CNROM

NES-CNROM (and its HVC counterpart) is a particular Nintendo cartridge board which uses uses discrete logic to provide up to four 8 KB banks of CHR ROM. The iNES format assigns mapper 3 to this board.

Many CNROM games such as Milon's Secret Castle store data tables in otherwise unused portions of CHR ROM and access them through PPUDATA reads. If an emulator can show the title screen of the NROM game Super Mario Bros., but CNROM games don't work, the emulator's PPUDATA readback is likely failing to consider CHR ROM bankswitching.

Overview

• PRG ROM size: 16 KB or 32 KB (DIP-28 standard pinout)
• PRG ROM bank size: Not bankswitched
• PRG RAM: None
• CHR capacity: 32 KB ROM (DIP-28 standard pinout)
• CHR bank size: 8 KB
• Nametable mirroring: Solder pads select vertical or horizontal mirroring
• Subject to bus conflicts: Yes

Solder Pad Config

• Horizontal mirroring : 'H' disconnected, 'V' connected.
• Vertical mirroring : 'H' connected, 'V' disconnected.

• 16 KB PRG ROM : 'SL' connected, 'CL' disconnected.
• 32 KB PRG ROM : 'SL' disconnected, 'CL' connected.

• Bit 4 security implemented to '0' : D2 cathode set to '3' (CHR A12) and D2 anode set to '4' (latch).
• Bit 4 security implemented to '1' : D2 cathode set to '4' (latch) and D2 anode set to '3' (CHR A12).
• Bit 5 security implemented to '0' : D1 cathode set to '1' (CHR A10) and D1 anode set to '2' (latch).
• Bit 5 security implemented to '1' : D1 cathode set to '2' (latch) and D1 anode set to '1' (CHR A10).
• Security unimplemented : D1 and D2 not present.

Banks

• PPU $0000-$1FFF: 8 KB switchable CHR ROM bank

Registers

Bank select ($8000-$FFFF)

7  bit  0
---- ----
xxDD xxCC
  ||   ||
  ||   ++- Select 8 KB CHR ROM bank for PPU $0000-$1FFF
  ++------ Security diodes config

Hardware

PRG ROM 256 kBit (32 KB x 8) (DIP-28) :

              ---_---
       +5V - |01   28| - +5V
       A12 - |02   27| - A14 or +5V (selectable with solder pads)
       A7  - |03   26| - A13
       A6  - |04   25| - A8
       A5  - |05   24| - A9
       A4  - |06   23| - A11
       A3  - |07   22| - /OE (/ROMSEL)
       A2  - |08   21| - A10
       A1  - |09   20| - /CE (GND)
       A0  - |10   19| - D7
       D0  - |11   18| - D6
       D1  - |12   17| - D5
       D2  - |13   16| - D4
       GND - |14   15| - D3
              -------

CHR ROM 256 kBit (32 KB x 8) (DIP-28) :

              ---_---
       +5V - |01   28| - +5V
       A12 - |02   27| - A14
       A7  - |03   26| - A13
       A6  - |04   25| - A8
       A5  - |05   24| - A9
       A4  - |06   23| - A11
       A3  - |07   22| - /OE (CHR /RD)
       A2  - |08   21| - A10
       A1  - |09   20| - /CE (CHR A13)
       A0  - |10   19| - D7
       D0  - |11   18| - D6
       D1  - |12   17| - D5
       D2  - |13   16| - D4
       GND - |14   15| - D3
              -------

The CNROM board contains a 74HC161 binary counter used as a quad D latch (4-bit register) to select the current CHR bank.

Early CNROM boards allow security diodes to be placed. If the latched bits 4 and 5 do not correspond to the configuration of the 2 diodes placed on the board while the PPU is rendering, the latched signal will conflict with some of the PPU's adresses bus and create bus conflicts. This system was probably created to make dumping cartridges harder, because the dumping device would have to write the correct value into the 74HC161 latch to dump the CHR ROM proprely, or else bus conflicts will appear and possibly damage the dumping device. This anti-dump precaution wasn't very effective, and Nintendo quickly gave up on this. Only Japanese games released in 1986 are known to have these diodes present.

Some Japanese CNROM games combine the diode security with special CHR ROM where higher addresses are actually additional chip enable signals. This will cause the game's CHR ROM to be disabled at all if the wrong CHR bank is selected, making only one actual 8K CHR bank available (the games could in theory run in a NROM board without being affected). Those games typically turn the PPU off, switch in the wrong CHR bank (that return open bus) with wrong diode configuration, read a CHR byte in a specific place where the bus conflicts with the mapper will not appear even with the wrong diode config, then read the same byte with the correct bank and diode config latched, and enter in an infinite loop if the two reads matches. Those game have been attributed to iNES mapper 185. Trying to dump them as regular NROM games will create bus conflicts with the dumping device, and even if this is bypassed the game will not run because the CHR ROM will be mirrored for all 8K bank select values.

Variants

CNROM operates identically to a GNROM with one PRG bank.

The upper 2 bank select bits on the 74HC161 were connected to security diodes. If they were connected to CHR ROM address lines instead, this board could have theoretically supported up to 128 KB of CHR ROM. In fact, iNES Mapper 003 encompasses both CNROM and a functionally similar board used in Panesian games that used this much CHR ROM.

In theory, it would be possible to implement the bank select register with a 74HC377 octal D latch, allowing up to 2 megabytes of CHR ROM, but due to mask ROM cost in the NES era, no non-pirate NES cart used this much memory.