//Previous thread: 8501 dissection: Some parts of the 8501 and 6509 chip layout do look very similar, some other parts don't.

Side quests:
6509 versus 8501 clock generator dissection
6509 dissection: the remaining pads //because RES#, NMI#, IRQ#, RDY, SYNC are not covered in this thread here.

Putting everything together:
6509 dissection: IDKFA

This thread is about a transistor level dissection of what makes the 6509 different from the 6502,
brought to you by Frank Wolf and ttlworks.

The 6509 was used in the ill-fated Commodore CBM-II line of computers (released 1982, discontinued 1984).

It was capable of addressing 1MB of RAM via bank switching (16 blocks of 64kB by a cumbersome sort of MMU), but had a reputation for being difficult to program, and never fared well.

In addition to A0..A15, it has four additional address pins, namely P0..P3.
There are two 4 Bit registers inside the chip, a RESET sets all of the register Bits.
Register 1 (located at $0001 in memory) is placed on P0..P3 when the CPU reads data from memory by using 'LDA (ind),y' or writes data to memory by using 'STA (ind),y'.
Else, register 0 (located at $0000 in memory) is placed on P0..P3.

Means, the first two Bytes ($0000 and $0001) of every 64kB block of memory can't be used, because the two MMU registers always are mapped there.
When reading these address locations, the CPU does a read cycle on the bus, but discards the data.
When writing these address locations, the CPU does a read cycle on the bus, but discards the data: R/W# is forced to 1, and the D0..D7 data bus drivers are disabled.

Note:
For consistence with Frank's notation, low_active signals are named foo#, not /foo.
For the cheat sheet, I decided to stick with the 8501 workflow, because it was economical to use copy&paste when writing text about parts where the chip designers had used copy&paste,
and that's why the 8501 topics 1) and 3) are missing in the 6509 cheat sheet: 6509 has no bias generator, and no GATE_IN logic.

Orientation for all the chip pictures: PHI1(in) is North.

Eagle 6.4 schematics for my schematic pictures in this thread,
just in case if somebody needs them.

Note: KiCad is supposed to be able to import these schematics,
unfortunately it doesn't seem to be possible to disable the layers 'name' and 'value' in KiCad schematics,
so making my schematics look nice and clean in KiCad will require some work, sorry.

0) cheat sheet

A very simplified schematic to give an overview about what came out during the dissection.



Some time ago, Dr Jefyll had had posted a schematic for 6502 add-on logic to make a 6509 look-alike,
and his schematic isn't too far from what came out during our 6509 chip dissection:



Bank switching versus "CPU responding to interrupts" still is a topic, we are getting there later.

A picture of the 6509 silicon, with the interesting areas marked according to the cheat sheet.



Just as a reference, another picture of the 6509 silicon without the markings.

2) AEC input buffer, located at the North West corner of the chip.

Nothing fancy in there:

AEC (high_active) goes through an inverting super buffer, and AEC#_buffered (low_active).

AEC#_buffered then goes through a non_inverting super buffer plus an inverting super buffer, and becomes AEC_buffered (high_active).

4) IO address decoder, and that part of the chip layout looks a bit similar to what we had in the 8501.

;---

First, we have a 15 input NOR gate which checks A1..A15 to zero for identifying a read/write to IO address space.
Except that the NOR gate doesn't instantly pop out when looking at the chip.

What we really have on the chip is a long metal trace (labeled IO_SELECT) which runs at most of the West and South side of the chip.
Each of the A1..A15 pad drivers has a FET which is tied to the metal trace, and pulls said metal trace to GND if the related address Bit is 1,
but we are getting to the innards of the address pad drivers later.

Also connected to the metal trace, we have a cute tiny pullup FET, located East of the A4,A5 pads, and it's hard to spot.

The metal trace then goes to the input of a non inverting super buffer, which gives out IO_SELECT_buffered to the address decoder.
Said buffer is located North of the GND pad. (GND pad is on the South edge of the chip).
If the address points to $0000 or $0001, IO_SELECT_buffered is 1.




Second, the address decoder logic is located North of the P3 pad.
//North of the address decoder logic, we have the logic for the IO ports and the MMU.

At the West side of the address decoder logic we have two signals going in, IO_SELECT_buffered and A0#.
A0# is low_active and tapped from the innards of the A0 pad driver, we are getting to it later.

At the North side of the address decoder logic, we have the WRITE1 signal going in,
that's the output of a transparent latch which is gated with PHI1 and samples the CPU_W/R# signal, we are getting to it later.
Also, we have some output signals:
WR_IO# is a low active signal for switching the IO data bus during writes.
WR_0x00, RD_0x00, WR_0x01, RD_0x01 are high_active control signals for the IO port logic.
OE_D# is the low active output enable for the D0..D7 data pad drivers.

Note, that the D0..D7 data pad drivers are disabled during IO reads/writes, and that the R/W# pin is forced to 1 during IO writes.

5) data read/write control, data read/write timing stuff that is.

;---

The R/W# buffer is inverting, and it is fed with "internal_W/R#", we are getting later to this.

The logic for generating "internal_R/W#" is made from two little parts, which have different locations on the chip:

We have an AND gate (located west of the D2 pad driver) with CPU_W/R# and IO_SELECT_buffered at the inputs.
And yes, that's why the R/W# pin is forced to 1 during IO reads.
//That part of 5) is different from the 8501, while the rest looks a bit similar.

The output of the AND gate then goes through a transparent latch controlled by PHI1,
goes through an inverter plus an inverting super buffer, which which gives us "internal_W/R#" at the output.
(These parts are located South of the R/W# pad driver).



;---

For the rest, we have one block of logic which is located West from the D6,D7 pad drivers.
CPU_W/R# is sampled by a transparent latch controlled by PHI1, generating WRITE1 for the IO address decoder.

IO_SELECT_buffered (and the IO_SELECT_buffered# generated by an inverter) are sampled by transparent latches controlled by PHI1.
The outputs of the latches are driving two tricky pulse shapers which generate two signals from PHI2:
OE_IO_Data, high_active output enable for the read buffers in the IO logic for reading IO data into the CPU data input latch,
OE_Data_in, high_active output enable for the read buffers at the D0..D7 data pads for reading the external data bus into the CPU data input latch.

I would dare to say, that the purpose of these pulse shapers is to delay these two signals
to make sure that the data read from the buffers fits the CPU read hold timing.

6) R/W# pad driver, high up North on the chip.

Nothing fancy.
Inverting buffer with low_active output enable.

Buffer inverts "internal W/R#" to external R/W.
Output enable is the low_active AEC#_buffered signal.

7) D0 pad driver, high up North in the chip.

Nothing fancy in there.

D0 pad is driven by a non_inverting buffer (fed by D0_output),
the (write) buffer has a low_active output enable OE_D#.

D0 pad is read by an inverting buffer into the low_active D0_Data_in#,
the (read) buffer has a high_active output enable OE_Data_in.

8) A11 latch + pad driver, down in the south of the chip.

We have an inverter that turns A11_internal into the low_active A11_internal#.

A11_internal# is sampled by a latch (three FET switches plus a non_inverting super buffer),
controlled by PHI1, PHI2, and LD_ADDR.

The low_active latch output goes to the A11 pad driver.
Also, the low_active latch output goes into a super buffer.
The high_active super buffer output goes to the A11 pad driver,
also it goes to the gate of a FET that switches IO_SELECT to GND.

Said FET is present in the A1..A15 logic, together with the IO_SELECT metal trace
and one pullup resistor this gives us a 15 input NOR gate for detecting the IO address range
$0000 and $0001, we already had mentioned this in 4) IO address decoder.

Also, the address decoder taps into the inverted output of the A0 address latch,
using the A0# signal to find out if the address is $0000 or $0001.

The A11 pad driver has a high_active output enable: AEC_buffered.

9) IO port logic.

The IO port logic is rather compact, and West from the CPS pad.

From North to South, we have the logic related to P0, P1, P2, P3.
The layout of these logic blocks varies a little bit,
because some parts of the MMU control logic are squeezed between them.

The layout of the West part of these blocks looks pretty similar to what we had in the 8501,
(the part containing the IO data bus and the two registers)...
except that a RESET _sets_ all of the register Bits to 1.

The East part of these blocks looks different from the 8501:
what we have here is a 2:1 multiplexer (plus a latch) which selects a Bit from one of the two registers
and sends it to a pad driver.

We have two 4 Bit registers which are mapped to memory:
$0001, register 1, is placed on P0..P3 when the CPU reads data from memory by using 'LDA (ind),y' or stores data to memory by using 'STA (ind),y'.
$0000, register 0, is placed on P0..P3 in every other case.

;---

Now to take a look at the logic block related to P0:

The low_active WR_IO# control signal puts the D0_output of the CPU on the IO data bus during peripheral writes.

An inverting super buffer with a FET switch at the output controlled by the high_active OE_IO_Data signal
puts the inverted data from the IO data bus on D0_data_in#.
D0_data_in# also is fed by the D0 pad input buffer.
D0_data_in# goes through a simple inverter before it enters the CPU as D0_data_in_latch.
//The game goes like this for D0_data_in_latch..D3_data_in_latch.
//D4_data_in_latch..D7_data_in_latch are forced to 0 during IO reads, we are getting there later.

In the IO logic, we have two latches:
WR_0x00 writes register 0.
WR_0x01 writes register 1.
RD_0x00 reads register 0.
RD_0x01 reads register 1.

We have a 2:1 multiplexer tapping into both registers, controlled by the MMU logic.
The multiplexer feeds a latch, controlled by PHI1 and the MMU PHI2 clock (which is generated by the MMU logic).
The output of that latch controls the P0 pad driver.

The P0 pad driver is nothing fancy, and P0 only works as an output.

10) D4..D7 data input NOR

Now to take a look at what happens to D4..D7 during IO reads.

As we remember, the D0..D7 pad input buffers give out low_active data, namely D0_data_in#..D7_data_in.

D4_data_in#, RD_0x00, RD_0x01 go into a three input NOR gate, which feeds D4_data_in_latch.
Means if D4_data_in is 1, or if RD_0x00 is active, or if RD_0x01 is active, D4_data_latch_in is 0.
D5..D7 are handled in the same way, means we have four 3 input NOR gates in total.

The D4_data_latch_in NOR is located at the Northern corner of the P1 logic block.
The D5_data_latch_in NOR is located at the Northern corner of the P2 logic block.
The D6_data_latch_in NOR is located at the Northern corner of the P3 logic block.
The layout of these three NOR gates is identical.

The D7_data_latch_in NOR is located at the Nothern corner of the IO address decoder,
South from the P3 logic block, and its layout is different from the three other NOR gates.

11) MMU control logic.

It's located on different places on the chip, so I decided to copy the different areas from the chip pictures,
to put them into a single picture, and to connect them with white lines.

Detection of 'LDA (ind),y' and 'STA (ind),y' plus the three Bit shift registers is located Nort of the P0 IO logic block.
The rest of the circuitry is crammed between the IO logic blocks, and a logic gate plus an inverter is West of the CPS pad.

;---

When the CPU responds to an interrupt, it does by forcing the instruction register to $00 forging a BRK instruction,
what discards the fetched instruction and initiates a BRK sequence.
For instruction fetches without a forged BRK, signal IBE# (Visual6502 Node 1077) is low.

We have two 9 input NOR gates (plus some inverters), which check the low_active D0_data_in#..D7_data_in# from the D0..D7 pads for:
$B1 (binary 10110001) at the D0..D7 pads = LDA (ind),y
$91 (binary 10010001) at the D0..D7 pads = STA (ind),y
when IBE# is low.

Point is, that if the CPU would be responding to an interrupt with a $91 or $B1 OpCode fetched,
we need to make sure that the MMU logic doesn't accidentally do bank switching during an interrupt sequence,
and that's why these two NOR gates also check if IBE# is low.

Hmm... for the average logic designer, it should be obvious that one NOR gate checks if D5 is 0, the other NOR checks if D5 is 1,
while all of the other inputs of both NOR gates are identical.
Means one could replace two 9 input NOR gates plus 5 inverters by one 8 input NOR gate plus 4 inverters, but I'm getting off topic.

;---

The outputs of the two 9 input NOR gates enter a two INPUT NOR, which feeds a 3 Bit shift register
(which, in the chip layout, doesn't instantly stick out as a shift register).

It's a 3 Bit shift register because the bank switching needs to be done in cycle T4,T5 during a LDA\STA (ind),y instruction:
T0: fetch OpCode
T1: fetch zero page indirect address
T2: fetch low order Byte of base address
T3: fetch high order Byte of base address
T4: fetch data from the same page
(T5: fetch data from the next page if there was a page crossing)


The output of the shift register sets a RS flipflop.
The RS flipflop tells the 2:1 multiplexers in the P0..P3 IO logic wheter to send register 0 or register 1 on the P0..P3 pads.
The RS flipflop is cleared either by a CPU RESET, or by the SYNC_early signal (indicating the next instruction fetch).

SYNC_early changes with PHI2, and goes through a latch controlled by PHI1 before it goes to the SYNC pin.

;---

Now for the circuitry generating the clock signals for the shift register.

The CPU does wait cycles when RDY=0 during reads,
so we have a NOR gate plus an inverter (West of the CPS pad) checking RDYP and WRITE1 to see if the CPU is out to do a wait cycle.

If there is a wait cycle, clock signal PHI1_MMU_hold goes active during PHI1.
If there is no wait cycle, clock signal PHI1_MMU_shift goes active during PHI1.

The pulse shaper generating these two clock signals looks pretty similar to the pulse shaper we already had in 5a) data read/write control.
Except that the capacitors are a bit smaller, and that it generates pulses during PHI1 instead of PHI2.

12) CPS input pin, also known as "Chuck Peddle special pin", or as SO (set overflow) pin.

A simple detector checks for a falling edge at the CPS pad.

If there was a falling edge at the CPS pad, signal CPS_10_edge becomes active for a cycle,
setting the V flag.

13) V flag, located East in the tangled mass of logic gates between the PLA and the mill.

The dissection wouldn't have been complete without taking a look of how the V flag is set by the CPS pin.
A teardown of the complete V flag logic would have gone too far (it's a very dense area in the chip layout),
so I only had focused on everything CPS related there.

Nothing fancy, except that it seems that the designers were fond of AND\NOR combination gates,
and that the output of the V flag is low_active inside the CPU.

And that's all for now.

I'm going on vacation and AFK for the next 4 weeks,
and then 6702 is next.