Sega Genesis Hardware Internals - Revised: 04/07/1993 An up-to-date version of this file can be gotten by anonymous ftp from ftp.spd.louisville.edu, in the file "pub/sega/hardware.txt". Please send corrections or comments to: Rick McTeague sysrick@starbase.spd.louisville.edu Disclaimers: The following information was extracted without the use of official information from Sega Enterprises, Ltd. I therefore offer no warranty on the correctness of this information. Use it at your own risk. This information was gathered as a personal project, and is not the responsibility of my employer. Different versions of the Genesis exist, so I won't suggest that any of this information is right for anybody's Genesis but my own. Sega, Genesis, Sonic the Hedgehog, and Ecco the Dolphin are trademarks of Sega Enterprises, Ltd. Other trademarks are the property of their respective companies. The Cartridge ROM ----------------- As others on the net have observed, a standard Genesis cartridge is nothing more than a small printed circuit board with a ROM on it. There are some cartridges which have battery-backed RAM for saving high scores, configurations, etc., but I haven't seen these, so I don't know about them. If you know of a particular cartridge that has RAM, let me know so I can go rent one and take it apart (shhhh!) to see what's in it. A cartridge contains a word-wide (16 bit) ROM with up to 2 Meg words (4 Mbytes). This is based on the signal !C_CE (see below), which is used as the cartridge ROM's chip enable on the cartridges I've looked at, and which is active at addresses $000000-$3fffff. It may be possible to have more than 4 Mbyte cartridges; if so, either they ignore the !C_CE line and do their own address decoding, or there's a register somewhere in the Genesis which changes the default address decoding scheme for !_CE. Note that cartridges are advertised as being "8 Meg"; as far as I know, is 8 Meg _bits_, not bytes. 1 Mbyte is still pretty impressive for a game machine. SONIC uses a 40-pin 256Kx16 (512Kx8) ROM in word mode. Ecco the Dolphin uses a 42-pin 512Kx16 (1024Kx8) ROM in word mode. This one confused me because I'd never seen a 42-pin DIP before, so I thought it was 40 pins. No wonder the signals didn't look right... Putting together a little bit of information from a Sharp data sheet for a 512 Kword ROM with a bit of conjecture based on the Sonic and Ecco cartridges, this is what I can come up with for pinouts: Sonic Ecco (256 Kword) (512 Kword) ------u------ ------u------ A18 1=| |=42 VCC? A17 1=| |=40 A 8 A17 2=| |=41 A 8 A 7 2=| |=39 A 9 A 7 3=| |=40 A 9 A 6 3=| |=38 A10 A 6 4=| |=39 A10 A 5 4=| |=37 A11 A 5 5=| |=38 A11 A 4 5=| |=36 A12 A 4 6=| |=37 A12 A 3 6=| |=35 A13 A 3 7=| |=36 A13 A 2 7=| |=34 A14 A 2 8=| |=35 A14 A 1 8=| |=33 A15 A 1 9=| |=34 A15 A 0 9=| |=32 A16 A 0 10=| |=33 A16 !CE 10=| |=31 !BYTE !CE 11=| |=32 !BYTE GND 11=| |=30 GND GND 12=| |=31 GND !OE 12=| |=29 D15 !OE 13=| |=30 D15 D 0 13=| |=28 D 7 D 0 14=| |=29 D 7 D 8 14=| |=27 D14 D 8 15=| |=28 D14 D 1 15=| |=26 D 6 D 1 16=| |=27 D 6 D 9 16=| |=25 D13 D 9 17=| |=26 D13 D 2 17=| |=24 D 5 D 2 18=| |=25 D 5 D10 18=| |=23 D12 D10 19=| |=24 D12 D 3 19=| |=22 D 4 D 3 20=| |=23 D 4 D11 20=| |=21 VCC D11 21=| |=22 VCC ------------- ------------- Note that the address line numbering is different than that of the 68000; line A0 of the ROM is really connected to the 68000's A1. This is because of the way the 68000 handles even/odd byte addressing using !UDS and !LDS. The !BYTE line is held high. This puts the ROM chip into "word" mode, where data is accessed 16 bits at a time. The convenient correspondence between ROM and 68000 data and address lines (ROM D0 = 68K D0, ROM D1 = 68K D1, etc..., and ROM A0 = 68K A1, ROM A1 = 68K A2, etc...) may not exist in all cartridge designs. This is sometimes difficult to visualize, but keep in mind that the ROM doesn't care whether its D0 is really D0, or if its A3 is really A3, etc. As long as each data line is used as the same D## line for both programming and reading, and each address line is used as the same A## for both programming and reading, the ROM will function properly and the 68000 will see the right instructions. Think about it... Why bring this up? If you remove the ROM from the cartridge PCB and try to read it with a EPROM programmer, there may be situations where you won't see valid 68000 instructions, or things won't be in the right place... Assuming your programmer isn't messed up, this would be because the address and data lines on the ROM aren't assigned the way you'd expect. Why would someone make a cartridge like this? To make your life difficult, if you're wanting to hack their ROMs, or to make their life easy, by making the cartridge PCB easier to design. Does anyone make cartridges like this? I don't know. But the possibility exists, and I thought you should know. The easiest way to avoid this potential problem is to build an adapter from your programmer's EPROM socket to an edge card connector into which you plug the cartridge. This is a bit safer, too, so you don't have to remove the ROM from the cartridge (or even open it up). The Cartridge Port ------------------ The cartridge port presents the 68000's 23 address lines, 16 data lines, as well as some control signals, described below. With the exception of the standard 68000 signals, signal names are my own and may bear no resemblance to their real (i.e., internal to Sega) names. Active low signals are prefixed with a "!". !C_OE drives the cartridge ROM's output enable. It's taken low on any 68000 read from locations $000000 to $0dfffff, but doesn't really matter unless !C_CE is low. !C_CE is the cartridge ROM's chip enable, and is taken low when the processor accesses memory locations $000000 to $3fffff. !LO_MEM looks similar to !C_CE, but is taken low on accesses to locations $000000 to $7fffff. I haven't tried tying anything to this yet. Not used by the ROM. CLK is the 68000's 7.67 MHz clock, being fed to the cartridge in case something might want to use it. Not used by the ROM. There's a !DTACK at the cartridge port, but I don't know how useful it is. It looks like the Genesis has its own logic for giving !DTACK to the processor, so it's not necessary (or advisable) for the cartridge to generate it. Perhaps there's some good reason why a cartridge might want to see the !DTACK being generated on its behalf. Directly connected to the 68000 (open collector line?). Not used by the ROM. !AS isn't used by the cartridge ROM, but is present in case something else wants it. Direct from the 68000. Byte reads from ROM don't need !UDS or !LDS, as the processor just ignores the unneeded bytes on the data bus. Byte writes shouldn't enable both upper and lower bytes, so the cartridge port provides a lower- byte write (!LDSW) and upper-byte-write (!UDSW) signals. These would be useful for cartridges with RAM. !RESET is provided for cartridges with logic which needs to be reset. Direct from the 68000. Not used by the ROM. !S_RESET is an input to the Genesis which causes a "soft" reset (see below). Not used by the ROM. !H_RESET is an input to the Genesis which causes a "hard" reset (see below). Not used by the ROM. !CART_IN is an input to the Genesis which lets it know that the cartridge is in place. This is used to enable the internal OS ROM and !C_CE signals. See the discussion on hard and soft resets, below. HS_CLK is a 13.188 MHz output from the Genesis. You tell _me_ what it's for! Not used by the ROM. VIDEO is an output which appears to be some sort of (non-NTSC?) video signal. I guess this goes with VSYNC and HSYNC, but I haven't tried to look at it. VSYNC is a 60 Hz output - possibly the vertical sync signal for VIDEO. HSYNC is a 16.240 KHz output - possibly the horizontal sync signal for VIDEO. This isn't NTSC... What is it? EGA? There are four signals I haven't got a clue on: B1: Goes through capacitor and resistor to IC12 pin 2. B3: Goes through capacitor and resistor to IC12 pin 8. B21: This is a strange one. When the processor is halted, this signal pulses at 60 KHz. When the processor is running, its rate varies. Hmmm.... B31: This is an output, but it's always high and I've not seen it go low. I know it's not an input because it sources too much current; it's not a 5V supply because it doesn't source enough. There is no R/!W line, as it's built into !UDSW and !LDSW signals. There are no !BR, !BG, or !BGACK signals at the cartridge port. The cartridge port pins are numbered A1-A32 and B1-B32, left-to-right, with the A row toward the back of the Genesis and the B row toward the front. The "i" and "o" labels describe whether a signal is an input and/or an output to/from the Genesis. Signals with an "o" are output from the Genesis to the cartridge. Signals with an "i" are input to the Genesis from the cartridge. Pin Signal Pin Signal -------------------------------------- A1 - gnd B1 - ? A2 - +5v B2 i !H_RESET A3 o a8 B3 - ? A4 o a11 B4 o a9 A5 o a7 B5 o a10 A6 o a12 B6 o a18 A7 o a6 B7 o a19 A8 o a13 B8 o a20 A9 o a5 B9 o a21 A10 o a14 B10 o a22 A11 o a4 B11 o a23 A12 o a15 B12 o VIDEO A13 o a3 B13 o VSYNC A14 o a16 B14 o HSYNC A15 o a2 B15 o HS_CLK A16 o a17 B16 o !C_OE A17 o a1 B17 o !C_CE A18 - gnd B18 o !AS A19 io d7 B19 o CLK A20 io d0 B20 i !DTACK A21 io d8 B21 o ? A22 io d6 B22 io d15 A23 io d1 B23 io d14 A24 io d9 B24 io d13 A25 io d5 B25 io d12 A26 io d2 B26 o !LO_MEM A27 io d10 B27 o !RESET A28 io d4 B28 o !LDSW A29 io d3 B29 o !UDSW A30 io d11 B30 i !S_RESET A31 - +5 B31 o ? A32 - gnd B32 i !CART_IN Resets and the OS ROM --------------------- A hard reset, which happens at power-up or when the cartridge port's !H_RESET line is pulled low, enables the Genesis' internal "OS" ROM. This is responsible for checking for a "valid" (i.e., does it say "SEGA" at location $000100?) cartridge, presenting the "Produced by or licensed from Sega Enterprises, ltd." message, enabling the cartridge ROM, and jumping to the cartridge's entry point. This only happens if the !CART_IN signal is pulled low; if not, the internal ROM (and cartridge ROM) is disabled, the 68000 sees invalid instructions, and eventually puts its heels up and dies. A system with a CD may behave differently, but I don't have one, so I don't know. A soft reset, which happens when you press the reset button or pull the cartridge port's !S_RESET line low, causes a 68000 reset: the processor fetches an initial stack pointer from locations $000000-$000003, and jumps to the initial PC specified by locations $000004-$000007. This will be the entry point of the cartridge ROM, if it's enabled, or the entry point of the OS ROM if the processor is reset before the OS ROM is finished doing its business. The Memory Map -------------- $000000 $3fffff Cartridge ROM, when enabled by cartridge control register and !CART_IN. $000000 $0007ff Internal OS ROM, when enabled by cartridge control register and !CART_IN. $ff0000 $ffffff 64Kbytes scratchpad RAM Partially decoded; RAM actually appears repeated between $e00000 through $ffffff. $a14101 cartridge control register bit 0 = 0: cartridge disabled, OS ROM enabled bit 0 = 1: cartridge enabled, OS ROM disabled $a00000 $a????? Unknown. Audio? Controller I/O? $c00000 $c????? Video display controller registers The OS puts the top of its stack at $ffff00, and defines a "user stack pointer" at $000000 (building down through the top of RAM memory). The Z80 processor (used for sound? controller i/o?) uses 8Kbytes of RAM. I don't know anything about how the Z80 does its work, as I haven't looked. Major parts ----------- I don't know what some of these are, as I'm working off a 1988 IC Master and a couple of data books. If anyone has better information, I'd love to have it. IC1 Hitachi HD68HC000P8 - Motorola 68000-compatible CMOS microprocessor, clock: 7.67 MHz IC2, IC3 Motorola MCM51L832 - 32K x 8-bit pseudo-static RAM for 68000 IC4 Sega 315-5433 - glue chip ? - 160 pins On older systems, this is a Sega 315-5364. IC5 No such beast on newer systems. On older systems, this is an 80 pin chip, labelled Sega 315-5309. IC6 NEC D780C-1 - Zilog Z80-compatible microprocessor IC7 Samsung KM6264BLS - 8K x 8 static RAM (used by the Z80) IC8 Sega 315-5313A-01 - glue chip? - 128 pins IC9, IC10 Hitachi HM53461ZP - 64K x 4 bit dual-port video RAM IC11 Yamaha YM2612 - Sound chip? IC12 Sony CXA1034P - Timer? Op-amp? IC13 Sony CXA1145P - RGB to Composite Video encoder. IC14 LM358 - Dual op-amp. Used for sound? OSC1 53.6931 MHz crystal oscillator. Divided by 7 to get the 68000 clock frequency, and used elsewhere for video, sound, Z80 clock, etc. Printed Circuit Board My Genesis circuit board is labelled "IC BD M5 USA". An older (and presumably PAL) system which has an IC5 and a different IC4 is labelled "IC BD M5 PAL". There is no explicit OS ROM chip, nor is there a ROM chip for the Z80. My guess is that these "ROMs" are part of one or both of the glue chips, IC4 and IC8 (and IC5 on older systems). System Revisions ---------------- I'm aware of at least two revisions of the Genesis. Earlier models may not have had an OS ROM, so some of the above discussion is probably not valid. Specifically: o There is probably no Cartridge Control Register. o Hard and soft resets might be one-and-the-same. I don't know about the cartridge pins used for these signals. o Any cartridge - not just those with "SEGA" in the right place - will work (maybe). o The parts in the box are different. IC5 is present, and IC4 is different. How can you tell new and old ones apart without opening it up? I think that older ones don't give a "Produced..." message on power-up with a Sega-produced/licensed cartridge. I'd like to get more complete info on this. If you happen to open your Genesis, I'd appreciate it if you'd compare it the information above and let me know if there are any differences. One poster on netnews mentioned a "Type III" Genesis. Does anyone know anything about this? The Joystick Ports ------------------ Info on the joystick ports can be found in the file "pub/sega/joystick.txt" on ftp.spd.louisville.edu. See acknowledgements below. The Game Genie -------------- The Game Genie sits between the cartridge port and the cartridge. It watches the address bus during read accesses to the cartridge ROM, and substitutes its own data/instructions according to the Game Genie codes you've entered. Game Genie codes are nothing more than encoded address and data. More information on the encoding scheme, and a C program which decodes Game Genie codes can be found in "pub/sega/game_genie.txt" and "pub/sega/decoder.c". See acknowledgements below. Acknowledgements ---------------- Thanks to: d91jn@efd.lth.se (Tore Nestenius) for info on older Genesis systems. lewism@rpi.edu (Michael Lewis) for info on the Sony CXA1145 and Samsung KM6264 chips. crs@crs-sys.uucp (Chris Gregors) for posting a version of the Genesis cartridge port pinouts. nhowland@matt.ksu.ksu.edu (Neal Howland) for information on the Joystick port. merlyn@digibd.com (Brian Westley) for Game Genie information and decoder program.