How does the Sonic & Knuckles cart detect another cartridge?
It checks the serial numbers of games; they can be found in the ROM's header. It probably detects all preceding Sonic the Hedgehog games since they all result in specific effects when locked-on.
Are the game ROMs merged in some way when connected?
It seems both games are simply mapped onto memory. This way, the executing game code gets access to the contents of both games.
To better understand what this means, imagine a Sonic & Knuckles ROM with the complete contents of the Sonic the Hedgehog 3 ROM concatenated onto it.
The address space represents memory the game code can access. The contents of the read-only memory chips get mapped onto the Mega Drive's 68k processor's 24-bit address space. The Mega Drive just sees two games, one after another. Incidentally, that's what a good dump of Sonic 3 & Knuckles looks like. This explains why the game works even in emulators that don't support any of the custom hardware inside the Sonic & Knuckles cartridge.
Any game locked onto Sonic & Knuckles will probably have its ROM mapped onto the game's address space the same way. This means game's data is made available for use by the Sonic & Knuckles game code; it does not necessarily mean the data will be used. Since Sonic & Knuckles was programmed to work with Sonic the Hedgehog 3, it makes extensive use of the data in the locked-on cartridge. Its handling of other games is far less sophisticated; apparently, it just uses the metadata found in the ROM's header to generate a unique Blue Spheres stage. If it detects that it's the first Sonic the Hedgehog game, it simply unlocks the full version of the bonus game.
The connection to Sonic the Hedgehog 2 works similarly:
There are two ROM chips in the Sonic & Knuckles cartridge: one has the main game and the other has a patch for Sonic the Hedgehog 2. The patch ROM contains the complete Knuckles the Echidna in Sonic the Hedgehog 2 game code; this is the full code for the original game but modified with the necessary game mechanics for Knuckles: lower speed, lower jump height, flight, wall climbing, etc. The ROM also contains new graphics data for Knuckles as well as new map data with places and items for Knuckles to reach with his abilities.
When Sonic & Knuckles detects that Sonic the Hedgehog 2 is locked on, it passes control of the processor to the code inside the patch ROM, thereby launching Knuckles the Echidna in Sonic the Hedgehog 2. The new game can reuse much of the data from the original game: level graphics, enemy data, bosses, etc. The only code from the locked-on cartridge that executes is the sound driver.
My question is, how exactly does the Lock-On Technology work?
Let's delve into the details.
According to Lock-on Technology Hacking Guide, there are some chips on the Sonic & Knuckles cartridge:
Along with the two ROM chips and the cartridge slot, they implement the Lock-On functionality.
Rizzo's photographs show what the cartridge's printed circuit board looks like:
The Mega Drive's cartridge I/O is meant for only one cartridge. However, a cartridge locked onto Sonic & Knuckles forms a system that contains three ROM chips:
- Sonic & Knuckles cartridge
- Sonic & Knuckles ROM 2 MB
- Sonic the Hedgehog 2 patch ROM 512 kB
- Locked-on cartridge
Apparently, the key functionality behind Lock-On Technology is choosing one of those ROM chips and connecting it to the appropriate addressing lines of the Mega Drive which is none the wiser.
This memory bank switching is apparently achieved via the chip enable lines. They are active when logically 0 and if inactive will cause all memory addressing operations to be ignored and nothing to be returned on the data bus, effectively "disabling" the chip. If one of the ROMs is disabled, the other will be mapped in its place. The Mega Drive just sees a big cartridge with a big address space.
Rizzo also made a schematic of the electronics:
Even though I'm not an electronics expert, I was able to figure some things out by studying the schematics and reading the notes on the website. Here's what I learned.
The 74HC74 Flip-Flop
The purpose of this chip is to hold a single bit of information: is Sonic the Hedgehog 2 locked on? Much of the circuit's operation depends on this single bit. It is denoted by the red node on the schematic, corresponding to the 74HC74's Q output.
When Sonic & Knuckles boots, it checks its cartridge slot. If there is a game locked on, it tests if its serial number matches that of earlier Sonic games. If it detects Sonic the Hedgehog 2, a signal is generated on the ROM's D0 line, setting the Q bit of the 74HC74.
On Hacker News, Dylan16807 provides additional information about the workings of this bit:
This is missing some important information.
One input to the flip flop is D0 on the ROM, yes, but it only sets when there is a clock signal.
Otherwise there would be some very interesting coding constraints.
The clock of the flip flop is connected to cartridge pin B31.
Here's the best explanation I can find of that pin:
/TIME is the schematic label given to pin B31 on the cartridge slot.
It is essentially a chip enable for the I/O port range $A130Fx, and is used for programming on-cart memory mappers.
The only games I know of that use it are Beyond Oasis, Phantasy Star 4 (both for switching between ROM and SRAM at $200000-3FFFFF) and Super Street Fighter 2 (for a full-blown ROM banking chip).
I don't know why it's called /TIME; perhaps they expected to connect an RTC chip to it.
So if you write to certain addresses, the genesis will flicker that pin, which is great for controlling an extra chip like this.
(I mean, it's meant to control an extra chip, but it seems like the plan is a significantly smarter one than a flip flop.)
The 74AC139 decoder/demultiplexer
There are two independent decoders M and N, each with three inputs E̅, SA and SB as well as four outputs Y0, Y1, Y2 and Y3. If E̅ is 1, all outputs are also forced to 1.
The Y outputs obey the following truth table:
E̅ SA SB Y0 Y1 Y2 Y3
1 -- -- 1 1 1 1
0 0 0 0 1 1 1
0 1 0 1 0 1 1
0 0 1 1 1 0 1
0 1 1 1 1 1 0
The I/O arrangement of each decoder
M is connected to to address line 20 and the output of the 74HC74 through SA and SB respectively; E̅ is connected to the Y3 output of N. The chip enable line of the Sonic the Hedgehog 2 patch ROM is connected to Y3, while Y0, Y1 and Y2 are all inputs to the 74AC08.
N is connected to address line 21 through both SA and SB. The chip enable signal from Mega Drive is connected to E̅. The chip enable line of the Sonic & Knuckles ROM is connected to Y0 but Y1 and Y2 are not connected to anything at all. Y3 is connected to M's E̅ input.
Putting it all together
Decoder M controls the activation of both the Sonic the Hedgehog 2 patch ROM and the locked-on cartridge's ROM. Decoder N controls the activation of the Sonic & Knuckles ROM.
The A21 line addresses memory that is beyond the bounds of the game's 2 megabytes ROM. If this memory is accessed, the result is that the Sonic & Knuckles ROM is disabled. Otherwise, it is enabled and M's E̅ is set.
The A20 line addresses memory that is within bounds; if that memory is accessed and the 74HC74 is also set, the Sonic the Hedgehog 2 patch ROM is enabled and the outputs to the 74AC08 are all 1. If M's E̅ is set, the 74AC08 also receives all 1s, but the patch ROM is not enabled.
The 74AC08 AND Gates
The 74AC08 has three inputs Y0, Y1 and Y2 as well as a single output that equals Y0 ∧ Y1 ∧ Y2 and is connected to the locked-on cartridge's chip enable line. Therefore, the second cartridge's ROM will only be mapped when all its inputs are 1:
- Locked-on cartridge is Sonic the Hedgehog 2
- Sonic & Knuckles ROM is enabled
Click for larger images
