Nintendo NES-001 - Entertainment System Game Console Operator's manual

Nintendo Entertainment
System Documentation
Version 1.0
August 2004
Patrick Diskin

2
Preface
Abstract
The Nintendo Entertainment System (NES) was the world’s most widely used videogames
console during the 1980s. From its initial release in 1983 until it was discontinued in 1995 the
console brought gaming into more homes than ever before and paved the way for the
videogame industry as it stands today.
Although technology has improved dramatically since the NES, many excellent games were
only released on that format and so are unplayable on more modern systems. However
these games have been able to survive and continue to be played thanks to emulation, which
simulates the workings of one system in order to allow software created for it to be used on a
modern system.
This document describes both the hardware in the NES and some of the devices used with it.
It also briefly discusses emulation and issues relating to this. Much of the contents of this
document appeared earlier in [1].
The document makes use of the hexadecimal and binary numbering systems. The reader is
assumed to have some knowledge of these numbering systems but a brief explanation of
some issues is presented in Appendix A.
Acknowledgements
The information contained within this document is based on the work of the many others
involved in NES emulation. I would like to acknowledge the authors of all the documents
listed in the References section but particularly:
•Andrew John Jacobs for his invaluable information on the 6502 processor [2], [3] and [4].
•Chris Covell for ‘NES Technical / Emulation / Development FAQ’ [5].
•Firebug for ‘Comprehensive NES Mapper Document’ [6].
•Jeremy Chadwick for ‘Nintendo Entertainment System Documentation’ [7].
•Loopy for ‘The Skinny on NES Scrolling’ [8].
•Marat Fayzullin for ‘Nintendo Entertainment System Architecture’ [9].
•Everybody involved with nesdev.parodius.com.

3
1 - Introduction
1.1 Nintendo Entertainment System History
In 1889, Fusajiro Yamauchi founded Nintendo Koppai and began manufacturing Japanese
playing cards, hanafuda, in Kyoto [10]. By 1950, when Hiroshi Yamauchi became president,
Nintendo was a successful manufacturer of both western and Japanese playing cards. In
1963, after several name changes, the company settled on Nintendo Co. Ltd. (NCL). By
1970, the company was producing electronic games and in 1973 they introduced a laser clay
shooting system which they hoped would replace bowling as a major pastime [11].
Nolan Bushnell was a student at the University of Utah when he first had the idea of a coin
operated computer game. Pong, which was released in 1972, quickly became a hit and
inspired the release of a wave of arcade games. Bushnell’s company, Atari, wanted to
replicate this success by releasing a system to play games in homes. By 1976 several
companies had tried, and failed, to release a successful console. Bushnell was aware that
Atari lacked the capital to produce a console and sold the company to Warner
Communications, retaining the position of chairman [12].
In 1977, Atari released the Atari Video Computer System (VCS), an 8-bit console which
succeeded in opening up the home console market, aided by the home version of Space
Invaders, released in 1980. Bushnell disagreed with the direction Warner were taking and left
the company in 1978.
In 1979, Nintendo made their first attempt to break into the arcade game market but by 1981
their success had been limited. Hiroshi Yamauchi asked Nintendo graphic artist, Shigeru
Miyamoto, to design a new game. The result was Donkey Kong in which players controlled a
carpenter called Jumpman and tried to rescue a captive girl from Donkey Kong, a large ape.
Jumpman was renamed Mario after the landlord of Nintendo’s newly created American
subsidiary, later to be called Nintendo of America Inc. (NOA), run by Yamauchi’s son in law,
Minoru Arakawa.
By 1982, third party development had led to several sub-standard games being released for
Atari’s VCS and competition with other consoles was leading to saturation of the market. By
1984 the industry was suffering enormous losses and most product lines were discontinued.
Nintendo, meanwhile, had enjoyed success in the arcade market and in the home market
with the Colour TV Game 6. The Japanese console market was still doing well and Yamauchi
felt that Nintendo could become the market leaders through a combination of quality games
and improved hardware sold at a lower price than competitors (profit would be made on the
games).
Figure 1-1. The Nintendo Entertainment System and the Famicom [13].

4
The Famicom (Family Computer) became an enormous success in Japan and in 1983,
Minoru Arakawa offered Atari the chance to produce the system in America. When it became
clear that Atari did not have the resources to proceed the deal fell through. Atari was divided
up and sold by Warner while Nintendo decided to produce and market the Famicom in
America themselves under the name Nintendo Entertainment System (NES). The console
was also redesigned to appeal to western children as shown in figure 1-1.
Despite early resistance from retailers fearing further losses after the industry crash the
previous year, the NES became available in America in 1985. As a result of strict quality
controls on third party software, combined with Nintendo’s own games (including Super
Mario Bros., The Legend of Zelda and Metroid) the console became a huge success.
In 1987, the NES became the top selling toy in America, while The Legend of Zelda became
the first NES game to achieve sales of one million units. In America alone, revenues for
Super Mario Bros. 3 were in excess of $500 million with over 7 million units sold and 4 million
in Japan [14]. In 1991, Nintendo earned about $1.5 million for each of its 5,000 employees.
The company’s profit in the early 1990s exceeded that of the American film industry. Such
was Nintendo’s effect on American culture that a 1990 survey showed that Mario was more
recognized by children than Mickey Mouse.
Sega released the 16-bit Genesis (Mega Drive in Europe) in 1989 and, due to the success of
Sonic the Hedgehog, the console became very popular. That same year, Nintendo were
busy with the release of their handheld console, the Game Boy but would enter the 16-bit
market with the Super Famicom in 1990. The console was released in America in 1991 as
the Super Nintendo Entertainment System (SNES) and due to incompatibility with the NES
hardware, signalled a move away from the old system.
Figure 1-2. Redesigned NES
released in 1993 [15].
In 1993, Nintendo released a redesigned version of the NES (as shown in figure 1-2) but the
last NES game, Wario’s Woods was released in late 1994 and the system was officially
discontinued in 1995 [16]. By this time over 60 million NES consoles and 500 million games
had been sold worldwide.
The SNES featured a 65816 processor which was largely compatible with the NES’ 6502
processor. However the graphics and sound on the new system were incompatible [5]. This
made it impossible for games created for the old system to run on its successor. As a result
the software created for the NES could no longer be used by people who did not already

5
have a NES, preventing many people from using the software. In addition, all hardware has a
limited lifespan and eventually there will be no working NES consoles to still play the games
on. The games themselves often featured battery backed RAM to enable progress to be
saved and Nintendo only predicted the battery life as five years. There are multiple options
which allow the continued use of NES games and these are described here.
1.2 Conversion
Although the exact implementations of computer systems is different, many of the principles
are the same. A PC cannot execute the instructions written for the NES because it does not
understand them. However, it is likely that comparable instructions do exist for the PC.
Therefore, it is possible to rewrite the software for a different system and to replicate the
graphics and sound of the original. Converting the software in this way is essentially
simulation [17]. The software appears to behave the same as the original but the
implementation may be quite different.
Converting the software has the advantage that the resulting software will perform well, since
it is produced for the target architecture. However, the process is time consuming and needs
to be done for each game individually.
1.3 Emulation
Emulation is the process of simulating hardware to enable the software developed for it to be
used on an otherwise incompatible system. The following definition is by the British
Computer Society and is taken from [18]:
“Emulation is a very precise form of simulation which should mimic exactly the
behaviour of the circumstances that it is simulating. An emulator may enable
one type of computer to operate as if it were a different type of computer.“
Emulation is often used by the videogame industry to allow developers to begin writing
software for a new system before it is released. However, it can also be used to allow the
continuing use of old systems.
Hardware emulation involves producing a system with hardware compatible with the original.
In the case of the NES it would be possible to produce a system using a compatible
processor and to allow it to play the original game cartridges. This technique can also
provide good performance, provided compatibility is ensured, but few people have the skills
and resources required to construct the system.
Using hardware simulation software it is possible to half implement this technique. Software
is available which allows simulation of a detailed hardware design and this can be used to
recreate the system from a design without having to produce a real implementation. Such a
system is described in [19].
Software emulation requires producing software which will emulate the functions of a given
system. There are three approaches to software emulation [17]:
•Interpretation involves reading in the next instruction for the system being emulated,
translating it to an instruction (or a number of instructions) for the target architecture and
executing it. Though this is accurate, due to translating during execution the process can
lead to noticeable degradation of performance compared to the original system if the
speed of the target system is low.

6
•Static translation involves reading in the whole of the source program and translating it
for the target system, producing a program that is executable on that system. However it
is not always possible to determine how a program will execute from a static analysis of
it. Branch instructions, for example, often depend on the contents of memory locations
which can only be determined at run-time [20].
•Dynamic translation works in much the same way as static translation but occurs while
executing the program. This allows it to account for branch and jump instructions and to
produce accurate code [20].
The NES is perhaps the most widely emulated console with a number of emulators already
available of varying quality. Writing a NES emulator remains a very challenging project,
requiring a detailed understanding of how the system works. A fairly comprehensive list of
available NES emulators can be found at [21] although many of these have been
discontinued. The basics of writing an emulator are described by [17] and [22], both of which
focus specifically on the NES.
1.4 Legal
Emulation is considered to be something of a legal grey area. Emulators are not illegal,
provided all the information used in the development is legally obtained and does not contain
any proprietary code. However, it is illegal to run any software which you do not own a
licence for.
Copying NES games is possible with the correct hardware. Such copiers dump the contents
of the game cartridges to a disk to enable access by a computer. There are a wide variety of
copiers, which function in different ways. Figure 1-3 shows ChameleonNES which copies the
contents of a cartridge to a PC via a USB port. Copyright law typically allows for a backup
copy to be made, however this does not apply to games stored on permanent semiconductor
chips such as those used by the NES. These copying devices are illegal.
Figure 1-3. ChameleonNES cartridge copier [23].
Most emulator users download games from the Internet since they do not have access to the
required copying hardware. These websites usually cover themselves with an agreement
that you can only download a file if you own the original game or if you will delete it within 24
hours. This may make the process look legal but, since the copies are illegal, it is clearly not.
Even if the law allowed for making a backup copy of a NES game, copies can only be made
and used by the original owner, so downloading files off the Internet would still be illegal.

7
This only applies to games which were originally made for the NES itself. Many developers
have produced games since which have been released freely on the Internet. Downloading
these is acceptable. As for original NES games, using them will remain illegal until either the
developers grant permission for their use or the copyright expires, which is 75 years after
they were made.
Nintendo are very much against emulation. The company acted against the developers of
UltraHLE [24], an emulator for their Nintendo 64 console, which they claimed violated
copyright. Nintendo’s objection was understandable as the console was still in use when
UltraHLE was released. The presence of Nintendo 64 emulators represented a threat to
Nintendo’s income however, many believe that the law should make an exception for
systems which are no longer in production and from which Nintendo no longer make any
money. Despite emulation’s ability to keep old games alive Nintendo refuse to release the
copyright on old games so their use remains illegal.
For more information on the legal issues of emulation, the reader is directed to Nintendo’s
own FAQ on the subject [25]. This is highly biased and ignores the legal uses of emulation.
For a detailed response and clarification on this, the reader should look at [26].
1.5 NES Hardware Overview
Hiroshi Yamauchi’s instructions to
design a console which would be
cheaper than the competition resulted in
Nintendo deciding to use an outdated
Central Processing Unit (CPU).
Although a 16-bit processor would have
coped with ease, to keep the price low
they decided to use a variant of the 8-bit
6502 processor, developed by MOS
technology in 1975. The chip would be
sufficient to run the programs but would
be unable to generate the graphics
required so the company decided to use
a second chip as a dedicated Picture
Processing Unit (PPU), responsible for
calculating and displaying the graphics.
Figure 1-4 shows the top of the
motherboard with the CPU and PPU
indicated.
Nintendo designed the basic features required from the chips but found it difficult to find a
company willing to produce such highly customised chips for the low price they were looking
for. Ricoh agreed to manufacture the chips after Nintendo guaranteed them a three-million
chip order. By the end of 1986 Nintendo was Ricoh’s largest customer, accounting for
between 60 and 70 percent of the company’s semiconductor sales [10]. The functionality of
the CPU is discussed in Part 2, that of the PPU is discussed in Part 3.
Both chips feature their own internal memory, in the form of RAM. Games were usually
stored on ROM chips within the game cartridges, which could be accessed by the CPU when
the cartridges where inserted into the system. The hardware used for games is discussed in
Part 4.
The NES used memory mapped I/O to allow the processor to communicate with the other
components, the PPU and the input devices. Memory mapped I/O is a technique where data
PPU CPU
Figure 1-4. The NES motherboard [27].

8
can be transferred to a device via a write to a specific location in memory. Input devices are
discussed in Part 5, the function of the memory mapped I/O is discussed throughout the
document and specifically in Appendix B.

9
2 - Central Processing Unit
2.1 2A03 Overview
Ricoh produced an NMOS processor based on the 6502, the 2A03. The chip differed from a
standard 6502 in that it had the ability to handle sound, serving as pAPU (pseudo-Audio
Processing Unit) as well as CPU, and that it lacked a Binary Coded Decimal (BCD) mode
which allowed representing each digit using 4 bits. For the purposes of programming, the
2A03 uses the same instruction set as the standard 6502 which is shown in figure 2-1. The
6502 is a little endian processor which means that addresses are stored in memory least
significant byte first, for example the address $1234 would be stored in memory as $34 at
memory location x and $12 at memory location (x + 1).
Figure 2-1. The 6502 processor [28].
2.2 CPU Memory Map
Figure 2-2 shows how the CPU accesses memory using buses. The memory is divided into
three parts, ROM inside the cartridges, the CPU’s RAM and the I/O registers. The address
bus is used to set the address of the required location. The control bus is used to inform the
components whether the request is a read or a write. The data bus is used to read or write
the byte to the selected address. Note that ROM is read-only and is accessed via a MMC, to
allow bank switching to occur. The I/O registers are used to communicate with the other
components of the system, the PPU and the control devices.
Figure 2-2. Processor diagram.

10
The 2A03 had a 16-bit address bus and as such could support 64 KB of memory with
addresses from $0000-$FFFF. Figure 2-5 is the CPU memory map used by the NES,
showing the layout of memory. The left hand map is a simplified version showing the major
sections, while the map to the right divides these sections further.
Zero Page refers to addresses in the range $0000-$00FF, that is the first page in memory
and is used by certain addressing modes to allow quicker execution [4]. Memory locations
$0000-$07FF are mirrored three times at $0800-$1FFF. This means that, for example, any
data written to $0000 will also be written to $0800, $1000 and $1800. The memory mapped
I/O registers are located at $2000-$401F. Locations $2000-$2007 are mirrored every 8 bytes
in the region $2008-$3FFF and the remaining registers follow this mirroring. SRAM (WRAM)
is the Save RAM, the addresses used to access RAM in the cartridges for storing save
games.
From $8000 onwards is the addresses allocated to cartridge PRG-ROM. Games with only
one 16 KB bank of PRG-ROM will load it into both $8000 and $C000. This is to ensure that
the vector table is located in the correct addresses. Games with two 16 KB PRG-ROM banks
will load one into $8000 and the other into $C000. Games with more than two banks use
memory mappers to determine which banks to load into memory. The memory mapper
monitors memory writes for a specific address (or range of addresses) and when that
address is written to, it performs a bank switch. The details vary between different memory
mappers and more information can be found in Appendix D.

11
Figure 2-3. CPU memory map.
2.3 Registers
The 6502 has fewer registers than similar processors. There are three special purpose
registers, the program counter, stack pointer and status register which each have a specific
use. It also has three general purpose registers, the accumulator and the index registers, X
and Y, which can be used to store data or control information temporarily.
2.3.1 Program Counter (PC)
The program counter is a 16-bit register which holds the address of the next instruction to be
executed. As instructions are executed, the value of the program counter is updated, usually
moving on to the next instruction in the sequence. The value can be affected by branch and
jump instructions, procedure calls and interrupts.
2.3.2 Stack Pointer (SP)

12
The stack is located at memory locations $0100-$01FF. The stack pointer is an 8-bit register
which serves as an offset from $0100. The stack works top-down, so when a byte is pushed
on to the stack, the stack pointer is decremented and when a byte is pulled from the stack,
the stack pointer is incremented. There is no detection of stack overflow and the stack
pointer will just wrap around from $00 to $FF.
2.3.3 Accumulator (A)
The accumulator is an 8-bit register which stores the results of arithmetic and logic
operations. The accumulator can also be set to a value retrieved from memory.
2.3.4 Index Register X (X)
The X register is an 8-bit register typically used as a counter or an offset for certain
addressing modes. The X register can be set to a value retrieved from memory and can be
used to get or set the value of the stack pointer.
2.2.5 Index Register Y (Y)
The Y register is an 8-bit register which is used in the same way as the X register, as a
counter or to store an offset. Unlike the X register, the Y register cannot affect the stack
pointer.
2.3.6 Processor Status (P)
The status register contains a number of single bit flags which are set or cleared when
instructions are executed.
•Carry Flag (C) - The carry flag is set if the last instruction resulted in an overflow from bit
7 or an underflow from bit 0. For example performing 255 + 1 would result in an answer
of 0 with the carry bit set. This allows the system to perform calculations on numbers
longer than 8-bits by performing the calculation on the first byte, storing the carry and
then using that carry when performing the calculation on the second byte. The carry flag
can be set by the SEC (Set Carry Flag) instruction and cleared by the CLC (Clear Carry
Flag) instruction.
•Zero Flag (Z) - The zero flag is set if the result of the last instruction was zero. So for
example 128 - 127 does not set the zero flag, whereas 128 - 128 does.
•Interrupt Disable (I) - The interrupt disable flag can be used to prevent the system
responding to IRQs. It is set by the SEI (Set Interrupt Disable) instruction and IRQs will
then be ignored until execution of a CLI (Clear Interrupt Disable) instruction.
•Decimal Mode (D) - The decimal mode flag is used to switch the 6502 into BCD mode.
However the 2A03 does not support BCD mode so although the flag can be set, its value
will be ignored. This flag can be set SED (Set Decimal Flag) instruction and cleared by
CLD (Clear Decimal Flag).
•Break Command (B) - The break command flag is used to indicate that a BRK (Break)
instruction has been executed, causing an IRQ.
•Overflow Flag (V) - The overflow flag is set if an invalid two’s complement result was
obtained by the previous instruction. This means that a negative result has been obtained
when a positive one was expected or vice versa. For example, adding two positive
numbers should give a positive answer. However 64 + 64 gives the result -128 due to the
sign bit. Therefore the overflow flag would be set. The overflow flag is determined by
taking the exclusive-or of the carry from between bits 6 and 7 and between bit 7 and the
carry flag [29]. An explanation of two’s complement can be found in Appendix A.

13
•Negative Flag (N) - Bit 7 of a byte represents the sign of that byte, with 0 being positive
and 1 being negative. The negative flag (also known as the sign flag) is set if this sign bit
is 1.
The flags are arranged in the status register in the order shown in figure 2-3. Bit 5 of the
status register is unused.
Figure 2-4. Status register layout.
2.4 Interrupts
Interrupts prevent the standard sequential execution of code and cause the processor to
attend to the interrupt. Interrupts are usually generated by hardware which requires attention,
but can be triggered by software. The NES has three different types of interrupt, NMI, IRQ
and reset. The addresses to jump to when an interrupt occurs are stored in a vector table in
the program code at $FFFA-$FFFF. When an interrupt occurs the system performs the
following actions [30]:
1. Recognize interrupt request has occurred.
2. Complete execution of the current instruction.
3. Push the program counter and status register on to the stack.
4. Set the interrupt disable flag to prevent further interrupts.
5. Load the address of the interrupt handling routine from the vector table into the program
counter.
6. Execute the interrupt handling routine.
7. After executing a RTI (Return From Interrupt) instruction, pull the program counter and
status register values from the stack.
8. Resume execution of the program.
IRQs, or maskable interrupts, are generated by certain memory mappers. They are ignored
by the processor if the interrupt disable flag is set. IRQs can be triggered by the software by
use of the BRK (Break) instruction. When an IRQ occurs the system jumps to the address
located at $FFFE and $FFFF.
NMI (Non-Maskable Interrupt) is the type of interrupt generated by the PPU when V-Blank
occurs at the end of each frame. NMIs are not affected by the interrupt disable bit in the
status register, so execution is always interrupted when they occur [31]. However, triggering
of a NMI can be prevented if bit 7 of PPU Control Register 1 ($2000) is clear. When a NMI
occurs the system jumps to the address located at $FFFA and $FFFB. The handling of NMIs
is shown in figure 2-4.
Reset interrupts are triggered when the system first starts and when the user presses the
reset button. When a reset occurs the system jumps to the address located at $FFFC and
$FFFD.
The system gives the highest priority to reset requests, followed by NMI and finally IRQ [7].
The NES has an interrupt latency of 7 cycles, which means it takes 7 CPU cycles to begin
executing the interrupt handler.

14
Figure 2-5. NMI (Non-Maskable Interrupt) handling.
2.5 Addressing Modes
The 6502 has several different addressing modes, providing different ways to access
memory locations. There are also addressing modes which operate on the contents of
registers, rather than memory. In total there are 13 different addressing modes on the 6502.
Some instructions can use more than one different addressing mode. Details on the available
addressing modes can be found in Appendix E.
2.6 Instructions
The 6502 has 56 different instructions although some come in multiple variations using
different addressing modes, making a total of 151 valid opcodes (operation codes) out of a
possible 256. A detailed explanation of the complete instruction set can be found in [2], [29]
and [32]. Instructions are either one, two or three bytes long, depending on the addressing
mode. The first byte is the opcode and the remaining bytes are the operands. Instructions fit
into several functional groups [3]:
•Load / Store Operations - Load a register from memory or stores the contents of a
register to memory.
•Register Transfer Operations - Copy contents of X or Y register to the accumulator or
copy contents of accumulator to X or Y register.
•Stack Operations - Push or pull the stack or manipulate stack pointer using X register.
•Logical Operations - Perform logical operations on the accumulator and a value stored in
memory.
•Arithmetic Operations - Perform arithmetic operations on registers and memory.
•Increments / Decrements - Increment or decrement the X or Y registers or a value stored
in memory.
•Shifts - Shift the bits of either the accumulator or a memory location one bit to the left or
right.

15
•Jumps / Calls - Break sequential execution sequence, resuming from a specified
address.
•Branches - Break sequential execution sequence, resuming from a specified address, if a
condition is met. The condition involves examining a specific bit in the status register.
•Status Register Operations - Set or clear a flag in the status register.
•System Functions - Perform rarely used functions.

16
3 - Picture Processing Unit
3.1 2C02 Overview
Ricoh also supplied the 2C02 to serve as PPU. The PPU’s registers are mostly located in the
I/O registers section of CPU memory at $2000-$2007 and $4014 as described in Appendix
B. In addition, there are some special registers used for screen scrolling.
3.2 PPU Memory Map
The PPU has its own memory, known as VRAM (Video RAM). Like the CPU, the PPU can
also address 64 KB of memory although it only has 16 KB of physical RAM. The PPU’s
memory map is shown in figure 3-1. Again, the left hand map shows a simplified version
which is elaborated on by the right hand map. Due to the difference between physical and
logical address spaces, any address above $3FFF is wrapped around, making the logical
memory locations $4000-$FFFF effectively a mirror of locations $0000-$3FFF.
Reading from and writing to PPU memory can be done by using the I/O registers $2006 and
$2007 in CPU memory. This is usually done during V-Blank at the end of a frame, as it
affects addresses used while drawing the screen and can therefore corrupt what is
displayed. However, this effect can be used to produce split screen effects.
Since PPU memory uses 16-bit addresses but I/O registers are only 8-bit, two writes to
$2006 are required to set the address required. Data can then be read from or written to
$2007. After each write to $2007, the address is incremented by either 1 or 32 as dictated by
bit 2 of $2000. The first read from $2007 is invalid and the data will actually be buffered and
returned on the next read. This does not apply to colour palettes.
The PPU also has a separate 256 byte area of memory, SPR-RAM (Sprite RAM), to store
the sprite attributes. The sprites themselves can be found in the pattern tables.

17
$0000
$2000
$3F00
$4000
$10000
Pattern Table 0
Pattern Table 1
Mirrors
$3F00-$3F1F
Sprite Palette
Image Palette
Mirrors
$2000-$2EFF
Attribute Table 3
Name Table 3
Attribute Table 2
Name Table 2
Mirrors
$0000-$3FFF
Attribute Table 1
Name Table 1
Attribute Table 0
Name Table 0
$0000
$1000
$2000
$23C0
$2400
$27C0
$2800
$2BC0
$2C00
$2FC0
$3000
$3F00
$3F10
$3F20
$4000
$10000
Name Tables
Palettes
Mirrors
$0000-$3FFF
Pattern Tables
Figure 3-1. PPU memory map.
3.3 PPU Registers
Communication between the CPU and other devices takes place via memory mapped I/O
registers. The registers used by the PPU are located in main memory at $2000-$2007 with
an additional register used for Direct Memory Access at $4014. Remember that locations
$2000-$2007 are mirrored every 8 bytes in the region $2008-$3FFF. A summary of all I/O
registers can be found in Appendix B.
The actions of the PPU can be controlled by the CPU by writing to $2000 and $2001, known
as PPU Control Register 1 and PPU Control Register 2 respectively. Both registers should

18
only be written to. Bit 7 of £2000 can be used to disable NMIs. Remember that this type of
interrupt is generated whenever a V-Blank occurs and is unaffected by the interrupt disable
flag of the status register. Clearing this bit will prevent an NMI from occurring on V-Blank.
Since the NES supports both 8x8 and 8x16 sprites, setting bit 5 of $2000 will switch to 8x16
sprites. The next address in PPU memory to read or write from will be incremented after
each I/O occurs. The value to increment by is adjusted by setting the value of bit 2 of $2000.
If this is clear, the address is incremented by 1 (horizontal), otherwise the increment is 32
(vertical). Using $2001, the background can be hidden by clearing bit 3 and, similarly, the
sprites can be hidden by clearing bit 4.
The PPU Status Register is located at $2002 and is read only. The register is used by the
PPU to report its status to the CPU. The programs will frequently cause the CPU to read
from this location in order to ascertain the PPU’s status. Bit 7 is set by the PPU to indicate
that V-Blank is occurring. Bit 6 and bit 7 relate to sprites and are described later. Bit 4
indicates whether the PPU is willing to accept writes to VRAM, if it clear then writes are
ignored. When a read from $2002 occurs, bit 7 is reset to 0 as are $2005 and $2006.
3.3.1 Direct Memory Access
When transferring a large amount of data between devices it is inefficient to transfer this
through the processor. To transfer data from CPU memory to sprite memory, for example,
takes the following steps:
1. Load required SPR-RAM address into CPU.
2. Write required SPR-RAM address to $2003.
3. Load byte into CPU.
4. Write byte to $2004.
When filling the contents of sprite memory, this technique would have to be repeated 256
times. Direct Memory Access (DMA) is a technique which allows more efficient copying of
data from CPU memory to sprite memory. Using DMA, the whole of sprite memory can be
filled by using a single instruction, a write to $4014. The starting address in CPU memory is
specified by the operand for the write multiplied by $100. The 256 bytes starting at this
address are copied directly into sprite memory without the further involvement of the CPU.
When the DMA is occurring, the memory bus is in use, preventing the CPU from accessing
memory and, therefore, preventing it from accessing any more instructions. This is referred
to as cycle stealing and the CPU has to wait until the DMA transfer is complete. On the NES,
the DMA takes the equivalent of 512 cycles (about 4.5 scanlines worth) after which the CPU
can resume. This is considerably less than would be required to copy manually through the
CPU.
3.4 Colour Palette
The NES has a colour palette containing 52 colours although there is actually room for 64.
However, not all of these can be displayed at a given time. The NES uses two palettes, each
with 16 entries, the image palette ($3F00-$3F0F) and the sprite palette ($3F10-$3F1F). The
image palette shows the colours currently available for background tiles. The sprite palette
shows the colours currently available for sprites. These palettes do not store the actual
colour values but rather the index of the colour in the system palette. Since only 64 unique
values are needed, bits 6 and 7 can be ignored.
The palette entry at $3F00 is the background colour and is used for transparency. Mirroring
is used so that every four bytes in the palettes is a copy of $3F00. Therefore $3F04, $3F08,
$3F0C, $3F10, $3F14, $3F18 and $3F1C are just copies of $3F00 and the total number of

19
colours in each palette is 13, not 16 [5]. The total number of colours onscreen at any time is
therefore 25 out of 52. Both palettes are also mirrored to $3F20-$3FFF. The colour palette is
shown in Appendix F.
3.5 Pattern Tables
The NES has two pattern tables at $0000 and $1000. The pattern tables store the 8x8 pixel
tiles which can be drawn on the screen. Many games store the pattern tables in CHR-ROM
on the cartridge, however, games without CHR-ROM will use RAM for the pattern tables and
fill them during execution. The pattern tables store the least significant two bits of the 4-bit
number needed to identify the image or sprite palette entry used by that pixel such that 00b
is palette entry 0, 01b is 1, 10b is 2 and 11b is 3.
Figure 3-2. Pattern tables. Adapted from [7].
Figure 3-2 shows how the pattern tables work. The character ‘A’ is the final result, shown at
the bottom. The character is constructed pixel by pixel by taking one bit from the top left and
one from the top right to make a 2-bit colour. The other two bits of the colour are taken from
the attribute tables. The colours shown are not genuine NES colour palette values.
3.6 Name Tables / Attribute Tables
Name tables are essentially a matrix of tile numbers, pointing to the tiles stored in the pattern
tables. The name tables are 32x30 tiles and since each tile is 8x8 pixels, the entire name
table is 256x240 pixels.
Each name table has an associated attribute table. Attribute tables hold the upper two bits of
the colours for the tiles. Each byte in the attribute table represents a 4x4 group of tiles, so an
attribute table is an 8x8 table of these groups. Each 4x4 group is further divided into four 2x2
squares as shown in figure 3-3 [9]. The 8x8 tiles are numbered $0-$F. The layout of the byte

20
is 33221100 where every two bits specifies the most significant two colour bits for the
specified square.
Square 0
$0 $1
$2 $3
Square 1
$4 $5
$6 $7
Square 2
$8 $9
$A $B
Square 3
$C $D
$E $F
Figure 3-3. 4x4 tile group layout. Adapted from [20].
The NES only has 2 KB to store name tables and attribute tables, allowing it to store two of
each. However it can address up to four of each. Mirroring is used to allow it to do this. There
are four types of mirroring which are described below, using abbreviations for logical name
tables (those that can be addressed), L1 at $2000, L2 at $2400, L3 at $2800 and L4 at
$2C00:
•Horizontal mirroring maps L1 and L2 to the first physical name table and L3 and L4 to the
second as shown in figure 3-4.
1 1
2 2
Figure 3-4. Horizontal mirroring.
•Vertical mirroring maps L1 and L3 to the first physical name table and L2 and L4 to the
second as shown in figure 3-5.
1 2
1 2
Figure 3-5. Vertical mirroring.