Analyzer ›› Trace Concepts ››
Parent Previous Next

This document is intended to be used together with the CPU reference manual provided by the silicon vendor. This document assumes knowledge of the CPU functionality and the terminology and concepts defined and explained in the CPU reference manual. Basic knowledge of winIDEA is also necessary. This document deals with specifics and advanced details and it is not meant as a basic or introductory text.


Contents        1

1        Trace        2

1.1        ETM Trigger and Qualifier Configuration        3

1.2        Troubleshooting Scenarios        10

2        BackTrace        20


ARM (on-chip) ETM provides a fairly good trace interface, which abilities vary from implementations (4, 8 or 16 data pins). Beside these, three status pins are added, through which the CPU reports the type of the CPU cycle: whether the instruction was executed or not, whether branch or trigger was executed, etc. When a relative branch was executed by the CPU, the ETM reports the new address through the ETM data pins. When an absolute branch is executed, the address must not be reported, since it can be calculated by the debugger with the help of the download code.

The most valuable information, reported by the ETM, is whether an instruction was executed or not. Based on the information, saved by the debugger, with the help of the download code the program execution can be reconstructed off-line.

ETM can also save data cycles, even in combination with the code. If the requirements for data transfer through the ETM are too large, there are two options: either the CPU can stop, if the data was not yet transmitted, or the data can go lost. These options can be set in the debugger. Also, the ETM incorporates its own trigger system.

Due to the absence of certain trace features on ARM ETM, iSYSTEM proprietary trace Real-Time Reconstruction (RTR) has been implemented for the ARM7/ARM9 architecture. The RTR restores the original CPU execution bus otherwise deeply embedded in the CPU silicon and allows implementing functionalities, which are otherwise found only on development systems featuring bus trace, like advanced trace functions, long profiler session times and infinite coverage.

Note: The RTR technology is available on iTRACE PRO/GT only. It is not available on iC5000.

Trace Features (iTRACE PRO/GT):

External trace buffer

Instruction and Data Trace

On-Chip Trigger and Qualifier

Time Stamps

AUX inputs

RTR Execution Trace

Advanced external trigger


Execution Coverage

4.1ETM Trigger and Qualifier Configuration

ETM Trigger dialog

The resource configuration, triggering and filtering is composed in such a way so it matches the ETM specification as closely as possible, therefore it is recommended to study the ‘Embedded Trace Macrocell Specification’ document before configuring the trigger and qualifier in the software.

The ETM has a configurable number of event resources. The resource types are:

address comparators

data comparators

context ID comparators

memory map decoders (where supported)

EmbeddedICE module watchpoint comparators (in cores supporting RANGEOUT)


a three-state sequencer

external inputs

trace start/stop.

The event resources are shared for:


Trace Enable

View Data


Resource Configuration – Address/Data Configuration

To specify a new comparator, press the ‘New’ button. To modify the existing comparator, double-click it, to remove a comparator, press the ‘Remove’ button.

Address/Data Configuration

First, the address to monitor is configured. An address can be selected by pressing the ‘From…’ button. If the entire object is to be covered, select the ‘Entire object’ option. If a range is to be configured, select the ‘To…’ address either by entering the address or by selecting the object. The type of access to that address can also be defined.

Data access type

Also, the data loaded or stored to that address can be filtered; in this case the comparator will be active only in the case of this exact data or mask.

To do this, select the length of the data from the drop-down menu.

Data length configuration

If the length is set to (none), the data is not monitored.

The data value can be inserted, if the comparator should be true only when this value is not in the memory address, select the ‘Not’ option. Also, the mask can be defined by selecting the ‘AND Mask’ option and the required mask entered.

Event Configuration

Event Configuration Dialog

One or two conditions can be defined for every event. The options differ from the condition; the source of the condition is defined for both conditions the same.

Resource Configuration – Counters Configuration

Up to four counters can be configured with each having an enable counter and a reload event.

Each time an ‘Enable’ event is reached, the ‘Count’ counter is decreased. Each time a ‘Reload’ event is reached, the ‘Count’ counter is reset to the default value, entered in this dialog. The trigger event can be set any occasion when any counter reaches 0.

In the above example, every write to address TestByte with the value of 0x8 decreases the counter. Every write to address TestWord with the value of 0x24 resets the counter to its default value, 10 in the above example.

Resource Configuration – Sequencer Configuration

The events that trigger changing states of the tri-state state machine can be defined here.

Transition Event Configuration

The trigger can be set to any of the three states.

The transition events defined above define state changes.

The trigger configuration in this way allows sequential conditions. In this case, first the access to Address_TestScopes must be performed; this switches from state 1 to state 2. Next, the access to ResetStrX switches from state 2 to state 3, which then completes the first trigger condition. Next, the access to Type_Arrays must be performed, in this case the trigger condition is met and saving begins.

Trigger Configuration

The trigger can be set to ‘Anything’ or to any event configured by pressing the ‘…’ button and opening the event configuration.

By selecting ‘Continuous Mode’ the recording continues until the CPU is stopped by the user or if the user has manually selected to stop recording in the trace window.

Trace Enable Configuration

Trace Enable part of ETM Trigger dialog

This field configures which part of instructions will be recorded beside the events enabling trace. The Include/Exclude regions can be defined and addresses which turn recording on and the addresses which turn it off. All conditions must be met (i.e. set to 1) to enable trace.

TraceEnable Configuration

The first option enables the Enabling event. If this event is set to ‘Disabled’, trace will never be enabled (always set to 0). If it is set to ‘Anything’, this event will always be set to 1.

The second option defines either the include or exclude regions. First, the region type is selected (either Include or Exclude), next the regions can be set. If no region is checked and ‘Exclude’ is selected, this condition will always be set to 1. Note that if no region is checked and ‘Include’ is selected, this condition will always be set to 0 and consequently trace will never be enabled.

Start/stop resources are defined in the third part of the Trace Enable configuration, defined as ‘Switch ON’ and ‘Switch OFF’ addresses.

If no resource is selected, the start/stop logic is turned off and always set to 1. If any resource is selected, the logic is enabled and checks for events. When a ‘Switch ON’ condition is met, at that point the logic will be set to 1. If a ‘Switch OFF’ condition is met, the logic will be set to 0.

Programming the TraceEnable Logic

Please see the examples for better understanding of Trace Enable configuration.

View Data Configuration

View Data part of Trigger/Qualifier dialog

This field configures which data will be recorded.

In the pull-down box, which data is saved is selected. This option allows you to store addresses, data or both. If this option is set to ‘(disabled)’, no data will be saved. If ‘Record CPR Transfers’ is selected, coprocessor transfers will be recorded too.

The event at which data is recorded can be configured. The data regions to exclude and regions to include can be selected too.

ViewData Configuration

First, the enabling event is selected.  If this event is set to ‘Disabled’, no data will be saved (the event always set to 0). If it is set to ‘Anything’, this event will always be set to 1.

Next, the Exclude resources can be selected. If any selected resource is true, the event will be set to 0.

Also, the Include resources can be selected. If the checkbox in front of the ‘AND Include’ is deselected, this logic is turned off and only the exclude logic will be used. If it is selected, this event will be set to 1 only if the selected resource is true. If the ‘AND Include’ option is checked and no resource is selected, this event will never be set to 1 and therefore no data will be saved.

If no exclude or exclude options are to be configured, uncheck the ‘AND Include’ option and deselect all resources in the ‘AND Exclude’ box. In this case this event will be set to 1 and only the Enabling event will be considered.

Programming the ViewData Logic

Please see the examples for better understanding of View Data configuration.

Stall CPU on FIFO Overflow

Stall CPU on FIFO overflow part of Trigger/Qualifier dialog

If this option is enabled, the system stalls the CPU when the FIFO overflows. The ‘FIFO Full Level’ specifies the number of free bytes of the FIFO when the level of the FIFO is considered full. The memory regions in which CPU stalling is enabled can be selected by using the Include/Exclude pull-down and selecting either include or exclude regions.

FIFOFULL Generation

Either include or exclude regions can be specified. If include regions are specified (‘Include’ is selected in the drop-down box), the FIFO buffer level will only be checked in these regions. If exclude regions are specified (‘Exclude’ is selected in the drop-down box), the FIFO buffer will be checked in all regions, except in the specified ones.

If FIFO Full level is being checked, first the number of free bytes in the FIFO is checked. If the number is below the specified number of bytes, the program will check whether the current memory area lies in the Include region or outside the Exclude regions. If this is true, then the CPU will be stalled.

Programming the FIFOFULL Logic

Typically this option remains unchecked.

4.2Troubleshooting Scenarios

Record everything

This configuration is used to record the contiguous program flow either from the program start on or up to the moment, when the program stops.

The trace can start recording on the initial program start from the reset or after resuming the program from the breakpoint location. The trace records and displays program flow from the start until the trace buffer fulfills.

As an alternative, the trace can stop recording on a program stop. ‘Continuous mode’ allows roll over of the trace buffer, which results in the trace recording up to the moment when the application stops. In practice, the trace displays the program flow just before the program stops, for instance, due to a breakpoint hit or due to a stop debug command issued by the user.

Example: ETM will record the CPU execution (instructions and data accesses) until the CPU is stopped by either the user or the program itself in case of any problems in the application. From the history, any problem originating from the code or the target can be filtered out.

Use the Wizard to set up ETM to record everything.

Set buffer size to maximum to achieve the best results and select the ‘Continuous mode’ option.

Before the program is set to run or while it is running already, activate ETM recording via ‘Trace begin’ tool bar or shortcut key. The ETM stops recording when the program execution is stopped. After the ETM stops recording, the collected information is analyzed and displayed.

Plain Trigger Configurations

This section describes configuring trace to trigger on a specific function being executed or to record specific variable data accesses.

‘On trigger break execution’ option in the ‘Recorder’ dialog should be checked when it’s required to stop the program on a trigger event.

Example: ETM will trigger on a function Type_Simple execution and record instructions.

Set the recorder to start ‘On Trigger’.

Configure the trigger by invoking the ‘Configure Address/Data’ dialog.

Enter Type_Simple address in the address field by invoking the symbol browser by pressing the ‘From’ button in the dialog.

Set the ‘Execute’ access type.

Now, return to the Trigger/Qualifier menu and specify the trigger event.

Define the condition A, so that it equals to the defined address.

Final configuration of the Trigger/Qualifier

After the trace is being activated, the ETM starts recording after the Type_Simple is executed. After the iTRACE buffer is fulfilled, the results are displayed.

Example: ETM will start recording (instructions and data accesses) after the function Type_Simple is executed (called) for the fifth time.

Configure the trigger by invoking the ‘ETM Trigger dialog’. We will use the settings from the previous example.

Enable the counter by specifying the counter event.

Define the condition A, so that it equals to the defined address.

Now, set the ‘Count’ to 5 since we want to focus on fifth execution of the function.

Next, set the trigger event with the Event Configuration menu by pressing the ‘…’ button. Set the condition so that it equals to the Counter1 being 0.

Next, back in the main trigger/qualifier window define the View Data field to ‘Addr & Data’ – this will save both instruction and data accesses.

After the trace is being activated, the ETM starts recording after the Type_Simple is being executed for the fifth time. After the iTRACE buffer is fulfilled, the results are displayed. Data accesses (both address and data bus) will be recorded beside the default instructions.

However, the user can also check the ‘Continuous mode’ option in the ‘Trigger/Qualifier’ dialog. Then again, the trace would not stop recording before the program execution is being stopped. Typically, this is not what the user needs and ‘Continuous mode’ option is left unchecked.

Example: In this example, an ‘illegal’ write to an iCounter variable occurs while running the target application. The variable gets a value 0x1233, which is unexpected and the application ceases from operating correctly.

Choose the start of the recording ‘On Trigger’. Set the trigger position to ‘End’ and choose a bigger buffer size to get the best results from the iTRACE.

Next, configure the trigger on the ‘ETM’ page.

Define the Address/Data comparator. Select iCounter from the symbol browser. Then select ‘Data store’ for access type, ‘Auto’ for data size and enter 0x1233 in the value field.

Next, set the trigger to the newly defined event.

Final configuration

When incorrect write to the iCounter occurs, the iTRACE stops recording after the buffer is fulfilled. Since the trigger was set to the end of the buffer, the user can inspect from the buffer pre-history of the application’s behavior before the trigger event occurred. Note that trigger event is troublesome in this particular case.

Example: Type_Pointers is a function, which is called periodically by the application. Using on-chip ETM, the time between the consecutive calls will be measured.

Choose the start of the recording ‘On Trigger’. Set the trigger position to ‘End’ and choose a bigger buffer size to get the best results from the iTRACE.

Next, configure the trigger on the ‘ETM’ page.

Define the Address/Data comparator. Select Type_Pointers from the symbol browser and ‘Execute’ for access type. If the whole function must be recorded instead of an entry point only, check ‘Entire object’ additionally.

Revert to the ‘ETM’ dialog. The trigger is set to ‘Anything’ since we are interested only in time differences between executed function calls. The start event is irrelevant.

Next, select the ‘Include’ and ‘Type_Pointers’ event in the Trace Enable field.

Final configuration

After activating ETM, the iTRACE records every entry to the function Type_Pointers. By using ‘Relative time’ display type in the trace window the user can verify the time between any two consecutive function calls.

The analyzer module is an optional add-on to the debug system. With its aid most of the emulated CPU lines are recorded without interfering with its operation. This makes the analyzer module and its features a vital component in monitoring the program’s response to real-time events.


BackTrace is a feature of winIDEA which enables a developer to get a high level view of the history of program execution recorded in a trace recording. Looking at a trace recording only, one can only see CPU machine instruction and data samples in the order in which they were recorded by the trace tool. Seeing the execution path of the program is fairly straightforward just by looking at the sequence of samples in the recording. But what about the state of the program at specific points in program history? Just by looking at the recording, this is quite unimaginable.

This is where the BackTrace comes in. After a trace recording has been made, the trace stream is displayed in the trace window. The program can continue running or can be stopped, does not really matter for BackTrace. Now, you can select any instruction sample in the recorded trace stream and use "Set Context" command from the menu which pops up when clicking the right mouse button on a sample in trace window. winIDEA will switch display to the BackTrace mode and the disassembly, memory, variables and watch windows will display the state of the program at the time just before the instruction in the selected trace sample was executed. Registers pane will show contents of registers at that point in time, memory windows will show contents of memory at that point in time, variables and watch windows will show values of variables at that point in time. Real-time watch windows do not apply in the BackTrace mode. There will be cases where it is not possible for BackTrace to determine the state of certain registers, bits in a register or memory locations. In such cases, the affected entity will be displayed with question mark instead of the value.

Once in the BackTrace display mode, one can keep selecting different samples in the trace stream and using the "Set Context" command to examine the state of the system at the point of the selected sample. One can also follow the changing of the system state one instruction at a time, forward or backward in time by using F4(forward) and Shift+F4(backward). F4 and Shift+F4 move one assembly line at a time or one source code line at a time, depending on the type of  the trace line that was last selected by mouse.

Registers cannot be modified in the BackTrace mode, since the BackTrace displays historical register context. Memory image cannot be modified in the BackTrace mode as well.

To switch back to the live debug session display, use any debug command and the display will switch back to the live debug session.

If target is running, switching back to live debug session will not be obvious, because registers and memory cannot be refreshed while target is running. If the target is stopped, 'Debug/Snapshot (F8)' or 'Debug/Show execution point (Alt+Num*)' will do just fine.

The BackTrace works on in-circuit bus trace, ETM and Nexus trace recordings. Quality of the BackTrace results also depends on presence of stream errors in the trace stream. Quality is measured in terms of the amount of reconstructed information (register contents and memory locations). All displayed reconstructed information is correct, what could not be reconstructed is displayed as '?'.

In case of in-circuit emulator with entirely visible program and data bus the best results are generally expected, since the trace recording contains all bus activity and there are no errors. In case of ETM, trace recording can either be free of errors or it can contain errors (i.e. FIFO overflows), depending on the CPU frequency, trace port throughput and data trace configuration. When there are no errors in the recorded trace stream the quality of the BackTrace results will be the same as in case of bus trace. When there are errors in the stream, the amount of reconstructed information will be affected by the number of errors and will vary depending on how far the point of context reconstruction is from the point of stream error. In case of Nexus trace, the situation is similar as in case of ETM trace. There can be errors in the stream which affect the quality of the BackTrace results.

Configuring the trace

Fundamental prerequisite for good quality the BackTrace results is the data trace. The BackTrace yields worst results if the on-chip trace doesn’t feature the data trace or if it is not configured properly for data access recording. Below is an example of ETM Trigger and Qualifier configuration, which results in recorded program flow and data accesses. Trigger is set to anything and all program and data cycles are recorded. To minimize the possibility for overflows, the user may select only data or address to be broadcasted for the data messages but this will also have a negative impact on amount of information displayed by the the BackTrace, which relies solely on the information recorded by the trace. Any trace trigger can be configured without impacting the BackTrace results.

Disclaimer: iSYSTEM assumes no responsibility for any errors which may appear in this document, reserves the right to change devices or specifications detailed herein at any time without notice, and does not make any commitment to update the information herein.

© iSYSTEM. All rights reserved.