In order to try to control the quality of the games being produced for the NES, Nintendo needed to devised a method to ensure that they would have direct control over any game released on their system, as well as an effective method for region control.  Having seen a glut of low-quality games flood the Famicom market, Nintendo didn’t want the same thing to happen with the NES when it was released in the US and Europe.  As a result, included in every NES-001 sold there is a small 16-pin DIP 4-bit microprocessor that serves as a gatekeeper for the console, only allowing games that have been officially licensed by Nintendo to boot properly.  That chip is called the 10NES, and even if you have never heard of it, you have probably indirectly seen and experienced the effects of its presence. Eventually, the 10NES would be defeated by unlicensed developers, allowing a few dozen games to be made outside of Nintendo’s influence.  In general though ,the 10NES system was succesful and allowed Nintendo to maintain a firm hold on game development throughout the life cycle of the console, something that would continue through the SNES and N64 eras.

In order to be able to exert the level of control that Nintendo wanted over game developers, a hardware solution was needed.  Nintendo devised the 10NES (or Checking Integrated Circuit/CIC) lockout system to hopefully guarantee that there would be no credible way to create a cartridge for the NES without Nintendo’s explicit approval.  The 10NES system relied on identical chips in both the console and the game cartridge.  The one in the console acts as a lock, and has direct control over the reset line for the console.  The chip in the cartridge acts as a key, communicating with the lock chip in the console; only after the lock chip has verified that there is a valid 10NES key in the game will it allow the NES to boot properly.  The authentication takes the form of a special code that is transmitted from the key chip to the lock chip at a precise time; if the code is not detected at the right time, the lock chip in the console will force the console to reboot once a second until a valid code is detected.  Now, normally you could just hook an oscilloscope up to the console, monitor the data lines between the two 10NES chips, and then create a chip of your own that sent a counterfeit code at the right time.  Unfortunately for those trying to produce unlicensed games, Nintendo took the effort to both patent and copyright the software and code running on the 10NES chip, effectively making it illegal to duplicate the functionality of the 10NES chip.  If you wanted to have a legitimate 10NES chip in your game, you had to buy it through Nintendo.

10NES chip on NES game cart

The 10NES chip on my copy of Castlevania

What does the 10NES system mean to the consumer?  Well, combined with the zero-insertion force 72-pin socket, the 10NES chip is primarily responsible for anytime you are having trouble getting a game to boot.  Anytime you see the 1 Hz red blinking power light, what you are actually seeing is the 10NES chip forcing a console reboot every 1 second.  This usually happens because the game is not making adequate contact with the 72-pin socket, and the key chip cannot appropriately communicate with the lock chip.  Most of the time you wasted blowing on cartridges as a kid can be chalked up to the 10NES and it’s inability to authenticate the game cartridge you were trying to play.

10NES chip on an NES motherboard

The 10NES chip found on the NES-001 motherboard. The 4th pin from the left on the bottom controls whether the chip acts as a lock or a key. Clipping this pin defeats the lockout system for the console.

As it turns out, there is an easy way to get around the 10NES system, but not one that is for the mainstream consumer market.  Remember that the key chip and the lock chip are actually identical?  While the actual chips are identical, the way they are wired up is different.  The lock chip in the console relies on a single +5 volt signal to tell it to act as the lock in the authentication.  The same pin on 10NES chips found in game cartridges is tied to ground, commanding it to operate as a key chip.  Simply clipping that signal line in the console (and, if you’re thorough, tying it to ground) convinces the 10NES chip on the console motherboard to act as a key, effectively abandoning its control over the reset line.  This will allow the NES to boot any cartridge no matter what region it is or whether it has a 10NES chip inside it.  This can also greatly improve the reliability of your console to boot even officially licensed games if you have a dirty or worn 72-pin connector.

Lockout defeat circuitry from Micro Machines cartridge

The lockout defeat circuitry from my copy of Micro Machines. It even includes a switch that will attempt two different defeat strategies if one doesn’t work

Since opening up an NES and getting medieval on the motherboard was not something that most consumers would do, developers looking to produce unlicensed games had to get creative.  Early methods to disable the 10NES lockout scheme involved using a circuit to stun the lock chip with a burst of negative voltage upon power-up, keeping the chip from forcing the console into a reboot cycle.  As games that could defeat the 10NEs showed up however, Nintendo responded by updating the NES motherboard to be more resilient to the attacks.  It actually led to a bit of an arms race, and the developers struggled to stay ahead of Nintendo’s protective measures.  As such, some of the later NES motherboard revisions (especially revision -11), cannot play a large number of unlicensed games, as the defeat mechanisms aren’t viable against the later console hardware.  Similarly, an early motherboard revision such as -04 (the original retail release) will be able to play any unlicensed games as its 10NES protection architecture is virtually non-existant.  This makes earlier NES consoles preferable over their later counterparts, which is something to keep in mind if you are in the market for a new (used) NES.

NES motherboard version -05

Early NES motherboard revisions, like this NES-CPU-05, should be susceptible to all lockout defeat schemes, enabling it to play any unlicensed game.

With the move away from the toaster style NES-001 and the release of the top loading NES-101, Nintendo omitted the 10NES chip as well as the flawed 72-pin zero-insertion force socket.  This makes the top-loader a much more reliable console for properly booting games.  Both the SNES and the N64 would also have similar, but significantly more complex, lockout schemes implemented.  With the move to a standard, high force, card-edge socket, however, the later consoles would rarely have problems booting and the lockout scheme would be effectively invisible to the end user unless you were trying to play cross-region games.

If you see any information in this post that is incorrect or wrong, please let me know!  I am striving  to paint as accurate a picture as possible, and will gladly welcome input.  In a future post, I will explore the 10NES functionality more closely, as well as some of the methods used to defeat the lockout scheme.  Until then, enjoy this crappy *.gif I made!

Unlicensed NES game pokemon style

AssocAds_468x60._V385221739_