Sega System 18 hardware notes by Charles MacDonald WWW: http://cgfm2.emuviews.com Unpublished work Copyright 2003 Charles MacDonald This document is in a very preliminary state and is subject to change. Most everything within has been tested and verified on a System 18 board, but please be aware that my testing methods or interpretations of results could be flawed. I can't guarantee that everything is 100% accurate. Table of contents - Overview - Game List - Timing - I/O area - Sound hardware - Video Display Processor - ROM boards - I/O boards - Connector pin assignments and jumpers - ROM board connector pin assignments - Custom chip pin assignments - Miscellaneous - Assistance Needed - Credits and Acknowledgements - Disclaimer ---------------------------------------------------------------------------- Overview ---------------------------------------------------------------------------- This document mainly covers differences between the System 18 and System 16B hardware, which are quite similar. Here are the System 18 hardware specifications: Main CPU 68000 @ 10 MHz Sound CPU Z80-B @ 8 MHz Security MCU 8751 @ 8 MHz (optional) Sound Chips Ricoh RF5C68A @ 10 MHz Yamaha YM3438 @ 8 MHz (x2) Video Hardware 315-5361 (Sprite generator) 315-5362 (Tilemap generator) 315-5313 (MegaDrive/Genesis VDP) 315-5360 (68000/Z80/8751 interface) 315-5242 (Color encoder) Others 315-5296 (I/O chip) PALs 315-5391 (Z80 address decoding) 315-5430 (Video layer mixing for 171-5873-02B main board) 315-5373 (Video layer mixing for 171-5873B main board) 315-5375 (System timing) 315-5374 (Sprite timing) 315-5389 (VDP display synchronization) 315-5390 (?) Memory 68000 work RAM 16K Z80 work RAM 8K RF5C68A RAM 64K VDP RAM 64K Tile RAM 64K Text RAM 4K Color RAM 4K Sprite RAM 2K Line buffer RAM 512x12-bit (x2) In addition, it has built-in tile banking hardware (instead of being integrated on the ROM board like System 16B), uses a JAMMA edge connector, and has more expansion connectors. The 8751 MCU is used for security in some games. I don't know what it is capable of in the System 18 hardware, at least for System 16B it has access to the I/O area, work RAM, Z80 sound command latch, and program ROM. It can halt the 68000 presumably after doing a checksum on the program ROM as well. Most System 18 games are encrypted and use a Hitachi FD1094 CPU instead of a regular 68000. It has a battery and presumably some internal RAM which stores the data used to decrypt the program code. When/if the battery fails, the CPU stops working. ---------------------------------------------------------------------------- Game List ---------------------------------------------------------------------------- Name Main board ROM board Notes Alien Storm 171-5873B 171-5874B Bloxeed ? 171-5874B* Clutch Hitter 171-5873-02B 171-5987A D.D. Crew 171-5873-02B 171-5987A Has I/O board for 3P,4P Desert Breaker ? ? Laser Ghost 171-5873-02B* 171-5987A* Has I/O board for three guns Moonwalker 171-5873-02B* 171-5874B* Has a 8751 MCU Shadow Dancer 171-5873B* 171-5874B* Where's Wally ? ? Has trackball, motorized seats Entries marked with a star are my guess based on photos of the PCB, the others are confirmed. Judging by the larger sprite ROM capacity, the Where's Wally ROM board may be another variation in adition to the two types listed above. All games are encrypted except for Shadow Dancer. There are bootlegs of Shadow Dancer, Alien Storm, and Moonwalker, which use the original code that has been patched to run on bootleg hardware. Program ROMs Game CPU 12271B/ 12272B Shadow Dancer Not encrypted, "REV.B" sticker on ROM board 12721 / 12722 Shadow Dancer Not encrypted, Japan only release? 12773 / 12774 Shadow Dancer Not encrypted 12910 / 12911 Bloxeed 317-0139 ? Bloxeed 317-0140 13094 / 13095 Alien Storm 317-0147 13232 / 13233 Moonwalker 317-0158 13234 / 13235 Moonwalker 317-0159 ? Laser Ghost 317-0165 13429 / 13437 Laser Ghost 317-0166 13794 / 13795 Clutch Hitter 317-0176 14152 / 14153 D.D. Crew 317-0186 14160 / 14161 D.D. Crew 317-0187 14730 / 14731 Where's Wally 315-0197B Encrypted games that have had multiple program revisions use different CPUs for each version, that are not compatible with the CPUs from other versions of the same game. ---------------------------------------------------------------------------- Timing ---------------------------------------------------------------------------- The 171-5873-02B board has a 16.000, 20.000, and 50.349 MHz oscillator. These provide the clock inputs for several components: 680000 - 10.000 MHz RF5C68A - 10.000 MHz Z80-B - 8.000 MHz YM3438 - 8.000 MHz 8751 - 8.000 MHz The 171-5873B board only has a 20.000 and 48.000 MHz clock. The 68000 and RF5C68A run at the same speed as before. The 48 MHz clock is connected to what appears to be a divide by 3 (315-5375 PAL) and divide by 2 (flip-flop) circuit to provide a 8.000 MHz clock for the sound section, but this hasn't been confirmed. ---------------------------------------------------------------------------- I/O area ---------------------------------------------------------------------------- The I/O area is shared between the I/O chip, a write-only latch that controls the System 18 / VDP video mixing, and an expansion area used for additional I/O boards. The area is 16K in size and is divided into four 4K sections: $0000-$0FFF : I/O chip internal registers and unused area $1000-$1FFF : I/O chip internal registers and unused area (mirror) $2000-$2FFF : Video control latch $3000-$3FFF : Expansion area (used by CN5) The I/O chip and video control latch are 8-bit devices mapped to odd bytes. Reading even bytes returns the prefetch value. The I/O chip has 8 bidirectional I/O ports, three output pins, and provides an chip select and clock output for interfacing with another device like a sound chip. It has an 8-bit data bus and 64 internal locations, used as follows: $0001 : Port A data input / output register (r/w) $0003 : Port B data input / output register (r/w) $0005 : Port C data input / output register (r/w) $0007 : Port D data input / output register (r/w) $0009 : Port E data input / output register (r/w) $000B : Port F data input / output register (r/w) $000D : Port G data input / output register (r/w) $000F : Port H data input / output register (r/w) $0011 : Protection ID (returns ASCII 'S') (r/o) $0013 : Protection ID (returns ASCII 'E') (r/o) $0015 : Protection ID (returns ASCII 'G') (r/o) $0017 : Protection ID (returns ASCII 'A') (r/o) $0019 : Mirror of CNT pin control register (r/o) $001B : Mirror of port direction control register (r/o) $001D : CNT pin control register (r/w) $001F : Port direction control register (r/w) Any value written to $001D, $001F can be read back from the same locations and $0019, $001B respectively. Register $001D controls the output state of the CNT2-0 pins: D7 : ? D6 : ? D5 : ? D4 : ? D3 : ? D2 : CNT2 (1= high, 0= low) D1 : CNT1 (1= high, 0= low) D0 : CNT0 (1= high, 0= low) Register $001F controls the direction of the I/O ports: D7 : Port H direction (1= output, 0= input) D6 : Port G direction (1= output, 0= input) D5 : Port F direction (1= output, 0= input) D4 : Port E direction (1= output, 0= input) D3 : Port D direction (1= output, 0= input) D2 : Port C direction (1= output, 0= input) D1 : Port B direction (1= output, 0= input) D0 : Port A direction (1= output, 0= input) Other information If a port is configured as an input, you can still write to it to set the output state of the pins, which will be used once the port is set to be an output later. If a port is configured as an output, reading it returns the last value written to it. After reset, all ports are inputs and registers $001D,$001F are zero. (as well as the read only mirrros at $0019, $001B) The System 18 hardware uses the chip like so: Port A - 1P controls D7 : Joystick left (0= pressed, 1= released) D6 : Joystick right (0= pressed, 1= released) D5 : Joystick up (0= pressed, 1= released) D4 : Joystick down (0= pressed, 1= released) D3 : Button D (0= pressed, 1= released) D2 : Button C (0= pressed, 1= released) D1 : Button B (0= pressed, 1= released) D0 : Button A (0= pressed, 1= released) Port B - 2P controls D7 : Joystick left (0= pressed, 1= released) D6 : Joystick right (0= pressed, 1= released) D5 : Joystick up (0= pressed, 1= released) D4 : Joystick down (0= pressed, 1= released) D3 : Button D (0= pressed, 1= released) D2 : Button C (0= pressed, 1= released) D1 : Button B (0= pressed, 1= released) D0 : Button A (0= pressed, 1= released) Port C - Bidirectional I/O port D7 : To CN8 pin 3 D6 : To CN8 pin 4 D5 : To CN8 pin 5 D4 : To CN8 pin 6 D3 : To CN8 pin 8 D2 : To CN8 pin 9 D1 : To CN8 pin 10 D0 : To CN8 pin 11 Port C is connected to a 74LS245 whose output goes to CN8. The CNT0 output pin controls the DIR input of the 74LS245. Port D - Miscellaneous output D7 : ? D6 : To color encoder /GRAY input (0= grayscale, 1= color) D5 : To tilemap/sprite generator flip screen input (0= normal, 1= flip) D4 : To pin 2 of CN8. D3 : Coin lockout 2 D2 : Coin lockout 1 D1 : Coin meter 2 (increment counter on 0 to 1 transition) D0 : Coin meter 1 (increment counter on 0 to 1 transition) Pin 2 of CN8 is a high current output capable of driving a lamp or coin meter. Bit 5 enables screen flipping for the tilemap and sprite layers, it is connected to both chips. It and bit 6 do not affect the VDP display which is separate. Port E - Service / Coin inputs D7 : Always returns '1' D6 : Select Game button (0= pressed, 1= released) D5 : 2P start button (0= pressed, 1= released) D4 : 1P start button (0= pressed, 1= released) D3 : Service switch (0= pressed, 1= released) D2 : Test switch (0= pressed, 1= released) D1 : 1P coin meter (0= Coin inserted, 1= No coin) D0 : 2P coin meter (0= Coin inserted, 1= No coin) Port F - DIP switch #1 D7 : Switch 8 (1= Off, 0= On) D6 : Switch 7 (1= Off, 0= On) D5 : Switch 6 (1= Off, 0= On) D4 : Switch 5 (1= Off, 0= On) D3 : Switch 4 (1= Off, 0= On) D2 : Switch 3 (1= Off, 0= On) D1 : Switch 2 (1= Off, 0= On) D0 : Switch 1 (1= Off, 0= On) Port G - DIP switch #2 D7 : Switch 8 (1= Off, 0= On) D6 : Switch 7 (1= Off, 0= On) D5 : Switch 6 (1= Off, 0= On) D4 : Switch 5 (1= Off, 0= On) D3 : Switch 4 (1= Off, 0= On) D2 : Switch 3 (1= Off, 0= On) D1 : Switch 2 (1= Off, 0= On) D0 : Switch 1 (1= Off, 0= On) Port H - Tile banking D7 : Bit 3 of tile bank value D6 : Bit 2 of tile bank value D5 : Bit 1 of tile bank value D4 : Bit 0 of tile bank value D3 : Bit 3 of tile bank value D2 : Bit 2 of tile bank value D1 : Bit 1 of tile bank value D0 : Bit 0 of tile bank value The tilemap generator outputs a select signal which sends either the lower or upper nibble of port H to the ROM board, where it can be used for tile ROM banking depending on the board itself. The select signal is from bit 12 of the attribute word for foreground/background tile layers, and it is always forced to zero for tiles from the text layer. Output pins (summary) CNT0 - To 74LS245 DIR to control direction of port C connected to CN8. 0= Input from CN8 to port C 1= Output from port C to CN8 CNT1 - OR'd with tilemap chip blank screen output, goes to /BLANK input of the color encoder. 0= Screen blanked 1= Screen shown CNT2 - To 315-5430 / 315-5373 pin 1 to control VDP display enable. 0= VDP output not shown 1= VDP output visible The CNT0 pin seems to affect screen flipping, even though it is not connected to the tilemap generator chip as opposed to bit 5 of port D. This is true for both main board types; maybe a mistake in the hardware? ---------------------------------------------------------------------------- Sound hardware ---------------------------------------------------------------------------- The sound hardware makes provisions for four 512K ROMs that the Z80 has access to for reading program code, data, and PCM samples. The ROM boards impose limits on the types of ROMs used: Board Sound 3 Sound 2 Sound 1 Sound 0 171-5874B 256K 256K 256K 128K 171-5987A 512K 512K 512K 128K In addition, games may not necessarily use all of the sound ROM sockets. Z80 memory map $0000-$9FFF : Fixed ROM $A000-$BFFF : Banked ROM $C000-$DFFF : RF5C68A internal registers / PCM RAM bank $E000-$FFFF : Work RAM Reading the fixed ROM area returns data from offsets $0000-$9FFF in the Sound 0 ROM. Reading the banked ROM area returns data from the currently select ROM and offset as defined by the sound bank control word. The RF5C68A is directly connected to 64K of sample RAM which can be accessed in 4K banks from the upper half ($D000-DFFF) of the RF5C68A memory space. The lower half ($C000-$CFFF) contain it's internal registers. Z80 I/O port map $00-$7F : Unused $80-$8F : YM3438 #1 (4 bytes, mirrored every 4 bytes) (r/w) $90-$9F : YM3438 #2 (4 bytes, mirrored every 4 bytes) (r/w) $A0-$BF : Sound bank control word (w/o) $C0-$DF : Sound command (r/w) $E0-$FF : Expansion (r/w) The 315-5391 outputs an active-low strobe when ports $E0-$FF are accessed, this along with I/O port read and write signals are brought out to the ROM board connectors for future expansion. Any value written to ports $A0-$BF is used to control sound ROM banking, it has the following format D7 : Bit 1 of sound ROM select D6 : Bit 0 of sound ROM select D5 : Bit 5 of sound ROM bank D4 : Bit 4 of sound ROM bank D3 : Bit 3 of sound ROM bank D2 : Bit 2 of sound ROM bank D1 : Bit 1 of sound ROM bank D0 : Bit 0 of sound ROM bank Table of ROM select values D7 D6 0 0 : Sound 0 ROM 0 1 : Sound 1 ROM 1 0 : Sound 2 ROM 1 1 : Sound 3 ROM Bits 5-0 select an offset in steps of 8K in the selected ROM to be accessed from the banked ROM window at $A000-$BFFF. Up to 64 8K banks are supported for 512K total, but the usable ranges depend on the type of ROMs used. Interrupts The first YM3438 (IC87) mapped to ports $80-$BF has it's /IRQ output tied to the Z80 /INT pin. The second YM3438 has it's /IRQ output left unconnected. When the 68000 or MCU writes to the sound command register (at $FE0007) the 315-5360 chip latches the 8-bit value written and triggers an NMI on the Z80. Reading ports $C0-$DF returns the sound command. It isn't known if the NMI pin is pulsed (allowing for multiple interrupts) or held low until the sound command port is read (preventing further interrupts until the Z80 reads the sound command). Miscellaneous I would imagine reading unused or write-only I/O ports would return $FF, as the Z80 data bus goes through an array of pull-up resistors. You'd probably get the same value off the data bus during the instruction / table address fetch in interrupt modes 0 and 2, respectively. Trying to access a ROM bank at an offset bigger than the ROM itself will result in wrapping, as the upper address lines aren't connected to anything and have no effect. After reset the sound bank is set to offset $0000-$1FFF of Sound ROM 0. The VDP PSG output is not connected, so it cannot be used to produce sound. The Sound 0 ROM has an unusual pinout; A16 and /OE are swapped. The rest of the Sound ROMs have standard 27C040 / 27C020 pin assignments. ---------------------------------------------------------------------------- Video Display Processor ---------------------------------------------------------------------------- This section still needs some work, right now it's just a collection of some of my notes. The VDP seems to be hardwired to any address within the $C00000-$DFFFFF range, regardless of any of the region configuration registers. Writing to VDP register $8C seems to make the video hardware re-sync with the VDP output. Both Shadow Dancer and Alien Storm set this register at the start of VBlank only. Otherwise, the VDP output is 'captured' at the wrong time and you can see the overscan / blanking areas. Video control register There is a 82S153 PLA used in both board types used to control how the VDP and System 18 graphics (tilemap, sprites) are mixed together. There are two differently programmed versions of the chip which have the same pinout, Alien Storm uses a 315-5373, Clutch Hitter uses a 315-5430. Here's a incomplete set of pin assignments: +----v----+ CNT2 |01 i 20| VCC ? |02 o 19| To enable inputs of analog switch for VDP RGB ? |03 o 18| To enable inputs of analog siwtch for color encoder RGB ? |04 i 17| From video control latch bit 0 ? |05 i 16| From video control latch bit 1 ? |06 i 15| From video control latch bit 2 ? |07 i 14| From video control latch bit 3 ? |08 i 13| 315-5313 pin 39 (VDP /YS) ? |09 ? 12| 315-5313 pin 40 (VDP SPA/B) GND |10 11| +---------+ The chip can detect transparent pixels and differentiate between sprite and tilemap pixels in the System 18 video. Some of the unknown pins must be used for that purpose. I figured this information could be taken from the color bus, but it isn't connected to the chip. The unamplified RGB output of the color encoder and the VDP RGB output go to two analog switches. The switches are controlled by the chip which can independantly enable or disable the System 18 or VDP video. Both switch outputs are connected to an amplifier circuit which boosts the video signal so it can drive a monitor. If you remove the PLA both switches output the System 18 and VDP graphics which are overlaid on each other. I guess the hardware sums the two signals together, as the output is much brighter. I think the PLA only enables one or the other at any given time. Some common features of the two chip types are that CNT0 enables or disables the VDP video output. When enabled, the VDP graphics appear behind the System 18 opaque pixels. The VDP backdrop isn't shown, instead the System 18 one (from color RAM entry zero) is shown. Concerning the video control register, the Clutch Hitter PLA will disable System 18 video and enable VDP video if bit 3 and/or 2 is set. Bits 1-0 have no use. For the Alien Storm PLA, when bits 2 and 1 are set, the System 18 video appears wherever there are transparent pixels in the VDP video. When bit 0 is cleared, System 18 sprites appear over the System 18 tilemaps and VDP video. When bit 0 is set, the sprites are shown behind the VDP just like the tilemaps. Bit 3 is unused. ---------------------------------------------------------------------------- ROM boards ---------------------------------------------------------------------------- ROM board: 171-5874B Used by: Alien Storm, Shadow Dancer Tile Banking The 4-bit bank value from the upper or lower nibble of port H is used as follows: D3 : Select tile ROMs (0= SCR 0,1,2, 1= SCR 3,4,5) D2 : To selected SCR ROM pair A17 D1 : To selected SCR ROM pair A16 D0 : To selected SCR ROM pair A15 Sprite Banking The 4-bit bank value is used as follows: D3 - Bit 1 of object ROM select D2 - Bit 0 of object ROM select D1 - To selected OBJ ROM pair A17 D0 - To selected OBJ ROM pair A16 D3 D2 0 0 : OBJ0 0 1 : OBJ1 1 0 : OBJ2 1 1 : OBJ3 ROM board: 171-5874B Used by: Clutch Hitter, D.D. Crew This board has a 315-5436 chip which is mapped to the 68000 address space and controls tile and sprite banking. The tile bank value from port H is unused (not connected to the tile ROMs or this chip). Because the only games that use this chip are encrypted, I don't know how it's supposed to be used. In my tests, it seemed that setting certain bits at many locations locked up the system. After reset, the tile bank registers are initialized to zero. Sprites are completely disabled. ---------------------------------------------------------------------------- I/O boards ---------------------------------------------------------------------------- Extra player I/O board (171-6097B) Used by D.D. Crew, also in System 32 games like Spider-Man, Golden Axe 2. The I/O board uses an 8255 PPI (Fujitsu MB89255B) chip which provides three programmable I/O ports. The hardware forces the ports to be used as follows: Port A (CN2) - Input Port B (CN3) - Input Port C1 (CN4) - Input Port C2 (CN5) - Output (high current, for driving lamps, coin meters, etc.) The PPI has four internal registers which are mapped to odd bytes in the $2000-$3FFF area of the I/O area. 68000 A3 is not used, so the registers are mirrored twice: $0001 - Port A $0003 - Port B $0005 - Port C $0007 - Control $0009 - Port A (mirror) $000B - Port B (mirror) $000D - Port C (mirror) $000F - Control (mirror) The control register is write only. Reading it returns the same data as reading port C. After reset, the registers return $FF, $FF, $0F, $0F. Writing to a port in input mode has no effect. Any value set in the output latch when a port is an output is reset to zero if the port mode changes. Writing to port C loads the port C output latch, the bit set/reset feature can be used to individually turn bits in the output latch on or off. All ports return $FF when configured as an input and read. Port A,B,C1 are active-low inputs. JP1 through JP4 control where the 8255 is mapped to within the $2000-$3FFF range: JP1 - Use offsets $0000-$000F JP2 - Use offsets $0010-$001F JP3 - Use offsets $0020-$002F JP4 - Use offsets $0030-$003F If multiple jumpers are shorted, the 8255 will occupy several address ranges. If no jumpers are shorted, the 8255 isn't enabled. Reading even bytes or unused locations returns the prefetch value. Pin assignments CN2 (10 pin) 1 - PA5 2 - PA4 3 - PA7 4 - PA6 5 - GND 6 - PA0 7 - PA1 8 - PA2 9 - PA3 10 - GND CN3 (11 pin) 1 - PB5 2 - PB4 3 - PB7 4 - PB6 5 - GND 6 - PB0 7 - PB1 8 - PB2 9 - PB3 10 - GND 11 - GND CN4 (5 pin) 1 - PC0 2 - PC1 3 - PC2 4 - PC3 5 - GND CN5 (6 pin) 1 - PC4 2 - PC5 3 - PC6 4 - PC7 5 - GND 6 - GND ---------------------------------------------------------------------------- Connector pin assignments and jumpers ---------------------------------------------------------------------------- Here are the pin assignments for CN8: 1 - GND 2 - Port D bit 5 (high current output) 3 - Port C bit 7 4 - Port C bit 6 5 - Port C bit 5 6 - Port C bit 4 7 - GND 8 - Port C bit 3 9 - Port C bit 2 10 - Port C bit 1 11 - Port C bit 0 12 - GND The Port C pins are either active-low inputs or regular outputs, depending on the direction of port C and the DIR pin of the 74LS245 controlled by CNT0. JP1 on the main board connects the 68000 /HALT pin to ground. I guess this could be used to freeze the system to take screenshots. ---------------------------------------------------------------------------- ROM board connector pin assignments ---------------------------------------------------------------------------- Main board: 171-5873-02B ROM board: 171-5987A CN1 (2x30 pins) A00 - SCR 0 D0 (Bitplane 0) B00 - SCR 0 D1 (Bitplane 0) A01 - SCR 0 D2 (Bitplane 0) B01 - SCR 0 D3 (Bitplane 0) A02 - SCR 0 D4 (Bitplane 0) B02 - SCR 0 D5 (Bitplane 0) A03 - SCR 0 D6 (Bitplane 0) B03 - SCR 0 D7 (Bitplane 0) A04 - SCR 1 D0 (Bitplane 1) B04 - SCR 1 D1 (Bitplane 1) A05 - SCR 1 D2 (Bitplane 1) B05 - SCR 1 D3 (Bitplane 1) A06 - SCR 1 D4 (Bitplane 1) B06 - SCR 1 D5 (Bitplane 1) A07 - SCR 1 D6 (Bitplane 1) B07 - SCR 1 D7 (Bitplane 1) A08 - SCR 2 D0 (Bitplane 2) B08 - SCR 2 D1 (Bitplane 2) A09 - SCR 2 D2 (Bitplane 2) B09 - SCR 2 D3 (Bitplane 2) A10 - SCR 2 D4 (Bitplane 2) B10 - SCR 2 D5 (Bitplane 2) A11 - SCR 2 D6 (Bitplane 2) B11 - SCR 2 D7 (Bitplane 2) A12 - ? B12 - ? A13 - SCR A15 B13 - SCR A14 A14 - SCR A13 B14 - SCR A12 A15 - SCR A11 B15 - SCR A10 A16 - SCR A9 B16 - SCR A8 A17 - SCR A7 B17 - SCR A6 A18 - SCR A5 B18 - SCR A4 A19 - SCR A3 B19 - SCR A2 A20 - SCR A1 B20 - SCR A0 A21 - Tile bank bit 0 B21 - Tile bank bit 1 A22 - Tile bank bit 2 B22 - Tile bank bit 3 B23 - ? A23 - ? B24 - /RESET A24 - ? A25 - ? A25 - ? A26 - ? A26 - ? A27 - ? A27 - ? A28 - ? A28 - ? A29 - ? A29 - ? A25 - ? A25 - ? /RESET is associated with the 68000 and other hardware, not the sound section. It is an output only. CN2 (2x25 pins) B18 - Sprite ROM A15 A18 - Sprite ROM A14 B17 - Sprite ROM A13 A17 - Sprite ROM A12 B16 - Sprite ROM A11 A16 - Sprite ROM A10 B15 - Sprite ROM A9 A15 - Sprite ROM A8 B14 - Sprite ROM A7 A14 - Sprite ROM A6 B13 - Sprite ROM A5 A13 - Sprite ROM A4 B12 - Sprite ROM A3 A12 - Sprite ROM A2 B11 - Sprite ROM A1 A11 - Sprite ROM A0 B10 - Sprite bank bit 3 A10 - Sprite bank bit 2 B09 - Sprite bank bit 1 A09 - Sprite bank bit 0 B08 - Sprite ROM D7 (even) A08 - Sprite ROM D6 (even) B07 - Sprite ROM D5 (even) A07 - Sprite ROM D4 (even) B06 - Sprite ROM D3 (even) A06 - Sprite ROM D2 (even) B05 - Sprite ROM D1 (even) A05 - Sprite ROM D0 (even) B04 - Sprite ROM D7 (odd) A04 - Sprite ROM D6 (odd) B03 - Sprite ROM D5 (odd) A03 - Sprite ROM D4 (odd) B02 - Sprite ROM D3 (odd) A02 - Sprite ROM D2 (odd) B01 - Sprite ROM D1 (odd) A01 - Sprite ROM D0 (odd) CN3 (2x30 pins) B30 - VCC A30 - VCC B29 - VCC A29 - VCC B28 - GND A28 - GND B27 - GND A27 - GND B26 - GND A26 - GND B25 - ? A25 - ? B24 - ? A24 - Z80 memory read strobe B23 - ? A23 - ? A22 - SOUND 3 /CS B22 - SOUND 2 /CS B21 - SOUND 1 /CS A21 - SOUND 0 /CS B20 - Z80 /EXP_CS A20 - Z80 A15 B19 - Z80 A14 A19 - Z80 A13 B18 - Z80 A12 A18 - Z80 A11 B17 - Z80 A10 A17 - Z80 A9 B16 - Z80 A8 A16 - Z80 A7 B15 - Z80 A6 A15 - Z80 A5 B14 - Z80 A4 A14 - Z80 A3 B13 - Z80 A2 A13 - Z80 A1 B12 - Z80 A0 A12 - 68K A23 B11 - 68K A22 A11 - 68K A21 B10 - 68K A20 A10 - 68K A19 B09 - 68K A18 A09 - 68K A17 B08 - 68K A16 A08 - 68K A15 B07 - 68K A14 A07 - 68K A13 B06 - 68K A12 A06 - 68K A11 B05 - 68K A10 A05 - 68K A9 B04 - 68K A8 A04 - 68K A7 B03 - 68K A6 A03 - 68K A5 B02 - 68K A4 A02 - 68K A3 B01 - 68K A2 A01 - 68K A1 Pin A24 is active when Z80 /MREQ and /RD are both low. Pin B20 is active on Z80 port access for $E0-$FF. CN4 (2x25 pins) A01 - 68K D0 B01 - 68K D1 A02 - 68K D2 B02 - 68K D3 A03 - 68K D4 B03 - 68K D5 A04 - 68K D6 B04 - 68K D7 A05 - 68K D8 B05 - 68K D9 A06 - 68K D10 B06 - 68K D12 A07 - 68K D12 B07 - 68K D13 A08 - 68K D14 B08 - 68K D15 A09 - Z80 D0 B09 - Z80 D1 A10 - Z80 D2 B10 - Z80 D3 A11 - Z80 D4 B11 - Z80 D5 A12 - Z80 D6 B12 - Z80 D7 A13 - 68K /RD B13 - 68K /LWR A14 - B14 - Z80 port read strobe A15 - Region #0 /CS B15 - Region #1 /CS A16 - Z80 ROM bank bit 5 B16 - ? A17 - Z80 ROM bank bit 3 B17 - Z80 ROM bank bit 4 A18 - Z80 ROM bank bit 1 B18 - Z80 ROM bank bit 2 A19 - ? B19 - Z80 ROM bank bit 0 A20 - 68K /UWR B20 - ? A21 - ? B21 - ? A22 - ? B22 - ? A23 - ? B23 - ? A24 - ? B24 - ? A25 - ? B25 - ? Pin B14 is active when Z80 /IORQ and /RD are both low. ---------------------------------------------------------------------------- Custom chip pin assignments ---------------------------------------------------------------------------- 315-5391 (PAL16V8) Manages Z80 address decoding. +----v----+ ZA13 |01 20| +5V ZA14 |02 19| /OPN_SEL ZA15 |03 18| /BANK_CLK ZA5 |04 17| /SNDCMD_CS ZA6 |05 16| /EXP_CS ZA7 |06 15| /CSB /M1 |07 14| /WRAMCS /IORQ |08 13| /ROM_SEL /MREQ |09 12| /MUX_SEL GND |10 11| /WR +---------+ ZA15-13,7-5 : Buffered Z80 address bus /M1 : From Z80 /M1 pin /IORQ : From Z80 /IORQ pin /MREQ : From Z80 /MREQ pin /WR : From Z80 /WR pin /OPN_SEL : To /2G of 74LS139 used to select the YM3438s /BANK_CLK : To CLK of 74LS273 used to hold the banking control word /SNDCMD_CS : To input pin on 315-5360 to enable output of internal sound command latch. /EXP_CS : Expansion /CS port for access to $E0-$FF on ROM board. CSB : To RF5C68A /CSB input WRAMCS : To work RAM /CS input /ROM_SEL : To /1G of 74LS139 used to select sound ROMs 0-3 /MUX_SEL : To multiplexer pair used to select fixed or banked ROM 315-5436 (64 pin shrink DIP) Used on the 171-5987A ROM board, so the pin assignments may be specific to that board. 1 : /RESET 2 : 68K /LWR 3 : 68K D0 4 : 68K D1 5 : 68K D2 6 : Input from tilemap generator Tile ROM A15 7 : Input from tilemap generator Tile ROM A14 8 : Input from tilemap generator Tile ROM A13 14 : Tile ROMs SCR0,SCR1,SCR2 /CS 15 : Tile ROM A13 17 : Tile ROM A14 18 : Tile ROM A15 19 : Tile ROM A16 20 : Tile ROM A17 23 : Tile ROMs SCR3,SCR4,SCR5 /CS 30 : 68K A4 31 : 68K A3 33 : 68K A2 34 : 68K A1 35 : Sprite bank bit 3 36 : Sprite bank bit 2 37 : Sprite bank bit 1 42 : ROM1 pair /CS 49 : OBJ3 pair /CS 50 : OBJ2 pair /CS 51 : OBJ1 pair /CS 52 : OBJ0 pair /CS 53 : Sprite ROM A17 54 : Sprite ROM A18 57 : 68K D7 58 : 68K D6 59 : 68K D5 60 : 68K D4 61 : 68K D3 62 : 68K /UWR 63 : Region #1 /CS The /RESET signal is an input only, and is used to reset (at least) the tile bank registers. Pin 68 is the region #1 /CS signal from the 315-5360 chip. The tile banking control signals from port H are not used by the tile ROMs or this chip. ---------------------------------------------------------------------------- Miscellaneous ---------------------------------------------------------------------------- The MB3771 power supply monitor will reset the entire system after power-up. The Z80, RF5C68A, both YM3438s, sound bank control latch, video control latch, I/O chip, and 315-5360 have a common reset signal. The 315-5360 has a dedicated reset signal for the 68000 which it will also reset after power-up. The bootleg versions of Alien Storm and Moonwalker appear to be decrypted versions of the original games. Does anyone have information about the hardware they run on? I have been told that some System 16 bootleg games use the original encrypted program ROMs with the decryption hardware implemented in TTL logic and the decryption data stored in a ROM or MCU. If there are other System 18 bootlegs like that, being able to examine the board would be very useful in understanding how the encryption works. ---------------------------------------------------------------------------- Assistance Needed ---------------------------------------------------------------------------- I'm always interested in System 16/18 schematics, ROM dumps from original or bootleg games, information about bootleg hardware or FD1094 encryption, etc. If you own any of the games listed in this document and can provide more information (board numbers, ROM board jumper settings, etc.) I will gladly accept contributions. Is it possible to dump the 8751 MCU used in Moonwalker? ---------------------------------------------------------------------------- Credits and Acknowledgements ---------------------------------------------------------------------------- - zozo for the Shadow Dancer dump and nice board scans. - Sega for their great arcade games. - Thierry Lescot and Nao for the System 16 emulator. - The MAME team for the System 16/18 drivers. - Sixtoe for maintaining the Sega Museum / System 16 website. - Fun City for the Clutch Hitter board. - Chris MacDonald for testing my test programs and financial support. ---------------------------------------------------------------------------- Disclaimer ---------------------------------------------------------------------------- If you use any information from this document, please credit me (Charles MacDonald) and optionally provide a link to my webpage (http://cgfm2.emuviews.com/) so interested parties can access it. The credit text should be present in the accompanying documentation of whatever project which used the information, or even in the program itself (e.g. an about box). Regarding distribution, you cannot put this document on another website, nor link directly to it.