The cartridge of Sonic & Knuckles is a little special. It flips open to allow you to connect another Sega Mega Drive (Genesis in US) cartridge to the top of it like so:

S&K Cartridge Sonic 3 connected to S&K Click for larger images

I know why the Sega developers did this: with the time constraints of developing Sonic 3, and the large size of the game files, they chose to split Sonic 3 & Knuckles into two separate games (Sonic 3, and Sonic & Knuckles). However, they also wanted the full game to be playable, so they invented the 'Lock-On Technology' to allow other games to connect to Sonic & Knuckles.

  • Connecting Sonic 3 results in Sonic 3 & Knuckles, the full 'intended' game:
    Sonic 3 & Knuckles Title Screen

  • Connecting Sonic 2 gives Knuckles the Echidna in Sonic the Hedgehog 2:
    Knuckles in Sonic 2 Title screen

  • Connecting Sonic 1 gives an animated "No Way? No Way!" screen with full-colour characters, with a hidden Blue Sphere minigame if you enter A+B+C:
    No Way? No Way! title screen

    Get Blue Spheres!

  • Connecting any other cartridge results in a non-animated 'No Way!" screen with greyed-out characters. Entering the code will only give you access to a single/repeated Blue Sphere stage:
    Get Blue Spheres - single game

My question is, how exactly does the Lock-On Technology work? Are the game ROMs merged in some way when connected? How does the Sonic & Knuckles cart detect another cartridge?

  • 5
    I know how I'd do it (put the program on Sonic & Knuckles, and treat the extra cartridge as a data file), but I've got no idea if that's how they did it.
    – Mark
    Commented Sep 26, 2016 at 17:14
  • 4
    I posted this question on /r/programming and hacker news (hence the extreme number of views on this post).
    – JAL
    Commented Sep 29, 2016 at 1:43
  • 4
    @Mark, it appears that's precisely how they did it. Sonic & Knuckles runs with Sonic the Hedgehog 3's ROM mapped to its address space. So the program really is part of Sonic & Knuckles and it does make use of the locked-on cartridge's data. Commented Sep 29, 2016 at 23:53

1 Answer 1


How does the Sonic & Knuckles cart detect another cartridge?

It checks the serial numbers of games; they can be found in the ROM's header. It probably detects all preceding Sonic the Hedgehog games since they all result in specific effects when locked-on.

Are the game ROMs merged in some way when connected?

It seems both games are simply mapped onto memory. This way, the executing game code gets access to the contents of both games.

To better understand what this means, imagine a Sonic & Knuckles ROM with the complete contents of the Sonic the Hedgehog 3 ROM concatenated onto it.

Sonic & Knuckles and Sonic the Hedgehog 3

The address space represents memory the game code can access. The contents of the read-only memory chips get mapped onto the Mega Drive's 68k processor's 24-bit address space. The Mega Drive just sees two games, one after another. Incidentally, that's what a good dump of Sonic 3 & Knuckles looks like. This explains why the game works even in emulators that don't support any of the custom hardware inside the Sonic & Knuckles cartridge.

Any game locked onto Sonic & Knuckles will probably have its ROM mapped onto the game's address space the same way. This means game's data is made available for use by the Sonic & Knuckles game code; it does not necessarily mean the data will be used. Since Sonic & Knuckles was programmed to work with Sonic the Hedgehog 3, it makes extensive use of the data in the locked-on cartridge. Its handling of other games is far less sophisticated; apparently, it just uses the metadata found in the ROM's header to generate a unique Blue Spheres stage. If it detects that it's the first Sonic the Hedgehog game, it simply unlocks the full version of the bonus game.

The connection to Sonic the Hedgehog 2 works similarly:

Sonic & Knuckles and Sonic the Hedgehog 3

There are two ROM chips in the Sonic & Knuckles cartridge: one has the main game and the other has a patch for Sonic the Hedgehog 2. The patch ROM contains the complete Knuckles the Echidna in Sonic the Hedgehog 2 game code; this is the full code for the original game but modified with the necessary game mechanics for Knuckles: lower speed, lower jump height, flight, wall climbing, etc. The ROM also contains new graphics data for Knuckles as well as new map data with places and items for Knuckles to reach with his abilities.

When Sonic & Knuckles detects that Sonic the Hedgehog 2 is locked on, it passes control of the processor to the code inside the patch ROM, thereby launching Knuckles the Echidna in Sonic the Hedgehog 2. The new game can reuse much of the data from the original game: level graphics, enemy data, bosses, etc. The only code from the locked-on cartridge that executes is the sound driver.

My question is, how exactly does the Lock-On Technology work?

Let's delve into the details.

According to Lock-on Technology Hacking Guide, there are some chips on the Sonic & Knuckles cartridge:

Along with the two ROM chips and the cartridge slot, they implement the Lock-On functionality.

Rizzo's photographs show what the cartridge's printed circuit board looks like:

Sonic & Knuckles cartridge printed circuit board, front Sonic & Knuckles cartridge printed circuit board, front

The Mega Drive's cartridge I/O is meant for only one cartridge. However, a cartridge locked onto Sonic & Knuckles forms a system that contains three ROM chips:

Apparently, the key functionality behind Lock-On Technology is choosing one of those ROM chips and connecting it to the appropriate addressing lines of the Mega Drive which is none the wiser.

This memory bank switching is apparently achieved via the chip enable lines. They are active when logically 0 and if inactive will cause all memory addressing operations to be ignored and nothing to be returned on the data bus, effectively "disabling" the chip. If one of the ROMs is disabled, the other will be mapped in its place. The Mega Drive just sees a big cartridge with a big address space.

Rizzo also made a schematic of the electronics:

Sonic & Knuckles Lock-On schematics, full

Even though I'm not an electronics expert, I was able to figure some things out by studying the schematics and reading the notes on the website. Here's what I learned.

The 74HC74 Flip-Flop

The purpose of this chip is to hold a single bit of information: is Sonic the Hedgehog 2 locked on? Much of the circuit's operation depends on this single bit. It is denoted by the red node on the schematic, corresponding to the 74HC74's Q output.

When Sonic & Knuckles boots, it checks its cartridge slot. If there is a game locked on, it tests if its serial number matches that of earlier Sonic games. If it detects Sonic the Hedgehog 2, a signal is generated on the ROM's D0 line, setting the Q bit of the 74HC74.

On Hacker News, Dylan16807 provides additional information about the workings of this bit:

This is missing some important information. One input to the flip flop is D0 on the ROM, yes, but it only sets when there is a clock signal. Otherwise there would be some very interesting coding constraints.

The clock of the flip flop is connected to cartridge pin B31. Here's the best explanation I can find of that pin:

/TIME is the schematic label given to pin B31 on the cartridge slot. It is essentially a chip enable for the I/O port range $A130Fx, and is used for programming on-cart memory mappers. The only games I know of that use it are Beyond Oasis, Phantasy Star 4 (both for switching between ROM and SRAM at $200000-3FFFFF) and Super Street Fighter 2 (for a full-blown ROM banking chip). I don't know why it's called /TIME; perhaps they expected to connect an RTC chip to it.

So if you write to certain addresses, the genesis will flicker that pin, which is great for controlling an extra chip like this. (I mean, it's meant to control an extra chip, but it seems like the plan is a significantly smarter one than a flip flop.)

The 74AC139 decoder/demultiplexer

There are two independent decoders M and N, each with three inputs , SA and SB as well as four outputs Y0, Y1, Y2 and Y3. If is 1, all outputs are also forced to 1.

The Y outputs obey the following truth table:

E̅ SA SB Y0 Y1 Y2 Y3
1 -- --  1  1  1  1
0  0  0  0  1  1  1
0  1  0  1  0  1  1
0  0  1  1  1  0  1
0  1  1  1  1  1  0

The I/O arrangement of each decoder

M is connected to to address line 20 and the output of the 74HC74 through SA and SB respectively; is connected to the Y3 output of N. The chip enable line of the Sonic the Hedgehog 2 patch ROM is connected to Y3, while Y0, Y1 and Y2 are all inputs to the 74AC08.

N is connected to address line 21 through both SA and SB. The chip enable signal from Mega Drive is connected to . The chip enable line of the Sonic & Knuckles ROM is connected to Y0 but Y1 and Y2 are not connected to anything at all. Y3 is connected to M's input.

Putting it all together

Decoder M controls the activation of both the Sonic the Hedgehog 2 patch ROM and the locked-on cartridge's ROM. Decoder N controls the activation of the Sonic & Knuckles ROM.

The A21 line addresses memory that is beyond the bounds of the game's 2 megabytes ROM. If this memory is accessed, the result is that the Sonic & Knuckles ROM is disabled. Otherwise, it is enabled and M's is set.

The A20 line addresses memory that is within bounds; if that memory is accessed and the 74HC74 is also set, the Sonic the Hedgehog 2 patch ROM is enabled and the outputs to the 74AC08 are all 1. If M's is set, the 74AC08 also receives all 1s, but the patch ROM is not enabled.

The 74AC08 AND Gates

The 74AC08 has three inputs Y0, Y1 and Y2 as well as a single output that equals Y0 ∧ Y1 ∧ Y2 and is connected to the locked-on cartridge's chip enable line. Therefore, the second cartridge's ROM will only be mapped when all its inputs are 1:

  • Locked-on cartridge is Sonic the Hedgehog 2
  • Sonic & Knuckles ROM is enabled
    • M's is set
  • 4
    Nice find with the "Lock-on Technology Hacking Guide!"
    – Aaron
    Commented Oct 5, 2016 at 17:53
  • 2
    You are some kind of hero Commented Feb 1, 2018 at 18:11
  • 1
    I wish I could upvote you more than once, thanks for the additions to do with Sonic 2, it makes it so much clearer :)
    – Robotnik
    Commented Feb 5, 2018 at 23:41
  • 4
    Thanks for your kind words. Every time I read the pages I linked, I end up learning something new and editing this answer. The guys who figured all this out are the real heroes. I wish a professional would comment on my analysis of the circuit; if there are errors, I would like to fix them and learn more. Commented Feb 6, 2018 at 0:17
  • 2
    Dylan16807 added some additional information/corrections at news.ycombinator.com/item?id=36743029.
    – pbhj
    Commented Jul 16, 2023 at 9:33

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .