12c) PC7

To me, again it feels like the designers had taken the layout from "10) PA0",
cut it into two parts, and crammed some ciruitry in between...
but fortunately less circuitry than we had in PC0..4.

In mode 0, PC7 behaves pretty much like PA0.

In mode 1, things are different:
PC7 data write register and PC7 direction register are ignored.
The PC7 output driver can't switch to VCC,
making PC7 an "open collector" output.
Means you would have to add an external pullup resistor to VCC.

Signal PCQ7 is generated by "9) CB, Port C handshake logic".
If PCQ7 is low, the output driver pulls PC7 to GND,
and that's all there is to it.

PC7 becomes the CB handshake output signal.
Note, that a Port C data read gives back what's on the PC7 pin.

;---

12b) PC6

The layout for the PC6 I\O logic isn't much different from what we had in PC7,
except that the designers had placed some inverters and pullups related to the
Port C control signals right in the middle of it... because it didn't fit elsewhere on the chip.

In mode 1: PC6 is "open collector output", external pullup resistor to VCC required.
Signal PCQ6 is generated by "8) CA, Port A handshake logic",
and if PCQ6 is low, the output driver pulls PC6 to low.

PC6 becomes the CA handshake output signal.
Note, that a Port C data read gives back what's on the PC6 pin.

;---

12a) PC5

The layout for the PC5 I\O logic isn't much different from what we had in PC7,
except that the designers again had placed some inverters and pullups related to Port C
right in the middle of it... because it didn't fit elsewhere on the chip.

In mode 1: PC5 is "open collector output", external pullup resistor to VCC required.
Signal PCQ5 is generated by the IRQ RS flipflop in "18) IRQ logic",
and if PCQ5 is low, the output driver pulls PC5 to low.

PC5 becomes the low_active IRQ# output.
Note, that a Port C data read gives back what's on the PC5 pin.

13) interrupt stack

The interrupt stack is located West from the D0 buffer/driver.

It breaks into 4 blocks, from West to East:
10a) top of stack input is AIR1, top of stack output is TOS1#.
10b) top of stack input is AIR2, top of stack output is TOS2#.
10c) top of stack input is AIR3, top of stack output is TOS3#.
10d) top of stack input is AIR4, top of stack output is TOS4#.
Bottom of stack input is GND for all of the 4 blocks.

There is no interrupt stack for AIR0, because it isn't necessary:
AIR0 has the lowest priority, and thus isn't able to block any interrupts.


Imagine to have a 5 Bit left/right shift register, and to turn it by 90 degrees.
That's what one block if the interrupt stack looks like.

Top of the stack is North in all of the 4 blocks.

Layout for the 4 blocks is identical, so just we focus on the 10a) AIR1 block.


Control signals for the interrupt stack are generated in "6) address decoder".

Reading AIR0..4 with CS# active pushes the interrupt stack, that's the high_active control signal PUSH.
Writing AIR0..4 with CS# active popps the interrupt stack, that's the high_active control signal POPP.
A falling edge detector in "6) address decoder" generates a high pulse on control signal DOST //"do stack"
after the falling edge of PUSH or POPP.

Each Bit of the shift register consists of a dynamic transparent latch
plus a fully static transparent latch. //See "master-slave flipflop" on wikipedia.

The dynamic latch controlled by PUSH and POPP does the shift
by sampling the output of the selected Bit cell inside the shift register.
PUSH: Bits go South in the chip. (pun intended.) AIR1 is pushed on top of the "10a) INT1 stack."
POPP: Bits go North in the chip. Empty location at the bottom of the stack is cleared to 0.

After the dynamic latch did it's job (PUSH and POPP inactive),
the static latch samples the output of the dynamic latch controlled by the DOST pulse.
The output of the static latch is the output of the shift register Bit cell, and that's all.

Note, that TOS1#, the output of the Bit cell on top of the "10a) AIR1 stack", is active_low.

14) AIR read buffers

What I had labelled AIR are just the non_inverting super buffers (plus FET switches)
which place AIR0..4 on the internal data bus D0..4io,
controlled by high_active R_AIR. //read AIR, not qualified by CS#.

That part is located South from the D5..D3 buffers/drivers on the chip.


Also, we have three FETs which pull D5..7io to GND when R_AIR is active.

That part is located South from the D6 buffer/driver on the chip.


Actually, we could condsider AIR (the active interrupt register) to be the sections:
"14) AIR read buffers"
"15) interrupt priority out"
"16) interrupt capture register"
"17) interrupt priority in"

15) interrupt priority out

The part which generates the active_high signals AIR0..4 from the active_low PIR0..4# outputs
of "16) interrupt capture register" is located West from the D1 buffer/driver.

If IP (interrupt priority, Control Register Bit 1) is 0,
AIR0..4 are just fed with the inverted PIR0..4# signals.

;...

If IP is 1, the PIR0..4# signal with the highest priority wins:

Active PIR4# always turns AIR4 high.
Active PIR3# only turns AIR3 high, when PIR4# is inactive.
Active PIR2# only turns AIR2 high, when PIR4..3# is inactive.
Active PIR1# only turns AIR1 high, when PIR4..2# is inactive
Active PIR0# only turns AIR0 high, when PIR4..1# is inactive.

16) interrupt capture register

It is located West from "15) interrupt priority out".

Basically we have five RS flipflops built from two NOR gates,
sensing the outputs of "17 interrupt priority in": IPR0..4.

We have a 5 input NOR gate, which generates the low_active signal IDET# //interrupt detected
if (at least) one of the RS flipflops is set.
Note, that flipflop 'clear' has priority than 'set' for generating IDET#.

If IDET# is inactive, a high on IPR0..4 sets the according flipflop.
Means that after the "interrupt capture register" has sensed something on IPR0..4,
it ignores further changes on IPT0..4 until the flipflops are cleared again.
IDET# also goes to "18) IRQ logic".

Flipflops are cleared with RST when the chip is in a reset.
Also they are cleared by high_active IRES, which is generated in "18) IRQ logic".

The outputs of the RS flipflops are the low_active signals PIR0..4#.
Note, that flipflop 'set' has a higher priority than 'clear' for these signals.

17) interrupt priority in

It is located between "13b..d) interrupt stack" and "16) interrupt capture register".

It generates the high_active IPR0..4 signals which go into "16) interrupt capture register".
The low_active TOS1..4# outputs from the top of the "13) interrupt stack"
and the low_active INT0..4# signals from the "11) PC0..4" I\O go into it.


If IP (interrupt priority, Control Register Bit 1) is 0,
IPR0..4 are just fed with the inverted INT0..4# signals.

;...

If IP is 1, it compares priority of TOS1..4# (top of the interrupt stack) with priority of INT0..4#.
Only an INT# signal with at least the priority of the highest priority TOS# signal will turn the accoring IPR signal active:

Active INT4# always turns IPR4 high.
Active PIR3# only turns IPR3 high, when TOS4# is inactive.
Active PIR2# only turns IPR2 high, when TOS4..3# is inactive.
Active PIR1# only turns IPR1 high, when TOS4..2# is inactive.
Active PIR0# only turns IPR0 high, when TOS4..1# is inactive.

18) IRQ logic

It is located between "13a..b) interrupt stack" and "9) CB".

We have two RS flipflops, each built from two NOR gates.


The first flipflop is set by an edge detector at the end of an interrupt stack PUSH,
and cleared by IDET# high when "16) interrupt capture register" has not sensed an active interrupt.
Note, that for the high_active IRES output of that flipflop 'clear' has a higher priority than 'set'.

IRES clears the flipflops in "16) interrupt capture register".


The second flipflop is set when IRES is inactive and an active IDET# indicates
that "16) interrupt capture register" has sensed an active interrupt.
It is cleared by RST when the chip is in a reset.
Also, it is cleared when IRES is active.
Note, that for the high_active IRQ output of that flipflop 'clear' has a higher priority than 'set'.
The IRQ output goes through an inverter and as signal PCQ5 into the PC5 I\O logic.

If the 6525 is in mode 1, IRQ high causes the PC5 I\O logic to pull PC5 to GND,
so that PC5 is the "open collector" IRQ# out of the 6525.

That's all for now.
6522 is next.

Another great in depth analysis!

It is interesting that there's no clock input. Can you summarise, perhaps, how this chip manages various bits of state? It sounds like edges on some control signals are used to create pulses, to act as clocks, and also that both dynamic and RS storage is used.

Thanks, Ed.

Indeed, there are not much peripheral chips in the 65xx family that lack a PHI2 input pin.

Dynamic storage is used when it only has to hold data "for one PHI2 cycle" or such, the rest is half_static or RS storage.
The best example for this is are the shift registers working as the interrupt stack:
a dynamic latch with two data inputs does the shift according to the control signals PUSH or POPP
(which are generated when the CPU reads/writes AIR with CS# active),
feeding a static latch which holds the data.
;
A falling edge detector senses the end of a PUSH or POPP,
then gives a clock pulse to the static latches in the interrupt stack.

In mode 1, in each of the I\O logic blocks for PC0..4 we have a static RS flipflop called the INT0..4 latch,
which is set by an edge detector when there was an active edge on PC0..4.
//because then PC0..4 are the interrupt inputs I0..4.

A falling edge detector senses the end of a Port C data write,
for clearing the related INT latches in mode 1 when a '0' was written to Port C data register.

Another falling edge detector senses the end of a PUSH,
and clears INT0..4 latches acknowledged by AIR0..4. //active interrupt.

Technically, the "interrupt capture register" is something like one big edge detector,
sensing the enabled INT0..4 latches in the PC0..4 I\O logic,
triggering the IRQ RS flipflop.
//I'm simplifying things by omitting the interrupt priority stuff.

In the IRQ logic, we have _another_ falling edge detector sensing the end of a PUSH
to clear the IRQ RS flipflop when there is no active interrupt.

;---

The falling edge detectors in the PC0..4 I\O logic are built from three inverters plus a NOR gate.

The rest of the falling edge detectors (with pulse output) tends to be two inverters (for the delay)
plus two NOR gates for sensing the edge and for generating the pulse.

Except for the pulse generators in the Port A and Port B handshake logic,
which seem to be based on the "two inverters plus two NOR gates" concept
and just add resistors/capacitors to the delay chain for generating a longer pulse output.

I am looking forward to the 6522! I am trying to improve the emulation of the VIA shift register in VICE (for the purposes of PET sound output). I'm feeling I'm getting close but I seem to be a bit stuck. In most shifting modes I seem to have mostly the correct overall timing but at some points there seems to be some unexplained offsets (the test program running on VICE reads a value that is shifted further than the reference data says it should be).

Maybe seeing your analysis can help me to find some inspiration.

VICE bug thread: https://sourceforge.net/p/vice-emu/bugs/1624/
VIA shift register test programs (they run on a VIC 20): https://sourceforge.net/p/vice-emu/code ... 20/via_sr/

(Welcome! Thanks for the link to that thread - interesting. I would think there would be lots of overlap with expertise in the Acorn community. There are several emulators and some FPGA work too.)

rhialto, welcome to our forum.

I'm waiting for Frank's polygonized pictures.

Once I have them, the 6522 dissection is supposed to take 1..2 months,
depending on the complexity/density of the chip layout.

Thanks for the welcoming words! I got pointed to this VHDL: https://github.com/hoglet67/BeebFpga/bl ... /m6522.vhd which is an improvement over https://github.com/mikestir/fpga-bbc/bl ... /m6522.vhd . I tried simulating it (with GHDL and GtkWave) and a few test cases I had seemed to work well. Of course such a hardware description isn't authoritative, but it can give some information about reverse engineering efforts by others. I didn't have any experience with VHDL before and it's fascinating to play around with it for a few days :)

A 65xx peripheral chip without clock phase is unusual. However, interrupt priority or parallel port handshaking may be more difficult with bus clock phase.

It is a curious approach to solve N tiers of priority using O(N^2) bits of state. It leads to the usual problem where multiple interrupts from processor IRQ to priority register sampling are not chronologically ordered. For an interrupt *priority* system this is not a problem but there may be edge cases external to 6525.



Patent US4020472A: Master Slave Registers For Interface Adaptor is also a highly relevant reference. The title has aged badly but it has a familiar list of contributors.

_________________
Modules | Processors | Boards | Boxes | Beep, Beep! I'm a sheep!