Introduction to the Principle of MCU Simulator

An ideal MCU emulator enables developers to observe the internal operation of the MCU. The emulator is a hardware tool that replaces the MCU and visualizes the operation of the MCU.
            An ICE should include two interfaces, one is connected to the MCU socket on the target board, and the other is connected to the PC. The emulator should be electrically and physically equivalent to the target MCU and can replace the MCU in the development system. The operation of the target system can be controlled and observed by the PC. In the early stage of development, the development system relies on the emulator to work. When the target function is perfected, the emulator will be replaced by the real MCU.

            Functions and features of ICE:
            Generate corresponding program areas between the host and target systems, host memory as emulator memory or Shadow memory,
            separate from target hardware, test code in real time,
            single step (Step), full speed (Run), run from a specific state to a specific state or to a breakpoint (BreakPoint). This usually refers to a specific address, but can also be a specific trigger condition.
            Modify MCU Register value,
            modify Memory content online
            , track and record executed programs in real time (Trace)

            Difficulties and limitations in ICE design:
            The realization of ICE functions needs to be connected to the MCU's data bus, address bus, and control bus, but the three buses of the actual chip are often not connected to the external pins
            . Electrically: The driving capability and timing of ICE need to be exactly the same as those of the MCU, and the external cables and circuits of ICE will inevitably reduce the load capacity and change the timing characteristics, causing some target systems to fail to be debugged with ICE under extreme conditions.
            A common phenomenon is that a system is debugged with ICE and eventually replaced with an actual MCU to ensure operation, but if ICE is not used during the hardware development process, and ICE is used in the middle to debug software problems, problems often arise in timing and load.
            Ideally, all functions of all pins are the same as those of the MCU, but in fact, many low-end emulators occupy an interrupt resource to control the operation of the monitoring program.

            The main advantages of using ICE are:
            software design and real-time testing can be completed before the actual hardware is completed,
            providing modifications, displaying memory and register functions, and improving system development efficiency

            Bond-out 
            MCU is a chip design company that connects the internal data, address and control bus to the pins of the chip package to achieve the simulation function of its commercial MCU, so that the external simulation logic can monitor and control the internal state of the MCU. The quality of an ICE depends largely on the degree of fit between it and the MCU to be simulated. Bond-out 
            MCU can provide the maximum degree of indiscriminate replacement between ICE and commercial MCU.

            The structure of the online emulator based on bond-out MCU
            is shown in Figure 1. The system consists of three parts: bond-out MCU, SRAM for storing user programs and simulation monitoring circuit. 
            The data and address buses of the bond-out MCU are connected to the SRAM as an external program storage. At the same time, the data, address and control buses are connected to the simulation monitoring circuit, so that the ICE can monitor and control 
            the operating status of the bond-out MCU. The communication interface connected to the PC can be a serial port, parallel port or USB port according to speed and cost. The bond-out 
            MCU will essentially be an extension of the commercial MCU. It includes all the I/O on the commercial MCU and is provided to the user. Its electrical and timing should be guaranteed to be completely consistent with the corresponding pins of the commercial MCU.

            The basic functions of the online emulator are realized by
            single-step (Step) and full-speed (Run)
            simulation. The monitoring circuit transfers the control of the A/D bus to the bond-out MCU. The bond-out MCU 
            first gives the instruction address, then enables the SRAM read signal, obtains the program code, and decodes and executes it in sequence.

            See Figure 2 for breakpoints
            . The breakpoint circuit consists of an SRAM that stores the breakpoint position and a breakpoint monitoring circuit. The SRAM that stores the breakpoint position is connected in parallel to the address bus of the SRAM that stores the user program. A certain data bit of the SRAM is used as the breakpoint information storage bit. When the user program is downloaded, the address where the breakpoint is set is set to 1, and the rest are 0. When the emulator is running at full speed, the SRAM is set to a read state, and the breakpoint judgment circuit monitors this data bit. When it is high, the emulator stops running at full speed.

            See Figure 3 for tracing and recording the executed program (Trace)
            . The Trace circuit consists of an SRAM that stores the Trace content and a Trace monitoring circuit. The data bus of the Trace SRAM 
            is connected in parallel to the bond-out MCU address bus, and the address control signal of the Trace SRAM is generated by the Trace monitoring circuit. When the emulator is initialized, 
            the address of the Trace SRAM is set to 0. When the user requests to start recording the executed program, the address of the Trace SRAM is incremented by one in each instruction cycle and the bond-out 
            MCU address is written into the SRAM. When the PC wants to read the Trace content, 
            the program addresses executed by the bond-out MCU in sequence are uploaded to the PC and the instruction code at the address is listed accordingly. 
            The record length of the Trace is limited by the size of the SRAM. When the record length is exceeded, the previous data will be overwritten.

            Read and modify Register/Memory
            to make the bond-out 
            MCU output the value of Register/Memory from the data bus. For example, to read the value at address 20H, the simulation monitoring circuit obtains bus control, first executes an instruction to send the value at address 20H to A, and then writes A to the data bus. The simulation monitoring circuit can read the value at address 20H. The method of modifying Register/Memory, for example, to change the value at address 20H, the simulation monitoring circuit sends the value, controls the bond-out 
            MCU to execute the instruction to read the data bus to A, and then executes the instruction to send A to address 20H.

            I hope this will be helpful to everyone using the emulator, and I welcome your discussions and corrections.