Hello, Guest the thread was called1.2k times and contains 25 replays

last post from androSID at the

MOS6530 (MCS6530-004 aka TIM) dissected

  • Thanks to some generous sponsoring by Asklia I was able to decap the MCS6530-004 aka TIM early May 2021.


    ttlworks once again joined and took over the majority of documentation work which I'm proud to reproduce here.*


    Enjoy... and stay tuned for the next chip(s)!



    * As in previous dissections I just copy&paste the text written by Dieter/ttlworks... which should not confuse

    anyone if he speaks of himself or cites some reminiscenses!

  • //Previos thread: 6702 dissection


    This thread is about a transistor level dissection of the 6530-004 (TIM edition),

    brought to you by Frank Wolf and ttlworks.


    6530 was used in the KIM-1, in Commodore disk drives, and in pinball machines.


    Datasheets:

    MOS MCS6530 datasheet, August 1975, preliminary

    MOS MCS6530 datasheet, undated

    Synertek SY6530, April 1979


    Patents by William D. Mensch, Jr.:

    U.S. Patent Number 4,099,232 seems to be related to the 6530 timer.


    Also, there is some info on Hans Otten's 6530-6532 page.


    ;---


    The 6530 RRIOT (RAM, ROM, IO, Timer) is a special chip in the 6502 family.


    6530 contains 64 Bytes of RAM, 1kB of mask programmed ROM, two 8 Bit IO ports, and a Timer.

    //Timer is an 8 Bit down counter with prescaler factors 1, 8, 64, 1024.

    It also contains a mask programmed address decoder.


    The idea at MOS was, that a microcontroller could be built from just two chips: 6502 plus 6530.

    And that up to seven 6530 (each chip containing a different address decoder and different ROM contents)

    could be used in a 6502 system.


    And that's where trouble starts:

    Because of custom address decoder and custom ROM contents,

    when replacing a defective 6530, you can't just buy any 6530, plug it into the socket and hope that it works.

    Even replacing a 6530 with a 6530 pulled from another socket from the same PCB probably won't work.


    It has to be a 6530 which fits to a specific socket on a specific PCB,

    and you need to look out for obscure chip markings and part numbers.



    6532 seems to be based on the 6530, it lacks the address decoder and the ROM, but it has 128 Bytes of RAM.

    6532 was used in the Elektor Junior computer and in the Atari 2600.


    ;---


    6530 contains some circuitry you probably won't expect to see in other 65xx peripheral chips (except for 6531 and 6532).


    When I was a kid, I did two layer PCB layouts on transparent foil with tape and rub-on dry transfers,

    and I think I know how the game goes when things are starting to get a bit dense and complex.


    The 6530 chip layout has that "hand routing smell" all over, it's incredibly dense/compact and complex,

    and I feel a need to salute to the designers (Bill Mensch et al.): it truly is a beautiful/amazing work of art.


    Image


    Again: my thanks to Frank Wolf, because not many out there could polygonize a beast of that sort.


    Now for some oddities of that 6530 "Wolpertinger":

    RESET is fully asynchronous, it's not sampled with the clock.

    PHI2_in has 30pF typ. input capacitance, because it directly and unbuffered feeds quite some circuitry on the chip.

    Signals from PA0..7 and PB0..7 are not latched at PHI1, the CPU reads them directly.

    ;

    Bus interface uses fully static latches for data writes, but read data bus uses a dynamic precharge mechanism.

    Bus interface uses fully static latches for the address, IO logic uses fully static register Bits,

    and the logic which sits in between and controls said IO logic uses dynamic latches.

    ;

    //That mix of static and dynamic logic started to make me wonder,

    //at which point of the 6530 design phase the specification for the 6502 bus timing had rolled out.

    //It would be interesting to read a "the making of the 6530" story.


    Some features:

    PA0 and PB0 have push/pull outputs for driving darlington transistors etc.

    PA1..PA7 and PB1..PB7 have open_drain outputs with integrated pullup resistors.

    However, there is a mask programmed option to disable the PB5 and PB6 output drivers

    and to use PB5 and PB6 as inputs for the address decoder.

    PB7 is supposed to be used as a Timer underflow IRQ# output, and it lacks the pullup resistor.


    Note:

    For consistence with Frank's notation, low_active signals are named foo#, not /foo.


    Orientation for all the chip pictures: A5 and R/W# pads are North.

  • Eagle 6.4 schematics for my schematic pictures in this thread,

    just in case if somebody needs them.


    Note: KiCad is supposed to be able to import these schematics,

    unfortunately it doesn't seem to be possible to disable the layers 'name' and 'value' in KiCad schematics,

    so making my schematics look nice and clean in KiCad will require some work, sorry.


    6530_dissect_schematics.zip

  • 0) cheat sheet


    A very simplified schematic to give an overview about what came out during the dissection.


    Note:

    Latches labeled FSTL are fully static transparent latches (built around a RS flipflop).

    Latches not labeled FSTL are dynamic transparent latches (just a FET switch plus some trace capacitance).




    A picture of the 6530 silicon, with the interesting areas marked according to the cheat sheet.


    Don't worry because the RAM and the ROM lack any details in the cheat sheet and in this picture,

    we are getting there later.



    Just as a reference, another picture of the 6530 silicon without the markings.


  • 1) clock generation


    Nothing special in there.


    However, it should be noted that PHI2_in also directly and unbuffered drives quite some circuitry on the chip.


    6530 PHI2_in has 30pF typ. input capacitance, for a NMOS 6522 20pF typ. would be normal.


    When using multiple 6530 (or 6532) chips in a system,

    it probably would be a good idea to keep an eye on the total capacitive load of the 6502 PHI2 output driver

    (and on the 6502 propagation delay PHI0_in to PHI2 output, which might be different for rising and falling edge of the clock).



  • 2) RESET


    The low_active RES# signal from the pad goes through an inverter, then through a non_inverting super buffer,

    and becomes the high_active RES signal (which puts the chip into a RESET).


    Note, that the 6530 RESET is fully asynchronous, and not sampled with the clock.

    Means, a glitch on RES# to logic low level at any time most likely will cause a RESET.


    RES clears the PRA and PRB IO port data registers.

    RES clears the DDRA and DDRB IO port data direction registers, configurating the PA0..7 and PB0..7 IO port pins as inputs.


    But be aware: RES does not affect the timer, the Timer Interrupt flag, the prescaler, and the prescaler factor.


    RES makes sure that PB7 is not pulled low while RES is active.

    RES also sets the latch for the PB7 interrupt generation to "disabled".

    But if there is something like an accidental Timer read during the RESET sequence of a 6502,

    A3i could enable PB7 interrupt generation, and then there might be a falling edge on PB7 in the wrong moment...

    For more details, please see "16) Timer control".




  • 4) A0


    Like RS0, high_active A0 from the pad is sampled with PHI1 into a fully static transparent latch.

    A special thing is, that the latch feeds push/pull output drivers which generate

    the low_active A0i# and the high_active A0i.


    When taking a look at the chip layout, it appears that big transistors are located between the address pads.

    They somehow look like output drivers (for external signals) to be found in other chips,

    but they are driving the internal address lines inside the chip instead.


    I think it's a good/clever idea to re_use an output driver structure/topology for driving internal address lines

    to deal with the capacitances build up by the RAM and ROM address decoders.



  • 5) A9


    Since the A9 input buffer circuitry layout is different from A0,

    I felt a need to take a closer look at it,

    but from the logic design point of view the input circuitry for A0 and A9 is identical.


    Layout of the A1..A5 input circuitry is identical to A0.

    Layout of the A6, A7 input circuitry is identical to A0, but it's mirrored to make better use of chip space.


    Layout of the A8 input circuitry is a variation of A9.



    Now for a list of signals generated by the A0..A9 output drivers:

    West to East: A0i#, A0i; A1i#, A1i; A2i#, A2i; A3i#, A3i; A4#i, A4i; A5i#, A5i; A6i, A6i#; A7i, A7i#; A8i, A8i#;


    North to South:

    A9i,

    A9i#;



  • 6) CS1 latch


    The CS1 latch is a fully static transparent latch, which samples PB6 at PHI1,

    and gives out the high_active CS1 signal to the address decoder PLA.


    Similar to the CS1 latch,

    the CS2 latch also is a fully static transparent latch, which samples PB5 at PHI1,

    and gives out the high_active CS2 signal to the address decoder PLA.



    Both latches are located between the RES# pad and the RAM block.



  • 8) DB7


    Overview:


    DB0..7 external data bus pads (high_active).


    Internal write data bus D0..7w# (low_active) when writing registers.

    //Internal write data bus D0..7w (high_active) is generated by super buffers located South in the IO logic block.


    Internal read data bus D7r# (low_active) when reading registers.

    //The read data bus is precharged during PHI1 with FETs located South in the Timer block.


    Layout for the DB0..6 circuitry is pretty similar to DB7, so we only take a look at DB7.


    ;---


    On the input side, the high_active DB7 pad is sampled with PHI2_in into a fully static transparent latch,

    which feeds a push/pull driver generating the low_active D7w# signal for the write data bus.

    //Note, that the PHI2_in signal controlling the DB0..7 latches comes directly and unbuffered from the PHI2_in pad.


    On the output side, the low_active OE_DB# control signal enables the inverting DB7 push/pull driver

    which takes the low_active D7r# signal from the read data bus and emits it in high_active form

    on the external DB7 data bus pad.



  • 9) PB7


    PB7 is an open drain IO port signal, which lacks a pullup resistor.


    In addition to being an IO port signal,

    it also works as a (low_active) Timer overflow interrupt output,

    supposed to be tied to the IRQ# pin of a 6502.


    The PB7 pullup resistor (FET) is present in the chip layout,

    but the diffusion layer between the pullup and VCC is cut.

    I think that's because if the PB7 pads of multiple 6530 chips are tied to IRQ#,

    and every 6530 would have a PB7 pullup resistor,

    the resulting impedance of all the PB7 pullup resistors in parallel on the IRQ# line

    would be too low for a 6530 PB7 output driver to pull down IRQ# to a logic low level.


    ;---


    Not much to say on the output side:

    if PB7o# is high OR IRQ is high, the output driver pulls PB7 low.

    //For logic high level, you need to add an external pullup resistor between PB7 and VCC.


    In the IO logic block, PB7o# is the output of a NOR gate fed by data bit PRB7 and data direction Bit DDRB7#.

    If PRB7=0 (data Bit low) and DDRB7=1 (PB7 is output), PB7o# is high, and PB7 is pulled to GND.


    The high_active IRQ signal is generated in the Timer control block.

    //IRQ can be enabled/disabled with A3 during Timer reads/writes.

    If it's enabled AND if the Timer Interrupt flag is set, IRQ is high, and PB7 is pulled to GND...

    ...by ignoring the PRB7 and DDRB7 Bits.


    ;---


    On the input side, the PB7 pad signal goes through two inverters, becomes PB7i and goes to the IO port logic,

    IO port logic places it in inverted form on the D7r# read data bus when reading data register PRB,

    we are getting there later.


    Note, that the PA0..7 and PB0..PB7 input signals are not latched at PHI1, the CPU reads them directly,

    we are getting there later, too.



  • 10) PB6


    PB6 pad also feeds CS1 latch, PB6 pad also feeds CS2 latch,

    CS1 and CS2 are used in the (mask programmed) address decoder PLA of the chip we had dissected,

    and as a mask programmed option the metal trace between PB5,PB6 pad and PB5,PB6 driver is cut.

    //You don't want the chip to be able to remove itself from the system by disabling its own chip select.


    PA1..7 and PB1..6 pad circuitry is pretty similar to PB7.

    They are open drain outputs with pullup resistor (FET).

    So we just focus on PB6:


    ;---


    On the output side, if PB6o# is high, and if the metal trace wouldn't be cut, the output driver would pull PB6 low.


    In the IO logic block, PB6o# is the output of a NOR gate fed by data bit PRB6 and data direction Bit DDRB6#.

    If PRB6=0 (data Bit low) and DDRB6=1 (PB7 is output), PB6o# is high.


    ;---


    On the input side, the PB6 pad signal goes through two inverters, becomes PB6i and goes to the IO port logic,

    IO port logic places it in inverted form on the D6r# read data bus when reading data register PRB,

    we are getting there later.


    Note, that the PA0..7 and PB0..7 input signals are not latched at PHI1, the CPU reads them directly,

    we are getting there later, too.



  • 11) PB0


    PA0 and PB0 have a pullup resistor (FET),

    but unlike PA1..7 and PB1..7, PA0 and PB0 have true push/pull output drivers.


    PA0 and PB0 are meant to source 3mA for driving darlington transistors and such.


    PA0 and PB0 circuitry layout is different to make better use of chip space,

    but electrically they are identical, I checked.

    So we now focus on PB0.


    ;---


    On the output side:


    PB0 output driver is enabled by DDRB0=1 (when PB0 is configurated as an output).

    PRB0# which goes into the output driver is the low_active output signal of the PRB0 data register Bit.


    When DDRB0=1:

    If DDRB=1 and PRB0=0 (PRB0#=1), the output driver pulls PB0 low.

    If DDRB=1 and PRB0=1 (PRB0#=0), the output driver pulls PB0 high.

    And that's all there is to it.


    ;---


    The input side is more complicated:


    There is a danger that the voltage at PB0 doesn't reach logic high level

    when the PB0 driver has to source a lot of current.


    That's why we have sort of a 2:1 multiplexer controlled by DDRB0 (data direction register Port B).

    The multiplexer generates PB0i, which goes to the IO port logic,

    IO port logic places it in inverted form on the D0r# read data bus when reading data register PRB,

    we are getting there later.


    If PB0 is configurated as an input, PB0i is generated from the PB0 pad.

    If PB0 is configurated as an output, PB0i is generated from the data register Bit PRB0.

    //I'm simplifying things a bit here.


    Note, that the PA0..7 and PB0..7 input signals are not latched at PHI1, the CPU reads them directly,

    we are getting there later, too.



  • 12) PLA


    (mask) programmed logic array (PLA), also known as "the address decoder".

    Mask programmed as in "customer specific".


    It decides, where ROM, RAM and IO (including Timer) show up in the 6502 address space.


    Located high up North, between A5 pad and R/W# pad.



    Basically, we have three NOR gates:

    One for selecting ROM: fed by CS1, CS2, RS0i. //CS1#, CS2#, RS0i# respectively.

    One for selecting RAM: fed by CS1, CS2, RS0i, A6..9i. //CS1#, CS2#, RS0i#, A6..9i# respectively.

    One for selecting IO: fed by CS1, CS2, RS0i, A6..9i. //CS1#, CS2#, RS0i#, A6..9i# respectively.


    Where CS2 is supposed to be A12, CS1 is supposed to be A11, and RS0 is supposed to be A10.



    //The A0..9 input buffers emit A0..9i (high_active) and A0..9i# (low_active).


    We have three inverters, generating CS1# from CS1, CS2# from CS2, and RS0i from RS0i#.


    ;---


    For those who are new to the game:


    In the polygonized chip picture, red is diffusion layer, green is PolySi layer, blue is metal layer.

    Where ever green crosses red, that's the active region of a FET, and green is the Gate of that FET.


    So the PLA was mask programmed by changes in the diffusion layer.



  • 13) some logic


    A tangled mass of logic gates located North East from the RAM, between RAM and ROM.


    It generates ROM# (low active) from ROM (high active), RAM# from RAM, IO# from IO.


    Also, it generates RAM_W (high_active), the RAM write enable signal,

    which is 1 when PHI1=0 (what is different from "when PHI2=1"), AND when RAM is selected, AND when W/R#=1 (write).



    Also, it generates OE_DB_R (high active),

    which is 1 when ROM OR RAM OR IO is selected,

    AND when RES is inactive, AND when W/R=0 (read).


    In 14) IO control, there is a NAND gate fed by OE_DB_R and PHI2_in which generates the low_active OE_DB# signal.

    OE_DB# enables the DB0..7 output drivers.



  • 14) IO control


    The IO control block is located below the South East corner of the RAM, East of the IO logic block.

    It generates the read/write control signals for the IO logic.


    First, we have a PLA like structure (containing 8 NOR gates), which is enabled when IO#=0 and A2i#=1.

    According to A0i, A1i and W/R#, it generates 4 read signals and 4 write signals.


    ;---


    The 4 read signals from the "IO control PLA" are sampled with PHI1 by dynamic transparent latches.

    The latch outputs then control FET switches, a closed switch puts PHI2 on the read control lines for the IO logic.

    IO read control signals are all high_active: R_PRA, R_DDRA, R_PRB, R_DDRB.


    Note, that there are 4 switches West of of the IO logic, wich tie these 4 IO read control signals to GND during PHI1.


    ;---


    The 4 write signals from the "IO control PLA" are sampled with PHI2 by dynamic transparent latches.

    A latch output goes through an inverter, then together with PHI2_in into an "open collector" NOR gate.


    Means if a write signal from the "IO control PLA" latched at PHI2 is high, AND PHI2_in is low,

    the NOR gate stops pulling the IO write control signal to GND, which then is pulled to high by a pullup resistor (FET).

    IO write control signals are all high_active: W_PRA, W_DDRA, W_PRB, W_DDRB.


    Note, that there are 4 switches West of the IO logic, which tie these 4 write control signals to GND during PHI2_in.


    The trick is, that the data from DB0..DB7 is sampled into static transparent latches during PHI2_in = HIGH.

    The latches place D0..7w# on the write data bus.

    The IO registers are written with this data during PHI2_in = LOW.


    //This is something you probably won't expect to see in a 65xx peripheral chip...


    ;---


    Decoding:

    IO has to be selected, A2i has to be 0.


    According to A0i, A1i and W/R#, we have:


    00 read: during PHI2=high: R_PRA

    01 read: during PHI2=high: R_DDRA

    10 read: during PHI2=high: R_PRB

    11 read: during PHI2=high: R_DDRB


    00 write: during PHI2_in=low: W_PRA

    01 write: during PHI2_in=low: W_DDRA

    10 write: during PHI2_in=low: W_PRB

    11 write: during PHI2_in=low: W_DDRB


    ;---


    Also, West in the IO control block we have a single NAND gate.

    When OE_DBR (mentioned in "13) some logic") is high AND PHI2_in is HIGH,

    it sets the low_active OE_DB# signal to low.


    OE_DB# enables the DB0..7 output drivers.



  • 15) IO logic.


    IO logic block is located East of the PB0, PB1 buffers/drivers and West of the IO control block.


    South in the IO logic block, we have eight inverting super buffers, which generate D0..7w (high_active) from D0..7w# (low_active).


    Since the layout for the IO block Bits is more or less identical,

    we just focus on the IO logic for Bit 7.


    ;---


    Output side:


    PRA (write) is data register for port A output (PA0..7).

    DDRA (write) is data direction register for port A, if a Bit is 1 this means the according PA0..7 pin is configurated to work as an output.


    The PRA, DDRA register Bits are static RS flipflops, which are cleared during RES=high.

    Note, that RES (high_active) is the inverted signal from the RES# pad (low_active),

    not sampled by any clock, take care.


    When one of the IO the write control signals W_PRA, W_DDRA, goes high,

    D0..7w and D0..7w# are fed to both transistors of a RS flipflop in the according register Bit by FET switches.

    And yes, that's "differential" signals and two FET switches per register Bit.


    For PA1..7, we have seven NOR gates which generate PA1..7o# signals, telling the output drivers to pull PA1..7 to GND,

    when a PRA register Bit is 0 and the according DDRA register Bit is 1 (when PA1..7 is configurated as an output).

    //Pullup resistors (FETs) to VCC are pulling PA1..7 to high when the output drivers are not pulling PA1..7 to GND.

    Since the PA0 output is a true push/pull driver, it lacks the NOR gate.

    See "11) PB0", which discusses the PA0 and PB0 driver/buffer circuitry.


    For port B, the game is similar, just with PB0..7, PRB and DDRB.

    But in the chip we had dissected, the PB5 and PB6 drivers were disabled because PB5 and PB6 were used as inputs for chip select signals.

    Also, PB7 can be used as #IRQ output, and in this case the Timer control block overrides PRB and DDRB when generating an interrupt on PB7.

    Note, that PB7 lacks the pullup resistor (FET), means one has to add an external pullup resistor for a logic high level on PB7.


    ;---


    Input side:


    When reading DDRA, the DDRA register Bits are placed on the read data bus D0..7r# in inverted form by FET switches, and that's all there is to it.


    The signals from the PA1..7 pads are buffered as PA1..7i.

    When reading PRA0..7, we have eight "open collector" NAND gates which pull the read data bus D0..7r# low

    if the according DDRA Bit is low (PA1..7 configurated as an input, that is) and PA0..7i is high.


    For PA0i it's a bit different:

    If PA0 is configurated as an input, PA0i comes from the PA0 pad.

    If PA0 is configurated as an output, PA0i comes from the PRA0 register Bit.

    For details, again please see "11) PB0", which discusses the PA0 and PB0 driver/buffer circuitry.


    For Port B, the game is similar.


    ;---


    65xx peripheral chips usually sample port input signals during PHI1, but the 6530 doesn't.

    6530 just places the signals from the IO port on the DB0..7 CPU data bus, the 6502 samples DB0..7 at the falling edge of PHI2, and that's it.

    That's not good for signal integrity.


    See, many years ago I had built counters for incremental encoders at work with XC95108 CPLD chips.

    Out of paranoia, I had tied three counters to one encoder, and after some hours of operation all of them counters had a different value.

    For position control in machine engineering, that's not good.


    I had tried a lot of different things:

    creative placement of capacitors of different size into the power supply, active/passive termination of the clock signal,

    filtering the signal inputs with shift registers and whatnot...

    What eventually had fixed the problem was running the counter with the non_inverted clock,

    and putting flipflops controlled by the inverted clock into the input signals.

    Sounds familiar when talking about PHI1 and PHI2... but I'm getting off topic.


    Whether you want to have transparent latches sampling PA0..7 and PB0..7 during PHI1 or not

    when building a TTL or FPGA implementation of the 6530, that's your decision.



  • 16) Timer control


    The Timer control block is located North of the DB3, DB4 drivers/buffers,

    East from the Timer block.


    Also, we have a little bit of logic for Timer Interrupt flag and PB7 IRQ generation West from the Timer block,

    which technically also belongs to the Timer control block.


    ;---


    Address decoding:


    To make things simple:

    We have three NOR gates, which generate three high_active control signals when PHI1 is low

    (what is different from "PHI2 is high") AND when IO is selected AND when A2i is high.

    R_TMR (read Timer) when A0i is low AND W/R# is low (read).

    R_IRQ (read Timer underflow Interrupt flag) when A0i is high AND W/R# is low (read).

    W_TMR (write timer) when W/R# is high (write). //Note: A0i doesn't matter here.


    R_TMR and W_TMR are switched to GND by FETs during PHI1:

    For R_TMR, one FET located West from the Timer block.

    For W_TMR, one FET located West from the Timer block, and another FET located in prescaler counter Bit 0.


    ;---


    Predivider control:


    We have a predivider, basically a ten Bit down counter running at PHI2_in speed,

    which is cleared when writing the Timer by W_TMR.

    //Predivider counter Bits change with PHI2.


    We have three latches for the prescaler factor, written with W_TMR.

    Depending on A0i and A1i, only one of the latches can be set to 1, default is 0.


    00: PRE1=1, PRE8=0, PRE64=0. No predivider, Timer is running at PHI2_in speed.

    01: PRE1=0, PRE8=1, PRE64=0. Predivider factor 8, Timer is running at PHI2_in/8.

    10: PRE1=0, PRE8=0, PRE64=1. Predivider factor 64, Timer is running at PHI2_in/64.

    11: PRE1=0, PRE8=0, PRE64=0. Predivider factor 1024, Timer is running at PHI2_in/1024.


    Active predivider counter Bits:

    Three when PRE8=1.

    Six when PRE64=1.

    Else, all of the ten predivider Bits are active.


    In the predivider block, we have a ten input NOR gate which generates the IS0 signal.

    If IS0 is high, all of the active predivider counter Bits are zero. //I'm simplifying things a bit here.


    ;----


    Timer control:


    We have a Timer, basically an eight Bit down counter,

    read with R_TMR, written with W_TMR,

    Timer Bits change with PHI2.


    The low_active CEN# signal enables Timer counting.

    If PRE1 is high, CEN# always is active, and the Timer is running at PHI2_in speed.

    ;

    IS0 is sampled with a transparent latch at PHI1,

    means that if IS0 was high in the previous PHI2_in cycle, CEN# is active for the current PHI2_in cycle.

    ;

    If the Interrupt flag is set, CEN# is active: the timer is running at full speed.

    ;

    W_TMR also puts CEN# active, and I don't know why,

    because the Timer counter circuity ignores CEN# when W_TMR is active.


    The Timer uses a carry lookahead mechanism for the lower 5 Bits,

    that's why we have that Tcin5 signal, we are getting there later in "18) Timer".


    ;---


    Timer underflow Interrupt flag and IRQ generation:


    6530 Interrupt flag basically is a RS flipflop built from two NOR gates.


    Timer Bit 7 carry output TC# (low_active, signaling Timer underflow, changes with PHI2) is sampled with a transparent latch during PHI1.

    TC# is active, when the (decrementing) Timer is at $00 in the current PHI2_in cycle (and will roll over to $FF in the next time).


    If TC# was active in the previous PHI2_in cycle, the latch output does set the 6530 Interrupt flag (through an inverter)

    during PHI1 in the current PHI2_in cycle.


    We have another transparent latch, which samples the Interrupt flag during PHI2.

    If the output of that latch is active, three things will happen:

    ;

    CEN# is active, the Timer counts a step during the current PHI2_in cycle.

    ;

    If the PB7 IRQ output is not disabled, AND RESET is not active,

    the IRQ signal goes active during PHI2 of the current PHI2_cycle and tells the PB7 driver to pull PB7 to GND.

    //If PB7 is tied to the IRQ# input of the 6502, this signals a 6530 Timer underflow IRQ# to the 6502.

    ;

    When the Interrupt flag is read by R_IRQ during PHI2, read data bus D7r# is pulled low,

    means the 6502 sees DB7 '1' what indicates that the 6530 Interrupt flag is set.

    //read data bus D0..7r# lines which are not pulled to GND during PHI2 give us '0' on DB0..7.

    //That's why DB0..6 are '0' when reading the Interrupt flag.


    The Interrupt flag is cleared in the current PHI2_in cycle by reading/writing the Timer (if R_TMR OR W_TMR goes high).


    ;---


    Now for the last part: disabling PB7 IRQ.


    We have a latch which samples A3i# during Timer reads (R_TMR=high) OR Timer writes (W_TMR=high).

    The output of that latch gives us the signal IRQ_DISABLE.

    If IRQ_DISABLE is high, IRQ is disabled, and the Timer Interrupt flag won't cause that PB7 is pulled low.


    When reading/writing the Timer,

    A3i=0 disables and A3i=1 enables PB7 IRQ generation during PHI2 in the current PHI2_in cycle.

    Also, the Interrupt flag is cleared in the current PHI2_in cycle.


    Note, that the PB7 IRQ generation ignores the PRB7 and DDRB7 IO register Bits.



    Also note, that RESET does not affect the 6530 Interrupt flag, Timer, prescaler, and prescaler factor.


    RES makes sure that PB7 is not pulled low by IRQ while RES is active.

    RES also sets the latch for the PB7 interrupt generation to "disabled".


    But if there is something like an accidental Timer read during the RESET sequence of a 6502,

    A3i could enable PB7 interrupt generation, and then there might be a falling edge on PB7 in the wrong moment...


    If PB7 is tied to IRQ# of the 6502, there is no problem, because the 6502 does not mind an active IRQ# during its RESET sequence.


    If PB7 is tied to NMI# of the 6502, there is a problem, because a falling edge on #NMI in the wrong time might disrupt the 6502 RESET sequence.

    And that the RES# input of the 6530 is not synchronized with a clock actually makes things worse, because the 6502 _does_ synchronize its RES# input with a clock.


    For more info, please read Rockwell 6532 timer interrupt precautions .