EEVblog #499 - What is JTAG and Boundary Scan?

hi welcome to fundamentals Friday today we're going to take a look at the JTAG interface JTAG stands for the joint test action group and I'm sure you've probably heard of JTAG and you may have even used it in terms of programming a microcontroller or an FPGA or you and/or using it as a debugging interface or something like that for example well that's not the only thing it can do in fact it originally wasn't designed for that JTAG came about in the late 80s when manufacturers started realizing that you know we're having a real a lot of trouble testing assembled PCBs packages were getting more dense are moving towards packages like BGA where the balls on the bottom of the device you can't use a traditional bed of nails tester to come down and if you did if you've got a you know a 500 pin chip or something boy that's a lot of test pins to come down and test your assembled PCB it was getting very difficult so a bunch of manufacturers got together and said well what can we do about it can we actually embed it come up with the standard that allows us to embed some hardware into the chips so that they can we can use that to test themselves so it can access all of these pins under the PCB without having to use a traditional bed of nails test system and that's exactly what they came up with and it was ratified by the I Triple E as a standard in around about 1990 and that's where the name comes from the joint test Action Group test was originally designed as a way to actually get in there and test individual pins on a chip which has JTAG built into it on the assembled PCB in cases where you couldn't physically get access like big BGA chips for example or there were just too many pins on a huge system that you're just you know you don't need thousands of pins to actually test it on your better nails or your flying probe test her to take too long to move all the probes around the test at all so that's what it was originally designed for and Henson boundary scan JTAG is also known as boundary scan testing and as the name implies we have to have a look at a block diagram here of a typical chip that includes a JTAG or this boundary scan testing now this chip could be an FPGA for example it could be a modern micro controller that has JTAG built in it could be a special-purpose custom chip that implements JTAG as well or practically anything on the market a dead giveaway for a chip that has JTAG build in are the pin names here if they got TV otda TCK and TMS you can bet your bottom dollar it's got JTAG built in now not all of the chips have all of the same functionality because they don't need it but let's take for example a micro a modern micro controller with a JTAG interface not only will it contain your traditional boundary scan around here which we'll talk about but it is also used as the interface where you can program your flash memory built-in so it's going to talk to the flash controller built-in and yes that micro controller may also have another block in here which then goes out to your traditional IC SP at your in circuit serial programming method and you may have two different methods actually program your flash micro controller for example but it's also going to go into debug controllers these days we've talked about ice systems before in circuit emulators which pretty much have gone the way of the dodo and have been replaced by the JTAG interface so that will also connect into the debug controller and that allows you to monitor and debug your code inside your microcontroller in real time so but that originally that wasn't really thought of when the JTAG the joint test action group originally started this what they started for is this boundary scan stuff around here now this is the interesting thing about je t'ai which a lot of people aren't familiar with they're used to using it to program and debug their mic controller for example but there's much more powerful functionality behind it and most chips which have JTAG building will also have this boundary scan capability around here now what is boundary scan well as the name implies the it has some circuitry attached to each pin you could call it like a JTAG cell for example I've drawn it as one big block here for that sort of you know joins all the pins but in reality it's like an individual JTAG cell a little bunch of logic in there which connects in between the usual chip i/o which we have looked at in the last video for example with FPGAs we looked at all the complex io stuff they had well not only did they have that I didn't show something last week and that's that bound additional boundary scan circuitry in there which is tucked away between the chip i/o and the pin all right you know this is a just a crude graphical representation of how it works how they actually implement it in there is up to the individual manufacturer but it's easy to think of it as being between your regular IO drivers on your micro controller or your FPGA for example and the pin and during normal use your program and debug your micro controller you don't even know this JTAG this boundary scan circuitry is actually in there it just defaults to off when you power on the chip and it does nothing it just passes the signal straight through from your regular chip IO circuitry here so what they do with these little JTAG cells is they actually what I've kind of shown it here I've shown an arrow going out like this and going into here but in reality as I said they're like individual cells and they go from one to the other and there's a serial a1 one-line serial i/o which goes in to each cell and then comes out and they're cascaded like that in a serial fashion until the data comes out so your feed data into the chip and you can and it just cascades and ripples all the way through like this ripples a bad term because that's actually asynchronous our clock in here which does everything so don't confuse that but and the data flows in a serial fashion like that and pops out and what does that allow you to do well it depends on the functionality built into the boundary scan but most of them are going to allow you full direct control over that I open not only are you able to read the value back directly on the pin of the chip and this is why I've shown it actually sort of after the chip IO here it's in between the chip IO driver and the pin because the idea of boundary scan is you physically read the actual electrical value on that pin not after any of the chip i/o or anything like that it actually allows you to read exactly what's on the pin itself so you can read back all that data and shift it out and do whatever you want with it but not only can you read it you can that they can have a driver in there as well that allows you to set a value on that pin and being able to set and read values that gives you an incredibly powerful tool to do in system debugging for example we if this was a microcontroller for example and we hadn't finished doing our firmware yet we haven't programmed the chip was empty it does nothing it doesn't matter if we've got a populated PCB what we can do is hook it up to our JTAG programmer and we can individually talk to and drive and read all of the pins on the board so for example let's say we had an external memory hooked up to this thing on - all these i/o pins here how do you test that memory to make sure it's okay well we can write individual value values to the address and data buses and then we can read it all back and we can actually exercise and test an external memory for example through our JTAG interface but not only that the assembled PCB it allows you to test for your more traditional things like our shorts and opens and things like that so and that's stuck bits let's say this pin here is shorted to ground like that well what you try and do is you try and write a 1 to it and then read it back and if you can't do that oops then you know it's shorted if it always reads back to zero then you know it's always shortened to ground and also and then if you had say two pins shorted like that on your PC on your assembled PCB you had a little solder bridge or something like that well based on your testing algorithm you can drive one and read the other etc and you can actually do all that in various combinations and you can check for shorts between this pin over here and this pin depending on your layout of your board and all sorts of stuff incredibly powerful and that is one of the main uses of JTAG which a lot of people aren't familiar with they just think it's programming and debugging but nope there's lots of powerful stuff hidden inside your chip you're probably already using we've already briefly looked at the four main pins of the JTAG controller and that's all it takes four pins is always going to be four pins there's a tdo which is the data coming out of the chip don't confuse them in terms of your traditional TX and rx when you get them mixed up T do on a chip when it's labeled T do is always the data coming out and TDI is always the data going the serial data going into the chip and then you've got your T clock line which is your synchronous clock which actually controls all the data shifting and everything else in there and you've got TMS which is a control line which does stuff as well based on that tip lock and everything else and those four pins allow you to feed data into the chip and read data back out and one other powerful feature as well after you've programmed your microcontroller here and you're running your firmware you can also at the same time access this boundary scan stuff and read live data changing on your pins here whoa that can be incredibly powerful but unfortunately because it's a big serial shifted interface it's not going to be very fast it's not a real-time all that sort of stuff and as I said it's not incredibly fast because it is a serial shifted system and if you've got an FPGA for example that's got a huge one that's got 800 i/o pins poor you've got to shift through all that data and all the other control data that's looked into and reading stuff like that can be a massively long serial data stream but not only that not only can you talk to one ship we can look our program ignoring all this we haven't talked about that yet we will in a second you have your programmer your JTAG programmer hooked up directly to the JTAG pins okay you can just talk to this one chip but the beautiful thing about the serial daisy-chaining nature of the JTAG system is that you can have additional chips on your board essentially an unlimited number essentially and then daisy chain those together so the TDI so your so instead of plugging directly into this chip here's our programmer plugged on the way I had it header on our board over here we've got our data coming in okay it goes through this chip bought all the stuff it needs to and then it shifts the data out and then the data goes into the TDI pin of chip number 2 here and it goes through its big J tagged daisy chain in there comes out the tdo pin and then you can daisy chain that to a third chip and so on and so on you can have as many chips as you as you like subject to electrical design rules and you know bus let your night load in and all that sort of stuff you can have as many devices in series as you like and the data finally spits back out so you could have a hundred chips on your board that all have JTAG interfaces in them you could hook them all onto one JTAG header lousy for pins you can test every single pin on every chip on your entire board both of the assembly stage and when it's actually running and you can read data back fantastic so that's all known as the JTA chain and it's very common to have more than one device hooked on here and I won't go into well I have to go into another video how FPGAs are also like they will have their external flash memory on the JTAG chain as well we talked about that and how that's all tied in and then how it can actually load data and you program your external flash memory for FPGA via this huge JTAG chain and each individual device will have its own internal ID and that can be all read out and there's a whole well there's a standard protocol behind all this which then allows you to talk and respond to any one of these chips but you have to understand that you can't just go oh I want to talk to this chip only you have to get the data if you physically daisy-chain them all like this or you know if you've got a hundred chips on your board of daisy chain them or well you had to get the data just out of this one you have to wait until you've got the data out of all the others well it depends where it is in the line where it physically is in the daisy chain part of the system now a lot of boards in in case of development and also production as well you'll actually build in jumpers on the board here so that you can actually you know a little to pin jump ahead or so that you can actually you know jump out that and bypass that particular chip from the JTAG interface that's useful for us speeding up our debugging and stuff like that let's say you what it really fast debugging well as fast as possible on the pins of this chip well you could short out all the other chips in your JTAG daisy chain to do just that and any JTAG chip that meets the JTAG standard will have an Associated file that you can just download from the manufacturers website and it defines the entire JTAG interface for that particular chip and that's known as a boundary scan description language or bsdl file that you can get from the manufacturer and that's a variant of VHDL so it's like a VHDL sort of language that describes what each individual pin does and the description ID for each chip and all that sort of stuff so you're JTAG system software that you're using on your PC or your test system will be able to read that bsdl file and know exactly how to talk to and operate and have the all the i/o mapping and the pin mapping and all the internal stuff for interfacing with a particular chip on that JTAG daisy chain and yes I know what some people are thinking if there's a JTAG header as you've seen in many of my tear downs inside a product not only can you hook up to it and read the data back out potentially read the firmware and everything else but you can also access the individual pins via the boundary scan here and you can use that to hack products mmm now I did actually leave out one line here because it's actually optional and it's not always use the t rst pin which is once again parallel connected to all the devices in the JTAG chain here and that can just reset the entire chip all of your chips all at once but you don't have to do that because you can actually reset them through our commands through the serial lines anyway all the chip itself may actually have individual like a difference or a reset circuit rebuilding now when you've got a JTAG daisy chain like this the maximum system operation of the JTAG chain is going to be determined by the slowest device in the chain so if one device is only capable of working at ten megahertz for example then well that's what you have to run your entire daisy chain at but you know they can work from anywhere from say 10 up to a hundred megahertz or so they can be actually very quick but still shifting all that data through it's not going to be able to read pins in real time that's for sure and thankfully we have something in the mail bag from xjtag purveyors of fine JTAG pornography that should be able to help us have a look at the hardware side of things and the software so let's crack it open and see what we got for her look at this beautiful with compliments AHA we have ourselves a JTAG demo board looks very impressive we have ourselves an XJ tag our xjlink2 JTAG interface and some software mmm now we'll just take a quick look at a practical example of looking at a basic Hardware JTAG interface using xjtag - programmer that we got here now this is not a hobbyist level tool this is a real professional high-end JTAG development not only programmer but the software and and the whole system behind it and it comes with this very nice demo board which should allow us to do which should allow us to like open pins and put various shorts and fault conditions on that as well now it's got an arm 9 processor on here that's a TIR stellaris lm3 s-300 it's got a Xilinx that CP OD on here as well that's got a built-in flash so that doesn't have like an external configuration prom or anything like that and that CP OD is hooked into some flash memory and some SRAM up here and then we can like introduce opens on the data bus and do things like that so we're going to have two programmable devices in our JTA chain for this thing now this programmer is actually capable of doing a lot more it's capable of reconfiguring all its pins on the output to match you know Xilinx or our Tara or anyone or any other manufacturer or even your custom own custom interface it can supply power through to this board as well all configurable on each individual pin it's hooked up to an I squared C bus on here as well which is then hooked into it and I squared C EEPROM a squared prom it's hooked up to an analog to digital converter on the I squared C bar so we've got some analog inputs and stuff like that don't have no time for muck around with that but we definitely want to look at these two devices on the JTAG chain that should be easy now what I'm running at the moment is this xjtag program that comes with it called the pin map chain debugger and this is sort of like a low-level interface where we can just get sort of the raw data and we can configure as I said the you can see that the header connector on this thing is completely reconfigurable now every JTAG programmer and their software's going to be different this is not going to be a review of the xjtag stuff this is just how this one happens to work and here we go we can actually reconfigure all of these pins here we can choose different types we can choose the xjtag interface moldy ice the bite our terabyte Blaster compatible interface so we can choose that if we want we can use the Zetas alias interface or a custom interface but anyway what we want is the xjtag you can see the pins here we've got TDI TMS tea clock t do you'll notice that there is no RT reset it's not actually used in this configuration and we want to actually power the board from this device so we can actually choose power on there do I want to continue yes I know what I'm doing how I blow up my board and it applies power to pin number one and you can see that these pins change state that's actually a live view there and anyway what we can do is then we can go down here and we can check well let's start ID code so let's try that there we go bang we're starting to read the ID codes it's found two different IDs chip IDs here and you would have to know what these IDs are you would have to know that okay that chip but there's definitely two chips on there so I can stop scanning that there we go so it's found two devices on that JTAG chain now what we can do is actually a neat function of this is we can get the maximum T clock so what it's going to do we can hit that and then it's just going to cycle through the frequencies until it basically gets an error to find the maximum frequency in this signal and bingo there it is max frequency 26 megahertz so this xjtag JTAG two devices capable of 166 megahertz so if your system was capable of that this is a neat little tool to find that anyway just thought I'd show you that we can clear and now let's check the chain here we go starting chain check and there's two devices found bingo there they are it doesn't know the actual our codes it doesn't know how to translate those codes yet through to a you know to map it to a particular device to tell you of it's an FPGA but there you go it tells you the length of the various chains but if we go over to the device configuration over here bingo it has found them look the Xilinx one there we go it's matched at the Xilinx and an arm there we go and the Xilinx is an sexy 9 5 3 6 it's automatically found that and it's automatically found the armed processes an LM 3 s 300 awesome and what we can do now is we can go up into tools and then view JTAG data and we can check that chain again and whoa look at what we got all this goodness there's our raw data from device number one and device and number two from both of these devices on the JTAG chain brilliant and of course you've got to know what each of the individual art bits doing things like that but this just allows you to suck the raw data out of this thing just as a first pass now I'm running what's called the XJ analyzer program and this allows us to do lots a really funky analysis and I've loaded in the example demo board it's already are pre-configured with our device types and it shows both of the devices down here now we've actually stopped this but we can actually go in there and run it and here we go bingo we get and now a live map of what out individual pins are doing here the yellow ones look that pin on that particular our CPL d is oscillating for example these ones are low high fantastic and we can go in there and modify individual pins so now got it run in and look if we right click here we can set individual pins lie low high we can set them to toggle lower fast the pin properties the device properties are fantastic there it is read value and output in net all sorts of stuff and you can you know can figure all this to the cows come home for your specific of course you'd set it all up for your specific artboard and your application for what you want to do we can go into the device properties there max JTAG frequency of this device for example our 10 megahertz I'm currently running it at 20 so it looks like we're overclocking it a bit like that I mean we can go in there and then we can set the chain frequency here and I've got it running at 20 but we can you know drop that back down it's adjustable for ten kilos 166 in 10 kilohertz steps for example we can drop that down not a problem so there's or the instruction length the boundary length how many bytes I think that figure was exactly what we saw before in the previous program 46 pins on here and that's the ID code that we got out of it that matched it fantastic now the thing you have to remember here is that we're using the JTAG interface to read all the data of all these pins out live while that microcontroller is doing running its regular firmware it's come there can - completely independent systems and we can get in there while that microcontroller firmware in this LM 3s for example is running we can go in there and individually override pins and disabled pins and set them and toggle them and do whatever and the firmware doesn't know that we're actually doing that completely independent now look what happens if i press this button here here we go look at that there's a pin on this such CP or d the buttons obviously connected to c 3 there and if i press that there we go it goes high low and if i continue to press it it tells us that it goes yellow to tell us that it's oscillating and watch this we can now go in here to this pin for example which is currently set low and we can which is it's telling us because it's a it's blue it's got a cross in it that we're actually setting it and we can make that toggle like that and bingo look what we got over here pin 48 up here of our our microcontroller is obviously connected through to that or they've got some sort of you know a linkage some however through the firmware is doing that or whatever because if this pin over here was going to an input to this microcontroller and then it was outputting it was just you know inverting and then output in that signal or something like that then we can actually see it doing that so we can just set that high and look at that too easy so that one's actually low so they're not actually physically connected they're inverted and then extremely briefly because well I haven't played that much is the full-on developer software with this thing and we can have our boards for example I've loaded in and we can have we've got this schematic of the board or the parts we can categorize our devices on it we can set up all our pins or our logic files our test circuits and all sorts of stuff designed for test and run and deploy and we can configure this thing to basically test any JTAG enabled system imaginable so you can really see the power of this JTAG system I mean imagine if we opened up a product like an oscilloscope or something and had a JTAG header in there we could hook up our JTAG programmer to it we can see what all the pins are doing not quite in real time but you know it does allow you to see things happening we can set and modify things all independent of the firmware it's very powerful and that doesn't include all the you know that's nothing to be said for the production testing side of things the testing assembled boards which is basically what all this stuff's about programming devices and pretty much it's not just about the programmer hardware that's you know almost irrelevant really the JTAG hardware it's all about the software and yes this is a big professional level software package but there are many many ones on the market built into our many different tools and things like that or they have independent tools like this one so that's JTAG and it is a as I have shown it's an incredibly powerful system that you probably didn't know is lurking behind any chip that has these JTAG that has a JTAG interface you may have used for programming or debugging so there you go I hope you found that video useful and you've learned a bit about JTAG and I'm sure I'll be doing more on it in the future so if you like fundamentals Friday please give it a big thumbs up you can't see my thumbs but I am sticking them up here and if you want to discuss it jump on over to the ear V log forum catch you next time you you

Channel: EEVblog

Views: 349,090

Rating: 4.9716234 out of 5

Keywords: Boundary Scan, Joint Test Action Group, jtag, xjtag, xilinx, altera, fpga, arm, microcontroller, arm microcontroller, Field-programmable Gate Array (Consumer Product), demo, how to, bsdl, boundary scan description language, icsp, flash memory, daisy chain, XJLink2

Id: TlWlLeC5BUs

Length: 28min 59sec (1739 seconds)

Published: Fri Jul 26 2013