MOS6509R7 dissection - IDKFA

16) PHI1# driver

PHI1# driver is located a bit East from the A4 pad in the silicon.

It's an inverting super buffer, fed by PHI1, sending PHI1# through two metal traces

into "17) control signal latches\drivers".

IIRC the NMOS 6502 uses two smaller inverting super buffers instead,

each of them driving a PHI1# metal trace separately.

That part of the 6509 CPU core definitely is different from the NMOS 6502.

;---

It's the first time I have seen a pulldown FET used inside a super buffer,

and I wonder why the designers did it that way.

17) control signal latches\drivers //actually 17a)..17f)

They are located East from "16) PHI1# driver" in the silicon, North from the mill.

And they are turning most of the outputs of the random logic area

into control signals for the mill.

17a) layout is a bit different from 17b)..17f) layout to make better use of chip space.

South from the mill, at the other end of the PolySilicon control signal traces,

there are FETs switching some of the control signals during PHI2,

and technically they belong to 17).

Control signals switched to GND during PHI2 (from West to East):

Y>SB, X>SB, SB>Y, SB>X,

SB>S, S>S,

DB>ADD, DB#>ADD, ADL>ADD, SB>ADD,

SB>A, A>SB, A>DB,

ADH>PCH, PCH>PCH, PCL>PCL, ADL>PCL.

Maybe there wasn't enough free chip space for switching some

of the other control signals to GND during PHI2, too.

Note, that all of the control signal latches\drivers are inverting,

except for ADD>SB7, which is non_inverting.

;

In the original MOS 6502 schematics, the input and output of the ADD>SB7

latch\driver is labelled 'ADD>SB7'.

To avoid further confusion, I had named the input 'ADD>SB7_'.

;---

The switches pulling control signals to GND during PHI2

at the other end of the PolySilicon traces just are a hardware trick

to make sure that the control signal really is low during PHI2,

to compensate for trace capacitance/resistance.

We already had seen such things in the 6530.

For control signals which wich are inactive when PHI1# =high OR PHI2 =high:

from the logic design point of view, PHI1# OR PHI2 looks like PHI1#,

so when trying to show just how things work we could throw

the PHI2 gating out of the equations.

6509_17_control_driver.zip

18) P

What I called 'P' is located East from "17f) control signal latches\drivers" in the silicon.

It's the "front end" for reading/writing the Flags to/from the DB bus,

we could say it's what the "end user" sees as the status register.

Also, it contains an 8 input NOR gate, which checks if the DB bus is $00

for Z Flag evaluation. //DBZ# is 0, if DB bus is $00.

Also, it contains an inverter which turns the high_active ALU carry output ACR

into the low_active ACR# signal.

In the cheat sheet, I had used 7404 and 74125 type gates between the Flag outputs and the switches

connecting to the DB bus, but in reality it's more something like

"7405\7407 open collector inverters\buffers with pullup",

please keep this in mind when digging into the "illegal" NMOS 6502 instructions.

19) Flags

Flags are located North East from "18) P" in the silicon,

and technically they are integral parts of the random logic area.

Everything is pretty much standard, outputs of the Flags change during PHI1,

but note that the inputs and outputs of the Flags are low_active.

In addition to the Flags N, V, D, I, Z, C,

we also have a Flag labelled "POS" in the NMOS 6502 schematics.

It is not visible to the "end user", and it is used for detecting

a 256 Bytes page crossing during branch instructions.

;---

The way how the I Flag is set in the T6 cycle of a BRK\INT sequence

for masking/disabling the IRQ# interrupt isn't easy to spot:

The low_active output I# of the I Flag is generated by a FET\inverter

switching to GND plus a pullup resistor (FET).

;

Mid West in "27) random 3", we have another FET which switches I# to GND during T6.

The related signals are labeled 'I#', '23.C' (which is active during T6), '23.Z' (high_active I).

The trick is, that the two FETs switching I# to GND plus the pullup are forming a NOR gate.

BTW: It's not that unusual in a 6502 like core to have FETs in different areas of the silicon

connected by long traces, forming up a logic gate... considering how 'ADH>ABH#' is generated...

;---

It's nicely done how a falling edge at the CPS pad sets the V Flag.

//The falling edge detector sensing the CPS pad was done in a previous dissection.

20) Flag multiplexer

It is located South West from "19) Flags" in the silicon.

6502 features conditional branches.

"conditional" means testing if a specific Flag is 0 or 1.

It breaks down to a 4:1 multiplexer, with signals from the Flags N,V,Z,C at the data inputs.

At the two control inputs, we have Bit 7 and Bit 6 from the instruction Byte,

selecting which one of these 4 Flags is to be tested.

We have something like an XOR gate, which does invert/not_invert

the multiplexer output depending on Bit 5 from instruction Byte,

generating the signal BRN# which is low when the condition is met

and the branch should be taken.

Said XOR gate is for testing if the selected Flag is 0 or 1.

;---

That's how it conceptually works, except that the Flag outputs are low_active,

and that Bit 5..7 from the instruction Byte also arrive at 20) in low_active form.

Inverted instruction Bit 5 comes from "21) instruction register".

Inverted instruction Bits 6,7 are generated by the PLA from the outputs

of "21) instruction register".

21) instruction register

Instruction register is located North from "20) Flag multiplexer" in the silicon,

a bit South from the D0 pad.

Basically, it sends the instruction Byte in inverted and non_inverted form into the PLA,

also it sends Bit 5 of the instruction Byte in inverted form as signal 'I5A#'

to "20) Flag multiplexer".

In the original MOS 6502 schematics, we have transparent latches between the D0..7 pads

and the instruction register, sampling the instruction Byte from D0..7 during PHI2.

In the 6509, the designers had pulled a trick for saving chip space:

these latches are a hidden/integral part of the D0..7 input buffers,

but it's not obvios to spot that.

So I explicitly had inserted these latches in the input buffers in my cheat sheet,

because if you miss that they are there, your FPGA implementation of the 6509

most likely won't be working at all.

;---

Note the IBE# signal which controls the 8 logic gates at the input of the instruction register,

that's a mechanism to make the instruction register load $00 during the next instruction fetch,

ignoring the Byte from D0..7.

$00 is the BRK instruction, a software interrupt.

When "23) interrupt logic" has detected RES#, NMI#, or IRQ#,

it uses this mechanism for faking a BRK instruction,

tricking the rest of the CPU into actually executing a BRK sequence without incrementing PC

(to make sure that the already fetched instruction Byte is read again after a RTI),

the BRK sequence then fetches the interrupt vector with a little bit of help

offered by "23) interrupt logic".

It's another neat trick for saving some chip space.

;---

Integral part of the instruction register is the predecoder.

It connects to the outputs of the 8 logic gates which do that "BRK faking trick".

The predecoder is another little lump of logic gates,

checking the instruction Byte at the end of the instruction fetch cycle for two things:

Signal '1ByteOp#' is low, if the instruction has one Byte.

Since 6502 instructions take at least 2 cycles, the 6502 pipeline needs this signal

to prevent a PC increment in the second cycle of an instruction.

Signal '21.A' is low for instructions which take two cycles,

and where the ALU operation could be done in parallel with the next instruction fetch.

This signal goes to the sequencer.

Note, that the signals '1ByteOp#' and '21.A' are affected by that "BRK faking trick".

22a) sequencer for T0#, T1#

It's integral part of the random logic area, and not easy to spot.

It is located West from "21) instruction register" in the silicon.

It generates the low_active signals T0# and T1# for the PLA.

In the MOS 6502 schematics, we have two signals labelled 'T1' and 'T1#'.

Funny thing is, that they are not directiy related, but a different pair of shoes.

Means when inverting 'T1', what you get is very different from 'T1#', and vice versa.

To avoid further confusion, I had named 'T1' as 'T11' in my schematics.

T11 also goes through a non_inverting buffer to the SYNC pad.

The "T0#, T1# sequencer" is a bit tricky, and when just having it on your desk

without the circuitry around it, it doesn't become too obvious what it is doing.

So please take a look at "0) cheat sheet" to see, what connects to the

"T0#, T1# sequencer".

Signal 'METAL#' changes during PHI2 and tells that all of the cycles of an instruction

are complete... I think.

;---

22b) sequencer for T2#, T3#, T4# T5#

It is located West from the PLA in the silicon, a bit East from the A0 pad.

Basically, it's just a shift register with T11 at the input, feeding the low_active outputs T2#..T5# into the PLA.

Outputs change with PHI1.

Shifting is enabled when RDY# is low, but be aware that RDY# is not what you get when just inverting RDY.

METAL# sampled during PHI1 directly clears the shift register outputs, setting T2#..T5# to 1.

Again: for some more clues, see "0) cheat sheet".

;---

Note, that a BRK\INT sequence also requires state T6.

The T6 flipflop happens to be integral part of 23a), the NMI# related interrupt logic,

and it is triggered by the PLA.

Again: for some more clues, see "0) cheat sheet".

23) interrupt logic

It is part of the random logic area.

Part 23a) is located South from "22b) T2#..T5# sequencer" in the silicon,

a bit East from the A1 pad.

It contains the NMI# related logic and the T6 state flipflop.

Part 23b) is located North from "17a), 17b) control signal latches\drivers" in the silicon,

quite a bit East from the A2 pad.

It contains the RES# related logic,

and it generates the control signals for the ADL0..2 interrupt vector.

It also contains "the upper half" of the multifunction gate which generates ADH>ABH#,

the control signal responsible for transferring the contents of the ADH bus into

the ABH latches which are feeding A8..A15.

Part 23d) is located East from 23b) in the silicon.

It contains the IRQ# related logic,

it also generates the signal which shows up in the status register as "the B Flag".

//

//in the 6502, there is only one interrupt vector for both IRQ# and BRK.

//

//so the "end user" has to check the status register Byte which was pushed on the stack

//during the IRQ# or BRK sequence to find out if the cause of the interrupt

//either was IRQ# (B=0) or BRK (B=1).

;---

So... what about part 23c) ?

Part 23c) consists of a 2 input NOR gate and an inverter.

The NOR gate is fed by PLA term 26 "T5.INT", and the inverted RDY# signal.

Again: when inverting RDY#, what you get is very different from RDY.

PLA term 26 is active in state T5 during a BRK\RES#\NMI#\IRQ# sequence,

and it is Visual6502 Node 370.

;

If you take a look at the 6509 orientation picture:

6509_23c.png

Those little red dots floating around in the white "25) random 1" area... that's 23C).

And for the rest of the random logic area it's a lot worse, but we are getting there later.

;---

What the functional blocks of 23) are doing isn't that obvios if you have them

in isolated form on your desk.

But it becomes obvious in the documentation in "0) cheat sheet".

24) PLA

PLA, "programmable" logic array, it is located North from the random logic area in the silicon.

And if you ask me, the layout of the PLA basically looks pretty much like a part of the 6530 ROM area.

It's big, and it's easy to mess things up while dissecting it, so I broke it into 9 parts:

East to West 24a)..24i).

The instruction Byte from the instruction register [see 21)] enters the PLA at the East in inverted and non_inverted form.

T0# and T1# from the first sequencer [see 22a)] enter the PLA from the South East.

T2#..T5# from the second sequencer [see 22b)] enter the PLA from the West.

They connect to horizontal PolySilicon traces which form the rows of the PLA, connecting to inputs of the NOR gates.

Most of the colums are just NOR gates, means the PLA outputs are supposed to be high_active.

NOR gates are vertical metal traces with a pullup resistor (FET) at the North ends,

and with FETs switching to GND attached to them.

FETs switching to GND are controlled by some of the horizontal PolySilicon traces.

The South end of the vertical metal traces is the PLA output.

But in order to save chip space, the designers had routed three signals through otherwise dead PLA NOR gates:

24:IRQP#, 89:RDYP, 90:RES.

Three more of the NOR gates (or "PLA product terms") are not used: 107:, 114:, 123:.

And we have some product terms which are a bit different from the others:

RDY1# goes into 80:T0.BR,

108:Tx.PSH_PUL goes into 92:T2.ANY_ABS and 99:T3.ANY_ABS,

136:Tx.PSH_PUL_ goes into 145:Tx.IMPL together with I0 from the instruction register.

The names for the product terms are from the original MOS schematics with the ROR bug,

that's ROR instructions missing, so don't wonder that the word "ROR" doesn't show up in them.

Now for the notation I have used for the product terms in my schematics:

'101:T4.IND_Y' means that product term 101 is active (high) during state T4, for addressing mode 'indirect Y'.

Tx means, that a product term is valid for all of the states.

//Note, that the PLA does not check for state T6, T6 is handled in the random logic area.

In the MOS 6502 schematics, the designers deliberately had counted the product terms from West to East,

starting with '1'.

Deliberately means, that they had included the three signals 24:IRQP#, 89:RDYP, 90:RES which

technically are just routed through the PLA as product terms, despite that they are no PLA product terms.

And they also had included the vertical GND metal traces of the PLA into the count, that's:

7:GND, 23:GND, 41:GND, 59:GND, 79:GND, 100:GND, 117:GND, 135:GND.

;---

I checked twice, and I think that my schematic for the PLA is correct,

but you better check if these 3000+ spots are with or without a FET again.

Speaking of it, now for the bonus material for those who might want to code something

like a little C program which highlights which PLA term is active in the instruction table.

If you take my PLA schematic, and rotate it clockwise by 90°, you notice from left to right:

one row of dots is red, 4 rows of dots are yellow, 4 rows of dots are yellow again, and so on.

A dot means, that a FET switching to GND is present in this location.

Now for a list of manually generated (so you better check) hexadecimal numbers.

One number per line in the text file, which stands for one PLA product term,

when converting the hexadecimal number to binary:

a binary '1' means FET present, a binary '0' means no FET there.

//Binary number is right adjusted, and the "special" product terms have a comment attached to the hexadecimal number.

Point is, that these hexadecimal numbers were my intermediate step between dissecting the silicon and drawing the schematic.

24_pla.txt

Plus a text file from Frank with the names of the product terms.

MOS650x_decode_rom.zip

;---

;---

Spotted 14 cases where two PLA product terms generate identical results:

;---

Ok, now for the rest of the random logic area.

As we already have seen in "23) interrupt logic",

the logic gates in that area are grouped together for maximal compactness,

not for making sense to the human brain.

So I had two choices:

Either to stick with the workflow from "23) interrupt logic",

what means trying to identify functional blocks and to cut them out of the silicon.

But chances for losing overview and making mistakes sure would increase exponentially

while doing this.

Or to first break down the whole area into a transistor level schematic

and to sort things out later.

But when having a transistor level schematic of the whole area,

it would be too big to keep overview either,

and it simply won't fit on one page in my schematics editor.

;---

So the decision was to break the random logic area into 4 parts,

from West to East that's 25)..28).

Then to make a transistor level schematic for each part,

what of course would cut through some of the logic gates,

for instance the FETs of the NOR gate generating the METAL# signal

show up on different pages.

Then to convert the 4 transistor level schematics separately to 4 logic gate schematics.

Then to clean the schematics up a bit while trying to simplify the logic,

like replacing "a NOR gate plus an inverter attached to its output" to an "OR gate" and such...

or eliminating two inverters in a row.

;---

25) random 1

;---

26) random 2

;---

27) random 3

;---

28) random 4

;---

Schematics for 25)..28) are really big, so I'm adding them as a ZIP.

random1_4_schematics.zip

29) random 0

Eventually, this was the attempt to mount these 4 parts "random 1..4" together,

followed by some more cleaning and simplifying.

The final result with comments was cleaned up again in "0) cheat sheet".

;---

In the MOS 6502 schematic, the PLA terms were not sorted by number,

but "creatively grouped" by function or such.

For making the schematic readable at all, I had decided to do the same,

but this still wasn't enough.

To make it readable enough, it was necessary to have product terms

show up more than once.

Means, if you see a signal trace which comes out of the PLA box,

and there is a little "stub" to said trace pointing to the left:

when searching where the PLA term shows up again in the schematic,

it is supposed to show up again to the left.

After you (hopefully) found it somewhere at the left,

you have a signal trace with a little "stub" which is supposed

to point to the right.

If you have bad luck, it also has another little "stub" pointing to the left _again_.

6509_29_schematics.zip

;---

To answer your next question:

The MOS 6502 schematic had the ROR bug, and it only showed a very big (and very confusing)

lump of logic gates for the random logic area, with long and confusing connections,

and with no comment on whatsoever about why the designers had built it that way,

and what every part does.

So it wasn't quite useful for this dissection, it just had added to the confusion.

For instance, if you have a signal named "foo" and another signal named "foo#" in these schematics,

what you get when inverting "foo" is different from "foo#", vice versa.

//That said, labelling a signal "RDY#" like in the original schematics wasn't a good idea after all.

That's all for now, and I'm happy to have the 6509 off my desk.

Some background info:

While waiting for Frank to finish that 6525 polygonisation, I had some spare time at my hands.

Some time ago, I had helped a bit with the C74 project, it was about building a 6502 compatible TTL CPU.

I remembered that we had some problems with getting the interrupt response of the TTL CPU cycle exact to the NMOS 6502.

So I said to myself:

"Hey, I had that 6509 dissection, let's take a little look at the interrupt logic in the 6509 silicon."

"Dang, that part is not easy to understand, and it has odd connections to a lot of other places."

"Hmm... need to find out what the control logic does for making sense of the interrupt logic."

"Hmm... need to find out what the control logic actually controls for making sense of the control logic."

And from there, things had escallated pretty quick.

But hey: if/when somebody is out to try building a NMOS 6502 compatible TTL CPU again,

I think now we know what the NMOS 6502 interrupt logic is supposed to look like.