6502 Opcode 8B (XAA, ANE)

From VisualChips

Revision as of 10:01, 16 January 2011 by Michael Steil (Talk | contribs)
Jump to: navigation, search

Of all the unsupported opcodes, 8B has had a lot of attention because it seems unpredictable. Even the same computer has been seen to act differently even with the same inputs.

The reason is that this opcode connects the A register to SB (the Special Bus) at both input and output: in a sense, A is both read and written. Unlike the stack pointer, the A register is not designed to do that, and the result is a circuit configuration which behaves in an interesting way.

Note that our switch-level simulation tends to produce wired-AND behaviour: if two logic gates both drive the same wire, then either of them can drive it low. A real 6502 usually does the same, which is why 8B - often called XAA - will more or less AND together the three inputs: the X register, the A register, and the immediate operand.

Why more or less? Two reasons: the A register is fed back on itself, and because of an interaction with the RDY input.

The A register drives the SB directly, and bits 0 and 4 read SB directly. The other 6 bits read SB through the Decimal Adjust logic, which doesn't affect the logic value but does affect the timing, the logic thresholds and the drive strengths. Exactly what happens is an analogue problem, not a digital one, so it will depend on the exact model of CPU, the variations of chip manufacture, the power supply and the temperature. We can't even model this without knowing the transistor strengths and having some idea of the transistor parameters - which we can only guess at.

The RDY input is a more digital influence on the outcome. RDY is intended to stall the CPU during read accesses, so it can read from slow memory. As it happens, the 6502 samples the databus on every falling clock edge, and loads the IDL (Input Data Latch), and then drives into the target register. Normally, the final cycle is the one which counts, overwriting the stray external values. In some computers, RDY is used to stall the CPU while the bus is used for DMA, which means the bus contains data such as video data for several cycles, except the last. In the case of XAA, every cycle's data is ANDed into A, and this is why the final value of A changes even for the same values of operand, X and A.

Here's an abridged circuit diagram. Note that bits 0 and 4 have direct A feedback whereas the other bits have indirect feedback. Note that phi1 is when A is written, but the preceding phi2 is when the operand is loaded and the two busses precharged high.


(Logic gate pullups shown as resistors, although in NMOS logic pullups are not usually depletion-mode transistors. They pull up to the positive rail. The pass transistors and precharges cannot pull up to the rail: they drop a threshold voltage. These considerations will affect an analogue analysis.)

Tested CPUs

The base formula for XAA seens to be:

A = (A | magic) & X & imm

"magic" defines which bits of A shine through.

Manufacturer Type YYWW Markings device tested in tester magic RDY clears #4 stable* notes
MOS 6502 8402 MOS
VC1541 Michael EE  ? yes this is the chip that came with this disk drive
MOS 6502B 8207 MOS
VC1541 Michael EE  ? yes from my Atari 800
Rockwell 6502 8228 R6502P
VC1541 Michael FF  ? yes Simon's; spare part bought from retailer
MOS 6510 8337 MOS
ASSY-NO.250407 / REV.B
Michael FF no yes
MOS 6510 8431 MOS
ASSY-NO.250407 / REV.A
Michael FF no yes
MOS 8500 8551 MOS
ASSY-NO.250425 / REV.B
Michael FE yes yes very early 8500
MOS 8500 9009 CSG
0990 24
ASSY-NO.250469 / REV.B
Michael FE yes yes very late 6502-like CPU
MOS 6502AD 8521 MOS
VC1571 Michael  ??  ? no very unstable; 1 MHz mode tested; can also do 2 MHz; bit #3 influences bit #4
Synertek 6502  ???? SY
VC1541 Michael Simon's; yet to test
MOS 8502  ???? MOS
C128D Michael yet to test; can do 1 MHz and 2 MHz
MOS 6502  ???? MOS
VC1581 Michael yet to test; can do 1 MHz and 2 MHz
Synertek 8323 Synertek
Atari 800XL Hias 00 - yes
Synertek 8320 Synertek
Atari 800XL Hias 00 - almost 40 errors in 256^3 full test
sometimes bit 3 was set
Synertek 8408 Synertek
Atari 800XL Hias 00 - no ~150k errors (1%) in full test
sometimes bit 3 set, for example A=03 X=FF imm=FF results either in 03 or 0B in repeated tests
Rockwell 8322 Rockwell
Atari 800XL Hias 00 - no ~80k errors (0.5%) in full test
sometimes bit 3 is set, but also bit 2 and 5 were set sometimes
for example A=5F or A=87 resulted in a set bit 3 (quite frequently), bit 5 (less frequently) or bit 2 (least frequent)
only flipping from 0 to 1 observed, no flipping from 1 to 0
NCR 8337 NCR
NCR C014806C-29
F826948 S8737
Atari 800XE Hias 00 - yes
 ?  ? unknown manufacturer
(C) ATARI 1980
Atari 65XE Hias 00 - no 6E)
when the CPU is cold A=FF X=FF imm=00 result in 46, later 66 and then 6E (when the CPU is warm)
bit 0 often flips from 0 to 1, for example A=01 X=01 imm=0C results in 00 or 01 (01 occurring more frequently when the CPU is warm)
Also bit 3 flipping from 1 to 0 was observed with A=09 X=E5 and imm=05 or 41 (result: 00 instead of 08)
Rockwell 8328 Rockwell
0579 8328
Atari 130XE Hias 00 - yes
Synertek 8324 Synertek
Atari 600XL Hias 00 - yes
Synertek 8321 Synertek
Atari 600XL Hias 00 - no ~95k errors (0.6%) in full test, sometimes bit 3 was set
Synertek 8407 Synertek
Atari 800XL Hias 00 - yes

(*)Note: "stable" means that the formula, the "magic" value and the potential #4 clearing by RDY fully describe the behavior.


  • For a list of all opcodes and some explanation of what they do, see 6502 all 256 Opcodes.
  • For notes on other opcodes we've explored in our simulations, see here.
Personal tools