MOS 6502 Simulator
Introduction
This site contains documentation for the various MOS 6502 opcodes and concepts, an editor that lets you write your own programs and a simulator that lets you run these. The Load menu will load example programs contributed by various authors.
Credits:
- Stian Søreng wrote the original 6502 simulator in JavaScript.
- Nick Morgan adapted the simulator for Easy 6502. It's a nice introduction, you might want to start there.
- John Pickens, Bruce Clark and Ed Spittles wrote the NMOS 6502 Opcodes documentation used in this site.
- Torkild Ulvøy Resheim adapted the simulator for the MOS 6502 Simulator (this) site, updated and added documentation.
This web site was put together as a part of a introductory tutorial on 6502 assembly for Itema AS. The layout have been designed to work fine on an iPad or iPad Pro. Feel free to fork the project on GitHub.
Notes
Memory location $fe contains a new random byte on every instruction.
Memory location $ff contains the ascii code of the last key pressed.
Memory locations $200 to $5ff map to the screen
pixels (1024 of them). The screen is 32 x 32 pixels in size. Different values
wil draw different colour pixels. The colours are:
$0: Black $8: Orange $1: White $9: Brown $2: Red $a: Light red $3: Cyan $b: Dark grey $4: Purple $c: Grey $5: Green $d: Light green $6: Blue $e: Light blue $7: Yellow $f: Light grey
This documentation was copied from actual MOS 6502 documentation and currently contains some information that does not apply here. For instance everything related to interrupts, which are not supported by the simulator. Also the various timing details are probably not accurate.
The DCB compiler directive
The DCB directive allocates one or more bytes of memory, and
defines the initial runtime contents of the memory. When combined with a label
one can reference this in an assember instruction. For example:
lda ypos,x ypos: dcb $00,$02,$20,$02,$40,$02,$60,$02 dcb $80,$02,$a0,$02,$c0,$02,$e0,$02
This will load the value of ypos on position x in
to the A register.
Program Counter
When the 6502 is ready for the next instruction it increments the program counter before fetching the instruction. Once it has the op code, it increments the program counter by the length of the operand, if any. This must be accounted for when calculating branches or when pushing bytes to create a false return address (i.e. jump table addresses are made up of addresses-1 when it is intended to use an RTS rather than a JMP).
The program counter is loaded least signifigant byte first. Therefore the most signifigant byte must be pushed first when creating a false return address.
When calculating branches a forward branch of 6 skips the following 6 bytes so, effectively the program counter points to the address that is 8 bytes beyond the address of the branch opcode; and a backward branch of $FA (256-6) goes to an address 4 bytes before the branch instruction.
Wrap-Around
Use caution with indexed zero page operations as they are subject to wrap-around. For example, if the X register holds $FF and you execute LDA $80,X you will not access $017F as you might expect; instead you access $7F i.e. $80-1. This characteristic can be used to advantage but make sure your code is well commented.
It is possible, however, to access $017F when X = $FF by using the Absolute,X addressing mode of LDA $80,X. That is, instead of:
LDA $80,X
ZeroPage,X - the resulting object code is B5 80
which accesses $007F when X=$FF, use:
LDA $0080,X
Absolute,X - the resulting object code is: BD 80 00
which accesses $017F when X = $FF (a at cost of one additional byte and one
additional cycle). All of the ZeroPage,X and ZeroPage,Y instructions except
STX ZeroPage,Y and STY ZeroPage,X have a corresponding Absolute,X and
Absolute,Y instruction. Unfortunately, a lot of 6502 assemblers don't have an
easy way to force Absolute addressing, i.e. most will assemble a LDA $0080,X
as B5 80. One way to overcome this is to insert the bytes using the .BYTE
pseudo-op (on some 6502 assemblers this pseudo-op is called DB or DFB,
consult the assembler documentation) as follows:
.BYTE $BD,$80,$00
In cases where you are writing code that will be relocated you must consider wrap-around when assigning dummy values for addresses that will be adjusted. Both zero and the semi-standard $FFFF should be avoided for dummy labels. The use of zero or zero page values will result in assembled code with zero page opcodes when you wanted absolute codes. With $FFFF, the problem is in addresses+1 as you wrap around to page 0.
ADC (ADd with Carry)
Affects Flags: N V Z C
MODE SYNTAX HEX Immediate ADC #$44 $69 Zero Page ADC $44 $65 Zero Page,X ADC $44,X $75 Absolute ADC $4400 $6D Absolute,X ADC $4400,X $7D Absolute,Y ADC $4400,Y $79 Indirect,X ADC ($44,X) $61 Indirect,Y ADC ($44),Y $71 + add 1 cycle if page boundary crossed
ADC results are dependant on the setting of the decimal flag. In decimal mode, addition is carried out on the assumption that the values involved are packed BCD (Binary Coded Decimal).
There is no way to add without carry.
AND (bitwise AND with accumulator)
Affects Flags: N Z
MODE SYNTAX HEX Immediate AND #$44 $29 Zero Page AND $44 $25 Zero Page,X AND $44,X $35 Absolute AND $4400 $2D Absolute,X AND $4400,X $3D Absolute,Y AND $4400,Y $39 Indirect,X AND ($44,X) $21 Indirect,Y AND ($44),Y $31 + add 1 cycle if page boundary crossed
ASL (Arithmetic Shift Left)
Affects Flags: N Z C
MODE SYNTAX HEX Accumulator ASL A $0A Zero Page ASL $44 $06 Zero Page,X ASL $44,X $16 Absolute ASL $4400 $0E Absolute,X ASL $4400,X $1E
ASL shifts all bits left one position. 0 is shifted into bit 0 and the original bit 7 is shifted into the Carry.
Branch Instructions
Affect Flags: none
All branches are relative mode and have a length of two bytes. Syntax is "Bxx Displacement" or (better) "Bxx Label". See the notes on the Program Counter for more on displacements.
Branches are dependant on the status of the flag bits when the op code is encountered. A branch not taken requires two machine cycles. Add one if the branch is taken and add one more if the branch crosses a page boundary.
MNEMONIC HEX BPL (Branch on PLus) $10 BMI (Branch on MInus) $30 BVC (Branch on oVerflow Clear) $50 BVS (Branch on oVerflow Set) $70 BCC (Branch on Carry Clear) $90 BCS (Branch on Carry Set) $B0 BNE (Branch on Not Equal) $D0 BEQ (Branch on EQual) $F0
There is no BRA (BRanch Always) instruction but it can be easily emulated by branching on the basis of a known condition. One of the best flags to use for this purpose is the oVerflow which is unchanged by all but addition and subtraction operations.
A page boundary crossing occurs when the branch destination is on a different page than the instruction AFTER the branch instruction. For example:
SEC BCS LABEL NOP
A page boundary crossing occurs (i.e. the BCS takes 4 cycles) when (the address of) LABEL and the NOP are on different pages. This means that
CLV
BVC LABEL
LABEL NOP
the BVC instruction will take 3 cycles no matter what address it is located at.
BIT (test BITs)
Affects Flags: N V Z
MODE SYNTAX HEX Zero Page BIT $44 $24 Absolute BIT $4400 $2C
BIT sets the Z flag as though the value in the address tested were ANDed with the accumulator. The N and V flags are set to match bits 7 and 6 respectively in the value stored at the tested address.
BIT is often used to skip one or two following bytes as in:
CLOSE1 LDX #$10 If entered here, we
.BYTE $2C effectively perform
CLOSE2 LDX #$20 a BIT test on $20A2,
.BYTE $2C another one on $30A2,
CLOSE3 LDX #$30 and end up with the X
CLOSEX LDA #12 register still at $10
STA ICCOM,X upon arrival here.
Beware: a BIT instruction used in this way as a NOP does have effects: the flags may be modified, and the read of the absolute address, if it happens to access an I/O device, may cause an unwanted action.
BRK (BReaK)
Affects Flags: B
MODE SYNTAX HEX Implied BRK $00
BRK causes a non-maskable interrupt and increments the program counter by one. Therefore an RTI will go to the address of the BRK +2 so that BRK may be used to replace a two-byte instruction for debugging and the subsequent RTI will be correct.
CMP (CoMPare accumulator)
Affects Flags: N Z C
MODE SYNTAX HEX Immediate CMP #$44 $C9 Zero Page CMP $44 $C5 Zero Page,X CMP $44,X $D5 Absolute CMP $4400 $CD Absolute,X CMP $4400,X $DD Absolute,Y CMP $4400,Y $D9 Indirect,X CMP ($44,X) $C1 Indirect,Y CMP ($44),Y $D1 + add 1 cycle if page boundary crossed
Compare sets flags as if a subtraction had been carried out. If the value in the accumulator is equal or greater than the compared value, the Carry will be set. The equal (Z) and negative (N) flags will be set based on equality or lack thereof and the sign (i.e. A>=$80) of the accumulator.
CPX (ComPare X register)
Affects Flags: N Z C
MODE SYNTAX HEX Immediate CPX #$44 $E0 Zero Page CPX $44 $E4 Absolute CPX $4400 $EC
Operation and flag results are identical to equivalent mode accumulator CMP ops.
CPY (ComPare Y register)
Affects Flags: N Z C
MODE SYNTAX HEX Immediate CPY #$44 $C0 Zero Page CPY $44 $C4 Absolute CPY $4400 $CC
Operation and flag results are identical to equivalent mode accumulator CMP ops.
DEC (DECrement memory)
Affects Flags: N Z
MODE SYNTAX HEX Zero Page DEC $44 $C6 Zero Page,X DEC $44,X $D6 Absolute DEC $4400 $CE Absolute,X DEC $4400,X $DE
EOR (bitwise Exclusive OR)
Affects Flags: N Z
MODE SYNTAX HEX Immediate EOR #$44 $49 Zero Page EOR $44 $45 Zero Page,X EOR $44,X $55 Absolute EOR $4400 $4D Absolute,X EOR $4400,X $5D Absolute,Y EOR $4400,Y $59 Indirect,X EOR ($44,X) $41 Indirect,Y EOR ($44),Y $51 + add 1 cycle if page boundary crossed
Flag (Processor Status) Instructions
Affect Flags: as noted
These instructions are implied mode, have a length of one byte and require two machine cycles.
MNEMONIC HEX CLC (CLear Carry) $18 SEC (SEt Carry) $38 CLI (CLear Interrupt) $58 SEI (SEt Interrupt) $78 CLV (CLear oVerflow) $B8 CLD (CLear Decimal) $D8 SED (SEt Decimal) $F8
The Interrupt flag is used to prevent (SEI) or enable (CLI) maskable interrupts (aka IRQ's). It does not signal the presence or absence of an interrupt condition. The 6502 will set this flag automatically in response to an interrupt and restore it to its prior status on completion of the interrupt service routine. If you want your interrupt service routine to permit other maskable interrupts, you must clear the I flag in your code.
The Decimal flag controls how the 6502 adds and subtracts. If set, arithmetic is carried out in packed binary coded decimal. This flag is unchanged by interrupts and is unknown on power-up. The implication is that a CLD should be included in boot or interrupt coding.
The Overflow flag is generally misunderstood and therefore under-utilised. After an ADC or SBC instruction, the overflow flag will be set if the twos complement result is less than -128 or greater than +127, and it will cleared otherwise. In twos complement, $80 through $FF represents -128 through -1, and $00 through $7F represents 0 through +127. Thus, after:
CLC LDA #$7F ; +127 ADC #$01 ; + +1
the overflow flag is 1 (+127 + +1 = +128), and after:
CLC LDA #$81 ; -127 ADC #$FF ; + -1
the overflow flag is 0 (-127 + -1 = -128). The overflow flag is not affected by increments, decrements, shifts and logical operations i.e. only ADC, BIT, CLV, PLP, RTI and SBC affect it. There is no op code to set the overflow but a BIT test on an RTS instruction will do the trick.
INC (INCrement memory)
Affects Flags: N Z
MODE SYNTAX HEX Zero Page INC $44 $E6 Zero Page,X INC $44,X $F6 Absolute INC $4400 $EE Absolute,X INC $4400,X $FE
JMP (JuMP)
Affects Flags: none
MODE SYNTAX HEX Absolute JMP $5597 $4C Indirect JMP ($5597) $6C
JMP transfers program execution to the following address (absolute) or to the location contained in the following address (indirect). Note that there is no carry associated with the indirect jump so: AN INDIRECT JUMP MUST NEVER USE A VECTOR BEGINNING ON THE LAST BYTE OF A PAGE
For example if address $3000 contains $40, $30FF contains $80, and $3100 contains $50, the result of JMP ($30FF) will be a transfer of control to $4080 rather than $5080 as you intended i.e. the 6502 took the low byte of the address from $30FF and the high byte from $3000.
JSR (Jump to SubRoutine)
Affects Flags: none
MODE SYNTAX HEX Absolute JSR $5597 $20
JSR pushes the address-1 of the next operation on to the stack before transferring program control to the following address. Subroutines are normally terminated by a RTS opcode.
LDA (LoaD Accumulator)
Affects Flags: N Z
MODE SYNTAX HEX Immediate LDA #$44 $A9 Zero Page LDA $44 $A5 Zero Page,X LDA $44,X $B5 Absolute LDA $4400 $AD Absolute,X LDA $4400,X $BD Absolute,Y LDA $4400,Y $B9 Indirect,X LDA ($44,X) $A1 Indirect,Y LDA ($44),Y $B1 + add 1 cycle if page boundary crossed
LDX (LoaD X register)
Affects Flags: N Z
MODE SYNTAX HEX Immediate LDX #$44 $A2 Zero Page LDX $44 $A6 Zero Page,Y LDX $44,Y $B6 Absolute LDX $4400 $AE Absolute,Y LDX $4400,Y $BE + add 1 cycle if page boundary crossed
LDY (LoaD Y register)
Affects Flags: N Z
MODE SYNTAX HEX Immediate LDY #$44 $A0 Zero Page LDY $44 $A4 Zero Page,X LDY $44,X $B4 Absolute LDY $4400 $AC Absolute,X LDY $4400,X $BC + add 1 cycle if page boundary crossed
LSR (Logical Shift Right)
Affects Flags: N Z C
MODE SYNTAX HEX Accumulator LSR A $4A Zero Page LSR $44 $46 Zero Page,X LSR $44,X $56 Absolute LSR $4400 $4E Absolute,X LSR $4400,X $5E
LSR shifts all bits right one position. 0 is shifted into bit 7 and the original bit 0 is shifted into the Carry.
Execution Times
Op code execution times are measured in machine cycles; one machine cycle equals one clock cycle. Many instructions require one extra cycle for execution if a page boundary is crossed; these are indicated by a + following the time values shown.
NOP (No OPeration)
Affects Flags: none
MODE SYNTAX HEX LEN TIM Implied NOP $EA 1 2
NOP is used to reserve space for future modifications or effectively REM out existing code.
ORA (bitwise OR with Accumulator)
Affects Flags: N Z
MODE SYNTAX HEX Immediate ORA #$44 $09 Zero Page ORA $44 $05 Zero Page,X ORA $44,X $15 Absolute ORA $4400 $0D Absolute,X ORA $4400,X $1D Absolute,Y ORA $4400,Y $19 Indirect,X ORA ($44,X) $01 Indirect,Y ORA ($44),Y $11 + add 1 cycle if page boundary crossed
Register Instructions
Affect Flags: N Z
These instructions are implied mode, have a length of one byte and require two machine cycles.
MNEMONIC HEX TAX (Transfer A to X) $AA TXA (Transfer X to A) $8A DEX (DEcrement X) $CA INX (INcrement X) $E8 TAY (Transfer A to Y) $A8 TYA (Transfer Y to A) $98 DEY (DEcrement Y) $88 INY (INcrement Y) $C8
ROL (ROtate Left)
Affects Flags: N Z C
MODE SYNTAX HEX Accumulator ROL A $2A Zero Page ROL $44 $26 Zero Page,X ROL $44,X $36 Absolute ROL $4400 $2E Absolute,X ROL $4400,X $3E
ROL shifts all bits left one position. The Carry is shifted into bit 0 and the original bit 7 is shifted into the Carry.
ROR (ROtate Right)
Affects Flags: N Z C
MODE SYNTAX HEX Accumulator ROR A $6A Zero Page ROR $44 $66 Zero Page,X ROR $44,X $76 Absolute ROR $4400 $6E Absolute,X ROR $4400,X $7E
ROR shifts all bits right one position. The Carry is shifted into bit 7 and the original bit 0 is shifted into the Carry.
RTI (ReTurn from Interrupt)
Affects Flags: all
MODE SYNTAX HEX Implied RTI $40
RTI retrieves the Processor Status Word (flags) and the Program Counter from the stack in that order (interrupts push the PC first and then the PSW).
Note that unlike RTS, the return address on the stack is the actual address rather than the address-1.
RTS (ReTurn from Subroutine)
Affects Flags: none
MODE SYNTAX HEX Implied RTS $60
RTS pulls the top two bytes off the stack (low byte first) and transfers program control to that address+1. It is used, as expected, to exit a subroutine invoked via JSR which pushed the address-1.
RTS is frequently used to implement a jump table where addresses-1 are pushed onto the stack and accessed via RTS eg. to access the second of four routines:
LDX #1 JSR EXEC JMP SOMEWHERE LOBYTE .BYTE <ROUTINE0-1,<ROUTINE1-1 .BYTE <ROUTINE2-1,<ROUTINE3-1 HIBYTE .BYTE >ROUTINE0-1,>ROUTINE1-1 .BYTE >ROUTINE2-1,>ROUTINE3-1 EXEC LDA HIBYTE,X PHA LDA LOBYTE,X PHA RTS
SBC (SuBtract with Carry)
Affects Flags: N V Z C
MODE SYNTAX HEX Immediate SBC #$44 $E9 Zero Page SBC $44 $E5 Zero Page,X SBC $44,X $F5 Absolute SBC $4400 $ED Absolute,X SBC $4400,X $FD Absolute,Y SBC $4400,Y $F9 Indirect,X SBC ($44,X) $E1 Indirect,Y SBC ($44),Y $F1 + add 1 cycle if page boundary crossed
SBC results are dependant on the setting of the decimal flag. In decimal mode, subtraction is carried out on the assumption that the values involved are packed BCD (Binary Coded Decimal).
There is no way to subtract without the carry which works as an inverse borrow. i.e, to subtract you set the carry before the operation. If the carry is cleared by the operation, it indicates a borrow occurred.
STA (STore Accumulator)
Affects Flags: none
MODE SYNTAX HEX Zero Page STA $44 $85 Zero Page,X STA $44,X $95 Absolute STA $4400 $8D Absolute,X STA $4400,X $9D Absolute,Y STA $4400,Y $99 Indirect,X STA ($44,X) $81 Indirect,Y STA ($44),Y $91
Stack Instructions
These instructions are implied mode, have a length of one byte and require machine cycles as indicated. The "PuLl" operations are known as "POP" on most other microprocessors. With the 6502, the stack is always on page one ($100-$1FF) and works top down.
MNEMONIC HEX TXS (Transfer X to Stack ptr) $9A TSX (Transfer Stack ptr to X) $BA PHA (PusH Accumulator) $48 PLA (PuLl Accumulator) $68 PHP (PusH Processor status) $08 PLP (PuLl Processor status) $28
STX (STore X register)
Affects Flags: none
MODE SYNTAX HEX Zero Page STX $44 $86 Zero Page,Y STX $44,Y $96 Absolute STX $4400 $8E
STY (STore Y register)
Affects Flags: none
MODE SYNTAX HEX Zero Page STY $44 $84 Zero Page,X STY $44,X $94 Absolute STY $4400 $8C