6502.org

Well, this is my first post, so hello everybody.

I've wanted for a very long time to build my own tiny computer from scratch, and after a friend told me he was doing one himself, I began actually designing mine.

My idea was a 6502-based design, at the highest speed I could run it reliably, so I went with 10MHz W65C02. Because of the über-expensive shipping options of Mouser to Europe (my usual provider being RS-Components, but they don't stock WDC parts), I gave Chinese providers from eBay a go.

After unpacking it I noticed that the top of them were slightly darker than the bottom, meaning they could be well "blacktopped" chips (aka removed from boards, had the original laser-etched part number removed and re-labeled as a different one)

With a multimeter I tried measuring continuity between pin 1 (VPB on real WDC, ground on any other 6502) and pin 21 (ground), and indeed got continuity, meaning that they are a completely different IC, or another true 6502 but relabeled as W65C02.

I thus got an Arduino, clocked it manually while probing on key pins (data, A15, A2~A0, R/W, SYNC), and found something really odd.

I ran a very simple program, consisting of a RESET vector set to 0x0000, and a BRA -1 ("while (true);" loop) at 0x0000, and everything else set to NOP (EA): The boot log, right after releasing reset is as follows: (Remember only A15 and A2 to A0 are connected)

As you can see, this CPU clearly doesn't support the BRA, so I thought "hey, this gotta be a NMOS MOS 6502 part".

But, here's the odd part: in the official 6502 during boot the stack writes that are part of any interruption (PC and processor status) are gated into reads. However they are not in this CPU. I have five of these fake 6502, and can say for sure they all behave the same, so it's not a one-off defect.

Any idea what kind of part do I have here? Could this be a 6502-compatible CPU designed from scratch by another manufacturer?

Welcome, socram!

It's an interesting puzzle you've presented. I'm curious about the actual origin of that CPU, but I don't have any hunch or opinion to offer (although perhaps other forum members will).

If I were you I'd be more concerned about verifying its functionality. IOW, is the chip fit to use or is it damaged or defective in some way? You could begin by replacing the BRA in your test program with an absolute JMP -- $4C $00 $00 in this case.
Can you clarify what you mean by clocking it manually? Just a reminder: NMOS 65xx CPU's have a spec for maximum cycle time -- IOW, minimum operating frequency. The published spec is very conservative, but nevertheless there's a frequency below which the chip cannot reliably operate.

cheers
Jeff

Welcome socram!

Yes, a nice puzzle you have presented

I am puzzled about the 'NOP' behaviour. I would assume each fetch of "EA" from address A with SYNC=1 is followed by a fetch (R/W=1, SYNC=0) from A+1, and then the next opcode fetch from A+1 (SYNC=1) would occur. But your list shows an address increment every cycle?

Then there is three lines below the fetch of 0x80 where the address indicates "0007". Some more address lines connected to the Arduino may clarify this.

cheers

In any case, give the ebay seller the lowest possible feedback score. They hate that because it really hurts them.
(if it was an ebay seller. If it was some other seller, feel free to tell us which one it was - one more to avoid)

Further to Jeff's note, the 65C02 (not 6502) can tolerate having the clock stopped in the high phase. However, only the genuine WDC static core 65C02 can tolerate having the clock stopped during either phase.
To my knowledge, WDC has not marketed 10 MHz 65C02s since the early 1990s, which means either yours is a pull (definitely not NOS, judging by the appearance) or a counterfeit—the date code says 2014, which is very suspicious, as you will soon see.

In either 1991 or 1992 (don't recall which), WDC converted the 65C02 (and the 65C816) to a fully static core and their foundry began producing the device in a smaller 0.8µ geometry—the S8 designator in the part number tells you this. Coincident with the geometry change to 0.8µ, the clock speed rating was increased to 14 MHz at 5 volts and slower speed grades were discontinued. To my knowledge, there were no 10 MHz MPUs produced in 0.8µ geometry, despite what the part number on the items you have says. WDC currently has their foundry producing their microprocessors in 0.6µ geometry, the switch to the smaller geometry having taken place a number of years ago. Therefore, an 0.8µ geometry part with a 2014 date code is an impossibility.

Given all this, I am very suspicious of the parts you received, which do appear to have been defaced in some fashion. See below for what a genuine 14 MHz WDC 65C02 looks like—the photo is straight from WDC themselves. Take careful note of the shape and appearance of the WDC logo and compare it to the logo on the microprocessors you have. The differences in logo appearance are what make me think your parts are not genuine.
Incidentally, the continuity test between VPB and GND probably isn't a reliable determination of the MPU's provenance. VPB is driven in both directions, so I would expect that it would be at least a very low resistance to the ground pin when the MPU is out-of-circuit.

By "manually clocking" I mean using an I/O pin to clock it. The program is: https://gist.github.com/socram8888/bbdd ... cc3ffc450d.
Well damn, I had the data pins wired backwards. With three NOPs and one BRA -1 now:
The EA backwards is 57, which is an illegal instruction and being ignored by the CPU instruction decoder I guess, therefore matching the behaviour of a CMOS part.

However, there are still those three stack writes. Do any brand-name CMOS 6502 behave like that?
I am not an expert on 6502 processors, but is VPB really driven in both directions? I thought it was just an output, and WDC's datasheet seems to indicate so.

At any rate, the VPB is never driven high, so I'm guessing it's indeed just ground.

EDIT:
I've tried PHX, STP and RMB7 instructions. Of them, only the PHX instruction works:

The GTE G65SC12 (as found in the Acorn BBC Master) definitely does three writes during the reset sequence:
viewtopic.php?f=4&t=4963&p=57391#p57391

The datasheet is here:
http://archive.6502.org/datasheets/cmd_ ... family.pdf

If you look at the pinouts, pins 1 and 21 are both VSS.

Might be worth checking for the presence of BBR/BBS (opcode 0x7) and RMB/SMB (opcode xF). The G65SC12 doesn't have these.

Dave

Apparently it doesn't have them - they're treated as a one-cycle NOP as seen in the log on my previous after I edited it.

I'll see if I can decap them, and look at their insides. I wonder where the G65SC12 were made, since these have Taiwan on the bottom and that seems authentic.

When I said "driven in both directions" I meant VPB is both sourced and sunk by the MPU. It is only an output, one that goes low when vectors are being fetched in response to an interrupt. In most systems, VPB is left unconnected.

I can positively tell you that the 65C02 in your photo is definitely not a WDC product. The date code 1451 indicates the device was manufactured during the 51st week of 2014. That is impossible, as WDC transitioned to 0.6µ geometry nearly a decade ago, which would be indicated by the presence of S6 in the part number of current production. S8 in the part number on your device is the older 0.8µ process that WDC adopted about 26 years ago when the conversion was made to static code. The 0.8µ process was discontinued around 2010. My information indicates that all 0.8µ devices were rated for 14 MHz—none rated for anything slower.

BTW, the topic of counterfeit 65C02s came up before.

Yes yes, I am aware that this is certainly not a WDC product. I am at this point just interested for sake of science in guessing which CPUs I had here.

The resistance between GND on pin 21 and pin 1 is in the order of 10 ohms, so I am pretty sure they are tied together, which would be the case if it's indeed a G65SC12.

Regarding the other fake Rockwell, I got a few fake of them from eBay as well when trying to source for an unrelated project. I have not done any testing with them yet.

EDIT: according to the G65SC12 datasheet, the pin 5 is VSS, but it doesn't seem to be connected at all on this chip: resistance to any power pin is over the 20Mohm my meter can read, vs about 700k for other inputs and outputs.

I'm guessing this could be a G65SC02, whose pin 5 is NC, and that those share the same CPU design and do write to stack on reset as well?

If it is a a GTE G65SC02 all opcodes x3, x7, xB, and xF are 1 cycle NOPs. WDCs 65C02 should have WAIT (CB) and STOP (DB) instructions.

It's an interesting bit of research. But I'd be careful trying to measure resistance or continuity from pin to pin of a chip: there are diodes in there, and your meter is going to be imposing a voltage and trying to measure a current. Might be meaningful to test the continuity or resistance both ways round: swap the meter leads between the pins.

Well, thank you everyone. I've just found a picture of the underside of a CMD G65SCxxx chip and can say for sure these are CMD chips.

The circles on the top are exactly the same in the CMD chips I've seen. The notch on the top, and the circle marking pin 1 are also identic on mine

On the underside, they also use the same font and serial number format that mine have.

Again, thank you everybody.

now if only those actually would be reproductions and not just restamped old stock... that'd be great. oh and they should pick their own name.

The "easiest" way would be to have a G65C02 design file sent to one of TSMC's design houses. With enough money you could get them to do a test run. Then, after a few rounds of tests and debugging, you could finally get your own mask set at TSCM and do proper production. A slight problem being the mask set cost... of at least 8-900K USD for 0,6um.

If you had your own cleanroom, the mask set cost would be much lower, but you probably had to settle to a 1um process for a ("cheap") normal contact mask aligner. There is loads of used equipment out there though, so for small volumes that would be a versatile (and fun) way.

But if you really need large volumes (for your own company), TSMC is the cheapest way (in the long term). You get far below 1USD per pc, given the correct package (which would be the most expensive part).

I once heard that some IC's are running 65C02 cores at >200MHz, but with a smaller process. I think they are designed and used in California somewhere, but I don't know the details.