SIEMENS C500 microcontroller architecture and instruction set

The cornerstone of embedded real-time control: C500 microcontroller architecture and deep analysis of instruction set

Introduction: Embedded Solutions Beyond Standard 8051

In embedded real-time systems such as industrial control, automotive electronics, and communication equipment, the architecture efficiency and instruction set capability of microcontrollers (MCUs) directly determine the system response speed, code density, and development flexibility. The Intel 8051 architecture, with its decades of proven stability and rich ecosystem, remains the preferred kernel for many embedded applications today. However, with the increasing complexity of peripherals and the demand for higher data throughput, the traditional 8051's single data pointer and limited memory management capabilities have gradually become system bottlenecks.

The Siemens C500 microcontroller family emerged in this context. It provides engineers with an upgrade path that inherits both classic and modern requirements by introducing multiple architectural enhancements, including up to 8 data pointers, scalable on-chip XRAM (external RAM), enhanced interrupt handling mechanisms, and flexible memory mapping, while maintaining 100% binary compatibility with the standard 8051 instruction set. This article will delve into the memory organization, CPU core characteristics, interrupt response timing, and complete instruction set functionality of the C500 family, aiming to help embedded developers fully unleash the performance potential of the C500 architecture when migrating existing 8051 projects or designing new systems.

Memory Architecture: Fine Layered Harvard Structure

The memory organization of the C500 family follows the classic Harvard Architecture, which physically separates program memory and data memory, each with its own independent address space and bus. The advantage of this design is that instruction prefetching and data access can be performed in parallel, thereby improving execution efficiency. Specifically, the storage resources of C500 are divided into five independent address spaces, as shown in Table 1.

Table 1 C500 Address Space Division

Memory type, location, capacity

Maximum external program memory size of 64 KB

Program memory internal (ROM/EEPROM) varies by model: 2 KB to 64 KB

Maximum external data storage capacity of 64 KB

Internal XRAM of data storage varies by model: 256 bytes to 3 KB

Internal IRAM 128 or 256 bytes in data storage

128/256 bytes inside the special function register

1. Program memory configuration and EA pin strategy

The access to program memory is controlled by the EA (External Access) pin, which provides great flexibility for system design:

EA=0 (low level): The CPU always retrieves data from external program memory. This mode is suitable for debugging/simulation scenarios where there is no ROM version or where internal ROM needs to be completely bypassed.

EA=1 (high level): The CPU prioritizes the use of internal program memory. When the address of the program counter (PC) exceeds the capacity limit of the internal ROM (for example, for C501 with built-in 8 KB ROM, the limit is 1FFF H), the CPU will automatically switch to the external program memory to continue execution. This' Code Rollover 'feature allows engineers to seamlessly expand when internal ROM space is insufficient without modifying the jump logic of existing code.

2. Triple structure of internal data storage

The Internal Data RAM (IRAM) is the core of the C500 data path, and its address space is divided into three physically independent but logically overlapping regions:

Low 128 bytes (00H-7FH): Directly addressable (direct addressing) or indirectly addressable (via R0/R1). This area contains four general-purpose register groups (each 8 bytes, i.e. R0-R7), which select the current active group through the RS1 and RS0 bits in the PSW register. In addition, the 16 bytes of byte addresses 20H-2FH provide 128 bit addressing units (bit addresses 00H-7FH), which are particularly suitable for efficient processing of Boolean variables.

High 128 bytes (80H - FFH): can only be accessed through indirect addressing (MOV @ Ri). The existence of this area allows the total internal RAM capacity to reach 256 bytes, but it must be distinguished from the SFR area through the correct addressing mode.

Special function register area (80H-FFH): can only be accessed through direct addressing. SFRs ending in 80H, 88H, 90H,..., F0H, FFH (i.e. the lower 3 bits of the address are 0) support bit addressing operations, with a bit address range of 80H-FFH. Common SFRs include accumulator (ACC), B register, program state word (PSW), stack pointer (SP), data pointer low 8-bit (DPL), and high 8-bit (DPH).

3. On chip XRAM: an acceleration solution for expanding data storage

Multiple C500 derivative models have integrated additional data storage - XRAM - inside the chip. From a logical address perspective, XRAM is located at the high end of the external data storage space (but the specific mapping depends on the model, except for C502), while its physical implementation is located on-chip. Accessing XRAM requires the use of MOVX instructions (similar to accessing external data storage), but because it does not require an external bus (P0 and P2 ports), its access speed is much faster than that of real external RAM. Through software control, XRAM can be disabled, and MOVX access to that address range will automatically redirect to the external bus, providing convenience for system expansion. More importantly, in Power Saving Modes, the content of XRAM is preserved, which is crucial for applications that require the retention of critical data in low-power states.

CPU core enhancement: breaking through the bottleneck of single data pointer

One of the most significant architectural improvements in the C500 series is the extension of Data Pointer (DPTR). The standard 8051 only has one 16 bit DPTR for accessing external data storage or external I/O. In applications that require frequent switching between multiple memory regions or peripheral addresses, software must repeatedly perform PUSH/POP operations to save and restore DPTR, which not only consumes additional instruction cycles but also occupies valuable internal RAM stack space.

1. Implementation mechanism of eight data pointers

C500 cleverly implements up to 8 16 bit data pointers (DPTR0 to DPTR7) while maintaining full compatibility with the 8051 instruction set. Its core is an SFR called DPSEL (Data Pointer Select Register, address 92H), whose lower 3 bits (DPSEL. 2-DPSEL. 0) are used to select the currently activated DPTR. From a software perspective, any instruction to operate DPTR (such as MOV DPTR, # data16, MOVX A, @ DPTR, INC DPTR, etc.) only acts on the DPTR pointer currently selected by DPSEL. Switching data pointers only requires one instruction (such as MOV DPSEL, # 06H selecting DPTR6), without the need to use multiple instructions to save and restore pointer values like standard 8051.

2. Analysis of Performance Improvement Examples

To visually demonstrate the advantages of multiple data pointers, consider a typical table lookup transfer task: transfer a data table with a starting address of 1FFF H from the code memory (ROM) to a buffer with a starting address of 2FA0 H in the external data memory.

Using a single data pointer (such as standard C501): Each time a byte is moved, the source pointer and destination pointer need to be saved separately to the "shadow variables" in the internal RAM. For every byte moved, it takes approximately 28 machine cycles and consumes 4 bytes of RAM as shadow variables.

Use dual data pointers (such as C509): During initialization, store the source pointer in DPTR6 and the destination pointer in DPTR7. In each loop, only one MOV DPSEL instruction # 06H is needed to switch to the source pointer, read bytes, and then another MOV DPSEL instruction # 07H switches to the destination pointer for writing. It only takes about 12 machine cycles to move one byte, and there is no need for additional shadow variables.

According to the performance data provided in the manual, using multiple data pointers in the same table transfer task can reduce the execution time by half (from 28 cycles to approximately 12-14 cycles), while freeing up internal RAM space. When all 8 pointers are used simultaneously, a maximum of 24 bytes of RAM can be released for the application (16 bytes for storing pointer variables and 8 bytes for avoiding stack operations). This feature is particularly important for large-scale projects using high-level programming languages such as C51 and PLM51, as their code generation efficiency is relatively low and they tend to frequently use pointers.

3. Enhanced Hooks simulation concept

The C500 family has also introduced innovative Enhanced Hooks simulation technology. Traditionally, simulating on-chip ROM type MCUs requires expensive "bond out" chips (i.e. special versions that lead out the internal bus). The C500 integrates dedicated simulation logic inside each mass-produced chip. With the external EH-IC (Enhanced Hooks Interface Chip), the mass-produced chip itself can achieve full functional simulation, including single step execution, reading SFR after breakpoints, and simulation of all ROM/ROMless modes. This ensures that the simulated chip is identical to the mass-produced chip, eliminating behavioral differences introduced by using different wafer batches, while reducing the cost of in circuit simulators (ICE).

Interrupt system: precise guarantee of real-time response

Interrupt latency is a key indicator in real-time control systems. The interrupt handling mechanism of C500 has strict temporal determinism, allowing engineers to accurately calculate the worst-case response time.

1. Interrupt Vector and Hardware Response Process

Each interrupt source has a fixed interrupt vector address located at the low end of the code storage area. The vector address interval is 8 bytes (such as 0003H, 000BH, 0013H, etc.), and usually a jump instruction is placed here to point to the real service program. When an interrupt is accepted by the CPU, the hardware will automatically perform the following operations:

Complete the execution of the current instruction.

Push the current value of the program counter (PC) onto the stack (16 bits, low byte first).

Load the entry address (vector address) of the interrupt service program into the PC.

The program jumps to interrupt service program execution.

Important note: Not all interrupt hardware will automatically clear the interrupt request flag. Partial interrupt sources require users to clear the flag through software in the service program, otherwise the interrupt will be triggered repeatedly.

2. Blocking conditions for interrupt response

The generation of hardware LCALL (long call) will be blocked by any of the following three conditions:

Condition 1 (Priority Blocking): Currently processing an interrupt of the same or higher priority.

Condition 2 (instruction completion blocking): The current instruction has not yet been executed to the last machine cycle. This ensures that the current instruction can be fully executed.

Condition 3 (Critical Instruction Blocking): The currently executing instruction is RETI (Interrupt Return), or an instruction that writes to the Interrupt Allow Register (IE) or Interrupt Priority Register (IP). The blocking will continue until the instruction is executed and another instruction is executed. This mechanism ensures that modifications to the interrupt system can take effect stably.

3. Precise calculation of interrupt response time

The interrupt response time is defined as the time interval between the time when the external interrupt request signal takes effect (the request flag is set) and the time when the first instruction of the interrupt service program starts executing.

According to the timing analysis in the manual, an interrupt requires at least 3 complete machine cycles from being detected to completing hardware LCALL (1 cycle for detecting flags and 2 cycles for executing LCALL). In the worst-case scenario, if the interrupt request encounters a blocking condition, the response time will be extended:

If blocked by condition 2 (instruction not completed), the maximum waiting time shall not exceed 3 cycles. Because the longest instruction (MUL or DIV) only requires 4 cycles, and interrupt detection occurs in the last cycle of each instruction.

If blocked by condition 3 (RETI or write IE/IP), the maximum waiting time should not exceed 5 cycles (1 cycle to complete the current RETI/write operation, plus up to 4 cycles to complete the immediately following instruction - if that instruction happens to be MUL or DIV).

Therefore, for a single interrupt system, the interrupt response time of C500 is always between 3 and 9 machine cycles. For a 12MHz crystal oscillator system (one machine cycle=1 µ s), this corresponds to a delay of 3 µ s to 9 µ s, providing highly predictable performance for hard real-time applications.

External Memory Access Timing and Bus Design

C500 accesses external program memory and data memory through standard bus interfaces, and understanding its timing is crucial for hardware design.

1. Address/data reuse

When accessing external memory, the P0 port assumes the time division multiplexing function for the low 8-bit address and 8-bit data, while the P2 port outputs the high 8-bit address (for MOVX @ DPTR or external fetch) or maintains its SFR content (for MOVX @ Ri). External address latches (such as 74HC373) use the falling edge of the ALE (Address Latch Enable) signal to latch the lower 8 bits of the address on port P0. Afterwards, the P0 port is switched to the data bus.

2. Two access modes

16 bit address access (MOVX @ DPTR): P2 port continuously outputs the content of DPH (high 8-bit address) throughout the entire access cycle. P0 port outputs DPL when ALE is valid, and then switches to data signal. This mode can access a complete address space of 64 KB.

8-bit address access (MOVX @ Ri): The P2 port maintains its existing SFR value throughout the entire cycle and does not automatically output the higher 8 bits of the address. The CPU uses the P0 port to output the content of Ri (8-bit address) and multiplex it with the data. This method is commonly used for "paging" expansion, where the P2 port is pre-set as a page address by software to enable external RAM access exceeding 256 bytes.

Important hardware precautions: During external memory access, the CPU will write FF H to the P0 port latch (SFR). Therefore, during external memory access, the software must not execute the MOV P0 instruction to modify the P0 port, otherwise it will damage the current bus cycle data. In addition, for the ROM free version (EA grounded), the entire 64 KB program space is external, and the P2 port will be fully occupied as an address line, which cannot be used for general-purpose I/O.

Instruction set: Functional classification and optimization of 111 instructions

The instruction set of C500 is fully compatible with the standard 8051, with a total of 111 instructions, including 49 single byte instructions (44%), 45 double byte instructions (41%), and 17 three byte instructions (15%). Efficient instruction encoding means that C500 can achieve higher code density at the same clock frequency.

Overview of Addressing Modes

C500 supports 5 addressing modes, each corresponding to a specific memory space, as shown in Table 2.

Table 2 Addressing Modes and Corresponding Memory Spaces

Memory space accessed in addressing mode

Address the R0-R7, ACC, B, CY bits of the currently selected register group DPTR

Directly addressing the low 128 bytes of internal RAM SFR

Immediate addressing of program memory (constant)

Register indirect addressing internal RAM (@ R0/@ R1/SP), external data storage (@ R0/@ R1/@ DPTR)

Base address register plus index addressing program memory (@ A+DPTR, @ A+PC), used for lookup tables

2. PSW impact of arithmetic operation instructions

Most arithmetic instructions affect the flag bits in the program state word (PSW), and engineers must pay attention when writing multi precision or signed operations:

CY (carry flag): When adding, if bit 7 has a carry, set it to 1; When subtracting, if bit 7 needs to be borrowed, set it to 1. The MUL and DIV commands will reset CY to zero.

OV (overflow flag): Used for signed number operations. When two positive numbers add up to a negative number, or when two negative numbers add up to a positive number, set it to 1. In MUL, if the product is greater than 255, OV is set to 1; In DIV, if the divisor is 0, OV is set to 1.

AC (auxiliary carry flag): When adding, if there is a carry from bit 3 to bit 4, set it to 1; When subtracting, if bit 3 needs to borrow from bit 4, set it to 1. Used for BCD adjustment (DA A instruction).

3. Boolean processor: an independent unit for bit operations

The C500 integrates an independent Boolean processor internally, and its accumulator is the CY flag. The bit addressing space (including 128 bits of internal RAM and addressable bits of SFR) constitutes its memory. The Boolean instruction set includes:

Bit transfer: MOV C, bit, MOV bit, C

Position bit/reset: SETB bit, CLR bit, CPL bit

Bit logic operation: ANL C, bit, ORL C, bit and its inverse form ANL C,/bit, ORL C,/bit - the result is saved back to CY.

Conditional jump: JB, JNB, JBC

Using a Boolean processor, C500 can directly perform complex logical judgments and operations on a single I/O pin without the need for byte operations and shifts, greatly improving the efficiency of control code.

4. Application scenarios for controlling transfer instructions

Instruction Type Example Jump Range Typical Applications

Unconditional Long Transfer LJMP addr16 64 KB Full Space Large Program Module Jump

Unconditional absolute transfer of AJMP addr11 2 KB page to save code space, short jump within the same page

Short transfer SJMP rel -128 to+127 byte efficient local loop

Indirect jump JMP @ A+DPTR implementation of multi branch jump table (state machine) based on DPTR index jump

Conditional jump CJNE A, if the comparison of # data and rel is not equal, the jump will occur, which also affects the comparison and branching of byte values in CY implementation

Loop control DJNZ Rn, rel minus one non-zero jumps to achieve precise software delay or counting loops

5. Common Instruction Optimization Techniques

MOVC lookup table: MOVC A, @ A+PC is suitable for local tables with a length not exceeding 256 bytes; MOVC A, @ A+DPTR is suitable for large tables that can be located at any position up to 64 KB.

XCHD Swap Low Half Byte: XCHD A, @ Ri can achieve efficient half byte swapping of BCD codes, commonly used for binary to BCD conversion.

SWAP A: Swapping the high 4 bits and low 4 bits of the accumulator is equivalent to shifting the loop left 4 times, which is very useful for quickly organizing packet formats.

The protection sequence of PUSH/POP: In the interrupt service program, if DPTR needs to be protected, PUSH DPL should be pushed first and then PUSH DPH; When restoring, first POP DPH and then POP DPL. This is opposite to the stacking order of LCALL (PC low byte first in).

Software Development and Debugging Practice

1. C language support for multiple data pointers

When using the C51 compiler, it is usually necessary to manipulate DPSEL through embedded assembly or compiler provided extension keywords. A common practice is to write macros or functions:

c//Attention: Adjustments need to be made according to the specific compiler

#define DPSEL   ((unsigned char __sfr __at(0x92)) 

#define SELECT_DPTR(n) (DPSEL = (n))

//Example usage

SELECT_DPTR(3); //Switch to DPTR3

unsigned int myAddr = 0x1234;

DPTR = myAddr; //Here DPTR actually points to DPTR3

SELECT_DPTR(4); //Switch to DPTR4, keeping the previous DPTR3 value unchanged

Some advanced compilers' library functions may have been optimized for multiple data pointers, automatically recognizing and utilizing idle DPTRs to accelerate memory copy operations.

2. Key points of interrupt service program

Use RETI instead of RET to return. RET will keep the interrupt priority state locked, causing subsequent same level or lower level interrupts to be unresponsive.

If the interrupt hardware does not automatically clear the request flag, the software must clear it before RETI, otherwise it will immediately re-enter the interrupt and cause a dead loop.

Try to keep the interrupt service program short and avoid time-consuming multiplication, division, or long loops within the interrupt.

3. Simulation and debugging suggestions

By utilizing Enhanced Hooks simulation technology, mass production chips are directly used in conjunction with EH-IC for debugging, ensuring consistency between the simulation environment and the final product.

When stepping, pay attention to the value of the DPSEL register to confirm which data pointer is currently being used.

Observing the ALE signal with an oscilloscope can confirm whether external bus access is normal. Under normal circumstances, the ALE frequency should be 1/6 of the crystal oscillator frequency (standard mode).