A Brief Introduction to the JTAG Boundary Scan Interface

Nick Patavalis (npat@inaccessnetworks.com)

Athens 08 Nov 2001

One of the difficult areas in the development of any modern hardware system is the production-testing of the Printed Circuit Boards (PCBs). This is the problem addressed by the IEEE standard number 1149 "Standard Test Access Port and Boundary-Scan Architecture". This standards defines a 5-pin serial protocol for accessing and controlling the signal-levels on the pins of a digital circuit, and has some extensions for testing the internal circuitry on the chip itself (which will not be discussed here). The standard was written by the Joint Test Action Group (JTAG) and the architecture defined by it is known as "JTAG boundary scan" or as "IEEE 1149".

The general structure of the JTAG boundary scan test interface is shown in the following figure.

All the signals between the chip's core logic and the pins are intercepted by a serial scan path known as the "Boundary Scan Register" (BSR), and shown as cells "C0", "C1", "C2", "C3", and "C4" in the figure above. In normal system operation this path can transparently connect the core-logic signals to the pins and effectively become invisible. In external-test mode, it can disconnect the core-logic from the pins, drive the output pins ("Pin1", and "Pin2" in the figure above) by itself, and read and latch the states of the input pins (figure: "Pin0", and "Pin2"). In internal-test mode, it can disconnect the core-logic from the pins, drive the core-logic input signals by itself, and read and latch the states of the core-logic output signals.

In the figure above, and assuming that the JTAG interface is in external-test mode, C0 is the BSR cell capturing the state of the input pin 0. C1 is the BSR cell driving the output pin 1. C2 does not itself correspond to any specific pin, but it is the "enable" BSR cell which controls the "direction" of the bidirectional pin 2. C3 is the input BSR cell capturing the state of the bidirectional pin 2, and C4 is the output BSR cell driving the bidirectional pin 2. Summarizing we can identify three times of BSR cells:

Input Cells like C0, and C3. They are always associated with a specific pin whose state they capture when the JTAG interface is in external test mode.
Output Cells like C1, and C4. They are always associated with a specific pin which they drive when the JTAG interface is in external test mode.
Enable Cells like C2. They are not associated with any pin per-se, but they either control the direction of bidirectional pins, or enable and disable certain input or output pins.

Gates E0, E3, and E4 operate under the control of the TAP (and probably also under the control of "enable" cells, like C2) and capture, or apply, the states (contents) of the respective input, or output, cells to, or from, the chip's pins. The state capture, or application, takes place during certain transitions of the TAP state-machine, and only if the IR (instruction register) has been previously loaded with, and contains, the proper opcode (e.g. EXTEST).

Gates I0, I3, and I4 operate under the control of the TAP (and probably also under the control of "enable" cells, like C2) and capture, or apply, the states (contents) of the respective input, or output, cells to, or from, the chip's internal-logic signal lines. The capture, or application, takes place during certain transitions of the TAP state-machine, and only if the IR (instruction register) has been previously loaded with, and contains, the proper opcode (e.g. INTEST).

Gates N0, N1, and N3, come into operation only when the system is in normal-operation mode (i.e. when the JTAG test apparatus is inactive) and connect the chip's pins to the internal core-logic signals, as if the Boundary Scan Path was not present.

The contents of the BSR register can be written and read bit-after-bit, in a serial fashion, using the TDI and TDO JTAG signals. Actually the BSR "read" and "write" (set) operations take place at the same time, with the new "value" shifted in from TDI, while the previous value is shifted out from TDO. The same technique is used to read and write the values of the other JTAG registers too, by having the TAP controller connect them between the TDI and TDO pins, in place of the BSR.

Interface signals

The JTAG interface uses the following five dedicated signals which must be provided on each chip that supports the standard:

TRST* is a Test-ReSeT input which initializes and disables the test interface.
TCK is the Test CLocK input which controls the timing of the test interface independently from any system clocks. TCK is pulsed by the equipment controlling the test and not by the tested device. It can be pulsed at any frequency (up to a maximum of some MHz). It can be even pulsed at varying rates.
TMS is the Test Mode Select input which controls the transitions of the test interface state machine.
TDI is the Test Data Input line, which supplies the data to the JTAG registers (Boundary Scan Register, Instruction Register, or other data registers).
TDO is the Test Data Output line, which is used to serially output the data from the JTAG registers to the equipment controlling the test. It carries the sampled values from the boundary scan chain (or other JTAG registers) and propagates them to the next chip in the serial test circuit.

The normal organization of the test circuit on a board that incorporates several chips with JTAG support is to connect TRST*, TCK, and TMS to every chip in parallel, and to connect TDO from one chip to TDI of the next in a single loop. This way the board presents a single test interface that has the same five signals discussed above. A simpler arrangement, for boards that have only a few chips with JTAG interfaces, is to provide one JTAG test-port for every such chip, and control the tests independently.

The TAP controller

The operation of the test interface is controlled by the Test Access Port (TAP) controller. This is a state-machine whose state transitions are controller by the TMS signal; the state-transition diagram is shown in the following figure.

As you can see all the states have two exits, so all the transitions can be controlled by one signal, TMS. The two main paths in the state transition diagram control the operations on the Data Registers (ID register, Bypass register, BSR register), and the Instruction Register. The Data Register operated upon every time the DR path is taken is selected based on the value loaded in the Instruction Register.

A transition path like the following (informally called "ir path") is used to load a new value into the Instruction Register, and read the old value back:

   *-> test logic reset
   --> run test idle
   --> select dr scan
   --> select ir scan
   --> capture ir
   --> shift ir --> ... n times ... --> shift ir
   --> exit1 ir
   --> update ir
   --> run test idle ->*

The new value is shifted-in the Instruction Register from the TDI line---one bit at a time---upon the entries to the 'shift ir' state. The old value of the Instruction Register is shifted-out the TDO line---one bit at a time---upon the exits from the "shift ir" state.

A transition path like the following (informally called "dr path") is used to load a new value into the currently selected Data Register, and read the old value back:

   *-> test logic reset
   --> run test idle
   --> select dr scan
   --> capture dr
   --> shift dr --> ... n times ... --> shift dr
   --> exit1 dr
   --> update dr
   --> run test idle ->*

The new value is shifted-in the currently selected Data Register from the TDI line---one bit at a time---upon the entries to the 'shift dr' state. The old value of the current selected Data Register is shifted-out to the TDO line---one bit at a time---upon the exits from the "shift dr" state. The value of the Instruction Register, that will be shifted out, is "captured" upon the entry to the "capture ir" state. The value of the currently selected Data Register, that will be shifted out, is "captured" upon the entry to the "capture dr" state. The new value shifted-in the Instruction Register, is applied (and the instruction takes effect) upon the entry to the "update ir" state. The value of the currently selected Data Register is applied (e.g transfered to the output pins, in case of the BSR) upon the entry to the "update dr" state.

Data Registers

As has been mentioned, the behavior of the test operation is affected by the contents of the instruction register, which selects between various different data registers to be operated upon during a "dr path". The following data-registers are present in almost any JTAG implementation:

The Device ID register (IDR) reads-out an identification number which is hardwired into the chip.
The Bypass register (BR) is a 1-cell pass-through register which connects the TDI to the TDO with a 1-clock delay to give test equipment easy access to another device in the test chain on the same board.
The Boundary Scan register (BSR), which has been described in detail above, intercepts all the signals between the core-logic and the pins.

Other registers may also be present on the chip, to perform other test operations

Instructions

The normal way of performing a JTAG test operation is to enter an instruction which specifies the type of test to be performed next, and the Data Register to be used during this test, into the Instruction Register (by means of running the TAP through an "ir path"), and then to use the Data Register to perform the test (by means of running the TAP through one or more "dr paths").

There are private and public instructions. Public instructions are documented by the chip manufacturers and available for general use. Private instructions are not. The IEEE-1149 standard defines a mandatory set of public instructions that must be present in all compliant JTAG implementations. This mandatory set contains the following instructions:

BYPASS: Here the TDI and TDO lines are connected to single-bit pass-through register (which passes to TDI to the TDO with a single-clock delay). This instruction allows the testing of other devices connected to the same test-loop.
EXTEST: With this command the boundary scan register (BSR) is connected between the TDI and the TDO signals. The chip's pin states are sampled and captured by the BSR cells at the entry to the "capture dr" state (see TAP state transition diagram above). The contents of the BSR register are shifted out via the TDO line at exits from the "shift dr" state. As the contents of the BSR (the captured data) are shifted out, new data are sifted in at the entries to the "shift dr" state. The new contents of the BSR are applied to the chip's pins during the "update dr" state.
IDCODE: The ID register is connected between the TDI and the TDO. At the entry to the "capture dr" state are the Device ID Code (a hard-wired identification number containing the manufacturer code, that part number, and the revision code) is parallel-loaded into the register. This number is shifted out at the exits of the "shift dr" states.
INTEST: With this command the boundary scan register (BSR) is connected between the TDI and the TDO signals. The chip's internal core-logic signals are sampled and captured by the BSR cells at the entry to the "capture dr" state (see TAP state transition diagram above). The contents of the BSR register are shifted out via the TDO line at exits from the "shift dr" state. As the contents of the BSR (the captured data) are shifted out, new data are sifted in at the entries to the "shift dr" state. The new contents of the BSR are applied to the chip's core-logic signals during the "update dr" state.