Skip to content

System 16/18/24: FD1094 / FD1089 (de-suicide & conversion)

Many Sega System 16B/18/24 games (and Outrun/X-Board) run on a security CPU: an encrypted 68000. The FD1094 keeps its key in an internal battery-backed SRAM → dead battery = dead game (suicide). Good news: the security has been fully reverse-engineered (MAME), so you can restore a board, replace the battery without losing the key, or convert an FD1094 to any game.

Field Value
Platforms Sega System 16B / 18 / 24, Outrun, X-Board…
Chips FD1094 (68000 + SRAM key) · FD1089 A/B (variant)
Specific System 18 adds an 8751 MCU → see System 18 conversions
Difficulty 🟡 (battery swap) → 🟠 (Arduino re-key / ROM de-suicide)
Suicide? Yes — key in battery-backed internal SRAM

How the FD1094 works

  • It is a Hitachi security module: a 68000 core + an internal SRAM of ~8 KB holding the decryption key, battery-backed.
  • The program is encrypted at the opcode level: the decryption state depends on the current address (not a simple global XOR).
  • Removing / draining the battery wipes the SRAM → the 68000 no longer decrypts anything → dead screen.
  • The FD1089 is a variant; note: its A and B flavours are not interchangeable (an "A" key only fits "A" hardware).

Three routes (from most "original" to most "practical")

1. Replace the battery without losing the key (preservation)

As long as the board still boots, you can hot-swap the battery: wire the new battery in parallel (piggyback) before removing the old one, so the SRAM never loses power. A fresh battery lasts 20–30 years.

Never cut SRAM power

If the SRAM loses power for even a fraction of a second during the operation, the key is lost. Measure, prepare, and solder the new battery in parallel first.

2. Re-key: rewrite the key into a dead FD1094 (the "clean" method)

Since the keys are known (extracted by MAME), you can reprogram the key into a suicided FD1094 → the board becomes an unmodified, encrypted original. The ideal preservation.

Hardware (ArcadeHacker guide):

  • Arduino Mega 2560 Rev 3
  • 64-pin socket (ZIF or turned-pin)
  • a dedicated PCB shield (files available, PCBway fab) + headers

Procedure:

  1. Assemble the shield (headers + 64-pin socket).
  2. Load the FD1094/FD1089 firmware in the Arduino IDE.
  3. Select the target game in the code, compile, upload.
  4. Insert the security module into the socket.
  5. Command w = write the keys.
  6. Command v = verify.

FD1089: verification is destructive

v (verify) is safe on FD1094 but erases the data on FD1089. On FD1089, do not verify.

📋 Which key for which game? → System 16 keys-per-game table (138 sets, 317-xxxx number per game, transcribed from MAME).

An FD1094 converts to ANY game

An FD1094 can be reprogrammed for any game (the label need not match) → it is also a conversion route: re-key the module to the wanted game + fit that game's encrypted ROMs. The FD1089, however, is limited by its A/B variant.

3. De-suicide via decrypted ROMs + bare 68000 (the simplest)

You replace the encrypted program ROMs with their decrypted versions (from MAME dumps, identical to the originals once decrypted) and replace the FD1094 with a standard 68000. The board has no security at all — no battery, no suicide.

  • Pro: permanent, simple, no Arduino.
  • Con: the board is no longer "original" (bare 68000 + decrypted EPROMs).
  • Ready-made kits exist (see SEGA Resurrection): true decrypted ROMs (MAME-based) + a 68000 adapter.

Converting to another game (summary)

  • Encrypted route: re-key the FD1094 to the target game (Arduino) + that game's encrypted ROMs. Stays an "original" build.
  • Decrypted route: bare 68000 + the target game's decrypted ROMs. Simpler, non-original.
  • Also check the board differences (System 16A vs 16B, customs, ROM format) — see System 16.

The 4 ROM board types (System 16B) — a game is tied to its board

On System 16B the game lives on a ROM board plugged into the main board. Each game is tied to a ROM board type: converting = swap the ROM board + the protection chip. You generally cannot move a game from one board type to another (different wiring/banking). (Source: MAME sega/segas16b.cpp, Guru's notes.)

(Board architecture & faults: Sega System 16 PCB.)

ROM board Program EPROMs How to identify Examples
171-5358 A1-A6 as 27C256 (64K) or A1/A2/A4/A5 as 27C512 32K/64K ROMs only, no tile banking Shinobi, Passing Shot, Sonic Boom, Alien Syndrome, Dunk Shot, SDI, Time Scanner, Tough Turf
171-5521 A5/A7 (or A5-A8) as 27C010 (128K) = 171-5704 bar one jumper Altered Beast, Dynamite Dux, Heavyweight Champ, Ryu Kyu, Tetris
171-5704 A5-A8 as 27C010 tile-banking register in region #2 ($xx0001/3) Aurail, Bay Route, Cotton, Flash Point, Wonder Boy III, Wrestle War, Riot City
171-5797 only A1 & A2 ≥ 128K (27C010/020) tile banking region #1 ($xx2001/3), 2 program ROMs ESWAT, Golden Axe, MVP, Toryumon

Which program EPROM, game by game?

Size → EPROM: 32 KB → 27C256 · 64 KB → 27C512 · 128 KB → 27C010 · 256 KB → 27C020. The protection (type + exact 317-xxxx number) is on the System 16 key table; here we give the board + program sockets. (Main set; regional revisions vary — see the key page.)

Game ROM board Program sockets (EPROM) Protection
Ace Attacker 171-5358 A1/A2/A4/A5 = 27C512 FD1089B
Alien Syndrome 171-5358 A1-A6 = 27C256 — (aliensyn7 = MC-8123)
Altered Beast 171-5521 A5/A7 = 27C010 8751 or MC-8123 depending on set
Aurail 171-5704 A5-A8 = 27C010 — (unprotected)
Bay Route 171-5704 A5-A8 = 27C010 FD1094
Bullet 171-5358 A1-A6 = 27C256 FD1094
Cotton 171-5704 A5-A8 = 27C010 FD1094
Dunk Shot 171-5358 A1-A6 = 27C256 FD1089
Dynamite Dux 171-5521 A5-A8 = 27C010 — (ddux1 = 8751)
ESWAT 171-5797 A1/A2 = 27C020 FD1094
Excite League 171-5358 A1-A6 = 27C512 FD1094
Flash Point 171-5704 A5/A7 = 27C512 FD1094 (fpoint1)
Golden Axe 171-5797 IC1/IC2 = 27C020 8751 (goldnaxe)
Heavyweight Champ 171-5521 A5/A7 = 27C010 — (unprotected)
MVP 171-5797 A1/A2 = 27C020 FD1094
Passing Shot 171-5358 A1/A4 = 27C512 FD1094
Riot City 171-5704 A5-A8 = 27C010 —
Ryu Kyu 171-5521 A5/A7 = 27C512 FD1094
SDI 171-5358 A1-A6 = 27C256 FD1089
Shinobi 171-5358 A1/A2/A4/A5 = 27C512 — (shinobi3/4 = MC-8123)
Sonic Boom 171-5358 A1/A2/A4/A5 = 27C512 FD1094
Super League 171-5358 A1-A6 = 27C512 FD1094
Tetris 171-5521 A5/A7 = 27C010 FD1094 (317-0092)
Time Scanner 171-5358 A1-A6 = 27C256 —
Toryumon 171-5797 A1/A2 = 27C010 —
Tough Turf 171-5358 A5/A7 = 27C010 8751
Wonder Boy III 171-5704 A5/A7 = 27C010 8751
Wrestle War 171-5704 A5-A8 = 27C010 8751 (or FD1094 depending on set)

System 16A (171-5307/5304 boards, older)

The System 16A games (Shinobi 16A, Fantasy Zone, Alex Kidd, Quartet, SDI 16A, Time Scanner, Wonder Boy III 16A, Tetris 16A, Passing Shot 16A…) use an earlier ROM board family, program EPROMs in 27C256/27C512. Protection: FD1089 / 8751 depending on the game (Bodyslam, Quartet, Fantasy Zone rev = 8751) → see the key table. Source detail: MAME sega/segas16a.cpp.

Before / after

  • Re-key: a suicided board becomes a working encrypted original again.
  • ROM de-suicide: the board runs battery-less, permanently (bare 68000).

Hardware / where to read more

Sources & attribution

Review & corrections

How this space is used

Spotted a wrong value, an outdated procedure, a chip reference that does not match your board? Say so here, with what you observed (model, board revision, serial number, measurement). Every report is cross-checked against a source before anything changes — an unverifiable correction is published as “reported by …, not cross-checked” rather than silently applied.

Reading is open to everyone; posting requires signing in with Discord. Reports from the wiki's declared reviewers are handled first; anyone else's are read too, but go through a human before anything is changed.