//Previos thread: 6702 dissection.

This thread is about a transistor level dissection of the 6530-004 (TIM edition),
brought to you by Frank Wolf and ttlworks.

6530 was used in the KIM-1, in Commodore disk drives, and in pinball machines.

Datasheets:
MOS MCS6530 datasheet, August 1975, preliminary
MOS MCS6530 datasheet, undated
Synertek SY6530, April 1979

Patents by William D. Mensch, Jr.:
U.S. Patent Number 4,099,232 seems to be related to the 6530 timer.

Also, there is some info on Hans Otten's 6530-6532 page.

;---

The 6530 RRIOT (RAM, ROM, IO, Timer) is a special chip in the 6502 family.

6530 contains 64 Bytes of RAM, 1kB of mask programmed ROM, two 8 Bit IO ports, and a Timer.
//Timer is an 8 Bit down counter with prescaler factors 1, 8, 64, 1024.
It also contains a mask programmed address decoder.

The idea at MOS was, that a microcontroller could be built from just two chips: 6502 plus 6530.
And that up to seven 6530 (each chip containing a different address decoder and different ROM contents)
could be used in a 6502 system.

And that's where trouble starts:
Because of custom address decoder and custom ROM contents,
when replacing a defective 6530, you can't just buy any 6530, plug it into the socket and hope that it works.
Even replacing a 6530 with a 6530 pulled from another socket from the same PCB probably won't work.

It has to be a 6530 which fits to a specific socket on a specific PCB,
and you need to look out for obscure chip markings and part numbers.


6532 seems to be based on the 6530, it lacks the address decoder and the ROM, but it has 128 Bytes of RAM.
6532 was used in the Elektor Junior computer and in the Atari 2600.

;---

6530 contains some ciruitry you probably won't expect to see in other 65xx peripheral chips (except for 6531 and 6532).

When I was a kid, I did two layer PCB layouts on transparent foil with tape and rub-on dry transfers,
and I think I know how the game goes when things are starting to get a bit dense and complex.

The 6530 chip layout has that "hand routing smell" all over, it's incredibly dense/compact and complex,
and I feel a need to salute to the designers (Bill Mensch et al.): it truly is a beautiful/amazing work of art.



Again: my thanks to Frank Wolf, because not many out there could polygonize a beast of that sort.

Now for some oddities of that 6530 "Wolpertinger":
RESET is fully asynchronous, it's not sampled with the clock.
PHI2_in has 30pF typ. input capacitance, because it directly and unbuffered feeds quite some circuitry on the chip.
Signals from PA0..7 and PB0..7 are not latched at PHI1, the CPU reads them directly.
;
Bus interface uses fully static latches for data writes, but read data bus uses a dynamic precharge mechanism.
Bus interface uses fully static latches for the address, IO logic uses fully static register Bits,
and the logic which sits in between and controls said IO logic uses dynamic latches.
;
//That mix of static and dynamic logic started to make me wonder,
//at which point of the 6530 design phase the specification for the 6502 bus timing had rolled out.
//It would be interesting to read a "the making of the 6530" story.

Some features:
PA0 and PB0 have push/pull outputs for driving darlington transistors etc.
PA1..PA7 and PB1..PB7 have open_drain outputs with integrated pullup resistors.
However, there is a mask programmed option to disable the PB5 and PB6 output drivers
and to use PB5 and PB6 as inputs for the address decoder.
PB7 is supposed to be used as a Timer underflow IRQ# output, and it lacks the pullup resistor.

Note:
For consistence with Frank's notation, low_active signals are named foo#, not /foo.

Orientation for all the chip pictures: A5 and R/W# pads are North.

Eagle 6.4 schematics for my schematic pictures in this thread,
just in case if somebody needs them.

Note: KiCad is supposed to be able to import these schematics,
unfortunately it doesn't seem to be possible to disable the layers 'name' and 'value' in KiCad schematics,
so making my schematics look nice and clean in KiCad will require some work, sorry.

0) cheat sheet

A very simplified schematic to give an overview about what came out during the dissection.

Note:
Latches labeled FSTL are fully static transparent latches (built around a RS flipflop).
Latches not labeled FSTL are dynamic transparent latches (just a FET switch plus some trace capacitance).



A picture of the 6530 silicon, with the interesting areas marked according to the cheat sheet.

Don't worry because the RAM and the ROM lack any details in the cheat sheet and in this picture,
we are getting there later.



Just as a reference, another picture of the 6530 silicon without the markings.

1) clock generation

Nothing special in there.

However, it should be noted that PHI2_in also directly and unbuffered drives quite some circuitry on the chip.

6530 PHI2_in has 30pF typ. input capacitance, for a NMOS 6522 20pF typ. would be normal.

When using multiple 6530 (or 6532) chips in a system,
it probably would be a good idea to keep an eye on the total capacitive load of the 6502 PHI2 output driver
(and on the 6502 propagation delay PHI0_in to PHI2 output, which might be different for rising and falling edge of the clock).

2) RESET

The low_active RES# signal from the pad goes through an inverter, then through a non_inverting super buffer,
and becomes the high_active RES signal (which puts the chip into a RESET).

Note, that the 6530 RESET is fully asynchronous, and not sampled with the clock.
Means, a glitch on RES# to logic low level at any time most likely will cause a RESET.

RES clears the PRA and PRB IO port data registers.
RES clears the DDRA and DDRB IO port data direction registers, configurating the PA0..7 and PB0..7 IO port pins as inputs.

But be aware: RES does not affect the timer, the Timer Interrupt flag, the prescaler, and the prescaler factor.

RES makes sure that PB7 is not pulled low while RES is active.
RES also sets the latch for the PB7 interrupt generation to "disabled".
But if there is something like an accidental Timer read during the RESET sequence of a 6502,
A3i could enable PB7 interrupt generation, and then there might be a falling edge on PB7 in the wrong moment...
For more details, please see "16) Timer control".

3) RS0

RS0 is an address decoder input signal.

The high_active RS0 input is sampled with PHI1 into a fully static transparent latch,
which gives out the low_active RS0i# signal that goes to the address decoder PLA.

//'i' like in 'Input'.

4) A0

Like RS0, high_active A0 from the pad is sampled with PHI1 into a fully static transparent latch.
A special thing is, that the latch feeds push/pull output drivers which generate
the low_active A0i# and the high_active A0i.

When taking a look at the chip layout, it appears that big transistors are located between the address pads.
They somehow look like output drivers (for external signals) to be found in other chips,
but they are driving the internal address lines inside the chip instead.

I think it's a good/clever idea to re_use an output driver structure/topology for driving internal address lines
to deal with the capacitances build up by the RAM and ROM address decoders.

5) A9

Since the A9 input buffer circuitry layout is different from A0,
I felt a need to take a closer look at it,
but from the logic design point of view the input circuitry for A0 and A9 is identical.

Layout of the A1..A5 input circuitry is identical to A0.
Layout of the A6, A7 input circuitry is identical to A0, but it's mirrored to make better use of chip space.

Layout of the A8 input circuitry is a variation of A9.


Now for a list of signals generated by the A0..A9 output drivers:
West to East: A0i#, A0i; A1i#, A1i; A2i#, A2i; A3i#, A3i; A4#i, A4i; A5i#, A5i; A6i, A6i#; A7i, A7i#; A8i, A8i#;

North to South:
A9i,
A9i#;

6) CS1 latch

The CS1 latch is a fully static transparent latch, which samples PB6 at PHI1,
and gives out the high_active CS1 signal to the address decoder PLA.

Similar to the CS1 latch,
the CS2 latch also is a fully static transparent latch, which samples PB5 at PHI1,
and gives out the high_active CS2 signal to the address decoder PLA.


Both latches are located between the RES# pad and the RAM block.

7) R/W#

R/W# (high=read, low=write) is sampled with PHI1 into a fully static transparent latch,
which feeds a push/pull driver generating W/R# (high=write, low=read).

8) DB7

Overview:

DB0..7 external data bus pads (high_active).

Internal write data bus D0..7w# (low_active) when writing registers.
//Internal write data bus D0..7w (high_active) is generated by super buffers located South in the IO logic block.

Internal read data bus D7r# (low_active) when reading registers.
//The read data bus is precharged during PHI1 with FETs located South in the Timer block.

Layout for the DB0..6 circuitry is pretty similar to DB7, so we only take a look at DB7.

;---

On the input side, the high_active DB7 pad is sampled with PHI2_in into a fully static transparent latch,
which feeds a push/pull driver generating the low_active D7w# signal for the write data bus.
//Note, that the PHI2_in signal controlling the DB0..7 latches comes directly and unbuffered from the PHI2_in pad.

On the output side, the low_active OE_DB# control signal enables the inverting DB7 push/pull driver
which takes the low_active D7r# signal from the read data bus and emits it in high_active form
on the external DB7 data bus pad.

9) PB7

PB7 is an open drain IO port signal, which lacks a pullup resistor.

In addition to being an IO port signal,
it also works as a (low_active) Timer overflow interrupt output,
supposed to be tied to the IRQ# pin of a 6502.

The PB7 pullup resistor (FET) is present in the chip layout,
but the diffusion layer between the pullup and VCC is cut.
I think that's because if the PB7 pads of multiple 6530 chips are tied to IRQ#,
and every 6530 would have a PB7 pullup resistor,
the resulting impedance of all the PB7 pullup resistors in parallel on the IRQ# line
would be too low for a 6530 PB7 output driver to pull down IRQ# to a logic low level.

;---

Not much to say on the output side:
if PB7o# is high OR IRQ is high, the output driver pulls PB7 low.
//For logic high level, you need to add an external pullup resistor between PB7 and VCC.

In the IO logic block, PB7o# is the output of a NOR gate fed by data bit PRB7 and data direction Bit DDRB7#.
If PRB7=0 (data Bit low) and DDRB7=1 (PB7 is output), PB7o# is high, and PB7 is pulled to GND.

The high_active IRQ signal is generated in the Timer control block.
//IRQ can be enabled/disabled with A3 during Timer reads/writes.
If it's enabled AND if the Timer Interrupt flag is set, IRQ is high, and PB7 is pulled to GND...
...by ignoring the PRB7 and DDRB7 Bits.

;---

On the input side, the PB7 pad signal goes through two inverters, becomes PB7i and goes to the IO port logic,
IO port logic places it in inverted form on the D7r# read data bus when reading data register PRB,
we are getting there later.

Note, that the PA0..7 and PB0..PB7 input signals are not latched at PHI1, the CPU reads them directly,
we are getting there later, too.

10) PB6

PB6 pad also feeds CS1 latch, PB6 pad also feeds CS2 latch,
CS1 and CS2 are used in the (mask programmed) address decoder PLA of the chip we had dissected,
and as a mask programmed option the metal trace between PB5,PB6 pad and PB5,PB6 driver is cut.
//You don't want the chip to be able to remove itself from the system by disabling its own chip select.

PA1..7 and PB1..6 pad circuitry is pretty similar to PB7.
They are open drain outputs with pullup resistor (FET).
So we just focus on PB6:

;---

On the output side, if PB6o# is high, and if the metal trace wouldn't be cut, the output driver would pull PB6 low.

In the IO logic block, PB6o# is the output of a NOR gate fed by data bit PRB6 and data direction Bit DDRB6#.
If PRB6=0 (data Bit low) and DDRB6=1 (PB7 is output), PB6o# is high.

;---

On the input side, the PB6 pad signal goes through two inverters, becomes PB6i and goes to the IO port logic,
IO port logic places it in inverted form on the D6r# read data bus when reading data register PRB,
we are getting there later.

Note, that the PA0..7 and PB0..7 input signals are not latched at PHI1, the CPU reads them directly,
we are getting there later, too.

11) PB0

PA0 and PB0 have a pullup resistor (FET),
but unlike PA1..7 and PB1..7, PA0 and PB0 have true push/pull output drivers.

PA0 and PB0 are meant to source 3mA for driving darlington transistors and such.

PA0 and PB0 circuitry layout is different to make better use of chip space,
but electrically they are identical, I checked.
So we now focus on PB0.

;---

On the output side:

PB0 output driver is enabled by DDRB0=1 (when PB0 is configurated as an output).
PRB0# which goes into the output driver is the low_active output signal of the PRB0 data register Bit.

When DDRB0=1:
If DDRB=1 and PRB0=0 (PRB0#=1), the output driver pulls PB0 low.
If DDRB=1 and PRB0=1 (PRB0#=0), the output driver pulls PB0 high.
And that's all there is to it.

;---

The input side is more complicated:

There is a danger that the voltage at PB0 doesn't reach logic high level
when the PB0 driver has to source a lot of current.

That's why we have sort of a 2:1 multiplexer controlled by DDRB0 (data direction register Port B).
The multiplexer generates PB0i, which goes to the IO port logic,
IO port logic places it in inverted form on the D0r# read data bus when reading data register PRB,
we are getting there later.

If PB0 is configurated as an input, PB0i is generated from the PB0 pad.
If PB0 is configurated as an output, PB0i is generated from the data register Bit PRB0.
//I'm simplifying things a bit here.

Note, that the PA0..7 and PB0..7 input signals are not latched at PHI1, the CPU reads them directly,
we are getting there later, too.

12) PLA

(mask) programmed logic array (PLA), also known as "the address decoder".
Mask programmed as in "customer specific".

It decides, where ROM, RAM and IO (including Timer) show up in the 6502 address space.

Located high up North, between A5 pad and R/W# pad.


Basically, we have three NOR gates:
One for selecting ROM: fed by CS1, CS2, RS0i. //CS1#, CS2#, RS0i# respectively.
One for selecting RAM: fed by CS1, CS2, RS0i, A6..9i. //CS1#, CS2#, RS0i#, A6..9i# respectively.
One for selecting IO: fed by CS1, CS2, RS0i, A6..9i. //CS1#, CS2#, RS0i#, A6..9i# respectively.

Where CS2 is supposed to be A12, CS1 is supposed to be A11, and RS0 is supposed to be A10.


//The A0..9 input buffers emit A0..9i (high_active) and A0..9i# (low_active).

We have three inverters, generating CS1# from CS1, CS2# from CS2, and RS0i from RS0i#.

;---

For those who are new to the game:

In the polygonized chip picture, red is diffusion layer, green is PolySi layer, blue is metal layer.
Where ever green crosses red, that's the active region of a FET, and green is the Gate of that FET.

So the PLA was mask programmed by changes in the diffusion layer.