Z80

Zilog Z80A

The Z80 is an 8-bit microprocessor designed by Zilog founder and CEO Federico Faggin, first released in July 1976. It is the CPU used in the Amstrad CPC / Plus / PCW computers.

The Z80/Z80A was a very popular microprocessor, used in a wide range of applications, from gaming consoles like the ColecoVision or the Sega Master System to handhelds like the Sega GameGear or some TI calculators to personal computers like the ZX81, ZX Spectrum, MSX and VG 5000.

It was even used in the Sega MegaDrive as the sound CPU and in the Commodore C128 as a secondary processor in order to achieve CP/M compatibility. Similarly, the Acorn Z80 Second Processor expansion for the BBC Micro enables CP/M compatibility.

In the early 1970s, Intel developed the 8080, one of the first widely used microprocessors. However, a group of engineers led by Federico Faggin, the originator of the 8080 architecture in early 1972, left Intel to start their own company called Zilog in 1974.

At Zilog, Faggin and his team wanted to create an improved version of the 8080 that would be more efficient, flexible, and easier to use. This led to the development of the Z80, which was designed to be both backward-compatible with the 8080 and more powerful. This compatibility meant that any software written for the 8080 could run on the Z80, making it an attractive upgrade for manufacturers and developers.

The Z80 had several key improvements over the 8080. It featured more registers, block instructions, bitwise ops, indexed addressing, and improved interrupt handling. It also had built-in memory refresh for dynamic RAM, that made it easier to build systems around it.

The Z80 microprocessor is an 8-bit CPU with a 4-bit ALU and a 16-bit address bus capable of direct access to 64KB of memory space. The Z80 is a little-endian CPU, meaning it stores 16-bit values with the least significant byte first, followed by the most significant byte.

It has a language of 252 root instructions and with the reserved 4 bytes as prefixes, access to an additional 308 instructions. Although it lacks the raw processing power of processors like the Intel 80x86 or the Motorola 68000 series, the Z80 is extremely useful for low cost control applications.

The Z80 has about 8500 transistors. To put it into perspective, 64KB of DRAM contains 524288 transistors, as 1 bit of DRAM needs 1 transistor. Fun fact: an Amstrad CPC equipped with a 4MB RAM expansion has 32 million transistors dedicated to RAM while the Z80 CPU still has only 8500 transistors.

The Z80 is mid-1970s technology while the 64KB DRAM is early-1980s technology and the 4MB DRAM is early-1990s technology.

The Z80 comes in a 40-pin DIP package. It has been manufactured in A, B, and C models, differing only in maximum clock speed. It also has been manufactured as a stand-alone microcontroller with various configurations of on-chip RAM and EPROM.

The Z80 CPU has been manufactured by others, and various Z80s have been used in the construction of the CPC during its lifetime:

• Mostek MK3880N-4 Source
• NEC D780C Source
• SGS Z8400AB1 Source
• ST Z8400AB1 Source
• ZILOG Z8400APS Source
• ZILOG Z0840004PSC Source

All the Z80 CPUs that have been used on CPC and Plus machines are NMOS. Source

Zilog ended the production of the Z80 in April 2024. This chip is still available in ample quantities through NOS chip suppliers. And Zilog continues to produce the eZ80 which is a modernized Z80 CPU.

Modern incarnations

Apart from surplus/new Z80-clones that are quite easy to find, many emulations depend on software implementations of the Z80:

• The T80 is a VHDL implementation of the Z80 and Z80A, finished in 2002 on OpenCores
• arnold uses InkZ80, written in C++ (apart from the author-designed C simulation)
• On OpenCores, there is also a Verilog implementation of the Z80.

 On Zilog NMOS Z80, when the instruction doesn't compute new flags, this register is cleared instead. But not on NEC NMOS Z80. And CMOS Z80 behave in a different way too.
 Normally, you never see the content of this register. But it leaks through F5 and F3 in the SCF/CCF instructions. Source
 Emulating Q is not strictly necessary. A 1-bit flag, indicating whether the previous instruction computed flags, is enough to emulate the behaviour of SCF/CCF. Source
 Also note that while POP AF and EX AF,AF' modify F, they do not compute new flag values.

Notes:

• EIP and IMP can be fusioned into a 3-bit internal state as there are only 7 possible values for the prefixes (none, ed, dd, fd, cb, ddcb, fdcb). Probably not a win though as it makes everything more confusing.
• IFF1 / IFF2 are called IEF1 / IEF2 (Interrupt Enable Flip-flops) in the Zilog eZ80 manual.

Legend

Flags

• - = no change
• + = change by definition (if noted, by the operation marked with '=> flags', otherwise by the only non-single-bit operation):

* S = sign, bit 7 of the result byte (accumulator or high byte for 16-bit operations)
* Z = zero, set if the result is zero (8 or 16-bit value)
* 5 = undocumented, bit 5 of the result byte
* H = half-carry, the carry (theoretical bit 4) of the low nibble of the result byte
* 3 = undocumented, bit 3 of the result byte
* P = parity (set if the result byte has an even number of bits set) or overflow (set when crossing the boundary of the signed range); always specified
* N = negative, set if the previous operation was a subtraction; always specified
* C = carry, the theoretical bit 8 of the result byte

• 0 = always reset
• 1 = always set
• X = change described under Effect
• P = parity (only for the parity flag)
• V = overflow (only for the parity flag)
• A = OR with the respective bit of the accumulator
• C = set if the counter (bc) is nonzero after decrementing

Miscellaneous

• () = indirection
• (()) = I/O port
• [] = operator precedence (to avoid confusion with indirection)
• E.B = the Bth bit of the value of expression E
• * = any bit value (0 or 1)
• wz = an internal 16-bit register connected to 16-bit operations
• tmp, tmp2 = temporary storage whose value is thrown away after each instruction

Letter A

Letter B

Letter C

Letter D

if hf or [a AND 0x0f > 9] then tmp -= 0x06
if cf or [a > 0x99] then tmp -= 0x60

if hf or [a AND 0x0f > 9] then tmp += 0x06
if cf or [a > 0x99] then tmp += 0x60

Letter E

Letter H

Letter I

Letter J

Letter L

Letter N

Letter O

Letter P

Letter R

Letter S

Letter X

On CPC, bus arbitration is done on every CPU bus access. On MSX, bus arbitration only applies to M1 machine cycles but access to VRAM has other limitations. On ZX Spectrum, bus arbitration is done not by using the /WAIT pin but by disabling the CPU clock when needed.

The NOPs column corresponds to CPC timings, which account for the bus arbitration managed by the Gate Array. The NOP instruction takes 4 cycles. This is the minimum amount of cycles an instruction can take.

Every M-cycle that involves a memory or I/O access will be stretched due to bus arbitration. But beware, some M-cycles are purely internal and don't involve a memory or I/O access.

Nevertheless, a few CPC timings can appear surprising at first glance:

• Instructions LD (IX+d),r and LD (IX+d),n take 5 and 6 NOPs respectively, even though they are both listed as 19 (4,4,3,5,3) cycles in the datasheet. This happens because LD (IX+d),r has one less memory access operation to do compared to LD (IX+d),n as it does not have to fetch its operand from memory.

• Instructions IN r,(C) and OUT (C),r take 4 NOPs with CPC timings, even though they are listed as 12 (4,4,4) cycles in the datasheet. This happens because I/O access is not aligned with memory access. On Zilog manual, it is precised that one wait-state TW is automatically inserted after T2 on I/O access.

The CPC timings of some instructions will be altered if an interrupt happens. The interrupt test occurs on the last T-State of the instruction, and if it's low, the Z80 will insert 2 wait states to acknowledge the interrupt.

So, instructions which end in the third or fourth T-State relative to the read alignment for the next instruction fetch will be delayed by an extra 4 T-States. The few instructions which end in the first or second T-State won't since the first instruction fetch/read in the interrupt won't be delayed an extra 4 T-States. Source

The Z80 follows a 2-3-3 opcode bit pattern.

All CB-prefixed opcodes and half of the standard opcodes (from &40 to &BF) follow a strict uniform layout. The sole exception is the HALT instruction (opcode &76), which replaces the expected LD (HL),(HL) instruction.

The rest of the opcode table is also neatly organised but in an horizontal way instead of vertical.

Any instruction in bold is undocumented by Zilog.

Standard opcodes

CB-prefixed opcodes

ED-prefixed opcodes

The opcodes that are not mentioned in the following table are EDNOP (ED-prefixed NOP instruction). Thay have no effect but take 8 cycles and increment the register R two times. EDED, EDDD, EDFD and EDCB are also EDNOP instructions.

Notes:

• The opcode ED70 reads the port indicated by the register C without keeping the result but modifies the register F
• The opcode ED71 corresponds to the instruction OUT (C),255 on a CMOS Z80

DD or FD-prefixed opcodes

If an opcode is prefixed by DD, the instruction is changed as follows:

• HL is replaced by IX
• H is replaced by IXH
• L is replaced by IXL
• (HL) is replaced by (IX+d)

Same for the FD prefix but with IY instead of IX.

There are 3 exceptions:

• In the instruction EX DE,HL, HL will not be replaced with IX or IY. The EXX instruction is not affected either.
• If (HL) and L or H are used in the same instruction, L and H are not replaced with IXL or IXH. For instance LD L,(IX+d) stores the content of (IX+d) into L, not IXL.
• If the next byte is a DD, ED or FD prefix, the current DD or FD prefix is ignored (it's equivalent to a NONI) and processing continues with the next byte. ED-prefixed opcodes cannot be altered by DD or FD prefixes.

DDCB or FDCB-prefixed opcodes

When a DD or FD prefix is followed by a CB byte, the CB acts as a second prefix. A mandatory displacement byte comes next, and then the actual opcode.

If the instruction produces output other than in the flags (i.e. all except BIT), then the result gets placed both into (IX+d) or (IY+d) and into the register one would normally expect to be altered.

DDCB and FDCB-prefixed instructions only increment the R register twice. Source

• RETI and RETN are identical instructions Source. The only reason for RETI is so that some other hardware can detect the specific case of returning from the interrupt, by detecting the RETI opcode on the data bus.
• EI has a 1-instruction delay. It is necessary for doing EI/RETI without any danger of nested interrupt routines.
• At the end of an NMI service routine, the earliest moment a maskable interrupt will be triggered is at the end of the instruction following RETN. Source
• RST instructions are just a CALL instruction to a fixed address baked in the instruction itself.
• Despite what the syntax of the instructions JP (HL/IX/IY) suggests, PC will be loaded with the contents of the register itself, not the indexed value. Those instructions should be understood as JP HL/IX/IY.
• The 16-bit commands ADD HL,ss, ADC HL,ss and SBC HL,ss exist but not the command SUB HL,ss.
• While the syntax of ADD, ADC and SBC instructions all explicitly mention the A register, the SUB instruction does not mention it. On the Zilog eZ80, the SUB instruction explicitly mention the A register.
• IN r,(C) and OUT (C),r instructions syntax is misleading as these instructions actually use the full 16-bit port address contained in BC. On the Zilog eZ80, these instructions are correctly named IN, r,(BC) and OUT (BC),r.
• The Amstrad engineers chose to use the high byte of the address (register B) for chip selection instead of the low byte (register C) in I/O operations. As a result, OTIR / OTDR / INIR / INDR instructions cannot be used on Amstrad CPC for transferring or reading a sequence of values on a port as they use B as a counter.
• INI/IND/INIR/INDR decrease B after storing the byte from the hardware port into memory. And OUTI/OUTD/OTIR/OTDR decrease B before sending the memory byte to the hardware port. Source
• All PUSH and POP instructions utilize a 16-bit operand and the high-order byte is always pushed first and popped last. PUSH HL is PUSH H then L. POP HL is POP L then H.
• When an LDxR / CPxR / INxR / OTxR instruction is interrupted, the interrupt handler sees some flags in a different state. Source
• LD A,I and LD A,R normally copy the state of IFF2 to the Parity flag. NMOS Z80 suffers a problem whereby LD A,I and LD A,R record the state of IFF2 after it has been reset if an interrupt is delivered during that instruction. Source

Note: A reset disables the maskable interrupt, selects interrupt mode 0, zeroes registers I & R and zeroes the program counter (PC).

The GBZ80 (Sharp SM83) that powers the original Nintendo GameBoy is an in-between the Intel 8080 and Z80. Source

The ASCII R800 that powers the MSX TurboR is a seriously beefed up version of the Z80:

• The ALU of the R800 is 16-bit instead of 4-bit for the Z80. This change allows instructions that were being executed in 4 clocks to be done in 1 clock.

• The instruction set of the R800 is almost identical to the Z80. Only 2 instructions have been added: MULUB and MULUW. And many of the undocumented instructions of the Z80 were made official.

Zilog itself offers the eZ80 processor, a binary-compatible upgrade of the Z80, which runs at up to 50MHz but performs like a 150MHz Z80 due to being 3 times faster at the same clock speed.

• Official Zilog Z80 CPU user manual (2016)
• Media:Z80 CPU Technical Manual 1977.pdf
• Media:Mostek Z80 Programming Manual.pdf
• Media:Z80-Mostek-Technical-Manual.pdf Text version - provides a detailed breakdown of the machine cycles
• Media:Mostek Z80 Micro-Reference Manual Feb78.pdf
• Media:Z80 CPU Instant Reference Card (Color).pdf
• Media:Z80 CPC Timings cheat sheet.20230709.pdf
• MEMPTR, esoteric register of the Z80 CPU
• The Undocumented Z80 Documented
• Z80 - undocumented opcodes

• Zilog [1]
• Computer Systems based on Z80 Family
• The Z80 processor on Wikipedia
• Z80 article on Sinclair Wiki
• Z80 documentation from Grimware
• Decoding Z80 opcodes
• Interrupt behaviour of the Z80 CPU
• Behaviour of the undocumented flags
• Complete list of Z80 instructions and their bus responses and cycles dumped from real hardware
• Detailed look at Z80 instruction timings with the help of a Z80 netlist simulation
• Cycle-stepped Z80 emulation how-to
• Tom Harte's SingleStepTests