Command reference of s51

General commands and information Execution Breakpoints Dump commands Set commands

General commands

Some commands can be repeated by entering an empty command (just pressing ENTER if command console is interactive). This repeats the full command entered previously precisely including parameters of the command. Repeatable commands are signed with [Repeatable] icon.

Some commands accept parameters which in most cases can be numbers. Numbers can be entered in C-style form. If the number begins whith 0x or 0X it is interpreted as a hexadecimal number. If it begins with 0 followed by digits it is interpreted as octal number. In other cases it is interpreted as decimal number.

Every command which changes content of ROM area such as l, dl or sc deletes result of code analyzer and causes to re-analyze the code.

show c|w

This command can be used to list licensing information. If c option has given, the license is listed. It is first 10 point of the version 2 of GNU Genral Public License. Using w parameter the command prints out last 2 point of the license ("NO WARRANTY" message). If you do not accept GPL simply do not use the program.

l file

 Loading specified files into simulated ROM area. File must hold information in Intel hex form. 
$ s51
Software Simulator of MCS51, version 0.1.1
> l ../remoansi.hex
58659 bytes read from ../remoansi.hex
>

dl,do

 Download command. It is same as load above but it reads information from command console which is standard input by default. This command stops read records when it detect an "END" record which is normaly the last record. This command has two equivalent forms dl and do. 
$ s51 -V
Software Simulator of MCS51, version 0.1.1
> do
:03000000020003F8
:1000030075812078207600D8FC900000AE83AF8203
:100013009000001200416005E4F0A380F690009F79
:1000230012004A9000A312004A9000A712006890A1
:1000330000AD12006875D0001200B50200B3EF6581
:10004300827003EE658322E493F8740193F97402DA
:1000530093FE740393F5828E83E869700122E4931F
:10006300F6A30880F4E493FC740193FD740293FEF9
:10007300740393FF740493F8740593F582888312D1
:100083000041700122E493A3A883A9828C838D820B
:10009300F0A3AC83AD828883898280E3212100B5FC
:1000A300212100B5000000B500B5000000B500B582
:0200B30080FECD
:1000B5007520117501AA850120750102850120228F
:00000001FF
15 records have been read
197 bytes read
> >
As you see after detection of "END" record, the prompt appears twice. It is a bug.

q

 Quit. This command causes immediate exit of the simulator program, it does not ask you to confirm your intention. Simulator always reads commands from a file so end of file condition exits the program too. If command console is on standard input/output, pressing the CTRL-D will quit just like the quit command. 
$ s51
Software Simulator of MCS51, version 0.1.1
> q
$

h,?

 Help command. It prints out short description of the commands.

Example

res

Reset command. It resets the microcontroller. It has same effect as active signal on the RST pin. 
$ s51 -V remoansi.hex
Software Simulator of MCS51, version 0.1.1
3732 records have been read
58659 bytes read from remoansi.hex
> dr
000000 00 00 00 00 00 00 00 00 ........
000000 00 .  ACC= 0x00   0 .  B= 0x00   DPTR= 0x0000 @DPTR= 0x00   0 .
000000 00 .  PSW= 0x00 CY=0 AC=0 OV=0 P=0
   000000 02 01 60 LJMP  0160
> s 2
000000 00 00 00 00 00 00 00 00 ........
000000 00 .  ACC= 0x00   0 .  B= 0x00   DPTR= 0x0000 @DPTR= 0x00   0 .
000000 00 .  PSW= 0x00 CY=0 AC=0 OV=0 P=0
   000160 c2 90    CLR   P1.0
000000 00 00 00 00 00 00 00 00 ........
000000 00 .  ACC= 0x00   0 .  B= 0x00   DPTR= 0x0000 @DPTR= 0x00   0 .
000000 00 .  PSW= 0x00 CY=0 AC=0 OV=0 P=0
   000162 c2 97    CLR   P1.7
> res
> dr
000000 00 00 00 00 00 00 00 00 ........
000000 00 .  ACC= 0x00   0 .  B= 0x00   DPTR= 0x0000 @DPTR= 0x00   0 .
000000 00 .  PSW= 0x00 CY=0 AC=0 OV=0 P=0
   000000 02 01 60 LJMP  0160
>

wi,Wi string

 Searching for specified string in internal RAM area. String is interpreted from first non-space sharacter until end of the command including spaces. wi command makes case insensitive search and Wi can be used to make case sensitive search. Result is a hexa dump of memory areas that match with specified string. Most of C-style escape sequences can be used in the string: \f, \n, \r, \t, \v, \a, \b, \0, and \0xxx where xxx is an octadecimal number of the code of the character. 
$ s51 remoansi.hex
Software Simulator of MCS51, version 0.1.1
58659 bytes read from remoansi.hex
> g

0
   00093a b9 00 11 CJNE  R1,#00,094e
> si 20 Dani DAni
000014 44 61 6e 69 44 41 6e 69                         DaniDAni
> wi dani
000014 44 61 6e 69             Dani
000018 44 41 6e 69             DAni
> Wi Dani
000014 44 61 6e 69             Dani
> wi dani\0
000018 44 41 6e 69 00          DAni.
>

wx,Wx string

 Search commands. These commands are similar to wi, Wi commands the only difference is that wx,Wx are used to search for a string in external memory.

wc,Wc string

 Search commands. These commands are similar to wi, Wi commands the only difference is that wx,Wx are used to search for a string in code memory area.

gopt [opt]

 Get actual value of option(s). Some options can be set by sopt to modify behavior of the simulator. Using gopt you can get actual value of these options. If you use this command without parameter you get list of all options known by the program. In this way you can figure out which options can be used. 
$ s51 -V
Software Simulator of MCS51, version 0.1.1
> gopt
debug TRUE Debug flag.
stopit FALSE Stop if interrupt accepted.
> gopt stopit
stopit FALSE Stop if interrupt accepted.
>
This version of the simulator knows about two options. First element of the list is name of the option (debug and stopit). This name can be used to identify the option in gopt and sopt command. Second element of the list is the value of the option. In this case type of both options is boolean, their value can be TRUE or FALSE. Third element is a short description of the option.
debug
Debug flag can be set by -V option of the program to TRUE otherwise its default value is FALSE. If it is TRUE, the simulator prints out short messages about important events.
stopit
Setting this option to TRUE (default value is FALSE) forces execution to stop every time when CPU accepts an interrupt. You do not have to use breakpoints to inspect interrupts.

sopt opt value

 Set option value. Options described at previous command (gopt) can be set using this command. First parameter must be an option name and second the new value. Interpretation of the value depends on type of the option. Value for a boolean type of option interpreted as follows: if first character of the value is one of 1, t, T, y, Y then value will be TRUE otherwise it will be FALSE. 
$ s51 -V
Software Simulator of MCS51, version 0.1.1
> gopt
debug TRUE Debug flag.
stopit FALSE Stop if interrupt accepted.
> sopt debug f
> gopt
debug FALSE Debug flag.
stopit FALSE Stop if interrupt accepted.
>

Execution commands

g [start [stop]]

 Go, start execution. Parameters are optional. First parameter specifies start address of the execution. By default execution starts at address specified by actual value of the PC. This can be overridden by first parameter. If second parameter is specified it places a dynamic breakpoint at specified address which stops the execution. If stop address is not given the simulator stops if it reaches a breakpoint, or the CPU accepts an interrupt and stopit option is TRUE, or fatal error occures. Execution can be stopped interactively by pressing ENTER key. It means that go command can not be used if command console attached to a regular file. Note that first instruction is executed without effect of breakpoints. It means that if there is a breakpoint at start address then it will not be hit. 
$ s51 remoansi.hex
Software Simulator of MCS51, version 0.1.1
58659 bytes read from remoansi.hex
> bs f 0x187
> sopt stopit y
> g
4
F  000187 d8 fc    DJNZ  R0,0185
>
If execution stops the simulator first writes out a number which is the reason of the stop (this is a diagnostic feature, it will be improved in future versions). Reason can be:
0
There is no reason to stop. The execution probably stopped interactively by pressing ENTER key.
1
Serious error for example unknown instruction code which is impossible to execute.
2
Invalid address used in an instruction. For example indirect address is bigger then 127 in 51 type of controller. Execution can be continued but result will be undefined.
3
Stack overflow. Execution can be continued but result will be undefined.
4
Breakpoint has been reached.
5
Interrupt accepted. It only stops the execution if stopit option is set to TRUE.
After this diagnostic message the simulator prints out intruction at the PC in disassembled form. See dis commands for description of disassembled form.

[Repeatable] s [step]

 Step command. It executes one instruction without effect of breakpoints. Optional parameter can specify number of requested steps. 
$ s51 remoansi.hex
Software Simulator of MCS51, version 0.1.1
58659 bytes read from remoansi.hex
> s
000000 00 00 00 00 00 00 00 00 ........
000000 00 .  ACC= 0x00   0 .  B= 0x00   DPTR= 0x0000 @DPTR= 0x00   0 .
000000 00 .  PSW= 0x00 CY=0 AC=0 OV=0 P=0
   000160 c2 90    CLR   P1.0
> s 2
000000 00 00 00 00 00 00 00 00 ........
000000 00 .  ACC= 0x00   0 .  B= 0x00   DPTR= 0x0000 @DPTR= 0x00   0 .
000000 00 .  PSW= 0x00 CY=0 AC=0 OV=0 P=0
   000162 c2 97    CLR   P1.7
000000 00 00 00 00 00 00 00 00 ........
000000 00 .  ACC= 0x00   0 .  B= 0x00   DPTR= 0x0000 @DPTR= 0x00   0 .
000000 00 .  PSW= 0x00 CY=0 AC=0 OV=0 P=0
   000164 d2 b5    SETB  P3.5
>
After execution of actual instruction pointed by PC the step command executes dr command.

[Repeatable] n [step]

 Execute until next instruction is reached. This command is similar to step command described above but if actual instruction to execute is a subroutine call the next command places a dynamic breakpoint after the call instruction and starts to execute the subroutine. If the subroutine is infinite the breakpoint set by next will never reached. It can be a dangerous situation because the executeion started by the next command can not be stopped interactively. But it can be stopped by other breakpoints. 
$ s51 remoansi.hex
Software Simulator of MCS51, version 0.1.1
58659 bytes read from remoansi.hex
> g 0 0x172
4
   000172 79 04    MOV   R1,#04
> dis 0x172 0 5
   000170 7f 00    MOV   R7,#00
   000172 79 04    MOV   R1,#04
   000174 12 0d b8 LCALL 0db8
   000177 0f       INC   R7
   000178 d9 fa    DJNZ  R1,0174
   00017a 75 0b 00 MOV   0b,#00
> n 3
000000 00 04 00 00 00 00 00 00 ........
000000 00 .  ACC= 0x00   0 .  B= 0x00   DPTR= 0x0000 @DPTR= 0x00   0 .
000004 00 .  PSW= 0x00 CY=0 AC=0 OV=0 P=0
   000174 12 0d b8 LCALL 0db8
000000 00 04 00 00 00 00 00 00 ........
000000 00 .  ACC= 0x00   0 .  B= 0x00   DPTR= 0x0167 @DPTR= 0x00   0 .
000004 00 .  PSW= 0x00 CY=0 AC=0 OV=0 P=0
   000177 0f       INC   R7
000000 00 04 00 00 00 00 00 01 ........
000000 00 .  ACC= 0x00   0 .  B= 0x00   DPTR= 0x0167 @DPTR= 0x00   0 .
000004 00 .  PSW= 0x00 CY=0 AC=0 OV=0 P=0
   000178 d9 fa    DJNZ  R1,0174
>

pc [address]

 Using this command without any parameter it simply dumps out instruction pointed by the PC. Specify address if you want to set the PC. 
$ s51
S51 0.1.5, Copyright (C) 1997 Daniel Drotos, Talker Bt.
S51 comes with ABSOLUTELY NO WARRANTY; for details type `show w'.
This is free software, and you are welcome to redistribute it
under certain conditions; type `show c' for details.
> pc
 * 000000 ff       MOV   R7,A
> pc 123
 * 00007b ff       MOV   R7,A
> sopt debug t  
> pc 32
Warning: maybe not instruction at 000020
 * 000020 ff       MOV   R7,A
>

Commands to manage breakpoints

Two kind of breakpoints can be used: fetch and event breakpoint. Fetch breakpoints are classical breakpoints. They can placed at any instruction in the code memory. Breakpoint will be hit if CPU fetches instruction code from the memory location specified by the breakpoint. Only fetching of first byte of the instruction hits the breakpoint. If the execution reaches a breakpoint it stops before the instruction at location specified by the breakpoint would be executed.

Event breakpoints are special onces. They cause stop of execution if event specified by the breakpoint occures. Events are:

wi
writing into internal RAM at specified location;
ri
reading from internal RAM at specified address;
wx
writing into external RAM at specified location (MOVX instruction);
rx
reading from external RAM at specified address (MOVX instruction);
ws
writing into SFR area at specified location;
rs
reading from SFR area at specified address;
rc
reading from code memory at specified location (MOVC instruction).
Event breakpoint stops execution after specified event occured.

Every breakpoint can be fix (permanent) or dynamic (temporary). Dynamic breakpoints are automatically removed when they reached. Some commands place dynamic fetch breakpoints into the code, for example go or next.

A hit number can be associated to any breakpoint. This hit number specifies how many times the breakpoint must be hit before it causes the execution to stop. This hit number is 1 by default.

bs f|d addr [hit]

Set fetch breakpoint. First parameter specify if the breakpoint will be fix (f) or dynamic (d). Second parameter specifies address where the breakpoint must be placed to. It should be address of an instruction.

Third parameter is optional and it specifies the hit number. It is 1 by default. 

$ s51 remoansi.hex
Software Simulator of MCS51, version 0.1.1
58659 bytes read from remoansi.hex
> dc 0 0x10
   000000 02 01 60 LJMP  0160
 * 000003 02 00 3c LJMP  003c
 * 000006 ff       MOV   R7,A
 * 000007 ff       MOV   R7,A
 * 000008 ff       MOV   R7,A
 * 000009 ff       MOV   R7,A
 * 00000a ff       MOV   R7,A
 * 00000b 02 3b e0 LJMP  3be0
 * 00000e ff       MOV   R7,A
 * 00000f ff       MOV   R7,A
 * 000010 ff       MOV   R7,A
> bs f 0x160
> bs d 8 2
> g
4
F  000160 c2 90    CLR   P1.0
>

bse wi|ri|wx|rx|ws|rs|rc f|d addr [hit]

 Set event breakpoint. First parameter specifies type of event. See general description of event breakpoints above about meaning of event identifiers. Second parameter specify if the breakpoint will be fix (f) or dynamic (d). Third parameter specifies address. Remember that this is not an instruction address, it is address of the memory cell where specified event should occur.

Forth parameter is optional and it specifies the hit number. It is 1 by default. 

$ s51 remoansi.hex
Software Simulator of MCS51, version 0.1.1
58659 bytes read from remoansi.hex
> dis
   00d47e 22       RET
   000000 02 01 60 LJMP  0160
   000160 c2 90    CLR   P1.0
   000162 c2 97    CLR   P1.7
   000164 d2 b5    SETB  P3.5
   000166 d2 b4    SETB  P3.4
   000168 75 81 22 MOV   SP,#22
   00016b 75 d0 00 MOV   PSW,#00
   00016e 7e 00    MOV   R6,#00
   000170 7f 00    MOV   R7,#00
   000172 79 04    MOV   R1,#04
   000174 12 0d b8 LCALL 0db8
   000177 0f       INC   R7
   000178 d9 fa    DJNZ  R1,0174
   00017a 75 0b 00 MOV   0b,#00
   00017d 75 0c 00 MOV   0c,#00
   000180 02 02 2a LJMP  022a
   000183 78 22    MOV   R0,#22
   000185 76 00    MOV   @R0,#00
   000187 d8 fc    DJNZ  R0,0185
> bse wi f 6
> g
4
   000170 7f 00    MOV   R7,#00
>

bd addr

 Delete fetch breakpoint. Parameter specifies address of breakpoint. If there is no breakpoint specified at given address this command prints out a warning message. 
> bl
F 1(1) 000160 c2 CLR   P1.0
D 2(2) 000180 02 LJMP  022a
F 1(1) 000006 wi
> bd 160
No breakpoint at 0000a0
> bd 0x160
> bl
D 2(2) 000180 02 LJMP  022a
F 1(1) 000006 wi
>

bde wi|ri|wx|rx|ws|rs|rc addr

 Delete event breakpoint. First parameter must be given to specify type of event. Second parameter is address of memory cell which the breakpoint is associated to. Continuing example given above: 
> bl
D 2(2) 000180 02 LJMP  022a
F 1(1) 000006 wi
> bde ri 6
No ri breakpoint at 000006
> bde wi 6
> bl
D 2(2) 000180 02 LJMP  022a
>

ba

 Delete all breakpoints. This command deletes all fetch as well as event breakpoints. Be carefull because it does not ask you to confirm your intention. 
> bl
F 1(1) 000160 c2 CLR   P1.0
D 2(2) 000180 02 LJMP  022a
F 1(1) 000006 wi
> ba
> bl
>

bl

 List breakpoints. This command prints out information about every fetch and then event breakpoints. 
> bl
F 1(1) 000160 c2 CLR   P1.0
D 2(2) 000180 02 LJMP  022a
F 1(1) 000006 wi
>
First character on the list shows permanency of the breakpoint. F means fix and D means dynamic. Second item on the list is the hit number associated to breakpoint. After that between the parentheses there is the actual value of the hit counter. If hit counter reaches zero, breakpoint is activated and hit counter is preset with value of hit number. Next item is the address. Next items are different for fetch and event breakpoints.

Fetch breakpoints list hexadecimal code of instruction at breakpoint's address and then dissassembled instruction.

Event breakpoints list identification of the event's type.

Dump commands

[Repeatable] dis [start [offset [lines]]]

 Disassemble code. This command can be used to list disassembled instructions which discovered by the code analyzer. First two parameters specify the address where the list starts. First parameter is address where the command starts to search an instruction. This search goes forward. When the first instruction marked by code analyzer found the simulator skips as many instructions as you specify in second parameter. If offset is negative the simulator goes backward and skips specified number of instructions. Default value of start parameter is last address which was listed by previous dis command and default value of offset is -1. It means you can make continuous list repeating parameterless dis command.

In third parameter you can specify how many instructions you want to list. Default value is 20. 

$ s51 remoansi.hex
Software Simulator of MCS51, version 0.1.1
58659 bytes read from remoansi.hex
> dis
   00d47e 22       RET
   000000 02 01 60 LJMP  0160
   000160 c2 90    CLR   P1.0
   000162 c2 97    CLR   P1.7
   000164 d2 b5    SETB  P3.5
   000166 d2 b4    SETB  P3.4
   000168 75 81 22 MOV   SP,#22
   00016b 75 d0 00 MOV   PSW,#00
   00016e 7e 00    MOV   R6,#00
   000170 7f 00    MOV   R7,#00
   000172 79 04    MOV   R1,#04
   000174 12 0d b8 LCALL 0db8
   000177 0f       INC   R7
   000178 d9 fa    DJNZ  R1,0174
   00017a 75 0b 00 MOV   0b,#00
   00017d 75 0c 00 MOV   0c,#00
   000180 02 02 2a LJMP  022a
   000183 78 22    MOV   R0,#22
   000185 76 00    MOV   @R0,#00
   000187 d8 fc    DJNZ  R0,0185
> bs f 0x180
> bs d 0x189
> dis 0x180 -3 10
   000178 d9 fa    DJNZ  R1,0174
   00017a 75 0b 00 MOV   0b,#00
   00017d 75 0c 00 MOV   0c,#00
F  000180 02 02 2a LJMP  022a
   000183 78 22    MOV   R0,#22
   000185 76 00    MOV   @R0,#00
   000187 d8 fc    DJNZ  R0,0185
D  000189 22       RET
   00018a 90 09 ec MOV   DPTR,#09ec
   00018d ae 83    MOV   R6,DPH
>
If there is an F or D character at the beginning of the line, it means that there is a fix or dynamic fetch breakpoint at listed address. Next element on the list can be an asterix (*) which means that the listed address is not marked by the code analyzer. dis lists marked instructions only so asterix never appears in the list. Next element of the list is address displayed as six digit hexadecimal number. Address is followed by hexadecimal dump of instruction's code. Last element of the list is disassembled instruction. Every number appeared on the list is hexadecimal number.

[Repeatable] dc [start [stop]]

 Disassembled dump of code memory area. This command simply produces disassambled list of memory area specified by the parameters. Default value of start parameter is last address listed by previous dc command. If stop parameter is not given 20 lines are listed. 
$ s51 remoansi.hex 
Software Simulator of MCS51, version 0.1.1
58659 bytes read from remoansi.hex
> dc
   000000 02 01 60 LJMP  0160
 * 000003 02 00 3c LJMP  003c
 * 000006 ff       MOV   R7,A
 * 000007 ff       MOV   R7,A
 * 000008 ff       MOV   R7,A
 * 000009 ff       MOV   R7,A
 * 00000a ff       MOV   R7,A
 * 00000b 02 3b e0 LJMP  3be0
 * 00000e ff       MOV   R7,A
 * 00000f ff       MOV   R7,A
 * 000010 ff       MOV   R7,A
 * 000011 ff       MOV   R7,A
 * 000012 ff       MOV   R7,A
 * 000013 02 00 ac LJMP  00ac
 * 000016 ff       MOV   R7,A
 * 000017 ff       MOV   R7,A
 * 000018 ff       MOV   R7,A
 * 000019 ff       MOV   R7,A
 * 00001a ff       MOV   R7,A
 * 00001b ff       MOV   R7,A
 * 00001c ff       MOV   R7,A
>

[Repeatable] dch [start [stop]]

 Hexadecimal dump of code memory area from address start to address stop. Default value of start address is address of following memory cell which was dumped by previous dch command. If stop parameter is not given dch command lists 10 lines 16 bytes per line. 
$ s51 remoansi.hex
Software Simulator of MCS51, version 0.1.1
58659 bytes read from remoansi.hex
> wc remo
001776 52 65 6d 6f             Remo
> dch 0x1770
001770 52 43 0a 00 0a 00 52 65 6d 6f 20 00 56 65 72 73 RC....Remo .Vers
001780 69 6f 6e 20 31 2e 30 20 00 43 6f 70 79 72 69 67 ion 1.0 .Copyrig
001790 68 74 20 28 63 29 20 00 31 39 39 34 2c 39 35 20 ht (c) .1994,95 
0017a0 00 54 61 6c 6b 65 72 20 42 74 2e 00 53 75 6e 64 .Talker Bt..Sund
0017b0 61 79 2e 00 4d 6f 6e 64 61 79 2e 00 54 68 75 65 ay..Monday..Thue
0017c0 73 64 61 79 2e 00 57 65 64 6e 65 73 64 61 79 2e sday..Wednesday.
0017d0 00 54 68 75 72 73 64 61 79 2e 00 46 72 69 64 61 .Thursday..Frida
0017e0 79 2e 00 53 61 74 75 72 64 61 79 2e 00 4e 6f 64 y..Saturday..Nod
0017f0 61 79 2e 00 4e 6f 20 65 72 72 6f 72 2e 00 4d 69 ay..No error..Mi
001800 73 73 69 6e 67 20 70 61 72 61 6d 65 74 65 72 2e ssing parameter.
>
First element in every lines is address of first byte dumped out in the line. Next elements are hexadecimal values of bytes followed by ASCII charactes of bytes dumped out in the line. If value of the memory cell is not printable than a dot is dumped out.

[Repeatable] di [start [stop]]

 Hexadecimal dump of internal RAM area from address start to address stop. Default value of start address is address of following memory cell which was dumped by previous di command. If stop parameter is not given di command lists 10 lines 8 bytes per line. 
$ s51 remoansi.hex
Software Simulator of MCS51, version 0.1.1
58659 bytes read from remoansi.hex
> sopt stopit 1
> g
5
 * 000023 02 01 1c LJMP  011c
> di
000000 18 02 16 ba 00 02 00 0a ........
000008 00 00 00 00 00 00 00 00 ........
000010 00 00 00 00 00 00 00 00 ........
000018 4a 00 00 00 00 00 00 00 J.......
000020 bc 27 06 2d 02 ee 35 8f .'.-..5.
000028 31 e7 42 01 0e 01 0b 00 1.B.....
000030 ec 0b 7f 10 7f a9 7e 08 ......~.
000038 fe 03 09 00 00 00 af 08 ........
000040 af 08 00 00 00 00 00 00 ........
000048 00 00 00 00 00 00 00 00 ........
>

[Repeatable] dx [start [stop]]

 Hexadecimal dump of external RAM area from address start to address stop. Default value of start address is address of following memory cell which was dumped by previous dx command. If stop parameter is not given dx command lists 10 lines 16 bytes per line. 
$ s51 remoansi.hex
Software Simulator of MCS51, version 0.1.1
58659 bytes read from remoansi.hex
> sopt stopit 1
> g
5
 * 000023 02 01 1c LJMP  011c
> dx 0x100
000100 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
000110 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
000120 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
000130 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
000140 00 00 00 00 00 00 00 00 00 00 00 00 00 44 61 6e .............Dan
000150 69 00 00 00 02 02 07 00 00 ff 00 00 07 cb 08 0c i...............
000160 32 00 07 cb 06 05 02 00 2c 00 00 00 00 00 00 00 2.......,.......
000170 00 0a 74 00 00 10 00 00 01 00 10 00 ff 00 00 00 ..t.............
000180 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
000190 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 23 ...............#
>

[Repeatable] dr

 This command prints out actual value of important registers. 
$ s51 remoansi.hex 
Software Simulator of MCS51, version 0.1.1
58659 bytes read from remoansi.hex
> sopt stopit 1
> g
5
 * 000023 02 01 1c LJMP  011c
> dr
000000 18 02 16 ba 00 02 00 0a ........
000018 4a J  ACC= 0x0a  10 .  B= 0x00   DPTR= 0x16ba @DPTR= 0x00   0 .
000002 16 .  PSW= 0x00 CY=0 AC=0 OV=0 P=0
 * 000023 02 01 1c LJMP  011c
>
In first line the actual register bank is dumped out. Register banks reside in internal RAM, address at the begining of the line shows start address of actual register bank selected by RS0 and RS1 bits of PSW register.

Next two lines begin with value of indirectly addressed internal RAM cells. Second line shows IRAM cell pointed by R0 while third line shows IRAM addressed by R1.

Second line displays some important registers. First one is the accumulator. Its value dumped out in hexadecimal, decimal form and then the ASCII character of its value. It is followed by value of the B register which is dumped out in hexadecimal form only. Next is DPTR register in hexadecimal and then external RAM cell which is addressed by DPTR. This is dumped out in hexadecimal, decimal and ASCII too.

In third line you find program status word in hexadecimal and then some flag bits of PSW register. Last line is disassembled instruction at PC.

dp

Dump out ports. This command shows actual value of ports. 
$ s51 remoansi.hex 
Software Simulator of MCS51, version 0.1.1
58659 bytes read from remoansi.hex
> sopt stopit 1
> g
5
 * 000023 02 01 1c LJMP  011c
> dp
P0    11111111 0xff 255 .    P1    11111110 0xfe 254 .
Pin0  11111111 0xff 255 .    Pin1  11111111 0xff 255 .
Port0 11111111 0xff 255 .    Port1 11111110 0xfe 254 .

P2    11111111 0xff 255 .    P3    11111111 0xff 255 .
Pin2  11111111 0xff 255 .    Pin3  11111111 0xff 255 .
Port2 11111111 0xff 255 .    Port3 11111111 0xff 255 .
>
First lines on the list (labeled with Px) are value of SFRs which are internal latch registers. Second lines (labeled with Pinx) are outputs of external devices connected to port pins of the microcontroller. These values can be set by you using sp command. Third lines (labeled with Portx) show actual values can be measured on pins of the device. These values are calculated with following pseudo formula:

Portx= Px AND Pinx

All three values are displayed in binary, hexadecimal, decimal form and then the ASCII character of the value is shown.

ds [addr...]

Print out SFR. This command can be used to get value of all or some SFRs. If you do not specify any parameter the ds command simply dumps out full SFR area 16 bytes per line. 
$ s51 remoansi.hex 
Software Simulator of MCS51, version 0.1.1
58659 bytes read from remoansi.hex
> sopt stopit 1
> g
5
 * 000023 02 01 1c LJMP  011c
> ds
000080 ff 2a ba 16 00 00 00 00 55 a1 d7 fe 50 fd 00 00 .*......U...P...
000090 fe 00 00 00 00 00 00 00 7e 00 00 00 00 00 00 00 ........~.......
0000a0 ff 00 00 00 00 00 00 00 97 00 00 00 00 00 00 00 ................
0000b0 ff 00 00 00 00 00 00 00 15 00 00 00 00 00 00 00 ................
0000c0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
0000d0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
0000e0 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
0000f0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
> ds p1 0x87
    P1 fe 254 .
000087 00   0 .
> ds p2 ip scon
    P2 ff 255 .
    IP 15  21 .
  SCON 7e 126 ~
>
If you specify one or more parameter the ds command prints out value of registers specified by parameters. Parameter can be an address or a symbolic name of the register. Note that the simulator implements a register at all address in the address space which is not true in real microcontroller where reading of an unimplemented register gets undefined value. Value of the registers printed out in hexadecimal, decimal, and ASCII form.

Note that different type of controllers can implement different registers: 

$ s51
Software Simulator of MCS51, version 0.1.1
> ds rcap2l
> q
$ s51 -t 52
Software Simulator of MCS51, version 0.1.1
> ds rcap2l
RCAP2L 00   0 .
>

[Repeatable] db addr...

 Dump bits. This command can be used to get value of bits. At least one arameter must be given. Bit address can be specified in three forms. First of all name of the bit can be used if it has any. Direct bit address is accepted too and it can be specified by address of IRAM or SFR which contains the bit and bit number within the byte separated by a dot. If the requested bit is in an SFR the address of the register can be specified by its name. 
$ s51
Software Simulator of MCS51, version 0.1.1
> db it1 0x20.3 0x43 p2.5
000088    IT1 0
000020   20.3 0
000028   28.3 0
0000a0   P2.5 1
>
Value of bits are printed out one per line. The list starts direct address of the bit followed by bit name or address of the memory cell or SFR which contains the displayed bit and bit number within the byte separated by a dot. At last the value of the bit is shown. Displaying a port bit you get value of SFR latch: 
> sp 1 0x0f
> ss p1 0x55
000090 55                                              U
> dp
P0    11111111 0xff 255 .    P1    01010101 0x55  85 U
Pin0  11111111 0xff 255 .    Pin1  00001111 0x0f  15 .
Port0 11111111 0xff 255 .    Port1 00000101 0x05   5 .

P2    11111111 0xff 255 .    P3    11111111 0xff 255 .
Pin2  11111111 0xff 255 .    Pin3  11111111 0xff 255 .
Port2 11111111 0xff 255 .    Port3 11111111 0xff 255 .
> db p1.2 p1.3 p1.4 p1.5 p1.6
000090   P1.2 1
000090   P1.3 0
000090   P1.4 1
000090   P1.5 0
000090   P1.6 1
>

Set commands

Set commands can be used to set value of memory cells, bits, or port pins. Those commands that set value of memory interpret their command lines a litle bit different than other commands. First parameter is always the start address of the memory area which is being set. This parameter is followed by a list of data parameters. Data can be specified by a number. Numbers must begin with a digit. Each number specifies one byte of data. If the parameter begins with a non-digit character, it is interpreted as string of characters and this kind of parameter specifies as many bytes as many characters the string has. Strings can contain escape sequencies (see description of wi command where escape sequencies are discussed) but they can not contain spaces because space characters (space, tabulator and vertical tabulator) separates parameters. Spaces can be specified as escape sequences or separated number parameters if needed. Only space characters separate data parameters while normaly comma (,) and semicolon (;) are interpreted as separator characters too.

si addr data...

 Write data into internal RAM area. First parameter specifies start address of memory area to set and other parameters are data to set. 
$ s51
Software Simulator of MCS51, version 0.1.1
> si 10 dani\040hej-ho
00000a 64 61 6e 69 20 68 65 6a 2d 68 6f                dani hej-ho
>
Result of the command is a memory dump of area which has been modified by the command. If there is syntax error in a data parameter then remaining parameters are dropped out. 
> si 20 1 2 0xi 3 4
Bad data 0xi
000014 01 02                                           ..
>

sx addr data...

 This command is similar to si command described above but it is used to modify external RAM.

sc addr data...

 This command is similar to si command described above but it is used to modify code memory area (ROM).

ss addr data...

 This command is similar to si command described above but it is used to modify SFR. Other difference is that first parameter (start address) can be specified by name of SFR not by address only. 
$ s51
Software Simulator of MCS51, version 0.1.1
> ss p1 0
000090 00                                              .
>

sb addr data...

 Modify bit(s). First parameter is address of first bit to modify. See description of db command how bit address can be specified. If first character of data parameter is 0 it means zero otherwise it means one. 
$ s51
Software Simulator of MCS51, version 0.1.2
> sb 0x23.5 1
> db 0x23.5
000023   23.5 1
> sb p3.3 0
> dp
P0    11111111 0xff 255 .    P1    11111111 0xff 255 .
Pin0  11111111 0xff 255 .    Pin1  11111111 0xff 255 .
Port0 11111111 0xff 255 .    Port1 11111111 0xff 255 .

P2    11111111 0xff 255 .    P3    11110111 0xf7 247 .
Pin2  11111111 0xff 255 .    Pin3  11111111 0xff 255 .
Port2 11111111 0xff 255 .    Port3 11110111 0xf7 247 .
> sb tr1 0
> db tr1
000088    TR1 0
> sb tr1 1
> db tr1
000088    TR1 1
>

sp port data

 This command can be used to sep up output values of external circuits connected to port pins. If a port bit is used as output to drive external circuits, do not set corresponding pin bit to zero because read back value of the port can be false. First parameter must be number of the port between 0 and 3. 
$ s51
Software Simulator of MCS51, version 0.1.2
> dp
P0    11111111 0xff 255 .    P1    11111111 0xff 255 .
Pin0  11111111 0xff 255 .    Pin1  11111111 0xff 255 .
Port0 11111111 0xff 255 .    Port1 11111111 0xff 255 .

P2    11111111 0xff 255 .    P3    11111111 0xff 255 .
Pin2  11111111 0xff 255 .    Pin3  11111111 0xff 255 .
Port2 11111111 0xff 255 .    Port3 11111111 0xff 255 .
> ss p1 0x55
000090 55                                              U
> sp 1 0x0f
> dp
P0    11111111 0xff 255 .    P1    01010101 0x55  85 U
Pin0  11111111 0xff 255 .    Pin1  00001111 0x0f  15 .
Port0 11111111 0xff 255 .    Port1 00000101 0x05   5 .

P2    11111111 0xff 255 .    P3    11111111 0xff 255 .
Pin2  11111111 0xff 255 .    Pin3  11111111 0xff 255 .
Port2 11111111 0xff 255 .    Port3 11111111 0xff 255 .
>

fi start stop data

 Fill command. It can be used to fill up an area of internal RAM with a specified data. 
$ s51
Software Simulator of MCS51, version 0.1.2
> fi 11 0x34 44
> di
000000 00 00 00 00 00 00 00 00 ........
000008 00 00 00 2c 2c 2c 2c 2c ...,,,,,
000010 2c 2c 2c 2c 2c 2c 2c 2c ,,,,,,,,
000018 2c 2c 2c 2c 2c 2c 2c 2c ,,,,,,,,
000020 2c 2c 2c 2c 2c 2c 2c 2c ,,,,,,,,
000028 2c 2c 2c 2c 2c 2c 2c 2c ,,,,,,,,
000030 2c 2c 2c 2c 2c 00 00 00 ,,,,,...
000038 00 00 00 00 00 00 00 00 ........
000040 00 00 00 00 00 00 00 00 ........
000048 00 00 00 00 00 00 00 00 ........
>

fx start stop data

 Fill command. It works similar to fi but it puts data into external RAM instead of internal RAM.

fs start stop data

 Fill command. It works similar to fi but it puts data into SFR instead of internal RAM.

fc start stop data

 Fill command. It works similar to fi but it puts data into code memory (ROM) instead of internal RAM.