JPH08161191A - In-circuit emulator - Google Patents

Abstract

PURPOSE: To execute sufficiently enough debugging even when a high speed MPU is a target by providing a built-in chip in a target device with a specific debugging unit. CONSTITUTION: The built-in chip 10 in the target device is provided with the debugging unit 20 having a state analyzing trace function, a non-brake debugging function for executing real-time on-chip debugging resource in all states without stopping the running of a target MPU and an on-chip monitor memory access interface function. Since the unit 20 for executing a part of the functions of an ICE is included in the chip 10 including the MPU in the target device, the necessity of a buffer or the like used for data transfer between a conventional target device and the ICE is eliminated, and thereby the speed of data to be processed can be increased.

Description

Detailed Description of the Invention

[0001]

BACKGROUND OF THE INVENTION 1. Field of the Invention The present invention relates to an in-circuit emulator, and more particularly to an in-circuit emulator capable of high speed debugging.

[0002]

2. Description of the Related Art An in-circuit emulator (hereinafter abbreviated as ICE) is a device for accessing an MPU in a target (device under test) to debug the target MPU. The functions of general ICE are as follows.

Emulation Function of Target Memory When the ICE is connected to the target and a part of the memory in the target is changed, the memory in the target is replaced by the memory in the ICE. Normally, the target memory is R
Since it is made of OM, it is difficult to change part of the program. Therefore, if the memory in the target is replaced by the memory in the ICE, the memory in the ICE becomes RA.
Since M can be used, the program can be changed freely. Further, even when the predetermined memory does not exist in the target, the program can be incorporated into the memory in the ICE to emulate the target.

History trace function This is similar to the function of a conventional logic analyzer,
This is a function of recording data on the bus in multiple stages from the trigger time to the front and the rear. When a device failure occurs,
The cause of the failure can be diagnosed by analyzing the data on the front and rear paths.

Target execution break function This function stops (breaks) the operation of the target MPU and reads the contents of various registers and the like in the MPU at the time of the stop. The cause of the target failure can be diagnosed.

[0006]

The above three functions are all judged by the ICE side based on the signal output from the MPU,
It realizes each function. However, if the bus cycle is 30 MHz or more, it becomes difficult for the ICE side to judge the conditions for performing each function.

More specifically, the time required to determine whether or not the address is a break is 30 to 40 nS from the address valid time. Therefore, considering the setup and hold time of MPU, bus cycle 30M
If the frequency exceeds Hz, it becomes impossible to supply the break instruction from the ICE side. Further, when the MPU is a single chip, it is necessary to separately manufacture an evaluation chip to support the ICE, which is a burden on both the chip maker and the user in terms of cost, development schedule, and the like.

The present invention has been made in view of the above problems, and an object thereof is to provide an in-circuit emulator capable of performing sufficient debugging even when a high-speed MPU is a target.

[0009]

SUMMARY OF THE INVENTION The present invention which solves the above-mentioned problems is an in-circuit emulator for debugging a target device, wherein a trace function for state analysis is provided in an embedded chip in the target device.
It is characterized by providing a debug unit having a non-break debug function for performing real-time on-chip debug resources in all states without stopping the running of the target MPU and an off-chip monitor memory access interface function.

In this case, the debug unit may be provided with an external interface pin for connecting to the outside of the chip, and the external interface pin may change the number of pins depending on the use of the MPU and its application. It is preferable for flexibly supporting the application of the application.

[0011]

The debug unit for executing a part of the function of the ICE is provided in the embedded chip (embedded chip) including the MPU in the target device. This eliminates the need for a buffer or the like that is conventionally used when exchanging data between the target device and the ICE, thereby increasing the data rate that can be handled. For example, the conventional bus cycle which can handle only about 30 MHz can handle about 100 MHz.

In this case, the debug unit is provided with an external interface pin for connecting to the outside of the chip, and the external interface pin enables the MPU and the MPU by changing the number of pins according to the use of the application. This is convenient because it can flexibly respond to the application of the application.

[0013]

Embodiments of the present invention will be described below in detail with reference to the drawings. FIG. 1 is a block diagram showing the configuration of an embodiment of the present invention. In the figure, 10 is a built-in chip (also called an embedded chip) mounted in the target device, and 20 is a debug unit (also called an IDB unit) having a debug function provided in the built-in chip. This debug unit 20 is part of what is mounted in the form of a chip within the embedded chip 10.

In the embedded chip 10, 1 is an MPU
It is the core. In the MPU core 1, the NMI terminal is I
It is used for a forced break of the CE function (stopping the MPU core) and a break after execution. When this terminal is asserted (activated), the exception processing is started from the next bus cycle. The INT terminal is an interrupt input terminal and is used as a break before execution. When an instruction in which this terminal is asserted enters the execution queue of the pipeline of the MPU core, it shifts to exception processing without executing this instruction. It is assumed that the instruction at the time of asserting the INT terminal is replaced with SWI (software interrupt).

Reference numeral 2 is a cache memory connected to the MPU core 1 and 2a is a break memory attached to the cache memory 2. The break memory 2a is the MPU core 1
Are fetched into the INT terminal of the MPU core together with the instruction of the address fetched from the cache memory 2.

Reference numeral 3 is an external bus controller connected to the cache memory 2, 5 is an input / output device (I / O) connected to the bus 4, 6 is RAM connected to the bus 4, and 7 is connected to the bus 4. Flash ROM (readable / writable ROM). The flash ROM 7 is a ROM for supporting a mask ROM built in the target device. This flash ROM can be accessed by a program in a monitor memory (described later) during a break.

A break memory 8 has a size of 1 bit × n. Here, n is given by the following equation. n = number of bits of ROM / minimum instruction bit length For example, in a 256-bit ROM and the minimum instruction of the MPU core is 8 bits, n = 256/8 = 32. Therefore, the capacity of the break memory 8 at this time becomes 32 bits.

The break memory 8 is a flash RO.
Arranged on the same memory map as M7, flash RO
INT of MPU core 1 in synchronization with M7 data read
Terminal or break memory 2a of cache memory 2
It is supposed to be loaded into. The break memory 8 is set (changed from 0 to 1) by asserting the break point terminal 9 simultaneously with the break setting address access by the monitor memory program during the break.

Next, the configuration of the debug unit 20 will be described. The debug unit 20 is connected to the address bus, data bus and status signal of the MPU core 1 and has an interface pin 11 with the outside of the chip. The external interface spin 11 is occupied by the ICE. The optimum number of pins can be set depending on the MPU core 1 and application. In addition,
It is possible that n is 1, 3, 5, 7, 15, 31, 63. In this way, by adopting the configuration of connecting to the ICE via the external interface pin, the optimum number can be set depending on the MPU core 1 and application use, which is convenient. Here, the case of n = 15 of DBG (n: 0) will be described ((n: 0) indicates the bus width. The same applies to the following).

Reference numeral 12 is a trace section for outputting the address of the instruction being executed during the target run, 13 is a serial monitor access section for performing an access interface between the MPU core 1 and the monitor memory during a break, and 14 is an on-chip ICE resource. The non-break debug unit that performs initialization, data modification of the specific target memory, and control of the monitoring function of the specific target memory can be performed without stopping the target run from the ICE side. Then, these trace units 12,
The serial monitor access unit 13 and the non-break debug unit 14 are connected to the MPU core 1. Reference numeral 15 is an interface selector of the debug unit 20, which selects the function blocks 12 to 14 determined by the mode. A DBGMODE (1: 0) signal is input to the selector 15 as a select signal.

Reference numeral 21 is a selector connected to the debug unit 20 via the external interface spin 11, and selects an ICE resource determined by the mode. The selector 21 receives a DBG as a select signal.
The MODE (1: 0) signal is input. The signals exchanged between the selector 15 and the selector 21 are DBG.
(N: 0), DBGCLK (clock signal), DBG
There is S, DBGMODE (1: 0).

The debug unit 20 has a mode signal DB
GMODE (1: 0) makes it possible to recognize which of the three functions of trace, serial monitor access, and non-break debug is connected to the external interface pin 11. Also on the outside of the chip, the selector 21 uses the DBGMODE (1: 0) signal to trace memory 22, monitor memory 23, and non-break debug controller 2 corresponding to the current mode.
External interface spin 1 in any block of 4
Connect the 1 signal pin. The signal of the trace unit 12 enters the trace memory 22, the output of the monitor memory 23 enters the MPU core 1 via the serial monitor access unit 13, and the output of the non-break debug controller 24 passes through the non-break debug unit 14. Enter MPU core 1. The operation of the circuit thus configured will be described below.

The present invention is characterized in that the debug unit 20 for performing a part of the ICE function is mounted in the built-in chip 10 in the user's target device. The debug unit 20 is assumed to have an ICE function that does not burden the user. In conventional ICE,
It was configured to access the embedded chip from the ICE body. Therefore, it is necessary to use a device such as a buffer gate in the meantime, and the operation clock speed is several tens MH due to the delay between the input and output of the device and the stray capacitance existing between the wiring lengths.
It was restricted to about z. Therefore, in the present invention, the ICE
By mounting this function in the user's built-in chip 10, a buffer gate and the like are not required, and as a result, the usable operation clock can be extended to about 100 MHz. Hereinafter, the operation function of the circuit of FIG. 1 will be described.

The external interface spin 11 shown in FIG.
Each function is selected according to the contents of DBGMODE (1: 0) in Table 1. That is, when DBGMODE = 00, trace PC mode, when DBGMODE = 01, NBD
(Non-break debug) mode, DBGMODE = 1
When 0, the monitor access mode is set, and when DBGMODE = 11, the transstate mode is set. In addition, trace PC
The mode and NBD mode are the target mode, the monitor access mode and the transstate mode are the monitor modes. The NBD mode is accessible in either case.

[0025]

[Table 1]

The transition of the DBGMODE (1: 0) signal will be described. DBGMODE (0): Chip input signal. MPU core 1
To the NBD (non-break debug) MODE request. 1 indicates that the request is in progress and the NBD is in operation. DBGMODE (1): Chip output signal. 1 indicates that a break is in progress (serial monitor access mode). 0 indicates that the target run is in progress. At this time, the MPU core 1 is accessing the target memory. Debug unit 20 is in PC trace or NBD mode.

Table 2 shows the definitions of the DBGMODE (1: 0), the debug unit (IDB) function, and the external interface pin 11.

[0028]

[Table 2]

(1) PC trace function The PC trace function is used during the target run (DBGMOD
At E = 00), the address of the instruction being executed by the MPU core 1 is time-divided from the trace unit 12 and output to the external interface pin 11 via the selector 15. Outside the chip, the signal of the external interface spin 11 is connected to the trace memory 22 by the selector 21 and is controlled by the PCH clock and PCHSEQ.
To be sampled.

The output contents of the PC trace are output in time division from the upper address. An output example will be described below. When the address width of MPU core 1 ≦ the number of signal lines of DBG (n: 0) All addresses are output simultaneously in synchronization with the bus cycle of MPU.

Address width of MPU core 1> DBG
When the number of signal lines is (n: 0) When the address of the MPU core 1 is not sequential due to a program branch or the like, the upper address is output, and when it is sequential, the lower address is output. 2 and 3 are diagrams showing the output timing in the trace PC mode.
2 shows that the MPU core 1 has an address width of 32 bits and DBG
FIG. 3 shows the case of (15: 0) and the case where the address width of the MPU core 1 is 16 bits and DBG (7: 0).

In FIG. 2, A (31: 0) is the output address of the MPU core 1, PCH (15: 0) is the content output from the IDB, and SUB (31: 0) is the trace memory 22. N-SEQ indicates the case where the address output by the MPU core 1 is non-sequential (when there is a program branch, etc.), and SEQ indicates the case where the address output by the MPU is sequential. nOPC indicates a signal at which the MPU core 1 reads a program at a "0" level. In FIG. 3, A (15: 0) is the output address of the MPU core 1, PCH (7: 0) is the content output from the debug unit 20, and SUB (15: 0) is the trace memory 2
2 is written in N-SEQ when the address output from the MPU core 1 is non-sequential.
Q indicates the case where the addresses output by the MPU core 1 are sequential. In the case of FIG. 3, all of the addresses are stored in memory.

The number of signal lines of DBG (n: 0) is MPU
When it is not possible to define the number required to output the address of the core 1, in this case, only the address where the program branch of the MPU core 1 occurs is output. When the next branch address is generated during the output of the branch address, the PCHSEQ signal is negated (inactivated) and a new branch address is output so that it can be identified outside the chip. 4 and 5
FIG. 6 is a diagram showing an operation timing in the trace PC mode at this time. FIG. 4 shows the case where the MPU core 1 has an address width of 16 bits and DBG (3: 0), and FIG.
The address width is 16 bits and DBG (3: 0) is shown. In the case of FIG. 4, unlike the case of FIG. 3, when the address becomes non-sequential due to the branch, only the branch address is stored in the memory.

(3) Serial monitor access function The serial monitor access function is used when the target MPU is in break (when DBGMODE (1: 0) = 10).
Program off-chip monitor memory to DBG (n:
0) etc. are used to access via signal lines. Access is time-divisionally input / output in the order of state, address, and data. Address and data are transferred from the upper bits. The contents of the state are read, write, program fetch, and valid byte. What is a valid byte?
In the case of the 32-bit data bus (D31 to D0), the valid bytes (D7 to D0) are notified to the outside of the chip during byte access.

Depending on the number of DBG (n: 0), the serial monitor access bus SDI (n-1 / 2: 0),
Since the bit width of SDO (n-1 / 2: 0) is determined, it is necessary to transfer the state, address, and data in a time division manner. The number of divisions is set by the non-break debug function.

FIG. 6 is a diagram showing the operation timing of the write cycle in the serial monitor access. The figure is D
The case of BG (15: 0) is shown. 1 of MPU core 1 itself
The bus cycle is from SDCLK1 to SDCLK13. Data is written to the monitor memory 23 at the falling edge of BUSCLK2.

The serial monitor bus time-divides the address, data, and state already output from the MPU core 1 with BUSCLK1, and the serial monitor access unit 13 → selector 15 → selector 21 → monitor memory 2 in the figure.
Output to the monitor memory 23 through the route of 3. During access to the monitor memory, the DBG (n: 0) outputs via the selector 21 the output bus SDO (n-1 / 2: 0) and the input bus SD.
It is bisected into I (n-1 / 2: 0). The write data, state, and address for the monitor memory 23 are SD
The selector 2 is divided into bus widths of O (n-1 / 2: 0).
It is output from SDO (n-1 / 2: 0) of 1.

In FIG. 6, the write data is SDCLK.
At the time of 12, all bits are aligned outside the chip, so S
Data is written (written) in the monitor memory 23 at the falling edge of DCLK13, that is, at the falling edge of BUSCLK.

FIG. 7 shows the operation timing of the read cycle in serial monitor access. The figure is D
The case of BG (15: 0) is shown. In the read cycle, the state and address are output in the same manner as the write. The ICE recognizes a read cycle outside the chip by transferring the read and write bits in the state. The monitor memory 23 side sets up data corresponding to the addresses output up to SDCLK6 up to SDCLK7. The serial monitor access unit 13 sends SD31 to D0 external to the chip from SDCLK8 to SDI (n-1 /
2: 0) and take in in time division. And SDCLK
When all bits (D31 to D0) are aligned inside the chip at 12,
MPU core 1 falls on SDCLK13, that is, B
D31 to D0 are read at the falling edge of USCLK2.

(3) Non-break debug (NBD) In the non-break debug (NBD), the on-chip debug resource is changed from the non-break debug section 14 to the selector 1
It is an interface that can be accessed from outside the chip in all states without breaking the MPU core 1 in the target run along the path of 5 → selector 21 → non-break debug controller 24. The NBD's on-chip resource has a memory independent of the memory map of the MPU core 1. The NBD has the following four functions.

Initial setting function: Setting of on-chip debug reset RAM monitor function: Readout of latest access data of specific address Dynamic tuning function: Data change of specific address Spare: For future MPU and application expansion (NBD access flow) ) FIG. 8 is a diagram showing a memory map of the NBD. Initial setting is performed in the initial setting area of the NBD map, RAM monitor is set in the RAM monitor area, and dynamic tuner is set in the dynamic tuning area. Accessing the NBD resource of the memory map configured as described above will be described with reference to the block diagram of FIG. 9 and the access flow of FIG. In FIG. 9, 10 is an embedded chip (see FIG. 1), 1 is an MPU core, and 14 is a non-break debug unit. 30 is NB
The D control block includes a serial / parallel converter 31, a register group 32, and a decoder 33. The register group 32 includes P0 register, P1 register and P2 register.
It consists of registers. An ICE control unit 40 includes an ICE CPU 41 inside.

In FIG. 8, the data "AAH" (H indicates hexadecimal) is written to the latch address A (31:24) at the address E00 as follows. Write "8EH", which means writing to the RAM monitor function, to the PO register.

“00H” is written in the P1 register to change the address A (31:24) in the RAM monitor memory map. In order to change the contents of the address A (31:24) in the RAM monitor memory map to "AAH" in the P2 register, "AAH" is written.

When reading, "0EH" is written in the PO register.
Is written and RA is read by reading the P2 register.
The contents of A (31:24) in the M monitor memory map can be read.

According to the present invention, the following effects can be obtained. Even in an embedded chip (single chip) that does not have an external access interface, history trace for debugging has been enabled, so debugging such as program execution and tracing of the MPU core can be performed.

By providing the non-break debug function, the debug resource in the chip can be accessed without breaking the target run operation of the MPU core. As a result, the debug function can be used in real time without affecting the MPU core.

Since the monitor serial access interface is provided, it becomes possible to control at the pace of the ICE side during the break. In addition, this function enables execution of the monitor program even in a single chip without an external bus.

Since the on-chip break memory is provided, it is possible to surely break even in a high-speed MPU or a single chip. Even if the above functions are defined on the actual chip, the IC
E Since the IDB can be disabled when not in use, it can be used as it is as the initial flow period of the target on-chip MPU. In addition, even if there is no external access interface such as a single chip, it is not necessary to separately manufacture an evaluation evaluation chip or port emulator.
Both users and chip makers will benefit from both cost and development schedule.

[0049]

As described above in detail, according to the present invention, the debug unit for executing a part of the function of the ICE is provided in the embedded chip (embedded chip) including the MPU in the target device. . This eliminates the need for a buffer or the like that is conventionally used when exchanging data between the target device and the ICE, thereby increasing the data rate that can be handled. For example, the conventional bus cycle which can handle only about 30 MHz can handle about 100 MHz.

In this case, the debug unit is provided with an external interface pin for connecting to the outside of the chip, and the external interface pin enables the MPU and the MPU by changing the pin number according to the application of the application. This is convenient because it can flexibly respond to the application of the application.

Thus, according to the present invention, high-speed MP
It is possible to provide an in-circuit emulator capable of performing sufficient debugging even when U is the target.

[Brief description of drawings]

FIG. 1 is a configuration block diagram showing an embodiment of the present invention.

FIG. 2 is a diagram showing an output timing in a trace PC mode.

FIG. 3 is a diagram showing an output timing in a trace PC mode.

FIG. 4 is a diagram showing an output timing in a trace PC mode.

FIG. 5 is a diagram showing output timing in a trace PC mode.

FIG. 6 is a diagram showing operation timing of a write cycle in serial monitor access.

FIG. 7 is a diagram showing operation timing of a read cycle in serial monitor access.

FIG. 8 is a diagram showing a memory map of an NBD.

FIG. 9 is an explanatory block diagram of an NBD access flow.

FIG. 10 is a diagram showing an NBD access flow.

[Explanation of symbols]

 1 MPU core 2 cache 2a break memory 3 external bus controller 4 bus 5 input / output device 6 RAM 7 cache ROM 8 break memory 9 break point terminal 10 embedded chip 11 external interface pin 12 trace unit 13 serial monitor access unit 14 non-break debug unit 15 Selector 21 Selector 22 Trace memory 23 Monitor memory 24 Non-break debug controller

Claims (2)

[Claims] 1. An in-circuit emulator for debugging a target device, wherein a trace function for state analysis and a real-time on-chip debug resource are provided in an embedded chip in the target device without stopping the running of the target MPU. An in-circuit emulator that is equipped with a debug unit that has a non-break debug function for all states and an off-chip monitor memory access interface function. 2. The debug unit comprises an external interface pin for connecting to the outside of the chip, and the external interface pin enables the number of pins to be changed according to the use of the MPU and its application. The in-circuit emulator described in 1.