16 responses
Emulation is a multifaceted field. Here are the main ideas and functional components. I'm going to break it down into parts and then fill in the details with changes. Many of the things I am about to describe will require knowledge of inner work processors - assembly knowledge is required. If I'm a bit vague on some things, please ask questions so I can continue to improve this answer.
Main idea:
Emulation works by controlling the behavior of the processor and individual components. You build each individual part of the system and then connect the parts just like wires in hardware.
CPU emulation:
There are three ways to handle CPU emulation:
- Interpretation
- Dynamic recompilation
- Static recompilation
With all of these paths, you have a common goal: execute a piece of code to change the state of the processor and interact with the "hardware". Processor state is a conglomeration of processor registers, interrupt handlers, and so on. For the given target processor. For 6502, you will have a number of 8-bit integers representing the registers: A , X , Y , P and S ; you will also have a 16-bit PC register.
With interpretation, you start with IP (instruction pointer - also called PC , program counter) and read the instruction from memory. Your code parses this instruction and uses this information to change the processor state specified by your processor. The main problem with interpretation is that it is very slow; each time you process a given instruction, you must decode it and perform the required operation.
With dynamic recompilation, you iterate over the code just like you would interpret, but instead of easy execution opcodes you create a list of opcodes. Once you reach the branch instruction, you compile this list of native code operations for your host platform, then you cache that compiled code and execute it. Then when you get back in this group commands, you only need to execute the code from the cache. (By the way, most people don't actually list the instructions, but compile them to machine code on the fly - this makes optimization difficult, but it's out of the scope of this answer unless people are interested)
With static recompilation, you do the same as with dynamic recompilation, but follow the branches. You end up with a piece of code that represents all of the code in the program, which can then be executed without any additional noise. This would be a great mechanism if not for the following problems:
- Code that is not in the program to begin with (e.g. compressed, encrypted, generated/modified at runtime, etc.) will not be recompiled, so it will not run
- It has been proven that searching for all code in a given binary equivalent is equivalent to the halting problem
They combine to make static recompilation completely unfeasible 99% of the time. For getting additional information Michael Steil did a great deal of research on static recompilation - the best I've seen.
The other side of CPU emulation is the way it interacts with the hardware. It really has two sides:
- Processor time
- Interrupt handling
Processor time:
Some platforms - especially old consoles like NES, SNES etc. - require your emulator to have a strict time for full compatibility. With the NES, you have a PPU (Pixel Processing Unit) processor that requires the processor to place pixels neatly into its memory. If you use interpretation you can easily count cycles and emulate right time; with dynamic/static recompilation, the whole thing is/much/more complicated.
Interrupt handling:
Interrupts are the main mechanism by which the processor communicates with the hardware. Typically, your hardware components tell the CPU what is interrupting it. It's pretty simple - when your code throws the given interrupt, you look up the interrupt handler table and call the correct callback.
Hardware emulation:
There are two sides to emulating a given hardware device:
- Emulation of device functionality
- Emulation of real device interfaces
Let's take a case hard drive. Emulation of functionality is provided by the creation of backup storages, read/write/format procedures, etc. This part is usually very simple.
The actual interface of the device is a little more complicated. This is typically some combination of memory-mapped registers (such as parts of memory that the device watches for changes in signaling) and interrupts. For a hard disk, you might have a memory mapped area where you place read, write, etc commands, then read that data.
I'd go into more detail, but there are a million ways you can go with it. If you have any specific questions feel free to ask and I'll add the information.
Resources:
I think there was a very good input here, but there are additional tons. I am more than happy to help with any questions; I've been very vague most of the time just because of the sheer complexity.
Required Wikipedia links:
General emulation resources:
- Zophar is where I started with emulation, downloading the emulators first and eventually plundering their huge documentation archives. This is the best resource you can have.
- NGEmu - Not many direct resources, but their forums are unbeatable.
- RomHacking.net - Documents section contains resources regarding machine architecture for popular consoles.
Emulator projects for reference:
- is a .NET emulation framework written in Nemerle and recompiles C# code on the fly. Disclaimer: This is my project, so I apologize for the shameless version.
- BSnes - An amazing SNES emulator with the goal of loop accuracy.
- MAME- arcade emulator. Excellent recommendation.
- 6502asm.com - This is a JavaScript 6502 emulator with a cool little forum.
- dynarec"d 6502asm - This is a little hack I did in a day or two. I took an existing emulator from 6502asm.com and modified it to dynamically recompile JavaScript code for speed.
Links to recompile the processor:
- Static recompilation research done by Michael Stehl (linked to above) ended up in this article, and you can find the source for such .
Addendum:
It's been over a year since this answer was posted, and with all the attention it's been receiving, I've decided it's time to update some things.
Perhaps the most exciting thing about emulation right now is libcpu , started by the aforementioned Michael Steele. This is a library designed to support a large number processor cores that use LLVM for recompilation (static and dynamic!). It has got huge potential and I think it will do great things for emulation.
A guy named Victor Moya del Barrio wrote a dissertation on this topic. Lots of good information on 152 pages. You can download PDF.
If you don't want to register with scribd , you can google for the PDF header, "Learning emulation programming techniques". There are several different sources for PDF.
Emulation may sound complicated, but it's actually much easier than simulation.
Any processor usually has a well-written specification that describes states, interactions, and so on.
If you didn't care about performance at all, you can easily emulate most older processors using very elegant object-oriented programs. For example, an X86 processor would need something to maintain the state of the registers (easy), something to maintain the state of the memory (easy), and something that would take every incoming instruction and apply it to the current state of the machine. If you really need precision, you also emulate memory translations, caching, etc., but it's doable.
In fact, many microchip and processor manufacturers test programs against the chip's emulator and then against the chip itself, which helps them find out if there are problems in the chip's specifications or in the actual implementation of the chip in the hardware. For example, one could write a chip specification that would lead to deadlocks, and when a deadline occurs in the hardware, it is important to see if it can be replicated in the specification, as it indicates big problem than something in the implementation of the chip.
Of course, video game emulators usually care about performance, so they don't use naive implementations, and also include code that interacts with the host system's OS, for example for drawing and sound.
Given the very slow performance of older video games (NES/SNES, etc.), emulation on modern systems pretty simple. In fact, it's even more amazing that you could just download a set of every SNES game ever or any Atari 2600 game, considering that when these systems were popular, having free access to every cartridge would have been a dream.
I know this question is a bit old but I would like to add something to the discussion. Most of the answers here are centered around emulators interpreting the machine instructions of the systems they emulate.
However, there is a very famous exception called "UltraHLE"(). UltraHLE, one of the most famous emulators ever made, emulated commercial Nintendo 64 games (with decent performance on home computers) at a time when it was considered impossible. In fact, Nintendo was still releasing new titles for the Nintendo 64 when UltraHLE was created!
For the first time I saw articles about emulators in printed magazines, where before, I only saw them on the Internet.
The concept behind UltraHLE was to make the impossible possible by emulating C library calls instead of machine level calls.
Having created your own 80s BBC microcomputer emulator (type VBeeb on Google), you need to know a few things.
- You are not emulating the real thing as such, it will be a replica. Instead you emulate State. good example is a calculator, the real thing has buttons, a screen, a case, etc. But to emulate a calculator, you only need to imitate the up or down buttons, which LCD segments are on, etc. Basically, a set of numbers representing all possible combinations of things that can change in a calculator.
- You only need the emulator interface to appear and behave like the real thing. The more convincing it is, the closer the emulation. What happens behind the scenes could be anything. But for ease of writing an emulator, there is a mental mapping that happens between the real system, i.e. chips, displays, keyboards, circuit boards, and abstract computer code.
- To emulate computer system, the easiest way is to break it into smaller pieces and emulate these pieces individually. Then combine the entire batch for the finished product. Much like a set of black boxes with input and output that lends itself perfectly to object-oriented programming. You can subdivide these chunks to make life easier.
Practically speaking, you usually want to write for the speed and fidelity of the emulation. This is due to the fact that software on the target system will (may) be slower than the source hardware on the source system. This may limit the choice of programming language, compilers, target system, etc.
Also, you should limit what you are willing to emulate, such as not needing to emulate the voltage state of the transistors in the microprocessor, but probably needing to emulate the state of the microprocessor's register set.
Generally speaking, the lower the emulation granularity, the more fidelity you will get in the original system.
Finally, information for older systems may be incomplete or non-existent. So getting the original hardware is essential, or at least highlighting another good emulator that someone else has written!
Yes, you have to interpret all machine code binary "manually". Not only do most of the time you also have to simulate some exotic hardware that has no equivalent on the target machine.
A simple approach is to interpret the instructions one by one. This works well, but it's slow. A faster approach is recompilation - translating the source machine code into the target machine code. This is trickier, as most instructions won't map to each other. Instead, you will have to develop complex tasks related to additional code. But in the end it's much faster. Most modern emulators do this.
When you develop an emulator, you are interpreting the processor assembly that the system is working on (Z80, 8080, PS CPU, etc.).
You also need to emulate all the peripherals that the system has (video output, controller).
You should start writing emulators for simpe systems like the good old Game Boy (which uses the Z80 processor, I'm not mistaken) OR the C64.
An emulator is very difficult to create as there are many hacks (like in fancy effects), timing issues, etc that you have to simulate.
This will also show you why you need a multi GHz processor to emulate 1 MHz.
I've never done anything to emulate a game console, but I took the course when the assignment was to write an emulator for the machine described by Andrew Tanenbaums. It was fun and gave me a lot of aha. You might want to choose this book before diving into a real emulator.
The injector emulator is required for with an injector. Installation and connection of the HBO injector emulator 2 generations have several mandatory conditions that are required for the productive operation of the entire system.
Injector emulator - what is it?
emulator gas equipment 2nd generation is special device, which creates an imitation of the operation of injectors petrol type, which allows the mechanisms to function normally. When the injectors of an emulative (emitting) nature are turned on, gas supply begins. The mechanism is a very important device that retains the ability full-fledged work no errors or damage.
Important! In the absence of an electronic device, the mechanism will fail or refuse to work.
To install the 2nd generation HBO injector emulator and connect it, certain skills are required, since when this process You will also need to do some configuration. It is better to entrust this process to professional mechanics, as otherwise minor problems may occur, which will manifest themselves in too slow or accelerated operation of the mechanisms.
Important! The gasoline pump does not turn off when switching to gas, since gasoline cools and washes its part of the system, including gasoline-type injectors. There must also be fuel in the gas tank.
In addition, it must be borne in mind that the engines are heated by gasoline, and not by gas. Otherwise, the system will shut down or may be damaged.
The injector has a number of necessary sensors. For the emulator, the lambda probe for HBO 2nd generation is very complex mechanism, which mainly regulates the EBO when running on gasoline for fuel supply. When switching to gas, the data transmission circuit is broken, and the secondary emulative lambda probe creates a transmission immediately to the controller. If you use the primary sensor, the machine will immediately go into an emergency state, as the ECU will show that the sensor is faulty.
Electronics injection machine very sensitive so better installation and configure it yourself, only if you have some experience.
In general, the emulator has several features that are very important. These functions regulate the operation of the entire transition and further process:
- shutdown of petrol type injectors;
- switching to work on gas with imitation of a gasoline injector mechanism;
- ECU deception regular type in the form of imitation of the working process of gasoline injectors;
- transition exception to emergency mode;
- adjustment of a number of processes, including those with sensors.
It is also worth considering that an injector with a properly configured electronic mechanism has advantages when automatic mode, that is, the transition from gasoline to gas will occur almost instantly after turning the ignition. But this requires an engine temperature of about forty degrees.
On our website there are articles about various gas injectors:
Installation and setup
Installation and configuration of the device are carried out at the same time, otherwise problems may arise. Any incorrect connection can lead to the following consequences:
- incorrect operation during ignition, including the lack of gas supply;
- unstable process of idling with gas;
- freezing of the gearbox;
- there are failures in work or after idle move.
For this reason, proper arrangement is extremely important. The priority is the re-equipment of the car when embedding the device by specialists who will immediately set up all the elements and characteristics.
For self installation the wiring diagram for the 2nd generation HBO injector emulator is quite complicated, but with experience, you can do everything right. In addition, it is worth remembering a few simple rules:
- the standard resistance of the electronic mechanism should be about 100 ohms;
- the installation of the device must take into account the presence or absence of self-regulation;
- each injector has its own mechanism, for example, for "Europeans" a device marked EI is suitable, and for the Japanese - JI. This will allow you to select a device with the appropriate connectors and characteristics;
- it is worth considering the number of cylinders, since in accordance with this there is an individual selection of the emulator;
- the desired transition delay limit varies from zero to 5 seconds. The range is set according to the motor configuration individually, immediately after installation.
With full arrangement, the smoothness of the transition and the course itself are immediately worked out. This avoids most further operational problems. If there is no self-diagnosis (lamp check engine does not light up when the gasoline-type injectors are turned off), then the transition can be made using a conventional relay. Otherwise, installation is more difficult. If the relay is connected, then it is better to use a five-pin one with a positive wire sent to a gasoline-type injector. The best choice voltage will be 12 volts.
In a more complex version, the emulator is connected through the HBO switch. In this case, it will be necessary to adjust the delay in accordance with the experimental work, that is, the required level of delay is indicated empirically. This is due to the different individual characteristics of each engine. If there are sensors, you will need to install an emulative type lambda probe. It is also called oxygen. When it is installed, a signal about the fuel rate will be sent to the ECU, which will allow the car not to go into emergency mode.
Read how to properly clean and replace gas injectors.
Finally
An emulative device is a simulator of the operation of a gasoline-type element with an electronic character. Best to install this device when converting the injector to HBO 2nd generation, since the following modifications already contain this element.
Each ECU has its own individual mechanism, which must be selected according to its characteristics. The process of embedding into the system should be carried out by professionals. This allows you to eliminate the shortcomings that arose at the first stage.
Exhaust gases emitted by a vehicle contain dangerous substance NOx. The purpose of the SCR is to minimize the amount of negative emissions using AdBlue urea. React allows you to do poisonous substance to water and nitrogen.
EGR - used similarly to SCR to reduce nitrogen oxide emissions. The device redirects exhaust gases to the intake manifold.
AdBlue is used by SCR to minimize NOx emissions in the exhaust gases.
AdBlue is a liquid, odorless and non-toxic element.
Urea in countries North America called DEF, and European states called AdBlue.
The diaphragm pump performs the suction function of the AdBlue. The device compresses the reagent, increasing the pressure to 9 bar, which is necessary to spray DEF. Special Electrical engine allows you to maintain pressure. The dispenser determines the DEF dosage and dispenses it.
Malfunctions often occur in the SCR, which became an additional argument in favor of disabling AdBlue urea.
Control of reagent injection and operation dashboard is handled by a special DCU or a software module in the engine control unit. These devices accurately determine the amount of urea supplied and provide a signal to the dosing module. The complex provides a closed control cycle.
Adblue freezing occurs when temperature indicators-11 degrees Celsius. Deactivation of the propulsion system may cause crystallization of the reagent.
To protect the SCR, in case low temperature operation, warm up the AdBlue before starting the engine. The process of supplying urea is possible after complete thawing of the reagent.
In case of work trucks in cold RF conditions, deactivating urea with a data simulator would be the right solution.
How Adblue emulator works
- IN vehicle, working on the basis of EURO-5, the AdBlue emulator is mounted via the CAN module. Errors in the AdBlue control system are not allowed!
- All data of the AdBlue system devices are copied to the emulator's memory block.
- Activation of the AdBlue emulator starts the process of sending a signal, via the CAN module, to the machine system of the copied saved data about the health of the AdBlue device.
- When the vehicle is moving, the AdBlue simulator communicates with certain vehicle units and sends modified data with simulated urea consumption data.
Now the market is filled with all kinds of urea emulators from a wide range of manufacturers from China. Our company prefers trusted suppliers of high quality equipment. Therefore, we successfully help motorists with EURO-5 class cars and help to minimize material investments associated with the implementation of repair measures for a regular urea device.
HBO 2nd generation is associated with many carbureted engines. The difference between these HBO systems and the popular HBO 4 is that in the 4th generation all work is based on automation and the operation of the computer, while in the 2nd generation half of the units are mechanized and operate on the principle of excess pressure in the lines.
However, there are times when connection of HBO 2nd generation to the injector turns out to be the most the best option. For example, installation on cars of the 90s with a mileage of over 300 thousand km. Differences HBO for injector from 2nd generation carburetor kits:
- more precise fuel injection through gas injectors. IN carburetor systems gas is supplied to the carburetor;
- the presence of a lambda probe emulator;
- fast switching between gas and gasoline due to the presence of electronics (in carburetor systems, this function is implemented with a delay).
Troubleshooting HBO on the injector
Below we have listed the most common malfunctions of HBO 2nd generation.1. The engine does not run on gas or starts poorly. Possible solutions:
- problems with the multivalve;
- the gearbox does not work or its filters are clogged;
- problems with the regulation of HBO;
- tightness is broken intake system;
- along with gas, gasoline is simultaneously supplied (problems with the injector emulator or problems with the gas valve).
- it is necessary to add antifreeze or find a leak;
- clogged coolant supply lines;
- there are violations in the tightness of the gas valves.
- problems with the idle system on the carburetor;
- the reducer is not adjusted (pressure in the line);
- it is necessary to drain the condensate from the gearbox.
- malfunction in the ignition of the car;
- clogged filters, lines or multivalve.
- problems with spark plugs, ignition coil, high voltage wires;
- the adjustment of gas-balloon equipment is knocked down;
- the gaps between the seats and valves are violated, the timing belt is stopped incorrectly.
If you did not find any signs of a malfunction of your HBO in this list, then come to KOSTA GAS, where they will make you the best HBO repair in Kharkov. Our specialists understand all types of HBO and are ready to help you in any matter: optimization
It is clear that he, reacting to the amount of oxygen in exhaust gases, gives a voltage of 0.1 - 0.2V (lean mixture) or 0.8-0.9V (rich mixture). The electronic unit The control unit (ECU) of the engine constantly changes the amount of fuel injected - lean mixture enriches, impoverishes the rich. Thus, the optimum is maintained, and the signal on the Lambda probe at the same time looks (can be viewed with an oscilloscope) as a series of pulses of equal duration, almost rectangular (important!) Shape, spanning from 0.1 - 0.2V to 0.8-0.9V .
This is how everything works as long as the auto-regulation circuit is closed, which includes an engine with a “body kit”, an ECU and a Lambda Probe. The chain starts to work poorly if you take care of the economy and the environment and put gas equipment(HBO).
For a single injection engine, a simple ejector system is quite sufficient. It's just yellow light bulb Check The engine starts to burn constantly, and when driving on gasoline, a solid overrun appears.
There is an opinion that the gas is to blame. Allegedly, the Lambda Probe is "accustomed" to gasoline, and "it goes crazy on gas."
In fact, everything is much simpler. The Lambda Probe doesn't care what kind of fuel it burns. It continues to respond in the same way to the amount of oxygen in the exhaust. But his reaction does not affect the operation of the engine in any way - after all, the auto-regulation circuit is broken. If earlier, in response to a signal about rich mixture, the ECU reduced the supply of gasoline (including the nozzle for a shorter time), and enriched the signal about the poor, maintaining the stoichiometric mixture, then when working with gas, the ECU cannot affect the HBO ejector system in any way.
Seeing that there is no reaction, the ECU lights the Check Engine light and switches to the “emergency” operation mode. When driving on gas, this does not affect its consumption in any way, since it is determined by the LPG setting. But when switching to gasoline, the consumption will increase sharply because the "emergency mode" remains in the computer's memory.
For the normal operation of the engine on gas, the Lambda Probe Emulator is needed. His task is to deceive the computer, when working on gas, to show that everything is in order. It does this very simply: it gives a signal similar to the reaction of a real Lambda probe when normal operation.
The emulator will give out 0.1V, the ECU will start to enrich the mixture, the emulator will give out 0.9V. The ECU will begin to lean the mixture, as it happens when running on gasoline. Thus, the Check Engine light does not light up, and the ECU does not go into emergency mode.
You can buy a ready-made emulator, you can make it yourself according to a simple scheme, the main thing is to connect it correctly.
A simple circuit of the Lambda Probe Emulator
The lambda probe emulator is assembled on the most popular chip. Resistor R1 sets the pulse frequency (1-2 per second), the LED indicates the operation of the device. During normal operation, the voltage on it does not exceed 1.8V. The resistor R6 will have exactly half, i.e. 0.9V or 0V.
The circuit is powered by the HBO switch, the relay is activated and connects the output of the device (K2) to the input of the ECU (K3).
When the HBO is turned off, the relay releases and the ECU input is connected to the lambda probe (K1), i.e. the device is included in the wire break from the Lambda probe to the ECU.
There are many options for sale. Some manufacturers are introducing an additional two or three LEDs, signaling the quality of the mixture.
This is not difficult to do, because the Lambda probe continues to perform its functions in terms of issuing a signal. So if you connect two threshold devices to the Lambda probe - one at 0.1V, the other at 0.9V, then they will light up the corresponding LEDs at the appropriate moments.
Thus, it is possible, as a first approximation, to determine the quality of the mixture when working on gas.
So, if you decide to put an ejector HBO on an engine with a “single injection”, you cannot do without the Lambda Probe Emulator.
In all other cases (replacement faulty L-Z or something similar) it is absolutely useless.
