Specifications

Combining 8-bit operations into 16-bit operations
When a processor only supports short arithmetic, such as 8 or 16 bits on the H8/300,
arithmetic on longer operands is built up by a sequence of short operations connected by
carry/borrow propagation. Bound-T does not have a general mechanism for tracking such
instruction sequences and modelling the effect on the long operands. Happily on the H8/300,
16-bit arithmetic can usually be implemented with dedicated 16-bit instructions. The exception
is the lack of immediate 16-bit operands for addition, subtraction and comparison, which
therefore must be implemented as a pair of 8-bit instructions. Such pairs are often applied to
16-bit loop counters and Bound-T therefore tries to detect them and to provide a 16-bit model
of the arithmetic. The following table shows these instruction pairs and their model.
Table 9: Paired 8-bit Instructions
Instruction pair Arithmetic model Remarks
ADD.B #i, RnL
ADDX #j, RnH
If the constant j:i is non-
negative:
Rn := Rn + constant j:i
Z, C := unknown
If the constant j:i is negative:
Rn := Rn − abs (constant j:i)
Z := result = 0
C := result < 0
The constant j:i is the 16-bit value
composed of j in the high octet and i in
the low octet. It is considered non-
negative if j < 128 and negative otherwise
(that is, if bit 15 is 1).
CMP.B #i, RnL
SUBX #j, RnH
Z := Rn = constant j:i
C := Rn < constant j:i
RnH := unknown
The constant is always taken as unsigned.
Memory data
Memory locations with statically know address are fully supported as operands and
destinations for instructions. Bound-T separates between memory octets and memory words: a
different logical storage cell models the octet at a given address and the word at the same
address. However, an assignment to a cell that models a memory word also implies an update
of the two cells that model the octets in the word, and an assignment to a memory octet cell
makes the containing word cell opaque.
For memory accesses with a dynamic address, for example in instructions like MOV R3,@R5,
Bound-T uses arithmetic analysis to try to bound the address to a single value. If this succeeds,
the arithmetic model is refined to use the statically addressed memory cell. (Dynamic accesses
based on the Stack Pointer SP = R7 are a special case as explained below.)
Unresolved dynamic memory write accesses are ignored at present. Thus, an instruction that
writes to an unresolved dynamically computed address is assumed to have no effect on any the
relevant computation, which is an unsafe approximation. An instruction that reads from an
unresolved dynamic address yields an opaque value, which is a safe assumption.
A word operand in the H8/300 memory is always aligned on an even octet address. However,
the program can use an odd address to access a word, because the processor ignores the least
significant bit and acts as if the address were even. Bound-T takes this into account: all word-
sized memory cells are identified by an even address, even if the code uses and odd (static)
address.
24 Supported H8/300 Features Bound-T for H8/300