Up Your Test Game
While most engineers have heard of JTAG or even may have used JTAG, there’s some interesting background and capabilities that aren’t so well known. Robert examines the history of JTAG and looks at clever ways to use it.
Welcome back to the Darker Side. This month, my topic is JTAG. You may have already encountered these four letters, probably as a kind of programming interface for a fancy microcontroller (MCU) or FPGA. But do you know that JTAG was developed for factory test applications? And do you know you can use a cheap JTAG probe to toggle pins on your design or to read the status of a given I/O, without writing a single line of code?
SOME HISTORY
Once upon a time, the majority of electronic devices used standard through-hole components and DIP packages. As a consequence, the printed circuit boards (PCBs) were often double-sided. At that time—meaning maybe 30 years ago—the most common test setup in factories was called a “bed of nails tester.” It was a board full of small, spring-loaded pins, aligned to given test points on the PCB to be tested. Each PCB was precisely aligned and pressed on the test bed, and a computerized system checked the connectivity between given pairs of nails. Building the required test set for each new project was tedious and expensive, but at the time, this technique was very efficient for mass production. It allowed a quick check for short circuits, open connections and wrongly soldered or missing parts—all of the most common defects.
Then people wanted to buy smaller devices, and surface-mount technology appeared. Components became smaller and smaller, and more importantly, ICs became far more complex, up to ball grid array (BGA) packages with several thousand pins. Yes, thousands. Just check your latest Intel processor. As a consequence, PCBs grew in complexity, and multilayer designs became standard. At the same time increasing clock frequencies and concerns about electromagnetic compatibility called for very short traces and impedance matching, reducing the available free space on the PCBs. That was the end of the bed of nails, as there was, in fact, no space left on the PCB for the nails at all!
Unfortunately, the need for an efficient factory test was even greater than before, because PCBs were more complex than ever. Manufacturers had to find a solution, and started a working group in 1985: The Joint Test Action Group. Now you know were “JTAG” comes from. As for the bed-of-nails testers, the initial objective was to find a way to quickly identify short or open traces and defective solders. The result was released in 1990—and Specification IEEE 1149.1 “Standard Test Access Port and Boundary-Scan Architecture” was born.
THE JTAG “TAP”
Before discussing how to use it, let’s have a look at the JTAG interface itself. Any JTAG-compatible chip has a JTAG Test Access Port (TAP). Such a TAP is a kind of serial interface and includes four or five pins:
• TCK (Test Clock)
• TMS (Test Mode Select)
• TDI (Test Data In)
• TDO (Test Data Out)
• TRST (Test Logic Reset, optional)
— ADVERTISMENT—
—Advertise Here—
As shown in Figure 1, all chips may be chained through their TDO and TDI pins, whereas the TCK, TMS and TRST pins are distributed to all chips. Such a configuration is called a “scan chain,” and may include as many chips as you want, even if the usual limit is 10 or so. The host, say a controlling PC, communicates with the board through a dedicated JTAG connector.
How does the JTAG interface work in detail? Well, usually you will not care at all, as you will already be using validated JTAG chips and controllers. For those who are interested, it is a kind of SPI interface. First, the optional TRST line resets the JTAG logic to a default state. Note that this is a JTAG logic reset, not a system reset. The host then communicates with the chips by manipulating the TMS and TDI lines in conjunction with the TCK clock, and reads the output bits through TDO.
In a nutshell, to initiate a JTAG transfer, the host pulses TCK while toggling TMS with a given bit sequence. This allows controlling the TAP circuitry, according to a 16-state finite state machine specified by the IEEE-1149.1. Two of these states allow the host to get access to two registers inside the TAP–the instruction and data registers. These registers can then be accessed by pulsing TCK again, without changing the state of TMS. As with SPI, the bit stream is then written through TDI and/or read back on TDO. The maximum TCK frequency varies, of course, depending on all chips and wiring, but ranges from about 10 MHz to 100 MHz.
The strength of JTAG is that it is a standardized but flexible solution. Each JTAG-compatible chip must implement the TAP circuit exactly as specified for compatibility, but the set of instructions supported by a given device is expandable. Very few instructions are mandatory, except BYPASS and EXTEST. The first asks the chip to shorten its delay between TDI and TDO to just 1 bit, so as to reduce the overall test duration. EXTEST is the main command for boundary test, which I will talk about later. Nearly all chips support the IDCODE command, which allows reading the chip ID.
On the connector and pinout side, the bad news is that there isn’t any real standard. The typical JTAG connector is a 2×10 pin, 2.54 mm header block, used mainly on ARM systems. Unfortunately, there are plenty of other variants such as the 2×5 pin connector used by Altera, and even different pinouts with the same connector format. In summary, you’d better check the pinout of your JTAG connector.
It’s important to know that there is a reduced pin count version of JTAG specified by IEEE 1149.7 nicknamed cJTAG (compact JTAG). It uses only two pins, TMSC and TCKC, and a star topology. cJTAG is seldom used, but is, for example, implemented by Texas Instruments on the CC26XX RF family. Don’t confuse it with similar two-wire programming interfaces such as SWD (Arm), which are close cousins but not standard JTAG.
BOUNDARY SCAN?
Ok, now how can JTAG help us to test a complex PCB? By using a concept called “boundary scan.” The idea is simple but incredibly efficient. Each JTAG-compatible chip includes a small extra logic circuit for each I/O pin, called “boundary scan cell.” The function of this circuit is either to read the actual pin level or to disconnect it from the internal chip logic and to force it to 1, 0 or high impedance. These cells are daisy-chained to form a long shift register, which can be accessed through the TDI/TDO pins of the JTAG interface (Figure 2).
The cost of this extra logic circuit is small, but it enables easy testing of the board assembly. How? See, for example, Figure 3, which illustrates a three-chip board. To test if the board was properly assembled, just connect a computer to the JTAG host connector on the left through an adequate interface—more on that later. Need to check that the good chips were soldered properly into good sockets? Manipulating TCK and TMS, the host will start by asking all chips to put their instruction register between TDI and TDO. It will then send one IDCODE instruction for each chip through TDI, clocking TCK for each bit. Using TMS and TCK again, it will then ask the chips to put their data register between TDI and TDO, which now contain their identification word. The host will then send a clock signal on TCK, and will get on TDO a bit stream with the identity of each chip. Easy, isn’t it?
Need to check that each chip is well soldered and that there isn’t a short circuit or open circuit between PCB traces and pads? This will be done using the boundary scan circuitry. How? The host will switch the TAPs in boundary scan more through an EXTEST instruction. This will disconnect the inner logic of the chip from the I/O pads and allow the controller to drive each I/O manually. Look again at Figure 3, and assume you want to check the connection of the top right output of U1, which goes to U2 and U3. Using the boundary scan cells, the host will configure this pin as an output, and toggle it back and forth to 1 and 0. It will then read the state of all other pins of all circuits, and check if the logic levels are as expected. If there is a bad soldering somewhere or a short circuit between two pads, it will be detected easily. Similarly, the board input or output connections can also be tested using boundary scan. Apply some stimuli externally, and read the logic levels of the corresponding boundary scan cells through JTAG, and reciprocally.
— ADVERTISMENT—
—Advertise Here—
JTAG FOR THE DEVELOPER
Ok, so you understand that JTAG is a great tool for factory testing. I imagine that the majority of you are not factory test engineers, but rather hardware or software designers. Can JTAG be useful to you too? You bet it can! First, it can be used as a firmware programming and debugging tool, as plenty of MCUs and FPGAs use JTAG as their programming interface. This is done through proprietary JTAG instructions, which implement software programming and debug functions. With the proper host software, usually supplied by the manufacturer, this allows the use of JTAG to download code, execute it and debug it. Complex chips like processors also implement specific JTAG commands to execute built-in self test routines (BIST).
But what about boundary scan? It is also more than useful for a designer. Of course, you can use it to find any bad soldering on your prototype, but it can do much more. Assume, for example, that you have designed a board using a JTAG-compatible MCU. One of its outputs may be connected to a driver stage for, say, a motor. How would you test that the driver circuit is working when you’ve just assembled the first prototype? You could write some firmware on the MCU to activate the pin, but this would require some work. You could also cut the PCB trace between the pin and the driver, and excite it with an external circuit, but that’s work, too. With JTAG, you could simply use the boundary scan mode and switch the pin level on and off, without having to write a single line of code!
JTAG HARDWARE
At this point, you should be convinced that JTAG could be useful for you. However, you may be wondering how to actually use it on your projects. Of course, you will need to have some JTAG-compatible chips. No problem if you use any CPLD, FPGA, microprocessor, DSP or complex logic chips like PCI bridges, PHY interfaces and similar; 99% of them support JTAG. If you use a MCU, you have to double check. High end MCUs usually have a JTAG port and boundary scan logic. This is the case for the majority of recent Cortex-M3 or above ARM-based processors. That said, the smallest versions may not have a JTAG TAP available, mainly due to lack of I/O pins or cost constraints. For example, in Microchip MCU family, all PIC32MX variants have JTAG—even the 28-pin versions—whereas PIC16s don’t.
Maybe would you like to add JTAG to a board based on chips that aren’t JTAG-compatible. Or perhaps you just need to add boundary scan cells on logic signals that are not directly connected to any chip. No problem. You will find some dedicated chips for that purpose, even if they are becoming obsolete. For example, have a look at Texas Instrument’s SN74BCT8244A (Figure 4). This is the same chip that as the ubiquitous 74XXX244 (octal logic buffers), but with the addition of a JTAG TAP and boundary scan circuitry. You will also find bidirectional buffers (‘BCT8245A), latches (‘BCT8374A) and so forth.
One more consideration on the hardware side. To meet JTAG timing requirements, the JTAG lines should be routed properly on the board or problems may occur. This is especially true when designing large boards and/or chaining more than a couple of chips. In this case, it might be necessary to add buffers on TCK and TMS to maintain signal integrity. Another concern exists when a board uses several different logic voltages. In this situation, you will either have to implement different JTAG chains (one per voltage), or to add voltage translation circuits here and there. There is a good application note from Analog Devices on that subject. Links to that and various tutorial and standards resources are all available on the Circuit Cellar article materials webpage.
Finally, you will need a JTAG probe to connect your board to your PC. Here the choice is extensive, ranging from $10 circuits found on eBay up to professional probes costing $1,000 or more (Figure 5). Some read the power voltage from the board and adapt their line voltage accordingly, whereas others assume a fixed voltage. So, it is wise to double check. My advice here: First select your chips and software tools, then buy a probe that is proven to be compatible with both. The USB-Blaster from Intel (formerly Altera) or the J-Link-Lite from SEGGER may be a good starting point for hobbyists.
SOFTWARE TOOLS
You will also need software on your PC to drive the JTAG probe and do anything useful. The first option is to use the tools provided by the MCU or FPGA supplier. The basic versions usually are free. Nothing is new here, and you will be able to use JTAG to program the chip, debug the code with step-by-step and breakpoint commands, watch registers and so forth. This is exactly the same as using the more common SWD, ICSP or similar programming interfaces, but through a standardized JTAG interface.
But how to use boundary scan features? Here you will need other software, dedicated to hardware testing. Several companies specialize in this market, including JTAG Technologies, Corelis, Acculogic, XJTAG, Temento Systems and Asset. The downside is that this type of software is usually dedicated to factory testing, with prices that may be out of reach.
There are also some open-source solutions emerging. Honestly, I have never tested them, but you might want to look at goJTAG (gojtag.com), which includes a simple but open-source JTAG probe design, or OpenOCD (openocd.org).
A few entry-level commercial products, meaning “lite” versions, of more advanced products, are available. These are more accessible than high-end products, and might be good alternatives to open source. In this category, TopJTAG (topjtag.com) seems interesting, but later in the article I’ll discuss another tool: JTAGLive Buzz. JTAGLive is the low-cost product line of JTAG Technologies, and Buzz is their entry-level software, which is downloadable for free. It works not only with their own low-cost JTAG probes, but also with third-party probes such as Intel’s (Altera’s) USB-Blaster, Xilinx’s and generic FTDI’s based probes.
BSDL
Before playing with boundary scan software, you will need to collect some information about the chips you are using. What are their chip IDs? What are their I/Os? How long is their boundary scan shift register? Which JTAG instructions do they support? The JTAG working group has standardized a specific description language for that, namely BSDL (Boundary Scan Description Language). Thanks to BSDL your job will be easy, because each manufacturer should provide a BSDL file with each of its JTAG-enabled part.
I will not describe in detail the content of the BSDL file, mainly because you will get this file from the manufacturer’s web site and insert it into your JTAG host software. Users of VHDL will feel at home, because BSDL is a subset of VHDL. I encourage you to read the BSDL file, which is a good way to understand JTAG. For example, go to ST Microelectronics’ website, look for any JTAG-compatible MCU (the Cortex M3-based MCUs are good candidates, why not the STM32L100RB-A?), scroll down to the “HW-mode & CAD files” section and you will find its BSDL file. In this file, which is plain text, you will find the package description, list of I/O pins and their characteristics, TAP description and so on. For your information, at least one website (www.bsdl.info) houses a collection of all BSDL files.
AN EXAMPLE!
Now let’s put JTAG to work. I found in one of my drawers an old CORELIS JTAG test board, which was perfect for illustrating this article (Figure 6). It includes four Texas Instruments (TI) SN74BCT8374A boundary-scan enabled octal D-type flip flops from TI, and plenty of switches to create short or open circuits. I connected its JTAG port to my PC using a JTAGLive controller probe, downloaded Buzz software and launched it. The first step was to scan the JTAG chain for devices. Here the software displayed four chips as expected (Figure 7). However, it did so only after one hour, because I found that the TDO and TDI pins had to be inverted between the probe and board connectors. I then had to find the ‘BT86374A BSDL file on the web, right click on each of the four discovered chips and select it. Buzz then checked if the selected BSDL files corresponded to the physical hardware, and displayed a friendly “Passed” message (Figure 8).
At this stage, you are in full control of your hardware through JTAG. Let me show you how Buzz can help you. Do you want to read the logic level of a given pin? Just drag & drop the corresponding pin name to the “Watch” section, and click on the icon on the right (Figure 9). Do you want to make sure that two pins are interconnected as they should be, based on your schematic? Drag & drop their names in the “Buzz” section, and you will get a green arrow if they are. Easy, isn’t it? Another great feature unfortunately is only available if you buy the Buzz Plus version (about $114): You can select a pin and automatically search for other pins connected to it (Figure 10). This is particularly useful for finding shorts under fine-pitch packages!
WRAPPING UP
I have just scratched the surface of this subject. My aim was to show you that JTAG and boundary scan techniques are not only for factory testing. They are also great tools for developers for investigation and debugging. As usual, I strongly encourage you to experiment with these techniques on your own. Buy or build a low-cost JTAG probe, connect it to the JTAG port of your MCU of choice, download low-cost or open-source test software and magic will happen! 
— ADVERTISMENT—
—Advertise Here—
RESOURCES
JTAGLive controller & Buzz software
https://www.jtaglive.com/
OpenOCD
http://openocd.org
SN74BCT8244A
Scan test devices with octal buffers
http://www.ti.com/lit/ds/symlink/sn74bct8244a.pdf
SN74BCT8374A
Scan Test Device With Octal D-Type Edge-Triggered Flip-Flops
http://www.ti.com/product/SN74BCT8374A
STM32L100RB-A
Ultra-low-power 32-bit Value Line ARM Cortex-M3 MCU
https://en.wikipedia.org/wiki/JTAG
JTAG standards and links to IEEE website
https://www.jtag.com/en/content/standards
IEEE Std1149.1 (JTAG)Testability
Texas Instruments 1997
http://www.ti.com/lit/an/ssya002c/ssya002c.pdf
JTAG tutorial
CORELIS
https://www.corelis.com/educationdownload/JTAG-Tutorial.pdf
https://www.embedded.com/electronics-blogs/beginner-s-corner/4024466/Introduction-to-JTAG
https://www.electronics-notes.com/articles/test-methods/boundary-scan-jtag-ieee1149/boundary-scan-description-language-bsdl.php
Instructions on doing (semi-)manual JTAG boundary scan with OpenOCD
Paul Fertser
https://sourceforge.net/p/openocd/mailman/message/31069985/
Architecting a Multi-Voltage JTAG Chain
Hossain Hajimowlana , Analog Devices
http://www.analog.com/en/analog-dialogue/articles/architecting-multi-voltage-jtag-chain.html
JTAG Technologies | www.jtag.com
Microchip Technology | www.microchip.com
SEGGER Microcontroller | www.segger.com
STMicroelectronics | www.st.com
Texas Instruments | www.ti.com
PUBLISHED IN CIRCUIT CELLAR MAGAZINE • DECEMBER 2018 #341 – Get a PDF of the issue
Sponsor this Article
Robert Lacoste lives in France, between Paris and Versailles. He has more than 30 years of experience in RF systems, analog designs and high-speed electronics. Robert has won prizes in more than 15 international design contests. In 2003 he started a consulting company, ALCIOM, to share his passion for innovative mixed-signal designs. Robert is now an R&D consultant, mentor and trainer. Robert’s bimonthly Darker Side column has been published in Circuit Cellar since 2007. You can reach him at askrobert@lacoste.link.
