CMON51
Copyright (c) 2005 Jesus Calvino-Fraga
CMON51 is a monitor program for the 8051 family of microcontrollers. With CMON51 you can:
a) Examine and modify both the internal and expanded RAM of the microcontroller.
b) Examine the program memory of the microcontroller.
c) Examine and change any register or special function register (SFR).
d) Download a program using the Intel hex format to flash code memory.
e) Disassembly programs in flash.
f) Run step-by-step, trace, and execute downloaded programs.
g) Use software breakpoints. Hardware breakpoints are also kind of supported.
CMON51 needs the following microcontroller resources to operate:
a) The serial port using timer 1 for baud rate generation.
b) Timer 1 interrupt for single step operation.
c) 256 bytes of external RAM for variables as well as to save the user program internal direct memory.
d) Around 8 Kbytes of code memory for the monitor itself (port dependant).
To communicate with CMON51 you need a terminal program. If you use Microsoft’s Windows, HyperTerminal works just fine. Another option is TeraTerm. You will need to configure your terminal program depending on the microcontroller and crystal you are using. For example, for a P89V51RD2 microcontroller with a 22MHz crystal, you will need to configure your terminal program to 115200 baud, 8 bits, 2 stop bits, and parity none.
Currently, CMON51 has been ported to work using the following 8051 compatible microcontrollers:
a) Plain 8051/8052 (using overlapped CODE and XRAM memory)
b) Philips P89V51RD2 (using built in Flash)
c) Atmel AT89C51RD2/ED2 (using built in Flash)
d) End of list L
CMON51 is hosted at http://sourceforge.net/projects/cmon51. There you can either download the latest release of CMON51 or explore the subversion repository. You can also get the latest files for CMON51 using subversion. Please follow the instructions given in http://sourceforge.net/svn/?group_id=147960 on how to access the repository. For your convenience, Intel hex files of CMON51 are provided both in the release archive and subversion repository for the supported microcontrollers.
CMON51 is written mainly in C and compiled using the freeware SDCC compiler available at http://sdcc.sourceforge.net/. Make files are available for the microcontrollers it has been ported to. You will need also the ‘make’ utility for your computer platform OS (Windows, Linux, Unix, etc.) available everywhere on the internet; Google “make.exe”, for example. For the Microsoft Windows operating systems you may use the make available from http://unxutils.sourceforge.net/. If you use Linux, ‘make’ is probably already installed. If you have Microsoft Visual Studio installed in your computer, you can use ‘nmake’ as well. For example:
make –f 8052.mak
or
make –f p89v51rd2.mak
In all my tests I used a 22.1184 MHZ crystal, and the code is setup to use this value. If you have a different crystal frequency, you will need to recreate the file “baud.h”, or setup the baud rate directly in CMON51 by setting the TH1 special function register in function _sdcc_external_startup (defined in 8052.c, p89v51rd2.c, at89c51ed2.c, etc.). To recreate “baud.h” first compile “baud.c”:
C:\board51\cmon51>cl baud.c
Microsoft (R) 32-bit C/C++ Optimizing Compiler Version 12.00.8804 for 80x86
Copyright (C) Microsoft Corp 1984-1998. All rights reserved.
baud.c
Microsoft (R) Incremental Linker Version 6.00.8447
Copyright (C) Microsoft Corp 1992-1998. All rights reserved.
/out:baud.exe
baud.obj
or if what you have is GCC:
$ gcc baud.c -o baud.exe
and then run it. For example, for a 12MHz crystal:
baud 12 > baud.h
WARNING: check the file “baud.h” to see what baud rates are available as 115200 is often not achievable using some crystal values. If that is the case, you will need to use a different baud rate for CMON51. To change to a different baud rate, look for “TH1=TIMER1_K2_115200;” in the corresponding microcontroller file (p89v51rd2.c, for example), and change it with one of the values present in “baud.h”. Then, configure you terminal program to use that baud rate.
If you find a bug in CMON51, you can report it at http://sourceforge.net/projects/cmon51. There is a tab there named ‘Bugs’. Please, provide a description of the bug as accurate as possible as well as a way to reproduce it!
The commands of CMON51 can be classified into these groups:
a) Commands used to display and modify memory.
b) Commands used to display and change registers and SFR.
c) Command to load a hex file.
d) Commands to execute user code.
e) Commands to set and display software breakpoints.
f) Disassembly.
For these commands [start] is the beginning of the memory you want to display, and [length] is the number of bytes. Both are plain hex numbers, and you neither have to add ’0’ to the beginning of the number nor ‘H’ to the end. CMON51 is case insensitive. If [start] is missing, the display will begin at zero, except for indirectly addressable internal RAM which is located at address 80H. If length is missing, the default length of 80H will be used. These are the memory display commands:
X [start] [length]: Displays expanded ram
D [start] [length]: Displays internal direct ram
I [start] [length]: Displays
internal indirect ram
C [start] [length]: Displays code memory
Examples:
> x
X:0000: 22 00 00 00 F0 40 22 09-05 46 55 55 55 40 00 C0 "....@"..FUUU@..
X:0010: 3B 34 00 00 80 3F 10 00-0B 00 74 02 00 00 00 00 ;4...?....t.....
X:0020: 00 00 0A 00 00 00 7A 3F-00 40 7A 44 0D 0C 00 5B ......z?.@zD...[
X:0030: 01 E2 3E 5B 01 E2 44 27-6F 80 A3 ED E7 B2 6F 12 ..>[..D'o.....o.
X:0040: 83 3A 00 77 00 40 C8 CC-4C 3D C8 CC 4C 3F 00 00 .:.w.@..L=..L?..
X:0050: 00 00 00 00 00 66 29 6F-80 07 00 01 00 00 9A 99 .....f)o........
X:0060: D9 40 4D EB 00 3F 9E D5-62 3F 00 00 F0 40 0C 00 .@M..?..b?...@..
X:0070: 5B 01 E2 3E 00 00 F0 40-01 00 DB 0F C9 40 D2 53 [..>...@.....@.S
> x 10 20
X:0010: 3B 34 00 00 80 3F 10 00-0B 00 74 02 00 00 00 00 ;4...?....t.....
X:0020: 00 00 0A 00 00 00 7A 3F-00 40 7A 44 0D 0C 00 5B ......z?.@zD...[
> x 200 200
X:0200: 00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00 ................
X:0210: 00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00 ................
X:0220: 00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00 ................
X:0230: 00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00 ................
X:0240: 00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00 ................
X:0250: 00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00 ................
X:0260: 00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00 ................
X:0270: 00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00 ................
X:0280: 00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00 ................
X:0290: 07 47 6E 00 00 00 00 00-00 00 00 00 00 00 00 00 .Gn.............
X:02A0: 78 20 32 30 30 20 32 30-30 00 00 00 00 00 00 00 x.200.200.......
X:02B0: 00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00 ................
X:02C0: 09 AA AA AA AA AA AA AA-AA AA AA AA AA AA AA AA ................
X:02D0: 55 55 55 55 55 55 55 55-55 55 55 55 55 55 55 55 UUUUUUUUUUUUUUUU
X:02E0: AA AA AA AA AA AA AA AA-AA AA AA AA AA AA AA AA ................
X:02F0: 55 55 55 55 55 55 55 55-55 55 55 55 55 65 56 55 UUUUUUUUUUUUUeVU
X:0300: FF FF FF FF FF FF FF FF-FF FF FF FF FF FD FE FF ................
X:0310: FF FF FF FF FF FF FF FF-FF FF FF FF FF FD FE FF ................
X:0320: FF FF FF FF FF FF FF FF-FF FF FF FF FF FD FE FF ................
X:0330: FF FF FF FF FF FF FF FF-FF FF FE FF FF FD FE FF ................
X:0340: FF FF FF FF FF FF FF FF-FF FF FF FF FF FD FE FF ................
X:0350: FF FF FF FF FF FF FF FF-FF FF FF FF FF FD FE FF ................
X:0360: FF FF FF FF FF FF FF FF-FF FF FE FF FF FD FE FF ................
<Space>=line <Enter>=page <ESC>=stop
> d
D:00: 00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00 ................
D:10: 00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00 ................
D:20: 00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00 ................
D:30: 00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00 ................
D:40: 00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00 ................
D:50: 00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00 ................
D:60: 00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00 ................
D:70: 00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00 ................
>
> i
I:80: 00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00 ................
I:90: 00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00 ................
I:A0: 00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00 ................
I:B0: 00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00 ................
I:C0: 00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00 ................
I:D0: 00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00 ................
I:E0: 00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00 ................
I:F0: 00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00 ................
>
> c e000 35
C:E000: 02 F7 4A 02 F3 4E 12 E8-5C 80 FE 02 DF 04 02 DF ..J..N..\.......
C:E010: 00 AA 82 AB 83 AC F0 8A-82 8B 83 8C F0 12 F7 2A ...............*
C:E020: FD 24 FF 50 28 BD 80 00-50 23 10 99 02 80 FB 8A .$.P(...P#......
C:E030: 82 8B 83 8C F0 12 F7 2A-FD 8D 99 BD 0A 08 10 99 .......*........
>
To edit memory, use the commands below. Start is the beginning of the memory to be modified. The current memory content will be displayed followed by a dot. At this point you may add a new value, or press <Space> to leave the value unchanged and display/modify the next memory location. Press <Enter> to stop editing.
MX [start]: Modify external RAM
MD [start]: Modify internal directly addressable RAM
MI [start]: Modify internal indirectly addressable RAM
Example:
> mx 110
X:0110: 00.11 00.22 00.33 00.44 00.55 00.66 00.77 00.88
X:0118: 00.
> x 110 10
X:0110: 11 22 33 44 55 66 77 88-00 00 00 00 00 00 00 00 ."3DUfw.........
>
For these commands [start] is the beginning of the memory you want to fill, [length] is the number of bytes, and [value] is the hex number the memory will be set to. For these commands, the three parameters are mandatory.
FX [start] [length] [value]:
fill expanded ram
FD [start] [length] [value]: fill direct internal ram
FI [start] [length] [value]: fill indirect internal ram
Example:
> fi c0 20 aa
> i
I:80: 00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00 ................
I:90: 00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00 ................
I:A0: 00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00 ................
I:B0: 00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00 ................
I:C0: AA AA AA AA AA AA AA AA-AA AA AA AA AA AA AA AA ................
I:D0: AA AA AA AA AA AA AA AA-AA AA AA AA AA AA AA AA ................
I:E0: 00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00 ................
I:F0: 00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00 ................
>
To display registers, SFR, and bits, just type the corresponding name. For example:
CMON51 V1.0
Copyright (c) 2005 Jesus Calvino-Fraga
Port: P89V51RD2 V1.0
> a
00
> t2mod
FC
> r1
00
> p1
FF
> cy
0
> p1_3
1
>
To change a register, SFR, or bit, type the corresponding name the ‘=’ and then the value. For example:
> a=f0
> a
F0
>
Some of the most common used registers can be displayed at once using command ‘R’:
> r
A =F0 B =00 SP=07 IE=00 DPH=00 DPL=00 PSW=00 PC=72FC
R0=00 R1=00 R2=00 R3=00 R4=00 R5=00 R6=00 R7=00 BANK 0
>
Notice that the register bank displayed is indicated as well. To see R0 to R7 for all four register banks, just display the directly addressable memory from address 0:
> d
D:00: 00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00 ................
D:10: 00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00 ................
D:20: 00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00 ................
D:30: 00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00 ................
D:40: 00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00 ................
D:50: 00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00 ................
D:60: 00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00 ................
D:70: 00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00 ................
>
Warning: Since the internal addressable memory and registers A, B, DPTR, SP, PSW, and IE are used by CMON51, they are preserved in external RAM when CMON51 is running, and restored before the user program runs. ALL OTHER REGISTERS ARE NOT PRESERVED, and changing them may crash CMON51. If that happens, you may have to reset the microcontroller. For example, altering TH1, will change the baud rate the microcontroller is using to communicate with the terminal program:
> th1
FF
> th1=fe
ø ß------Wrong baud rate: garbage on the screen
ß------Reset
CMON51 V1.0
Copyright (c) 2005 Jesus Calvino-Fraga
Port: P89V51RD2 V1.0
>
CMON51 is programmed so that you can use the SFR’s and bits proper names instead of their addresses. The names are port dependant and come from the microcontroller manufacturer datasheet. For the P89V51RD2 port of CMON51, these are the SFRs recognized by CMON51:
P0, SP, DPL, DPH, WDTD, SPDR, SPDAT, PCON, TCON, TMOD, TL0, TL1, TH0, TH1, AUXR, P1, SCON, SBUF, P2, AUXR1, IE, SADDR, SPSR, SPCFG, P3, FCF, FST, IP0H, IP, SADEN, WDTC, T2CON, T2MOD, RCAP2L, RCAP2H, TL2, TH2, PSW, SPCR, SPCTL, CCON, CMOD, CCAPM0, CCAPM1, CCAPM2, CCAPM3, CCAPM4, ACC, A, IEN1, CL, CCAP0L, CCAP1L, CCAP2L, CCAP3L, CCAP4L, B, IP1H, IP1, CH, CCAP0H, CCAP1H, CCAP2H, CCAP3H, CCAP4H, DPTR, and PC.
For the P89V51RD2, these are the bits recognized by CMON51:
IT0, IE0, IT1, IE1, TR0, TF0, TR1, TF1RI, TI, RB8, TB8, REN, SM2, SM1, SM0, EX0, ET0, EX1, ET1, ES, EA, PX0, PT0, PX1, PT1, PT2, PS, P, F1, OV, RS0, RS1, F0, AC, CY, CP_RL2, C_T2, TR2, EXEN2, TCLK, RCLK, EXF2, TF2, ET2, CF, CR, CCF4, CCF3, CCF2, CCF1, CCF0, EC, EBO, PPC, and PBO.
CMON51 will recognize individual bits of any register. Just append period (‘.’) followed by the bit number to the SFR name. For example:
CMON51 V1.0
Copyright (c) 2005 Jesus Calvino-Fraga
Port: P89V51RD2 V1.0
> p1.0
1
> p1.0=0
> p1
FE
> p1.0
0
>
This command should behave differently depending on the 8051 variant you are using. For some 8051s with internal flash, the flash will be erased before downloading can begin. For example, for CMON51 running in a Philips P89V51RD2 this will happen:
CMON51 V1.0
Copyright (c) 2005 Jesus Calvino-Fraga
Port: P89V51RD2 V1.0
> L
Erasing............................
Send file or <Esc>
The erasing of the flash memory will take 9 or 10 seconds for a P89V51RD2 microcontroller. After that, you can send the hex file. If you are using HyperTerminal, click ‘Transfer’->’Send Text File…’, select the hex file you want to send and press ‘Open’. The file will be send line by line. CMON51 will echo a period ‘.’ for each line received:
>
CMON51 V1.0
CopyRight (c) 2005 Jesus Calvino-Fraga
Port: P89V51RD2 V1.0
> L
Erasing............................
Send file or <Esc>
................................................................................
................................................................................
................................................................................
................................................................................
................................................................................
................................................................................
................................................................................
................................................................................
................................................................................
................................................................................
................................................................................
................................................................................
.
Done.
>
If instead of periods you see ‘X’s, the hex file was received with errors. For the P89V51RD2 microcontroller, make sure your terminal program is set to 115000 baud, 8 bits, 2 stop bits, and no parity and try again. If you get this message:
WARNING: missing Timer1 jmp
It means that your code did not reserve space for the timer 1 interrupt which CMON51 uses to implement the single step command. If your program is written in assembly, make sure you have something like this
org 0000H
ljmp start
org 001BH
ljmp 001BH
start:
;your code starts here
Of course, the actual ljmp can point to anything. CMON51 will replace it with the correct address for the single step routine. CMON51 will also replace the address of the first jump, so that when the microcontroller is reset it executes the monitor not the user program. If the user code has a ljmp at address 0, CMON51 will set the default program counter to that particular address:
> pc
72FC
> r
A =00 B =00 SP=07 IE=00 DPH=00 DPL=00 PSW=00 PC=72FC
R0=00 R1=00 R2=00 R3=00 R4=00 R5=00 R6=00 R7=00 BANK 0
>
Additionally, you can write the interrupt service routines for other interrupts as you will normally do. If you are using the sdcc compiler, something like this in your main project file will work just fine:
void dummyint3 (void) interrupt 3 _naked {}
The following commands allow executing the loaded user code:
G [start]
This command will run the user program from address ‘start’. If start is zero, or not included, the ‘G’ command will start from the current value of the program counter. For instance, the command
> g 100
and
> pc=100
> g
are equivalent. Remember, the program counter (PC) is set to the address of the ljmp instruction found in address 0 after you download a file using command ‘L’. The ‘G’ command will run the user program at full speed, and software breakpoints will be ignored. You can add hardware breakpoints to your program by calling the monitor breakpoint routine. In assembly you can insert this instruction in your code
lcall 01bh
If you are programming in ‘C’ using sdcc, you can add the same instruction using in-line assembly:
_asm lcall 0x1b _endasm;
To return to the monitor from your code,
S [start] step one assembly instruction
This is similar to command G, except that only one instruction is executed at a time, then the registers and the next instruction to be executed are displayed in the terminal:
> s 72c0
A =00 B =00 SP=07 IE=80 DPH=00 DPL=00 PSW=00 PC=72C2
R0=00 R1=00 R2=00 R3=00 R4=00 R5=00 R6=00 R7=00 BANK 0
72C2: 9E subb a,r6
> s
A =00 B =00 SP=07 IE=80 DPH=00 DPL=00 PSW=00 PC=72C3
R0=00 R1=00 R2=00 R3=00 R4=00 R5=00 R6=00 R7=00 BANK 0
72C3: C2 D1 clr F1
>
To see where your program is, and where is going, you can use the unassemble command:
> u 72c3 10
72C3: C2 D1 clr F1
72C5: F5 82 mov DPL,a
72C7: 12 35 80 lcall 3580
72CA: 02 50 F3 ljmp 50F3
72CD: AA 82 mov r2,DPL
72CF: AB 83 mov r3,DPH
72D1: A2 F7 mov c,B_7
72D3: 33 rlc a
72D4: 92 D1 mov F1,c
72D6: 60 02 jz 72DA
72D8: D2 F7 setb B_7
72DA: F5 82 mov DPL,a
72DC: AC F0 mov r4,B
72DE: 22 ret
72DF: E5 82 mov a,DPL
72E1: 90 02 58 mov dptr,#0258
>
The format of the ‘U’ command is
U [start] [lines]
[start] is where CMON51 will begin unassembling. [lines] is the number of lines of assembly code to be displayed. If [lines] is zero or empty, one line will be unassembled.
T [address] step until address
This command is similar to the step (‘S’) command, but single steps will be executed until the program counter (PC) reaches [address]. Every instruction will be displayed in the terminal as it is executed. When the PC reaches [address] the registers and the next instruction to be executed are displayed in the screen:
> t 33bc
33AE: 74 F0 mov a,#F0
33B0: 55 89 anl a,TMOD
33B2: 44 01 orl a,#01
33B4: F5 89 mov TMOD,a
33B6: 75 8A EA mov TL0,#EA
33B9: 75 8C 03 mov TH0,#03
A =21 B =00 SP=5C IE=80 DPH=00 DPL=00 PSW=00 PC=33BC
R0=00 R1=00 R2=00 R3=00 R4=00 R5=00 R6=00 R7=00 BANK 0
33BC: E4 clr a
>
If you run your code using this command, it will run at a fraction of its actual speed as compared to the ‘G’ command. Also, you can make it run forever just by setting [address] to an unreachable location. For example
> t ffff
will display all the instructions as they are executed. To stop the execution hit any key.
TR [address] same as T but shows the registers every time
> r
A =21 B =00 SP=5C IE=80 DPH=00 DPL=00 PSW=00 PC=33BC
R0=00 R1=00 R2=00 R3=00 R4=00 R5=00 R6=00 R7=00 BANK 0
> tr 33c3
33BC: E4 clr a
A =00 B =00 SP=5C IE=80 DPH=00 DPL=00 PSW=00 PC=33BD
R0=00 R1=00 R2=00 R3=00 R4=00 R5=00 R6=00 R7=00 BANK 0
33BD: F5 08 mov 08,a
A =00 B =00 SP=5C IE=80 DPH=00 DPL=00 PSW=00 PC=33BF
R0=00 R1=00 R2=00 R3=00 R4=00 R5=00 R6=00 R7=00 BANK 0
33BF: F5 09 mov 09,a
A =00 B =00 SP=5C IE=80 DPH=00 DPL=00 PSW=00 PC=33C1
R0=00 R1=00 R2=00 R3=00 R4=00 R5=00 R6=00 R7=00 BANK 0
33C1: F5 0A mov 0A,a
A =00 B =00 SP=5C IE=80 DPH=00 DPL=00 PSW=00 PC=33C3
R0=00 R1=00 R2=00 R3=00 R4=00 R5=00 R6=00 R7=00 BANK 0
33C3: F5 0B mov 0B,a
>
GB [address] go until a software breakpoint
This command works similarly to the ‘T’ command, but nothing is sent to the terminal. When the program counter reaches one of four possible breakpoint addresses, it will stop execution. To setup the breakpoints, use the commands
BR0 = [address]
BR1 = [address]
BR2 = [address]
BR3 = [address]
To clear all software breakpoints use the command
BRC
To display the software breakpoints, use
BR
The execution when using GB is somehow faster than that of the T and TR commands. Nevertheless, it is way slower than the G command.
<CTRL>+V: retypes the last command.
PCR: restores the PC to the value obtained when the file was originally downloaded.