11) IER //interrupt enable register

IER contains 7 RS flipflops, working as the register Bits.
The high_active outputs of these flipflops go into "12) IFR" for enabling IRQ generation
of the IFR (interrupt flag register) Bits.

High_active read control signal R_IER reads the register Bits into the internal
read data bus D0..6r during PHI1=0, also it switches D7r to VCC during PHI1=0,
so that the MSB always is 1 when reading IER.

Internal write data bus signal D7w# (low_active) goes into an inverter,
which sends D7_w into "8) address decoder".
When writing IER, the address decoder generates two high_active
write control signals during PHI0=0, depending on D7_w:
;
If D7_w=0, W_IER0 connects D0..6w# (low_active) to the low_active R# inputs of the RS flipflops.
Means when writing binary 0xxxxxxx to IFR, if x=1 this clears an IFR register Bit.
;
If D7_w=1, W_IER1 connects D0..6w# (low_active) to the low_active S# inputs of the RS flipflops.
Means when writing binary 1xxxxxxx to IFR, if x=1 this sets an IFR register Bit.

Of course I'm simplifying things, because the RS flipflops are not built from two NOR gates,
they are built from two "open collector" inverters which have pullups to VCC at the outputs.
This trick makes the RS flipflops smaller than when using NOR gates.
For RS flipflops built like this, R# is identical to Q, and S# is identical to Q#.

Note, that all of the IFR register Bits are asynchronously cleared by RST.

Control signals enter the register block from the South,
North of the register blocks we have the usual FETs switching control signals to GND
during a certain clock phase.

;---

IER7: always reads 1, when writing IER use Bit 7 for selecting CLEAR or SET.
IER6: enable IRQ generation for active IFR6 //Timer 1 underflow
IER5: enable IRQ generation for active IFR5 //Timer 2 underflow
IER4: enable IRQ generation for active IFR4 //CB1 active edge
IER3: enable IRQ generation for active IFR3 //CB2 active edge
IER2: enable IRQ generation for active IFR2 //shift register
IER1: enable IRQ generation for active IFR1 //CA1 active edge
IER0: enable IRQ generation for active IFR0 //CA2 active edge

;---

12) IFR //interrupt flag register

IFR contains 7 RS flipflops, working as the register Bits.
For every register Bit, we have an "open collector" NAND gate
fed by the high_active output of said register Bit,
plus the high_active output of the IER (interrupt enable) Bit.

Long story:
Outputs of the NAND gates are tied together to one pullup,
generating the low_active IRQ_ACT# signal:
IRQ_ACT# goes active, when an IFR Bit is high, AND the related IER Bit is high.
an inverter turns the low_active IRQ_ACT# signal into the high_active IRQ signal.
The IRQ signal goes into the inverting "2d) IRQ" driver,
which pulls the low_active IRQ# pad to GND if IRQ is high.
;
Short story:
When an IFR Bit is high, AND the related IER Bit is high,
low_active IRQ# pad is switched to GND.

All of the 7 RS flipflops have one high_active SET input,
which sets the interrupt flag when the related interrupt event has occured.
Note, that some of the RS flipflops have one CLEAR input,
and that some of the RS flipflops have two CLEAR inputs.
;
I'm not counting the RST signal here which asynchronously clears all of the register Bits.

High_active read control signal R_IFR reads the register Bits into the internal
read data bus D0..6r during PHI1=0, also it reads IRQ into D7r during PHI1=0,
so that the MSB indicates an active IRQ# pad.

High_active write control signal W_IFR uses internal write data bus D0..6w# (low_active)
for clearing register Bits during PHI0=0.
Writing 1 to a register Bit clears a register Bit.
Writing 0 to a register Bit does no change to a register Bit.
This way, the 6502 can clear specific interrupt flags by writing IFR.

Of course I'm simplifying things, because the RS flipflops are not built from two NOR gates,
they are built from two "open collector" inverters which have pullups to VCC at the outputs.

Control signals enter the register block from the South,
North of the register blocks we have the usual FETs switching control signals to GND
during a certain clock phase.

Note, that in the IFR area of the chip silicon, we also have some logic gates related
to handshake logic for clearing IFR0,IFR1.
Plus some other logic gates for clearing IFR6,IFR7 during Timer reads.

;---

IFR7: reads IRQ status, write has no effect

IFR6: SET by Timer 1 underflow, CLEARED by T2L read or R2H write
IFR5: SET by Timer 2 underflow, CLEARED by T1L read or T1H write

IFR4: SET by CB1 active edge, CLEARED by ORB read/write
IFR3: SET by CB2 active edge, CLEARED by ORB read/write if CB2 is not "independent interrupt"

IFR2: SET by 8 shifts completed, CLEARED by shift register read/write

IFR1: SET by CA1 active edge, CLEARED by register $01 (ORA) read/write
IFR0: SET by CA2 active edge, CLEARED by register $01 (ORA) read/write

;---

13) CA1 input

Note, that the CA1 pad has no pullup to VCC inside the 6522 chip.

Tied to the CA1 pad, we have an edge detector sampling CA1 during PHI0,
it sets IFR1 by high_active signal S_IFR1 when detecting an active CA1 edge.

Active CA1 edge is selected by PCR0:
PCR0=0: CA1 falling edge detect
PCR0=1: CA1 rising edge detect

To me, the circuitry looks a bit odd (the part where signal IFR1 goes into it),
and I wonder why Bill Mensch (TM) had implemented it that way.
My guess is, that it compensates for something that might happen when/while/after IFR1 is cleared.

Maybe somebody (not me) should write a technical article about this.

Point is, that we have that sort of edge detector at the CA1, CA2, CB1, CB2 pad.
Chip layout does vary for making better use of chip space,
but from the logic design point of view these 4 edge detectors are more or less identical.




;---

Thanks to org\breaknes for taking a look at the CA1 edge detector circuitry.
He confirmed, that I had interpreted the polygonized chip picture of the CA1 edge detector correctly.



Also, he had mentioned that another approach for getting a better understanding might be
splitting the RS flipflop of the edge detectors into two separate RS flipflops,
one scanning for CA1 rising edge, and one for CA1 falling edge.



Of course, the schematic just shows a possible direction to take,
and it still might require some work... but it's good for a (new/different) start.

14) CA2 input/output

At the input side, we have an edge detector similar to "13) CA1"
sampling CA2 during PHI0.
When sensing an active edge, it sets IFR0 by high_active signal S_IFR0.

Active CA2 edge is selected by PCR2:
PCR2=0: CA2 falling edge detect
PCR2=1: CA2 rising edge detect

;---

Now for the output side.

Basically, the low_active /Q output of a RS flipflop goes into an "open collector" inverter,
which switches the CA2 pad to GND if /Q is high.
A pullup ties the CA2 pad to VCC.

If CA2 is configurated as an input by PCR3=0,
this forces /Q to low by overriding anything else that goes into the flipflop,
so that the "open collector" inverter is unable to switch CA2 to GND.

Control signals PCR1 and PCR2 then select, what sets or clears the flipflop
(and what comes out at CA2 if CA2 is configurated as an output).

For more details, please see the simplified CA2 schematic in the "handshake cheatsheet".

;---

15a) T2L //Timer 2 low (Bit 7..0)

Timer 2 is a down counter using an inverting/non_inverting carry chain. //ripple carry.
Counter Bits 0,2,4,6 have low_active input carry and high_active output carry,
Counter Bits 1,3,5,7 have high_active input carry and low_active output carrry.

Down counter means:
If the carry input of a counter cell is active, the counter will toggle in the pending clock phase.
If the carry input of a counter cell is active and the counter Bit is 0,
the output carry goes active.

Counter cells have a fully transparent static latch,
High_active control signal W_T2L_latch loads the latches from the write data bus during PHI0=0.

High_active control signal T2L_LD transfers the contents of the latches into the counter Bits.
High_active control signal T2L_CNT tranfers "the new counter value" into the counter Bits.
These two signals are active when PHI0=0 AND PHI2=0.

High_active control signal R_T2L reads the T2L counter Bits into the read data bus
during PHI1=0 (what is different from PHI0=1).

T2L_cin0# is the low_active input carry of the LSB (Bit 0) T2L counter cell,
it comes out of a transparent latch controlled by PHI2.
If ACR5=0, input of the latch is low, and Timer 2 is running at PHI2 speed.
If ACR5=1, the output of the "PB6 falling edge detector" goes into the latch,
what means that Timer 2 is counting gown one step after there was a falling edge
at the PB6 pad.

High_active signal T2L_TC indicates a Timer 2 low terminal count,
means that T2L_TC is high if T2L=$00 and T2L_cin0#=0,
what will make the T2L down counter Bits roll over to $FF during PHI0=0 AND PHI2=0.
Note, that T2L_TC changes during PHI2=1.
;
Of course, in the silicon the NOR gate is broken into 9 parts,
one attached to the T2L Bit 0 input carry, the rest attached to each of the counter Bits,
to make better use of chip space.

T2L Bit 0 and Bit 1 counter cells:



;---

15b) T2L control

This is the circuitry which generates the control signals T2L_LD and T2L_CNT for Timer 2.
Either T2_LD (load) or T2L_CNT (count) is active during PHI0=0 AND PHI2=0. //but not both.
T2L counter is loaded, when T2H counter is loaded (signal T2H_LD).

If the shift register uses Timer 2 (actually T2L) as a clock source, SR_T2 is high,
T2L is re_loaded from the latch after T2L_TC indicated a T2L underflow.
//I'm simplifying things a bit, but that's the basic concept.
;
Note, that some part of the related circuitry is in "8c) address decoder".
//Hey, cutting the silicon into functional blocks sometimes isn't that easy to do...

Also, see "22) shift register control" for signals T2_SR and T2_TCNL.
Shift register control generates the high_active T2_SR signal, telling T2L control
that the shift register uses T2L as a timebase for generating the shift clock.
T2L control generates the high_active T2_TCNL signal, telling shift register control
that T2L reached terminal count AND there was no T2L write.



;---

15c) T2H //Timer 2 high (Bit 15..8)

Conceptually not much different from T2L, except that counter cells have no latch.
//Timer 2 is meant to be one_shot, that's why there are no latches in the T2H counter cells.

High_active control signal T2H_LD transfers the write data bus into the counter Bits.
High_active control signal T2H_CNT tranfers "the new counter value" into the counter Bits.
One of these two signals is active when PHI0=0 AND PHI2=0,
and they are generated in "8c) address decoder".

High_active control signal R_T2H reads the T2H counter Bits into the read data bus
during PHI1=0 (what is different from PHI0=1).

Counter Bits 8,10,12,14 have low_active input carry and high_active output carry,
Counter Bits 9,11,13,15 have high_active input carry and low_active output carrry.

T2H_cin8# is the low_active carry input of the T2H Bit 8 counter cell,
and it's just generated from the high_active T2L_TC signal by using an inverter.

The five counter Bits 8..12 are linked together by ripple carry.
A NOR gate checks if the Bits 8..12 are 0, and if T2H_cin8# is active.
It then generates the high_active T2H_TC signal, what is the input carry
for counter Bit 13.
The three counter Bits 13..15 are linked together by ripple carry again.



;---

15d) T2H control

We have a RS flipflop, which is set with T2H_LD (when the 6522 write T2H).
It indicates that Timer 2 currently is running one_shot
and will set IFR5 (Timer 2 interrupt flag) when there is a timer underflow.

When T2H is not written AND there is a Timer 2 underflow (indicated by T2H Bit 15 output carry)
AND the RS flipflop is set (sampled by a transparent latch during PHI1=1),
this will set IFR5 (Timer 2 interrupt flag) during PHI2=1,
and clear the RS flipflop during the next PHI1=1.

Note, that Timer 2 still might count when the RS flipflop is cleared.
But when the RS flipflop is cleared, further Timer 2 underflows just will not set IFR5.



;===

16a) T1H //Timer 1 high (Bit 8..15)

Timer 1 is a down counter, counting at PHI2 speed.

Down counter means:
If the carry input of a counter cell is active, the counter will toggle in the pending clock phase.
If the carry input of a counter cell is active and the counter Bit is 0,
the output carry goes active.

Conceptually, it's very similar to what we had in "15c) T2H",
except that the latches can be read back to the data bus.

Counter cells have a fully transparent static latch,
High_active control signal W_T1H_latch loads the latches from the write data bus during PHI0=0.

High_active control signal T1H_LD transfers the write data bus into the counter Bits.
High_active control signal T1H_CNT tranfers "the new counter value" into the counter Bits.
One of these two signals are active when PHI0=0 AND PHI2=0,
and they are generated in "16b) T1H control".

High_active control signal R_T1H reads the T1H counter Bits into the read data bus.
High active control signal R_T1H_latch reads the T1H latch back into the read data bus.
One of these two signals can be active when PHI1=0 (what is different from PHI2=1).

Counter Bits 8,10,12,14 have low_active input carry and high_active output carry,
Counter Bits 9,11,13,15 have high_active input carry and low_active output carrry.

T1H_cin8# is the low_active carry input of the T1H Bit 8 counter cell,
and it's just generated from the high_active T1L_TC signal by using an inverter.

The five counter Bits 8..12 are linked together by ripple carry.
A NOR gate checks if the Bits 8..12 are 0, and if T1H_cin8# is active.
It then generates the high_active T1_TC signal, what is the input carry
for counter Bit 13.
The three counter Bits 13..15 are linked together by ripple carry again.



;---

16b) T1H control

It is based on the circuitry we already had in "15d) T2H control".

We have a RS flipflop, which is set when T1H counter is written with W_T1HC

Note:
Writing to $7 T1H latch does not set the RS flipflop or write T1H counter.
Writing to $5 T1H counter does set the RS flipflop and writes T1H latch.

When T1H is not written AND there is a Timer 1 underflow (indicated by T1H Bit 15 output carry)
AND the RS flipflop is set (sampled by a transparent latch during PHI1=1),
this will set IFR6 (Timer 1 interrupt flag) during PHI2=1,
and if Timer 1 is running one_shot (ACR6=0) this clears the RS flipflop during the next PHI1=1.
If Timer 1 is running continous interrupts (ACR6=1), the RS flipflop is not cleared.

Note: when the RS flipflop is cleared, Timer 1 still will count,
and Timer 1 still will be reloaded from the Timer 1 latches after there was a Timer 1 underflow.

Also, T1H control generates two high_active control signals of which only one is active
during PHI0 AND PHI2: T1H_LD and T1H_CNT (these signals already went described above in the text).
And it generates the high_active T1_LD signal, which goes into "16d) T1L control",
indicating a Timer 1 load.

PB7_T1 is the signal which goes into the PB7 output driver when Timer 1 emits a pulse
or a square wave on PB7. //In this case, PB7 = PB7_T1.
It is generated by a toggle flipflop, which is cleared runing a T1H counter write,
set when ACR7=0 (when Timer 1 does not use PB7),
and it toggles during PHI2 after a Timer 1 underflow when the "Timer 1 active" RS flipflop is set.
;
Note, that for the toggle flipflop, clear has highest priority, and toggle has lowest priority.



;---

16c) T1L //Timer 1 low (Bit 7..0)

Timer 1 always is running at PHI2 speed, and that's why counter Bit 0 has no input carry:
Bit 0 just always toggles at PHI2 speed, and it has a high_active output carry.

Timer 1 is a down counter using an inverting/non_inverting carry chain. //ripple carry.
Counter Bits 2,4,6 have low_active input carry and high_active output carry,
Counter Bits 1,3,5,7 have high_active input carry and low_active output carrry.

Counter cells have a fully transparent static latch,
High_active control signal W_T1L_latch loads the latches from the write data bus during PHI0=0.

High_active control signal T1L_LD transfers the write data bus into the counter Bits.
High_active control signal T1L_CNT tranfers "the new counter value" into the counter Bits.
One of these two signals are active when PHI0=0 AND PHI2=0,
and they are generated in "16d) T1L control".

High_active control signal R_T1L reads the T1L counter Bits into the read data bus.
High active control signal R_T1L_latch reads the T1L latch back into the read data bus.
One of these two signals can be active when PHI1=0 (what is different from PHI2=1).

High_active signal T1L_TC indicates a Timer 1 low terminal count,
means that T1L_TC is high if T1L=$00,
what will make the T1L down counter Bits roll over to $FF during PHI0=0 AND PHI2=0.
Note, that T1L_TC changes during PHI2=1.
;
Of course, in the silicon the NOR gate is broken into 8 parts,
attached to each of the counter Bits, to make better use of chip space.



;---

16d) T1L control

T1_LD generated in "16b) T1H control" indicates a Timer 1 load.
From this signal, T1L control generates the two control signals
T1_LD and T1L_ CNT. That's all there is to it.



;===

Now for an overview about the whole Timer 1 + Timer 2 section:

17) D0..w# inverters, precharge

Fully static transparent latches sample the high_active D0..7 pads
(tied to the external data bus) during PHI0,
and place low_active D0..7w# on the internal write data bus.

We have 8 inverting super buffers, generating high_active D0..7w
from low_active D0..7# for the internal write data bus.

The internal read data bus D0..7r is precharged to VCC during PHI1=1.
//6522 registers are read into the internal read data bus during PHI1=0.

18) bus control, handshake logic

Signals 1W/R# (0=read, 1= write), 10CS# and 11CS#
are sampled during PHI1 at the R/W#, CS and CS# pads.
For details, see "2) pads".

RST is the high_active asynchronous reset signal.

When the 6522 is selected with CS=1 AND CS#=0,
if R/W#=1 the low_active control signal OE_RD# enables the D0..7 pad drivers during PHI0=1,
which then place the internal read data bus D0..7r on the external data bus D0..7.
For the bus drivers, see "4) D0".

We have a RS flipflop that generates the low_active WE# signal which goes into "8) address decoder".
If the 6522 was selected with R/W#=0 during PHI1=1, the RS flipflop will be cleared during PHI0=1.
If the 6522 was not selected during PHI1=1, the RS flipflop will be cleared during PHI1=0.
;
Means that the flipflop tells the address decoder that the 6502 does a 6522 register write.
The reason why the circuitry looks like this is that the 6522 actually writes the
register in the first half of the cycle which follows the 6502 write cycle.

The other three RS flipflops are related to handshake circuitry,
for the rest please see the "handshake cheatsheet" up in the thread.

19) CB2 input/output

At the input side, we have an edge detector similar to "13) CA1"
sampling CB2 during PHI0.
When sensing an active edge, it sets IFR3 by high_active signal S_IFR3.

Active CB2 edge is selected by PCR6:
PCR6=0: CB2 falling edge detect
PCR6=1: CB2 rising edge detect

Also, "22) shift register control" taps the low_active CB2# signal
from the edge detector for generating the serial data input
which goes into "10) shift register".

;---

The output side is based on what we had in "14) CA2",
but we have some additional circuitry because the shift register
can use CB2 as a serial data output.

Like with CA2, again we have a RS flipflop and use the low_active /Q output.
But this time, /Q goes through an inverter, then into a 2:1 multiplexer.

Signal SR_CB1_Q also goes into the multiplexer, is the serial data output
of the shift register generated in "22) shift register control".

The 2:1 multiplexer is controlled by ACR4.
ACR4=0: shift register shifts in serial data, and does not use CB2 at all.
ACR4=1: shift register shifts out serial data through CB2.

The output of the multiplexer goes into the non_inverting push/pull driver
which switches the CB2 pad to GND/VCC.
Low_active signal OE_CB2# enables the driver,
it is generated in "22) shift register control.

There is a pullup to VCC at the CB2 pad.

;...

But now back to the RS flipflop.

If CB2 is configurated as an input by PCR7=0,
this forces /Q to low by overriding anything else that goes into the flipflop.

Control signals PCR5 and PCR6 then select, what sets or clears the flipflop
(and what comes out at CB2 if CB2 is configurated as an output).

For more details, please see the simplified CB2 schematic in the "handshake cheatsheet".

;---

20) CB1 input/output

Tied to the CB1 pad, we have an edge detector sampling CB1 at PHI2,
it sets IFR4 by high_active signal S_IFR4 when detecting an active CB1 edge.

Active edge is selected by PCR4:
PCR4=0: CB1 falling edge detect
PCR4=1: CB1 rising edge detect

For more info about that edge detector, see "13) CA1 input".

;---

The CB1 pad also works as the shift clock from/to the outerworld
when enabling "10) shift register", and that's why we have _another_
(conceptually different) edge detector sensing the CB1 pad,
gated with PHI0=1 AND PHI2=1.

If ACR4=0, the shift register shifts in, and the detector scans for CB1 rising edge.
If ACR4=1, the shift register shifts out, and the detector scans for CB1 falling edge.

Low_active signal SR_CB1_DET# generated by the detector tells "22) shift register control"
to shift/count the next Bit.

;---

Also, "22) shift register control" can generate a clock signal to be sent into the CB1 pad.
Doing so, "22) shift register control" generates two signals: SR_CB1_Q and OE_CB1#.

In is case, a non_inverting driver fed by high_active SR_CB1_Q, enabled by low_active OE_CB1#,
emits a shift clock signal through the CB1 pad to the outerworld.
//At the output of the CB1 driver, there is a pullup to VCC.

No matter if CB1 is working as an input or an output, low_active signal SR_CB1_DET# generated
by the edge detector above which scans CB1 tells "22) shift register control"
to shift/count the next Bit.

;---

21) PB6 falling edge detector

Not much to say:

A fully static transparent latch taps into the PB6 input circuitry
for sampling PB6# during PHI1.
The latch is located North from "22) shift register control".

The output of said latch feeds an edge detector built from dynamic latches.
It emits the high_active PB6_10 signal during PHI2 after there was a falling edge on PB6.
The edge detector is located South from "22) shift register control".

PB6_10 goes into "15a) Timer 2 low",
Timer 2 then counts down one step after a PB6 falling edge if ACR5=1.
//Timer 2 counts down with PHI2 if ACR5=0, ignoring PB6.

22) shift register control

It generates the low_active output enable signals OE_CB1# and OE_CB2#
for the CB1 and CB2 output drivers.
That's because the CB1 pad works as shift clock from/to the outerworld,
and the CB2 pad works as serial data from/to the outerworld.

At the MSB output of the shift register, there is another latch
which emits the serial data signal SR_CB2_Q which goes to the CB2 circuitry.

A 2:1 multiplexer, controlled by ACR4, feeds the serial input of the shift register.
ACR4=0: shift register shifts in, CB2 goes into the shift register.
ACR4=1: shift register shifts out, SR_CB2_Q goes into the shift register //circular shift.

ACR4..2 select the mode in which the shift register is operating.
Shift register either can use an internal or an external clock source at CB1.
But don't get fooled: no matter if it uses an internal or external clock source,
an edge detector always scans CB1 for an active edge,
then triggers a pulse generator which emits the high_active clock signals
SHIFT_SR and HOLD_SR which eiter advance or hold the shift register
and the Bit counter (counting the Bits that were shifted).
;
Note, that the edge detector scans for rising edge when shifting data in,
and for falling edge when shifting data out, for details see "20) CB1".

When an internal clock source goes into CB1,
signal SR_CB1_Q (generated by a toggle flipflop) goes into the CB1 pad driver.
Note, that Timer 2 can be used as a clock source for said toggle flipflop,
high_active signal SR_T2 then tells "15b) T2L control" that Timer 2
is used for generating the clock source, and T2L control then reports back
Timer 2 low underflow to shift register control by high_active signal T2_TCNL.

We have a RS flipflop, which is set when the 6522 reads/writes the shift register,
and which is cleared then IFR2 is set after all of the Bits were shifted.
The flipflop indicates, that a serial transmission is active/running.
;
If the flipflop does not indicate that a serial transmission is active/running,
this clears the Bit counter (counting the Bits that were shifted) to a defined state.

The Bit counter is implemented as a 5 Bit ring counter.
Basically, an edge detector taps into Bits 2,3 of the ring counter
for detecting if all of the Bits were shifted.
If all of the Bits were shifted, it sets IFR2 by high_active signal S_IFR2.
IFR2 then indicates a completed transmission, what ends the transmission,
clears the RS flipflop, and clears the Bit counter.

And that's all for now.

8520 dissection is next,
and 6520 decapping is in progress.

Wow excellent work! Lots to digest!
Many thanks!

_________________
Author of the GeckOS multitasking operating system, the usb65 stack, designer of the Micro-PET and many more 6502 content: http://6502.org/users/andre/