when should i

22
1 When given the choice between using an oscilloscope or a logic analyzer, many people will choose an oscilloscope. Why? Because a scope is more £amiliar to most users. There is one on virtually every engineer's bench, and it is relatively easy to use. It is one 0£ the most "general purpose" 0£ all electronic instruments. However, it has some shortcomings that limit its usefulness in some applications. A logic analyzer may yield more useful information in many 0£ these applications. However, since a logic analyzer is "tuned" to the digital world, it doesn't have as broad a use as an oscilloscope. Because 0£ some overlapping capabilities between a scope and a logic analyzer, either may be used in some cases. How do you detem\ine which is better £or your application? The next £ew paragraphs give some basic guidelines. Oscilloscope or Logic Analyzer? 1-1

Upload: others

Post on 06-Feb-2022

2 views

Category:

Documents


0 download

TRANSCRIPT

Page 1: When Should I

1

When given the choice between using an oscilloscope or alogic analyzer, many people will choose an oscilloscope.Why? Because a scope is more £amiliar to most users.There is one on virtually every engineer's bench, and it isrelatively easy to use. It is one 0£ the most "generalpurpose" 0£ all electronic instruments. However, it hassome shortcomings that limit its usefulness in someapplications. A logic analyzer may yield more usefulinformation in many 0£ these applications. However, sincea logic analyzer is "tuned" to the digital world, it doesn'thave as broad a use as an oscilloscope. Because 0£ someoverlapping capabilities between a scope and a logicanalyzer, either may be used in some cases. How do youdetem\ine which is better £or your application? The next£ew paragraphs give some basic guidelines.

Oscilloscope or Logic Analyzer?1-1

Page 2: When Should I

When Should IU se a Scope?

.When you need to see small voltage excursions onyour signals.

.When you need high time-interval accuracy.

Generally, an oscilloscope is the instrument to use whenyou need high vertical or voltage resolution. To say itanother way, if you need to see every little voltageexcursion, like those shown below on the bottomwaveform, you need a scope. Many scopes, including thenew generation digitizing ones, can also provide very hightime-interval resolution. That is, they can measure the timeinterval between two events with very high accuracy.Overall, an oscilloscope is to be used when you needparametric information.

.{AutO-Measure) Group Run

~ertod 8.0140 us Freq .Vp-p 4.00 VR1settme 29.563 ns +Hidth 7.9969 us Preshoot 16.0 X.'allttme 6.3328 ns -Htdth 17.084 ns Overshoot 12.0

~

Oscilloscope or Logic Analyzer?1-2

Page 3: When Should I

When Should I Usea Logic Analyzer?

.When you need to see lots of signals at once.

.When you need to look at signals in your system thesame way your hardware does.

.When you need to trigger on a pattern of highs andlows on several lines and see the result.

Logic analyzers grew out of oscilloscopes. They presentdata in the same general way that a scope does; thehorizontal am is time, the vertical am is voltageamplitude. But a logic analyzer does not provide as muchvoltage resolution or time interval accuracy as its cousin,the oscilloscope. It can capture and display eight or moresignals at once, something that scopes cannot do. A logicanalyzer reacts the same way as your logic circuit doeswhen a single threshold is crossed by a signal in yoursystem. It will recognize the signal to be either low orhigh. It can also trigger on patterns of highs and lows onthese signals. So when do you use a logic analyzer? Whenyou need to look at more lines than your oscilloscope canshow you, provided you can live without ultra-precise timeinterval information. 1£ you need to look at every littletransition on the waveform, a logic analyzer is not a goodchoice (see the picture on the previous page). Incidentally,the display on the previous page was made with anHP l65OOA which has both logic analyzer and digitizingscope channels.

Logic analyzers are particularly useful when looking attime relationships or data on a bus -e.g. a microprocessoraddress, data, or control bus. It can decode the informationon microprocessor buses and present it in a meaningfulform (more on this when we talk about state analyzers).Generally, when you are past the parametric stage ofdesign, and are interested in timing relationships amongmany signals and need to trigger on patterns of logic highsand lows, the logic analyzer is a good choice.

Oscilloscope or Logic Analyzer?1-3

Page 4: When Should I
Page 5: When Should I

A timing analyzer is the part of a logic analyzer that isanalogous to an oscilloscope. As a matter of fact, they canbe thought of as close cousins. The timing analyzerdisplays information in the same general form as a scope,with the horizontal axis representing time and the verticalaxis as voltage amplitude. Because the waveforms on bothinstruments are time-dependent, the displays are said to bein the "time domain:'

What's a

Timing Analyzer?

Choosing the RightSampling Method

A timing analyzer works by sampling the input waveformsto determine whether they are high or low. It cares aboutonly one voltage-threshold. If the signal is above thresholdwhen it is sampled, it will be displayed as a lor high bythe analyzer. By the same criterion, any signal sampledthat is below threshold is displayed as a O or low. Fromthese sample points, a list of ones and zeros is generatedthat represents a one-bit picture of the input waveform. Asfar as the analyzer is concerned, the waveform is eitherhigh or low- no intermediate steps. This list is stored inmemory and is also used to reconstruct a one-bit picture ofthe input waveform, as shown below. A timing analyzer islike a digitizing scope with only one bit of verticalresolution. With one bit of resolution, you can display onlytwo states- high or low.

~\

~ESHOLD

t1 ,1 t1,.

t.

t8 t1 ,1 t1 t.

SAWLE POINTS

SAMPLE RESUL TS <8 REPRESENTS BELOW THRESHOLD)

SAMPL£ RESUL TS < 1 REPRESENTS ABOVE THRESHOLD)

TIMIMG ANAL YZER DISPLAY RECONSTRUCTED

f'Ra. SAt6'LE RESUL TS

,.

~

What's a Timing Analyzer?2-2

Page 6: When Should I

Notice the display shown below. These displays areactually the same signal (a sine wave) displayed by adigitizing scope and a timing analyzer.

This tendency to square everything up would seem to limitthe usefulness of a timing analyzer. We should remember,however, that it is not intended as a parametric instrument.H you want to check rise time of a signal with an analyzer,you are using the wrong instrument. But if you need toverify timing relationships among several lines by seeingthem all together, a timing analyzer is the logical (no punintended) choice. For example, imagine that we havedynamic RAM in a system that must be refreshed every 2ms. To ensure that everythmg in memory is refreshedwithin that 2 ms, a counter is used to count upsequentially through all rows of the RAMs and refresheach .H we want to make certain that the counter doesindeed count up through all rows before starting over, atiming analyzer can be set to trigger when the counterstarts and display all of the counts. Parametrics are not ofgreat concern here- we merely want to check that thecounter counts from 1 to N and then starts over.

What's a TIming Analyzer?2-3

Page 7: When Should I

~

When the timing analyzer samples an input line, it iseither high or low. If the line is at one state (high or low)on one sample and the opposite state on the next sample,the analyzer "knows" that the input signal transitioned atsometime in between the two samples. It doesn't knowwhen, so it places the transition point at the next sample,as shown below. This presents some ambiguity as to whenthe transition actually occurred and when it is displayed bythe analyzer. Worst case for this ambiguity is one sampleperiod assuming that the transition occurred immediatelyafter the previous sample point.

I.. TRANSITI~S OCCUR -.1I. B£~EN ~LE POINTS I

1 I

I I I I I I II~UT SIGNAL. i I I'.1 ",

I I: I

t +

S.A..- LE PO I NT S

With this technique however, there is a trade-off betweenresolution and total acquisition time. Remember, that everysampling point uses one memory location. Thus the higherthe resolution (faster sampling rate), the shorter theacquisition window.

What's a Timing Analyzer?2-4

r- .ar";{"1 I ~14- MAXII lKERTAINTY

I II I

ANALYZER DISPLAY I I I

I ~ ANALYZER PlACES TRANSITI~S ~Ir-- ~ f"OLL(M1NG SAMPLE POINT ~

Page 8: When Should I

Transitional

Sampling

When we capture data on an input line with data burstslike in the example below, we have to adjust the samplingrate to high resolution ( e.g. 10 ns) to capture the fastpulses at the beginning. This means however, that a timinganalyzer with 1 k (1024 samples) memory would stopacquiring data after 10.24 p.s and the second data burstcould not be captured.

'_1... ., 141... -.I5.1'5

~ L-#--Jl.J~

6ANPlING POINTS t t t t t t t t t ...~ WEWORY FULl(All STORED IN WEMORY) '.24 X '8n8 .'..2~

, t. 3 4 5 .7 .1.

Note that we sample and store data for a long time wherethere is no activity. This uses up logic analyzer memorywithout providing additional information. All we reallyneed to know is when these transitions occur and if theyare positive or negative. Transitional timing, however, usesmemory efficiently.

What's a Timing Analyzer?2-5

Page 9: When Should I

~To accomplish this, we could use a "transition detector" atthe input of the timing analyzer together with a counter.The timing analyzer will now store only those sampleswhich were preceded by a transition, together with theelapsed time from the last transition. Thus we use onlytwo memory locations per transition and no memory at allif there is no activity at the input. This technique is called"transitional timing" and is used in Hewlett-Packard's1650/16500 family of logic analyzers. In our example we cannot only capture the second burst, but also the third,fourth and fifth, depending how many pulses per burst arepresent. At the same time, we can keep the timingresolution as high as 10 ns.

1.- 188NS .' i~:::: 181t4S .1 sel105

~ --, 811JLSAWLI~ POINTS t t t t t t t t t , ...t t t t t , t t t t t , t

t7

"""

8 9 1. '1 1213

S~LING POINTS ,STORED IN ~~y 1

,8

,14, , , ,

2 3 4 5

ONL Y 28 MEMORY LOCATIONS REQUIRED ( 14 SAMPLING POINTS + 14 TIME INTERVALS)

We can now talk about "effective memory depth" which equalsthe total time data captured divided by the sampling period(10 ns). On the example at the right, which shows typicalmicroprocessor activity, the total time data captured is 260 JLS(26 JLs!div x 10 div) at a sampling period of 10 ns which equalsto an "effective memory depth" of 26 k.

Note:This is a conceptual description of the transitional timing technique.

What's a Timing Analyzer?2-6

Page 10: When Should I

Stete/Timing E ) ( Weyefor.. I) ~ c::::::J

ISMPI. ptrtod .10.000 ns If AccUllulet. 1l Off J,~ .s/0iy

26.0 us I,

~

Marker. 1Off~

~

GlitchCa pture

One headache of digital systems is the infamous "glitch:'Glitches have a nasty habit of showing up at the mostinopportune times with the most disastrous result. How doyou capture a glitch that occurs once every 36 hours andsends your system into the weeds? Once again the timinganalyzer comes to the rescue! Hewlett-Packard analyzershave glitch capture and trigger capability that makes it easyto track down elusive glitch problems.

A glitch can be caused by capacitive coupling betweentraces, power supply ripples, high instantaneous currentdemands by several devices, or any number of otherevents. Because they are difficult for most oscilloscopes todifferentiate from valid transitions, a scope is generally nothelpful in tracking down a glitch. However, since a timinganalyzer samples the incoming data and can keep track ofany transitions that occur between samples, it can readilyrecognize a glitch. In the case of an analyzer, a glitch isdefined as any transition that crosses logic threshold morethan once between samples.

What's a TIming Analyzer?2-7

Page 11: When Should I

.

The analyzer already keeps track of all single transitionsthat occur between samples, as we discussed before. Torecognize a glitch, we "teach" the analyzer to keep track ofall multiple transitions and display them as glitches.

While displaying glitches is a useful capability, it can alsobe helpful to have the ability to trigger on a glitch anddisplay data that occurred before it. This can help us todetermine what caused it. This capability also enables theanalyzer to capture data only when we want it -when theglitch occurred. Think about the example we mentioned inthe beginning paragraph of this section. We have a systemthat crashes periodically because a glitch appears on one ofthe lines. Since it occurs infrequently, to store data all thetime (assuming we had enough storage capability) wouldresult in an incredible amount of information to sortthrough. Another alternative is to use an analyzer withoutglitch trigger capability and sit in front of the machinepressing the RUN button and waiting until you see theglitch. Unfortunately, neither of the above are practicalalternatives. If we can tell the analyzer to trigger on aglitch, it can stop when it finds one, capturing all the datathat happened before it. We let the analyzer be thebabysitter and when the system crashes, we have a recordof what led up to the error.

IANALYZERI~T

S.A.aFLE tPOINTS

4-- GlITCH DISPlAYED

~ NEXT SAWlE'r

AHAL YZER

DISPLAY

What's a Timing Analyzer?2-8

Page 12: When Should I

Triggering the

Timing Analyzer

Another term that should be familiar to oscilloscope usersis "triggering:' It is also used in logic analyzers, but isoften called "trace point:' Unlike an analog oscilloscopewhich starts the trace right after the trigger, a logicanalyzer continuously captures data and stops theacquisition after the trace point is found to display thedata. Thus a logic analyzer can show information prior tothe trace point, which is known as negative time, as wellas information after the trace point .

Setting trace specifications on a timing analyzer is a bitdifferent than setting trigger level and slope on an analogoscilloscope. Many analyzers trigger on a pattern of highsand lows across input lines. Notice the trace menu.

Pattern

Trigger

We have told the analyzer to start capturing data whenchannels 0, 2, 4, and 6 are high (logical I) and whenchannels I, 3, 5, and 7 are low (logical 0). The picturebelow shows the resulting display with the line in themiddle indicating the trace point. At the trace pointchannels 0, 2, 4, and 6 are all high while channels I, 3, 5,and 7 are low.

What's a Timing Analyzer?2-9

Page 13: When Should I

To make things easier for some users, the trigger point onmost analyzers can be set not only in binary (I's and O's)but in hex, octal, ASCII, or decimal. For instance, to setthe previous example in hex the trigger specification wouldbe 55 instead of 01010101. Using hex for the trigger pointis particularly helpful when looking at buses that are 4, 8,16, 24, or 32 bits wide, Imagine how cumbersome it wouldbe to set a specification for a 24-bit bus in binary!

~~

~

( Stote/Tlmlng E) i

~ CCumUI ote ~ t ( DAT~ 1 OtOtOfOI

Off)( morker l =':!

~ Olloy 1 -

0- SJ

~

Trtv to )(1 r Trlg to O

O O ,

~~

What's a Timing Analyzer?2-10

Page 14: When Should I

Edge triggering is a £amiliar concept to those accustomed tousing an analog oscilloscope. When adjusting the "triggerlevel" knob on a scope, you could think 0£ it as setting thelevel 0£ a voltage comparator that tells the scope to triggerwhen the input voltage crosses that level. A timinganalyzer works essentially the same on edge triggeringexcept that the trigger level is preset to logic threshold.Why include edge triggering in a timing analyzer? Whilemany logic devices are level-dependent, clock and controlsignals of these devices are often edge-sensitive. Edgetriggering allows you to start capturing data as the device isclocked. As a simple example, take the case 0£ an edge-triggered shift register that is not shifting data correctly. Isthe problem with the data or the clock edge? In order tocheck the device, we need to verify the data when it isclocked- on the clock edge. The analyzer can be told tocapture data when the clock edge occurs (rising or £al1ing)and catch all 0£ the outputs 0£ the shift register. 0£ course,in this case we would have to delay the trace point to takecare 0£ the propagation delay through the shift register.

EdgeTrigger

What's a Timing Analyzer?2-11

Page 15: When Should I

What's aState Analyzer?

If you've never used a state analyzer, you may think it's anincredibly complex instrument that would take a large timeinvestment to master. "Besides", you say to yourself, "Whatuse could I have for a state analyzer? I design hardware:'The truth is, many hardware designers find a stateanalyzer to be a very valuable "tool" in their "toolbox",especially when tracking down little bugs in software orhardware. It can eliminate "finger-pointing" betweenhardware and software teams when a problem does comeup. And the state analyzer is not any more difficult tounderstand than a timing analyzer.

In the first part of this book we talked about one of twomajor parts of a logic analyzer- the timing analyzer. It islike a digitizing oscilloscope in some respects, especiallywhen displaying timing waveforms. Since the horizontalaxis on the waveform display is time, we say that it is inthe "time domain:'

When Should IUse a State

Analyzer?

If we want to understand when to use a State Analyzer,we need to know first what is a "state". A "state" for alogic circuit is a sample of a bus or line when its data isvalid.

For example, take a simple "D" flip-flop, like the oneshown below. Data at the "D" input will not be valid untila positive-going clock edge comes along. Thus, a state forthe flip-flop is when the positive clock edge occurs.

DATA ~ ~

~C&.~ ~ ,

,

DATA VALID-STATE

What's a State Analyzer?2-12

Page 16: When Should I

Now imagine that we have eight of these flip-flops inparallel. All eight are connected to the same clock signal.When a positive transition occurs on the clock line, alleight will capture data at their "0" inputs. Again, astate occurs each time there is a positive transition on theclock line. These eight lines are analogous to amicroprocessor bus.

087 086 Dee

H we connected a state analyzer to these eight lines andtold it that a positive transition on the clock line is whenwe want to collect data, the analyzer would do just that.Any activity on the inputs will not be captured by the stateanalyzer unless the clock is going high.

This points up the major difference between a timingand a state analyzer. The timing analyzer has an internalclock to control sampling, so it asynchronously samplesthe system under test. A state analyzer sychronouslysamples the system since it gets its sampling clock fromthe system.

As a rule of thumb, you might remember to use a stateanalyzer to check "what" happened on a bus and a timinganalyzer to see "when" it happened. Therefore, a stateanalyzer generally displays data in a listing format and atiming analyzer displays data as a waveform diagram. Wehave to be extremely careful not to misinterpret the datawhen the logic analyzer is capable of displaying state dataas a waveform diagram and timing data as a listing.

What's a State Analyzer?2-13

Page 17: When Should I

In the timing analyzer, sampling is under direction of asingle internal dock. That makes things very simple.However, in the world of microprocessors, a system mayhave several "clocks:' Let's look at a brief example.

u nderstandingClocks

Suppose for a moment that we want to trigger on aspecific address in RAM and see what data is stored there.Further, we1l assume that the system uses a Zilog Z80.During a read or write cycle, the Z8O first puts an addresson the address bus. Next it asserts MREQ showing thatthe address is valid for a memory read or write. Last, theRD or WR line is asserted, depending on whether we aredoing a read or write. The WR line is asserted only afterthe data on the bus is valid.

In order to capture addresses from the Z8O with our stateanalyzer, we will want to capture when MREQ line goeslow. But to capture data, we will want the analyzer tosample when the WR line goes low (write cycle) or whenRD goes high (read cycle).

Ti TW

~

Ae-A15 VALID AODRESS

-Q ~==::=+==::=x:= ~

r:'LT3

~

Ttr'1

Cl~ ~L-J

~;' "---'

Will ",.c-\C'

RD" -,0- , /~~T.

~ ;::x: D==

READ

OPERATI~

De -D7 =::J" -c~\

~

D.-~ DATA QJT

~ITEOPERATI~

DATA.

Some microprocessors multiplex data and address on thesame lines. The analyzer must be able to clock ininformation from the same lines but with different clocks.This, in essence, acts as a demultiplexer to capture anaddress at the proper time and then catch data that occurson the same lines.

What's a State Analyzer?2-14

Page 18: When Should I

Triggering theState Analyzer

A state analyzer still gives the capability to qualify the datawe want to store. If we are looking for a specific pattern ofhighs and lows on the address bus, we can tell theanalyzer to start storing when it finds that pattern and tocontinue storing until tne analyzer's memory is full.

In the £ollowing example, we have set the trigger point as8OOOH (hexadecimal) .In this case we want to find out whatis in location 8OOOH, so we set the data trigger as don'tcares (xx). This tells the analyzer to trigger on address8OOOH regardless 0£ what the data is at that point.

The analyzer captured address 8000H and all £ollowingstates. Notice that data is C3H at address 8000. Notice thatall 0£ the information is displayed in hexadecimal £ormat.We could display it in binary, if that is helpful. However, itmay be more helpful to have the hex decoded intoassembly code.

( Slele/Ttming E )

~

Sequence LlYels

"""::"""1 Hhi 18 storing "anystatIN1 J TRIGGER on NaN T times

~

0Store ~enystet8..

~~

~ QQ (abSolute )()()()( )

~QQ(abSolut. )()()()()

~QQ(abSolute )()()()()

~~(abSolut. )()()()()

What's a State Analyzer?2-15

Page 19: When Should I

~~Disassembly { Stote/Timing E) { list1ng I

{ Morkers 1l Off J

IADDR llDATA II STAT I

I Hex I ~ I Symbo I I

8000 C3 OPCODE FETCH8001 50 nEnoRV READ8002 eo nEnoRv READ

r Label> 1

L_~a8!~JOt

If you specify that all information on the buses is to bedisplayed in hex, you will get a display that resembles theone shown below. What do these hex codes mean? In thecase of a processor, specific hex characters comprise aninstruction. If you are very familiar with the hex codes,you may be able to look at a hex listing like the above andknow what instruction is represented by it. Most of us,however, can't do that. For that reason, most analyzermakers have designed software packages calleddisassemblers or inverse assemblers. The job of thesepackages is to translate the hex codes into assembly codeto make them easier to read. For example, the displayshown above has C3, 50, 80, and C3 shown. If we lookthose codes up in the 8085 manual we find that theyrepresent JMP 50 80 (jump to location 8050), and thenanother JMP instruction (C3). Rather than having to lookeach code up, the inverse assembler does it for us. Look atthe following display and notice the difference.

-Stote/Timing E ) ( LIsting 1 ) ~ ~

r Lebel>l ~1808S nnemonlc II STATl

L~e~J ~I hex II Symbol I

o 8000 JnP 8050 OPCODE FETCH1 8001 So memory read nEnoRV READ2 8002 60 memory reed nEnORV READ

What's a State Analyzer?2-16

Page 20: When Should I

State analyzers have "sequence levels" that aid triggeringand storage. Sequence levels allow you to qualify datastorage more accurately than a single trigger point. Thismeans that you can more accurately window in on the datawithout storing information you don't need. Sequencelevels usually look something like this:

u nderstanding

Sequence Levels

Selective Storage

Saves Memory

and Time!

1 find xxxxelse on xxxx go to level x

2 then find xxxxelse on xxxx go to level x

3 trigger on xxxx

Sequence levels are especially useful for getting into asubroutine from a specific point in the program.

Sequence levels make possible what we call selectivestorage. Selective storage simply means storing only aportion out of a larger whole. For instance, suppose wehave an assembly routine that calculates the square of agiven number. H the routine is not calculating the squarecorrectly, we can tell the state analyzer to capture thatroutine. We do this by first telling the analyzer to find thestart of the routine. When it does find the start address,we then tell it to look for the ending address while storingeverything in-between. When the end of the routine isfound, we tell the analyzer to stop storing ( store no states) .The following diagram shows how selective storage works.

Cf STEP 1 : SEARCH FOR FIRST LINE CW" SECTION .

';;'"::,o,,;; DON'T STORE ANYTHING ~ING THE SEARCH

,:i~"li:t.::!= I,! !,-: ::

SECTION WE WANT TO CAPTURE ~

cp STEP 3 WHEN LAST LINE IS ENCOUNTERED. STOP STORING

What's a State Analyzer?2-17

Page 21: When Should I

Application ExamplePrestore

Beyond these features, the 1650/16500 family of Hewlett-Packard's logic analyzers lets you further specify a so-called"prestore" condition. This means that the analyzer willstore the last two states in addition to the one storedanyway. But let's have a look at how this can help you insolving some of your problems more easily. The nightmareof every hardware and software designer is when a globalmemory location of his system gets overwritten with erraticdata from time to time. In our example we assume thataddress OBAEH is reserved for a global variable and getsintermittently overwritten with data 44H.

We can trigger the state analyzer on a memory write toaddress OBAEH with data 44H ("a") and store only theseconditions. Now we can see how often wrong data getswritten to our global variable. To find the cause of theproblem however, we'd need to know which instruction(opcode fetch) ("b") generated the erratic write cycle. If wespecify 'prestore on "b"' where "b" is defined as an opcodefetch, we also store the last two instruction cycles prior tothe write cycle, pointing to the problem. Thus we needonly three state analyzer memory locations to capture thecause of the problem.

~~

What's a State Analyzer?2-18

Page 22: When Should I

( Stetl/Ti.ing El ( listing 1 )

{ nlrklrl 1l Off J

~c::::::J

I23~56

c:=j=J10111213I~1516

04200431OBAE0420043108AE0420043108AE0420043108AE0420043108A£0432

OPCOOE FETOPCOOE FETMEMORY HRIOPCOOE FETOPCOOE FETMEMORY HRIOPCOOE FET~COOE FETMEMORY HRIOPCOOE FETOPCOOE FETMEM~Y HRIOPCOOE FETOPCOOE FETMEI1ORY HRIOPCOOE FET

PRESTOREPRESTORE1.089 ..8PRES~EPRESTORE1.089 m8PRESTOREPRESTORE1.069 maPRESTOREPRESTORE1.069 maPRESTOREPRESTORE1.069 118

PRESTORE

JMP PUSH PSH

44 memory writeJMP PUSH PSH

44 memory writeJMP PUSH PSH

44 memory writeJMP PUSH PSN

44 18emory urtteJMP PUSH PSH

44 ...nMIry write)(RA A

What's a State Analyzer?2-19