CIA 6526 | Code Like It's 198x

Every key pressed on a Commodore 64, every joystick movement, every byte sent to the disk drive and every bit sent through a modem passes through one of two identical chips. The MOS 6526 Complex Interface Adapter, or CIA, has two 8-bit ports, two 16-bit timers, a clock that keeps the time of day and a shift register for serial data. The C64 wires the two chips differently. CIA 1, at $DC00, reads the keyboard and joysticks and interrupts the processor through its IRQ line. CIA 2, at $DD00, drives the serial bus to the disk drive, the user port and the RS-232 lines, chooses which 16K of memory the video chip sees, and interrupts through NMI, which the processor cannot ignore.

The shift register comes with a story. Al Charpentier, who led the chip design group at MOS Technology, told IEEE Spectrum in 1985 that the serial interface of the older 6522 chip, used in the VIC-20, “does not work”, which is why the VIC-20’s serial disk drive was so slow. “We fixed the serial-shift register for the 6526,” he said, “but we couldn’t use it, because the disk drive had to be compatible.” The C64 kept sending data to the 1541 one bit at a time under software control, and fast loaders were the result.

Fast facts

Part: MOS 6526; some later C64s have the 8521 in its place.
Chips per C64: two, at $DC00–$DC0F (56320) and $DD00–$DD0F (56576).
Features: Commodore’s specification lists “16 Individually programmable I/O lines”, “2 independent, linkable 16-Bit interval timers”, a “24-hour (AM/PM) time of day clock with programmable alarm” and an “8-Bit shift register for serial I/O”.
Interrupts: five sources per chip. CIA 1 drives IRQ, CIA 2 drives NMI.
Speed: the data sheet’s ordering table lists the plain 6526 as the 1 MHz part and the 6526A as the 2 MHz part.

Registers

Both chips have the same sixteen registers. The names are the ones in Mapping the Commodore 64; CIA 2’s versions carry a 2 (CI2PRA, TI2ALO and so on).

CIA 1	CIA 2	Name (CIA 1)	Purpose
`$DC00`	`$DD00`	CIAPRA	Data port A
`$DC01`	`$DD01`	CIAPRB	Data port B
`$DC02`	`$DD02`	CIDDRA	Data direction, port A (1 = output)
`$DC03`	`$DD03`	CIDDRB	Data direction, port B
`$DC04`–`$DC05`	`$DD04`–`$DD05`	TIMALO, TIMAHI	Timer A, low and high bytes
`$DC06`–`$DC07`	`$DD06`–`$DD07`	TIMBLO, TIMBHI	Timer B, low and high bytes
`$DC08`–`$DC0B`	`$DD08`–`$DD0B`	TODTEN, TODSEC, TODMIN, TODHRS	Time-of-day clock: tenths, seconds, minutes, hours
`$DC0C`	`$DD0C`	CIASDR	Serial data register
`$DC0D`	`$DD0D`	CIAICR	Interrupt control
`$DC0E`	`$DD0E`	CIACRA	Control register A
`$DC0F`	`$DD0F`	CIACRB	Control register B

CIA 1: keyboard and joysticks

The keyboard is a matrix of eight rows and eight columns wired between CIA 1’s two ports. To read it, a program sets port A as outputs and port B as inputs (the default), writes a 0 to the bit of port A for the column it wants and 1s everywhere else, then reads port B. “A 0 in any bit position signifies that the key in the corresponding row of the selected column is being pressed,” Mapping the Commodore 64 explains. Two keys are missing from the matrix: SHIFT LOCK, which just holds the left SHIFT switch down, and RESTORE, which is wired to the processor’s NMI line. The KERNAL scans the whole keyboard from an interrupt about 60 times a second, driven by CIA 1’s Timer A.

The joysticks share the same lines. A joystick is five switches, and like a key, a closed switch reads as 0.

Direction	Control port 2 (`$DC00`)	Control port 1 (`$DC01`)
Up	bit 0	bit 0
Down	bit 1	bit 1
Left	bit 2	bit 2
Right	bit 3	bit 3
Fire	bit 4	bit 4

Port 1 is read from port B, the same port as the keyboard rows, and Mapping points out what follows. The keyboard routine cannot tell a joystick switch from a key: push a stick in port 1 to the right and the computer sees the 2 key. Pushing it to the left is read as the CTRL key, which slows down a program listing. “Many commercially available games just use Controller Port 2 to avoid the conflict.” To read port 1 cleanly, a program stops the keyboard scan and writes $FF to port A first: POKE 56333,127:POKE 56320,255, and POKE 56333,129 afterwards.

Port A has two more jobs. Bits 6 and 7 choose which pair of paddles the SID reads, and the paddle fire buttons appear on bits 2 and 3 of each port.

CIA 2: serial bus, video bank, user port and RS-232

`$DD00` bit	Job
0–1	Which 16K bank the VIC-II sees
2	RS-232 data out (user port pin M)
3	Serial bus ATN out
4	Serial bus clock out
5	Serial bus data out
6	Serial bus clock in
7	Serial bus data in

Port B, $DD01, is the user port’s eight data lines. Commodore’s RS-232 software uses most of them as handshaking lines (received data, request to send, data terminal ready and others), and the chip’s /FLAG input sits on user port pin B.

The two bank bits are inverted, so a higher number selects a lower address:

`$DD00` bits 1–0	Bank	VIC-II sees
11	0	`$0000`–`$3FFF` (the power-up setting)
10	1	`$4000`–`$7FFF`
01	2	`$8000`–`$BFFF`
00	3	`$C000`–`$FFFF`

The Programmer’s Reference Guide gives the BASIC for it, POKE 56576,(PEEK(56576) AND 252) OR A, where A is 0 to 3. It also notes that the VIC-II can see the character ROM only in banks 0 and 2, so a program that moves to bank 1 or 3 has to bring its own character set.

The difference that matters most is the interrupt wiring. Mapping warns that because CIA 2 is connected to NMI, “interrupts from this chip cannot be masked by setting the Interrupt disable flag (SEI)”, only through the chip’s own mask register. The KERNAL’s RS-232 routines use this on purpose. According to the Programmer’s Reference Guide, their bit-level handlers “run under the control of the 6526 CIA #2 device timers and interrupts”, and the chip “generates NMI (Non-Maskable Interrupt) requests for RS-232 processing”, so a modem transfer carries on while a BASIC program runs.

Timers

Each timer is a 16-bit counter that counts down from a value held in a latch. In one-shot mode it counts down once, raises an interrupt, reloads and stops; in continuous mode it keeps repeating. Counting the processor clock, one timer can measure anything from a millionth of a second to about a fifteenth, as Mapping puts it. For longer periods, Timer B can count Timer A’s underflows instead, making a 32-bit timer. Timer A can also count pulses on the chip’s CNT pin, and Timer B can count CNT pulses or Timer A underflows while CNT is high.

A timer can drive a pin by itself. A control bit puts Timer A’s output on port B bit 6 and Timer B’s on bit 7, as either a one-cycle pulse or a toggle on each underflow. The data sheet says this “overrides the DDRB control bit and forces the appropriate PB line to an output”.

The C64 uses CIA 1’s timers for the KERNAL’s regular interrupt and, during tape loading and saving, for timing the signal; Mapping notes that “reading and writing to the cassette uses both CIA #1 Timer A and Timer B”.

Setting a timer running takes three steps:

Write the start value to the timer’s low and high bytes ($DC04, $DC05 for CIA 1 Timer A). This loads the latch; if the timer is stopped, writing the high byte also loads the counter.
Enable its interrupt in the interrupt control register, if one is wanted.
Write the control register ($DC0E for Timer A): bit 0 starts the timer, bit 3 chooses one-shot, and bit 4 forces the latch into the counter.

Interrupt control

Each chip has five interrupt sources: Timer A, Timer B, the time-of-day alarm, the serial register and the /FLAG pin. They share one address with two different jobs.

Reading it returns which events have happened, with bit 7 set if any of them caused an interrupt. The read also clears it. The data sheet warns that “polling the IR bit will cause the DATA register to clear”, so a program that tests more than one bit has to save the value first.

Writing it changes the mask, using bit 7 to say whether the other bits set or clear. With bit 7 at 0, every bit written as 1 is cleared; with bit 7 at 1, every bit written as 1 is set; bits written as 0 are left alone. So POKE 56333,127 disables every CIA 1 interrupt and POKE 56333,129 turns Timer A’s back on. Mapping warns against trying the first from BASIC’s direct mode, since it stops the keyboard scan and “will in effect turn off the keyboard”.

Time-of-day clock

The time-of-day clock does not count the processor clock. The data sheet says it “requires an external 60 Hz or 50 Hz (programmable) TTL level input on the TOD pin”, and control register A’s bit 7 chooses which. On the C64 that signal comes from the mains. The Transactor’s 1985 tour of the C64’s circuit board traced it: the 9 volt AC supply from the power pack is “the source of the 60 Hz signal used by the time-of-day (TOD) clock”, squared up by a logic gate and fed to both CIAs. The SX-64 portable has a switching power supply and no AC line, so, the magazine noted, it carries “an additional oscillator circuit, including another crystal” just to supply the TOD signal.

The clock keeps tenths, seconds, minutes and hours in four registers, each in binary-coded decimal, so each nybble is one decimal digit, with an AM/PM flag in bit 7 of the hours register. An alarm shares the same four addresses: with control register B’s bit 7 set, writes go to the alarm instead of the clock, and a match raises an interrupt.

Reading the time has a trap. So that the minutes cannot roll over between reading the hours and reading the minutes, all four registers freeze when the hours register is read, and stay frozen until the tenths register is read. The clock keeps counting underneath. Mapping spells out the consequence: “anytime you read hours, you must follow it by reading tenths of seconds, even if you don’t care about them, or else the registers will not continue to update.” Writing works the same way: a write to the hours stops the clock until the tenths are written.

The C64’s own software barely uses it. Mapping found only one use in the operating system, the seed for BASIC’s RND(0), but recommended it for game timers, because unlike the jiffy clock kept by the interrupt routine it is not disturbed when disk or tape activity stops the interrupt.

Handshaking and /FLAG

Port B can signal other hardware on its own. The /PC output goes low for one cycle after any read or write of port B, which can mean “data ready” or “data accepted”. The /FLAG input sets an interrupt bit on any falling edge. On CIA 2 it is on the user port. On CIA 1 it is connected to the cassette read line: Commodore’s service manual traces the tape signal from the cassette port to CIA 1’s /FLAG pin, so each pulse from the tape raises a CIA 1 interrupt. The Programmer’s Reference Guide adds the serial bus’s service request line to the same input.

6526, 6526A and 8521

Chips marked 6526, 6526A and 8521 all appear in C64s. Commodore’s own documents say little about how they differ. The 6526 data sheet treats the A suffix as a speed grade, 2 MHz against 1 MHz. Commodore’s 1992 service manual lists a 6526 in both CIA positions, even on board assembly 250469, the C64C board that carries the 8500 processor. A Commodore Tech Topics service bulletin warned dealers that the C64 diagnostic cartridge wrongly reported a fault in CIA U2 when an 8521 had been fitted in manufacturing.

Programmers found the difference that matters by testing. On the older chips a timer’s interrupt arrives one clock cycle later than on the newer ones, and Codebase64 publishes a routine that tells the two apart by whether an extra instruction runs before the interrupt. The VICE emulator lets the user choose between an “old 6526” and a “new” CIA, which its documentation calls both the 8521 and the 6526A, because cycle-exact programs can depend on the difference.

Sources

Commodore, Commodore 64 Programmer’s Reference Guide (1982): video bank selection and the character ROM, pp. 101–102; the IRQ vector called every 1/60th of a second, p. 307; CIA 1 and CIA 2 memory map, pp. 328–333 (joystick bits, /FLAG inputs, TOD frequency bit, $DD00 bits); game ports, pp. 343–344; RS-232 and NMIs, pp. 347–348; Appendix M, “6526 Complex Interface Adapter (CIA) Chip Specifications”, pp. 419–433 (features, handshaking, timers, PB6/PB7 output, time-of-day clock and its latching, serial port, interrupt control).
Commodore Semiconductor Group, 6526 Complex Interface Adapter (CIA) data sheet, ordering information (no suffix 1 MHz, A 2 MHz); read in the re-typeset edition at archive.6502.org/datasheets/mos_6526_cia_recreated.pdf.
Sheldon Leemon, Mapping the Commodore 64 (COMPUTE! Publications, 1984), pp. 172–197: register names, timer range, keyboard matrix and scanning, RESTORE and SHIFT LOCK, joystick and keyboard conflicts, paddles, cassette timing, TOD latching and RND(0), interrupt control, CIA 2 on NMI, $DD00 and $DD01 bits, /FLAG on user port pin B and on the cassette read line.
Commodore, C64/C64C Service Manual (March 1992, PN-314001-03): cassette read data to CIA 1’s FLAG input; serial bus on CIA 2’s port A; parts list for board assembly 250469.
Chris Zamara, “Inside the Commodore 64”, The Transactor vol. 5 no. 5 (March 1985), pp. 51–56: the 9 V AC supply as the TOD clock source; the SX-64’s extra oscillator; CIA 2 timers and NMIs.
The TORPET issue 9 (April 1982): the 6526 announced with the Commodore 64.
Commodore Tech Topics (Commodore Business Machines dealer service bulletin), “C64 Diagnostic Revisions”: the 8521 fitted during manufacturing.
VICE manual, CIA1Model and CIA2Model settings, and the x64sc -help text for -ciamodel (web, secondary): “old 6526” and “new 6526A” or “new 8521”. https://vice-emu.sourceforge.io/
Tekla S. Perry and Paul Wallich, “Design case history: the Commodore 64”, IEEE Spectrum, vol. 22 no. 3, March 1985 (read in the version republished at spectrum.ieee.org): Charpentier on the 6522 and 6526 shift registers.
White Flame, Bitbreaker and TWW, “Detecting 6526 vs 6526A CIA chips”, Codebase64 wiki (web, secondary): “The older 6526 triggers one cycle later”. https://codebase.c64.org/doku.php?id=base:detecting_6526_vs_6526a_cia_chips