Emulation techniques: BDM, OnCE, JTAG

Emulation techniques

In-circuit emulation (ICE) has been the traditional method employed to emulate a processor inside an embedded design so that software can be downloaded and debugged in situ in the end application. For many processors this is still an appropri-ate method for debugging embedded systems but the later processors have started to dispense with the emulator as a tool and replace it with alternative approaches.

The main problem is concerned with the physical issues associated with replacing the processor with a probe and cable. These issues have been touched on before but it is worth revisiting them. The problems are:

•                                                                                 Physical limitation of the probe

With high pin count and high density packages that many processors now use such as quad flat packs, ball grid arrays and so on, the job of getting sockets that can reliably provide good electrical contacts is becoming harder. This is starting to restrict the ability of probe manufacturers to provide headers that will fit these sockets, assuming that the sockets are available in the first place.

The ability to get several hundred individual signal cables into the probe is also causing problems and this has meant that for some processors, emulators are no longer a practical proposition.

•                                                                                 Matching the electrical characteristics

This follows on from the previous point. The electrical characteristics of the probe should match that of the device the emulator is emulating. This includes the  electrical characteristics of the pins. The difficulty is that the probe and its associated wiring make this matching very difficult indeed and in some cases, this imposes speed limits on the emulation or forces the insertion of wait states. Either way, the emulation is far from perfect and this can cause restrictions in the use of emulation. In some cases, where speed is of the essence, emulation can prevent the system from working at the correct design speed.

•                                                                                  Field servicing

This is an important but often neglected point. It is extremely useful for a field engineer to have some form of debug access to a system in the field to help with fault identification and rectification. If this relies on an emu-lator, this can pose problems of access and even power supplies if the system is remote.

So, faced with these difficulties, many of the more recent processors have adopted different strategies to provide emula-tion support without having to resort to the traditional emula-tor and its inherent problems.

The basic methodology is to add some debugging sup-port to the processor that enables a processor to be single stepped and breakpointed under remote control from a workstation or host. This facility is made possible through the provision of dedicated debug ports.

JTAG

JTAG ports were originally designed and standardised to provide a way of taking over the pins of a device to allow different bit patterns to be imposed on the pins allowing other devices within the circuit to be tested. This is important to implement boundary scan techniques without having to re-move a processor. It allows access to all the hardware within the system.

The system works by using a serial port and clocking data into a large shift register inside the device. The outputs from the shift register are then used to drive the pins under control from the port.

OnCE

OnCE or on-chip emulation is a debug facility used on Motorola’s DSP 56x0x family of DSP chips. It uses a special serial port to access additional registers within the device that provide control over the processor and access to its internal registers. The advantage of this approach is that by bringing out the OnCE port to an external connector, every system can provide its own in circuit emulation facilities by hooking this port to an interface port in a PC or workstation. The OnCE port allows code to be downloaded and single stepped, breakpoints to be set and the display of the internal registers, even while operating. In some cases, small trace buffers are available to capture key events.

BDM

BDM or background debug mode is provided on Mo-torola’s MC683xx series of processors as well as some of the newer 8 bit microcontrollers such as the MC68HC12. It is similar in concept to OnCE, in that it provides remote control and access over the processor, but the way that it is done is slightly different. The processor has additional circuitry added which provides a special background debug mode where the processor does not execute any code but is under the control of the remote system connected to its BDM port. The BDM state is entered by the assertion of a BDM signal or by executing a special BDM instruction. Once the BDM mode has been en-tered, low level microcode takes over the processor and allows breakpoints to be set, registers to be accessed and single stepping to take place and so on, under command from the remote host.