Main thread: 6509 dissection

Another dissection brought to you by Frank Wolf and ttlworks.

Since we had dissected anything around the 6509 CPU core, it's now time to go for the core,
and then to put everything together with the results from the previous 6509 dissections.

6509 peripherals (MMU) dissection is here. //Main thread.
6509 pads\pins RES#, NMI#, IRQ#, RDY, SYNC dissection is here.
6509\8051 clock generator dissection is there.

Note:
For consistence with Frank's notation, low_active signals are named foo#, not /foo.

Orientation for all the chip pictures: PHI1(in) is North.

Eagle 6.4 schematics for my schematic pictures in this thread,
just in case if somebody needs them.

Note: KiCad is supposed to be able to import these schematics,
unfortunately it doesn't seem to be possible to disable the layers 'name' and 'value' in KiCad schematics,
so making my schematics look nice and clean in KiCad will require some work, sorry.

A picture of the 6509 silicon, with the interesting areas marked.
The dark green areas in the picture went covered by the previous 6509 dissections.



Just as a reference, another picture of the 6509 silicon without the markings.



Bus systems inside the 6509 CPU core:
(omitting instruction register and peripherals)

To us, it appears that the CPU core in the 6509 and 8501 is somewhat identical to the 6502 at the logic design point of view,
just with some variations in the chip layout.

The only difference we were able to spot is in "16) PHI1# driver".
Two PHI1# metal traces are going from "16) PHI1# driver" into "17) control latch\driver".
IN the 6502, IIRC we have two inverting super buffers fed by PHI1, separately driving each of the PHI1# traces.
In the 6509\8501 we have just one (bigger) inverting super buffer fed by PHI1, driving both PHI1# traces.

Like the 6530, the 6502 is an incredibly compact beast, and it's sometimes difficult to tell
where one function block ends and the next function block starts when just staring at the silicon.
It's very impressive, that the designers were able to get two manually routed chips of that size and complexity
done and running within only a year.

6502 is a work of true art\craftsmanship, and the designers had pulled every trick possible
to make it as compact as possible, because the size of a chip directly affects the sales price of a chip.
As in "one square millimeter of processed silicon is more expensive than one square millimeter of processed gold".

;---

Now about said tricks:

Before the 6502, the control circuitry of a CPU just was a big lump of random logic.
6502 uses a PLA (fed by the instruction Byte and the sequencer), with some random logic attached to it.

The sequencer is split into two parts.
One part (below the East end of the PLA) does the steps T0 (ALU data operation) and T1 (instruction fetch),
the other part (below the West end of the PLA) does the steps T2..T5.

When the interrupt logic detects RES#\NMI#\IRQ#, it forces the Byte from an instruction fetch to $00,
and $00 is instruction BRK, a software interrupt.
While the rest of the CPU executes the faked BRK instruction, the interrupt logic blocks PC increment
and "injects" the interrupt vector into the CPU internal address bus.

The next thing is, that BRK has one more step than the rest of the instructions: T6.
The T6 state flipflop is not part of the sequencers, on the chip it almost looks like an integral part of the interrupt logic.
Step T6 is triggered from the PLA after step T5 during a BRK instruction.
Also, the PLA does not check T6 state, so what has to be done during step T6 is defined in the random logic area.

RMW (read/modify/write) operations, that's incrementing/decrementing/shifting memory,
"fork" from the sequencer by using a flipflop "step chain" controlled by RDY,
everything related to this is deep inside the random logic area.

In my opinion, it all was intentionally build that way to minimize chip space.

;...

It is normal to have the FETs of a single logic gate "spread over half of the chip",
and it is normal that it turns out to be an AND/NOR combination gate.

It is normal to have transparent latches and NOR based RS flipflops which don't appear as such at first sight.

It also is normal to encounter logic design tricks like that one:

Note, that this thread is about how the 6509 core works at logic design level in a simplified way.

A detailed transistor level explanation would be a lot bigger, and a lot more confusing.

After the dissection, I had checked my schematics at transistor level again,
also I compared my schematics to the emu-russia "Breaking NES Book", Revision 1.
Greetings to' org' and his team: great job, nicely done.
//Thread about said book is here

Of course, "I see no errors in my schematics" is different from 'there are no errors in my schematics',
take care.

Had no capacity for a detailed understanding of the structure of the 6502 pipeline,
what would be necessary for understanding the sequencer,
what would be necessary for drawing a detailed state diagram for the sequencer,
what would be necessary for checking what the random logic does during a specific instruction,
what would be necessary for checking if the random logic is drawn correctly.
So there still is enough work to do for the experienced reader with too much spare time on his\her\its hands.

;---

First a small picture, to tell what in the cheat sheet goes where.

Note, that the location of the functional blocks in the picture does not directly correspond
with the physical location of the functional blocks in the silicon.



Now for the big cheat sheet: be warned it really is big.
It has some intrinsic beauty, but be warned that staring at it for too long is unhealthy: please take a break from time to time.

1) ADL0..ADL2 constant generator

Interrupt vectors are at the upper end of memory.

The internal addres bus lines of the CPU are precharged to 1 during PHI2.
//External address lines change later during PHI1.

The interrupt logic controls three FET switches for pulling the internal addres bus lines ADL0..2 to GND
according to the interrupt vector, for more details see "23) interrupt logic".

Control signals for these three FET switches are named:
0>ADL0, 0>ADL1, 0>ADL2.

The three FET switches are located at the North West side of the mill,
and physically they almost look like an integral part of the A0..2 address bus latches\drivers.

//We now travel from West to East trough the mill of the CPU.

2) Y register

Y register is located East from the A0..7 latches\drivers in the silicon.

Y register cells are half_static (and very compact).
The Bits are refreshed during PHI2,
and read/written during PHI1# =0 (what is different from PHI2 =1).

Note, that PHI1 and PHI2 are non_overlapping clock signals.
//unlike the 6502, the 6509 has no internal clock generator.

And that a FET pulling an internal bus line to GND also has to sink
the current through the pullup resistor (FET) inside the register cell to GND.

So trying to figure out what exactly happens during "illegal" NMOS 6502 instructions
when more than one register might connect to to a bus line may give you some more grey hairs,
because you would have to take the resistance of all the pullup resistors (FETs)
plus all the FETs switching to GND at a bus line into account.

In my opinion that's not a clean design, but it sure saved some chip space.
Also, when stretching PHI1 for too long, the data in the register is getting lost.

3) X register

X register is located East from the Y register in the silicon.

Circuitry is identical to "2) Y register".

4) S, the stackpointer

Stackpointer is located East from the X register in the silicon.

S Register cells are a nicer design than X,Y register cells, but they take more chip space.

The pullup resistors (FETs) for precharging the internal SB (special bus) lines
during PHI2 are integral part of the S register.

5) ALU_in

ALU_in is located East from the Stackpointer in the silicon.

For understanding how the ALU works, it was necessary to break it into three parts.

For convenience, I had named the part where the bus signals enter the ALU just ALU_in.
What isn't exactly correct, because it also handles things like AND, OR, shift right.

Three bus signals enter ALU_in:
ADL, the internal A0..7 address bus,
DB, the data bus from/to the "15) data latches" (which connect to the external data bus),
SB, the special bus.

One ALU input is either ADL, DB, or inverted DB.
The other ALU input is either SB, or 0.

ALU_in generates NAND (open collector with pullup) plus NOR (open collector with pullup)
for both ALU inputs, these signals are used later for the ALU carry chain, the BCD detection\correction,
also for "9) V evaluation" (overflow detection that is).

The ALU result bus Q# is low_active,
FETs controlled by 'AND' are switching the NAND output signals on the Q# bus,
FETs controlled by 'OR' are switching the NOR output signals on the Q# bus.

Shifting/rotating right just switches the NAND output signals in a different order to the Q# bus,
except for Q7# which is pulled to VCC.

ALU carry chain is located East from ALU_in in the silicon.

The ALU carry chain features the usual inverted/non_inverted carry scheme for binary adders.
For more details, start reading here.

FET switches controlled by 'EOR' place an XNOR (open collector with pullup) of both ALU inputs on the Q# bus.
FET switches controlled by 'SUM' place the inverted adder sum on the Q# bus.

;---

6) ALU carry chain, Bit 0,2,4,6:
low_active carry input, high active carry output.
The NAND from "5) ALU_in" generates a carry, if both ALU inputs are 1.
The NOR from "5) ALU_in" kills carry propagation, if both ALU inputs are 0.
Note, that "8) BCD detection" reads the high_active Bit 4 input carry from inside the carry chain.




;---

7) ALU carry chain, Bit 1,3,5,7:
high_active carry input, low_active carry output.
The NOR from "5) ALU_in" propagates a carry, if one or both ALU inputs are 1.
The NAND from "5) ALU_in" generates a carry, if both ALU inputs are 1.
DC3 is an additional carry input of carry chain Bit 3, generated by "8) BCD detection".

8) BCD detection

BCD detection is located East from the ALU carry chain in the silicon.

For decimal ADC\SBC, it checks if the result of Bit 0..3 (respectively Bit 4..7)
would be not inside the valid range $0..$9 for BCD (binary coded decimal).

It does so by sensing some of the signals generated in 5), 6), 7).

For more info, see patent US3991307A.
For an article about the concept, start reading here.

9) V evaluation, overflow evaluation related to the V flag that is.

It is located at the South end of the ALU carry chain in the silicon.

Per definition, overflow when adding two signed binary numbers is,
when the result has a corrupted sign Bit in the MSB (most significant Bit).

When adding/subtracting two signed binary numbers, this is the case when:
a carry goes into the MSB and no carry comes out of the MSB,
or when no carry goes into the MSB and a carry comes out of the MSB.

For more details about the concept of overflow detetion, see here.

;---

In the NMOS 6502, it's implemented like this:

If no carry goes out of Bit 6 and into Bit 7 (the MSB),
and both ALU inputs for Bit 7 are 1 (what would generate a carry going out of Bit 7),
there is an overflow.

If a carry goes out of Bit 6 and into Bit 7,
and both ALU inputs for Bit 7 are 0 (what would kill/inhibit a carry going out of Bit 7),
there is an overflow.

Note, that the high_active AVR output signal from the V evaluation goes through an inverter
and becomes the low_active AVR# signal which goes to the V flag.
The inverter is located between "17e) control signal latches\drivers" and "27) random 3" (random logic area).

10) ALU_out

ALU_out is located East from "8) BCD detection" in the silicon.

The low_active ALU result bus Q# is sampled by a latch during PHI2.
The output of that latch drives a FET.
Similar to a 7405 type open collector inverter,
said FET does pull (or not pull) a pullup resistor (FET) to GND,
giving us the high_active ALU result Q.

From there, we have FETs switching Q to ADL bus or SB bus (or to no bus at all).

However, while the FETs switching Q0..7 to ADL0..7 all have a common output enable 'ADD>ADL',
for the FETs switching Q to SB it's different:

'ADD>SB' switches Q0..6 to SB0..6,
'ADD>SB7" switches Q7 to SB7.

Point is, that the SB bus is precharged to 1 by pullup FETs during PHI2, including SB7.
And that for "shift right" operation, the ALU output Q7 would be 0. //See "5) ALU_in".

So during "shift right",
if 'ADD>SB7' is 1, Q7 would be 0,
if 'ADD>SB7' is 0, Q7 would be 1.

ROR makes creative use of 'ADD>SB7' depending on the C Flag,
for getting the state of the C flag into SB7.

11) BCD correction

BCD correction is located East from "10) ALU out" in the silicon.
Basically, the game is about making creative use of XOR (XNOR) gates.

It is controlled by 8) "BCD detection".

For more info, see patent US3991307A.
For an article about the concept, start reading here.
//I already had mentioned this in "8) BCD detection".

Note, that a BCD detection during ADC for Bit 0..3 would go into the ALU carry chain Bit 4.

BCD correction also taps into the Q outputs of the ALU.
I think that's a smart move, because SB bus capacitances plus Q>SB (Q>SB7) switch impedances
would cause a delay of the data on SB relative to Q, and because it gives a more compact chip layout.


The ALU result Q is put on the SB bus,
and from there it goes through the BCD correction before entering A (the accumulator).

This sure results in a compact chip layout, this also sure results in an incorrect Flag evaluation,
because the N,Z Flag evaluation does check the _input_ of the BCD correction circuitry, not the _output_.

Obviously, a compact chip layout was more important to the designers than correct flag evaluation in decimal mode.