25 April 2000 SEESCOASEESCOA STWW - Programma Evaluation of on-chip debugging techniques Deliverable D5.1 Michiel Ronsse

SEESCOASEESCOA Contents  Problem description  Debugging embedded systems  On-chip debugging techniques  Logic analyser  ROM monitor  ROM emulator  In-Circuit Emulator  Background Debug Mode  JTAG  Conclusions

SEESCOASEESCOA Problem description  embedded systems have become increasingly sophisticated  debugging becomes a major problem  types of bugs  computational errors  synchronisation errors  performance errors  testing and debugging is responsible for a huge part of the development time   definitive need for appropriate debugging tools

SEESCOASEESCOA Debugging embedded systems  two test/debug phases  during the development  during the actual use  an embedded system  typically runs continuously  interactive debugging?  can have hard and soft real-time constraints  Heisenbugs  parallel and/or distributed systems: abscence of a global clock  uses lots of input  repeatability?  cyclic debugging?  hardware related problems: code in ROM, limited amount of RAM  Solution: hardware add-ons for on-chip debugging techniques

SEESCOASEESCOA On-chip debugging techniques  Logic Analyser  ROM monitor  ROM emulator  In-Circuit Emulator  Background Debug Mode  JTAG

SEESCOASEESCOA Logic Analyser  a recorder for digital signals (event triggered)  can capture real-time traces  suitable for fast logic circuits  different from other tools:  no target control  no code download  no access to memory  used in addition with other tools

SEESCOASEESCOA ROM monitor  resident piece of code on the target system  provides debugging features  access to memory and registers  downloading of code  breakpoints and single stepping  advantage: cheap  disadvantage: uses resources  CPU cycles  memory (ROM+RAM)  communication channel  UART must be running  Keep ROM monitor in end product?

SEESCOASEESCOA ROM emulator  plug-in replacement for ROM chips  connected to a host computer using a serial, parallel or Ethernet link  simplest form: download code to the ROM  most sophisticated form: download a ROM monitor  advantages  no communication channel required  easy to retarget to new systems (no processor dependencies)

SEESCOASEESCOA ROM emulator: example

SEESCOASEESCOA Disadvantage of ROM monitor/emulator  target software must work with the ROM monitor/emulator  target needs a working memory system  no emulation of target RAM  how to debug a monitor?  limited to systems with external ROM  not for single- chip microcontrollers

SEESCOASEESCOA In-Circuit Emulator  uses a bond out version of the processor, or is plugged in the processor socket  full access to the programmer’s model of the processor  hardware breakpoints  execution trace  memory emulation (RAM)

SEESCOASEESCOA In-Circuit Emulator (II)  advantage:  uses no target I/O resources  possible to debug code before the target exists  ideal for debugging ISRs  ‘place’ breakpoints in ROM  real-time tracing (size of buffer?)  disadvantages:  electrical equivalence can be a problem  ICEs lag processor availability and are expensive  difficult for deeply-embedded CPUs

SEESCOASEESCOA ICE: an example

SEESCOASEESCOA Background Debug Mode  we keep the normal processor, ROM, connectors, but we add debugging facilities in the processor and use special pins to communicate with it  also known as OCD or OnCE  port used: BDM, JTAG, OnCE  processor switches to Background Debug Mode if  signal at BKPT-pin  processor executes a BGND-instruction  a fault occurs

SEESCOASEESCOA Background Debug Mode  first type: debug monitors written in microcode  later: real-time reading of instruction counter  some allow a complete trace of the processor’s execution uses additional pins  the AMD ÉlanSC520 uses AMDebug: an on-chip instruction cache (no CPU cycles or bandwidth is used)  the PowerPC has an instruction stuff buffer  only a minimal amount of external hardware is required

SEESCOASEESCOA JTAG  Joint Test Action Group  not a debugging technique, but a standard way for connecting test circuits in hardware components  uses boundary scan to control and observe the boundary pins of a device

SEESCOASEESCOA JTAG

SEESCOASEESCOA

SEESCOASEESCOA

SEESCOASEESCOA Conclusions ualmost all contemporary embedded processors have add-ons for debugging uas embedded processors get faster, these add-ons get closer to (or in) the processor uthese add-ons take up valuable chip area (up to 10%) uthese add-ons are also available in the consumer produsts, making on-site testing possible u  hardware manufacturers believe in design for debugability