The NES CPU core is based on the 6502 processor and runs at approximately 1.79 MHz (1.66 MHz in a PAL NES). It is made by Ricoh and lacks the MOS6502's decimal mode. In the NTSC NES, the RP2A03 chip contains the CPU and APU; in the PAL NES, the CPU and APU are contained within the RP2A07 chip.
- CPU instructions
- CPU addressing modes
- CPU memory map
- CPU power-up state
- CPU registers
- CPU status flag behavior
- CPU interrupts
- Unofficial opcodes
- CPU pin-out and signals, and other hardware pin-outs
CPU signals and frequencies
The CPU generates its clock signal by dividing the master clock signal.
|Rate||NTSC NES/Famicom||PAL NES||PAL Famiclone|
|Color subcarrier frequency fsc (exact)||39375000/11 Hz||4433618.75 Hz||4433618.75 Hz|
|Color subcarrier frequency fsc (approx.)||3.579545 MHz||4.433619 MHz||4.433619 MHz|
|Master clock frequency 6fsc||21.477272 MHz||26.601712 MHz||26.601712 MHz|
|Clock divisor d||12||16||15|
|CPU clock frequency 6fsc/d||1.789773 MHz (~559 ns per cycle)||1.662607 MHz (~601 ns per cycle)||1.773448 MHz (~564 ns per cycle)|
- Kevtris has confirmed that all illegal 6502 opcodes execute identically on the 2A03/2A07. He has even went as far as to integrate them into the CopyNES BIOS.
- Every cycle on 6502 is either a read or a write cycle.
- A printer friendly version covering all section is available here.
- 2A03 technical reference by Brad Taylor. (Pretty old at this point; information on the wiki might be more up-to-date.)
|$0000-$07FF||$0800||2KB internal RAM|
|$0800-$0FFF||$0800||Mirrors of $0000-$07FF|
|$2000-$2007||$0008||NES PPU registers|
|$2008-$3FFF||$1FF8||Mirrors of $2000-2007 (repeats every 8 bytes)|
|$4000-$4017||$0018||NES APU and I/O registers|
|$4018-$401F||$0008||APU and I/O functionality that is normally disabled. See CPU Test Mode.|
|$4020-$FFFF||$BFE0||Cartridge space: PRG ROM, PRG RAM, and mapper registers (See Note)|
See Sample RAM map for an example allocation strategy for the 2KB of internal RAM at $0000-$0800.
Note: Most common boards and iNES mappers address ROM and Save/Work RAM in this format:
- $6000-$7FFF = Battery Backed Save or Work RAM
- $8000-$FFFF = Usual ROM, commonly with Mapper Registers (see MMC1 and UxROM for example)
The CPU expects interrupt vectors in a fixed place at the end of the cartridge space:
- $FFFA-$FFFB = NMI vector
- $FFFC-$FFFD = Reset vector
- $FFFE-$FFFF = IRQ/BRK vector
If a mapper doesn't fix $FFFA-$FFFF to some known bank (typically, along with the rest of the bank containing them, e.g. $C000-$FFFF for a 16KiB banking mapper) or use some sort of reset detection, the vectors need to be stored in all banks.
Pin out and signal description
.--\/--. AD1 <- |01 40| -- +5V AD2 <- |02 39| -> OUT0 /RST -> |03 38| -> OUT1 A00 <- |04 37| -> OUT2 A01 <- |05 36| -> /OE1 A02 <- |06 35| -> /OE2 A03 <- |07 34| -> R/W A04 <- |08 33| <- /NMI A05 <- |09 32| <- /IRQ A06 <- |10 31| -> M2 A07 <- |11 30| <- TST (usually GND) A08 <- |12 29| <- CLK A09 <- |13 28| <> D0 A10 <- |14 27| <> D1 A11 <- |15 26| <> D2 A12 <- |16 25| <> D3 A13 <- |17 24| <> D4 A14 <- |18 23| <> D5 A15 <- |19 22| <> D6 GND -- |20 21| <> D7 `------'
|Active-Low signals are prefixed by a / (slash) symbol. Every cycle is either a read or a write cycle.|
- CLK : 21.47727 MHz (NTSC) or 26.6017 MHz (PAL) clock input. Internally, this clock is divided by 12 (NTSC 2A03) or 16 (PAL 2A07) to feed the 6502's clock input φ0, which is in turn inverted to form φ1, which is then inverted to form φ2. φ1 is high during the first phase (half-cycle) of each CPU cycle, while φ2 is high during the second phase.
- AD1 : Audio out pin (both pulse waves).
- AD2 : Audio out pin (triangle, noise, and DPCM).
- Axx and Dx : Address and data bus, respectively. Axx holds the target address during the entire read/write cycle. For reads, the value is read from Dx during φ2. For writes, the value appears on Dx during φ2 (and no sooner).
- OUT0..OUT2 : Output pins used by the controllers ($4016 output latch bits 0-2). These 3 pins are connected to either the NES or Famicom's expansion port, and OUT0 is additionally used as the "strobe" signal (OUT) on both controller ports.
- /OE1 and /OE2 : Controller ports (for controller #1 and #2 respectively). Each enable the output of their respective controller, if present.
- R/W : Read/write signal, which is used to indicate operations of the same names. Low is write. R/W stays high/low during the entire read/write cycle.
- /NMI : Non-maskable interrupt pin. See the 6502 manual and CPU interrupts for more details.
- /IRQ : Interrupt pin. See the 6502 manual and CPU interrupts for more details.
- M2 : Can be considered as a "signals ready" pin. It is a modified version the 6502's φ2 (which roughly corresponds to the CPU input clock φ0) that allows for slower ROMs. CPU cycles begin at the point where M2 goes low.
- In the NTSC 2A03, M2 has a duty cycle of 5/8th, or 350ns/559ns. Equivalently, a CPU read (which happens during the second, high phase of M2) takes 1 and 7/8th PPU cycles. The internal φ2 duty cycle is exactly 1/2 (one half).
- In the PAL 2A07, the duty cycle is not known, but suspected to be 19/32.
- TST : (tentative name) Pin 30 is special: normally it is grounded in the NES, Famicom, PC10/VS. NES and other Nintendo Arcade Boards (Punch-Out!! and Donkey Kong 3). But if it is pulled high on the RP2A03G, extra diagnostic registers to test the sound hardware are enabled from $4018 through $401A, and the joystick ports $4016 and $4017 become open bus. On older revisions of the CPU, pulling pin 30 high instead causes the CPU to stop execution.
Power up state
The following results are from a US (NTSC) NES, original front-loading design, RP2A03G CPU chip, NES-CPU-07 main board revision, manufactured in 1988. The memory values are probably slightly different for each individual NES console. Please note that you should NOT rely on the state of any registers after Power-UP and especially not the stack register and RAM ($0000-$07FF).
- P = $34 (IRQ disabled)
- A, X, Y = 0
- S = $FD
- $4017 = $00 (frame irq enabled)
- $4015 = $00 (all channels disabled)
- $4000-$400F = $00 (not sure about $4010-$4013)
- All 15 bits of noise channel LFSR = $0000. The first time the LFSR is clocked from the all-0s state, it will shift in a 1.
- Internal memory ($0000-$07FF) has unreliable startup state. Some machines may have consistent RAM contents at power-on, but others do not.
- Emulators often implement a consistent RAM startup state (e.g. all $00 or $FF, or a particular pattern), and flash carts like the PowerPak may partially or fully initialize RAM before starting a program, so an NES programmer must be careful not to rely on the startup contents of RAM.
- A, X, Y were not affected
- S was decremented by 3 (but nothing was written to the stack)
- The I (IRQ disable) flag was set to true (status ORed with $04)
- The internal memory was unchanged
- APU mode in $4017 was unchanged
- APU was silenced ($4015 = 0)
Status flag behavior
The flags register, also called processor status or just P, is one of the six architectural registers on the 6502 family CPU. It is composed of six one-bit registers (see Status flags); instructions modify one or more bits and leave others unchanged.
Instructions that save or restore the flags map them to bits in the architectural 'P' register as follows:
7 bit 0 ---- ---- NVss DIZC |||| |||| |||| |||+- Carry: 1 if last addition or shift resulted in a carry, or if |||| ||| last subtraction resulted in no borrow |||| ||+-- Zero: 1 if last operation resulted in a 0 value |||| |+--- Interrupt: Interrupt inhibit |||| | (0: /IRQ and /NMI get through; 1: only /NMI gets through) |||| +---- Decimal: 1 to make ADC and SBC use binary-coded decimal arithmetic |||| (ignored on second-source 6502 like that in the NES) ||++------ s: No effect, used by the stack copy, see note below |+-------- Overflow: 1 if last ADC or SBC resulted in signed overflow, | or D6 from last BIT +--------- Negative: Set to bit 7 of the last operation
The B flag
There are six and only six flags in the processor status register within the CPU. Despite what some 6502 references might appear to claim on a first reading, there is no "B flag" stored within the CPU's status register.
Two interrupts (/IRQ and /NMI) and two instructions (PHP and BRK) push the flags to the stack. In the byte pushed, bit 5 is always set to 1, and bit 4 is 1 if from an instruction (PHP or BRK) or 0 if from an interrupt line being pulled low (/IRQ or /NMI). This is the only time and place where the B flag actually exists: not in the status register itself, but in bit 4 of the copy that is written to the stack.
|Instruction||Bits 5 and 4||Side effects after pushing|
|BRK||11||I is set to 1|
|/IRQ||10||I is set to 1|
|/NMI||10||I is set to 1|
Two instructions (PLP and RTI) pull a byte from the stack and set all the flags. They ignore bits 5 and 4.
The only way for an IRQ handler to distinguish /IRQ from BRK is to read the flags byte from the stack and test bit 4. The slowness of this is one reason why BRK wasn't used as a syscall mechanism. Instead, it was more often used to trigger a patching mechanism that hung off the /IRQ vector: a single byte in PROM, UVEPROM, flash, etc. would be forced to 0, and the IRQ handler would pick something to do instead based on the program counter.
Unlike bits 5 and 4, bit 3 actually exists in P, even though it doesn't affect the ALU operation on the 2A03 or 2A07 CPU the way it does in MOS Technology's own chips.