For general informations about the In-Circuit Debugger refer to the “ICE User’s Guide” (ice_user.pdf). All general commands are described in “IDE Reference Guide” (ide_ref.pdf) and “General Commands and Functions”.
P:000D75 \\IARZ80\iarz80\sieve+97 ........... MIX A
E::w.d.laddr/line code label mnemonic commentP:000D70 AF xor aP:000D71 ED42 sbc hl,bcP:000D73 381E jr c,0D93 ; c,?0176
Before debugging can be started, the emulator must be configured by software:
Ready to run setup files for most standard compilers can be found on the software CD in the directory ../Demo/Z80/Compiler. All setup files are designed to run the emulator stand alone without target hardware.
The following description should make the initial setup (to run the emulator together with the target hardware) easier. It describes a typical setup with frequently used settings. It is recommended to use the programming language PRACTICE to create a batch file, which includes all necessary setup commands. PRACTICE files (*.cmm) can be created with the PRACTICE editor pedit (Command: PEDIT <file name>) or with any other text editor.
The command sys.cpu is used to select one derivative within a cpu-family and to set its operation mode.
2. Set system options
The system window controls the CPU specific setup. Please check this window very carefully and set
the appropriate options. Use the button in the main tool bar and click to the option check box (Command: HELP.PICK) to get online help in a pop up window.
3. Select dualport mode (optional)
Dualport allows access to emulation RAM, while emulation is running. This is necessary to display variables, set breakpoints or display the flag listings while the emulation is running. System.Access selects how dualport access is done.
4. Set mapper (optional)
The mapper controls the memory access of the CPU. This means the use of internal or external memory, the protection of a memory bank etc. Address ranges must be defined by using memory classes.
system.downsystem.cpu Z182
; switch the system down; select derivative Zilog Z182
system.option IO8 on ; inform the ICE that you are using only ; 8 bit addresses
The CPU can be clocked by an internal (emulator) or external (target) clock source. If the internal clock is used, the clock is provides by the VCO of the emulator. The setting of the internal clock is done by the “vco” command.
The current CPU frequency can be displayed in the counter window.
6. Activate the emulator
When the emulator is activated a debug-monitor program is loaded into a hidden emulator memory. Afterwards, a bondout reset-signal is inactivated and the monitor program starts. This program allows access to user memory (data.dump, data.list) and cpu-registers, and gives control to start and stop the emulation.
7. Load application file (optional)
Application can be loaded by various file formats. UBROF format is often used to load code and symbol information. For information about the load command for your compiler see Compiler.
8. Set breakpoints (optional)
There are several ways to set breakpoints (Command: Break.Set). Breakpoints can be displayed using the Break.List command.
9. Start application
Application can be started with giving a break address. For example “go main” starts the application and stops at symbol main.
vco.clock 20. ; input clock to the EXTAL pin of the; cpu is set to 20 MHz (only necessary; if internal clock is used)
system.mode emulint ; system works with internal target clock
d.load.u iarz180.dbg ;load application file
breakpoint.set main /program
breakpoint.set flags /write
; set program break on function; main; set write break on variable; ’flags’
If you are not able to stop the emulation, there may be some typically reasons:
Dual-Port Errors
To realize the dual-port access (emulation memory) the BUSREQ-line of the CPU is used. Dual-port accesses are allowed only while no external request to the bus occurs and the CPU cycle is completed. If the emulation CPU is in RESET state of the CPU the system controller may always access the emulation memory.
Dual-port errors may occur by the following conditions:
1. The length of the CPU cycle is extended by wait cycles, so that the request timeout signal is generated.
2. External DMA requests (single cycles) are too long.
To solve problems with dualport error first increase the SYStem.TimeReq value. Be sure that the SYStem.TimeOut value is bigger than the access time limit. If it is not possible to solve the problem by changing the values, you must switch to DENIED mode. In this mode no access to memory is possible while running realtime emulation. The internal dual-port access can increase the reaction time for external DMA requests. The performance reduction by the dual-port access is typically 1% with some data windows (dual-ported) on the screen and may be at max. 5% when using dynamic emulation memory.
Clock Error The clock lines between the target and the oscillator of the MCU are very short. Therefore normally no problems should occur when using an external crystal. The clock line for all Z80 type processors is very critical.
Analyzer Function If you switch off the analyzer and the CPU has stopped operation, an invalid display occurs. Make a SYStem.Up command to see the true trace information.
The debugger is accessed via Internet/VPN and the performance is very slow. What can be done to improve debug performance?
The main cause for bad debug performance via Internet or VPN are low data throughput and high latency. The ways to improve performance by the debugger are limited:
In PRACTICE scripts, use "SCREEN.OFF" at the beginning of the scriptand "SCREEN.ON" at the end. "SCREEN.OFF" will turn off screenupdates. Please note that if your program stops (e.g. on error) without exe-cuting "SCREEN.OFF", some windows will not be updated.
"SYStem.POLLING SLOW" will set a lower frequency for target statechecks (e.g. power, reset, jtag state). It will take longer for the debugger torecognize that the core stopped on a breakpoint.
"SETUP.URATE 1.s" will set the default update frequency ofData.List/Data.dump/Variable windows to 1 second (the slowest possiblesetting).
prevent unneeded memory accesses using "MAP.UPDATEONCE[address-range]" for RAM and "MAP.CONST [address--range]" forROM/FLASH. Address ranged with "MAP.UPDATEONCE" will read thespecified address range only once after the core stopped at a breakpoint ormanual break. "MAP.CONST" will read the specified address range onlyonce per SYStem.Mode command (e.g. SYStem.Up).
Is there a simple way to control target power supply via the ICE to prevent problems after the ICE has been powered off?
Follow the sequence below.
If you own an output probe COUT8, connect it to the STROBE output con-nector.
Type PULSE2. and press F1. You will get the pin out of the output probeCOUT8. Pin 13 (OUT6) delivers +5 V after the emulator has finished its ini-tialization and 0 V if the emulator is powered off. This can be used to drivea relay via a transistor to switch the target power on and off automatically ifthe Pulse Generator is not used for other purposes. The schematic of theswitching unit can be found in the file TARGETC.CMM.
Additionally Pin 13 (OUT6) can be controlled by ICE commands.
Target power supply off. "PULSE2.P +" Target power supply on. "PULSE2.P -"
The following Practice command file creates 3 buttons in the Toolbox for:
Target power on Target power off Target power off and QUIT.
Adding that file to T32.cmm loads the buttons automatically after startup.
http://www.lauterbach.com/faq/targetc.cmm
Wrong Location after Break
Ref: 0030
Why is the location after break wrong?
Most emulators use some bytes of user stack for the break system. Therefore it is necessary to have valid stack, if single step or breakpoints are used.
Z80C15
Z84C11/C13/C15 Emulation
Ref: 0047
How must a Z84C15 target be prepared for the emulation, using a Z80 emulator?
To run the emulation mode on the target CPU, the EV pin must be tied to "high". The TRACE32 Z80 emulation probes of the Z84C11/C13/15 emulators, drive the EV pin with a 100 Ohm resistor. On the target, it is recommended to connect the EV pin via a 1 kOhm resistor to ground.
The ICE-80 emulation head supports all Z80 derivatives from Zilog, Renesas and Toshiba and further the 8085 from Intel or NEC. The adaption to different probes is done by changing modules. Modules support both DIL and PLCC versions, if available. The maximum frequency of the base module is 20 MHz. The modules are delivered with the fastest available chip. The emulation probes support all modes of the CPUs, some modes without dual-port access capability. The 8085, Z80 and TMPZ84Cxx probes support 256 banks with 64K each. The Z180 like probes may run with 16 banks of 1 MByte each. An additional slot in the base module offers upgrading with the Port-Analyzer to get timing and state trace features for all MCU I/O ports.
Peripherals Window
After the internal IO base address has changed (Z180,Z181,Z182), the Peripherals Windows must be reprogrammed. Use the PER.RP command, otherwise the windows has a wrong content.
Z80182 Emulation hints
IMPORTANT:
For emulation without a target or for emulation of a target but without a CPU on it, put a Z80182 CPU into the socket at the Z182 adapter.
For emulation of a target with a CPU on it, remove the Z80182 CPU from the Z182 adapter.
In order to emulate a Z80182 target, the CPU on the target (if there is one) must stay in the special mode (Mode1). This mode is selected if pin EV1 is connected to VCC, and pin EV2 is connected to GND. It cannot be accomplished through any emulator instruction. The user must cater for the correct signal levels by himself. For a normal operation without an emulator (Mode0), it is recommended to connect both pins to the appropriate level via 2 high-resistive resistors. The Z80182 probe is able to drive these pins via 100 Ohm resistors to Mode1.
Bear in mind, that the Z80182 is emulated with a Z180 CPU. The internal peripherals should only be moved to the IO base addresses xx00,xx40 or xx80. The additional internal peripherals (start at IO:xxD8) can only be accessed if the emulator is in mode Emulation External or Emulation Internal.
The emulation head can stay in 6 modes. The modes are selected by the SYStem.Up or the SYStem.Mode command.
In active mode, the power of the target is sensed and by switching down the target the emulator changes to RESET mode. The probe is not supplied by the target. When running without target, the target voltage is simulated by an internal pull-up resistor.
This command selects the operation mode of the CPU (only Z84C01, HD647180). The command may only be executed when the system is down and must be set to the correct operation mode. External mode pins from the target system are not sensed.
Nodelay The dual-port access is made between two bus cycles. The max. frequency is 8 MHz on Z80 and Z180 probes.
REFresh The dual-port access is made on CPU refresh cycles. On Z180 probes the refresh function must be switched on. Z80 probes run till 10 MHz and Z180 probes with max. speed if 2 waits for the refresh is specified. 8085 probes do not support this operation mode.
Request This operation allows operation up to the max. speed of the CPU, it runs only on processors with open BUSREQ/BUSACK lines (Not HD647180, HD648180). The CPU speed is slowed down about 1% by dual-port accesses or 5% by refreshing DRAMs as emulation memory.
Denied This mode is available for all types of CPUs. No dual-port access is possible on realtime emulation.
This option allows DMA access without running realtime emulation. External DMA circuits are not stopped on breakpoints.
NMI Routines NMI routines use the IFF1 and IFF2 register. On breakpoint execution there is no distinction between IFF1 and IFF2 register. So the next RETN instruction may set the interrupt flag incorrectly. Running with realtime NMI routines are executed correctly.
Power Down Modes All power down modes which stop the clock generator make fatal emulator errors. On emulation change to an other operation mode.
HALT Realtime emulation may not be stopped if the CPU is in the HALT state. The command Break.Halt activates the breakpoint logic and forces a NMI signal to recover from HALT state.
Trace Internal Registers Write cycles to internal registers are always traced correctly. On read cycles data may be invalid on Z180 and HD64180 probes. The Z181 CPU and the HD647180 enable trace on internal read cycles. On Z181 the ROM emulator mode bit (0ED.1) must be set.
8 Bit I/O When 8-Bit I/O addressing is active (System.Option IO8) it is not possible to map attributes (e.g. intern/extern, wait states) to single I/O locations.
Normally refresh cycles are not traced by the analyzer. On high speed operation with Z80 probes (f > 12.5 MHz) no trace on refresh cycles is allowed as the cycle time of the analyzer must be 150 ns at minimum (ECC8). If activated, the refresh cycles can cause the data selectors to be triggered by refresh cycles, even if the address is not hit by the cycle. To prevent occasionally triggers, address selectors of the trigger unit should be combined with the condition 'N:REFRESH'.
SYStem.Option Wait options
SYStem.Option OMCR OMCR register
The Z180 and Z181 probes must be switched to different internal modes resulting from different bus signals and timings if the OMCR register is changed. The value in this field must be the same value as set by the target software. The CPU is automatically programmed to this pattern on activating the emulation system (SYStem.Up).
FAST Must be set to ON with emulation frequency higher than 12 MHz (Z80, Z180).
RamWait This signal generates 1 wait state for all bus cycles that sense the wait input line. As the generation of the wait signal is sometimes very critical in high-speed Z80 systems, this option may help to solve problems with external wait state generators.
PullWait An additional pull-up resistor on the WAIT input line is switched on. Normally needed in standalone mode (Z84C50, Z84C11, Z84C15).
One big problem in Z80 systems is handling the RETI instruction. This command must be read by the peripherals together with the M1 signal to clear the interrupt daisy chain. No problem occurs if the program is running from the target memory as the data flow is the same like in the system running without emulator. If the program is mapped to internal the peripherals may see other code than the emulation CPU.
In small target systems (no data buffer between CPU and peripherals) the internal code may be send to the data system if DOUT is on. The memory is accessed internal and no memory on the target should block the bus (remove EPROMs).
If a data buffer between CPU and peripherals exists in the target, there are also some possible solutions:
1. Replace the EPROM by a RAM and load the code to the target.
2. Program the RETI instruction to a fixed address in the EPROM on the target and exit every interrupt routine at this location.
3. Use an EPROM simulator to load your program.
4. Some systems use special boot modes to change the data bus direction.
SYStem.Option IO8 Size of I/O space
This option must be set when only 8-bit I/O addresses are used. The option must be set before any memory is mapped or breakpoints are set. Memory attributes, like wait states or protection, are not handled for 8-bit I/O address.
SYStem.Option V33 Voltage sense
The threshold level for the power-down sense is reduced to 2.8 V for operation with 3.3 V targets.
The NMI line is not traced directly. A special circuit samples only the falling edge and makes it visible in the next cycles. This allows correct trigger only to edges and not to static levels.
The pulse width of the exception generator defines the length of the interrupt request. As the NMI signal is edge sensitive, only one interrupt is executed.
On INT0 a pulse executes only one interrupt, but if there is no bus cycle within the pulse active time, no interrupt is generated.
Exception vectors are all even values from 0 to 254 (0 to 7 for the 8085). On interrupt stimulation no INTA cycles are made to the target. Therefore stimulated interrupts may run in parallel to interrupts generated by peripherals on the target system.
Format: Exception.Enable NMI [ON | OFF]
Format: Exception.Enable TRAP [ON | OFF]
Format: Exception.Enable Int0 [ON | OFF]
Format: Exception.Enable Int1 [ON | OFF]
Format: Exception.Enable Int2 [ON | OFF]
Format: Exception.Enable RST55 [ON | OFF]
Format: Exception.Enable RST65 [ON | OFF]
Format: Exception.Enable RST75 [ON | OFF]
NMI, TRAP, INTR
Enables NMI from target.
Int0, Int1, Int2 Enables interrupt line from target.
If using the DMA and switching of the M1 signal the emulator cannot distinguish between opfetch cycles and dma read cycles. This may result in fatal errors executing breakpoints. As usually the DMA doesn't access the program area the data area can be marked for the emulator by the mapper. Only DMA memory read areas should be mapped.
Banking as described in this chapter refers to address extension of Z80/8085 processors, not the internal MMU of the Z180 family. In banked systems the upper address lines are either supplied internally or by the external bank probe. 8 additional lines offer 256 different memory banks. Accessing the different pages is done by extending all memory and pc addresses to 24 bit. The address bits A16 to A23 select the memory bank. Every command which makes a memory access first calls a special bank driver subroutine to select the temporary memory bank. On realtime emulation the bank number is traced on the upper 8 bits of the address bus. The breakpoints function stores the bank address back to the MSB of the program counter.
SYStem.BankFile Select banking file
This command loads the bank driver. The bank driver is a special subroutine to select the actual bank. Loading a special bank driver gives a maximum of flexibility to the user. A bank address delivered by the emulator may be used to set microcontroller ports or external MMUs in the target system.
The bank file consists of a code number defining the bank operation mode and a code area which consists of a subroutine to set the correct bank state. Writes to internal CPU ports may be executed directly, while ports in target systems must be accessed by a special system call (see end of this chapter). The internal bank address is placed in accu A when calling the subroutine. One return the function must clear A when working on a Z180 with external banking. The write function to the target system needs the address in BC and the data in accu A. The BNK register holds the physical bank number. The PP (Program Pointer) register hold the logical 24-bit PC address. The translation between logical bank and physical bank (also for the common areas and I/O space) is done by the MMU command.
; set area of banked eprom; activate translation for; addresses; load bank file
org 17FFH
db 1 ; select internal mode
bank: ; accu a is bank address
org 1800h ; destination area in system memory
ld e,0ld hl,1800hcall 100h
ret
; physical bank 0; set hl to banked area; subroutine to write byte to target; system setting the page register; in the EPROM; hl is address, A is date; return
External banked systems use a register or output pins of the CPU to generate the upper memory addresses. These lines must be feedback to the emulator with the bank probe. Unused inputs of the bank probe must be grounded (or jumpered to ground pin).
This example selects the bank by internal port 45H bit 6 and 7:
Now the bank select is done by an external register selected at A0h:
; This example uses a common program area on 0--3fffh; a banked area from 4000--7fff with 4 banks
Extended is used to extend the address space of Z180 CPUs. Up to 16 banks of 1MByte can be used. The bank select routines gets A16..A23 in A and returns the remaining A16..A19 for the CPU address in A. The upper 4 bits are used to specify the 16 banks.
The next examples shows the map and load commands with MMU translation for common ares:
bank: ; accu a is bank address
org 1800h ; destination area in system memory
ld bc,0a0hcall 110H
xor aret
; set BC to banked area; subroutine to write byte to emulation; ram setting bank register; BC is address, A is date; clear BANK (only required for Z180); return
The following routines are available in the emulation control monitor to access external memory or i/o:
Using the MMU for Z180
This command and the commands MMU support the built-in MMU of the Z180 processors.
The analyzer and all memory systems and breakpoints are based on the physical address. The display in the analyzer can be both physical or logical addresses. A logical address can have two formats: smaller than 64K or larger. Smaller addresses are assumed to be an logical address as seen by the CPU in the current
MMU configuration. If an address is larger than 64K, the address bits A16 to A23 define the bank base address used for the BBR or CBR register. Logical above 64K addresses should only be used, if the MMU registers were already setup. The following schematic shows these relations for some examples:
To activate the correct address translation for breakpoints, the MMU command must be activated. The following example loads a banked application:
The next example loads a banked application in two logical units:
The MMU translation table is used for translating physical addresses (analyzer, trigger) to logical addresses and logical addresses to physical addresses. The logical to physical translation is done by reading the MMU registers of the CPU and calculating the physical address.
This storage classes operate on the same physically memory. They are only used to be compatible with other emulation probes. CPU internal registers and memory may not be accessed dual-ported, by mapping memory to the same address range data written to the internal memory are also present in the emulation memory.
IO:
The IO address is normally 16 bit. The commands Data.Out and Data.In uses this storage classes on default.
EEPROM:
This storage class is used to program the internal EEPROM. On read cycles there is no difference to the access mode with C: or D:. On write cycles the monitor program executes an EEPROM write protocol.
Access Class Description
C:D:P:AD:AP:IO:
Specify the same address-area (CPU-access) on Z80 family
The absolute access storage classes can be used if access to a physical memory location is required. The storage class is only useful on Z180/HD64180 devices.
CODE::BLOCKS - -C++TEST - WindowsADENEO -X-TOOLS / X32 blue river software GmbH WindowsCODEWRIGHT Borland Software
CorporationWindows
CODE CONFIDENCE TOOLS
Code Confidence Ltd Windows
CODE CONFIDENCE TOOLS
Code Confidence Ltd Linux
EASYCODE EASYCODE GmbH WindowsECLIPSE Eclipse Foundation, Inc WindowsCHRONVIEW Inchron GmbH WindowsLDRA TOOL SUITE LDRA Technology, Inc. WindowsUML DEBUGGER LieberLieber Software
GmbHWindows
SIMULINK The MathWorks Inc. WindowsATTOL TOOLS MicroMax Inc. WindowsVISUAL BASIC INTERFACE
Microsoft Corporation Windows
LABVIEW NATIONAL INSTRUMENTS Corporation
Windows
RAPITIME Rapita Systems Ltd. WindowsRHAPSODY IN MICROC IBM Corp. WindowsRHAPSODY IN C++ IBM Corp. WindowsDA-C RistanCASE WindowsTRACEANALYZER Symtavision GmbH WindowsECU-TEST TraceTronic GmbH WindowsUNDODB Undo Software LinuxTA INSPECTOR Vector WindowsVECTORCAST UNIT TESTING
The emulation probe is designed for running with CPUs up to 20 MHz. The max. speed is limited by the memory speed and the wait states used for memory access. The CPU type (Z80 or Z180) and some operation options (e.g. Refresh, dual-port access) also affect the max. frequency.
Additional OptionsET-1032 ET100-CET-QF06 Clip-Over Adapter for ET100-QF06TO-1260 ET100-ETO-QF06 Emul. Adapter for TO socket ET100-QF06YA-1031 ET100-EYA-QF06 Emul. Adapter for YAMAICHI socket ET100-QF06ET-1030 ET100-SET-QF06 Surface Mountable Adapter for ET100 to QF06TO-1261 ET100-STO-QF06 Emul. Adapter TO-surface mount. ET100-QF06LA-7518 MON-Z80 ROM Monitor for Z80 on ESILA-6450 PA64 Port AnalyzerLA-1925 PLCC-TEST-ADAPTER-44 PLCC Test Adapter 44 PinsLA-1927 PLCC-TEST-ADAPTER-84 PLCC Test Adapter 84 Pins
