the PPU is reading the second pattern table, A12 is high and and A13 is low.When the PPU is reading nametables, A12 is low and and A13 is high.

How an A12-based timer works: (MMC3)The PPU performs 32 sets of reads for background, 8 sets of reads for sprites, and then 2 more sets of reads for the background to set up the next scanline. If a game puts background tiles in the first pattern table and sprite tiles in the second pattern table, then A12 will be low during nametable and background pattern fetches, which represent most of the line, and it will go high several times near the end of the scanline when the PPU is fetching sprite patterns. By watching for several successive reads with A12low followed by a read with A12 high, the mapper can infer that a new scanline has started.

How an A13-based timer might work:Between one scanline and the next, the PPU's state machine pauses, causing it to read nametables four times in a row: the first of a set of four twice (ignored) plus the first two of the next set of four (used). By watching for several successive reads with A13 low, the mapper can infer that a new scanline has started.

EDIT: MMC5 relies on the same phenomenon as an A13 spreader but compares the whole address instead of just watching A13.

Between one scanline and the next, the PPU's state machine pauses, causing it to read nametables four times in a row: two that don't belong to a