if you are looking for coverage analysis ...
the coverage analysis on the Keil simulator
doesn't work very well (the output is not useful). at least it wasn't a few years ago.

at that time, i looked at the ACEbus simulator and Craig's Pinnacle52 simulator (actually i asked them about it). neither of them had coverage analysis then, but they both offered to look into it. i didn't follow up, so i don't know if they added it.

i wound up hacking at Daniel Drotos' s51 (?) simulator (he publishes the source) to get it to output the current address at each program step to a file. i used gawk to filter this output to produce a coverage report for each module (showing covered and uncovered lines of code, and summary counts).
i don't have any of this stuff, it's with my old employer. but if AceBus or Pinnacle52 haven't added coverage analysis, you might start there.

james