and ADL0 with SBx and ADLx for the remaining register
bits)
Each register bit is based on a trigger, loading and unloading of values on the buses is done by
control signals:
114
Logic
• During PHI1 the X and Y registers output their value to the SB bus / are overloaded with
new values from the SB bus.
• The S register has an input latch and an output latch. During PHI1 the value from the out-
put latch is placed on the SB or ADL buses and the input latch is either loaded with a new
value from the SB bus or refreshed from the output latch (S/S).
• During PHI2 the X and Y registers "store" their old value as the control signals disconnect
them from the bus.
• The S register simply outputs its value to the S or ADL bus during PHI2. The input latch is
overridden because the exchange commands are disabled during PHI2.
The SB and ADL buses are precharged during PHI2. This is done because it takes longer to
"charge" the bus than to "discharge" it. Therefore, when the bus is not needed - it is precharged,
so that it does not have "floating" values. If the value placed on the bus is 1, then the bus is al-
ready prepared ("charged") in advance. If the value placed on the bus is 0, then the bus is
"discharged" to ground.
In modern processors the task of precharging the bus is done by dedicated standard cells called
Bus Keeper.
In the transistor schematic above you can only see the transistors to charge the SB bus (located
in the circuit for the S register bits). The transistors to precharge the ADL bus are scattered next
to the program counter (PC).
115
Notes in the margins for future revisions of the book.
116
ALU
It is not possible to show the whole ALU circuit, so let's saw it into its component parts and con-
sider each one separately.
Generally speaking the ALU is a mess of transistors and wires, but its workings are not very com-
plicated, as you can see later.
117
118
119
AI/BI Latches
The input circuits consist of 8 identical chunks, which are designed to load input values on the AI
and BI latches:
Control signals:
(The picture shows the circuit for bit 0, the rest are the same)
Computational Part
The ALU uses an inverted carry chain, so the even and odd bit circuits alternate.
Bit 0 is slightly different from the other even bits because it has an input carry (/ACIN) and no
SRS input.
(The circuit for bit 1 is shown, the rest are the same)
120
Schematics for bits 2, 4, 6:
(The circuit for bit 2 is shown, the rest are the same)
Anatomically, the left side deals with logical operations, the right side is the adder (Full Adder),
and in the middle is the carry chain.
121
To make it clearer how the intermediate results are obtained, all the main motifs are marked in
the image below:
(Bit 1 is shown, for the other bits the motif looks similar)
122
Logic for odd bits:
123
Fast BCD Carry
This is the circuit that appears in patent US 3991307 (https://patents.google.com/patent/
US3991307A).
How exactly this circuit works is written in the patent, I have nothing much to add. Just a mish-
mash of logic gates - do the same and it will work.
Besides calculating the carry for BCD the circuit also generates the ACR (ALU carry for flags) and
DAAH control signals for the BCD correction circuit.
124
Logic:
(The circuit is shown for bit 0, the others are the same)
• ADD/SB06: Place the value of the ADD latch on the SB bus. The control signal ADD/SB7 is
used instead of ADD/SB06 for bit 7.
• ADD/ADL: Place the ADD latch value on the ADL bus
125
BCD Correction
The BCD correction circuit is controlled by two signals: /DAA (perform correction after addition)
and /DSA (perform correction after subtraction).
The outputs of the circuit are connected to the accumulator inputs (AC) and the circuit takes into
account the ALU operation when the BCD mode is disabled.
Some of the accumulator inputs are connected directly to the SB bus and do not participate in
BCD correction (bits 0 and 4).
The circuit uses 4 auxiliary internal signals in its operation: DAAL, DAAH, DSAL and DSAH. The "L"
in the name stands for the lower part of the bits (0-3), the "H" stands for the higher part of the
bits (4-7).
• The input combinatorial circuits, in various combinations accounting for the 4 auxiliary sig-
nals and the bits of the intermediate result (ADD latches)
• Output xor, one of the inputs of which is a bit of the bus SB, and the second of the above
combinatorial circuits
126
Sawed schematics:
The auxiliary signals /ADDx on the BCD correction circuits are derived from the values of the
ADD latch bits as follows:
127
Logic:
Accumulator (AC)
The accumulator consists of eight identical pieces:
(The circuit for bit 3 is shown, the others are the same)
The accumulator inputs a value from the BCD correction circuit (bits 1-3, 5-7) or directly from the SB bus (bits 0
and 4).
In addition to directly outputting the accumulator to the SB and DB buses, other bus operations are also per-
formed at this point, so they are also discussed in this section.
• SB/AC: Place the value from the SB bus/BCD correction circuit into the accumulator
• AC/SB: Place the AC value on the SB bus
• AC/DB: Place the AC value on the DB bus
• SB/DB: Connect the SB bus to DB bus
• SB/ADH: Connect the SB bus to ADH bus
• 0/ADH17: Forced write 0 to ADH bits 1-7. The control signal 0/ADH0 is used for bit 0 instead of 0/ADH17.
128
Notes in the margins for future revisions of the book.
129
Program Counter (PC)
Because of the 8-bit nature of the processor its instruction counter is divided into two 8-bit
halves: PCL (Program Counter Low) and PCH (Program Counter High).
The PCH is also divided into two halves: the low part of the bits (0-3) and the high part (4-7).
PCL
Represents the low 8 least significant bits of PC.
130
• The circuits alternate for even and odd bits because an optimization known as an inverted
carry chain is used
• The control signal #1/PC (0: perform PC increment) comes to the PCL0 bit
• PCLC (PCL Carry): Carry from the lowest 8 bits (PC[0-7]) to the highest (PC[8-15])
• PCL connects to two buses: ADL and DB
• PCL/PCL is used when PCL is not connected to any bus (to maintain the current state)
• Each bit contains two latches (input latch PCLSx and output latch PCLx) which implement
the counter logic
PCH
Represents the top 8 most significant bits of PC.
The circuit marked as "patch" to form the PCHC is actually between the ADL/PCL and #1/PC
control outputs.
• The basic principles of PCH are the same as PCL, but PCH is divided into two halves: the
lower half (PCH0-3) and the higher half (PCH4-7)
• PCHC (PCH Carry): Carry from the lowermost to the highestermost PCH half
• The PCH connects to two buses: ADH and DB
• PCH/PCH is used when the PCH is not connected to any bus (to maintain the current state)
131
ADL/ADH Precharge
In between the PC bits you can find transistors for precharge of the ADL and ADH buses:
(The image shows the precharge transistors for ADH4 and ADL5. The others are similar)
Logic
It makes sense to show only the bit schematics (the circuitry alternates between even and odd
PCL/PCH bits).
For these circuits to work correctly in the simulator, FF uses a posedge trigger for the PCL/PCH
register.
132
Notes in the margins for future revisions of the book.
133
Afterword
At this point, the prepared reader is likely to ask: Where is the description of how the instructions
work?
Yes, everything on the previous pages is just the tip of the iceberg. Schematics without examples
turn into an ordinary album.
But that is exactly what the A revision book is about: setting the right direction, for further study.
In the next revision the book is planned to be expanded with a lot of examples of circuits in dif-
ferent modes and a detailed examination of the work of all the instructions.
In the meantime, the reader has a valuable material for self-preparation and checking the cor-
rectness of the circuits presented.
134
Used Materials
• Visual6502.org
• 6502.org
• US3991307A - Integrated circuit microprocessor with parallel binary adder having on-the-fly
correction to provide decimal results - Google Patents (https://patents.google.com/patent/
US3991307A)
• emu-russia/breaks: Nintendo Entertainment System (NES) / Famicom / Dendy chip revers-
ing (github.com) (https://github.com/emu-russia/breaks)
• Image of Bender © Fox Interactive
135
Author's Team:
Editor-in-Chief: org
© 2022, emu-russia
136
This book contains descriptions of all MOS 6502 circuits.
If you are good at digital circuitry, the 6502 processor will reveal all its secrets
to you.
The online version of the book is free, the printed version can be ordered from
various offices that print the pdf on paper.
137