Saturday 12 October 2019

Deconstructing Sega's System 16 Security - Part 1



Sega's System 16 was a new arcade platform introduced in 1986 as a successor to the earlier 8 bit Z80 designs Sega System 1 and System 2. The new system brought in many system upgrades including 16 bit Motorola 68000 CPUs and pioneering security.

Above all System 16 was one of Sega's most successful games platform seeing the release of countless epic games that form part of our collective childhood memories. Among my favorites titles are Shinobi, Golden Axe, Outrun, or Michael Jackson's Moonwalker to name a few, I bet you have yours too.

The platform got subsequent updates and revisions introducing improvements to base specs and integration of chips. The initial System 16A was released in 1986 followed soon by the more common System 16B in 1987, a later revision known as System 18 was introduced in 1989. Specs for all three revisions are as follows:


System 16A specifications

Main CPU: Motorola 68000 or Hitachi FD1089/FD1094 security modules @ 10 MHz
Memory: 16kB + 2 kB
Sound CPU: NEC uPD780C-1 (Zilog Z80) @ 4 MHz
FM synthesis sound chip: Yamaha YM2151 @ 4 MHz (8 FM synthesis channels)
PCM sound chip: NEC uPD7751@ 6 MHz
ADPCM channels: 3
Audio bit depth: 8-bit
Custom GPU chipset: 315-5011 sprite line comparator, 315-5012 sprite generator, 2× 315-5049 tilemap chips, 315-5107 & 315-5108 display timers, 315-5143 & 315-5144 sprite chips, 315-5149 video mixer
Performance: 12.5874 MHz sprite line buffer render clock, 6.2937 MHz sprite line buffer scan/erase & pixel clock
Display resolution: 320×224 to 342×262 (horizontal), 224×320 to 262×342 (vertical), progressive scan
Color palette: 98,304
Colors on screen: 4096 (unique colors) to 6144 (with shadow & highlight)
Graphical planes and sprite capabilities: 2 tile layers (row & column scrolling, 8×8 tiles), 1 text layer, 1 sprite layer. Dual line buffers, double buffering, 128 on-screen sprites, 800 sprite pixels (800.75 sprite processing ticks) per scanline, 100 sprites per scanline, 16 colors per sprite, 8 to 256 width, 8 to 256 height

Fantasy Zone System 16(A) motherboard

Note: a few of the initial System 16 games were released in what's know as Pre-System 16 hardware, this rare system looks pretty much like modified a System1 / 2 pcb.

Alien Syndrome. Pre-System 16 motherboard

System 16B specifications

Sound upgrades
Sound CPU: Zilog Z80 @ 5 MHz or NEC MC-8123 security module
PCM sound chip: NEC uPD7759 ADPCM Decoder @ 640 kHz
ADPCM channels: 8
Audio bit depth: 9-bit
Other features: 8 kHz sampling rate, up to 128 KB audio ROM and 256 samples

Video upgrades
GPU chipset: 315-5196 sprite generator, 315-5197 tilemap generator, 315-5213 sprite chip, 315-5248 & 315-5250 math chips
Sprite capabilities: Sprite-scaling

Wonder Boy III Monster Lair. System 16(B) motherboard

System 18 specifications

Sound upgrades
Sound CPU: Zilog Z80 @ 8 MHz
Sound chip: 2 × Yamaha YM3438 @ 8 MHz + Ricoh RF5c68 @ 10 MHz (8-channel PCM chip, remarked as Sega Custom 315)

Video upgrades
Graphics chips: Sega System 16B chipset, Yamaha YM7101 VDP
Colors on screen: 4096 (unique colors) to 8384 (with shadow & highlight)
Graphical planes and sprite capabilities: 4 tile layers, 1 text layer, 1 sprite layer with hardware sprite zooming, translucent shadows, sprites of any height and length.

Michael Jackson's Moonwalker. System 18 motherboard


Sega meets Hitachi

With the introduction of System 16, selected games replaced the main system 68000 CPU with secretive Hitachi branded device modules, these modules were Hitachi FD1089 revisions A and B, and a more commonly found Hitachi FD1094.


Pictured a couple of HITACHI modules used in Sega System 16 game boards


Most modules feature a sticker with a seven-digit code unique per game title and region. For arcade operators or collectors trying to replace these modules with a regular 68000 CPU or a different Hitachi module, this would result in a non-working game. A battery inside also plays a fatal role, losing its power renders the module unusable.

In combination with encrypted roms the modules provided Sega with a way to control piracy and stop unauthorized board conversions (when a game base system is reused for a different game).

Sega's work with Hitachi was no coincidence, at the time probably no other company in Japan would have the expertise, technology, and rights to be able to produce custom 68000 based modules. Early on Hitachi helped Motorola, the company behind the 68000 CPU, overcome critical manufacturing challenges and achieve repeatable production of the new CPU. In exchange Hitachi was allowed to second source 68000 CPUs under the Hitachi brand.

Hitachi's work with customer modules was not limited to Sega game systems, different modules for different customers were also produced over the years. Here's a few examples found on the net:

FD1095 a custom module close numbered to Sega's FD1094, its purpose or nature is unknown


Several HITACH FD modules found online

Some of these modules can be bought online at present time, in fact, IC supplier Kynix has an active listing selling Sega's FD1094 stock, to verify the validity of the listing I purchased a lot which turned to be right. The modules seem to be refurbished as some of them still contain valid game data and are visibly used.

FD1094 modules purchased from Kynix

Inside the modules

Over the next posts we will discuss the internals of the FD1089 and FD1094 modules, reveal their construction and facts of interest.

Stay tuned.


8 comments:

  1. Great write up. Thanks Ed. Looking forward to part 2

    ReplyDelete
  2. Looking forward to reading all about this - it's fascinating stuff.

    ReplyDelete
  3. Awesome, soooo keen to see what is actually in these puppies. Thanks!!!

    ReplyDelete
  4. Awesome work, and your articles are a pleasure to read. Thanks for all the information you shared.

    ReplyDelete
  5. Got me very curious on the used modules with leftover data in them... Might be worth checking against known data as you should be able to identify them using the verify feature... If they happen to be undumped would be interesting attempt table extraction...

    ReplyDelete
  6. awesome! Can´t wait do read more abaout it!

    ReplyDelete
  7. Would it be possible if you could give all of us thirsty nerds an update with Part 2 while we're all on lockdown? Can't wait for your write up on the MC-8123B module too. Thanks again. =)

    ReplyDelete
  8. Is there any way to reprogram the MC-8123B modules?
    Thanks!

    ReplyDelete