Why do you need an emulator with gas equipment. How it works? Which emulator is suitable

16 responses

Emulation is a multifaceted field. Here are the main ideas and functional components. I'm going to break it down into parts and then fill in the details with changes. Many of the things I'm about to describe will require knowledge of the inner workings of processors - assembly knowledge is required. If I'm a bit vague on some things, please ask questions so I can continue to improve this answer.

Main idea:

Emulation works by controlling the behavior of the processor and individual components. You build each individual part of the system and then connect the parts just like wires in hardware.

CPU emulation:

There are three ways to handle CPU emulation:

• Interpretation
• Dynamic recompilation
• Static recompilation

With all of these paths, you have a common goal: execute a piece of code to change the state of the processor and interact with the "hardware". Processor state is a conglomeration of processor registers, interrupt handlers, and so on. For the given target processor. For 6502, you will have a number of 8-bit integers representing the registers: A , X , Y , P and S ; you will also have a 16-bit PC register.

With interpretation, you start with IP (instruction pointer - also called PC , program counter) and read the instruction from memory. Your code parses this instruction and uses this information to change the processor state specified by your processor. The main problem with interpretation is that it is very slow; each time you process a given instruction, you must decode it and perform the required operation.

With dynamic recompilation, you iterate over the code just like you would interpret, but instead of easy execution opcodes you create a list of opcodes. Once you reach the branch instruction, you compile this list of native code operations for your host platform, then you cache that compiled code and execute it. Then when you get back in this group commands, you only need to execute the code from the cache. (By the way, most people don't actually list the instructions, but compile them to machine code on the fly - this makes optimization difficult, but it's out of the scope of this answer unless people are interested)

With static recompilation, you do the same as with dynamic recompilation, but follow the branches. You end up with a piece of code that represents all of the code in the program, which can then be executed without any additional noise. This would be a great mechanism if not for the following problems:

• Code that is not in the program to begin with (e.g. compressed, encrypted, generated/modified at runtime, etc.) will not be recompiled, so it will not run
• It has been proven that searching for all code in a given binary equivalent is equivalent to the halting problem

They combine to make static recompilation completely unfeasible 99% of the time. For more information, Michael Steil did a great deal of research on static recompilation - the best I've seen.

The other side of CPU emulation is the way it interacts with the hardware. It really has two sides:

• Processor time
• Interrupt handling

Processor time:

Some platforms - especially old consoles like NES, SNES etc. - require your emulator to have a strict time for full compatibility. With the NES, you have a PPU (Pixel Processing Unit) processor that requires the processor to place pixels neatly into its memory. If you use interpretation you can easily count the cycles and emulate the correct time; with dynamic/static recompilation, the whole thing is/much/more complicated.

Interrupt handling:

Interrupts are the main mechanism by which the processor communicates with the hardware. Typically, your hardware components tell the CPU what is interrupting it. It's pretty simple - when your code throws the given interrupt, you look up the interrupt handler table and call the correct callback.

Hardware emulation:

There are two sides to emulating a given hardware device:

• Emulation of device functionality
• Emulation of real device interfaces

Let's take a case hard drive. Emulation of functionality is provided by the creation of backup storages, read/write/format procedures, etc. This part is usually very simple.

The actual interface of the device is a little more complicated. This is typically some combination of memory-mapped registers (such as parts of memory that the device watches for changes in signaling) and interrupts. For a hard disk, you might have a memory mapped area where you place read, write, etc commands, then read that data.

I'd go into more detail, but there are a million ways you can go with it. If you have any specific questions feel free to ask and I'll add the information.

Resources:

I think there was a very good input here, but there are additional tons. I am more than happy to help with any questions; I've been very vague most of the time just because of the sheer complexity.

Required Wikipedia links:

General emulation resources:

• Zophar is where I started with emulation, downloading the emulators first and eventually plundering their huge documentation archives. This is the best resource you can have.
• NGEmu - Not many direct resources, but their forums are unbeatable.
• RomHacking.net - Documents section contains resources regarding machine architecture for popular consoles.

Emulator projects for reference:

• is a .NET emulation framework written in Nemerle and recompiles C# code on the fly. Disclaimer: This is my project, so I apologize for the shameless version.
• BSnes - An amazing SNES emulator with the goal of loop accuracy.
• MAME- arcade emulator. Excellent recommendation.
• 6502asm.com - This is a JavaScript 6502 emulator with a cool little forum.
• dynarec"d 6502asm - This is a little hack I did in a day or two. I took an existing emulator from 6502asm.com and modified it to dynamically recompile JavaScript code for speed.

Links to recompile the processor:

• Static recompilation research done by Michael Stehl (linked to above) ended up in this article, and you can find the source for such .

Addendum:

It's been over a year since this answer was posted, and with all the attention it's been receiving, I've decided it's time to update some things.

Perhaps the most exciting thing about emulation right now is libcpu , started by the aforementioned Michael Steele. This is a library designed to support a large number processor cores that use LLVM for recompilation (static and dynamic!). It has got huge potential and I think it will do great things for emulation.

A guy named Victor Moya del Barrio wrote a dissertation on this topic. Lots of good information on 152 pages. You can download PDF.

If you don't want to register with scribd , you can google for the PDF header, "Learning emulation programming techniques". There are several different sources for PDF.

Emulation may sound complicated, but it's actually much easier than simulation.

Any processor usually has a well-written specification that describes states, interactions, and so on.

If you didn't care about performance at all, you can easily emulate most older processors using very elegant object-oriented programs. For example, an X86 processor would need something to maintain the state of the registers (easy), something to maintain the state of the memory (easy), and something that would take every incoming instruction and apply it to the current state of the machine. If you really need precision, you also emulate memory translations, caching, etc., but it's doable.

In fact, many microchip and processor manufacturers test programs against the chip's emulator and then against the chip itself, which helps them find out if there are problems in the chip's specifications or in the actual implementation of the chip in the hardware. For example, one could write a specification for a chip that would lead to deadlocks, and when a deadline occurs in the hardware, it's important to see if it can be replicated in the specification, as it indicates a bigger problem than anything in the implementation of the chip.

Of course, video game emulators usually care about performance, so they don't use naive implementations, and also include code that interacts with the host system's OS, for example for drawing and sound.

Given the very slow performance of older video games (NES/SNES, etc.), emulation on modern systems is fairly easy. In fact, it's even more amazing that you could just download a set of every SNES game ever or any Atari 2600 game, considering that when these systems were popular, having free access to every cartridge would have been a dream.

I know this question is a bit old but I would like to add something to the discussion. Most of the answers here are centered around emulators interpreting the machine instructions of the systems they emulate.

However, there is a very famous exception called "UltraHLE"(). UltraHLE, one of the most famous emulators ever made, emulated commercial Nintendo 64 games (with decent performance on home computers) at a time when it was considered impossible. In fact, Nintendo was still releasing new titles for the Nintendo 64 when UltraHLE was created!

For the first time I saw articles about emulators in printed magazines, where before, I only saw them on the Internet.

The concept behind UltraHLE was to make the impossible possible by emulating C library calls instead of machine level calls.

Having created your own 80s BBC microcomputer emulator (type VBeeb on Google), you need to know a few things.

• You are not emulating the real thing as such, it will be a replica. Instead you emulate State. good example is a calculator, the real thing has buttons, a screen, a case, etc. But to emulate a calculator, you only need to imitate the up or down buttons, which LCD segments are on, etc. Basically, a set of numbers representing all possible combinations of things that can change in a calculator.
• You only need the emulator interface to appear and behave like the real thing. The more convincing it is, the closer the emulation. What happens behind the scenes could be anything. But for ease of writing an emulator, there is a mental mapping that happens between the real system, i.e. chips, displays, keyboards, circuit boards, and abstract computer code.
• To emulate a computer system, it's easiest to break it down into smaller chunks and emulate those chunks individually. Then combine the entire batch for the finished product. Much like a set of black boxes with input and output that lends itself perfectly to object-oriented programming. You can subdivide these chunks to make life easier.

Practically speaking, you usually want to write for the speed and fidelity of the emulation. This is because the software on the target system will (may) be slower than the original hardware on the source system. This may limit the choice of programming language, compilers, target system, etc.
Also, you should limit what you are willing to emulate, such as not needing to emulate the voltage state of the transistors in the microprocessor, but probably needing to emulate the state of the microprocessor's register set.
Generally speaking, the lower the emulation granularity, the more fidelity you will get in the original system.
Finally, information for older systems may be incomplete or non-existent. So getting the original hardware is essential, or at least highlighting another good emulator that someone else has written!

Yes, you have to interpret all machine code binary "manually". Not only do most of the time you also have to simulate some exotic hardware that has no equivalent on the target machine.

A simple approach is to interpret the instructions one by one. This works well, but it's slow. A faster approach is recompilation - translating the source machine code into the target machine code. This is trickier, as most instructions won't map to each other. Instead, you will have to develop complex tasks related to additional code. But in the end it's much faster. Most modern emulators do this.

When you develop an emulator, you are interpreting the processor assembly that the system is working on (Z80, 8080, PS CPU, etc.).

You also need to emulate all the peripherals that the system has (video output, controller).

You should start writing emulators for simpe systems like the good old Game Boy (which uses the Z80 processor, I'm not mistaken) OR the C64.

An emulator is very difficult to create as there are many hacks (like in fancy effects), timing issues, etc that you have to simulate.

This will also show you why you need a multi GHz processor to emulate 1 MHz.

I've never done anything to emulate a game console, but I took the course when the assignment was to write an emulator for the machine described by Andrew Tanenbaums. It was fun and gave me a lot of aha. You might want to choose this book before diving into a real emulator.

Exhaust gases emitted by a vehicle contain dangerous substance NOx. The purpose of SCR is to minimize the amount of negative emissions using AdBlue urea. React allows you to do poisonous substance to water and nitrogen.
EGR - used similarly to SCR to reduce nitrogen oxide emissions. The device redirects exhaust gases to the intake manifold.
AdBlue is used by SCR to minimize NOx emissions in the exhaust gases.
AdBlue is a liquid, odorless and non-toxic element.
Urea in North America is called DEF, and European states called AdBlue.

The diaphragm pump performs the suction function of the AdBlue. The device compresses the reagent, increasing the pressure to 9 bar, which is necessary to spray DEF. A special electric motor allows you to save pressure. The dispenser determines the DEF dosage and dispenses it.

Malfunctions often occur in the SCR, which became an additional argument in favor of disabling AdBlue urea.
Reagent injection and instrument panel operation are controlled by a special DCU or a software module in the engine control unit. These devices accurately determine the amount of urea supplied and provide a signal to the dosing module. The complex provides a closed control cycle.

Freezing Adblue occurs at temperatures of -11 degrees Celsius. Deactivation of the propulsion system may cause crystallization of the reagent.

To protect the SCR, in case of low temperature operation, the AdBlue warm-up must be carried out before starting the engine unit. The process of supplying urea is possible after complete thawing of the reagent.
In case of work trucks in cold RF conditions, deactivating urea with a data simulator would be the right solution.

How Adblue emulator works

• IN vehicle, working on the basis of EURO-5, the AdBlue emulator is mounted via the CAN module. Errors in the AdBlue control system are not allowed!
• All data of the AdBlue system devices are copied to the emulator's memory block.
• Activation of the AdBlue emulator starts the process of sending a signal, via the CAN module, to the machine system of the copied saved data about the health of the AdBlue device.
• When the vehicle is moving, the AdBlue simulator communicates with certain vehicle units and sends modified data with simulated urea consumption data.

Now the market is filled with all kinds of urea emulators from a wide range of manufacturers from China. Our company prefers trusted suppliers of high quality equipment. Therefore, we successfully help motorists with EURO-5 class cars and help to minimize material investments associated with the implementation of repair measures for a regular urea device.

The injector emulator is required for with an injector. Installing and connecting the HBO injector emulator of the 2nd generation has several prerequisites that must be met for the productive operation of the entire system.

Injector emulator - what is it?

The 2nd generation gas equipment emulator is a special device that simulates the operation of injectors petrol type, which allows the mechanisms to function normally. When the injectors of an emulative (emitting) nature are turned on, gas supply begins. The mechanism is a very important device that retains the ability full-fledged work no errors or damage.

Important! In the absence of an electronic device, the mechanism will fail or refuse to work.

To install the 2nd generation HBO injector emulator and connect it, certain skills are required, since this process will also require configuration. It is better to entrust this process to professional mechanics, as otherwise minor problems may occur, which will manifest themselves in too slow or accelerated operation of the mechanisms.

Important! The gasoline pump does not turn off when switching to gas, since gasoline cools and washes its part of the system, including gasoline-type nozzles. There must also be fuel in the gas tank.

In addition, it must be borne in mind that the engines are heated by gasoline, and not by gas. Otherwise, the system will shut down or may be damaged.

The injector has a number of necessary sensors. For the emulator, the lambda probe for the 2nd generation LPG is a very complex mechanism that mainly regulates the EBO when running on gasoline for fuel supply. When switching to gas, the data transmission circuit is broken, and the secondary emulative lambda probe creates a transmission immediately to the controller. If you use the primary sensor, the machine will immediately go into an emergency state, as the ECU will show that the sensor is faulty.

Electronics injection machine very sensitive, so it is better to do the installation and configuration yourself, only with some experience.

In general, the emulator has several features that are very important. These functions regulate the operation of the entire transition and further process:

• shutdown of petrol type injectors;
• switching to work on gas with imitation of a gasoline injector mechanism;
• ECU deception regular type in the form of imitation of the working process of gasoline injectors;
• exclusion of the transition to emergency mode;
• adjustment of a number of processes, including those with sensors.

It is also worth considering that an injector with a properly configured electronic mechanism has advantages when automatic mode, that is, the transition from gasoline to gas will occur almost instantly after turning the ignition. But this requires an engine temperature of about forty degrees.

Our site contains articles about various gas nozzles:

Installation and setup

Installation and configuration of the device are carried out at the same time, otherwise problems may arise. Any incorrect connection can lead to the following consequences:

• incorrect operation during ignition, including the lack of gas supply;
• unstable work process Idling with gas;
• freezing of the gearbox;
• there are failures in work or after idling.

For this reason, proper arrangement is extremely important. The priority is the re-equipment of the car when embedding the device by specialists who will immediately set up all the elements and characteristics.

For self installation the wiring diagram for the 2nd generation HBO injector emulator is quite complicated, but with experience, you can do everything right. In addition, it is worth remembering a few simple rules:

• the standard resistance of the electronic mechanism should be about 100 ohms;
• the installation of the device must take into account the presence or absence of self-regulation;
• each injector has its own mechanism, for example, for "Europeans" a device marked EI is suitable, and for the Japanese - JI. This will allow you to select a device with the appropriate connectors and characteristics;
• it is worth considering the number of cylinders, since in accordance with this there is an individual selection of the emulator;
• the desired transition delay limit varies from zero to 5 seconds. The range is set according to the motor configuration individually, immediately after installation.

With full arrangement, the smoothness of the transition and the course itself are immediately worked out. This avoids most further operational problems. If there is no self-diagnosis (the Check Engine lamp does not light up when the gasoline-type injectors are turned off), then the transition can be made using a conventional relay. Otherwise, installation is more difficult. If the relay is connected, then it is better to use a five-pin one with a positive wire sent to a gasoline-type injector. The best choice voltage will be 12 volts.

In a more complex version, the emulator is connected through the HBO switch. In this case, it will be necessary to adjust the delay in accordance with the experimental work, that is, the required level of delay is indicated empirically. This is due to the different individual characteristics of each engine. If there are sensors, you will need to install an emulative type lambda probe. It is also called oxygen. When it is installed, a signal about the fuel rate will be sent to the ECU, which will allow the car not to go into emergency mode.

Read how to properly clean and replace gas injectors.

Finally

An emulative device is a simulator of the operation of a gasoline-type element with an electronic character. Best to install this device when converting the injector to HBO 2nd generation, since the following modifications already contain this element.

Each ECU has its own individual mechanism, which must be selected according to its characteristics. The process of embedding into the system should be carried out by professionals. This allows you to eliminate the shortcomings that arose at the first stage.

Recently, the trend is to install gas equipment the second generation of the injection car has significantly declined. But, a fairly large proportion of motorists are still interested in how to install and what design features must be brought into the vehicle. Today we will talk about the system node, without which it is impossible to install 2nd generation HBO on an injection car - this is an injector emulator.

Why you need an injector emulator

Job injection car impossible without electronics. The computer of the modern "iron horse" controls the operation of gasoline injectors, correctly metering the fuel injection, and also monitors all kinds of system malfunctions. By installing the 2nd generation HBO on an injection internal combustion engine, we actually go back a step and get a carburetor system. For stable operation HBO 2nd generation injection internal combustion engine we need to turn off the petrol injectors. At the same time, the electronic brain of the car will definitely diagnose that the injectors are disabled and will display a “check engine” error message. So that this message does not appear, and the ECU “thinks” that the entire system is operating normally and an HBO injector emulator is needed.

It should be noted that using this device, you can set the necessary time delay when the engine switches from gas to gasoline and vice versa. Typically, the delay time is set individually for each ICE and driver, and is in the range from 0 to 5 seconds. This is done for a smooth change of fuel so that the driver does not notice the moment of transition, as well as to prevent the engine from stalling.

Thus, the 2nd generation HBO injector emulator performs three main functions:

1. When the engine switches to gas, it turns off the petrol injectors;
2. After turning off the petrol injectors, it emulates their work by giving the car's ECU a signal regular work nozzles.
3. The ECU, seeing that there are no malfunctions, does not display the “check engine” error on the dashboard.

Note! On HBO 4th generation, the injector emulator is not purchased separately, since this unit is already built into the gas electronic control unit.

Injector emulator marking

To choose the right injector imitation device for your car, you need to know the number of cylinders in your internal combustion engine, as well as understand the labeling of these products.

The basic marking scheme is as follows:
Manufacturer, HBO type, emulator type, number of cylinders. For example, the marking "STAG2 E4" means that this is a STAG product, suitable for 2nd generation HBO, has electronic control and is designed for 4-cylinder internal combustion engines.

Similarly, “Stag2E-6” is a STAG manufacturer, suitable for 2nd generation HBO, has electronic control and is designed for 6-cylinder internal combustion engines.

also in without fail you need to understand what connector should be on the device.

In order not to make a mistake in your choice, it is best to consult with a specialist in the store where you will purchase the injector emulator for HBO. When consulting, be sure to indicate the make and country of the car manufacturer, this will help the specialist to select the device you need.

Injector emulator connection

First of all, it is worth noting that it is best to entrust the connection of the 2nd generation HBO injector emulator to an experienced installer, so that when you connect it yourself, you do not damage the car's electronics.

When connecting the device yourself, be sure to check the following points:

• Most petrol injectors have a resistance of 100 ohms. Make sure the device you want to install supports this resistance. Usually the resistance is indicated in technical specifications products.
• Make sure the connector on the emulator is the same as on your car.
• Make sure that the device supports the number of internal combustion engine cylinders you need.
• Carefully study the connection diagram, it should be included with the device.

The general scheme for connecting the injector emulator is as follows:

11. IN-CHIP EMULATORS

11.1. OPERATING PRINCIPLE OF IN-CIRCUIT EMULATORS

The main method of integrating hardware and software (AS and PS) and complex debugging of MPS is the method of in-circuit emulation. This method consists in the fact that for debugging the MPS, a single debugging system is created, including the prototype of the MPS, an object or object simulator and an in-circuit emulator, which functions as a whole under the control of the emulator. In-circuit emulator, or just an emulator built into common system MPS debugging, allows you to debug the MPS or troubleshoot as if the emulator is part of the device being debugged.

So, in-circuit emulator (ICE) called a debugging tool that connects to the system being debugged or tested through a microprocessor connector and provides system control by replacing (emulating) individual functional units of the MPU prototype, primarily the MP, with the corresponding nodes of the emulator. The in-circuit emulator is the most powerful and versatile debugging tool.

As a matter of fact, a “good” in-circuit emulator makes the process of functioning of the debugged controller transparent, i.e. easily controlled, arbitrarily controlled and modified at the will of the developer.

Structurally, emulators can be either built into a PC (ie, inserted into a computer slot) or remote (in a separate case, connected to a PC via a parallel LPT port or a serial RS-232 port).

The emulator contains a target MP, RAM, input-output devices (I/O), an emulator control unit, a control bus and an emulator system bus and is connected to the MPS prototype using a connector (plug) having the same marking and specification as the target MP. The specified connector is inserted into the sockets of the terminal block (socket) of the MPS prototype, designed for installing the MP. Usually, the docking of the in-circuit emulator with the system being debugged is done using an emulation cable with a special emulation module. The emulation module is inserted instead of the microcontroller into the system being debugged.

The emulator usually supports one family of microprocessors (on-

example INTEL 8031/8051/8052, INTEL 8080/8085 or ATMEL AVR), and the specific microprocessor in the family is determined by a plug-in emulation module. Thus, you can increase the fleet of emulated processors by purchasing additional emulation modules.

If the microcontroller cannot be removed from the system being debugged, then the use of the emulator is possible only if this microcontroller has a debug mode, in which all its outputs are in the third state. In this case, a special clip adapter is used to connect the emulator, which is connected directly to the outputs of the emulated microcontroller.

The MPS system bus associated with the emulator provides control of all hardware of the MPS prototype and does not require any additional control buses. After docking the connectors of the emulator and the prototype, their system buses are connected, and the MPS prototype can function as if a real MP was installed in the prototype.

However, there is very essential difference emulator from a real MP: when a prototype of a real MP is installed in a construct without an emulator, it is not possible to control the internal state and control the behavior of the prototype, for

switching on the input and output devices connected to the MPS. On the other hand, with the help of the emulator, full control of the state of the MP is provided, flexible control of the MPS prototype in various modes necessary for debugging, as well as analysis of errors in the operation of the MPS.

The emulator in the process of debugging the MPS allows you to emulate (replace) not only the target MP, but also some functional nodes and blocks of the MPS prototype with nodes and blocks of the emulator. For example, the memory of the emulator can be used as the RAM or PROM of the MPS prototype. Similarly, the clock generator (synchronization block) of the emulator can be used instead of the corresponding prototype block. Sequential substitution of parts of the MPS prototype AS, as well as the wide functionality of the emulator for analyzing the state of the MPS and AS MPS, allow for a phased debugging of the device: from debugging using the maximum possible number of emulator nodes, they gradually switch to debugging using full membership real AS of the MPS prototype, with the exception of the MP. At the same time, for

In order to fully identify logical errors in the PS, it is necessary, if possible, to execute and check the largest part of the PS only as part of the emulator without connecting the MPS prototype. After identifying errors at this stage, you should proceed to other stages of debugging the MPS.

Emulators may contain elements of a logic analyzer - a tracer and breakpoint processor(Breakpoint Processor - BP). The tracer remembers the path passed by the processor, and unnecessary information can be ignored (for example, remember only accesses to program memory in some area of ​​the address space). VR allows you to set breakpoints by analyzing the state of the processor (for example, stop after a cycle of N calls to cell A, provided that cell B was written to at the time of the interrupt value X). It should be emphasized that both the tracer and the VR processor work in real time.

A very important characteristic of the emulator is the reliability of the real-time break. This means that when exiting real time (for example, when a breakpoint is encountered), the emulator should not lose interrupt flags and interrupts themselves, and also should not falsely enter interrupts, should correctly stop timers and counters and save the serial channel buffer. All this is necessary for the correct subsequent entry into the real-time mode. Otherwise, the ability to debug a system that uses interrupts is lost.

11.2. THE FIRST IN-CHIP EMULATORS

Even in the early days of embedded microcontroller development, in-circuit emulators were the most advanced tool. In 1975, Intel created its first true in-circuit emulator, the MDS-800, designed for the 8080 microprocessors. True, these were quite expensive (in 1975, the MDS-800 cost $20,000) and bulky systems (the MDS-800 had a screen, keyboard and two 20 cm floppy disk drives).

At that time, such emulators were not always reliable and in many situations still interfered with the operation of the simulated device. Thus, they worked "in not quite real time" (albeit in much more real time than other methods). Their buffers were small due to, ridiculously, the high cost of RAM. Also, they couldn't emulate faster processors. At that time, the processor that could be used in an embedded system was identical to the processor used in an emulator.

Emulators differ from monitors in two ways. First, when the emulator stops at a checkpoint, the whole system stops, and the developer sees the real current state of the microprocessor device in front of him. In the case of a monitor working system and the monitor program continue to run, while the monitor actually does not provide information about the internal state of the microprocessor. Breakpoints in the emulator can be placed anywhere in the program, while monitors and simulators have certain limitations. In particular, in programs for the 8051 family, as a rule, breakpoints can only be set in place of the three-byte opcode.

Where emulators were similar to monitors was in their focus on assembly language. This was the case in the 70s of the last century, when no high-level language could compare with the current prevalence of C in the embedded computer industry. Also, the code produced by the first high-level language compilers was not compact enough to fit in embedded systems.

Due to the high cost and relative unreliability of some early emulators, many users abandoned them in favor of ROM monitors. This may seem like a step backwards, but developers prefer to move forward with their task rather than wasting time fighting unreliable hardware. Simulators were not available, and monitors were the only way out in this situation.

In addition, sometimes logic analyzers were used instead of emulators, since they had much the best means synchronization of access to information. At the very least, they allowed you to see what was happening on the bus without disrupting its operation.

Also, one of the shortcomings of the first emulators was the low speed of serial communication lines. Although 9600 baud is quite fast, it could take a considerable amount of time to load a program. In addition, it took time to generate the symbol table.

11.3. CLASSIFICATION OF IN-CIRCUIT EMULATORS AND THEIR FUNCTIONAL CAPABILITIES

11.3.1. Classification of in-circuit emulators

Functionally, in-circuit emulators are divided into those connected to an external computer (usually an IBM PC) and functioning autonomously.

Autonomous in-circuit emulators have individual computing resources, input-output facilities, do not require normal operation docking with any external computing facilities, but the user has to pay for this either at a significantly higher price, or with reduced functionality and service capabilities compared to similar models docked with the IBM PC.

11.3.2. Functionality of the WSE

The set of functionality provided to the developer by in-circuit emulators is very wide and includes almost all the variety of functional modules of development tools.

The presence of a built-in editor, a built-in project manager and a control system in the emulator software shell can also greatly facilitate the work of the developer. Then the line between writing a program, editing it and debugging is erased. Moving from Editing Source to Debugging - Getting Started

The work of the emulator itself and vice versa occurs "transparently" and synchronously with the activation of the corresponding windows, the project manager automatically starts compilation as needed and activates the corresponding windows of the program interface.

When operating an in-circuit emulator as part of an integrated environment, it is just as easy to make the transition to debugging a project using the existing debugger-simulator or start entering a debugged program into the ROM of the microcontroller.

Some models of in-circuit emulators may provide users with other additional features. Among them, we note one, although quite specific, but in some cases of fundamental importance: the possibility of building multi-emulator complexes necessary for debugging multiprocessor systems. A distinctive feature of such a complex is the possibility of synchronous control (from one computer) of several emulators.

11.3.3. Advantages and disadvantages of in-circuit emulators

The advantages of in-circuit emulators include

a wide range of functionality that makes in-circuit emulators the most powerful and versatile debugging tool;

operation of the in-circuit emulator in real scheme electronic block, which assumes a robot microcontroller or DSP;

Greater flexibility in temporal and electrical characteristics microcontroller, which is associated with a predominantly software method of their simulation

However, in-circuit emulators also have disadvantages.

The main one is the difficulty of software simulation of electrical signals at the microcontroller pins in real time. For adequate simulation, the speed of the simulation processor or computer must be significantly higher than the emulated microcontroller, which is far from always achievable, especially in the case of emulation of modern high-performance digital signal processors and microcontrollers.

Moreover, even in the case of running in slow motion, various models In-circuit emulators may have various restrictions on the control and management of the functioning of debugged devices, which is associated with the difficulty of their modeling. For example, it may be incorrect interrupt processing in step mode, or a ban on the use of a serial port, etc.

11.4. MODERN IN-CIRCUIT EMULATORS

The modern emulator, like all electronic equipment, has become smaller in size, faster in operations, has acquired many functions and has become much cheaper. He owes all this to the "loss" of the built-in screen, keyboard and floppy disks, thanks to which it was possible to increase its reliability and reduce the cost of production. At the same time, the speed of the emulator's computations has increased, which provides a real-time emulation of operations that does not affect the main mode of operation at a speed that could only be dreamed of a few years ago. The latter is explained by the fact that, in general, the performance of embedded target systems, compared to emulators, has not increased so much. They still use 8 MHz micro

processor of the 8051 family, while in the host system, instead of the 16 MHz 80286 processor, there is already a Pentium4 with an operating frequency of 2000 MHz.

Finally, in-circuit emulators are freed from assembler and can work with high-level languages ​​(at least with C).

With support for advanced object management tools in the OMF (Object Module Format) format, modern emulators can display text in a high-level language with full description types and characters. Some low cost emulators still lack support for advanced OMF features. In addition to the already mentioned display and user interface, microswitches are missing in modern VSEs (no longer needed). Configuration and parameter setting is now done in software (stored in flash memory or ROM). These settings include target system clock speed, processor type (and family), and peripheral device configuration.

Due to cheaper memory, many emulators are equipped with significant trace buffers, and this fact is presented as one of the advantages of the emulator. Some vendors have, however, analyzed what is actually required to improve efficiency and have come to the conclusion that it is better to spend less time tracing 1K bytes than digging through 8K bytes for a long time looking for a problem. All this requires a good set of triggers and storage necessary information in the buffer. The required information includes:

addresses of executed instructions (as well as unloaded and ignored

code labels and variable names, external signals, ports, etc.

bus status, read/write command results, interrupt acknowledges, and

A good emulator should also present data in several ways. For example, in the form of disassembled code, high-level language statements, machine loops, and, as most programs do, in the form of binary and hexadecimal code. It is also desirable to be able to generate events and organize the buffer as circular and linear.

It should also be possible to combine these modes to, for example, trace based on absolute loops, displaying the situation before (or after) the event in the form of high-level language statements.

Some emulators do nothing but register breakpoints in the program in the tracebuffer, and then dynamically recreate the original text from the content when it is parsed. Together with mechanisms for determining start and stop times and detecting library accesses, this can provide a very powerful tracing system that does not require a large trace buffer. In addition, it should be possible to access the contents of the trace buffer during program execution using the emulator (and not later using a text editor).

Some emulators need large trace buffers because they write all assembler code into it, not just C statements, and cannot ignore calls to library functions. In addition, as mentioned earlier, they can insert at the beginning of each C statement the instruction

In many cases, creating an in-circuit emulator requires specialized chips that only the chip manufacturer has. To solve this problem, the semiconductor industry offers such a tool as FPGA matrices. They are often used as part of inexpensive emulators, in order to

in order to give the future user the impression of almost the same capabilities as more expensive EVs. The impression lasts until you start using this VSE and find that it is not comparable to a real emulator in terms of efficiency, especially where you just need its capabilities as a "hard" real-time system.

This new low-cost technology has spawned a plethora of so-called "universal" emulators that can handle multiple families of microprocessor devices. However, if it were that simple, the use of FPGAs to produce multi-architecture emulators would attract many of the leading VSE manufacturers. And the cost would be great, but in practice it did not happen!

One of the "transient" problems in the history of in-circuit emulators was the problem of serial connections. In those days when the transmission speed over parallel communication lines was 1200, 2400, 4800 and (with some diligence) 9600 baud, the connection of a personal computer and the WSE by parallel communication lines was considered a panacea. Some manufacturers even built the emulator directly into the personal computer! Modern serial lines work fine at 115200 baud. Even very large programs are loaded in seconds. Parallel buses have disappeared from the scene, replaced by Ethernet lines in many systems.

11.5. NEW POSSIBILITIES OF IN-CIRCUIT EMULATORS

In addition to high-level language support and improved triggers and tracing, modern emulators have many other benefits. Among them, code usage analysis and execution time calculation. Some simulators also have similar characteristics, but not on real hardware and not in real time, which makes the calculation of execution time a purely academic interest.

11.5.1. Code Usage Analysis

Analysis of code usage is one of the most important components of the program testing and validation process, especially in systems with increased security requirements. Simply put, this test must document that, when performing a specific test program All instructions are executed, and without failures. After passing this test, the end user is given an almost absolute guarantee that there are no hidden errors in the system.

Data usage analysis determines which areas of data were accessed during testing, allowing you to identify potentially dangerous reads (READs) performed before the data was initialized by a write (WRITE) operation. For an embedded program to be validated, it must run on the target hardware in real time. This is possible only with the use of the ESS. Code usage analysis can also be performed on the simulator, but not in a real hardware environment, and a ROM monitor (unless supplied with the product) changes the memory allocation (and in any case does not provide real-time operation).

11.5.2. Execution time calculation

Calculating the execution time of application programs requires simulators to work in real, "hard" time, and not pseudo-real time. Simulators can show execution times in cycles and percentages, but not in milliseconds.

dah. One of the advantages of modern emulators, which is often overlooked, is their ability to determine, at the request of the user, the net execution time of functions, that is, the duration of their execution, both with and without taking into account the running time of subroutines and called library functions. Suppose you want to know how long it takes to execute a function that contains many IF statements. It's stupid to calculate everything directly possible options this function (although you will learn how to master a pocket calculator). The emulator, having removed all nested subroutines, will accurately determine the duration of execution of the main body of the function.

11.6. IN-CHIP EMULATOR OF MICROCONTROLLERS OF THE FAMILY

We will illustrate the capabilities of a "real" in-circuit emulator using the PICE-51 model of the domestic company Fiton as an example.

11.6.1. general description PICE-51

PICE-51 is a new generation emulator, created using new hardware development technologies and software(Fig. 11.1).

Rice. 11.1. Appearance PICE-51 in-circuit emulator

The use of large-capacity programmable matrices made it possible to drastically reduce the size of the emulator without any damage to its functionality, minimize the deviations of the electrical and frequency characteristics of the emulator from the characteristics of the emulated processor, and thereby achieve maximum emulation accuracy at frequencies up to 30 MHz at supply voltages from 3.3 V up to 5 V.

The reloadable hardware structure of the emulator provides emulation of almost all microcontrollers of the 8051 family as domestic production, and firms: Intel, Philips, Siemens, Atmel, Dallas, Temic, OKI, AMD, MHS and others.

A powerful programming interface in the Windows environment, is an integrated development environment that supports all stages of software development

support from writing the source code of the program to compiling and debugging it. The emulator support program is focused on debugging high-level language programs from source code.

The emulator consists of a PICE-51 main board 80 x 76mm in size, a replaceable adapter for a specific POD-51-XX processor, and a replaceable ADP-51-XX emulation head for a specific case type (Fig. 11.2). Implemented on the main board: tracer, breakpoint processor. The plug-in adapter board contains an emulating processor for a specific type of microcontroller. The emulation heads provide installation of the emulator into the DIP and PLCC blocks on the user board. The emulator is powered from a +5 V, 0.5 A power supply or directly from the device being debugged. Communication with a computer - via a galvanically isolated RS-232C channel at a speed of 115 kBaud.

Rice. 11.2. The structure of the PICE-51 emulator

11.6.2. Hardware Specifications

Accurate emulation - no any restrictions on the use of microcontroller resources by the user program.

Up to 256K emulated program and data memory. Support for banked memory model. Memory allocation between the emulator and the user's device

accurate to 1 byte.

Up to 512K hardware program and data memory access breakpoints.

Hardware support for debugging programs in high-level languages.

Trace 8 arbitrary external signals.

4 user equipment synchronization outputs.

Real time tracer with 16K to 64K 64-bit frame buffer with on-the-fly access. Tracing of address, data, control signals, real time timer and 8 external user signals.

Programmable trace filter.

Hardware breakpoint processor with the ability to set a complex emulation stop condition by a combination of address, data, control, 8 external signals, real time timer, event counters and delay timer.

Four complex breakpoints that can be used independently or in combinations according to conditions AND/OR/IF-THEN.

48-bit real time timer.

Transparent emulation - on-the-fly access to emulated memory, breakpoints, breakpoint processor, trace buffer, real-time timer.

Controlled clock generator for the emulated processor. The ability to smoothly change the clock frequency from 500 kHz to 40 MHz.

Galvanically isolated from the computer communication channel RS-232C with baud rate 115 kbaud.

Built-in system of self-diagnostics of the emulator equipment.

11.6.3. Software Features

The software is designed to work in a Windows environment on IBM-compatible computers with 386/486/Pentium processors;

Built-in multi-window The editor is intended for writing program source texts. The editor supports operations with blocks of text, search/replace, color highlighting of syntactic constructions of assembly language and C;

built-in Project Manager provides automatic compilation of programs. All options are set in the dialog form. The transition from source editing to debugging and vice versa is "transparent", i.e. project manager automatically starts compilation of the project if necessary;

PICE-51 provides symbolic and source code debugging for programs written with the following compilers:

o assembler ASM51 from Intel;

o MCA-51 assembler from Fiton/MicroCosm; o Intel PL/M compiler;

o assembler and C compiler from IAR Systems;

o C assembler and compiler from Avocet Systems Inc./HiTech ; o assembler and compiler

interface and debugging options. Ensures configuration files are compatible with the PDS-51 simulator. Portability of projects between the PICE-51 emulator and the PDS-51 simulator is provided;

Ability to set colors, fonts and other parameters for all windows at the same time and for each window separately;

The emulator is supplied with a printed user manual and context e-management, which describe in detail its principles of operation, commands, menus, hot keys.

Table 11.1. Comparative characteristics of some emulators for microcontrollers of the 8051 family

provider
Emulated micro		All known	All major		All major		All major
family controllers		variety-	varieties		variety-		varieties
Maximum frequency
emulation
Max Volume
emulated memory
Opportunities for redistribution		Blocks by	Blocks by		Blocks of 16		Up to
memory limits							1st byte
between emulator and
user device
		Up to 16K frei-	Up to 32K frei-		Up to 4K frei-		Up to 64 K frei-
Trace Buffer		mov 48 bit	mov 80 bit		mov 48 bit		mov 64 bit
On-the-fly access to
emulated memory and			Frame		The whole emulator
ISA format,					in the emulation
cables 2 met-	mm, cable,		mm, cable,		head
					size

Price for comparable
supply configuration
ki: support 80X51,
25 MHz, 128K RAM,
trace buffer
16K frames

Conclusion

The microprocessor system can be made to execute a program under the control of an external, host system that takes over the functions of the CPU of the target system. The behavior of the buses, memory, and I/O circuits of the target system can be monitored by the host system, even if the target system does not have I/O devices or has them but they are faulty. Most VEs have real-time tracing capability.

The emulator allows the developer to run the program (or program fragments) in real time, debug the program step by step, run the program