Inside the 6502: How 3,510 Transistors Became a Computer

0:12This Apple II’s processor contains about three thousand five hundred switches. None of those switches knows what a number or an instruction is. How does that run a program? The chip is a MOS 6502. We’ll see why its relative, the Commodore 64’s 6510, can leave BASIC unable to recognise PRINT, and what five altered switches change in Nintendo’s Ricoh 2A03. Inside the 6502, watch LDA load forty-two hex into A, its accumulator.

0:56We’ll see why some instructions read the wrong address before the right one, down in the original NMOS circuit. By the end, you’ll understand that load instruction, from code in memory to individual transistors, and how so little silicon runs a program.

1:20From the outside, the 6502 is a black or ceramic package with forty pins. Sixteen carry an address and eight carry data. Thirteen more provide power, clocks and control signals, while three connect to nothing. The sixteen address wires and eight data wires each carry one bit, a one or a zero. Eight bits make a byte. Each hexadecimal digit is shorthand for four bits. Its digits run from zero to nine, then A to F. Two hex digits name one byte, and four name a full address. MOS Technology, the company that made the chip, stated the important rule in its 1976 programming manual: every clock cycle is a memory cycle. Each cycle has two halves, called phi one and phi two. In phi two the internal buses are refilled with ones, wherever nothing else is driving them. During phi one the refill stops, and circuits pull selected wires low to move most values. Meanwhile the pins perform one read or one write, so they never get a cycle off.

2:39Inside the package, a few small stores hold the programmer’s working state. A is the accumulator, the main place for a value being worked on. X and Y are index registers, often used as offsets into tables. The program counter holds the address of the next instruction. The stack pointer marks the top of a last-in, first-out working pile. A status byte keeps one-bit notes, called flags, about results and operating modes.

3:14SYNC is the useful marker. It goes high when the byte being read is an opcode, the start of an instruction. The other reads can be operands, addresses, useful data, or nothing the processor wants at all.

3:32A one-byte instruction still takes at least two cycles. In the second, the 6502 reads the next address even though the opcode has already told it everything it needs. MOS’s manual called that second fetch “worthless”. Then the same address is read again, this time as the next opcode.

3:58This apparent waste follows from the fixed rhythm. Every clock must be a read or a write. Many spare cycles become reads, although a read-modify-write instruction can use one by writing the old value back instead. We’ll keep finding both habits in stranger places. While the Apple II waits for a key, its processor keeps running. The Apple II spends those cycles running a small loop, and turns the waiting itself into a changing number.

4:35The loop increments the low byte of a two-byte number. If that hasn’t wrapped to zero, it skips the high byte. Then it tests the keyboard and branches back if no key is down. A normal pass takes fifteen clock cycles. Once every two hundred and fifty-six passes, the low byte wraps, the high byte is incremented too, and that pass takes nineteen.

5:05At just over a million cycles a second, the loop runs about sixty-eight thousand times a second. Its two-byte count goes all the way round about once a second. Apple’s manual says the loop randomises the seed, so the key press catches whichever value happens to be there. Apple’s 1978 manual even printed Dragon Maze, a program that asks you to type GO and then uses that count to choose every wall it draws.

5:50The loop also gives us a first answer to why instructions take different times. Because every cycle is a memory cycle, an instruction takes exactly as many cycles as times it touches memory, including repeated visits to the same place. A taken branch costs another cycle, and another if its destination crosses a page boundary, from one block of two hundred and fifty-six addresses into the next. We’ll see why when the processor gets an address wrong.

6:36Before any program can run, the processor itself has to start. Once its start sequence begins, it lasts seven cycles, and the first opcode follows. The first two cycles make reads whose values are discarded. Then it reads three addresses in page one, where the stack lives, each one below the last, wherever the stack pointer happened to be. It writes nothing there and uses none of the values. The final two cycles read the low and high bytes of the starting address from F F F C and F F F D hex.

7:20Those three stack reads are not arbitrary. For now, keep the shape of it in mind: seven cycles, the stack pointer moved down three places, and nothing placed on the stack. We’ll come back when the disguise makes sense.

7:39The silicon we’ll follow is a revision D NMOS 6502 from the early 1980s, not a 1975 die and not a later CMOS redesign. Think of a switching transistor as a door controlled by another wire, its gate. A high wire represents one and a wire connected to ground represents zero. The switch itself understands none of those meanings.

8:13A programmer writes this instruction as LDA, load the accumulator, followed by the value forty-two hex. Assembly turns that line into two bytes in memory: A nine, the opcode, and forty-two, its operand. On the first cycle the processor places zero two hundred hex on the address pins. Memory returns A nine, and SYNC marks it as the start of an instruction. A nine enters the instruction register, a latch that holds the opcode steady while the instruction runs. The decoder also receives signals from a timing circuit that marks the processor’s current step. Its step markers move on as the clock advances. In the next cycle, the instruction register still holds A nine. Two timing signals are active together. T two says this is the instruction’s second cycle. T zero says it is also the final step, the cycle in which this LDA receives its value. At the same time, forty-two hex enters the data latch.

9:28Between the instruction register and the rest of the processor is the decoder. It doesn’t contain a little list saying A nine means load A. It contains about one hundred and thirty long wires crossed by bit and timing lines. Those crossing lines reach transistor gates. At each checked bit, the wiring chooses the line that will turn on a pull-down switch when the value is wrong. A decoder wire stays high only when every checked bit and the timing step fit its pattern. The wire for loading A is almost absurdly economical. One load transistor, a pull-up, keeps trying to hold it high, which represents a match. Five switching transistors can connect it straight to ground. Ground is low, or zero, and that direct pull-down beats the pull-up’s high. A veto switch that is off leaves the wire alone. One that is on connects it to ground. Any one switch turned on is enough to veto the match.

10:40The timing switch vetoes every step except T zero, the instruction’s final step. For this two-cycle LDA, that is its second cycle, when the operand arrives. The other four switches each inspect one opcode bit, which we’ll read from left to right. Bit seven must be one. Bit six must be zero. Bit five must be one. Bit zero must be one. If any condition fails, its switch grounds the decoder wire. A nine in binary is one zero one zero one zero zero one, read from bit seven on the left to bit zero on the right. It passes. None of the five veto switches turns on, so the pull-up keeps the wire high. That high wire is the decoder saying, in the only language it has, load A now.

11:41The striking part is what the row does not inspect. There is no transistor here for bits one, two, three or four. Change any of them and this same row still lights.

12:00That broad pattern covers all eight documented LDA opcodes, the same load instruction with different ways of finding its byte. It also covers eight bit patterns MOS did not document. The decoder’s indifference to four bits will matter later, when one pattern activates two instructions at once.

12:27By the wiring, seven hundred and twenty-four switching transistors can pull the decoder’s wires to ground. Recognition alone consumes about a fifth of the chip’s switches.

12:43On the die the decoder wires run vertically, so the five load-A switches appear as one narrow column. At the end of the dive, watch for those five sites.

13:09This decoder was central to the design. MOS described the control structure as a ROM. Here, ROM means the fixed pattern of transistor crossings we’ve just built. In the 1975 team photograph, a thousand-times enlargement hung behind the designers. Chuck Peddle, who led the processor’s architecture, claimed the ROM was one reason the chip could be made so small. Small meant affordable. The computer magazine BYTE reported the 6502 at twenty-five dollars in 1975, and the area of each die strongly affected what it cost to make. Looking back, Peddle put the starting constraint this way: “And the chip has to fit in this area. Period, end of discussion.” When Bill Mensch put the logic into the decoder ROM, it came out about five mils too wide, as Peddle later remembered it. That’s five thousandths of an inch. He said he and logic designer Wil Mathys resolved not to give up any instructions. Instead they adjusted addressing modes, timing and positions in the opcode map, the chart assigning byte patterns to operations, until it fitted.

14:27Programmers did meet an instruction set whose ways of finding data weren’t perfectly consistent from one instruction to another. A contemporary BYTE reviewer called that inconsistency the design’s greatest failing. Some of it may reflect the fitting Peddle described, but the opcode map also carries other design decisions.

14:55The team had come from Motorola’s 6800 project, but reduced that larger architecture in specific ways. The 6502 kept one accumulator, used two eight-bit index registers rather than one sixteen-bit register, and fixed its eight-bit stack pointer into one page of memory. Mathys recalled that an eight-bit incrementer was significantly smaller than a sixteen-bit one. We’ll see the index calculation expose a half-finished address, and the shortened stack pointer confine every stack access to page one. Bill Mensch later told Jason Sachs that Peddle checked the first silicon one opcode at a time, calling out results such as “Load A works”. The five-switch row before us belongs to the later revision D circuit. On this chip, a working load A means all five veto switches stay off during T zero.

15:57Recognition alone changes nothing. The load-A row now has to reach across the chip and open the physical doors into the accumulator.

16:10The chip moves values on four internal buses: the special bus, the internal data bus, and the low and high address buses. Each is a group of eight wires, one per bit. Registers and circuits connect to them through transistor doors.

16:33One of those is the special bus. Its lowest bit alone has thirteen switching transistors attached. Twelve are doors, each opened by a named control signal. The thirteenth is a switching transistor turned on by the clock during phi two, refilling the wire with a one.

16:57During phi two, every bus wire is connected to the supply: unless something else is driving it, it fills with a one, so an undriven eight-bit bus reads F F hex. During phi one, the chosen circuit writes a value by pulling its zero bits down. Precharging pays because discharging selected wires is faster than charging selected ones. Watch forty-two hex: only bits one and six remain high; the other six are pulled low. The data latch does that pulling on the internal data bus, and a row of pass transistors, switched on by a signal called S B D B, joins it to the special bus.

17:46This was not an invention unique to the 6502. The team had used precharged buses on Motorola’s 6800. Tom Bennett, from the Motorola 6800 team, recalled that every bus line was first charged to five volts and then, in the active phase, the circuit would “just yank them to ground”. The load-A decoder wire doesn’t operate the accumulator doors directly. First it joins six other decoder wires on one shared line, because loads, transfers, pulls, shifts and arithmetic can all give A a new value. The selected signal then crosses a transistor opened by the clock, passes through one more combining circuit, and reaches a driver. That driver either raises S B A C, short for special bus to accumulator, or leaves it pulled low. A separate clock-controlled switch holds S B A C low during phi two. S B A C can open the accumulator doors only during phi one, after the buses have been refilled and the selected value is ready.

19:01S B A C controls eight doors, one per accumulator bit. Two, for bits zero and four, open directly onto the special bus. The other six open onto its decimal-adjusted copy. During an ordinary binary load that copy carries the same value, so all eight bits of forty-two hex enter A together.

19:29This happens during the fetch of the next opcode. The bus pins are already reading the next instruction while the previous one’s forty-two is settling into A. The 6502 is always one step ahead. MOS called this overlap pipelining. It did not mean a modern multi-stage pipeline. It meant the chip could interpret one byte or complete an operation while it fetched another.

20:01Each bit of X and Y has a door from the special bus and a clocked feedback transistor. A is similar, except that six of its doors receive the decimal-adjusted copy we’ve just seen. During phi two, feedback refreshes A, X and Y. During phi one, unless a new value is being loaded, each bit of A, X and Y survives only as electric charge on a transistor’s gate. The stack pointer and program counter are built in two stages, and in either phase one of those stages holds its bits only as charge. The engineering magazine EDN described this charge-dependent two-phase design as dynamic in 1975. Whichever phase the clock stops in, some of the processor’s registers are holding their bits only as charge. There is no safe phase in which to stop the original NMOS 6502 indefinitely.

21:08That is why makers had to state a slowest permitted clock. MOS’s own early sheets printed no maximum cycle time. Synertek’s limit works out to twenty-five kilohertz, Commodore Semiconductor Group gave fifty kilohertz, and Rockwell’s limit was one hundred kilohertz. They disagreed on the number, but none allowed the clock simply to stop.

21:36An interrupt is an event that makes the processor pause ordinary code and run a special routine. MOS’s KIM-1 offered single-step operation by using its non-maskable interrupt, one software couldn’t turn off. It stopped at the first byte of each successive instruction without ever freezing the clock.

22:14The economy is already visible. The decoder uses a line that stays high unless vetoed. The bus begins as all ones unless pulled down. A register keeps a bit with a door and a timed refresh. The design repeatedly gets a useful default for almost nothing, then spends transistors only on the exceptions.

22:43Now the opening’s load is readable. But loading is the easy case. The same doors and buses also have to add, compare, shift and correct arithmetic without enough room for a separate circuit for each job.

23:01Put forty-two hex in A and add three F hex. The adder produces eighty-one hex. A flag is a one-bit note about a result or an operating setting, and the chip keeps its flags together in the status byte. The negative flag follows the result’s top bit, which is one here. Read as signed eight-bit numbers, forty-two and three F are positive but eighty-one is negative. The overflow flag records that the signed answer has crossed beyond the positive range the byte can hold. The sum is formed while the following opcode is fetched. A still holds forty-two throughout that fetch. In the half-cycle just after it, S B A C opens and A takes eighty-one, with the negative and overflow flags.

24:00For every bit, the arithmetic and logic unit forms four possible answers at once. OR makes a one when either input is one. AND makes a one only when both are one. Exclusive OR makes a one when the inputs differ. The fourth answer is their sum. Five output-selection lines then decide what reaches the output, including a fifth path that shifts each bit right from its neighbour.

24:34Each output-selection line controls eight transistors, one for every bit. The decoder and control logic do not tell the ALU how to calculate a sum from scratch. The sum is already there. They open the doors for the answer the instruction wants.

24:57The process offered only one metal layer, Peddle remembered, so every long signal route was precious. At circuit designer Rod Orgill’s party one night, Peddle said, the team decided to split a data-bus line in half. Breaking the route at one point allowed more lines to reach the adder. Shift left reuses the adder too. There is no separate left-shift result line. For ASL A, the processor places A on both adder inputs and adds the value to itself. Adding any binary value to itself doubles it, which moves every bit one place left. So forty-one hex, zero one zero zero zero zero zero one in binary, becomes eighty-two hex, one zero zero zero zero zero one zero.

25:58Rotate right moves every bit one place to the right. The carry flag records a bit that falls beyond the top of a byte. The old bottom bit falls into the carry flag, and the old carry must become the new bit seven at the top. The adder’s shift path supplies bits zero to six from their neighbours. With carry clear, it also drives bit seven low. With carry set, it leaves bit seven untouched, so the one already placed there by precharge remains. There is no dedicated wire carrying the carry flag into bit seven. Sometimes the cheapest way to write a one is not to write anything.

26:47The first 6502s could not rotate right. MOS’s January 1976 manual listed ROR as “Available on Microprocessors after June, 1976”. Microsoft’s 6502 BASIC could be built for either kind and printed “NO ROR” or “ROR ASSUMED” during assembly. The surviving evidence has produced an argument over whether this was a broken instruction or a missing one. A comparison of revision A and revision D silicon by Eric Schlaepfer found that the early die lacked the necessary circuitry. His conclusion was: “It’s not a bug, it’s a missing feature.”

27:43The more remarkable addition was decimal arithmetic. In binary-coded decimal, each group of four bits represents one decimal digit. That four-bit group is called a nibble. The byte nineteen hex therefore means the decimal digits one and nine, not the binary value twenty-five. Set decimal mode and add twenty-eight hex to nineteen hex. The binary adder still begins by producing forty-one hex. In the low four bits, nine plus eight makes seventeen, too large for one nibble, so the adder leaves one and carries into the high digit. Watch the low decimal digit on its way to A: the correction path will turn that one into seven, giving the decimal answer forty-seven.

28:39When a four-bit decimal sum passes nine or produces a carry, the correction adds six. That maps the binary nibble back onto a valid decimal digit.

28:53Earlier designs used the binary adder for a second cycle to make this correction. Here it happens while the sum travels to A, which MOS’s patent calls “on-the-fly”. For subtraction, taking six away in four-bit arithmetic is the same as adding ten. Neither six nor ten changes a digit’s lowest bit. Bits zero and four are the lowest bits of the byte’s two decimal digits, so they come directly from the special bus while the other six receive its corrected copy.

29:31Fifty-six of the chip’s roughly three thousand five hundred switches change state only during decimal arithmetic. They are spread through the ALU, the adjustment circuitry beside A and the control logic.

29:50It earned its space. Commodore’s Omega Race and Wizard of Wor add to their scores in decimal mode. Wizard of Wor can then draw each score digit directly from a four-bit nibble instead of dividing a binary number by ten.

30:18Nintendo’s Ricoh 2A03 contains a 6502 core beside its sound and input circuitry, but the core doesn’t perform decimal correction. Quietust’s die investigation found five decimal-adjust transistors altered with what Quietust called “surgical precision”. Those five switches were pull-downs whose gates stay high except while the decimal-add or decimal-subtract signal is active. In the 6502, each one is on while correction is idle, holding its wire at zero, and turns off when decimal arithmetic needs it. In the Ricoh 2A03, the five transistors were cut out of the decimal circuit, each left as a fixed conducting connection. Their wires therefore stay at zero even when the decimal-add signal arrives. No switch is left to answer it, so decimal correction never acts. The decoder and decimal flag don’t need to change. The flag still sets, but it no longer changes the answer.

31:28For nineteen plus twenty-eight, the NMOS 6502 produces forty-seven while the Ricoh 2A03 leaves the binary forty-one. At the decimal limit the difference is sharper. Ninety-nine plus one gives zero with carry on the 6502, but nine A with no carry on the 2A03. Five altered switches are enough to make those processors disagree.

32:07The adder now explains far more than addition. It can hold an address byte while the other byte is fetched. It adjusts the stack pointer, doubles a value for shift left, and adds a branch offset to the program counter’s low byte. The program counter itself has a separate sixteen-bit incrementer.

32:36A full address has two bytes. The high byte chooses one page, a block of two hundred and fifty-six locations. The low byte chooses a location within that page. The address is sixteen bits wide, but the main adder handles only eight at a time. For zero-page instructions, the processor does not fetch a high address byte. It assumes the high byte is zero. A zero-page instruction can therefore use two bytes and three cycles where the corresponding absolute instruction needs three bytes and four cycles. MOS’s manual adds that an absolute ADC really takes six cycles, although the programmer counts only four, because the last two overlap the next instruction. This made the first two hundred and fifty-six bytes of memory feel rather like extra registers.

33:35Indexed addressing lets a program start from one address and use X or Y as an offset, useful for stepping through a table. Suppose a load starts at zero two F zero hex and X contains twenty hex. The intended address is zero three one zero. The eight-bit adder can add only the low byte first. While the high byte zero two is being fetched, the adder works on F zero plus X. Watch the low byte wrap to one zero and produce a carry while the old high byte is already moving towards the pins. The bus is about to show two addresses. The first combines the new low byte with the old high byte. One cycle later, the carry repairs the high byte.

34:30So the load reads zero two one zero and throws that value away, then reads zero three one zero and uses it. The processor isn’t confused. It is exposing its intermediate result because every cycle is a memory cycle and the high byte has not caught up yet. A load can afford to speculate. If the page does not change, the first read is correct and no extra cycle is needed. A store cannot do that because a write to the wrong address cannot be taken back. Indexed stores always spend a cycle completing the address before they write, even when no page boundary is crossed.

35:32Single-stepping an early sample, EDN met behaviour the data sheets already described as normal. The processor wouldn’t stop on a write cycle. It ran through the write and stopped on the next read. The ready input, a pin asking the processor to pause, is ignored during writes until a read cycle returns. Read-modify-write instructions go further. Increment a memory location containing seven F hex and the processor reads seven F, writes seven F back unchanged, then writes eighty. The INC at the start of the Apple II keyboard loop uses this same read, old write, new write sequence. That is why its single increment occupies five cycles. A 1976 cycle table gives four labels for a different example, an indexed rotate instruction: “False Read”, “Fetch Value”, “Destroy Memory” and “Store Results”. Its final two labels describe the same double write we’ve just watched. MOS’s phrase “Destroy Memory” is dramatic, but exact: the old value is written before the new one.

37:00A write can reach a hardware register as easily as ordinary memory. In the Commodore 64, the VIC-II video chip has an interrupt register at address D zero one nine. An interrupt is its request for the processor’s attention, and writing a one back to the set bit acknowledges it. Some software uses DEC, decrement, which subtracts one through the same read, old write and new write sequence as INC. DEC’s old-value write still carries the one, so that first write clears the interrupt. The final decremented value may clear nothing at all.

37:54A branch stores a signed one-byte offset rather than a complete destination. The adder adds that offset to the program counter’s low byte, and the sum is used only if the condition is true. A branch not taken costs two cycles. One taken within the same page costs three. If the low-byte sum crosses a page, a fourth cycle repairs the high byte, after the bus has already read the old page with the new low byte.

38:27A branch at zero two F two hex, taken to zero three one zero, reads zero two one zero on the way. That value is ignored. This is also why both branches in the Apple II keyboard loop take three cycles: they are taken, but their destinations remain on the same page.

39:12An indirect jump reads its destination from a pointer, which is another address stored in memory, low byte first. In this example the JMP instruction itself begins at zero two hundred, and its pointer is stored at zero two F F. Watch what happens when the processor fetches the pointer’s two bytes.

39:43Half the address has come from the instruction itself.

39:53MOS’s 1976 table already shows the mechanism: add one to the indirect address’s low byte, then fetch the high byte using the same high part. It did not single out what happens at F F. Programmers found out. fig-FORTH was a compact programming system whose inner loop jumped through an address stored with each command. That made this indirect jump central to almost everything it ran. Forth calls that collection of stored commands its dictionary. Its source offsets the dictionary so those stored pointers avoid F F endings. In CREATE, a comment runs across two lines: “6502 only. The code field musn’ straddle page boundaries.” Another says the offset “must be checked and altered on any alteration”, and ends with three exclamation marks. A modern ca65 assembler still refuses an indirect jump across that boundary on these processors.

41:00In indexing, branches and the indirect jump, an eight-bit adder exposes a half-finished sixteen-bit address on the memory bus. The next address problem does something different. It hides one byte inside a register that was meant for the stack.

41:24The stack is a last-in, first-out pile used for return addresses and temporary values. On this chip it always occupies page one, from zero one hundred to zero one F F hex. The stack pointer marks the next empty slot, and because it is only eight bits wide the high address byte is manufactured as zero one from the precharged bus.

41:53To move the stack pointer down, the adder adds F F hex. In eight-bit arithmetic that is minus one: adding F F fills the byte with one less than the starting value while the carry beyond bit seven is discarded. The F F costs no register or constant generator. It is the undriven special bus.

42:20Pushing A takes three cycles: fetch the opcode, perform a read the instruction does not need, then write A to the stack. Pulling A takes four. The stack pointer is left at the next empty slot, so a pull must first read the slot it still points to, add one, and then read the value above it.

42:45MOS said the extra pull cycle shortened the interrupt sequence, the urgent detour that will use three fast pushes in the next chapter. A choice that makes pushes quicker leaves a visible extra cycle when data is pulled back. A subroutine is a temporary detour into a reusable piece of code.

43:11JSR needs to leave a return address on the stack like a bookmark, then load the subroutine’s address. RTS later takes that bookmark back and continues just after the call. JSR has only six cycles to fetch its three bytes, push two return bytes and assemble the new program counter. The stack pointer is built as two latches in series, one taking a new value from the special bus while the other can put the old value onto the low-address bus. That two-sided construction lets JSR borrow the register without immediately losing the real stack position. There isn’t enough separate temporary storage for every value involved. Take a JSR beginning at zero two zero three hex and calling zero three zero zero. After the low target byte, zero zero, is fetched, the input side of the stack-pointer register holds it. The register’s previous value, F F, remains available at the adder input through the other latch.

44:22Now watch those two values separate. The adder will count the real stack position down while the processor pushes the return address. The parked low target byte stays in S until the target’s high byte arrives last.

44:48At the end, the real stack pointer returns to its register two places lower, at F D. The target zero three zero zero enters the program counter.

45:04The return address pushed was zero two zero five, the address of JSR’s own last byte. It was not zero two zero six, the next instruction. MOS’s manual called this “this apparent anomaly in the machine”. The reason was internal storage. By fetching the target’s high byte only after the pushes, the processor needed to keep just the low byte temporarily. That saved one byte of temporary storage inside the processor. JSR itself still occupies three program bytes.

45:43RTS corrects the apparent anomaly. It pulls the two saved bytes and rebuilds zero two zero five. It reads that address and discards the byte while the program counter’s own incrementer advances to zero two zero six. The next opcode is fetched there.

46:08Of that final increment, the manual says: “That is the only purpose of the sixth cycle.” Programmers could exploit this correction. Microsoft’s 6502 BASIC dispatches statements by taking an address from a table, pushing it onto the stack, and jumping into a routine whose RTS transfers control to that address. The table stores every destination minus one: END minus one, FOR minus one, NEXT minus one, DATA minus one. RTS supplies the missing one automatically. A return instruction has become an indirect jump because the software understands the circuit’s compromise exactly.

47:09Four events can divert the processor from ordinary code. An interrupt request, or IRQ, is a hardware request that software can temporarily mask, meaning ignore.

47:27A non-maskable interrupt, or NMI, cannot be switched off that way. Reset starts the processor, and BRK is a software instruction asking for the same kind of detour. Inside the chip, all four use the same seven-cycle skeleton.

47:48When a hardware interrupt is accepted, the chip forces all eight bits of the instruction register to zero. Zero is the opcode for BRK.

48:02The cycle table puts it bluntly: “Force a BRK Instruction, Hold P-Counter.” MOS also noted that BRK’s all-zero opcode made it useful for patching an instruction in a fusible-link PROM, a kind of programmable read-only memory.

48:25That is the disguise. The processor does not need a separate controller for every kind of interruption. It begins the BRK sequence, then makes small changes according to the source. The first two cycles complete the handover and force BRK. The next three push the program counter’s high byte, its low byte and the status byte onto the stack. Those fast consecutive pushes are the interrupt saving that made ordinary pulls take their extra cycle. The last two cycles read a vector, a two-byte address telling the processor where its special routine begins.

49:08All three vectors begin in the final six bytes of memory. The precharged address buses supply F F for the high byte. The chip makes only the low starting byte by pulling down one or two bits: F A for NMI, F C for reset and F E for IRQ or BRK. So NMI starts at F F F A, reset at F F F C, and IRQ or BRK at F F F E. Three destinations emerge from an otherwise undriven F F F F.

49:52BRK and IRQ share a vector, so software needs to distinguish them. In the byte written to the stack, the break position is B, bit four. It is set for BRK and clear for an ordinary IRQ. Yet there is no stored break bit in the status register. It is manufactured only when the status byte is written. PLP, pull processor status, and RTI, return from interrupt, can restore the stored flags from the stack, but neither restores B because there is no B latch to receive it. The neighbouring bit five is missing too. When the status is written, nothing drives that data-bus bit, so its precharged one remains. The byte contains two positions that look like ordinary status bits but are really consequences of how the write is assembled.

51:01Every handler therefore has to fish B out of the stacked copy. MOS’s example pulls the status, restores it, isolates bit four and branches. The Commodore 64 reads the same bit directly from the stack page. Apple’s Monitor, the machine’s small control program, uses a neater trick: three left shifts move bit four into the sign position, where a branch can test it. Different recipes, all forced by a flag that exists only in memory.

51:37Now compare IRQ with reset. Watch the first two handover cycles, the three stack cycles and the two vector reads line up. In the middle, IRQ writes three bytes while reset performs three reads. The stack pointer still moves down by three, but memory is unchanged.

52:05MOS called reset “a specialized form of interrupt” with the read-write line disabled. That is the wake-up mystery solved: reset is an interrupt wearing its write line turned off.

52:22One decoder path and one stack sequence serve software breaks, two hardware interrupts and reset. MOS said sharing the BRK and IRQ vector was done “to minimize the hardware cost”. The concrete price shows in the chip’s behaviour: reset touches the stack, IRQ executes a forced BRK, and B exists only in the byte written to memory.

52:52A proposed interrupt design that also saved the accumulator was rejected. Peddle told EE Times that it would have added another ten thousandths of an inch to the chip. The die was then only about a sixth of an inch across. Instead, handlers save A themselves when they need to. Reset sets the interrupt-disable flag and loads the program counter from its vector. It does not clear decimal mode. The decimal flag remains as it was, while the manual warns that internal registers during reset might be in “any random condition”. So software had to take responsibility: leaving decimal mode set could turn an ordinary binary addition into the corrected decimal result we saw earlier. The Apple-1 Monitor begins with CLD, commented “Clear decimal arithmetic mode.” The original Apple II Monitor made four subroutine calls before clearing it. Apple’s later Autostart ROM moved CLD to the first instruction of its reset routine and commented: “DO THIS FIRST THIS TIME”.

54:05The Commodore 64 shows a sharper reason for CLD. SYS loads the 6510’s flags from a saved byte before it calls machine code, and BASIC doesn’t restore its old flags afterwards. If that saved byte leaves decimal mode set, BASIC no longer recognises PRINT. BASIC uses subtraction to match keywords, test letters and find line ends. Here, decimal correction makes the PRINT match fail, so BASIC treats the line as an assignment. Its letter test then rejects the P and reports “?SYNTAX ERROR”. The addition is never attempted. The C64 can no longer read.

54:51RUN/STOP-RESTORE doesn’t recover it.

54:57Reset does, because the KERNAL reset routine’s fourth instruction is CLD. The Commodore 64, Atari 400 and 800, and BBC Micro all clear decimal mode early in their reset paths. Super Mario Bros. does it in its second instruction, immediately after disabling interrupts.

55:23Nintendo’s Ricoh 2A03 has no working decimal correction, but its decimal flag still exists and CLD still clears it. So the game performs the orthodox 6502 ritual on a processor where the ritual cannot change arithmetic. It is harmless, and wonderfully revealing.

55:52In 1975, EDN reported that MOS had left holes in the opcode pattern for a possible future machine. Those holes weren’t blank areas in the decoder. They were byte patterns to which no official instruction had been assigned. The decoder still responds to them. Its rows recognise partial patterns, not a complete list of approved opcodes. The load-X row is built much like load A. It also has five pull-down transistors. But where load A checks bit zero, load X checks bit one. Its pattern is one zero one, then three ignored bits, then one, then an ignored bit. Opcode A F hex has both bit seven and bit five set as load A requires, and it also satisfies the load-X pattern because bits zero and one are both one. Apply it to the two decoder wires together and watch which vetoes stay off.

57:07Nothing new had to be designed. A F merely passed two existing sets of vetoes. The ignored bits in one row and the different ignored bit in another overlap in a combination MOS did not promise.

57:27SAX exposes the two buses instead. With A equal to five A hex and X equal to zero F, the instruction makes A drive the internal data bus while X drives the special bus. Pass transistors then join the buses. Watch what happens on the bits where one register offers a one and the other pulls low. Where both registers offer a one, the wire stays high. Where either register pulls the wire low, zero wins. The joined buses therefore carry A AND X. Five A AND zero F is zero A, and that is what the processor writes to memory.

58:15This is the same electrical habit we have used throughout the film. A pull-up tries to hold a decoder row high and one veto pulls it down. A bus is refilled with ones and selected circuits pull down the zeros. Put two registers on one wire and the zeros win again.

58:40Other unassigned patterns can stop the processor. The timing circuit normally passes its step marker along through an instruction and back to the start. Opcodes usually called KIL or JAM shift that marker off the end. With no active timing step, no decoder wire can begin another instruction. Only reset restores it.

59:17Some undocumented results depend on analogue contention, manufacturing variation, supply voltage or temperature. They are not predictable digital instructions. The Visual6502 team reconstructed the chip’s circuitry from die photographs. They explained that those analogue outcomes don’t reduce to reliable switch-level behaviour. The stable examples make the larger point. No transistor serves only the undocumented instructions. Every switch they use also acts for documented instructions, interrupts or reset. There is no hidden illegal-opcode unit. These are ordinary circuits fired in combinations their designers didn’t intend.

1:00:09According to groepaz’s No More Secrets, these instructions first appeared in copy-protection schemes, so keeping the knowledge secret mattered. The trick was knowing which forbidden byte to ask for.

1:00:27We can now ask where the chip’s three thousand five hundred and ten switching transistors went. That is the title’s count. Add the one thousand and eighteen pull-up load transistors and this chip contains four thousand five hundred and twenty-eight transistors in all. The decoder count is exact from its wiring. The other functional regions are approximate by a few percentage points, but the overall division is clear. Recognising instructions alone takes about a fifth of the switches: seven hundred and twenty-four. Add the control and timing circuits and about half the chip is deciding what to do and when. Recognition and choreography cost more than arithmetic.

1:01:15About a third of the switches hold and move data. The ALU and the program counter with its incrementer are the largest parts. X, Y and the stack pointer together use fewer switches than either. The programmer’s named registers are a small part of the machinery around them. The data latches, accumulator with its decimal adjuster, and address latches make up the rest of that third.

1:01:48The remaining sixth talks to the outside world: pads, pin drivers and clock buffers around the edge. The address output buffers were the most visible space saving, EDN reported. MOS removed their three-state control, the ability to disconnect the address outputs electrically, and made the buffers considerably smaller. Systems needing that flexibility had to add it outside the processor.

1:02:20Almost the whole chip gets used. Only eighteen of its three thousand five hundred and ten switches never change state. Seventeen of those eighteen have gates wired to ground, so they can never turn on. Most sit between an input pin and ground, in the usual form of input protection. The remaining switch has a gate connected to nothing.

1:02:49Even a small instruction keeps much of the chip moving. Depending on the opcode, a half-cycle changes between about five hundred and fourteen hundred switches. A typical one changes about six hundred and fifty. Much of that activity is recurring housekeeping: refilling buses and refreshing dynamic latches whether or not the instruction needs them.

1:03:17Rod Orgill told EDN that one of the processor’s worst timing cases was the program counter rolling from F F F F to zero. Every carry in the incrementer has to propagate at once. A simple boundary between two addresses becomes a stress test for hundreds of carefully placed devices.

1:03:43The layout was checked largely by hand. Harry Bawcom said the drawings were made on stable plastic at a scale where one chip would fill a room. Sydney-Anne Holt recalled the pieces being taped together on the floor so the team could crawl over them and trace every line. The drawings were later digitised into mask layers, and Mensch said he used a FORTRAN program to check the decimal correction’s combinations. During one check, Holt said, someone’s damp socks began erasing the drawing beneath his toes. It was caught early, the rework was minimal, and she remembered that the team had a good laugh over it.

1:04:28Peddle recalled the complete layout being hand-coloured to check it because there was no full-chip simulation. He also recalled that the first silicon worked. The credits resist being reduced to one inventor. Peddle led the architecture. Mathys said he turned Peddle’s architecture into the complete logic diagram. Surviving logic sheets also bear Orgill’s and Mensch’s names, and Holt remembered receiving logic drawings from Mensch and Ray Hirt. Orgill and Mensch worked on circuits. Harry Bawcom, Michael Janes and Sydney-Anne Holt made the physical layout. Process and manufacturing work turned it into affordable silicon.

1:05:18The area constraint explains the recurring character of the design. One eight-bit adder also shifts left and repairs addresses. The stack pointer also parks a subroutine byte. An empty precharged bus supplies F F, a stack page, vector addresses, a status bit and the top bit of a rotate. One decoder sequence serves every interrupt and reset.

1:05:45Now we can replay the instruction from the beginning. At zero two hundred hex, the address reaches the pins. A nine returns with SYNC high and enters the instruction register. During the next cycle, T two marks the second step while T zero marks the instruction’s final step. In the decoder, the load-A wire’s five veto switches stay off, so its pull-up keeps the wire high. The next address goes out and forty-two enters the data latch. During phi two, the buses refill with ones. During phi one, the data latch pulls the zero bits down on the internal data bus, and S B D B’s pass transistors join it to the special bus. The shared seven-row control line, clocked stage, combining circuit and driver carry the decision to S B A C. S B A C opens eight doors. Bits zero and four come from the special bus, and the other six from its decimal-adjusted copy, which carries the same byte for this binary load. Forty-two enters A’s dynamic latches. At the pins, the next opcode is being fetched. It will be latched half a cycle later.

1:07:12No transistor understood A nine or forty-two. The program ran because thousands of switches had been arranged so that time and bit patterns opened one useful route after another. The peculiar reads, wrong addresses and borrowed registers were not exceptions to that design. They were how such a small design managed to be complete. The chip used in Ben Eater’s breadboard series is Western Design Center’s W65C02S, a static CMOS redesign, not this NMOS circuit. Static here means its clock can stop in either phase, so its maximum cycle time can be infinite. It also replaces the wrong-address page-cross read with a reread of the instruction byte, uses two reads and one write for read-modify-write, fixes the indirect jump at an F F boundary, and clears decimal mode on reset. Each repair calls back to an oddity we’ve just watched, but it belongs to a different circuit. The original NMOS 6502 lives by motion: buses refilled, latches refreshed, timing passed on, one memory cycle after another. About three thousand five hundred switches became a computer because shared buses, latches and circuits are reused at precisely chosen times.

1:08:46If you’d like to go this far inside more of the machines that made computing personal, subscribe to Retro Computer TV.