
STR91xFAx32 STR91xFAx42 STR91xFAx44
Functional overview
29/99
JTAG EmbeddedICE-RT protocol on the STR91xFA. These protocol converters are 
commercially available and operate with debugging software tools.
The CPU may be forced into a Debug State by a breakpoint (code fetch), a watchpoint (data 
access), or an external debug request over the JTAG channel, at which time the CPU core 
and memory system are effectively stopped and isolated from the rest of the system. This is 
known as Halt Mode and allows the internal state of the CPU core, memory, and peripherals 
to be examined and manipulated. Typical debug functions are supported such as run, halt, 
and single-step. The EmbeddedICE-RT logic supports two hardware compare units. Each 
can be configured to be either a watchpoint or a breakpoint. Breakpoints can also be data-
dependent.
Debugging (with some limitations) may also occur through the JTAG interface while the CPU 
is running full speed, known as Monitor Mode. In this case, a breakpoint or watchpoint will 
not force a Debug State and halt the CPU, but instead will cause an exception which can be 
tracked by the external host computer running monitor software. Data can be sent and 
received over the JTAG channel without affecting normal instruction execution. Time critical 
code, such as Interrupt Service Routines may be debugged real-time using Monitor Mode.
3.15.4 
JTAG security bit
This is a non-volatile bit (Flash memory based), which when set will not allow the JTAG 
debugger or JTAG programmer to read the Flash memory contents.
Using JTAG ISP, this bit is typically programmed during manufacture of the end product to 
prevent unwanted future access to firmware intellectual property. The JTAG Security Bit can 
be cleared only by a JTAG “Full Chip Erase” command, making the STR91xFA device blank 
(except for programmed OTP bytes), and ready for programming again. The CPU can read 
the status of the JTAG Security Bit, but it may not change the bit value.
3.16 
Embedded trace module (ARM ETM9, v. r2p2)
The ETM9 interface provides greater visibility of instruction and data flow happening inside 
the CPU core by streaming compressed data at a very high rate from the STR91xFA though 
a small number of ETM9 pins to an external Trace Port Analyzer (TPA) device. The TPA is 
connected to a host computer using USB, Ethernet, or other high-speed channel. Real-time 
instruction flow and data activity can be recorded and later formatted and displayed on the 
host computer running debugger software, and this software is typically integrated with the 
debug software used for EmbeddedICE-RT functions such as single-step, breakpoints, etc. 
Tracing may be triggered and filtered by many sources, such as instruction address 
comparators, data watchpoints, context ID comparators, and counters. State sequencing of 
up to three triggers is also provided. TPA hardware is commercially available and operates 
with debugging software tools.
The ETM9 interface is nine pins total, four of which are data lines, and all pins can be used 
for GPIO after tracing is no longer needed. The ETM9 interface is used in conjunction with 
the JTAG interface for trace configuration. When tracing begins, the ETM9 engine 
compresses the data by various means before broadcasting data at high speed to the TPA 
over the four data lines. The most common ETM9 compression technique is to only output 
address information when the CPU branches to a location that cannot be inferred from the 
source code. This means the host computer must have a static image of the code being 
executed for decompressing the ETM9 data. Because of this, self-modified code cannot be 
traced.