6502

The 6502 CPU

The MOS Technology 6502 is an 8-bit microprocessor designed by Chuck Peddle in 1975 for MOS Technology (later purchased by Commodore). When it was introduced it was the least expensive full featured CPU on the market by far, at about 1/6th the price, or less, of competing designs from larger companies such as Motorola and Intel. It was nevertheless faster than most of them, and, along with the Zilog Z80, sparked off a series of computer projects that would eventually result in the home computer revolution of the 1980s. The 6502 design was originally second-sourced by Rockwell and Synertek and later licensed to a number of companies; it is still made for embedded systems.

Originally the CPC was destined to be designed around the 6502 processor. But when Amstrad approached Locomotive Software to develop a Basic for it with a very tight deadline, Locomotive PLC, who already had a Z80 Basic in the works, urged and convinced Amstrad to switch to the Z80.

The 6502 microprocessor is an 8-bit CPU with an 8-bit ALU and a 16-bit address bus capable of direct access to 64KB of memory space. Like the Z80, the 6502 is a little-endian CPU, meaning it stores 16-bit values with the least significant byte first, followed by the most significant byte. The 6502 has 151 instructions, which are composed of 56 distinct opcodes across various addressing modes.

Although it lacks the raw processing power of processors like the Intel 80x86 or the Motorola 68000 series, the 6502 was known for its efficiency and affordability, making it a popular choice for embedded systems and early home computers. Its simple design contributed to lower manufacturing costs and simplified integration.

The 6502 chip is made up of 4528 transistors (3510 enhancement transistors and 1018 depletion pullup transistors). Despite having so few transistors, it is generally viewed as being twice as fast as the Z80 for same clock speed. Two reasons explain it:

• The 6502 has an 8-bit ALU while the Z80 has a 4-bit ALU
• The 6502 has a clock doubler circuit built inside the chip

The 6502 comes in a 40-pin DIP package. It has been produced by various manufacturers and used in a wide range of applications, from gaming consoles like the Atari VCS, Atari Lynx, Nintendo Entertainment System and PC-Engine to personal computers like the Apple II, BBC Micro, Oric, VIC20 and Commodore 64.

The address space that the 6502 uses is split into pages. There are 256 pages and each page is 256 bytes in size, ranging from page 0 to page 255.

In order to make up for the lack of registers, the 6502 includes a zero page addressing mode ($0000-$00FF) that uses only 1 address byte in the instruction instead of the 2 that are needed to address the full 64 KB of memory. This provides fast access to the first 256 bytes of RAM by using shorter instructions.

The stack is permanently located in page 1 ($0100-$01FF) and managed by the 8-bit stack pointer (S), with an initial value of $FF. It grows downward as data is pushed onto the stack. The stack has a 256-byte limit, and overflow occurs if not managed properly.

Instructions PHA and PHP push the accumulator and processor status onto the stack, while PLA and PLP pull them back. Subroutine calls with JSR store the return address on the stack, and RTS retrieves it to continue execution. Similarly, interrupts (BRK) push the program counter and status, while RTI restores them.

All I/O operations are memory-mapped. There are no port-based I/O instructions.

Memory-mapped ports often have different properties than normal RAM:

• A read-only port is what it sounds like. Attempting to write to this address will not affect the contents. It is also possible that reading a port will alter its contents, or alter the contents of other related ports.

• A write-only port can be written to, but reading it will result in undefined behavior. The value read from the address is not necessarily what was last stored in it.

6502 machines use the last 6 bytes of their address space to hold a vector table containing (in order) the addresses of the NMI routine, the program's start, and the IRQ routine.

On a RESET, the CPU loads the vector from $FFFC/$FFFD into the program counter and continues fetching instructions from there.

On an NMI, the CPU pushes the low byte and the high byte of the program counter as well as the processor status onto the stack, disables interrupts and loads the vector from $FFFA/$FFFB into the program counter and continues fetching instructions from there.

On an IRQ, the CPU does the same as in the NMI case, but uses the vector at $FFFE/$FFFF.

On a BRK instruction, the CPU does the same as in the IRQ case, but sets BF in the copy of the status register that is saved on the stack.

The priority sequence for interrupts, from top priority to bottom, is as follows: RESET, BRK, NMI, IRQ. Source at chapter 7.19

Interrupt hijacking

On NMOS, if NMI is asserted during the first 4 ticks of a BRK instruction, the BRK instruction will execute normally at first (PC increments will occur and P will be pushed with BF set to 1), but execution will branch to the NMI vector instead of the IRQ/BRK vector. On CMOS, this situation is correctly handled by executing BRK and then servicing the interrupt.

An IRQ can also hijack a BRK, though it won't be as visible since they use the same interrupt vector.

Similarly, an NMI can hijack an IRQ. But this is not usually a problem because the IRQ will normally still be asserted when the NMI returns and generate a new interrupt.

Branch instructions and Interrupts

The branch instructions have subtle interrupt polling behavior. When executing a branch instruction, the 6502 checks for interrupts before fetching the operand (cycle 2).

If the branch is taken (i.e., the CPU decides to jump), it does not check for interrupts again before proceeding unless the branch crosses a page boundary (like moving from memory address $01FF to $0200).

If the branch crosses a page boundary, the CPU checks for interrupts once more before fixing the program counter.

If an interrupt is detected at any of these points (before the operand fetch or the page boundary fixup), the CPU will handle the interrupt immediately, interrupting the branch execution.

BCD operations are limited to addition and subtraction using the ADC and SBC instructions.

On NMOS, when Decimal Mode is on, the ADC and SBC instructions update NF, VF and ZF based on the binary result before the decimal correction is applied. Only CF is updated correctly. On CMOS, all the flags are updated correctly, at the cost of 1 additional cycle.

On NMOS, DF is not defined after RESET. On CMOS, DF is automatically cleared on RESET.

On NMOS, DF is unchanged when entering an interrupt of any kind. This can cause unexpected bugs in the interrupt handler if Decimal Mode is on when an interrupt occurs. On CMOS, DF is automatically cleared on interrupt. Upon returning from an interrupt, the processor restores the status register from the stack, including DF.

The 6502 divides each clock cycle into two phases (ϕ1 and ϕ2):

• During the ϕ1 half-cycle, no bus access occurs. This phase is dedicated to internal CPU operations.
• During the ϕ2 half-cycle, the CPU accesses the external bus for memory reads/writes or I/O operations.

The use of half-cycles ensures that memory and I/O devices have predictable timing windows when the CPU will access the bus, while still allowing the CPU to perform internal operations in parallel.

Unlike most microprocessors, the 6502 does not make memory accesses on an "as needed" basis. It always does a fetch or store on every single clock cycle. When there isn't anything to be fetched or stored, a "garbage" fetch or store occurs. This is mainly of importance with the memory-mapped I/O devices:

• On NMOS, when adding a carry to the MSB of an address, a fetch occurs at a garbage address. On CMOS, the last byte of the instruction is refetched.
• On NMOS, when doing a fetch-modify-store instruction (INC, DEC, ASL, LSR, ROL, ROR), garbage is stored into the location during the "modify" cycle... followed by the "real" store cycle which stores the correct data. On CMOS, a second fetch is performed instead of a garbage store.

The 6502 CPU uses some sort of pipelining. If an instruction does not store data in memory on its last cycle, the processor can fetch the opcode of the next instruction while executing the last cycle. This is very primitive as the 6502 does not have an instruction cache nor even a prefetch queue. It relies on RAM to hold all program information.

As an example, the instruction EOR #$FF truly takes 3 cycles:

• On the first cycle, the opcode $49 will be fetched
• During the second cycle the processor decodes the opcode and fetches the parameter #$FF
• On the third cycle, the processor will perform the operation and store the result in register A, but simultaneously it fetches the opcode for the next instruction

This is why the EOR instruction effectively takes only 2 cycles.

However, this pipelining only makes sense when looking at full cycles. If we break it down into half-cycles, there's no actual overlap. In fact, it's the other way around. If the previous instruction ends with a memory write, the CPU has to wait for a half-cycle before fetching the next instruction on the next ϕ2 half-cycle.

Standard instructions

Cycles are shown in parenthesis for each opcode. p=1 if page is crossed. t=1 if branch is taken.

Illegal instructions

Opcodes in red are unstable. Only 2 of those 7 opcodes ($8B, $AB) are actually unstable in the sense that they may produce a truly unpredictable result. The other 5 opcodes actually produce predictable results – but the conditions under which they do that and the produced results are a bit unexpected.

The 6502 follows a 3-3-2 opcode bit pattern. If we arrange the opcode table in a slightly different way than it is usually done, we can observe some interesting symmetries:

Opcodes in bold are illegal. Opcodes in red are unstable.

• On NMOS, an indirect JMP will behave unexpectedly when the indirect address crosses a page boundary, because the 6502 does not add the carry to calculate the address of the high byte. For example, JMP ($19FF) will use the contents of $19FF and $1900 for the JMP address. On CMOS, this issue was fixed, at the cost of 1 additional cycle. In our example, JMP ($19FF) will use the contents of $19FF and $2000 for the JMP address.

• Some instructions, particularly those involving branches or indexed addressing modes, incur an extra cycle if the processor has to cross a memory page boundary. This is problematic for time-sensitive code.

• Conditional jumps are only 8-bit relative. And unconditional jumps are only 16-bit absolute.

• ADC is the only command for addition. To perform an addition without carry, the carry flag must be cleared manually first. Same with SBC for subtract.

• The CLV (Clear Overflow Flag) instruction exist but not the SEV (Set Overflow Flag) instruction.

• The NOP instruction takes 2 full-cycles. This is the minimum amount of cycles an instruction can take.

• The alternate NOPs are not created equal. Some have one- or two-byte operands (which they don't do anything with), and they take different amounts of time to execute.

Simple view

Detailed view

Notes:

• SYNC is an output signal. It is high at T0.
• S.O. is an input signal, which stands for Set Overflow. It allows the hardware to affect VF independently of the software.
• Some pins are modified in CPU variants.

• The ROR instruction didn't exist in the very earliest (pre-1977) chips.

• The 6502 core used inside the NES is missing the Decimal Mode feature.

• The 6507 CPU, used in the Atari VCS, has only 13 address lines. So it can only address 8KB instead of 64KB. It also lacks the IRQ and NMI interrupt lines.

• The 6510 CPU, used in the Commodore 64, is a 6502 with an additional AEC pin that puts the bus in high impedance mode. It also includes a 6-bit I/O port that occupies addresses 0 and 1.

• The disk drive of the Commodore 64 has its own 6502 processor that acts as a floppy disk controller (FDC) and as a disk operating system (DOS) processor. It can also be used as a general coprocessor for the main system.

• The 6502C used in Atari 8-bit computer range, adds an additional HALT pin. The 6502C is otherwise a regular NMOS 6502, not to be confused with the CMOS 65C02.

• The CMOS 65C02 fixed multiple bugs of the original NMOS 6502, but also removed access to all illegal instructions. Some cycle counts have been modified and some extra instructions have been added. In fact, there are multiple implementations of the 65C02 (WDC 65C02, WDC 65C02S, Rockwell R65C02, CSG 65CE02, ...), each with its own variant of the instruction set.

• The HuC6280, used in the PC-Engine gaming console, is an improved version of the CMOS 65C02.

• The 65C816, used in the SNES and the Apple IIGS, is a 16-bit version of the 65C02. It contains a compatibillity mode, enabled by default upon reset, that makes it behave like a regular 65C02.

• The Sony SPC700 sound CPU used inside the SNES also behaves similarly to a 6502 with some extensions. Source

• 6502 at the English-language Wikipedia
• On the 6502 - A brillant or sloppy design?
• 6502 Instruction Set
• 6502 Family CPU Reference
• The 6502/65C02/65C816 Instruction Set Decoded
• Opcode matrix arrangement
• Oxyron Opcode Matrix
• Synertek SY650x programming manual (250 pages)
• Synertek SY650x hardware manual (178 pages)
• Media:SY6500 - SY65C02 datasheet.pdf - provides a detailed breakdown of the machine cycles
• Media:6502 (65xx) Microprocessor Instant Reference Card.pdf
• Media:6502-dead-cycles.pdf
• 6510 Instruction Timing
• No more secrets - NMOS 6510 Unintended Opcodes
• Conference - Reverse Engineering the MOS 6502 CPU
• 6502 Interrupts
• Cycle-stepped 6502 emulation how-to
• Tom Harte's SingleStepTests