6530-004 Dissected

>This page about the 6530-004 dissection is about a transistor level dissection of the 6530-004 (TIM edition), brought to you by Frank Wolf and Dieter a.k.a. ttlworks. Frank Wolf and http://retro.hansotten.nl/6502-sbc/tim-6530-004/6530-004-dissected/

post

6530-004 dissected

This page about the 6530-004 dissection is about a transistor level dissection of the 6530-004 (TIM edition), brought to you by Frank Wolf and Dieter a.k.a. ttlworks. Published, as before at the 6502.org forum, with permission by Frank Wolf and ttlworks.

Contents

EagleCAD schenatics archive download

Imported in Kicad, exported as SVG images on this page:

The 6530 was used in the KIM-1, in Commodore disk drives, and in pinball machines.

The 6530 RRIOT (RAM, ROM, IO, Timer) is a special chip in the 6502 family.

6530 contains 64 Bytes of RAM, 1kB of mask programmed ROM, two 8 Bit IO ports, and a Timer.
//Timer is an 8 Bit down counter with pre-scaler factors 1, 8, 64, 1024.
It also contains a mask programmed address decoder.

The idea at MOS Technology was, that a microcontroller could be built from just two chips: 6502 plus 6530.
And that up to seven 6530 (each chip containing a different address decoder and different ROM contents)
could be used in a 6502 system.

And that’s where trouble starts:
Because of custom address decoder and custom ROM contents, when replacing a defective 6530, you can’t just buy any 6530, plug it into the socket and hope that it works. Even replacing a 6530 with a 6530 pulled from another socket from the same PCB probably won’t work.

It has to be a 6530 which fits to a specific socket on a specific PCB, and you need to look out for obscure chip markings and part numbers.




6532 seems to be based on the 6530, it lacks the address decoder and the ROM, but it has 128 Bytes of RAM.
6532 was used in the Elektor Junior computer and in the Atari 2600.

6530 contains some circuitry you probably won’t expect to see in other 65xx peripheral chips (except for 6531 and 6532).

When I was a kid, I did two layer PCB layouts on transparent foil with tape and rub-on dry transfers,
and I think I know how the game goes when things are starting to get a bit dense and complex.

The 6530 chip layout has that “hand routing smell” all over, it’s incredibly dense/compact and complex,
and I feel a need to salute to the designers (Bill Mensch et al.): it truly is a beautiful/amazing work of art.

Again: my thanks to Frank Wolf, because not many out there could polygonize a beast of that sort.

Now for some oddities of that 6530 “Wolpertinger”:
RESET is fully asynchronous, it’s not sampled with the clock.
PHI2_in has 30pF typical input capacitance, because it directly and unbuffered feeds quite some circuitry on the chip.
Signals from PA0..7 and PB0..7 are not latched at PHI1, the CPU reads them directly.

Bus interface uses fully static latches for data writes, but read data bus uses a dynamic pre-charge mechanism.
Bus interface uses fully static latches for the address, IO logic uses fully static register Bits,
and the logic which sits in between and controls said IO logic uses dynamic latches.

//That mix of static and dynamic logic started to make me wonder,
//at which point of the 6530 design phase the specification for the 6502 bus timing had rolled out.
//It would be interesting to read a “the making of the 6530” story.

Some features:
PA0 and PB0 have push/pull outputs for driving Darlington transistors etc.
PA1..PA7 and PB1..PB7 have open_drain outputs with integrated pull-up resistors.
However, there is a mask programmed option to disable the PB5 and PB6 output drivers
and to use PB5 and PB6 as inputs for the address decoder.
PB7 is supposed to be used as a Timer underflow IRQ# output, and it lacks the pull-up resistor.

Note:
For consistence with Frank’s notation, low-active signals are named foo#, not /foo.

Orientation for all the chip pictures: A5 and R/W# pads are North.

0 cheat sheet

A very simplified schematic to give an overview about what came out during the dissection.

Note:
Latches labeled FSTL are fully static transparent latches (built around a RS flipflop).
Latches not labeled FSTL are dynamic transparent latches (just a FET switch plus some trace capacitance).

A picture of the 6530 silicon, with the interesting areas marked according to the cheat sheet.

Don’t worry because the RAM and the ROM lack any details in the cheat sheet and in this picture,
we are getting there later.

Just as a reference, another picture of the 6530 silicon without the markings.

1 Clock generation

Nothing special in there.

However, it should be noted that PHI2_in also directly and unbuffered drives quite some circuitry on the chip.

6530 PHI2_in has 30pF typ. input capacitance, for a NMOS 6522 20pF typ. would be normal.

When using multiple 6530 (or 6532) chips in a system,
it probably would be a good idea to keep an eye on the total capacitive load of the 6502 PHI2 output driver
(and on the 6502 propagation delay PHI0_in to PHI2 output, which might be different for rising and falling edge of the clock).

2 RESET

The low-active RES# signal from the pad goes through an inverter, then through a non-inverting super buffer,
and becomes the high_active RES signal (which puts the chip into a RESET).

Note, that the 6530 RESET is fully asynchronous, and not sampled with the clock.
Means, a glitch on RES# to logic low level at any time most likely will cause a RESET.

RES clears the PRA and PRB IO port data registers.
RES clears the DDRA and DDRB IO port data direction registers, configuring the PA0..7 and PB0..7 IO port pins as inputs.

But be aware: RES [b]does not[/b] affect the timer, the Timer Interrupt flag, the pre-scaler, and the pre-scaler factor.

RES makes sure that PB7 is not pulled low while RES is active.
RES also sets the latch for the PB7 interrupt generation to “disabled”.
But if there is something like an accidental Timer read during the RESET sequence of a 6502,
A3i could enable PB7 interrupt generation, and then there might be a falling edge on PB7 in the wrong moment…
For more details, please see “16) Timer control”.

3 RS0

RS0 is an address decoder input signal.

The high-active RS0 input is sampled with PHI1 into a fully static transparent latch,
which gives out the low-active RS0i# signal that goes to the address decoder PLA.

//’i’ like in ‘Input’.

4 A0

Like RS0, high-active A0 from the pad is sampled with PHI1 into a fully static transparent latch.
A special thing is, that the latch feeds push/pull output drivers which generate
the low-active A0i# and the high-active A0i.

When taking a look at the chip layout, it appears that big transistors are located between the address pads.
They somehow look like output drivers (for external signals) to be found in other chips,
but they are driving the internal address lines inside the chip instead.

I think it’s a good/clever idea to re-use an output driver structure/topology for driving internal address lines
to deal with the capacitances build up by the RAM and ROM address decoders.


5 A9

Since the A9 input buffer circuitry layout is different from A0,
I felt a need to take a closer look at it,
but from the logic design point of view the input circuitry for A0 and A9 is identical.

Layout of the A1..A5 input circuitry is identical to A0.
Layout of the A6, A7 input circuitry is identical to A0, but it’s mirrored to make better use of chip space.

Layout of the A8 input circuitry is a variation of A9.

Now for a list of signals generated by the A0..A9 output drivers:
West to East: A0i#, A0i; A1i#, A1i; A2i#, A2i; A3i#, A3i; A4#i, A4i; A5i#, A5i; A6i, A6i#; A7i, A7i#; A8i, A8i#;

North to South:
A9i,
A9i#

6 CS1 latch

The CS1 latch is a fully static transparent latch, which samples PB6 at PHI1,
and gives out the high_active CS1 signal to the address decoder PLA.

Similar to the CS1 latch,
the CS2 latch also is a fully static transparent latch, which samples PB5 at PHI1,
and gives out the high_active CS2 signal to the address decoder PLA.

Both latches are located between the RES# pad and the RAM block


7 R/W#

R/W# (high=read, low=write) is sampled with PHI1 into a fully static transparent latch,
which feeds a push/pull driver generating W/R# (high=write, low=read)

8 DB7

Overview:

DB0..7 external data bus pads (high_active).

Internal write data bus D0..7w# (low-active) when writing registers.
//Internal write data bus D0..7w (high_active) is generated by super buffers located South in the IO logic block.

Internal read data bus D7r# (low-active) when reading registers.
//The read data bus is pre-charged during PHI1 with FETs located South in the Timer block.

Layout for the DB0..6 circuitry is pretty similar to DB7, so we only take a look at DB7.
On the input side, the high_active DB7 pad is sampled with PHI2_in into a fully static transparent latch,
which feeds a push/pull driver generating the low-active D7w# signal for the write data bus.
//Note, that the PHI2_in signal controlling the DB0..7 latches comes directly and unbuffered from the PHI2_in pad.

On the output side, the low-active OE_DB# control signal enables the inverting DB7 push/pull driver
which takes the low-active D7r# signal from the read data bus and emits it in high_active form
on the external DB7 data bus pad.


9 PB7

PB7 is an open drain IO port signal, which lacks a pull-up resistor.

In addition to being an IO port signal,
it also works as a (low-active) Timer overflow interrupt output,
supposed to be tied to the IRQ# pin of a 6502.

The PB7 pull-up resistor (FET) is present in the chip layout,
but the diffusion layer between the pull-up and VCC is cut.
I think that’s because if the PB7 pads of multiple 6530 chips are tied to IRQ#,
and every 6530 would have a PB7 pull-up resistor,
the resulting impedance of all the PB7 pull-up resistors in parallel on the IRQ# line
would be too low for a 6530 PB7 output driver to pull down IRQ# to a logic low level.
Not much to say on the output side:
if PB7o# is high OR IRQ is high, the output driver pulls PB7 low.
//For logic high level, you need to add an external pull-up resistor between PB7 and VCC.

In the IO logic block, PB7o# is the output of a NOR gate fed by data bit PRB7 and data direction Bit DDRB7#.
If PRB7=0 (data Bit low) and DDRB7=1 (PB7 is output), PB7o# is high, and PB7 is pulled to GND.

The high_active IRQ signal is generated in the Timer control block.
//IRQ can be enabled/disabled with A3 during Timer reads/writes.
If it’s enabled AND if the Timer Interrupt flag is set, IRQ is high, and PB7 is pulled to GND…
…by ignoring the PRB7 and DDRB7 Bits.
On the input side, the PB7 pad signal goes through two inverters, becomes PB7i and goes to the IO port logic,
IO port logic places it in inverted form on the D7r# read data bus when reading data register PRB,
we are getting there later.

Note, that the PA0..7 and PB0..PB7 input signals are not latched at PHI1, the CPU reads them directly,
we are getting there later, too.

10 PB6

PB6 pad also feeds CS1 latch, PB6 pad also feeds CS2 latch,
CS1 and CS2 are used in the (mask programmed) address decoder PLA of the chip we had dissected,
and as a mask programmed option the metal trace between PB5,PB6 pad and PB5,PB6 driver is cut.
//You don’t want the chip to be able to remove itself from the system by disabling its own chip select.

PA1..7 and PB1..6 pad circuitry is pretty similar to PB7.
They are open drain outputs with pull-up resistor (FET).
So we just focus on PB6:
On the output side, if PB6o# is high, and if the metal trace wouldn’t be cut, the output driver would pull PB6 low.

In the IO logic block, PB6o# is the output of a NOR gate fed by data bit PRB6 and data direction Bit DDRB6#.
If PRB6=0 (data Bit low) and DDRB6=1 (PB7 is output), PB6o# is high.
On the input side, the PB6 pad signal goes through two inverters, becomes PB6i and goes to the IO port logic,
IO port logic places it in inverted form on the D6r# read data bus when reading data register PRB,
we are getting there later.

Note, that the PA0..7 and PB0..7 input signals are not latched at PHI1, the CPU reads them directly,
we are getting there later, too.

11 PB0

PA0 and PB0 have a pull-up resistor (FET),
but unlike PA1..7 and PB1..7, PA0 and PB0 have true push/pull output drivers.

PA0 and PB0 are meant to source 3mA for driving darlington transistors and such.

PA0 and PB0 circuitry layout is different to make better use of chip space,
but electrically they are identical, I checked.
So we now focus on PB0.
On the output side:

PB0 output driver is enabled by DDRB0=1 (when PB0 is configurated as an output).
PRB0# which goes into the output driver is the low-active output signal of the PRB0 data register Bit.

When DDRB0=1:
If DDRB=1 and PRB0=0 (PRB0#=1), the output driver pulls PB0 low.
If DDRB=1 and PRB0=1 (PRB0#=0), the output driver pulls PB0 high.
And that’s all there is to it.
The input side is more complicated:

There is a danger that the voltage at PB0 doesn’t reach logic high level
when the PB0 driver has to source a lot of current.

That’s why we have sort of a 2:1 multiplexer controlled by DDRB0 (data direction register Port B).
The multiplexer generates PB0i, which goes to the IO port logic,
IO port logic places it in inverted form on the D0r# read data bus when reading data register PRB,
we are getting there later.

If PB0 is configurated as an input, PB0i is generated from the PB0 pad.
If PB0 is configurated as an output, PB0i is generated from the data register Bit PRB0.
//I’m simplifying things a bit here.

Note, that the PA0..7 and PB0..7 input signals are not latched at PHI1, the CPU reads them directly,
we are getting there later, too.


12 PLA

(mask) programmed logic array (PLA), also known as “the address decoder”.
Mask programmed as in “customer specific”.

It decides, where ROM, RAM and IO (including Timer) show up in the 6502 address space.

Located high up North, between A5 pad and R/W# pad.

Basically, we have three NOR gates:
One for selecting ROM: fed by CS1, CS2, RS0i. //CS1#, CS2#, RS0i# respectively.
One for selecting RAM: fed by CS1, CS2, RS0i, A6..9i. //CS1#, CS2#, RS0i#, A6..9i# respectively.
One for selecting IO: fed by CS1, CS2, RS0i, A6..9i. //CS1#, CS2#, RS0i#, A6..9i# respectively.

Where CS2 is supposed to be A12, CS1 is supposed to be A11, and RS0 is supposed to be A10.

//The A0..9 input buffers emit A0..9i (high_active) and A0..9i# (low-active).

We have three inverters, generating CS1# from CS1, CS2# from CS2, and RS0i from RS0i#.
For those who are new to the game:

In the polygonized chip picture, red is diffusion layer, green is PolySi layer, blue is metal layer.
Where ever green crosses red, that’s the active region of a FET, and green is the Gate of that FET.

So the PLA was mask programmed by changes in the diffusion layer.


13 some logic

A tangled mass of logic gates located North East from the RAM, between RAM and ROM.

It generates ROM# (low-active) from ROM (high-active), RAM# from RAM, IO# from IO.

Also, it generates RAM_W (high_active), the RAM write enable signal,
which is 1 when PHI1=0 (what is different from “when PHI2=1”), AND when RAM is selected, AND when W/R#=1 (write).

Also, it generates OE_DB_R (high-active), which is 1 when ROM OR RAM OR IO is selected, AND when RES is inactive, AND when W/R=0 (read).

In 14 IO control, there is a NAND gate fed by OE_DB_R and PHI2_in which generates the low-active OE_DB# signal.
OE_DB# enables the DB0..7 output drivers.


14 IO control

The IO control block is located below the South East corner of the RAM, East of the IO logic block.
It generates the read/write control signals for the IO logic.

First, we have a PLA like structure (containing 8 NOR gates), which is enabled when IO#=0 and A2i#=1.
According to A0i, A1i and W/R#, it generates 4 read signals and 4 write signals.
The 4 read signals from the “IO control PLA” are sampled with PHI1 by dynamic transparent latches.
The latch outputs then control FET switches, a closed switch puts PHI2 on the read control lines for the IO logic.
IO read control signals are all high_active: R_PRA, R_DDRA, R_PRB, R_DDRB.

Note, that there are 4 switches West of of the IO logic, wich tie these 4 IO read control signals to GND during PHI1.
The 4 write signals from the “IO control PLA” are sampled with PHI2 by dynamic transparent latches.
A latch output goes through an inverter, then together with PHI2_in into an “open collector” NOR gate.

Means if a write signal from the “IO control PLA” latched at PHI2 is high, AND PHI2_in is low,
the NOR gate stops pulling the IO write control signal to GND, which then is pulled to high by a pull-up resistor (FET).
IO write control signals are all high_active: W_PRA, W_DDRA, W_PRB, W_DDRB.

Note, that there are 4 switches West of the IO logic, which tie these 4 write control signals to GND during PHI2_in.

The trick is, that the data from DB0..DB7 is sampled into static transparent latches during PHI2_in = HIGH.
The latches place D0..7w# on the write data bus.
The IO registers are written with this data [b]during PHI2_in = LOW.[/b]

//This is something you probably won’t expect to see in a 65xx peripheral chip…
Decoding:
IO has to be selected, A2i has to be 0.

According to A0i, A1i and W/R#, we have:

00 read: during PHI2=high: R_PRA
01 read: during PHI2=high: R_DDRA
10 read: during PHI2=high: R_PRB
11 read: during PHI2=high: R_DDRB

00 write: during PHI2_in=low: W_PRA
01 write: during PHI2_in=low: W_DDRA
10 write: during PHI2_in=low: W_PRB
11 write: during PHI2_in=low: W_DDRB
Also, West in the IO control block we have a single NAND gate.
When OE_DBR (mentioned in “13) some logic”) is high AND PHI2_in is HIGH,
it sets the low-active OE_DB# signal to low.

OE_DB# enables the DB0..7 output drivers.

15 IO logic

IO logic block is located East of the PB0, PB1 buffers/drivers and West of the IO control block.

South in the IO logic block, we have eight inverting super buffers, which generate D0..7w (high_active) from D0..7w# (low-active).

Since the layout for the IO block Bits is more or less identical, we just focus on the IO logic for Bit 7.

Output side:

PRA (write) is data register for port A output (PA0..7).
DDRA (write) is data direction register for port A, if a Bit is 1 this means the according PA0..7 pin is configurated to work as an output.

The PRA, DDRA register Bits are static RS flipflops, which are cleared during RES=high.
Note, that RES (high_active) is the inverted signal from the RES# pad (low-active), not sampled by any clock, take care.

When one of the IO the write control signals W_PRA, W_DDRA, goes high, D0..7w and D0..7w# are fed to both transistors of a RS flipflop in the according register Bit by FET switches.
And yes, that’s “differential” signals and two FET switches per register Bit.

For PA1..7, we have seven NOR gates which generate PA1..7o# signals, telling the output drivers to pull PA1..7 to GND,
when a PRA register Bit is 0 and the according DDRA register Bit is 1 (when PA1..7 is configurated as an output).
//pull-up resistors (FETs) to VCC are pulling PA1..7 to high when the output drivers are not pulling PA1..7 to GND.
Since the PA0 output is a true push/pull driver, it lacks the NOR gate.
See “11) PB0”, which discusses the PA0 and PB0 driver/buffer circuitry.

For port B, the game is similar, just with PB0..7, PRB and DDRB.
But in the chip we had dissected, the PB5 and PB6 drivers were disabled because PB5 and PB6 were used as inputs for chip select signals.
Also, PB7 can be used as #IRQ output, and in this case the Timer control block overrides PRB and DDRB when generating an interrupt on PB7.
Note, that PB7 lacks the pull-up resistor (FET), means one has to add an external pull-up resistor for a logic high level on PB7.
Input side:

When reading DDRA, the DDRA register Bits are placed on the read data bus D0..7r# in inverted form by FET switches, and that’s all there is to it.

The signals from the PA1..7 pads are buffered as PA1..7i.
When reading PRA0..7, we have eight “open collector” NAND gates which pull the read data bus D0..7r# low
if the according DDRA Bit is low (PA1..7 configurated as an input, that is) and PA0..7i is high.

For PA0i it’s a bit different:
If PA0 is configurated as an input, PA0i comes from the PA0 pad.
If PA0 is configurated as an output, PA0i comes from the PRA0 register Bit.
For details, again please see “11) PB0”, which discusses the PA0 and PB0 driver/buffer circuitry.

For Port B, the game is similar.
65xx peripheral chips usually sample port input signals during PHI1, but the 6530 doesn’t.
6530 just places the signals from the IO port on the DB0..7 CPU data bus, the 6502 samples DB0..7 at the falling edge of PHI2, and that’s it.
That’s not good for signal integrity.

[i]See, many years ago I had built counters for incremental encoders at work with XC95108 CPLD chips.
Out of paranoia, I had tied three counters to one encoder, and after some hours of operation all of them counters had a different value.
For position control in machine engineering, that’s not good.

I had tried a lot of different things:
– creative placement of capacitors of different size into the power supply, active/passive termination of the clock signal,
– filtering the signal inputs with shift registers and whatnot…
What eventually had fixed the problem was running the counter with the non_inverted clock,
and putting flipflops controlled by the inverted clock into the input signals.
Sounds familiar when talking about PHI1 and PHI2… but I’m getting off topic.[/i]

Whether you want to have transparent latches sampling PA0..7 and PB0..7 during PHI1 or not
when building a TTL or FPGA implementation of the 6530, that’s your decision.


16 Timer control

The Timer control block is located North of the DB3, DB4 drivers/buffers, East from the Timer block.

Also, we have a little bit of logic for Timer Interrupt flag and PB7 IRQ generation West from the Timer block,
which technically also belongs to the Timer control block.
Address decoding:

To make things simple:
We have three NOR gates, which generate three high_active control signals when PHI1 is low
(what is different from “PHI2 is high”) AND when IO is selected AND when A2i is high.
R_TMR (read Timer) when A0i is low AND W/R# is low (read).
R_IRQ (read Timer underflow Interrupt flag) when A0i is high AND W/R# is low (read).
W_TMR (write timer) when W/R# is high (write). //Note: A0i doesn’t matter here.

R_TMR and W_TMR are switched to GND by FETs during PHI1:
For R_TMR, one FET located West from the Timer block.
For W_TMR, one FET located West from the Timer block, and another FET located in pre-scaler counter Bit 0.
Predivider control:

We have a predivider, basically a ten Bit down counter running at PHI2_in speed,
which is cleared when writing the Timer by W_TMR.
//Predivider counter Bits change with PHI2.

We have three latches for the pre-scaler factor, written with W_TMR.
Depending on A0i and A1i, only one of the latches can be set to 1, default is 0.

00: PRE1=1, PRE8=0, PRE64=0. No predivider, Timer is running at PHI2_in speed.
01: PRE1=0, PRE8=1, PRE64=0. Predivider factor 8, Timer is running at PHI2_in/8.
10: PRE1=0, PRE8=0, PRE64=1. Predivider factor 64, Timer is running at PHI2_in/64.
11: PRE1=0, PRE8=0, PRE64=0. Predivider factor 1024, Timer is running at PHI2_in/1024.

Active predivider counter Bits:
Three when PRE8=1.
Six when PRE64=1.
Else, all of the ten predivider Bits are active.

In the predivider block, we have a ten input NOR gate which generates the IS0 signal.
If IS0 is high, all of the active predivider counter Bits are zero. //I’m simplifying things a bit here.

Timer control:

We have a Timer, basically an eight Bit down counter,
read with R_TMR, written with W_TMR,
Timer Bits change with PHI2.

The low-active CEN# signal enables Timer counting.
If PRE1 is high, CEN# always is active, and the Timer is running at PHI2_in speed.
;
IS0 is sampled with a transparent latch at PHI1,
means that if IS0 was high in the previous PHI2_in cycle, CEN# is active for the current PHI2_in cycle.
;
If the Interrupt flag is set, CEN# is active: the timer is running at full speed.
;
W_TMR also puts CEN# active, and I don’t know why,
because the Timer counter circuity ignores CEN# when W_TMR is active.

The Timer uses a carry lookahead mechanism for the lower 5 Bits,
that’s why we have that Tcin5 signal, we are getting there later in “18) Timer”.
Timer underflow Interrupt flag and IRQ generation:

6530 Interrupt flag basically is a RS flipflop built from two NOR gates.

Timer Bit 7 carry output TC# (low-active, signaling Timer underflow, changes with PHI2) is sampled with a transparent latch during PHI1.
TC# is active, when the (decrementing) Timer is at $00 in the current PHI2_in cycle (and will roll over to $FF in the next time).

If TC# was active in the previous PHI2_in cycle, the latch output does set the 6530 Interrupt flag (through an inverter)
during PHI1 in the current PHI2_in cycle.

We have another transparent latch, which samples the Interrupt flag during PHI2.
If the output of that latch is active, three things will happen:
;
CEN# is active, the Timer counts a step during the current PHI2_in cycle.
;
If the PB7 IRQ output is not disabled, AND RESET is not active,
the IRQ signal goes active during PHI2 of the current PHI2_cycle and tells the PB7 driver to pull PB7 to GND.
//If PB7 is tied to the IRQ# input of the 6502, this signals a 6530 Timer underflow IRQ# to the 6502.
;
When the Interrupt flag is read by R_IRQ during PHI2, read data bus D7r# is pulled low,
means the 6502 sees DB7 ‘1’ what indicates that the 6530 Interrupt flag is set.
//read data bus D0..7r# lines which are not pulled to GND during PHI2 give us ‘0’ on DB0..7.
//That’s why DB0..6 are ‘0’ when reading the Interrupt flag.

The Interrupt flag is cleared in the current PHI2_in cycle by reading/writing the Timer (if R_TMR OR W_TMR goes high).
Now for the last part: disabling PB7 IRQ.

We have a latch which samples A3i# during Timer reads (R_TMR=high) OR Timer writes (W_TMR=high).
The output of that latch gives us the signal IRQ_DISABLE.
If IRQ_DISABLE is high, IRQ is disabled, and the Timer Interrupt flag won’t cause that PB7 is pulled low.

When reading/writing the Timer,
A3i=0 disables and A3i=1 enables PB7 IRQ generation during PHI2 in the current PHI2_in cycle.
Also, the Interrupt flag is cleared in the current PHI2_in cycle.

Note, that the PB7 IRQ generation ignores the PRB7 and DDRB7 IO register Bits.

Also note, that RESET does not affect the 6530 Interrupt flag, Timer, pre-scaler, and pre-scaler factor.

RES makes sure that PB7 is not pulled low by IRQ while RES is active.
RES also sets the latch for the PB7 interrupt generation to “disabled”.

But if there is something like an accidental Timer read during the RESET sequence of a 6502,
A3i could enable PB7 interrupt generation, and then there might be a falling edge on PB7 in the wrong moment…

If PB7 is tied to IRQ# of the 6502, there is no problem, because the 6502 does not mind an active IRQ# during its RESET sequence.

If PB7 is tied to NMI# of the 6502, there is a problem, because a falling edge on #NMI in the wrong time might disrupt the 6502 RESET sequence.
And that the RES# input of the 6530 is not synchronized with a clock actually makes things worse, because the 6502 _does_ synchronize its RES# input with a clock.

For more info, please read [url=http://archive.6502.org/datasheets/rockwell_r6530_r6532_timer_interrupt_precautions.pdf]Rockwell 6532 timer interrupt precautions[/url].

17 Predivider

The predivider is located between the ROM and the DB1, DB2 drivers/buffers,
East from the Timer control block.

Basically, it’s a 10 Bit down counter, and the carry is inverted with every Bit.
Counter Bits change with PHI2.

We have a 10 input NOR gate, it generates the IS0 signal (high_active), which indicates that the active predivider Bits are zero.
Actually, the NOR gate is just a metal trace connected to a pull-up resistor which is located in predivider Bit 0,
and there is a FET switching that metal trace to GND in every predivider counter Bit if said Bit is not zero…
…but before we are getting to the details:

The predivider breaks in three parts:
Bit 9..6 (five Bits) are controlled by PRE64 and PRE8.
Bit 5..3 (three Bits) are controlled by PRE8.
Bit 2..0 (three Bits) are free running.

If PRE64 and PRE8 are low, all of the 10 predivider counter Bits are active, what gives us a predivider factor of 1024.
If PRE64 is high, only Bit 5..0 of the predivider counter Bits are active, that’s six Bits, what gives us a predivider factor of 64.
If PRE8 is high, only Bit 2..0 of the predivider counter Bits are active, that’s three Bits, what gives us a predivider factor of 8.

However, if a predivider counter Bit is “active”, this just means that the IS0 NOR gate is sensing said counter Bit.

For even predivider counter Bits, the input of the IS0 NOR gate is just disabled, but the Bits still are able to count.
For odd predivider counter Bits, the counter Bit really is cleared.

It isn’t that bad, because when the Timer is written with W_TMR is high, all of the predivider counter Bits are cleared.
And the only way to change the pre-scaler factor (signals PRE64 and PRE8, that is) is to write the Timer.

Note: predivider counter Bit 0 contains a FET switching W_TMR to GND during PHI1, this already was mentioned in “16) Timer control”.

18 Timer

The Timer is located North of the DB7..5 drivers/buffers,
West from the Timer control block.

Basically, it’s an 8 Bit down counter, and the carry is inverted with every Bit.
Counter Bits change with PHI2.
It uses a carry lookahead mechanism for the lower 5 Bits, basically a six input NOR gate.
Note, that the NOR gate FET for every odd Bit is located in the next higher Bit.

Timer control block enables Timer Bit 0..5 counting with CEN# (low-active).

A dynamic transparent latch (located in the Timer control block) samples CEN# during PHI2.
If the output of that latch is low, AND if Timer Bits 0..4 are zero, the output of the six input NOR gate
Tcin5 (high_active Timer Bit 5 input carry) is high, what enables counting for Timer Bits 5..7.
The low-active TC# signal is the output carry of Timer Bit 7,
it tells the Timer control block about a Timer underflow.
//When the (decrementing) counter is $00, and wants to roll over to $FF in the next time.

If R_TMR is high, Timer contents are placed on the (low-active) read data bus D7..0r# by FET switches.

If W_TMR is high, Timer is written with the write data bus.
Even Bits are written with low-active data, odd Bits are written with high_active data, take care.
//The inverting super buffers for the write data bus which generate D0..7w from D0..7w# are South in the IO logic block,
//which is located North from the Timer. This already was mentioned in “15) IO logic”.

Note, that there are FETs West of the Timer block, which are switching R_TMR and W_TMR to GND during PHI1,
this already was mentioned in “16) Timer control”.
Dynamic pre-charge mechanism for read data bus:

There are eight pre-charge FETs South in the Timer block.
During PHI1, the FETs are active, acting as “pull-up resistors” for the read data bus D0..7r#.
Due to the bus capacitances, D0..7r# remain high during PHI2 (if PHI2_in doesn’t get too slow, that is).

During PHI2, the pre-charge FET switches are open,
and everything connected to the read data bus can pull the charge on the read bus lines to GND.

Short form:
The read data bus is low-active, and pre-charged to VCC during PHI1,
so if a read data bus line isn’t pulled to GND during PHI2, it keeps the charge.
And that’s why Bits on the read data bus default to ‘0’ on DB0..7 for the 6502.

19 RAM

6530 contains 64 Bytes of static RAM.

From North to South,
we have the RAM address decoder, the column select signal drivers, then the RAM cells,
then the FETs which discharge the colum select signals by switching them to GND during PHI1.

North in the RAM block, the column address decoder is fed by A0..3i (A0..3i# respectively).
It contains sixteen 4 input NOR gates.
Note, that the pull-up resistor for every NOR gate is not tied to VCC directly/permanently, but only during PHI1.
To be more precise, we have FET switches controlled by PHI1, and the impedance of a FET is working as a resistor.
//From West to East, the NOR gates check from 0000 to 1111, it’s linear.

South from the column address decoder, we have the column select signal drivers:
Sixteen transparent latches, sampling the outputs of said NOR gates during PHI2,
control sixteen FET switches, which connect one of the sixteen column select signals to PHI2.
Means, only one column select signal is active at a time.

At the Southern corner of the RAM block, we have FETs switching all of the column select lines to GND during PHI1.
RAM cells are organized in eight parts, for D0..D7,
starting with D0 South of the column select signal drivers, followed by D1, and so on.

In each of the eight D0..D7 RAM cell areas, we have RAM cells arranged in a “4 rows and 16 columns” pattern.
//That’s 64 RAM cells in total for every Bit on the data bus.

Each RAM cell contains a conventional RS flipflop (built from two FETs and two pull-up resistors (FETs)),
plus two FET switches (controlled by the column select signals) connecting the RS flipflop to the row signals
RAM_ROW and RAM_ROW# during PHI2.

At the Western corner of the RAM block, we have pre-charge FETs switching the RAM_ROW and RAM_ROW# signals
for every line of RAM cells to VCC during PHI1, switches have an impedance which makes them act like pull-up resistors.
//That’s 8*4*2 = 64 pre-charge FETs in total for 64 Bytes of RAM.

RAM cells are read/written only during PHI2.

East of the column decoder plus drivers, we have the row decoders plus drivers,
and except that they are fed with A5i and A6i (A5i# and A6i# respectively),
conceptually they are not much different from the column decoders plus drivers.

They control 4:1 multiplexers East of the RAM cells.
For every Bit on the data bus, we have two 4:1 multiplexers,
one connecting the RAM_ROW signals from four rows of RAM cells to the read/write driver/buffer of a data Bit,
the other connecting the RAM_ROW# signals from four rows of RAM cells to the read/write driver/buffer of a data Bit.

//One row has 16 RAM cells.

Note, that the multiplexers are just FET switches, and that signals can go through said switches in both directions.

To be more precise:
When reading RAM cells, signals from the RAM cells to the read buffers go through the multiplexers from West to East.
When writing RAM cells, signals from the write drivers to the RAM cells go through the multiplexers from East to West.

According to A5i and A6i, the multiplexers are selecting the rows in the pattern:
00
01
11
10
But since all of the RAM cells are identical, we can safely ignore this.

Now for the read/write drivers/buffers.

West of the multiplexers we have the RAM cells, East of the multiplexers we have the read/write drivers/buffers.
At the read/write driver/buffer side of the multiplexers, we have two FETs,
precharging RAM_ROW and RAM_ROW# of said read/write drivers/buffers to high during PHI1.

On the write side, we just have a “differential” push/pull line driver, fed by a Bit on the write data bus D0..7w (high_active).
The driver outputs are enabled when RAM_W is high, during PHI1=0 (what is different from “PHI2=1”),
setting the RAM_ROW and RAM_ROW# signals of the selected row of RAM cells through the two 4:1 multiplexers.
;
PHI1 and PHI2 are not overlapping, the line driver outputs are enabled during PHI1=0,
so that RAM_ROW and RAM_ROW# at the RAM cells are valid before the rising edge of PHI2.
//The RAM cells connect to RAM_ROW and RAM_ROW# during PHI2.

On the read side, we have a RS flipflop which is brought into a controlled state during PHI1,
and flipped (or not flipped) by the RAM_ROW# signals from the RAM cells during PHI2.
;
The side of the RS flipflop which is switched to GND during PHI1 goes through an inverter,
then into a two input NOR gate together with RAM# (low-active RAM enable signal which changes during PHI1).
The output of that NOR gate drives a FET which pulls a Bit on the read data bus to GND, and that’s all.
;
To be more precise:
The output FET can’t pull a Bit on the read data bus to GND during PHI1,
because the side of the RS flipflop that goes through an inverter into the NOR gate controlling the output FET
is switched to GND during PHI1.

20 ROM

6530 contains 1024 Bytes of mask programmed NOR ROM.


From North to South,
we have the ROM address decoder, the column select signal drivers, then the ROM cells,
then the FETs which discharge the colum select signals by switching them to GND during PHI1.

North in the ROM block, the column address decoder is fed by A0..5i (A0..5i# respectively).
It’s a PLA like structure of 64 six input NOR gates.
Note, that the pull-up resistor for every NOR gate is not tied to VCC directly, but only during PHI1.
To be more precise, we have FET switches controlled by PHI1, and the impedance of the FETs is working as a resistor.
//From West to East, the NOR gates check from 000000 to 111111, it’s linear.

South from the column address decoder, we have the column control signal drivers:
64 transparent latches, sampling the outputs of said NOR gates during PHI2,
control 64 FET switches, which connect one of the sixteen column select signals to PHI2.
Means, only one column select signal is active at a time.

At the Southern corner of the ROM block, we have FETs switching all of the column select lines to GND during PHI1.

//The game isn’t much different from what we had in the RAM block so far.
ROM cells are organized in eight parts, for D0..D7,
starting with D0 South of the column control signal drivers, followed by D1, and so on.

In each of the eight D0..D7 ROM cell areas, we have 16 mask programmed NOR gates, one gate per row,
with up to 64 inputs each (which connect to the high_active column select signals).
Mask programmed means, that an input transistor of the NOR gate connecting to one of the 64 column select signals
is present or missing.

Mask programming was done by changes in the diffusion layer, like in “12) PLA”.

If the transistor in a NOR gate connecting to a column select signal is present,
said NOR gate emits 0 when the column select signal goes active (high) during PHI2.

Transistor present: Data Bit is 1.
Transistor missing: Data Bit is 0.


Like in the column address decoder, the (up to) 64 input NOR gates don’t have a pull-up resistor
which is tied to VCC directly/permanently, but only during PHI1.
To be more precise, we have 8*16 = 64 FET switches controlled by PHI1,
the row pre-charge FETs, and the impedance of the FETs is working as a resistor.

If you take a closer look at the PLA like structure of the column address decoder,
and rotate it by 90 degrees clockwise, it looks pretty much like the ROM cells, doesn’t it ?

East of the column decoder plus drivers, we have the row decoders plus drivers,
and except that they are fed with A6..8i (A6..8i# respectively),
conceptually they are not much different from the column decoders plus drivers.

They control two 8:1 multiplexers West of the ROM NOR gates per Data Bit.
Each of the 8:1 multiplexer inputs is fed by the outputs of 8 ROM NOR gates.

The outputs of the two multiplexers go into another 2:1 multiplexer controlled by A9i (and A9i# respectively),
which then gives the signal to a read buffer for every Bit on the data bus.

Note:
The multiplexer for the second 8 rows of NOR gates has the inputs in reversed order.
From North to south, the selection of ROM NOR gates according to A6..9i actually is:
0000 up to 0111, and then 1111 down to 1000.

Now for the ROM read buffers.

The game is very similar to the read buffers in the RAM.

Outputs of the two 8:1 multiplexer and the 2:1 multiplexer are pre-charged by FET switches
(with some impedance to make them work as pull-up resistors) during PHI1.

Again, we have a RS flipflop which is brought into a controlled state during PHI1,
and flipped (or not flipped) by the output of the 2:1 multiplexer during PHI2.
;
The side of the RS flipflop which is switched to GND during PHI1 goes through an inverter,
then into a two input NOR gate together with ROM# (low-active ROM enable signal which changes during PHI1).
The output of that NOR gate drives a FET which pulls a Bit on the read data bus to GND, and that’s all.
;
To be more precise:
The output FET can’t pull a Bit on the read data bus to GND during PHI1,
because the side of the RS flipflop that goes through an inverter into the NOR gate controlling the output FET
is switched to GND during PHI1.
Just one more word about the output FETs of the RAM and the ROM, switching the read data bus to GND.

It’s an incredibly compact design, and for most of the Bits on the read data bus,
the output FETs of the RAM and the ROM are close together, forming a big NOR gate.

Letter from Bill Mensch on the creation of the 6530

Bill Mensch wrote:
I would be happy to contribute some commentary concerning the creation of the 6530 at MOS.

What are you interested in other than it was the second chip for the combination of the 6502 for use in control systems.
The KIM-1 was a reference design/use case for bothe the 6502 and the 6530, actually two of them.
One 6530 was for the “Teletype Input Monitor (TIM)” and the other one was for the “Keypad Input Monitor (KIM)”.

It was first demonstrated along with the 6501/6502 at the WESCON ’75.
The 6502 and 6530 were ment to compete with the $29 Intel 4040 two chip controller combo.

The actual design was important for the introduction of the 6502.
I and a team of three mask designers Harry Bawcom, Mike Jaynes and Sid Holdt created the 6530.
The timer design was patented and used on the 6530, 6531 and 6532 chips.

Chuck Peddle and Wil Mathys contributed the system level applications concepts and requested the features.
We were a small team. I was the semiconductor design and architect engineer.
The 6530 followed many of the design concepts of the 6820/6520/6821/6520 concepts for IO and interrupt features.

The 6522 followed the 6520/6530/6532 designs at MOS.

Ray Hirt was the project lead on the 6532.
The 6532 RIOT design was basically to remove the ROM and add another 64 bytes of RAM for a total of 128 bytes.
I was the microprocessor design manager at this time replacing Rod Orgill who had left MOS to work at NCR in Colorado Springs, CO.
Rod didn’t work on any of the IO chips, just the 6501/6502.

Ray, Rod, sometimes Wil and I shared many a pitcher of beer at many lunches after the 6502 and 6530/32 were completed before Rod left for Colorado.
These are fond memories of my time at MOS.

Let me know if you have any questions.

Best,
-Bill

6530-004 decapped

EagleCAD schenatics archive download

Imported in Kicad, exported as SVG images on this page:

Logic concept

Clock Generator

Reset
RS0

A0

A9

CS1 Latch

RW
< PB7 driver/buffer a href="http://retro.hansotten.nl/wp-content/uploads/2021/11/6530-004_dissect_9-6530-004_dissect_9.svg">


PB6 driver/buffer

PB0 driver/buffer

PLA

Some logic

I/O control

I/O logic, Bit 7

Timer control

Predivider

Timer (don countyer)

RAM row buffer/driver

ROM

post

Baseball

Another KIM-1 game by Robert Leedom.

Thanks to Nils for providing this material, and letting Robert Leedom dig up even more material!

Baseball for the KIM-1

(text by Nils)
Robert ‘Bob’ Leedom published another game called Baseball in the KIM user notes issue 16:

tten.nl/wp-content/uploads/2021/11/KIM1_BB_small.png”>

The “listing” of the game is pure HEX, no source file given in the Usernotes. But Bob has provided that now!

Some information about the game:
– It fits in an unexpanded KIM-1, and is being played with the keypad and the LEDs
– You can find the whole article here http://retro.hansotten.nl/uploads/files/6502%20user%20notes%2016.pdf
– Bob Leedom has digged up much more information than published, like source (handwritten, 16 pages), readable hex dump, photos of the hand controller described next. All part of the downloadable archive.

Downloads

The Baseball game with instruction
All media and documents and photos about Baseball

How to play

There are two game modes:

  • A one player batting pactice mode (default)
  • A two player mode where one throws the ball (with the buttons 0-5) and one player has to hit; change the game mode by setting $002C to 1

The pitcher (in one player mode the computer) decides how the ball is thrown. The baseball then flies immediately to the Batter.

The Batter has to time very carefully when to hit with the button B

Nils has played the ‘batting training’ and could not find any errors.

There is the chance to add external switch to give you a better game experience. You can set the pitch on a multi position switch and include two buttons to throw and hit.

External Controls

Bob sent pictures of his (back in ’79) self build external controls for KIM-1 Baseball

   

Now this is oldschool. Do you see the self printed circuit board? It fits directly in the KIM-1 extension port!

Special thanks to Bob Leedom, who dug in his basement in the search for all the missing documents, scanning and sending it

Pascal-M 2k1 Pascal on the KIM-1

New version of the Pascal-M system, run Pascal programs on the KIM-1.

KIM-1 Simulator

First public beta of the KIM-1 Simulator

Runs in Windows and Linux (everywhere a Lazarus IDE is available, source included).

Convert hex formats new version

Bug fix release of the PC utility to convert MOS papertape, Intel hex, Motorola S record, Apple 1 hex etc. Windows and Linux. Source included.

KIM-1 Simulator


A KIM-1 simulator with the look and feel of the KIM-1 and a debugger to look ‘inside’

Console, with choice of colors of font and background:



KIM-1 built in ROM tape load and save:




Downloads

Setup for Windows and Ubuntu and Raspberry Pi 5
Source (requires Lazarus IDE 2.x))
Bundled with Conversion 8 bit hex formats utility, to convert to/from various binary files like MOS Papertape, Intel Hex, Motorola S-record and more.

KIM-1 Simulator

Hans Otten, 2019- 2024, Version 1.4.0

Contents

Introduction

The KIM-1 simulator is written for my personal use to aid me in developing and testing software for the KIM-1. It is not meant to be a cycle exact complete KIM-1 emulation. Instead it shows as much as possible what is happening inside. So do not expect it to run the typical KIM games on the LED and Keypad.
Just for fun and a tribute, it looks and feels and functions as a real KIM-1. The debugger is what the purpose of this program is. The program is developed on Windows 10 (32 bit executable) and tested and compiled on and Ubuntu . Since the source is available, it will run anywhere Lazarus IDE is available.

What is simulated

  • 6502 or 65C02 CPU (only documented behaviour)
  • KIM- LEDs and keypad
  • TTY in and out with TTY console
  • 6530-002 and 6530-003 ROM
  • The suppress ‘echo TTYecho’ hardware
  • The TTY/LED input bit
  • KIM-1 Tape load and save ti audio

Limitations

What the KIM_1 Simulator does not do as the real KIM-1:

  • Light the LED segments from the RRIOTs outputs. Instead the SCANDS routine is intercepted and the LEDs show the hex output of location F9 FA FB.The simulation is not cycle exact enough to perform the KIM-1 way of flashing the LEDs. So some First Book of KIM type programs will not work.
  • The TTY in and out routines are intercepted and rerouted to an ACIA emulation. See the ACIA routines.
  • The upper pages are not mapped to the lower pages as in most KIM-1 configurations. The vectors at FFFA etc are pointing to the KIM-1 ROM vectors, so RESET. NMI and IRQ work.
  • Tape hardware is not emulated.
  • No hardware single-step via NMI, the debugger has much better facilities for that/
  • The CPU runs as fast the host CPU allows, and lets the host operating system do some work like key and display and other applications running and continue the emulation loop until the user stops the 6502 CPU.

    The speed is herefore dependent on the host CPU. Running the classic Clock program, showing a HHMMSS clock on the LEDs, on my Intel core I7 one minute real time has the clock show 1 hour 37 minutes.

    The CPU is halted every 1000 clock ticks to let the GUI of the program a chance to handle mouse and keyboard and screen updates like the stop key.

    This works well on the Intel PC, the Raspberry is sluggish to unusable in responding to GUI events if in keypad/LED mode. Dropped form distribution!
  • The CPU emulation may not be perfect, only valid and documented opcodes are implemented, especially ADC and SBC have many, not emulated here, undocumented issues.
  • IRQ handling is not present in this version, see planned enhancements. NMI key works, as does Reset.

Enhancements

The KIM-1 Simulator is a KIM-1 with:

  • 6502 or 65C02 CPU (make the choice in the Debugger)
  • RAM to $1400
  • RAM from $2000 to $E000
  • ACIA 6850 at $1600 (equal to Corsham’s I/O card)
  • ROM at $F000 with ACIA routines
  • Pages E and F are not mapped to page 0 and 1 as in most expanded KIM-1’s.
  • LEDs and switches to the user RRIOT Port A and B
  • Switch between TTY and LED/keypad
  • Emulation of the hardware echo of TTY console input, and echo suppression trick

To do, planned expansions after version 1.0

  • IRQ and 6530 timer support
  • Testing and bugfixing
  • Better documentation …

Installation

Windows

Run KIM1SIMsetup.exe or place the files KIM1SIM.EXE + KIM1Simulator.html file in a folder of choice.


For high DPI screens change the Properties of the KIM1SIM.EXE, Compatibility settings,

– Change high DPI settings,

– check high DPI scaling Override,

– scaling performed by “System(enhanced)”.

Ubuntu 20.04.3 LTS

Execute KIM1SIM from the Ubuntu folder. Works fine on a modern PC.

Note that the font used is Courier New. Install ttf cour.ttf on Linux in .home/.fonts to prevent substitution with artifacts

Other platforms
If Lazarus is available then install Lazarus (Version 2 or higher) and build from source.

No extra packages are required, just a standard Lazarus.

Open the project KIM1SIM.LPI and do RUN – Build to get an executable.


This may work on MacOS. It seems not easy, Lazarus is not that stable on MacOS it seems.

After installation

Start the KIM-1 Simulator and choose Settings to

– set the default working directory. Otherwise files may appear at locations you do not want!

– select the keyboard layout in the console (Geman and US International for the moment)

How to use as KIM-1

Start the emulator main program and push the ‘Run’ icon. Then press the RS key on the keyboard (or type R).
After that the LEDs awake and the keyboard is operational as a KIM-1.

  [0] to [F]  -   Sixteen keys used to define the hex code
                  of address or data

  [AD]  -   selects the address entry mode

  [DA]  -   selects the data entry mode

  [+]   -   increments the address by +1 but does
            not change the entry mode

  [PC]  -   recalls the address stored in the Program
            Counter locations (PCH, PCL) to the display

  [RS]  -   causes a total system reset and a return to
            the control of the operating program

  [GO]  -   causes program execution to begin starting
            at the address shown on the display

  [ST]  -   terminates the execution of  a program and
            causes a return to the control of the
            operating program

Besides pressing the keys on the KIM keybaord on the screen you can also use the PC keyboard:
  0-9 : key 0 - 9
  a-f : key A - F
  A-F : key A - F
  +   : +
  A   : AD 
  D   : DA
  P,p : PC
  G,g : GO
  S,s : ST
  R,r : RS
  S,s : ST

Console

Press the TTY switch and run/stop and you have a console terminal. The KIM-1 teletype commands now work and also programs line KB9 Basic can be used. See the Console chapter below.

KIM-1 Tape load and save

The KIM-1 tape load ($1873) and save ($1800) programs are emulated.

Fill in the tape ID and optionally start and end address as documented in the KIM-1 User manual.

Start the Save at $1800 and the load at $1873 with the KIM-1 monitor.

You will be prompted for file to load or save.

Default working directory and other settings

Use the menu Settings to dipslay the possible settings that survive sessions.

– Set default work folder to choose a folder for all files created or used by the emulator. The settings are saved between sessions.

– Set the preferred keyboard layout (US International German,Belgium (french), others await your input, see below)

Default settings config file : “/home/(user)/.config/KIM1SIM.cfg” or C:\users\(user)\Appdata\local\KIM1SIM.cfg”


Loaded at startup, updated via the Settings menu.

Load and Save

The menu has Load and Save functions, you can load and save to many 8 bit binary formats as MOS papertape, Intel HEX, Motorola S record, binary and simple hex.
The 16 bit versions of Intel Hex etc are not supported.


The Define Type is a text file format suitable for inclusion in assembler source.
The layout is as follows (all in hex)

; <Start address> - <end address>
        <define text> $<hex data>
     ..
where <define text> is what you fill in the Define text entry, may be empty.

Example:
; 1800-1805
        .byte $A9
        .byte $AD
        .byte $8D
        .byte $EC
        .byte $17
        .byte $A9

TTY console mode

Press the TTY console switch to let the KIM simulator use a glass teletype in a console window. The standard KIM user interface is shown, see the manual how to use.
Note: set the PC keyboard to CAPS Lock, only uppercase is used in the KIM monitor.
Note the menu options to record a session, (Load Text to Console) or play (Save text from Console, followed by Stop saving text ) a text file in the console.
This is in fact the same functionality as a teletype with high speed papertape punch or reader. You can use this to load and save Basic programs as ASCII text files. Or use the KIM-1 tape routines built in KB9 Basic!

The console

The console is an emulation video terminal (ANSI color, subset) connected to an ACIA (a Motorola 6850) in the KIM-1. The KIM Monitor is patched to send or receive via the ACIA and is transparant to the user of the KIM-1 I/O routines (even the quirlks like flags and returned register values!)

Keyboard input, when the console window has focus, is sent to the serial input of the ACIA. No local echo. The KIM-1 monitor only accepts uppercase (hint: Caps lock!), user programs are free to use upper or lowercase.

Characters sent tot to ACIA output are received by the console window and handled as a VT100 would do, a subset of the ANSI/VT100 is implemented.
All keys of the PC are usable, SHIFT works. Note the translation of codes from the PC keyboard to ASCII characters is for the keybaord choosen in Settings.
Other mappings are possible by changing the routine in console.pas: procedure TFconsole.FormKeyDown

Received characters by the console are handled as follows, a subset of the ANSI set.

Single control character

$01 : CursorHome 
$04 : CursorRight 
$05 : CursorUp 
BS  : Backspace 
TB  : Tab 
LF  : LineFeed 
FF  : ClearScreen 
CR  : CarriageReturn 
$13 : CursorLeft 
$16 : DeleteToEndofLine 
$18 : CursorDown 
DEL : Backspace  

ESC sequences

ESC[K             Clear from cursor to the end of the line
ESC[0K            Clear from cursor to the end of the line
ESC[1K            Clear from the beginning of the current line to the cursor
ESC[2K            Clear the whole line
ESC[J             Clear the screen from cursor
ESC[0J            Clear the screen from cursor
ESC[1J            Clear the screen until cursor position
ESC[2J            Clear the screen and move the cursor to 0-0, defined sprites are removed, loaded bitmaps are kept

Insert / Delete

ESC[1@            Insert a blank character position (shift line to the right)
ESC[1P            Delete a character position (shift line to the left)
ESC[1L            Insert blank line at current row (shift screen down)
ESC[1M            Delete the current line (shift screen up)

Move cursor

ESC[H             Move to 0-0
ESC[f             Move to 0-0
ESC[s             Save the cursor position 
ESC[u             Move cursor to previously saved position 
ESC[(Row);(Col)H  Move to row,column
ESC[(Row};(Col)f  Move to row,column
ESC[nA            Move the cursor up n lines
ESC[nB            Move the cursor down n lines
ESC[nC            Move the cursor forward n characters
ESC[nD            Move the cursor backward n characters

Attributes

ESC[m             Reset all attributes
ESC[0m            Reset all attributes
ESC[1m            bold
ESC[4m            underline
ESC[5m            italics
ESC[7m            Turn on reverse color
ESC[27m           Turn off reverse color

Color attributes

color     FG       BG      FG high  BG high 
--------------------------------------------
black    ESC[30m  ESC[40m  ESC[90m  ESC[100m
red      ESC[31m  ESC[41m  ESC[91m  ESC[101m
green    ESC[32m  ESC[42m  ESC[92m  ESC[102m
yellow   ESC[33m  ESC[44m  ESC[99m  ESC[103m
blue     ESC[34m  ESC[44m  ESC[94m  ESC[104m
magenta  ESC[35m  ESC[45m  ESC[95m  ESC[105m
cyan     ESC[36m  ESC[46m  ESC[96m  ESC[106m
black    ESC[37m  ESC[47m  ESC[97m  ESC[107m

FG = foreground
BG = background
High = higher intensity

Note that setting colors is implemented in a limited way.
Combining attributes and fore/background in one Escpe sequence is not supported
If you want to use for example

  ESC [1;31;104m (bold, red foreground, blue background)

you will have to use

  ESC[1m  ESC[31m ESC[104m

Printable character (>= $20): placed on screen where the cursor is, cursor moved to next position
Wrap around at end of line, screen scroll up when bottom line is reached 

Console and the keyboard

Handling different keyboard layouts and platform independent development is a nightmare! The Console in Version 1 and below is built for the US International keyboard, the only type I use.
SInce then some more keybaord layoyts are added, you can select form the Settings.

This means the key code translation is fine for a-z, A_Z, 0-9, with NumLock also for the numeric keyboard, backspace, delete and othr control characters. Fine for the KIM-1 monitor.

The key code translation is now not optimal for keyboards with other layouts, characters like []{}\|;:'”,<.>/?!@#$%~^&*()_+ are possibly mapped wrong.


This can be fixed in a newer version by letting the user select a keyboard layout. But I do not have all those keyboards and the information on the internet is confusing.
So I built a test program to let you help me: Testkeydown. Fill in the type of your keyboard, press at least the []{}\|;:'”,<.>/?!@#$%~^&*()_+ keys, et Num Lock and press the numeric keyboard.
Save to the file keydowntestfile.txt and sent it to me at h.otten (fill in here at sign) hansotten.nl so that I can add your variant to the Simulator.

The debugger

From the menu Simulator choose Debugger to show the debug window. This windows has step/single step/run buttons, shows the registers and flags, zeropage, memory and the stack. The Trace logfile facility may store a trace of what happened.The disassembler part shows a disassembly.

Several refresh buttons let you update the current state of the machine.

Single step, RUN, trace log

First set the PC to the first instruction of the program to test.

  • Step in: execute next instruction
  • Step over: execute next instruction but skip JSR subroutines
  • RUN: execute at maximum speed ( wait 0) or slow (wait x seconds between steps), use the STOP button to halt execution
  • Step n: execute n instructions full speed
  • Run to: execute instructions full instructions until the breakpoint or watchpoint location is reached or STOP pressed
  • You can set 1o code breakpoints, 10 memory watch points and wacthpoinst on registers A,X,, Y and Stackpointer, press the Breakpoints and Watches button to show the form to fill in as desired.
  • Trace log on/off: first set the Trace log file directory from the file Menu, then use any Step to have every instruction logged with status in the logfile and the tracelog.Note that this slows down execution a lot and the files can become large. So clean up regularly!
    The file name of the log is set to KIM1SIMtrace(datestamp).log.



From the Search Memory you can Search with hex 1,2 or 3 bytes in memory (leave unwanted fields blank), Fill memory and Copy/Move memory.

With a fill byte you can replace the moved bytes, leave the field empty to leave the original value.

Symbol table and the disassembler

The disassembler shows locations/labels in hex format. If the assembler symbol table is available (TASM can produce that as blank delimited list) you can load it and do some symbolic disassembly.
Load and show the symbol table from the menu “Symbol table”. Supported symbol table formats: TASM 32 bit and CA65 (part of CC65 suite).

RRIOT status display

From the menu Simulator choose RRIOT to show a windows with the current RRIOT status or you can enter new values for the various registers.
Press Refresh to update to the current state, it is not updated realtime.

The 6530-002, responsible for the KIM-1 hardware, is decoded to the relevant in/output bits.

Note that the simulator does not perform the KIM-1 LED/key functions this way. Code for output to the LED displays is currently present but commented out in the source.
Timing limiting is essential for this to work, the simulation now runs as fast as the host CPU can deliver.

The Profiler

Available from the ‘watches and breaks’ form or from the Window menu

This facility keeps track (once activated with the Profiling Check box) how much an instruction is executed,
Independent of the debugger, always available.

Use the Refresh button to see the current state, not automatically updated so it is no a high performance hit.
Any opcode, from o to 255, is counted. The display shows the maximum 65C02 instruction set.

You can save the profiler data to a CSV file, with instruction mnemonic and number of times executed per line.
Invalid instructions are marked as ‘Unknown’.

Focal V3D from the KIM-1 Software page

Focal V3D, an interpreter modeled after the DEC PDP-8 Focal interpreter runs on the KIM-1 and on the Simulator.
This program uses a trick to suppress the echoing of charaters typed on the KIM-1 TTY hardware. And another trick to get a hash/random number.
After loading both zeropage and program code, start at $2000. But first go to sSettings and choose Focal Break testing.
Only when running Focal! Set to Normal break testing for e.g. MS Basic. This setting is not saved, and resetting the emulator makes the setting to Normal.

Example programs

In the Setup archive a folder with TTY programs are collected. Note that manuals etc are on the Retro website.

kb9.bin load 2000 start $4065 Microsoft KIM-1 Basic 9 digits (upercase only, set 00F1 to 0)

kb6.bin load 2000 start $3D50 Microsoft KIM-1 Basic 6 digits (upercase only, ROR instruction patched + CLD)

kb9V2.bin load 2000 start $3F8E Microsoft KIM-1 Basic 9 digits (upercase only, ROR instruction patched + CLD)

kimGFX.BIN load 2000 start 2000 Demo for K1008 video display Dave Plummer

kimGFX1.BIN load 2000 start 2000 Demo for K1008 video display Dave Plummer

kim1sim6502test.ihex start 2000 65(C)02 opcode test (lower case y/n)

Focal folder

Set in Settings Focal3D break setting

focalzp.bin load $0000

focalm.bin load $2000 start 2000

Printing disassembler

PRDISV3.PAP start B000

Compiling and building the simulator from source

Prerequisites

  • A modern PC and operating system. Windows 10/11 is where the software has been developed, Ubuntu are tested and binaries included.
  • Development (Compile and run everywhere!) with Freepascal and Lazarus IDE, see https://www.lazarus-ide.org/
    Any Lazarus version above 2.0 will be OK.
  • The archive with the KIM-1 Simulator sources KIM1SIMsourcesxxx.zip.
  • Unpack in a folder, avoid blanks in folder and filenames
  • Start the IDE by clicking on KIM1SIM.lpi
  • Build with Run – Build
  • On Windows a Setup installable can be made with Inno Setup, KIM1SIM.iss and compile with Inno Studio.

Note that the font used is Courier New. Install ttf cour.ttf on Linux in .home/pi/.fonts to prevent substitution with artefacts

The include files with KIM ROM and 6502 code

If and when the ACIA routines and other routines in the KIM1SIM ROM are altered you need to rebuild the KIM1SIMrom.inc file.
Subfolder ‘romtoconst’ contains the binary of the original KIM ROMS (6530-002.bin, 6530-003.bin) and the additional ROM binary with ACIA routines (kimsimrom.bin).
The .inc files for the compilation of the KIM1SIM, to be placed in the main folder, are created with the program creatINC.exe, a console application (source included here).
Copy the the tree .inc files to the main folder and compile the KIM1SIM program again.

D:\myfiles\development\kim-1 simulator\romtoconst\creatINC.exe
kimrom002 include file created
kimrom003 include file created
kimsimrom include file created

Folder KIM-1 assembler sources

Here you find assembler sources of various tests. Assemble with TASM, included in the folder. See TASM.HTML for information.
It is convenient to compile from an editor like Notepad++, plugin NPPEXEC
with command to create intel hex file

"D:\myfiles\development\kim-1 simulator\KIM-1 assembler sources\tasm" -65 -x3 -g0 -s $(FILE_NAME) $(NAME_PART).ihex  $(NAME_PART).lst  -s $(NAME_PART).sym

or to create a binary file with
"D:\myfiles\development\kim-1 simulator\KIM-1 assembler sources\tasm" -65 -x3 -g3 -s $(FILE_NAME) $(NAME_PART).bin  $(NAME_PART).lst  -s $(NAME_PART).sym

Note that also symbol files are generated which can be read in by the debugger in the KIM-1 Simulator.

  • kim1sim6502test.asm : The 65(C)02 test, a program that runs on the TTY console
  • kimsimrom.asm : the source of the KIM-1 Simulator ROM at $F000 with ACIA support for KIM-1 TTY in/out
  • Various snippets used to test the CPU emulation

MTU K-1008 Visible Memory

The MTU Visible Memory is a memory mapped video display made by MTU.

See the K-1008 Manual how it works.

Enabling it will display a form on which the video memory is shown (according the packing of the pixels in bytes, see the manual).

Use the Settings from to enable or disable (default) the K-1008. The base address in memory can be set to what the original board allowed with jumpers.

The K-1008 display can be resized from 1x to 3x. Larger means a slower display, not much effort has been put in making it display fast.
A fourth option is to choose for a correct aspect ratio.

Note that the pixel only appears on screen when the corresponding memory location is written to by the CPU. Use Refresh in the Debugger to force the display.

Using MS Basic: the interpreter will detect the video memory as normal memory. No harm done, MS Basic does not support the K-1008. The memory test of MS Basic is visible on the K-1008 display!

There are several ways an image can be loaded to the K-1008 video display:

  • Load a K-1008 formatted binary file into memory. It will show on the K-1008 display if enabled via Settings.
  • The Refresh button in the debugger will also refresh the K-10008 display from memory
  • With a C header file. see below

How to make a C Header image file with threshold

  1. Choose a high contrast image
  2. Load the image in GIMP (a freeware image processing app for Windows, Linux etc)
  3. Scale the image to 320×200 exactly(have the ties between the dimension windows untied)
  4. Use the Treshold tool to convert to black and white, play with the settings until it looks good
  5. Export to, choose the C header file format, a file
  6. This file can be loaded with the File menu entries of the KIM- Simulator main window and Debugger
  7. The file is converted if you load in it into memory
  8. If you have the K-1008 display on (see Settings) it will display it too
  9. Now you can save the image if you wish with the ‘Memory to file’ menu entries

Make a C Header image file with dithered images

  1. Open image in GIMP
  2. Crop the image to 320×200 or a multiple like 960×600
  3. Image – Scale the image to 320×200
  4. Image – Mode – Indexed to black white palette Floyd-Steinberg (normal)
  5. Image – Mode – RGB
  6. File -Export As Select file type – C source header
  7. Export

Note there is a command line program in the folder K-1008 load C Header , called LoadK1008 that converts a C header image file to a K-1008 formatted binary.

D:\k1008\LoadK1008.exe h
LoadK1008 is a program to convert a 320x200 C header file from GIMP to
MTU Visable memory K-1008 image
LoadK1008 <C header filename> <K-1008 binary filename>

Prepare the C header file in GIMP as follows:

  1. Load an image in GIMP
  2. Scale to 320×200 (detach the link between the sizes)
  3. Threshold or dither to black and white, play to get a nice result
  4. Export as C header file
  5. Feed the C header file to this program
  6. Convert the result, a binary file into a program like my Convert 8 bit hex formats (included with the KIM-1 Simulator) to a papertape format with the start address of the K-1008 (2000-C000)
  7. Load the papertape into the KIM-1 or KIM-1 Simulator

Also there are examples of C header and binary K-1008 formatted files.

Sources of LoadK1008 commandline

The folder K-1008 load C Header contains the Freepascal source and original JPG files.

Use the Apple 1 monitor (Wozmon)

Load in Settings the Apple 1 monitor (wozmon) into the free space of the KIM-1 tape ROM.
Start at $1AA0, back to KIM-1 monitor with ‘X’ command.

Changelog

  • V 0.9 October 2021 First public beta
  • V 0.9.1 November 2021 Fixed key 0 bug (Thanks Liu!)
  • V 0.9.2 November 2021 Scrollbars in Load/Save dialog boxes added, Linux tests
  • V 0.9.3 November 2021 Added CC65 format symboltable load, added search in symbol table, fixed label display error in disassembly
  • V 0.9.4 December 2021 emulated getch in kimsinrom.asm now returns with Y=$FF
  • V 0.10.0 January 2022 Added 10 breakpoints and 10 watch points in debugger
  • V 0.10.1 January 2022 Save memory bug solved
  • V 0.10.2 January 2022 Watchpoints on registers and Stackpointer added
  • V 0.11.0 January 2022 Profiler (count how much an opcode is executed) added, Windows main menu to get fast to one of the forms
  • V 0.12.0 February 2022 Console cursor control (not finished yet)
  • V 0.13.0 February 2022 Main screen updated, more help entries. Console updates (on screen menu for colors) and KIM-1 tape load and save emulation
  • V 0.13.1 February 2022 Tested on Ubuntu, small updates and bugs fixed
  • V 0.13.2 February 2022 Settings for work directory, KIM tape load/save added to Save/Load memory
  • V1.0 February 2022, all planned functionally implemented (the console is now ANSI color enabled)
  • V1.0.0.1 February 2022, NumLock numeric keypad added, request for keyboard layout tests: testkeydown program added
  • V1.1.1 March 2022 KIMDLE works: free running timer at $1704 and KIM keyboard fixes (no key returns $15)
  • V1.1.2 March 2022 Settings for keyboard layout (US International and German for now), key handling KIM keypad and keyboard/console improved, free running timer
  • V1.1.4 April 2022 Improved design, use of debugger Run buttions stops main Run/Stop run state
  • V1.1.5 August 2022 Save to Define Byte file added, Belgium(french) keyboard layout (tnx Pascal Duquenoy )
  • V1.1.6 September 2022 Suppress echo on console like the KIM-1, Focal V3D supported
  • V1.1.7 15 November 2022 Tape load/save checksum overflow fixed
  • V1.1.8 25 january 2023 Windows 11 keypad shows white image when key pressed, now nothing seen when pressed.

V1.2x retracted

  • V1.2.0 30 april 2023 MTU K-1008 Visible Memory implemented
  • V1.2.1 19 may 2023 Raspberry Pi added again, compile options optimization high, no debugging
  • V1.2.2 30 may 2023 Cleanup all targets and docs (except macOS), Example programs like MS Basic added
  • V1.2.3 6 June 2023 Stricter RAM boundaries in Read memory. MacOS version included, thanks Michael Doornbos
  • V1.2.4 25 June 2023 Auto scroll bars added for larger forms like debugger. profiler
  • V 1.3.0 August 2023, V1.1.8 and changes from V1.2.4 merged
    • Auto scroll bars added to larger forms
    • Example programs added
    • Save and load to file formats bugfixes
    • Convert 8 bit Hex format program included in release
    • SST switch on keypad shows debugger window
    • MTU K-1008 Visible Memory implemented with example programs
  • V1.3.1 K-1008 video display updated with File load, Tape load and debugger Refresh button
  • V1.3.2 K-1008 images can be loaded from C header files images with GIMP, straight or dithered
  • V1.3.3 K-1008 images can be shown in normal window or stretched to correct aspect ratio
  • V1.3.4 August 31 Read text file to console improved, improved K-1008 settings
  • V1.3.5 October 2 2023 Read text file to console for UNIX and DOS line endings.
    Search in Memory, Fill memory and Move/copy memory added to Debugger menu
  • V1.3.6 October 10 Added Commodore PRG formatted files (binary, starts with load address low byte, high byte
  • V1.3.7 Debugged and tested the VT100 codes in the console
  • V1.3.8 November 2023 Console now only shows ASCII code 32-126, to get Tiny Basic working.
  • V1.3.9 December 2023 TIM format, all forms show in taskbar Windows, bug fixes, file types shown in load, setup with logo
  • V 1.4.0 February 2024 Console escape sequence handling improved, more robust, added documentation on color setting, wozmon loaded in Settings

Screenshot of 1.3.3 with ‘correct’ aspect ratio.

HEXPAWN

A game by Robert Leedom, published in 6502 user notes #13, 1979. Typed in by Dominic Bumbaco so we can play it!.

HEXPAWN

A game by Robert Leedom, published in 6502 user notes #13, 1979. Typed in by Dominic Bumbaco so we can play it!

Paper tape and hex dump of the program
Original article