WDC 65C02

The 65C02 is a low cost, general-purpose 8-bit microprocessor (8-bit registers and data bus) with a 16-bit program counter and address bus. The register set is small, with a single 8-bit accumulator (A), two 8-bit index registers (X and Y), an 8-bit status register (P), and a 16-bit program counter (PC). In addition to the single accumulator, the first 256 bytes of RAM, the "zero page" ($0000 to $00FF), allow faster access through addressing modes that use an 8-bit memory address instead of a 16-bit address. The stack lies in the next 256 bytes, page one ($0100 to $01FF), and cannot be moved or extended. The stack grows downward with the stack pointer (S or SP) starting at $01FF and decrementing with each byte that is pushed.^[3] The 65C02 has a variable-length instruction set, varying between one and three bytes per instruction.^[1]

The basic architecture of the 65C02 is identical to the original 6502, and may be considered a low-power implementation of that design. At 1 MHz, the most popular speed for the original 6502, the 65C02 requires only 20 mW, while the original uses 450 mW, a reduction of over twenty times.^[4] The manually optimized core and low power use is intended to make the 65C02 well suited for low power system-on-chip (SoC) designs.^[1]

A Verilog hardware description model is available for designing the W65C02S core into an application-specific integrated circuit (ASIC) or a field-programmable gate array (FPGA).^[5] As is common in the semiconductor industry, WDC offers a development system, which includes a developer board, an in-circuit emulator (ICE) and a software development system.^[6]

The W65C02S6T is the production version as of 2025^[update], and is available in PDIP-40, PLCC-44 and QFP-44 packages. The maximum officially supported Ø2 (primary) clock speed is 14 MHz when operated at 5 volts, indicated by a –14 part number suffix (hobbyists have developed 65C02 homebrew systems that run significantly faster than the official rating). The "S" designation indicates that the part has a fully static core, a feature that supports stopping the Ø2 clock in either phase with no loss of state.^[7]  Typical microprocessors not implemented in CMOS have dynamic cores and will lose state (and thus crash) if they are not continuously clocked at a rate between some minimum and maximum specified values.

The "6T" designation indicates the process geometry (0.6µ) and that Taiwan Semiconductor Manufacturing Company (TSMC) is the foundry that produces WDC's wafers.

• 8-bit data bus.
• 16-bit address bus (providing an address space of 64 KB).
• 8-bit arithmetic logic unit (ALU).
• 8-bit processor registers:
  • accumulator.
  • stack pointer.
  • index registers.
  • status register.
• 16-bit program counter.
• 69 instructions, implemented by 212 operation codes.
• 16 addressing modes, including zero page addressing.

• Vector pull (VPB) output indicates when interrupt vectors are being addressed.
• Memory lock (MLB) output indicates to other bus masters when a read-modify-write instruction is being processed.
• WAit-for-Interrupt (WAI) and SToP (STP, stop-the-clock) instructions reduce power consumption, decrease interrupt latency and enable synchronization with external events.

• Supply voltage specified at 1.71 V to 5.25 V.
• Current consumption (core) of 0.15 and 1.5 mA per MHz at 1.89 V and 5.25 V respectively.
• Variable length instruction set, enabling code size optimization over fixed length instruction set processors, results in power savings.
• Fully static core allows stopping the clock to conserve power.

The W65C02S may be operated at any convenient supply voltage (V_DD) between 1.8 and 5 volts (±5%). The data sheet AC characteristics table lists operational characteristics at 5 V at 14 MHz, 3.3 V or 3 V at 8 MHz, 2.5 V at 4 MHz, and 1.8 V at 2 MHz.  This information may be an artifact of an earlier data sheet, as a graph indicates that typical devices are capable of operation at higher speeds than suggested by the AC characteristics table, and that reliable operation at 20 MHz should be readily attainable with V_DD at 5 volts, assuming the supporting hardware will allow it.

The W65C02S support for arbitrary clock rates allows it to use a clock that runs at a rate ideal for some other part of the system, such as 13.5 MHz (digital SDTV luma sampling rate), 14.31818 MHz (NTSC colour carrier frequency × 4), 14.75 MHz (PAL square pixels), 14.7456 (serial bit rate crystal), etc., as long as V_DD is sufficient to support the frequency. Designer Bill Mensch has pointed out that F_MAX is affected by off-chip factors, such as the capacitive load on the microprocessor's pins. Minimizing load by using short signal tracks and fewest devices helps raise F_MAX.  The PLCC and QFP packages have less pin-to-pin capacitance than the PDIP package, and are more economical in the use of printed circuit board space.

WDC has reported that FPGA realizations of the W65C02S have been successfully operated at 200 MHz.^{[citation needed]}

Although the 65C02 can mostly be thought of as a low-power 6502, it also fixes several bugs found in the original and adds new instructions, addressing modes and features that can assist the programmer in writing smaller and faster-executing programs. It is estimated that the average 6502 assembly language program can be made 10 to 15 percent smaller on the 65C02 and see a similar improvement in performance, largely through avoided memory accesses through the use of fewer instructions to accomplish a given task.^[1]

The original 6502 has 56 instructions, which, when combined with different addressing modes, produce a total of 151 opcodes of the possible 256 8-bit opcode patterns. The remaining 105 unused opcodes are undefined, with the set of codes with low-order 4-bits with 3, 7, B or F left entirely unused, the code with low-order 2 having only a single opcode.^[8]

On the 6502, some of these leftover codes actually perform computation. Due to the way the 6502's instruction decoder works, simply setting certain bits in the opcode causes parts of the instruction processing to take place. Some of these opcodes immediately crash the processor, while other perform useful functions and were even given unofficial assembler mnemonics by some programmers.^[9]

The 65C02 adds new opcodes that use some of these previously undocumented instruction slots. For example, $FF is used for the new BBS instruction. Those which remain truly unused are equivalent to NOPs. 6502 programs using those opcodes will not work on the 65C02.^[1]

A flaw that is present in all NMOS variants of the 6502 involves the jump instruction when using indirect addressing. In this addressing mode, the target address of the JMP instruction is fetched from memory, the jump vector, rather than being an operand to the JMP instruction. For example, JMP ($1234) would fetch the value in memory locations $1234 (least significant byte) and $1235 (most significant byte) and load those values into the program counter, which would then cause the processor to continue execution at the address stored in the vector.

The flaw, which some consider a bug, appears when the vector address ends in $FF, which is the boundary of a memory page. In this case, JMP will fetch the most significant byte of the target address from $00 of the original page rather than $00 of the new page. Hence JMP ($12FF) would get the least significant byte of the target address at $12FF and the most significant byte of the target address from $1200 rather than $1300. The original 6502 documentation does not state that the address will cross pages in this fashion, so one cannot consider it to be a bug per-se. But many 6502 users perceived this complication to be a weakness, so it was eliminated in the 65C02 at the cost of spending another cycle to update the pointer.^[1]

Another by-design weakness that was revised by popular demand, the state of the (D)ecimal flag in the NMOS 6502's status register is undefined after a reset or interrupt. This means programmers have to set the flag to a known value in order to avoid random errors caused by arithmetic operations performed in the mode other than the one intended, constituting software bugs. As a result, one finds a CLD instruction (CLear Decimal) in almost all 6502 interrupt handlers, as well as early in the reset code. The 65C02 automatically clears this flag after pushing the status register onto the stack in response any interrupt or in response to a hardware reset, thus placing the processor back into binary arithmetic mode.^[10] This usually saves a few bytes in the software and eliminates the possibility of a common programming mistake, at the cost of increasing the size of code that runs in decimal mode as programmers have to remember to SED in places they previously assumed it would still be set.

During decimal mode arithmetic, the NMOS 6502 will put the (N)egative, o(V)erflow and (Z)ero flags into officially undefined states. Programmers found that the CPU updates these three flags to reflect the result of underlying binary arithmetic, that is, the flags reflect a result computed prior to the processor performing decimal correction. In contrast, the 65C02 sets these flags according to the result of decimal arithmetic, at the cost of an extra clock cycle per arithmetic instruction.^[10] Some writers assert that the V flag on the 65C02 is still incorrect in decimal mode, but the flag may also be considered to be meaningless because decimal arithmetic is always unsigned.

When executing a read-modify-write (R-M-W) instruction, such as INC addr, all NMOS variants will do a double write on addr, first rewriting the current value found at addr and then writing the modified value. This behavior can result in difficult-to-resolve bugs if addr is a hardware register. This may occur if the hardware is watching for changes to the value in the register and then performs an action, in this case, it will perform two actions, one with the original value and then again with the new value. The 65C02 instead performs a double read of addr, followed by a single write.

When performing indexed addressing, if indexing crosses a page boundary all NMOS variants will read from an invalid address before accessing the correct address. As with a R-M-W instruction, this behavior can cause problems when accessing hardware registers via indexing. The 65C02 fixed this problem by performing a dummy read of the instruction opcode when indexing crosses a page boundary. However, this fix introduced a new bug^{[citation needed]} that occurs when the base address is on an even page boundary (which means indexing will never cross into the next page). With the new bug, a dummy read is performed on the base address prior to indexing, such that LDA $1200,X will do a dummy read on $1200 prior to the value of X being added to $1200. Again, if indexing on hardware register addresses, this bug can result in undefined behavior.

If an NMOS 6502 is fetching a BRK (software interrupt) opcode at the same time a hardware interrupt occurs, the BRK will be ignored as the processor reacts to the hardware interrupt. The 65C02 correctly handles this situation by servicing the interrupt and then executing BRK.

The 6502 has two indirect addressing modes which dereference through 16-bit addresses stored in page zero:

• Indexed indirect e.g. LDA ($10,X). Adds the X register to the given page zero address before reading the 16-bit vector. In this example, if X is 5 then the 16-bit address is read from locations $15/$16. This is useful when there is an array of pointers in page zero.
• Indirect indexed e.g. LDA ($10),Y. Adds the Y register to the 16-bit vector read from the given page zero address. In this example, if Y is 5 and locations $10/$11 contain the vector $1000 then the read address will be $1005. This performs pointer-offset addressing.

A downside of this model is that if indexing is not needed but the address is in the zero page, one of the index registers must still be set to zero and used in one of these instructions. Therefore the 65C02 adds a non-indexed indirect addressing mode, e.g. LDA ($10), to all instructions that can use indexed indirect and indirect indexed modes. This leaves the index registers free for other uses.^[11]

The 6502's JMP instruction has a unique (among 6502 instructions) addressing mode known as "absolute indirect" that reads a 16-bit value from a given memory address and then jumps to the address in that 16-bit value. For instance, if memory location $A000 holds $34 and $A001 holds $12, JMP ($A000) will read those two bytes, construct the value $1234, and then jump to that location.

One common use for indirect addressing is to build branch tables, a list of entry points for subroutines that can be accessed using an index. For instance, a device driver might list the entry points for OPEN, CLOSE, READ, etc in a table at $A000. READ is the third entry, zero indexed, and each address requires 16-bits, so to call READ one would use something similar to JMP ($A004). If the driver is updated and the subroutine code moves in memory, any existing code will still work as long as the table of pointers remains at $A000.

The 65C02 adds the new "indexed absolute indirect" mode which eases the use of branch tables. This mode adds the value of the X register to the absolute address and takes the 16-bit address from the resulting location. For instance, to access the READ function from the table above, one stores 4 in X, then executes JMP ($A000,X). This style of access makes accessing branch tables simpler as a single base address is used in conjunction with an 8-bit offset.^[11] The same can be achieved in the NMOS version using indexed indirect mode, but only if the table is in the zero page, a limited resource. Allowing these tables to be constructed outside zero page not only lessens the demand for this resource but also allows the tables to be placed in ROM.

In addition to the new addressing modes, the "base model" 65C02 also adds a set of new instructions.^[12]

• INC and DEC with no parameters now increment or decrement the accumulator. This was an odd oversight in the original instruction set, which only included INX/DEX, INY/DEY, and INC addr/DEC addr. Some assemblers use the alternate forms INA/DEA or INC A/DEC A.^[12]
• STZ addr, STore Zero in addr, replaces the need to LDA #0;STA addr and doesn't require changing the value of the accumulator. As this task is common in most programs, using STZ can reduce code size, both by eliminating the LDA as well as any code needed to save the value of the accumulator, typically a PHA PLA pair.^[13]
• PHX,PLX,PHY,PLY push and pull the X and Y registers to and from the stack. Previously, only the accumulator and status register (P) had push and pull instructions. X and Y could be stacked only by moving them to the accumulator first with TXA or TYA, thereby changing the accumulator contents, then using PHA.^[14]
• BRA, branch always, operates like a JMP but uses a 1-byte relative address like other branches (which all are conditional), saving a byte. The speed is often the same as the 3 cycle absolute JMP unless a page is crossed which would make the BRA version 1 cycle longer (4 cycles).^[15] As the address is relative, it is also useful when writing relocatable code.^[13]

Both WDC and Rockwell contributed improvements to the bit testing and manipulation functions in the 65C02. WDC added new addressing modes to the BIT instruction that was present in the 6502, as well two new instructions for convenient manipulation of bit fields, a common activity in device drivers.

BIT in the 65C02 adds immediate mode, zero page indexed by X and absolute indexed by X addressing.^[12] Immediate mode addressing is particularly convenient in that it is completely non-destructive. For example:

LDA $1234

BIT #%00010000

may be used in place of:

LDA $1234

AND #%00010000

The AND operation changes the value in the accumulator, so the original value loaded from $1234 is lost. Using BIT leaves the value in the accumulator unchanged, so subsequent code can make additional tests against the original value, avoiding having to re-load the value from memory.

In addition to the enhancements of the BIT instruction, WDC added two instructions designed to conveniently manipulate bit fields:

• TSB addr and TRB addr, Test and Set Bits and Test and Reset Bits.

A mask in the accumulator (.A) is logically ANDed with memory at addr, which location may be zero page or absolute. The Z flag in the status register is conditioned according to the result of the logical AND—no other status register flags are affected. Furthermore, bits in addr are set (TSB) or cleared (TRB) according to the mask in .A. After the logical AND, TSB performs a logical OR of .A with the memory byte and stores the result at addr, whereas TRB instead performs a logical AND of NOT .A with the memory byte and stores the result at addr. In both cases, the Z flag in the status register indicates the result of .A AND addr before the content of addr is changed. The other flags are not affected. TRB and TSB thus replace a sequence of instructions, essentially combining the BIT instruction with additional steps to save the computational changes, but without the additional steps affecting the flags, and without affecting the V flag as BIT does.^[1]

Rockwell's changes added more bit manipulation instructions for any bit in zero page, to directly set or reset a bit with a 2-byte instruction, or to test and branch on a bit with a single 3-byte instruction. The new instructions were available from the start in Rockwell's R65C00 family,^[16] but were not part of the original 65C02 specification and not found in versions made by WDC or its other licensees. These were later copied back into the baseline design, and were available in later WDC versions.

Rockwell-specific instructions are:

• SMBbit# zp and RMBbit# zp. Set or Reset (clear) bit number bit# in zero page byte zp.

RMB and SMB are used to clear (RMB) or set (SMB) individual bits in a bit field, each replacing a sequence of three instructions. As RMB and SMB allow zero page addressing only, these instructions have limited usefulness and are primarily of value in systems in which device registers are present in zero page.^{[citation needed]} The bit# component of the instruction is part of the opcode and is often written as part of the mnemonic, such as SMB1 $12 which sets bit 1 in zero-page address $12 (a/k/a address $0012). Some assemblers treat bit# as part of the instruction's operand, e.g., SMB 1,$12, which has the advantage of allowing it to be replaced by a variable name or calculated number.^[13]

• BBSbit# zp,addr and BBRbit# zp,addr. Branch on Bit Set/Reset.

The same zero-page addressing and limitations as RMB and SMB apply, but these instructions test, rather than assign, the selected bit of the zero page byte zp and then branch to addr if that bit is clear (BBR) or set (BBS). Also as with RMB and SMB above, the bit# component of the instruction is often written as part of the mnemonic, such as BBS1 $12,addr which branches to the address label addr if bit 1 of the byte at zero-page address $12 is set. Again, some assemblers treat bit# as part of the instruction's operand, e.g., BBS 1,$12,addr, with the advantage of allowing it to be replaced by a variable name or calculated number.^[13]

Each of RMB, SMB, BBR, and BBS replaces a sequence of three instructions.^[13]

In addition to the new commands above, WDC also added the STP and WAI instructions for supporting low-power modes.

STP, STop the Processor, halts all processing until a hardware reset is issued. This can be used to put a system to "sleep" and then rapidly "wake" (reactivate) it with a reset.

WAIt has a similar effect, halting all processing, but this instruction resumes normal execution on the reception of an interrupt. Without this instruction, waiting for a hardware interrupt generally involves running a loop suspend the program until interrupt processing breaks out of the loop, sometimes known as "spinning". This means the processor runs during the entire process, using power while doing (almost) nothing, even when no interrupts are occurring. In the 65C02, interrupt code can be written by having a WAI followed immediately by a JSR or JMP to the handler. When the WAI is encountered, processing stops and the processor goes into low-power mode. When an interrupt is received, the processor immediately executes the JSR and handles the request.

This has the added advantage of slightly improving performance. In the spinning case, the interrupt might arrive in the middle of one of the loop's instructions, and to allow it to restart after returning from the handler, the processor spends three cycles to save its location. With WAI, the processor enters the low-power state in a known location where all instructions are guaranteed to be complete, so when the interrupt arrives it cannot possibly interrupt an instruction and the interrupt response can be immediate. Plus, since the program expects the interrupt, the processor can safely continue without spending time saving state; the program is responsible to perform any necessary state-saving before the WAI.

The 65SC02 is a variant of the WDC 65C02 without WAI, STP and bit instructions.^[17][18]

• Apple IIc portable by Apple Computer (NCR 1.023 MHz)^[19]
• Enhanced Apple IIe by Apple Computer (1.023 MHz)
• BBC Master home/educational computer, by Acorn Computers Ltd (2 MHz 65SC12 plus optional 4 MHz 65C102 second processor)^[20]
• Replica 1 by Briel Computers, a replica of the Apple I hobbyist computer (1 MHz)
• Laser 128 series clones of Apple II^[21]
• KIM-1 Modern Replica of the MOS/CBM KIM-1 by Briel Computing

• Atari Lynx handheld (65SC02 @ ~4 MHz)
• PC Engine aka TurboGrafx-16 (HuC6280 @ 7.16 MHz)^[22]
• GameKing handhelds (6 MHz) by Timetop
• Watara Supervision handhelds (KS5360 (65SC02 core) @ 4 MHz)

• TurboMaster accelerator cartridge for the Commodore 64 home computer (65C02 @ 4.09 MHz)
• Tube-connected second processor for the Acorn BBC Micro home computer (65C02 @ 3 MHz)
• Many dedicated chess computers, e.g. Mephisto MMV, Novag Super Constellation, Fidelity Elite (4–20 MHz)

• Interrupts in 65xx processors
• CSG 65CE02, a further enhanced version of the 65C02