Difference between revisions of "Z80"

Latest revision as of 05:21, 30 April 2025

Zilog Z80A

The Z80 is an 8-bit microprocessor designed by Zilog founder and CEO Federico Faggin. It is a successor of the Intel 8080, also designed by Federico Faggin. First released in July 1976, this CPU is used in the Amstrad CPC / Plus / PCW computers.

The Z80/Z80A was a very popular microprocessor, used in a wide range of applications, from gaming consoles like the ColecoVision, the Sega Master System and Sega GameGear to personal computers like the ZX81, ZX Spectrum and MSX.

It was used in the Commodore C128 as a secondary processor in order to achieve CP/M compatibility. Similarly, the Acorn Z80 Second Processor expansion for the BBC Micro enabled CP/M compatibility. And the popular Z-80 SoftCard expansion did the same for the Apple II.

The best-selling devices to feature a Zilog Z80 are the Sega MegaDrive with 40 million units sold Source, and the TI graphing calculators with 90 million units sold Source.

Although there were definitely other CPUs in use in the 1980s, the vast majority of microcomputers people had at home or at the office used either a MOS 6502 (or one of its variants), a Zilog Z80, an early member of the Intel 8086 family, or a Motorola 68000.

History

In the early 1970s, Intel developed the 8080, one of the first widely used microprocessors. However, a group of engineers led by Federico Faggin, the originator of the 8080 architecture in early 1972, left Intel to start their own company called Zilog in 1974.

At Zilog, Faggin and his team wanted to create an improved version of the Intel 8080 that would be more efficient, flexible, and easier to use. This led to the development of the Z80, which was designed to be both backward-compatible with the 8080 and more powerful. This compatibility meant that any software written for the 8080 could run on the Z80, making it an attractive upgrade for manufacturers and developers.

The Z80 had several key improvements over the 8080. It featured more registers, block instructions, bitwise ops, indexed addressing, and improved interrupt handling. It also had built-in memory refresh for dynamic RAM, that made it easier to build systems around it.

Description

The Z80 microprocessor is an 8-bit CPU with a 4-bit ALU and a 16-bit address bus capable of direct access to 64KB of memory space. The Z80 is a little-endian CPU, meaning it stores 16-bit values with the least significant byte first, followed by the most significant byte.

The Z80 instruction set is really 3 separate subsets each occupying 256 opcode ‘slots’. The main and CB subsets each occupy the full range of 256 instructions, while the ED subset is mostly empty and only implements 59 instructions. DD and FD instruction prefixes are not counted as they are just modifiers. This means there are 571 unique instructions in the Z80 instruction set.

Although it lacks the raw processing power of processors like the Intel 80x86 or the Motorola 68000 series, the Z80 is extremely useful for low cost control applications.

The Z80 has about 8500 transistors. To put it into perspective, 64KB of DRAM contains 524288 transistors, as 1 bit of DRAM needs 1 transistor. Fun fact: an Amstrad CPC equipped with a 4MB RAM expansion has 32 million transistors dedicated to RAM while the Z80 CPU still has only 8500 transistors.

The Z80 is mid-1970s technology while the 64KB DRAM is early-1980s technology and the 4MB DRAM is early-1990s technology.

The Z80 comes in a 40-pin DIP package. It has been manufactured in A, B, and C models, differing only in maximum clock speed. It also has been manufactured as a stand-alone microcontroller with various configurations of on-chip RAM and EPROM.

Register File

While the ALU is responsible for most flag changes, other instructions like stack operations (POP AF), specific register loads (LD A,I/R), direct flag commands (SCF, CCF), bit tests (BIT), and the control logic within block instructions also modify the flag register.

Internal State

 On Zilog NMOS Z80, when the instruction doesn't compute new flags, this register is cleared instead. But not on NEC NMOS Z80. And CMOS Z80 behave in a different way too.
 Normally, you never see the content of this register. But it leaks through F5 and F3 in the SCF/CCF instructions. Source
 Only 1 extra bit (F-changed) is needed for emulation Source. Also note that while POP AF and EX AF,AF' modify F, they do not compute new flag values. Source

Notes:

• EIP and IMP can be fusioned into a 3-bit internal state as there are only 7 possible values for the prefixes (none, ed, dd, fd, cb, ddcb, fdcb). Probably not a win though as it makes everything more confusing.
• IFF1 / IFF2 are called IEF1 / IEF2 (Interrupt Enable Flip-flops) in the Zilog eZ80 manual.

Addressing Modes

Many instructions, such as arithmetic instructions or loads, include more than one operand. In these cases, two different types of addressing can be employed in the same instruction.

For example, LD (HL),42 uses Immediate Addressing to specify the source and Register Indirect Addressing to specify the destination, to perform the operation: M(HL) ← 42.

Instruction Execution Sequence

For an instruction to fully execute, the Z80 goes through these key phases in order:

1. Prefix and Opcode Fetch (M1)
2. Operand Fetch (if needed)
3. Memory Read / I/O Read (if needed)
4. Operation
5. Memory Write / I/O Write (if needed)
6. At the end of every instruction, the IRQ (if IFF1 is active) and NMI pins are checked
7. Loop (for block instructions only)

For example, the instruction RL (IX+42) will execute as follow:

1. M1 (4 t-states): Prefix fetch &DD then increment PC
2. M1 (4 t-states): Opcode fetch &CB (the second prefix) then increment PC
3. M2 (3 t-states): Operand fetch 42 (the displacement byte) then increment PC
4. M3 (5 t-states): Operand fetch &16 (the real opcode) then increment PC, while calculating the address IX+42
5. M4 (4 t-states): Memory read at address IX+42 then RL operation
6. M5 (3 t-states): Memory write at address IX+42

Z80 Instructions

Legend

Flags

• - = no change
• + = change by definition (if noted, by the operation marked with '=> flags', otherwise by the only non-single-bit operation):

* S = sign, bit 7 of the result byte (accumulator or high byte for 16-bit operations)
* Z = zero, set if the result is zero (8 or 16-bit value)
* 5 = undocumented, bit 5 of the result byte
* H = half-carry, the carry (theoretical bit 4) of the low nibble of the result byte
* 3 = undocumented, bit 3 of the result byte
* P = parity (set if the result byte has an even number of bits set) or overflow (set when crossing the boundary of the signed range); always specified
* N = negative, set if the previous operation was a subtraction; always specified
* C = carry, the theoretical bit 8 of the result byte

• 0 = always reset
• 1 = always set
• X = change described under effect
• P = parity (only for the parity flag)
• V = overflow (only for the parity flag)

Registers

• r,r̃: 000=B, 001=C, 010=D, 011=E, 100=H, 101=L, 111=A (110 is treated separately)
• s,s̃: 000=B, 001=C, 010=D, 011=E, 100=IXH/IYH, 101=IXL/IYL, 111=A (110 is treated separately)
• pp: 00=BC, 01=DE, 10=HL, 11=SP
• p̃p̃: 00=BC, 01=DE, 10=HL, 11=AF
• qq: 00=BC, 01=DE, 10=IX/IY, 11=SP
• q̃q̃: 00=BC, 01=DE, 10=IX/IY, 11=AF

Miscellaneous

• () = indirection
• (()) = I/O port
• [] = operator precedence (to avoid confusion with indirection)
• e.b = the bth bit of the value of expression e
• * = any bit value (0 or 1)
• wz = an internal 16-bit register connected to 16-bit operations
• tmp, tmp2 = temporary storage whose value is thrown away after each instruction

M-Cycle Sequences have been deduced logically and verified on real hardware. See Arduino Z80 dongle bus activity dump.

Load group

16-bit Arithmetic group

8-bit ALU group

Note: Arithmetic operations ADD, ADC, SUB, SBC, CP calculate flags in the same way. Logic operations AND, XOR, OR calculate flags in the same way.

Note2: INC/DEC are meant to be used for loops and counters. They don't modify CF, to allow loops and counters to increment/decrement without disturbing carry-sensitive logic.

BCD group

if hf or [a and 0x0f > 9] then tmp -= 0x06
if cf or [a > 0x99] then tmp -= 0x60

if hf or [a and 0x0f > 9] then tmp += 0x06
if cf or [a > 0x99] then tmp += 0x60

ROT group

Note: All ROT operations calculate flags in the same way, except for 8080-style ROT operations (RLCA, RRCA, RLA, RRA).

Bitwise group

Block group

Note: The INI instruction has incorrect timing in the official Zilog manual Source.

I/O group

Control flow group

CPU control group

Interrupt Acknowledge

M-cycles and T-states

In the Z80, M-cycles represent high-level execution cycles for an instruction, while T-states are individual clock cycles. Each M-cycle consists of several T-states, and instructions require one or more M-cycles.

M-cycles can be classified as follows:

• Opcode Fetch (aka M1 cycle): this is always the first (and sometimes only) machine cycle in an instruction (4 T-states)
• Memory Read: read a byte from memory (3 T-states)
• Memory Write: write a byte to memory (3 T-states)
• IO Read: read a byte from an IO port (4 T-states)
• IO Write: write a byte to an IO port (4 T-states)
• Interrupt Acknowledge: special M-cycle which is executed at the start of maskable interrupt handling
• Extra: many instructions contain extra T-states necessary for computations. In the official CPU documentation, these are sometimes identified as a separate M-cycle, and sometimes just lumped together with other M-cycle types. For example:
  • The INC pp instruction has only one M-cycle, but consisting of 6 T-states instead of the usual 4.
  • The instruction RST t has an M1 cycle consisting of 5 T-states instead of the usual 4.
  • The CALL cc,nn instruction has an extra T-state inserted in M3 depending if cc is true or not.

Every place the Z80 manual shows a memory read taking more than 3 clocks, or an opcode fetch/decode taking more than 4 clocks, it should be interpreted as "standard read or fetch cycle with (n - 3) or (n - 4) internal operations after". Source

Note: 0=Active, 1=Inactive, Z=High Impedance

Timing Diagrams

• 

  Basic CPU Timing

• 

  Opcode Fetch

• 

  Memory Read or Write

• 

  Input or Output

• 

  Interrupt Request

• 

  NMI Request

• 

  Bus Request

• 

  HALT Exit

Opcode fetches are compressed into just 2 clocks; the second 2 clocks of an M1 cycle are DRAM refresh, in which the Z80 puts the contents of the R register on the address bus and then increments the lower 7 bits of R.

Since opcode fetches require the memory to respond faster than normal read/write cycles do, some machines (like the MSX) have an externally-inserted wait state only on M1 cycles. Source

CPC Timings

On MSX, bus arbitration only applies to M1 machine cycles but access to VRAM has other limitations. On ZX Spectrum, bus arbitration is done not by using the /WAIT pin but by disabling the CPU clock when needed.

On CPC, bus arbitration occurs on every CPU bus access. The Gate Array asserts the /WAIT pin on the Z80 for 3 out of every 4 cycles, effectively aligning all bus operations to a 4-tick cycle. The Z80 extends T2 indefinitely by adding wait states until /WAIT is released.

The NOPs column corresponds to CPC timings, which account for the bus arbitration. The NOP instruction takes 4 cycles. This is the minimum amount of cycles an instruction can take.

Every M-cycle that involves a memory or I/O access will stretch the previous M-cycle due to bus arbitration. But beware, some M-cycles are purely internal and don't involve a memory or I/O access. So those won't stretch the previous M-cycle.

Nevertheless, a few CPC timings can appear surprising at first glance:

• Instructions LD (IX+d),r and LD (IX+d),n take 5 and 6 NOPs respectively, even though they are both listed as 19 (4,4,3,5,3) cycles in the datasheet. This happens because LD (IX+d),r has one less memory access operation to do compared to LD (IX+d),n as it does not have to fetch its operand from memory.

• Instructions IN r,(C) and OUT (C),r take 4 NOPs with CPC timings, even though they are listed as 12 (4,4,4) cycles in the datasheet. This happens because I/O access is not aligned with memory access. On Zilog manual, it is precised that one wait-state TW is automatically inserted after T2 on I/O access.

The CPC timings of some instructions will be altered if an interrupt happens. The interrupt test occurs on the last T-state of the instruction, and if it's low, the Z80 will insert 2 wait states to acknowledge the interrupt.

So, instructions which end in the third or fourth T-state relative to the read alignment for the next instruction fetch will be delayed by an extra 4 T-states. The few instructions which end in the first or second T-state won't since the first instruction fetch/read in the interrupt won't be delayed an extra 4 T-states. Source

Opcodes

The Z80 follows a 2-3-3 opcode bit pattern. Register instructions normally use three bits to specify the register used: 000=B, 001=C, 010=D, 011=E, 100=H, 101=L, 110=indirect through HL, 111=A.

Register pairs are encoded as: 00=BC, 01=DE, 10=HL, 11=SP. The PUSH and POP instructions use a slightly different encoding: 00=BC, 01=DE, 10=HL, 11=AF.

Three bits are used to specify condition codes: 000=NZ (Non Zero), 001=Z (Zero), 010=NC (Non Carry), 011=C (Carry), 100=PO (Parity Odd), 101=PE (Parity Even), 110=P (Plus), 111=M (Minus). The JR instruction only decodes the 2 lower bits of the condition code.

Condition C (carry) is unrecognizable from register C. To recognize which it is, conditions (flags) are used only in instructions: CALL, JR, JP, RET.

All CB-prefixed opcodes and half of the standard opcodes (from &40 to &BF) follow a strict uniform layout. The sole exception is the HALT instruction (opcode &76), which replaces the expected LD (HL),(HL) instruction.

The rest of the opcode table is also neatly organised but in a horizontal way instead of vertical.

Any instruction in bold is undocumented by Zilog.

Standard opcodes