You are on page 1of 69

FIRE Emulator for C166S V2 Family

TRACE32 Online Help


TRACE32 Directory
TRACE32 Index
TRACE32 Documents ......................................................................................................................

FIRE In-Circuit Emulator ...............................................................................................................

FIRE Target Guides ....................................................................................................................

FIRE Emulator for C166S V2 Family ......................................................................................

Warning .................................................................................................................................

Quick Start ............................................................................................................................

Configuration ........................................................................................................................

10

Adapter XC161CJ/XC164CS

10

Troubleshooting ...................................................................................................................

12

Hang-Up Conditions

12

Dualport Errors

12

FAQ ........................................................................................................................................

13

Basics ....................................................................................................................................

14

Overview

15

Trigger Module

16

Bondout Module

17

CPU Module

19

Emulation Modes

19

SYStem.Mode

Operation modes

SYStem.Access

20

Dualport access

21

Run-time memory access

22

Sets dualport update intervall

23

General SYStem Settings and Restrictions .......................................................................

24

SYStem.CpuAccess
SYStem.TimeReq

SYStem.CPU
SYStem.JtagClock
SYStem.Option MonLevel
SYStem.Option InjLevel
SYStem.Option V33
SYStem.Option IMASKASM

Monitor level

25

Injection level

26

3.3V power fail detection

26
26

Mask interrupts during HLL step

26

On-circuit emulation

27

On-circuit emulation reset

27

SYStem.Option ONCE
SYStem.Option ONCEReset
1989-2016 Lauterbach GmbH

25
25

Mask interrupts during assembler step

SYStem.Option IMASKHLL

FIRE Emulator for C166S V2 Family

CPU type selection


JTAG clock selection

SYStem.RESetOut
SYStem.Option BusType
SYStem.Option CS_Register
SYStem.Option WriteLimit
SYStem.Option

Peripheral reset

27

Bus mode

28

CS programming

28

Write strobe limitation

29

Start-up modes

29

SYStem.Option

Trace modes

30

SYStem.Option

Freeze modes

30

SYStem.Option

Watchdog settings

31

SYStem.Option LoadCS

Startup settings

31

SYStem.Option Overlay

Overlay flash settings

31

Start modes

32

Clock test

32

Segmentation

33

SYStem.Option Start
SYStem.Option TestClock
SYStem.Option SGT
SYStem.Option CS

Chip selects

33

SYStem.Option CLOCK

PLL selects

33

Register Access ...................................................................................................................

34

Exception Control ................................................................................................................

35

Schematics

35

RSTIN Line

35

NMI

35

eXception.state

Exception control

36

eXception.Activate

Force exception

36

eXception.Enable

Enable exception

37

eXception.Trigger

Trigger on exception

37

Stimulate exception

39

Shadowing ............................................................................................................................

40

eXception.Pulse

Shadow Memory

40

Fast Emulation Memory .......................................................................................................


Function

41
41

Bondout Trace ......................................................................................................................


Analyzer Modes

42
42

Bondout Trigger and Break System ...................................................................................

43

Bondout Breakpoints

43

Bondout Trigger System

44

Trigger on Data Writes

45

Trigger on Data Writes with Data Qualification

45

Selective Trace of Address Areas

45

Selective Trace of Address Areas and Data Qualification

45

Trigger on Execution of Program Line

45

Trace of Local Variables

46

Trigger of Local Variables with Data Qualification

46

1989-2016 Lauterbach GmbH

FIRE Emulator for C166S V2 Family

Code Flag System ................................................................................................................

47

Code Coverage

47

Flag Mapping

47

Data Access Flags ................................................................................................................

48

Flag Operation

48

Flag Mapping

48

Bondout Based Dualport Systems .....................................................................................

49

Bondout Shadow Memory

49

Injected Access

49

On-chip Trigger System .......................................................................................................

50

Special Functions .................................................................................................................

51

Breakpoints ...........................................................................................................................

52

Breakpoint Realization Modes

52

Memory Classes ...................................................................................................................

53

State Analyzer .......................................................................................................................

54

General 80166 Keywords for the Trigger Unit

54

Bondout CPU Keywords for the Trigger Unit

54

Keywords for the Display

55

Bondout Information Display

55

Port Analyzer ........................................................................................................................

56

Port Signals XC161CJ

56

Port Signals XC164CM

56

Port Signals XC164CS

57

Technical Data ......................................................................................................................

58

Mechanical Dimensions

58

Adaptions

60

Adapters

61

Operation Voltage

62

Operation Frequency

63

Support ..................................................................................................................................

64

Probes

64

Available Tools

64

Compilers

65

Realtime Operation Systems

65

3rd party Tool Integrations

66

Products ................................................................................................................................

68

Product Information

68

Order Information

69

1989-2016 Lauterbach GmbH

FIRE Emulator for C166S V2 Family

FIRE Emulator for C166S V2 Family


Version 24-May-2016
F::d.l
addr/line
P:004C5A
P:004C5C
P:004C5E
P:004C60
P:004C62
P:004C66
P:004C6A

code
E00C
E112
F0DC
08C1
E42D2E82
46FC1200
BDF8

label

mnemonic
comment
mov
r12,#0x0
movb
rl1,#0x1
mov
r13,r12
; r13,i
add
r12,#0x1
; i,#1
movb
[r13+#0x822E],rl1; [r13+#flags],rl
cmp
r12,#0x12
; i,#18
jm
F::r
745
for ( i = 0 ; C
C R1
1 R9
5FB3 DPP1
2
P:004C6C E00C
mo V
_ R2
3 R10 4058 DPP2
2
{
Z
_ R3
0 R11
2 DPP3
3
747
if ( f E
_ R4
2 R12
0 SP
FBF8
P:004C6E F42C2E82
mo MIP _ R5
2 R13
3 MDH
0
P:004C72 2D0F
jm USR U R6
C104 R14
3 MDL 071C
{
USR _ R7
1 R15
0 MDC
0
749
BNK G PSW 0843 CP
FC00 CSP
0
P:004C74 F0EC
mo S1 _ SOV FA0C SUN FC00 IP
4C80
P:004C76 00EC
ad IEN I IDX0
0 QX0
0 QR0
0
P:004C78 08E3
ad ILV 0 IDX1
0 QX1
0 QR1
0
750
Tsk
MAE
0 MAH
0 MAL
0
P:004C7A F0DC
mo
MCW
0 MSW 0200 MRW
0
P:004C7C 00DE
ad
751
GLOBAL R0
4058 R8
1
P:004C7E 0D05
jm
R1
1 R9
5FB3
R2
3 R10 4058
R3
0 R11
2
R4
2 R12
0
R5
2 R13
3
F::per h:\t32new\per161cj
R6
C104 R14
3
-"EBC
R7
1 R15
0
EBCMOD0 0158 RDYPOL low
RD
WRCFG WR/BHE
ARBEN 1 CSPEN 5
SAPEN 8
EBCMOD1 0000 DHPDIS no
APDIS 0000
TCONCSMM 6243 WRPHFMR 3 RDPHFMR 0 PHEMR 10 PHDMR 0
PHCMR 0 PHBMR 0 PHAMR 3
TCONCSSM 6243 WRPHFBR 3 RDPHFBR 0 PHEBR 10 PHDBR 0
PHCBR 0 PHBBR 0 PHABR 3
TCONCS0 6243 WRPHF 3 RDPHF 0
PHE 10 PHD 0
PHC 0 PHB 0 PHA 3
FCONCS0 0021 BTYP 16-demu RDYMOD asyn RDYEN yes
ENCS ena

1989-2016 Lauterbach GmbH

FIRE Emulator for C166S V2 Family

For general informations about the In-Circuit Debugger refer to the FIRE Users Guide (fire_user.pdf). All
general commands are described in IDE Reference Guide (ide_ref.pdf) and General Reference
Guide.

Warning

NOTE:

Do not connect or remove probe from target while target power is ON.
Power up:
Switch on emulator first, then target
Power down: Switch off target first, then emulator

1989-2016 Lauterbach GmbH

FIRE Emulator for C166S V2 Family

Warning

Quick Start
Before debugging can be started, the emulator must be configured by software:
Ready to run setup files for most standard compilers can be found on the software CD in the directory ../
Demo/c166/Compiler. All setup files are designed to run the emulator stand alone without target hardware.
The following description should make the initial setup (to run the emulator together with the target
hardware) easier. It describes a typical setup with frequently used settings. It is recommended to use the
programming language PRACTICE to create a batch file, which includes all necessary setup commands.
PRACTICE files (*.cmm) can be created with the PRACTICE editor pedit (Command: PEDIT <file name>)
or with any other text editor.
A basic setup file includes the following parts:
1.

Set cpu-type and -mode

2.

Set system options

3.

Select dualport mode (optional)

4.

Set mapper and CS definition (optional)

5.

Select frequency (optional)

6.

Activate the emulator

7.

Load application file (optional)

8.

Set breakpoints (optional)

9.

Start application

10.

Stop application (optional)

1989-2016 Lauterbach GmbH

FIRE Emulator for C166S V2 Family

Quick Start

Here a typical example, how to set up the system:


1.

Set cpu-type and -mode options


The command SYStem.CPU is used to select one derivative within a cpu-family and to set its
operation mode.
SYStem.Down
SYStem.CPU XC161CJ
SYStem.Option BusType NOMUX16
SYStem.Option CS 5
SYStem.Option SGT 16M
SYStem.Option Clock 4.0
SYStem.Option V33 OFF
SYStem.Option CAN1 ON

2.

;
;
;
;
;
;
;
;

switch the system down


select derivative XC161CJ
set the operation mode NOMUX16
set the number of CS used
set segmentation
set PLL option
select operation voltage
one CAN used

Set system options


The system window controls the CPU specific setup. Please check this window very carefully and set
the appropriate options. Use the ? button in the main tool bar and click to the option check box
(Command: HELP.PICK) to get online help in a pop up window.
SYStem.Option XPerEN ON
SYStem.Option WDTdis ON

3.

; Set XPEN automatically


; Disable watchdog

Select dualport mode (optional)


Dualport allows access to emulation RAM, while emulation is running. This is necessary to display
variables, set breakpoints or display the flag listings while the emulation is running.
System.MemAccess selects how dualport access is done.
SYStem.MemAccess ARAM

;
;
;
;

SYStem.CpuAccess Denied

4.

Select type of dualport access


for the emulation memory
Deny real-time memory access to
all other memories

Set mapper and CS definition


The mapper controls the memory access of the CPU, this means the use of internal or external
memory. The FIRE XC166 has no separate bondout address bus, therefore all emulator address
information must be regenerated out of the chip select and address signals..
MAP.RESet

; reset mapper (all external)

SYS.Option FCONCS0 0x6243


MAP.Ram 0x0--0x7fff
MAP.Intern 0x0--0x7fff

; Allocate emulation RAM:


; Select emulation RAM as valid

1989-2016 Lauterbach GmbH

FIRE Emulator for C166S V2 Family

Quick Start

5.

Select frequency (optional)


The CPU can be clocked by an internal (emulator) or external (target) clock source. If the internal
clock is used, the clock is provides by the VCO of the emulator. The setting of the internal clock is
done by the VCO command.
The current CPU frequency can be displayed in the counter window (Command: Count).
VCO.Fre 5.

6.

; input clock to the EXTAL pin of the cpu is


; set to 5 MHz
; (only necessary if internal clock is used)

Activate the emulator


When the emulator is activated a debug-monitor program is loaded into a hidden emulator memory.
Afterwards, a bondout reset-signal is inactivated and the monitor program starts. This program allows
access to user memory (data.dump, data.list) and cpu-registers, and gives control to start and stop
the emulation.
SYStem.Mode EmulExt

7.

; system works with external target clock

Load application file (optional)


The application can be loaded by various file formats. OMF format is often used to load code and
symbol information. For information about the load command for your compiler see Compiler.
Data.LOAD.Omf keilcl /Puzzled /LowerPATH

8.

; load application file

Set breakpoints (optional)


There are several ways to set breakpoints (Command: Break.Set). Breakpoints can be displayed
using the Break.List command.
Break.Set main /Program
Var.Break.Set flags /Write
Break.Set flags /Write /Data 0x1

9.

; set program break on function


; main
; set write break on variable
; flags
; set write break with data
definition

Start application
Application can be started with giving a break address. For example go main starts the application
and stops at symbol main.
Go

;run application

1989-2016 Lauterbach GmbH

FIRE Emulator for C166S V2 Family

Quick Start

10.

Stop application (optional)


Application can be breaked manually by using the BREAK command.
Break

; break application manually

It is recommended to check the following chapters for all questions regarding the correct setup:

Configuration

Troubleshooting

1989-2016 Lauterbach GmbH

FIRE Emulator for C166S V2 Family

Quick Start

Configuration

Adapter XC161CJ/XC164CS
BOTTOM VIEW

S102
S101

CPU

Switch Settings S101

XC161CJ
1 2 3 4 5 6 7 8

OFF
XC164CS
1 2 3 4 5 6 7 8

OFF
VAGND/VAREF from Target

1 2 3 4 5 6 7 8

OFF
VAGND to GND
1 2 3 4 5 6 7 8

OFF

1989-2016 Lauterbach GmbH

FIRE Emulator for C166S V2 Family

10

Configuration

VAREF to VCC
1 2 3 4 5 6 7 8

OFF
XTAL3 to internal 32 kHz
clock

1 2 3 4 5 6 7 8

OFF
XTAL3 to target
1 2 3 4 5 6 7 8

OFF

CPU

Switch Settings S102

Default
1 2 3 4 5 6 7 8

OFF
Fast Emulation
on CS0 (XC161)

1 2 3 4 5 6 7 8

OFF
Fast Emulation
on CS0 (XC164)

1 2 3 4 5 6 7 8

OFF

1989-2016 Lauterbach GmbH

FIRE Emulator for C166S V2 Family

11

Configuration

Troubleshooting

Hang-Up Conditions
If you are not able to stop the emulation, there may be some typically reasons:
No READY Signal

This condition occurs, if no READY signal is generated by the target.

WATCHDOG

In C167/ST10 CPU has a watchdog system. Don't forget to disable


the Software Watchdog before starting emulation.

IDLE oder PWRDWN

The emulator can be stopped in idle or powerdown modes. Some


restrictions depend on bondout errors.

Dualport Errors
Dualport access is made either between bus cycles or by feeding NOP instructions (Bondout CPU). If no
bus cycle is generated (IDLE or SLEEP), an dualport error occurs.
The ROM emulation memory system (DATA, BREAK, FLAG) is always accessible.

1989-2016 Lauterbach GmbH

FIRE Emulator for C166S V2 Family

12

Troubleshooting

FAQ

Debugging via
VPN

The debugger is accessed via internet/VPN and the performance is very


slow. What can be done to improve debug performance?
The main cause for bad debug performance via internet or VPN are low data
throughput and high latency. The ways to improve performance by the debugger
are limited:

in practice scripts, use "SCREEN.OFF" at the beginning of the script and


"SCREEN.ON" at the end. "SCREEN.OFF" will turn off screen updates.
Please note that if your program stops (e.g. on error) without executing
"SCREEN.OFF", some windows will not
be updated.

"SYStem.POLLING SLOW" will set a lower frequency for target state


checks (e.g. power, reset, jtag state). It will take longer for the debugger to
recognize that the core stopped on a breakpoint.

"SETUP.URATE 1.s" will set the default update frequency of Data.List/


Data.Dump/Variable windows to 1 second (the slowest possible setting).

prevent unneeded memory accesses using "MAP.UPDATEONCE


[address-range]" for RAM and "MAP.CONST [address--range]" for ROM/
FLASH. Address ranged with "MAP.UPDATEONCE" will read the specified
address range only once after the core stopped at a
breakpoint or manual break. "MAP.CONST" will read the specified address
range only once per SYStem.Mode command (e.g. SYStem.UP).

1989-2016 Lauterbach GmbH

FIRE Emulator for C166S V2 Family

13

FAQ

Basics
The bondout module includes a separate 512K memory for ROM emulation up to 40/50 MHz. The ROM
emulation is supported by a BREAKPOINT memory and a FLAG memory. These memories are dualported
with no limitations.

1989-2016 Lauterbach GmbH

FIRE Emulator for C166S V2 Family

14

Basics

Overview
The C16x/ST10 specific part of TRACE32-FIRE consists of the following modules:

Trigger Module

Bondout Module

CPU Module

Shadow Memory
Read Trace

Write Trace

Data Trace

IP Trace

Code Trace

Read Flag

Write Flag

Data Flag

IP Flag

Code Flag

Read Break

Write Break

Data Break

IP Break

Code Break
Trigger Module

Clock
Generator
Mapper

Trace Bus

Trigger System

ROM Bus

Bondout

FLASH
Emulation
Boot Loader

Ports

External Bus

Monitor RAM
Bondout Module

Fast
Overlay
RAM
(external)

Port
Analyzer
Target Adapter

CPU Module

1989-2016 Lauterbach GmbH

FIRE Emulator for C166S V2 Family

15

Basics

Trigger Module

Trigger Module
Bondout Module
CPU Module

The trigger module provides the follwing features:


Trace System

The trace system is build by an 128 bit and 64K deep trace storage. All
bondout signals are sampled by this unit. The trace works as a trace
extension to the trace memory within the FIRE emulation controller.

Break System/
Address Selectors

The break/address selector system consists of:

4 * 1 MByte ranges to set (Operand) Read Breakpoints plus 4


data selectors

4 * 1 MByte ranges to set (Operand) Write Breakpoints plus 4 data


sele tors

8 * 1 MByte ranges to set Instruction Address Breakpoints plus 8


data selectors

2 independent data selectors

Flag System

The flag system is build by

2 * 1 MByte ranges for Operand Read Flags

2 * 1 MByte ranges for Operand Write Flags

2 * 1 MByte ranges for Instruction Execution Flags

2 * 1 MByte ranges for Jump Taken Flags

Shadow Memory

1 MByte shadow memory that can be used for IRAM/XRAM or external


memory.

Trigger Unit

The trigger unit combines address selectors to set trigger points (Alpha,
Beta, Charly and Delta address selector).

Break Unit

The break unit combines breakpoints to directly stop the emulation


(Read, Write breakpoints).

1989-2016 Lauterbach GmbH

FIRE Emulator for C166S V2 Family

16

Basics

Bondout Module

Trigger Module
Bondout Module
CPU Module
The bondout module is the family specific part of TRACE32-FIRE. Three different bondout modules are
available:
C166V2

Supports all XC166 devices

The bondout moduls includes the following conponents:


Bondout Chip

The bondout chip is either an E3 from Infineon or a ST1020x by


STMicroelectronics. The bondout chip has special trace busses for
emulation of the on-chip FLASH memory and for sampling the internal
signals.

JTAG Accelerator

For higher download speed, a hardware accelerator is implemented. The


download is about 700 kBbyte/sec through JTAG.

Clock Generator

The clock can be driven by the target or the emulator system. The
32 kHz clock is always driven by the emulator.

Trigger System
Exception Control

RSTIN and NMI lines can be enabled and stimulated by the emulator
system.

Exception Trigger

Triggering is possible on asynchronous events like RSTIN, the emulation


is stopped after the trigger event.

Monitor Memory

A monitor memory can hold foreground monitor systems. (not used


now).

Bootloader

The bootloader is part of the bondout chip

1989-2016 Lauterbach GmbH

FIRE Emulator for C166S V2 Family

17

Basics

Bondout Chip

The XC166 bondout chip is a flip chip device, containing on one part all
the emulation logic and on the other part the production chip for XC161/
XC164. That means that on changing silicon step of the production
chips, new emulation devices can be producted very quickly. The
bondout chip is in a BGA socket and can be easily replaced by the
customer.

FLASH/ROM
Emulation Memory

A 128 K memory for ROM/FLASH overlay is placed on the bondout chip.

Mapper

The mapper defines the mapping of the external emulation memory. Up


to 16 MByte of memory can be supported. The FIREXC166 emulator
uses asynchronous dualport emulation memory (ARAM).

1989-2016 Lauterbach GmbH

FIRE Emulator for C166S V2 Family

18

Basics

CPU Module

Trigger Module
Bondout Module
CPU Module

The CPU module is the device specific part of the FIRE-166 emulator.
Target Connection

The target connection is done by 100 mil socket rows. Clip-over, solderon oder socket adapters can be used.

Port Analyzer MUX

All signal pins can be traced by the port analyzer. Buffers to all peripheral
signals are on the adapter board.

FAST Overlay RAM

A 1 MByte 16 Bit overlay RAM, which can replace external FLASH


devices for high-speed emulation (12 ns access).

Emulation Modes
F::sys
system
Down
Up
RESet

Mode
RESet
AloneInt
AloneExt
EmulInt
EmulExt

CPU
XC161CJ
C166SV2
reset
RESetOut

MemAccess
ARAM
CPU
GAP
ROM
Monitor
MIXed
Denied
CpuAccess
Enable
Denied
Nonstop
TimeReq
1.000ms
JtagClock
CLK/4

Option
TraceInt
TraceExt
TraceRes
Option
IMASKASM
IMASKHLL
TestClock
V33
WriteLimi
PERSTOP
WDTSTOP

The emulations head can stay in 5 modes. The modes are selected by the SYStem.Up or the
SYStem.Mode command.

1989-2016 Lauterbach GmbH

FIRE Emulator for C166S V2 Family

19

Basics

SYStem.Mode

Operation modes

Format:

SYStem.Mode <mode>

<mode>:

RESet
AloneInt
AloneExt
EmulInt
EmulExt

RESet

The probe is in Reset.

AloneInt

Probe is running with internal clock, no target access possible.

AloneExt

Probe is running with external clock, no target access possible.

EmulInt

Probe is running with internal clock, target access is possible.

EmulExt

Probe is running with external clock, target access is possible.

In active mode, the power of the target is sensed and by switching down the target the emulator changes to
RESET mode. The probe is not supplied by the target. When running without target, the target voltage is
simulated by an internal pull-up resistor. The command SYStem.Up in Stand-alone doesn't work correctly.
Use SYStem.Mode AloneInt to select the correct emulation mode.

1989-2016 Lauterbach GmbH

FIRE Emulator for C166S V2 Family

20

Basics

SYStem.Access

Dualport access

Format:

SYStem.MemAccess <option>

<option>:

ARAM
GAP
ROM
CPU
MIXed
Denied

GAP

Reserved, do not use with ARAM emulation memory.

ARAM

The memory access is made directly to the ARAM. The perfoance is not
influenced. Only memory areas, which are mapped to emulation memory, are
accessible.

ROM

The ROM area can be accessed at every time without any performance
reduction.

CPU

The injected mode access of the C166S V2 is used for memory access. In this
access mode read/write to emulation and target memory is possible.

MIXed

Combination of all dual port modes.


Realtime memory access to RAM via injection mode of the CPU. Realtime
memory access to onchip ROM/FLASH via ROM access. Realtime memory
access to external memory with access method ARAM.

Denied

Dualport access is not possible while the emulation is running.

Dualport allows access to emulation RAM and onchip ROM/FLASH, while emulation is running. This is
necessary to display variables, set breakpoints or display flag listings while the emulation is running.
Dualport access is only possible on the emulators internal RAM and not on target RAM.

1989-2016 Lauterbach GmbH

FIRE Emulator for C166S V2 Family

21

Basics

SYStem.CpuAccess

Run-time memory access

Format:

SYStem.CpuAccess <option>

<option>:

Enable
Denied
Nonstop

Enable

If a dualport read/write access is requested to a non-mapped memory, a


spotpoint is used to access the memory. Spotpoint means emulation break and
go.

Denied

Dualport access via spotpoint is not possible.

Nonstop

Reserved.

The emulator uses a two stage strategy to realize the best possible dualport access method.
If MemAccess is set to GAP, the emulation controller tries a bus arbitration access as dualport cycle. This is
possible if memory is mapped to internal and on read cycles to shadow memory. Shadow memory means,
that memory is mapped in the emulator (map.ram), but the area is mapped external (map.extern). On
access to external mapped memory and write access to shadow memory the dualport is executed as a
spotpoint if CpuAccess is enabled. Dualport on access to external mapped memory and write access to
shadow memory is disabled if CpuAccess is disabled.
If MemAccess is set to CPU, the emulation controller uses the injection interface of the CPU to realize the
dualport cycle. The advantage of this method is that all memories, independent on the mapping, can be
used. The CpuAccess switch is ignored if MemAccess is set to CPU.
If MemAccess is set to Denied and CpuAccess is enabled, the emulation controller uses a spotpoint to
realize the dualport cycle.
If MemAccess is set to Denied and CpuAccess is disabled, dualport access is not possible.

1989-2016 Lauterbach GmbH

FIRE Emulator for C166S V2 Family

22

Basics

The following table shows how the dualport is realized depending on the used system setting:
Mem
Access

Cpu
Access

Read
Map
Int.

Write
Map
Int.

Read
Shadow

Write
Shadow

Read
Map
Ext.

Write
Map
Ext.

GAP

Enable

gap

gap

gap

spot

spot

spot

GAP

Denied

gap

gap

gap

CPU

Enable

cpu

cpu

cpu

cpu

cpu

cpu

CPU

Denied

cpu

cpu

cpu

cpu

cpu

cpu

Denied

Enable

spot

spot

spot

spot

spot

spot

Denied

Denied

gap: The bus arbitration interface of the CPU is used for dualport access. Application performance is
only slightly influenced.
cpu: The injection interface of the CPU is used for dualport access. Application performance is more
influenced than with GAP mode.
spot: The emulation is breaked, memory access is done via CPU, emulation is continued. Application
performance is most influenced with this method.

SYStem.TimeReq

Sets dualport update intervall

Format:

SYStem.TimeReq <time>

<time>:

Update time intervall.

1989-2016 Lauterbach GmbH

FIRE Emulator for C166S V2 Family

23

Basics

General SYStem Settings and Restrictions


F::sys
system
Down
Up
RESet

Mode
RESet
AloneInt
AloneExt
EmulInt
EmulExt

CPU
XC161CJ
C166SV2
reset
RESetOut

MemAccess
ARAM
CPU
GAP
ROM
Monitor
MIXed
Denied
CpuAccess
Enable
Denied
Nonstop
TimeReq
1.000ms
JtagClock
CLK/4

Option
ResetMode
OWDDIS
WDTdis
Option
Overlay
Start
Standard
MonLevel
16.
InjLevel
17.

Option
TraceInt
TraceExt
TraceRes
Option
IMASKASM
IMASKHLL
TestClock
V33
WriteLimi
PERSTOP
WDTSTOP

Option
ResetExt
ONCE
ONCEReset
BOOTSTRAP
WRC
BusType
NOMUX8
CS
5
SGT
16M
CLOCK
0.5

FConCSx
0x6243
0x0
0x0
0x0
0x0
0x0
0x0
0x0
EBCMode0
0x0

AddrSelx
0x0
0x0
0x0
0x0
0x0
0x0
0x0
EBCMode1
0x0

1989-2016 Lauterbach GmbH

FIRE Emulator for C166S V2 Family

24

General SYStem Settings and Restrictions

SYStem.CPU

CPU type selection

Format:

SYStem.CPU <cpu >

<cpu>:

XC161CJ
XC164CS

The CPU type is selected. The CPU should be selected before activating the emulator and before using the
first PER command. Selections which doesnt fit to the probe used are ignored. Be sure that the switches on
the probe have the correct setting.

SYStem.JtagClock

JTAG clock selection

Format:

SYStem.JtagClock <rate >

<rate>:

/2
/4
/8
10000000
5000000
2500000

The JTAG clock should not be faster than 25% of the CPU clock frequency.

SYStem.Option MonLevel

Monitor level

Format:

SYStem.Option MonLevel <level>

<level>:

1. 18.

The monitor system can be interrupted. The monitor level defined the level, where all lower level interrupts
are blocked.

1989-2016 Lauterbach GmbH

FIRE Emulator for C166S V2 Family

25

General SYStem Settings and Restrictions

SYStem.Option InjLevel

Injection level

Format:

SYStem.Option InjLevel <level>

<level>:

1. 18.

Memory access by the debug system is made by injected instructions. The INJECT level defines the priority
of this function. The inject level should be higher than the monitor level.

SYStem.Option V33

Format:

3.3 V power fail detection

SYStem.Option V33 [ON | OFF]

The emulator has a detection logic to detect a target power fail. This option must be set to on, if a 3.3 V
target is used.
NOTE: The C166S V2 bondout chip is specified for 5 V only.

SYStem.Option IMASKASM

Format:

Mask interrupts during assembler step

SYStem.Option IMASKASM [ON | OFF]

If enabled, the interrupt mask bits of the cpu will be set during assembler single-step operations. The
interrupt routine is not executed during single-step operations. After single step the interrupt mask bits are
restored to the value before the step.

SYStem.Option IMASKHLL

Format:

Mask interrupts during HLL step

SYStem.Option IMASKHLL [ON | OFF]

If enabled, the interrupt mask bits of the cpu will be set during HLL single-step operations. The interrupt
routine is not executed during single-step operations. After single step the interrupt mask bits are restored to
the value before the step.
NOTE: By changing the status register through target software, this option can affect the flow of the
target program. Accesses to the interrupt-mask bits will see the wrong values.
1989-2016 Lauterbach GmbH

FIRE Emulator for C166S V2 Family

26

General SYStem Settings and Restrictions

SYStem.Option ONCE

Format:

On-circuit emulation

SYStem.Option ONCE [ON | OFF]

Set to ON when using the Clip-Over-Adapter with QFP-Packages. The CPU chip on the target board is set
to tristate on RESET of the target system (Push reset key on your target).

P0.1
Target

ONCEEmulator

10K

SYStem.Option ONCEReset

Format:

On-circuit emulation reset

SYStem.Option ONCEReset [ON | OFF]

Some new probes support target reset out of the probe for ONCE mode. The RSTIN input of the CPU must
be an open-drain type. Then the emulator can force an RSTIN signal on the target when an
SYSTEM.MODE or SYSTEM.UP command is executed.

RSTINTarget

Emulator

SYStem.RESetOut

Format:

Peripheral reset

SYStem.RESetOut

The SRST instruction is executed. The RSTOUT line is set to active.

1989-2016 Lauterbach GmbH

FIRE Emulator for C166S V2 Family

27

General SYStem Settings and Restrictions

SYStem.Option BusType

Bus mode

Format:

SYStem.Option BusType <mode>

<mode>:

ROMEN
NOMUX8
MUX8
NOMUX16
MUX16

Selects the bus mode for the processor.


ROMEN

reserved.

NOMUX8

Non-multiplexed 8 bit bus. Port 0L is data port, Port 1 and 4 are address ports.

MUX8

Multiplexed 8 bit bus. Port 0 is used for address and data.

NOMUX16

Non-multiplexed 16 bit bus. Port 0 is data bus, port 1 and 4 are address signals.

MUX16

Multiplexed 16 Bit bus. Port 0 is address and data bus. The upper address lines
(segments) are supported on port 4.

SYStem.Option CS_Register

CS programming

Format:

SYStem.Option <cs_reg>

<cs_reg>:

FConCS[7..0]
AddrSel[7..0]
EBCMode[1..0]

For correct operation of the XC161/XC164 emulators all chip-select and address-line related registers must
be programmed before emulator is started. The address-regeneration is done by the emulator logic in
hardware. The FConCS and AddrSel registers are programmed by the emulator system. They should not be
changed later on.

A16..A22

CS0..CS7

Address
Regenerator

A16..A23 to Memory

1989-2016 Lauterbach GmbH

FIRE Emulator for C166S V2 Family

28

General SYStem Settings and Restrictions

SYStem.Option WriteLimit

Format:

Write strobe limitation

SYStem.Option WriteLimit [ON | OFF]

The write strobe for the emulation RAM is limited. Ths option should be activated if chip selects with zero
tristate cycles are used.

SYStem.Option

Start-up modes

Format:

SYStem.Option <mode> [ON | OFF]

<mode>:

BOOTSTRAP
ResetExt
WRC
ResetMode

BOOTSTRAP

Bootstrap Mode for C166S.

ResetExt

The setup after RESET is defined by the target system. The internal setups
(BOOTSTRAP, etc.) are ignored. This mode is valid for the C167 probe only.
Usually the probe can use the reset vector from the target. However some
targets supply this vector on reset of the target only (which must not be the
same time as the reset of the emulator), or the pull-down resistors didnt work
very fine (the buffers on Port 0 of the emulator need some input current). In all
this situations the internal reset vectors should be used:
SYStem.Option BusType
SYStem.Option ChipSelect
SYStem.Option Clock
SYStem.Option BOOTSTRAP
SYStem.Option WRC
SYSTem.Option Start

WRC

Activates the WRL/WRH mode.

ResetMode

reserved.

1989-2016 Lauterbach GmbH

FIRE Emulator for C166S V2 Family

29

General SYStem Settings and Restrictions

SYStem.Option

Trace modes

Format:

SYStem.Option <mode> [ON | OFF]

<mode>:

TraceExt
TraceInt
TraceRes

TraceExt

The external bus cycles are traced only.

TraceInt

The internal bus cycles on the bondout bus are traced. The option can be used
together with the TRACEEXT option to force a mixed trace of internal (bondout)
operations together with external cycles.

TraceRes

The dummy cycles on reset state are trace additionally (Bondout probes only).
This option is only necessary, if the trace should work through reset operation.

The MIXED trace mode (TRACEINT + TRACEEXT) is the most powerful trace function, but delivers a lot of
information that can disturb operations especially for performance and code coverage tests.

SYStem.Option

Freeze modes

Format:

SYStem.Option <mode> [ON | OFF]

<mode>:

PERSTOP
WDTSTOP

WDTSTOP

Disables the watchdog timer when emulation is stopped.

PERSTOP

Disables all peripharal systems when emulation is stopped.

1989-2016 Lauterbach GmbH

FIRE Emulator for C166S V2 Family

30

General SYStem Settings and Restrictions

SYStem.Option

Watchdog settings

Format:

SYStem.Option <mode> [ON | OFF]

<mode>:

WDTdis
OWDDIS

WDTdis

Disables the WDT (WatchDogTimer) while activating the emulator.

OWDDIS

Oscillator Watchdog Disable.

SYStem.Option LoadCS

Startup settings

Format:

SYStem.Option LoadCS [ON | OFF]

LoadCS

Load CSs settings in EBC registers.

SYStem.Option Overlay

Overlay flash settings

Format:

SYStem.Option Overlay [ON | OFF]

Overlay

Substitute onchip Flash memory with overlay memory.

1989-2016 Lauterbach GmbH

FIRE Emulator for C166S V2 Family

31

General SYStem Settings and Restrictions

SYStem.Option Start

Start modes

Format:

SYStem.Option Start <mode>

<mode>:

External
ExternalPLL
Boot
Internal
AltExternal
AltBoot
AltInternal

External

Start from External Memory, PLL/OWD off (0x000000)

ExternalPLL

Start from External Memory, PLL/OWD on (0x000000)

Boot

Start from Boot memory (0xBF0000)

Internal

Start from Internal Program Memory (0xC00000)

AltExternal

Alternate Start from External Memory

AltBoot

Alternate Start from Boot memory

AltInternal

Alternate Start from Internal Program Memory


(0xC10000)

SYStem.Option TestClock

Clock test

Format:

SYStem.Option TestClock [ON | OFF]

TestClock

The internal clock (ECLK or XTAL2) is checked by the emulator. If


POWERDOWN modes are used, the TESTCLOCK option should be switched
off.
The clock test circuit is always active, if the emulation is stopped.

1989-2016 Lauterbach GmbH

FIRE Emulator for C166S V2 Family

32

General SYStem Settings and Restrictions

SYStem.Option SGT

Segmentation

Format:

SYStem.Option SGT <size>

<size>:

OFF
256K
1M
16M

The segmentation must be set up for all non-bondout probes. However it is recommended on the C167
bondout probe for correct address mirroring. The setup defines the reset vector in stand-alone mode.

SYStem.Option CS

Chip selects

Format:

SYStem.Option CS <size>

<size>:

0
2
3
5

The reset vector for the chip selects is defined for all C167 probes.

SYStem.Option CLOCK

PLL selects

Format:

SYStem.Option CLOCK <factor>

<factor>:

0.5
1.0
2.0
2.5L
2.5H
3.0
4.5
5.0

The reset vector for the PLL multiplier is defined for all C167 probes.

1989-2016 Lauterbach GmbH

FIRE Emulator for C166S V2 Family

33

General SYStem Settings and Restrictions

Register Access
The XC166 devices contain 3 additional register set.
F::r
C
_
V
_
Z
_
E
_
MIP _
USR _
USR _
BNK G
S1 _
IEN _
ILV 0
Tsk

R1
R2
R3
R4
R5
R6
R7
PSW
SOV
IDX0
IDX1
MAE
MCW

0
F000
1
0
7FFF
C104
1
0
FA00
0
0
0
0

R9
R10
R11
R12
R13
R14
R15
CP
SUN
QX0
QX1
MAH
MSW

5FB3
4251
C5C6
CE5A
DCB1
3267
CFE8
FC00
FC00
0
0
0
0200

GLOBAL R0
R1
R2
R3
R4
R5
R6
R7

3A01
0
F000
1
0
7FFF
C104
1

R8
R9
R10
R11
R12
R13
R14
R15

6B94
5FB3
4251
C5C6
CE5A
DCB1
3267
CFE8

LOCAL1 R0
R1
R2
R3
R4
R5
R6
R7

0
0100
F0
0100
F0
0100
F0
0100

R8
R9
R10
R11
R12
R13
R14
R15

F0
0100
F0
0100
F0
0100
F0
0100

LOCAL2 R0
R1
R2
R3
R4
R5
R6
R7

F0
0100
F0
0100
F0
0100
F0
0100

R8
R9
R10
R11
R12
R13
R14
R15

F0
0100
F0
0100
F0
0100
F0
0100

Register.Set R0G
Register.Set R0L1

DPP1
1
DPP2
2
DPP3
3
SP
FC00
MDH
0
MDL
0
MDC
0
CSP
0
IP
0
QR0
0
QR1
0
MAL
0
MRW
0

; set register R0 in global bank


1

; set register R0 in local bank 1

1989-2016 Lauterbach GmbH

FIRE Emulator for C166S V2 Family

34

Register Access

Exception Control

Schematics
RSTIN Line
Vcc
X.Enable
10K
RSTIN(Target)

RSTIN(CPU)

X.Activate
or
X.Pulse

NMI

VDD
10K
NMI- Target
>=1
X.Enable-

&

NMI- Cpu

X.Pulse-

1989-2016 Lauterbach GmbH

FIRE Emulator for C166S V2 Family

35

Exception Control

eXception.state

Exception control

Format:

F::x
exception
OFF

ON
RESet

eXception.state

Activate
OFF
RSTIN
NMI

Enable
OFF

ON
RSTIN

NMI

Trigger
OFF
ON
RSTIN
RSTOUT
NMI
TRAP
PEC
BUSIDLE
CPUIDLE
ClockFail
Pulse

eXception.Activate

Pulse
OFF
RSTIN
NMI

Pulse
Single
Width
1.000us
PERiod

OFF
ON
0.000

Force exception

Format:

eXception.Activate RSTIN [ON | OFF]

Format:

eXception.Activate NMI [ON | OFF]

Format:

eXception.Activate OFF

RSTIN

Activates the RSTIN line.

NMI

Activates the NMI line.

OFF

No activation of any exception line.

1989-2016 Lauterbach GmbH

FIRE Emulator for C166S V2 Family

36

Exception Control

eXception.Enable

Enable exception

Format:

eXception.Enabke RSTIN [ON | OFF]

Format:

eXception.Enable NMI [ON | OFF]

Format:

eXception.Enable ON

Format:

eXception.Enable OFF

RSTIN

Enables the RSTIN line.

NMI

Enables the NMI line.

ON

Enables all exception line.

OFF

Disables all exception lines.

eXception.Trigger

Trigger on exception

Format:

eXception.Trigger RSTIN [ON | OFF]

Format:

eXception.Trigger RESET [ON | OFF]

Format:

eXception.Trigger NMI [ON | OFF]

Format:

eXception.Trigger BUSIDLE [ON | OFF]

Format:

eXception.Trigger IDLE [ON | OFF]

Format:

eXception.Trigger HLDA [ON | OFF]

Format:

eXception.Trigger Pulse [ON | OFF]

Format:

eXception.Trigger PEC [ON | OFF]

Format:

eXception.Trigger PWRDOWN [ON | OFF]

1989-2016 Lauterbach GmbH

FIRE Emulator for C166S V2 Family

37

Exception Control

Format:

eXception.Trigger RSTOUT [ON | OFF]

Format:

eXception.Trigger TRAP [ON | OFF]

Format:

eXception.Trigger TRAPACK [ON | OFF]

Format:

eXception.Trigger OFF

Format:

eXception.Trigger ON

RSTIN

Trigger on RSTIN line.

RSTOUT

Trigger on RSTOUT line.

NMI

Trigger on NMI line.

TRAP

Trigger on Trap execution.

PEC

Trigger on PEC transfers.

BUSIDLE

Trigger on Busidle.

CPUIDLE

Trigger on Cpuidle.

ClockFail

Trigger on Clock fail.

Pulse

Trigger on Pulse.

ON

Trigger on all exception lines.

OFF

No trigger on any exception lines.

1989-2016 Lauterbach GmbH

FIRE Emulator for C166S V2 Family

38

Exception Control

eXception.Pulse

Stimulate exception

Format:

eXception.Pulse RSTIN [ON | OFF]

Format:

eXception.Pulse NMI [ON | OFF]

Format:

eXception.Pulse OFF

RSTIN

Trigger on RSTIN line.

NMI

Trigger on NMI line.

OFF

No trigger on any exception line.

1989-2016 Lauterbach GmbH

FIRE Emulator for C166S V2 Family

39

Exception Control

Shadowing

Shadow Memory

Format:

MAP.RAM <range>

The XRAM area can be supported by the emulator. When mapping external memory to this areas, the
memory can be used as shadow memory.
MAP.RAM 0xc000--0xdfff

; activate shadow memory

Dump

; show shadow memory

E:0xc000

1989-2016 Lauterbach GmbH

FIRE Emulator for C166S V2 Family

40

Shadowing

Fast Emulation Memory

Function
For high-speed emulation of external FLASH memories the standard emulation memory can be too slow.
The target adaptet contains 2 sockets for 2 512K*8 RAMs (10..15ns). By setting the DIP switches on the
adapter board, the CS0- line is routed to this memory and the connection to the target system is opened.
The WRL- and WRH- lines are used for loading this memory.

DIP Switch
CS0- (Target)
CS0A[19..1]

A[0..18]

A[0..18]

D[7..0]

D[7..0]

RD-

OE-

OE-

WRL-

WE-

WE-

RAM 512K*8

RAM 512K*8

D[15..0]

WRH-

1989-2016 Lauterbach GmbH

FIRE Emulator for C166S V2 Family

41

Fast Emulation Memory

Bondout Trace
The bondout bus delivers information on the instruction pointer, the opcode, the operand data (result or
operation) and the source and destination address. The bondout trace system makes filtering and dequeing
of this busses to build qualified trace and trigger information. Valid trigger information is highlighted in the
trace.
ADD1

Operand Read Address

ADD2

Operand Write Address

IP

Instruction Pointer

OPC

Opcode

OD

Operand Data (result of operation)

MACH,MAC

MAC Data

DPP

Used DPP register

INJ

Injected Instruction (e.g. interrupt)

NI

New Instruction (marks first cycle)

BSEL

Selected register bank

ILVL

Status or PSW.ILVL field

Every operation is shown in on trace frame. The IP address belongs to the source and destination address
and the operand data.

Analyzer Modes
The analyzer can work in 3 different modes:
TraceInt

All cycles inside the CPU are traced, the external bus cycles are not
traced.

TraceExt

Only external bus cycles are traced. The internal breakpoints (OD, etc.)
can be used for emulation break, but not for analyzer control.

TraceInt+TraceExt
(TraceMixed)

In this mode the internal CPU cycles as well as the external bus cycles
are traced.

1989-2016 Lauterbach GmbH

FIRE Emulator for C166S V2 Family

42

Bondout Trace

Bondout Trigger and Break System

Bondout Breakpoints

Format:

Break.Set <address> | <range> [/<mode> ...]

<mode>:

Read
Write
Program
Data[.<size>] <data>

<size>:

auto
Byte
Word

<data>:

<value>
<range>
<mask>

The breakpoint system is based on the bondout bus. The breakpoint information is filtered out of the
program counter (instruction pointer), the operand read and write addresses and the resulting data of the
operation. Every breakpoint can be qualified by a data word, byte, range or pattern.
Break.Set

flags /write

; set write breakpoint on address


; flags

Break.Set

v.range(flags) /write

; set write breakpoint to full range


; of array flags

Break.Set

flags /read

; set read breakpoint

Break.Set

sieve /program

; set software breakpoint on


; function sieve

Break.Set

sieve /p /hard

; set hardware breakpoint on function


; sieve

1989-2016 Lauterbach GmbH

FIRE Emulator for C166S V2 Family

43

Bondout Trigger and Break System

Bondout Trigger System

Format:

Break.Set <address> | <range> [/<mode> ...]

<mode>:

Alpha
Beta
Charly
Delta
Read
Write
Program
Data[.<size>] <data>

<size>:

auto
Byte
Word

<data>:

<value>
<range>
<mask>

As all trace records are synchronized, and no prefetches are on the trace bus, triggering and selective
sampling is very easy with the FIRE emulator. By using the program address qualifier, triggering on local
variables is possible. Every qualifier is combined with a data qualifier.

Operand Read Address


OAR Qualifier

Alpha
Beta

Operand Write Addr.


OAW Qualifier

+
Charly

Instruction Address
IP Qualifier

Delta

Data
Data (Result)

Data Qualifier

Data

1989-2016 Lauterbach GmbH

FIRE Emulator for C166S V2 Family

44

Bondout Trigger and Break System

Trigger on Data Writes


addr ab v.range(flags) /write

; defines alphabreak with


; address of array flags
; stop emulator if alphabreak

trigger.program if ab

Trigger on Data Writes with Data Qualification


addr ab v.range(flags) /write /data.byte
0x1

trigger.trace if ab

;
;
;
;
;

defines alphabreak with


address of array flags
and data value 0x01
stop analyzer if
alphabreak

;
;
;
;

defines alphabreak with


address of array flags
trace only access to range
of alphabreak

Selective Trace of Address Areas


addr ab v.range(flags) /readwrite
sample if ab

Selective Trace of Address Areas and Data Qualification


addr ab v.range(flags) /write /data 0x1

sample if ab

;
;
;
;
;

defines alphabreak with


address of array flags
with data qualification
trace only access to range
of alphabreak

Trigger on Execution of Program Line


addr ab sieve /program /hard

; defines alphabreak with


; address of function sieve
; stop analyzer if alphabreak

trigger.trace if ab

1989-2016 Lauterbach GmbH

FIRE Emulator for C166S V2 Family

45

Bondout Trigger and Break System

Trace of Local Variables


addr ab \\demo\20 /program /hard

sample if ab

;
;
;
;

defines alphabreak with


address of program line 20
in module demo
sample data if alphabreak

Trigger of Local Variables with Data Qualification


addr ab \\demo\20 /program /hard /data 0x1

sample if ab

;
;
;
;
;
;

defines alphabreak with


address of
program line 20 in
module demo and data 0x1
sample data if
alphabreak

1989-2016 Lauterbach GmbH

FIRE Emulator for C166S V2 Family

46

Bondout Trigger and Break System

Code Flag System

Code Coverage
As prefetches are filtered by the bondout, the code coverage is 100% valid. The trigger system has 2 areas
for code coverage with 1 MByte each. There are no restrictions on memory used by the program code. The
code coverage works for external memory, ROM, XRAM and IRAM. There is no distinguish between BOOT
ROM, ROM and external memory.

Flag Mapping
Flag mapping is done by:

Format:

MAP.CFlag <addressrange>

Format:

MAP.NoCFlag <addressrange>

MAP.CFlag

0--0xfffff

MAP.NoCFlag

; supports the 1st MByte with


; code coverage memory
; suspends code coverage

1989-2016 Lauterbach GmbH

FIRE Emulator for C166S V2 Family

47

Code Flag System

Data Access Flags

Flag Operation
The data flag system works on all accesses with short and long addresses, in all types of memory. The flag
system has 2 areas for read and write with 1 MByte each. Stack, register and bit operations are not covered
by the flag system
The flag system works with byte resolution

Flag Mapping
Data flag mapping is done by:

Format:

MAP.Flag <addressrange>
MAP.ReadFlag <addressrange>
MAP.WriteFlag <addressrange>

Format:

MAP.NoFlag <addressrange>
MAP.NoReadFlag <addressrange>
MAP.NoWriteFlag <addressrange>

MAP.Flag

0--0xfffff

MAP.NoFlag

; supports the 1st MByte with


; read and write flag memory
; suspends flag mapping

1989-2016 Lauterbach GmbH

FIRE Emulator for C166S V2 Family

48

Data Access Flags

Bondout Based Dualport Systems

Bondout Shadow Memory


The shadow memory works for all short and long addressing modes in the external memory, the XRAM and
IRAM.

Format:

MAP.Shadow <addressrange>

Format:

MAP.NoShadow <addressrange>

The shadow memory is displayed, when the emulation is running and the
The shadow memory has 1 block with 1MByte length.

Injected Access
The C166S supports injected dualport access. A memory-memory transfer instruction is feeded to the
instruction queue. This type of dualport access can access internal and external memory, IRAM and XRAM,
as well as memory on the target system.
The injected access mode is used when CPU access is enabled (C166S only).

1989-2016 Lauterbach GmbH

FIRE Emulator for C166S V2 Family

49

Bondout Based Dualport Systems

On-chip Trigger System


The bondout CPU has an onchip trigger unit with 16 IP Watchpoints and 32 Data Watchpoints. Every
Watchpoint can be used as address range or as two independent breakpoint. They can be used if you
would like to set a breakpoint in a target memory where no code can be patched (e.g. EPROM or Flash)
The setting of the on-chip breakpoints in running mode is only possible when dualport access CPU or
MIXED is enabled
Onchip prgram breakpoints are not working in a atomic or EXTended sequence. There are also ignore on a
single cycle jump instruction.

1989-2016 Lauterbach GmbH

FIRE Emulator for C166S V2 Family

50

On-chip Trigger System

Special Functions
DPP( <offset> )
Returns the memory addressed by the short pointer argument. The lower 14 bits of the argument hold the
offset, the two upper bits the DPP selector.

1989-2016 Lauterbach GmbH

FIRE Emulator for C166S V2 Family

51

Special Functions

Breakpoints
For a basic description of the breakpoint system please refer to FIRE Users Guide.

Breakpoint Realization Modes


This chapter describes the different realization modes and shows their availability for the logical breakoints
types.
Software
Breakpoints

The user application code is patched with a special break-instruction of the


bondout CPU (opcode 0x8C00) before jumping into the user program.
After executing this instruction, the CPU stops the user program and jumps
into the emulator debug monitor.

Hardware
Breakpoints

These breakpoints are used as address selectors for the trigger unit (see
FIRE Users Guide).

On-chip
Breakpoints

The bondout CPU has an onchip trigger-unit with 16 IP Watchpoints and


32 Data Watchpoints
They can be used if you would like to set a breakpoint in a target memory
where no code can be patched (e.g. EPROM or Flash).

The following table shows realization of the logical breakpoint types in auto-mode.
Breakpoint Type

Realization in Auto Mode

Program

Software
On-chip (If the address is mapped as ReadOnly)
On-chip (If the CPU is in running mode)

HLL

Software
On-chip (If the address is mapped as ReadOnly)
Stepmode (If HLL-Line is too complex)

Spot

Software
On-chip (If the address is mapped as ReadOnly)

Read, Write

Hardware

Alpha, Beta,
Charly, Delta,
Echo

Hardware

1989-2016 Lauterbach GmbH

FIRE Emulator for C166S V2 Family

52

Breakpoints

Memory Classes

Memory Class

Description

D
P

Data
Program

X
R
L
B

External Area
ROM/Flash Area
Bootloader Area
Bit

C
E
A

Memory access by CPU


Emulation memory access
Absolute (physical) memory access

1989-2016 Lauterbach GmbH

FIRE Emulator for C166S V2 Family

53

Memory Classes

State Analyzer

General 80166 Keywords for the Trigger Unit

Bondout CPU Keywords for the Trigger Unit


Input Event

Meaning

BYTE

Byte transfer

EXTREAD

Read access on external bus

EXTWRITE

Write access on external bus

INTCYCLE

Internal cycle

OPFETCH

Opfetch cycle

TRIGOUT0
TRIGOUT1
Word

Word transfer

For non cpu-specific keywords see non-declarable input variables in ICE/FIRE Analyzer Trigger Unit
Programming Guide (analyzer_prog.pdf).

1989-2016 Lauterbach GmbH

FIRE Emulator for C166S V2 Family

54

State Analyzer

Keywords for the Display

Bondout Information Display


WR

Write Bus Cycle

IP
IPY
OPC
OD
ADD1
ADD1Y
ADD2
ADD2Y

Instruction Execution Address


Symbolic Instruction Execution Address
Op Code
Result Data
Operand Address Read
same symbolic
Operand Address Write
same symbolic

DPP
INJ
NI
BSEL
ILVL

DPP select (shows which DPP register is used)


Injected instruction (e.g. interrupt)
New Instruction (marks first cycle of an instruction
Bank select (show selected register bank)
Interrupt Level (status if ILVL field of PSW register)

List.Bondout
List.NoDummy

Display internal bus information (included in default)


Suppress dummy cycles (included in default)

The information from the bondout busses is displayed in the way like external operations. In mixed trace
mode bondout data display is omitted, when it matches an external cycle. Cycles which sample only internal
bondout information are marked as DUMMY cycles. Cycles which contain only external information have the
EXTONLY flag set. Internal bondout cycles get the timestamp and external line information of the closest
cycle if possible. This allows the display of timestamp and external lines even when the processor has no
external bus activities. Variable accesses can be displayed in HLL form even for register and stack variables
(Var command).

1989-2016 Lauterbach GmbH

FIRE Emulator for C166S V2 Family

55

State Analyzer

Port Analyzer

Port Signals XC161CJ


Name

Group

Description

NMI-

MISC

Line NMI-

RSTIN-

MISC

Line RSTIN-

P000 .. P015

P0

Port P000 .. P015

P100 .. P115

P1

Port P100 .. P115

P208 .. P215

P2

Port P208 .. P215

P2000 .. P2002

P20

Port P2000 .. P2002

P2004 .. P2005

P20

Port P2004 .. P2005

P2012

P20

Port P2012

P300 .. P313

P3

Port P300 .. P313

P315

P3

Port P315

P400 .. P407

P4

Port P400 .. P407

P500 .. P515

P5

Port P500 .. P515

P600 .. P607

P6

Port P600 .. P607

P704 .. P707

P7

Port P704 .. P707

P900 .. P905

P9

Port P900 .. P905

Name

Group

Description

NMI-

MISC

Line NMI-

RSTIN-

MISC

Line RSTIN-

P100 .. P113

P1

Port P100 .. P113

P301 .. P311

P3

Port P301 .. P311

P313

P3

Port P313

P315

P3

Port P315

P500 .. P507

P5

Port P500 .. P507

P510 .. P515

P5

Port P510 .. P515

P900 .. P905

P9

Port P900 .. P905

Port Signals XC164CM

1989-2016 Lauterbach GmbH

FIRE Emulator for C166S V2 Family

56

Port Analyzer

Port Signals XC164CS


Name

Group

Description

NMI-

MISC

Line NMI-

RSTIN-

MISC

Line RSTIN-

P000 .. P015

P0

Port P000 .. P015

P100 .. P115

P1

Port P100 .. P115

P2000 .. P2001

P20

Port P2000 .. P2001

P2004 .. P2005

P20

Port P2004 .. P2005

P2012

P20

Port P2012

P301 .. P313

P3

Port P301 .. P313

P315

P3

Port P315

P400 .. P407

P4

Port P400 .. P407

P500 .. P515

P5

Port P500 .. P515

P900 .. P905

P9

Port P900 .. P905

1989-2016 Lauterbach GmbH

FIRE Emulator for C166S V2 Family

57

Port Analyzer

Technical Data

Mechanical Dimensions

Dimension
LA-9595

M-XC161

ET128QF63

1989-2016 Lauterbach GmbH

FIRE Emulator for C166S V2 Family

58

Technical Data

Dimension
LA-9596

M-XC164CS

4250

5000

FRONT VIEW

TOP VIEW
ALL DIMENSIONS IN MILS

PIN1
ET100QF49

750

1900
1650

ET128QF49 PIN1

450

LA-9597

3800

5100

6500
6875

M-XC164CM

750

2150

4250

PIN1 ET64QF64

FRONT VIEW

5000

TOP VIEW
ALL DIMENSIONS IN MILS

450

4225

6500
6875

1989-2016 Lauterbach GmbH

FIRE Emulator for C166S V2 Family

59

Technical Data

Adaptions

CPU

Adaption

XC164CS
XC164D
XC164N
XC164S

ET100-QF49

XC161CJ
XC161CS
XC167CI

ET144-QF63

1989-2016 Lauterbach GmbH

FIRE Emulator for C166S V2 Family

60

Technical Data

Adapters

Socket CPU

Adapter

ET100-QF49

YA-1091 ET100-EYA-QF49
Emul. Adapter for YAMAICHI socket ET100-QF49

XC164CS
XC164D
XC164N
XC164S

8
6

56

SIDE VIEW

66

18

14
TOP VIEW (all dimensions in mm)

1989-2016 Lauterbach GmbH

FIRE Emulator for C166S V2 Family

61

Technical Data

Socket CPU

Adapter

ET144-QF63

YA-1111 ET144-EYA-QF63
Emul. Adapter for YAMAICHI socket ET144-QF63

XC161CJ
XC161CS
XC167CI
8
6

69

SIDE VIEW

69

17

18

TOP VIEW (all dimensions in mm)

Operation Voltage
This list contains information on probes available for other voltage ranges. Probes not noted here supply an
operation voltage range of 4.5 5.5 V.

No other voltage ranges available !

1989-2016 Lauterbach GmbH

FIRE Emulator for C166S V2 Family

62

Technical Data

Operation Frequency
Module

CPU

F-W010

F-W110

S-W010

S-W110

CHIP

LA-9595
LA-9595
LA-9597
LA-9596
LA-9596
LA-9597
LA-9597
LA-9597
LA-9596
LA-9596
LA-9597
LA-9597
LA-9595

XC161CJ
XC161CS
XC164CM
XC164CS
XC164D
XC164GM
XC164KM
XC164LM
XC164N
XC164S
XC164SM
XC164TM
XC167CI

33.0
33.0
33.0
33.0
33.0
33.0
33.0
33.0
33.0
33.0
33.0
33.0
33.0

40.0+
40.0+
40.0+
40.0+
40.0+
40.0+
40.0+
40.0+
40.0+
40.0+
40.0+
40.0+
40.0+

24.8
24.8
24.8
24.8
24.8
24.8
24.8
24.8
24.8
24.8
24.8
24.8
24.8

40.0+
40.0+
40.0+
40.0+
40.0+
40.0+
40.0+
40.0+
40.0+
40.0+
40.0+
40.0+
40.0+

40.0
40.0
40.0
40.0
40.0
40.0
40.0
40.0
40.0
40.0
40.0
40.0
40.0

TRACE HEAD
RAM

1989-2016 Lauterbach GmbH

FIRE Emulator for C166S V2 Family

63

Technical Data

Support

Probes
LA-9606

XC161CJ

ET144-QF63

XC161CS

ET144-QF63

XC164CM

ET64-QF64

XC164CS

ET100-QF49

XC164D

ET100-QF49

XC164GM

ET64-QF64

XC164KM

ET64-QF64

XC164LM

ET64-QF64

XC164N

ET100-QF49

XC164S

ET100-QF49

XC164SM

ET64-QF64

XC164TM

ET64-QF64

XC167CI

ET144-QF63

LA-9595
LA-9597
LA-9596

LA-9597

LA-9596

LA-9597
LA-9595

YES
YES
YES
YES
YES
YES
YES
YES

INSTRUCTION
SIMULATOR

YES
YES
YES
YES
YES
YES
YES
YES

POWER
INTEGRATOR

ICD
MONITOR

YES
YES
YES
YES
YES
YES
YES
YES

ICD
TRACE

ICD
DEBUG

XC161CJ
XC161CS
XC164CM
XC164CS
XC164D
XC164GM
XC164KM
XC164LM

FIRE

ICE

CPU

Available Tools

YES
YES
YES
YES
YES
YES
YES
YES

1989-2016 Lauterbach GmbH

FIRE Emulator for C166S V2 Family

64

Support

YES
YES
YES
YES
YES

INSTRUCTION
SIMULATOR

ICD
MONITOR

YES
YES
YES
YES
YES

POWER
INTEGRATOR

ICD
DEBUG

YES
YES
YES
YES
YES

ICD
TRACE

FIRE

ICE

CPU
XC164N
XC164S
XC164SM
XC164TM
XC167CI

YES
YES
YES
YES
YES

Compilers
Language

Compiler

Company

Option

C
C
C

C166
XC16X/ST10
GNU-GCC166

EOMF-166
ELF/DWARF
DBX

C
C++

C166
GNU-CPP166

C++

CP166

ARM Germany GmbH


Cosmic Software
HighTec EDV-Systeme
GmbH
TASKING
HighTec EDV-Systeme
GmbH
TASKING

Comment

IEEE
DBX
IEEE

Realtime Operation Systems


Name

Company

Comment

ARTX-166
CMX-RTX
Elektrobit tresos
Erika
Nucleus PLUS
osCAN
OSE Basic
OSE Epsilon
OSEK
ProOSEK
PXROS

ARM Germany GmbH


CMX Systems Inc.
Elektrobit Automotive GmbH
Evidence
Mentor Graphics Corporation
Vector
Enea OSE Systems
Enea OSE Systems
Elektrobit Automotive GmbH
HighTec EDV-Systeme GmbH

via ORTI
via ORTI
via ORTI
(OS166)
(OS166), 3.x
via ORTI
via ORTI

1989-2016 Lauterbach GmbH

FIRE Emulator for C166S V2 Family

65

Support

Name

Company

Comment

RTX166/-tiny
RTXC 3.2
RTXC Quadros
Rubus OS
SDT-Cmicro
uC/OS-II

ARM Germany GmbH


Quadros Systems Inc.
Quadros Systems Inc.
Articus Systems AB
IBM Corp.
Micrium Inc.

2.0 to 2.92

3rd party Tool Integrations


CPU

Tool

Company

ALL
ALL
ALL

ADENEO
X-TOOLS / X32
CODEWRIGHT

ALL

CODE CONFIDENCE
TOOLS
CODE CONFIDENCE
TOOLS
EASYCODE
ECLIPSE
RHAPSODY IN MICROC
RHAPSODY IN C++
CHRONVIEW
LDRA TOOL SUITE
UML DEBUGGER

Adeneo Embedded
blue river software GmbH
Borland Software
Corporation
Code Confidence Ltd

ALL
ALL
ALL
ALL
ALL
ALL
ALL
ALL
ALL
ALL
ALL

ATTOL TOOLS
VISUAL BASIC
INTERFACE
LABVIEW

ALL
ALL
ALL
ALL
ALL
ALL
ALL

CODE::BLOCKS
C++TEST
RAPITIME
DA-C
TRACEANALYZER
SIMULINK
TA INSPECTOR

Host
Windows
Windows
Windows

Code Confidence Ltd

Linux

EASYCODE GmbH
Eclipse Foundation, Inc
IBM Corp.
IBM Corp.
Inchron GmbH
LDRA Technology, Inc.
LieberLieber Software
GmbH
MicroMax Inc.
Microsoft Corporation

Windows
Windows
Windows
Windows
Windows
Windows
Windows

NATIONAL
INSTRUMENTS
Corporation
Open Source
Parasoft
Rapita Systems Ltd.
RistanCASE
Symtavision GmbH
The MathWorks Inc.
Timing Architects GmbH

Windows
Windows
Windows

Windows
Windows
Windows
Windows
Windows
Windows

1989-2016 Lauterbach GmbH

FIRE Emulator for C166S V2 Family

66

Support

CPU

Tool

Company

Host

ALL
ALL

UNDODB
VECTORCAST UNIT
TESTING
VECTORCAST CODE
COVERAGE
WINDOWS CE PLATF.
BUILDER
SDT CMICRO

Undo Software
Vector Software

Linux
Windows

Vector Software

Windows

Windows

Windows

IBM Corp.

Windows

ALL
ALL
C166

1989-2016 Lauterbach GmbH

FIRE Emulator for C166S V2 Family

67

Support

Products

Product Information
OrderNo Code

Text

LA-9606

FIRE Emulator for XC16x

FIRE-XC166

Bondout Module for XC166 family,


256K Flash Emulation, 5 Volt operation,
40 MHz Operation with bondout
requires FIRE-ARAM for external memory emulation
requires Trigger Module for XC166
(LA-9607)

LA-9607

Trigger Module for XC166

FIRE-XC166-TRIGG-64K

224 Trace Channels, Bondout Trigger System,


Bondout Flag System, Shadow RAM, 64K Trace

LA-9632

Trigger Module for XC166 512K

FIRE-XC166-TRIGG-512

224 Trace Channels, Bondout Trigger System,


Bondout Flag System, Shadow RAM, 512K Trace

LA-9595

Module for XC161, XC167

M-XC161

Module for TQFP144,ET128QF63


supports XC161 and XC167

LA-9596

Module for XC164CS

M-XC164CS

Module for ET100-QF49,


supports XC164CS, XC164D, XC164S and XC164N

LA-9597

Module for XC164CM

M-XC164CM

Module for ET64-QF64


supports XC164CM, XC164LM and XC164SM

1989-2016 Lauterbach GmbH

FIRE Emulator for C166S V2 Family

68

Products

Order Information

Order No.

Code

Text

LA-9606
LA-9607
LA-9632
LA-9595
LA-9596
LA-9597

FIRE-XC166
FIRE-XC166-TRIGG-64K
FIRE-XC166-TRIGG-512
M-XC161
M-XC164CS
M-XC164CM

FIRE Emulator for XC16x


Trigger Module for XC166
Trigger Module for XC166 512K
Module for XC161, XC167
Module for XC164CS
Module for XC164CM

Additional Options
LA-7512
MON-166
LA-7759
OCDS-C166S-V2

ROM Monitor for C166/ST10 on ESI


OCDS Debugger for XC2000/C166S V2 (ICD)

1989-2016 Lauterbach GmbH

FIRE Emulator for C166S V2 Family

69

Products