Researchers:
This question was asked before and it sat for an entire month and then expired.
If there is a problem, whether you need more information, or need more
money before it is worth it ($100 isn't adaquate?) ... please let me
know in a request for clarification or just in a comment below.

Please, if everyone is skipping this question I'd like to know how to
remedy this now instead of just watching it sit and then expire after
another month without knowing what caused it.

Thank you.


Anyway, onto the question...
=======================================

I realize some SNES cartridges used coprocessors to enhance the
abilities of the system.  This is not what I am referring to.

Games for the SNES and NES both contained a CPU in every single
cartridge.  This chip was usually labelled 'CIC' on the printed
circuit board.  The code changed between the systems, but the CPU was
the same.  The CPU is 4-bit and its opcodes are 8-bit.

Here is an example of the datecode/information on a NES CIC chip:
6113B1
(c) 1988 Nintendo
9046 5 AB

Here is an example of the datecode/information on a SNES CIC chip:
D411A
(c) 1990 Nintendo
9442 BA


I cannot personally verify this, but I have heard that Nintendo64
cartridges also used the same CPU. (If you go this route to answer the
questions, I will also need verification that the N64 cartidges did
use the same CPU.)


I would like the following:
1] What CPU did Nintendo use in all their NES and SNES cartridges?
2] A list of the CPU's opcodes (hex value and function of opcode).

---

Request for Question Clarification by pafalafa-ga on 30 Jun 2005 05:38 PDT

snesprogrammer-ga,

I didn't want your question to come and go without at least one
comment from a Google Answers researcher.

I didn't attempt to answer this question for two reasons:

1.  I'm not familiar with the lingo used here, and have no personal
experience with Nintendo games, so I'd have to do a lot of
self-education before really feeling comfortable with this question.

2.  I'd only do that sort of self-education when there seems a high
likelihood that the question can be answered.  But so far, I've seen
nothing to suggest that this one is readily approachable.


Hope someone can dive in here at the last moment and get you the
information you need (but it won't, alas, be me).


pafalafa-ga

following taken off this website:
http://www.raphnet.net/electronique/nes_cart/nes_cart_en.php

 "The allow the use of more memory, supplemental chips are required in
the cartridge. Those are named mappers and make bank switching
possible. With bank switching, it is possible to point an address
range (from the CPU point of view) to various areas in the ROM. eg:
Address range $C000-$FFFF which normally points to the range
$4000-7FFF in ROM could point to $8000-$C000 instead. This is
transparent from the CPU point of view. (except the actual operation
of switching bank).

Many different mapper chips exists, and some mappers are very complex.
The mapper present in my cartridge is a MMC1 by Nintendo. Here is some
documentation about this mapper:
(http://www.raphnet.net/electronique/nes_cart/mmc1.txt).

 In the cartridge, there is also a protection chip (CIC). The CIC chip
communicates with the CIC chip inside the NES. If the communication is
successful, the NES's CIC chip stops resetting the NES at 1hz and the
game can run. I just left the chip were it was."


I'm not sure if you are talking about the mapper or the CIC protection
chip, and maybe with just this information you can figure out what you
need, if not let me know and I'll try to look up the op codes for the
one you want, etc.

http://nesdev.parodius.com/

(here is another site with tons of info on the nes and programming it,
it lists tons of mappers and links to more info about them if you are
intersted in those, still looking for CIC op codes and info)

Here is the relevant patent on the CIC chip used in both cartridges:
http://www.freepatentsonline.com/4799635.html

Here is a link to a guide on how to disable the security:
http://cgfm2.emuviews.com/txt/snestech.txt

Maybe these aren't helping at all and you have already found all
this... but here is one more place with another bit of info on the
CIC:

CIC
---
4MHZ: cicurity chip clock line.

S0..S2: pins carrying cicurity chip protocol signals. Without the use of 
another 6113 or 3193 device connected here, the NES control deck cannot 
function properly (the cicurity chip inside the control deck will send a 
nice 1Hz square wave to the 2A03 /reset and 2C02 /SYNC input lines). Much is 
unknown about how the NES cicurity chips work, but there is some 
documentation on it at the usual place, which includes pinout & hookup info, 
and info on some techniques 3rd party NES game developers used to defeat it 
(with simple discrete electronic components). For additional information on 
the CIC not found anywhere else, refer to the following patent documents: 
U.S.#4,799,635 and U.S.#5,070,479.

hobbes828-ga:
Apparently, your last comment and my response were removed due to
request/mention of outside transactions.  I don't understand, since I
obviously already have your contact info now.  Do they not want other
people seeing it as well?  It's not like google-answers wasn't given
time to answer it themselves (one month plus some!)... without a
single word from them.  Eh, whatever.

So here's my comment again with "that portion" removed:
-------------
hobbes828-ga:
Thank you for your efforts.  That is some interesting info about the
chips (especially the patents).  Unfortunately it doesn't really
answer my question.  The information you provided, including the
patents, basically just tell me what the software in the chip is
making the hardware do (ie what the function of the chip is here). 
I'm more interested in the hardware / the CPU itself... in this case,
identifying the CPU.  I also asked for the opcodes of the CPU, because
just knowing the name of it (or family of it) is nice, but doesn't
help if I can't also find the opcode list.

Again, thank you for trying though.
-----------

Please google researchers ... someone work on my question.  Or at the
very least, don't let this expire again without letting me know why
everyone passes this question up (even with a $100 offer).

Please, the silence is deafening.

NES, SNES and N64 game cartidges all contain a chip called CIC by
Nintendo, and usually refered as "lockout chip". It serves the purpose
of determining the authenticity of the cartidge.

The CIC chip is NOT a CPU. That's why nobody can give you an
instruction set, a datasheet, register set, etc. A CPU process data
and can be adapted to many purposes depending on the program that it
runs. While the CIC does some data processing, not all data processing
integrated circuits are CPU. The CIC is an ASIC (Application-specific
integrated circuit) that is solely designed for one task: securing
game cartidges, and does that in hardware, not software.

If you want to know more about ASIC and differences between CPU, check
this: http://en.wikipedia.org/wiki/Asic

I will speak about the N64 CIC chip, which is the latest one Nintendo
designed, and with which I have some experience. the N64 CIC in the
game cartidges acts as a key, and the N64 PIF chip found inside the
N64 console acts as a lock. When the N64 is powered on, a small BIOS
stored in the PIF chip is executed and reads the 1st 1kb of the
inserted game cartidge. It then does some checksum over the data using
a custom algorithm. The resulting value of this algorithm is a 48bit
number. This 48bit number is then sent to the CIC, and if it's not the
value it expects, it locks the console.

This is a protection so that people can't temper with the 1st 1kb of
ROM of the game cartidges, for security reasons. But this is not the
only feature of the N64 CIC. During the gameplay there is constant
communication between the PIF (which is also an ASIC btw) and the CIC,
and if it fails the console is locked aswell.

That is for N64 but the same mechanism is surely true for NES and
SNES. To sum up, you can't program on a CIC chip, and you can't "read
the program" of a CIC chip, because there's simply no program, just
hardware (gates, registers, etc) with a specific function.

I'll finish with a quote from http://www.zyx.com/chrisc/NESTechFAQ.html#lockout

------ QUOTE -------
What is the NES lockout chip (CIC) and how does it work?
Nintendo are greedy and they wanted to maximize their profits by
requiring developers to have a licence before making games for the
NES. As a way to ensure this, they installed a chip inside the NES
unit which looks for a similar chip inside each game cartridge. The
two chips then establish a communications protocol. Without this
protocol, the NES unit never comes out of reset mode. Since only
Nintendo sold this lockout chip, developers had little choice but to
buy them from Nintendo (through a licence), or else they would have to
find ways of disabling the lockout chip, which is what the majority of
unlicenced developers did. There are also regional lockouts. Several
European varieties of lockout chips exist, as do Asian varieties. In
general, USA NES games/systems are not compatible with Euro/Asian NES
games/systems until you disable the lockout chip.

I don't think anybody in the public really knows the communications
protocol of the CIC in detail, but since there is a way to disable the
chip permanently, I don't think it's too important anymore. As far as
I know, the new top-loading NES unit has no lockout chip. No Famicom
systems have lockout chips either.
--------------------

After more research for the NES model I found out that several web
site mention that the CIC chip in the NES is a microprocessor (CPU)
running a program named "10NES". Either this affirmation is true which
means that Nintendo licensed a CPU that they integrated to the CIC
chip or designed a specific one for this task, or maybe this
affirmation is false and 10NES is the name of an algorithm that is
implemented in hardware.

Atari wanted to know how the CIC chip worked. And they succeeded...in
their own way;)... The "background" section of the following page
explains how :
http://cyber.law.harvard.edu/openlaw/DVD/cases/atarivnintendo.html

I know very little about the N64 since I haven't looked into it much. 
So thank you for the information about the N64 chip.  As for the
information about what the CIC does, that is not helpful here.  I know
the function of the CIC chip in the system.  That is not what I am
asking for.

Sadly, you also included some disinformation.

You wrote:
"The CIC chip is NOT a CPU. That's why nobody can give you an
instruction set, a datasheet, register set, etc."

It is a CPU.  Moreover, by looking at the ICs in a microscope, one can
see that the SNES and NES CIC chips use the same CPU. (only the code
changes).

Please ... I'm afraid you might scare away potential researchers.
I repeat, there is a CPU, and it does have an instruction set.

Not only that, but I know:
- the CPU is 4-bit
- the instruction codes are 8-bit

You wrote:
"... you can't "read the program" of a CIC chip, because there's
simply no program, just hardware (gates, registers, etc) with
a specific function."

There is a program.  Not only that, I have "read the program" in a
very crude way already.  I have the ROM bits for the NES and SNES CIC
chips, but without the instruction set they mean nothing to me. 
(Also, for technical reasons, I may have the ordering wrong.  This is
easy to correct once the instruction set is known.  I have done it
before for other CPU's / ROMs.)

You write:
"... I found out that several web site mention that the CIC chip in
the NES is a microprocessor (CPU) running a program named "10NES".
Either this affirmation is true which means that Nintendo licensed
a CPU that they integrated to the CIC chip or designed a specific
one for this task, or maybe this affirmation is false and 10NES is
the name of an algorithm that is implemented in hardware."

It is true that it is a CPU.  So, as you mentioned, this narrows it down to:
- did Nintendo license a CPU core?
- or did Ninteno design a specific one for this task?

I fully admit that I don't know how businesses make their decisions,
but it seems to me that designing and debugging a CPU core from
scratch would be quite wasteful when there are so many working cores
already in existence.  I really hope Nintendo didn't make their own
(because then finding the info would be harder), and I personally
think it is more likely that they just bought/liscenced an existing
CPU core from someone.


You seem like a smart guy.  Do you have any suggestions for how I can
identify the CPU core if it is not a custom one?

For instance, can someone check financial records and see who Nintendo
bought/liscenced intellectual property from back then?

Q: can someone look at the financial records of Nintendo to see
whether they bought the IP/core from someone else?

A: Sure thing! Just change the payment price to 10,000.

As to cartridges, aren't there the lockout chip manufacturers and
cartridge cloning/programming companies? Why don't you find those guys
and see if anyone there remembers tech details about the cartridges
they hacked.