
STR91xF
Functional overview
23/73
Debugging requires that an external host computer, running debug software, is connected to 
the STR91xF target system via hardware which converts the stream of debug data and 
commands from the host system’s protocol (USB, Ethernet, etc.) to the JTAG EmbeddedICE-
RT protocol on the STR91xF. These protocol converters are commercially available and 
operate with debugging software tools.
The CPU may be forced into a Debug State by a breakpoint (code fetch), a watchpoint (data 
access), or an external debug request over the JTAG channel, at which time the CPU core and 
memory system are effectively stopped and isolated from the rest of the system. This is known 
as Halt Mode and allows the internal state of the CPU core, memory, and peripherals to be 
examined and manipulated. Typical debug functions are supported such as run, halt, and 
single-step. The EmbeddedICE-RT logic supports two hardware compare units. Each can be 
configured to be either a watchpoint or a breakpoint. Breakpoints can also be data-dependent.
Debugging (with some limitations) may also occur through the JTAG interface while the CPU is 
running full speed, known as Monitor Mode. In this case, a breakpoint or watchpoint will not 
force a Debug State and halt the CPU, but instead will cause an exception which can be tracked 
by the external host computer running monitor software. Data can be sent and received over 
the JTAG channel without affecting normal instruction execution. Time critical code, such as 
Interrupt Service Routines may be debugged real-time using Monitor Mode.
2.15.4 JTAG security bit
This is a non-volatile bit (Flash memory based), which when set will not allow the JTAG 
debugger or JTAG programmer to read the Flash memory contents.
Using JTAG ISP, this bit is typically programmed during manufacture of the end product to 
prevent unwanted future access to firmware intellectual property. The JTAG Security Bit can be 
cleared only by a JTAG “Full Chip Erase” command, making the STR91xF device blank and 
ready for programming again. The CPU can read the status of the JTAG Security Bit, but it may 
not change the bit value.
2.16 Embedded trace module (ARM ETM9, v. r2p2)
The ETM9 interface provides greater visibility of instruction and data flow happening inside the 
CPU core by streaming compressed data at a very high rate from the STR91xF though a small 
number of ETM9 pins to an external Trace Port Analyzer (TPA) device. The TPA is connected to 
a host computer using USB, Ethernet, or other high-speed channel. Real-time instruction flow 
and data activity can be recorded and later formatted and displayed on the host computer 
running debugger software, and this software is typically integrated with the debug software 
used for EmbeddedICE-RT functions such as single-step, breakpoints, etc. Tracing may be 
triggered and filtered by many sources, such as instruction address comparators, data 
watchpoints, context ID comparators, and counters. State sequencing of up to three triggers is 
also provided. TPA hardware is commercially available and operates with debugging software 
tools.
The ETM9 interface is nine pins total, four of which are data lines, and all pins can be used for 
GPIO after tracing is no longer needed. The ETM9 interface is used in conjunction with the 
JTAG interface for trace configuration. When tracing begins, the ETM9 engine compresses the 
data by various means before broadcasting data at high speed to the TPA over the four data 
lines. The most common ETM9 compression technique is to only output address information 
when the CPU branches to a location that cannot be inferred from the source code. This means