JTAGchip PDF

1149.
1 Boundary Scan Standard: Chip Level Architecture

BA
June, 2006
Boundary-Scan Technology
IEEE
IEEE 1149.1
1149.1
Boundary-Scan
Boundary-Scan Standard
Standard
Part
Part 1:
1: Chip
Chip Level
Level
Ben Bennetts, DFT Consultant
Bennetts Associates, UK
Tel: +44 1489 581276 E-mail: ben@dft.co.uk
http://www.dft.co.uk/
2006, Bennetts Associates
1149-1-chip.ppt, Last revised: June 2006
Slide 1
In this tutorial, you will learn the basic elements of boundary-scan architecture where it
came from, what problem it solves, and the implications on the design of an integratedcircuit device.
Bennetts Associates, 2006
Page 1
1149.1 Boundary Scan Standard: Chip Level Architecture

BA
June, 2006
The Standard
IEEE
IEEEStandard
Standard1149.190,
1149.190,1a-93,
1a-93,1b-94,
1b-94,1c-01
1c-01
Test
TestAccess
AccessPort
PortAnd
AndBoundary-Scan
Boundary-ScanArchitecture
Architecture
Available
Availablefrom:
from:
http://standards.ieee.org/
http://standards.ieee.org/ or
or
http://www.techstreet.com/info/ieee.html
http://www.techstreet.com/info/ieee.html or
or
http://global.ihs.com/
http://global.ihs.com/

Slide 2
The core reference is the IEEE 1149.1 Standard:

IEEE Standard 1149.1-2001 Test Access Port and Boundary-Scan Architecture,
available from the IEEE, 445 Hoes Lane, PO Box 1331, Piscataway, New Jersey 088551331, USA. The standard was first published in 1990, revised in 1993 and 1994, and most
recently in 2001. You can obtain a copy of the Standard via the world wide web on the
IEEE home page at: http://standards.ieee.org/catalog.
The 1993 revision to the standard, referred to as 1149.1a-1993, contained many
clarifications, corrections, and minor enhancements. Two new instructions were
introduced in 1149.1a and these are described in this tutorial.
The 1149.1b-1994 supplement contained a description of the Boundary-Scan
Description Language (BSDL).
The 1149.1-2001 version contains enhancements to the wording, plus removal of the use
of the all-0s code for the Extest instruction. In addition, the mandatory Sample/Preload
instruction has been spit into two separate instructions: Preload and Sample, both still
mandatory.
Page 2

BA
June, 2006
In-Circuit & Functional Board Test
Bed-Of-Nails (ICT, FPT, MDA)

Functional
Slide 3
Since the mid-1970s, the structural testing of loaded printed circuit boards has relied very
heavily on the use of the so-called in-circuit bed-of-nails technique (see above). This
method of testing makes use of a fixture containing a bed-of-nails to access individual
devices on the board through test lands laid into the copper interconnect, or into other
convenient physical contact points. Testing then proceeds in two phases: power-off tests
followed by power-on tests. Power-off tests check the integrity of the physical contact
between nail and the on-board access point, followed by open and shorts tests based on
impedance measurements.
Power-on tests apply stimulus to a chosen device, or collection of devices (known as a
cluster), with an accompanying measurement of the response from that device or cluster.
Other devices that are electrically connected to the device-under-test are usually placed
into a safe state (a process called guarding). In this way, the tester is able to check the
presence, orientation, and bonding of the device-under-test in place on the board.
Page 3

BA
June, 2006
In-Circuit Test & Test Objectives

Presence
Presence
Orientation
Orientation
Bonding
Bonding
Bed-Of-Nails (ICT, FPT, MDA)
Slide 4
Page 4

BA
June, 2006
Defect Coverage: Bed-Of-Nails
Driver
(Sensor)
Sensor
(Driver)
Driver
(Sensor)
Defects covered: nail - plated-through-hole - interconnect

- solder - leg - bond wire - device - bond wire - leg - solder
- interconnect - plated through hole - nail

Slide 5
The use of boundary-scan cells to test the presence, orientation, and bonding of
devices was the original motivation for inclusion in a device. The use of scan cells as a
means of applying tests to individual devices is not the major application of boundaryscan architecture. Consider the reason for boundary-scan architecture in the first place.
The prime function of the bed-of-nails in-circuit tester was to test for manufacturing
defects, such as missing devices, damaged devices, open and short circuits, misaligned
devices, and wrong devices. See diagram above.
In-circuit testers were not intended to prove the overall functionality of the on-board
devices. It was assumed that devices had already been tested for functionality when they
existed only as devices (i.e., prior to assembly on the board). Unfortunately, in-circuit test
techniques had to make use of device functionality in order to test the interconnect
structure hence the rather large libraries of merchant device functions and the
problems caused by increasing use of ASICs.
Page 5

BA
June, 2006
Device Packaging Styles
Thru-Hole
Surface-Mount
DIP
PGA
SOJ
PLCC

SOIC
QFP
TSOP
BGA
Slide 6
Fundamentally, the in-circuit bed-of-nails technique relied on physical access to all

devices on a board. For plated-through-hole technology, the access is usually gained by
adding test lands into the interconnects on the B side of the board that is, the solder
side of the board. The advent of onserted devices packaged in surface mount styles
see Figure above - meant that system manufacturers began to place components on both
sides of the board the A side and the B side. The smaller pitch between the leads of
surface-mount components caused a corresponding decrease in the physical distance
between the interconnects.
Page 6

BA
June, 2006
Multi-Layer Board Construction

Components
A Side
Vias
Inner
Layers
B Side
Components
Slide 7
Page 7

BA
June, 2006
Probing Multi-Layer Boards

Slide 8
The move to surface-mount packaging had a serious impact on the ability to place a nail
accurately onto a target test land, as shown in the Figure. The whole question of access
was further compounded by the development of multi-layer boards created to
accommodate the increased number of interconnects between all the devices.
Basically, the ability to physically probe onto the board with a bed-of-nails system was
going away: physical access was becoming limited.
Page 8

BA
So, What Went Wrong?

Thru-Hole
June, 2006
Surface-Mount
DIP
PGA
SOJ
PLCC

SOIC
QFP
TSOP
BGA
Slide 9
Page 9

BA
June, 2006
What Problem Did This Cause?

Nowhere
Nowheretotoprobe
probe
onto
ontothe
theboard.
board.

Slide 10
Page 10

BA
June, 2006
What Was The Solution?
Joint (European) Test Action Group, 1985 - 90

Slide 11
Page 11

BA
June, 2006
Principle of Boundary Scan

Test Data In (TDI)
Input
Scan Cell
Test Clock (TCK)
Any Digital Chip

Test Mode Select (TMS)
Test Data Out (TDO)
PI
SI
SO
PO
Output
Scan Cell
Each boundary-scan cell can:

R Capture (parallel load) data on its parallel input PI
R Update (parallel unload) data onto its parallel output PO
R Serially scan data from SO to its neighbours SI
R Behave transparently: PI passes to PO
R Note: all digital logic is contained inside the boundaryscan register
Slide 12
In a boundary-scan device, each digital primary input signal and primary output signal is
supplemented with a multi-purpose memory element called a boundary-scan cell. Cells
on device primary inputs are referred to as input cells; cells on primary outputs are
referred to as output cells. Input and output is relative to the internal logic of the
device. (Later, we will see that it is more convenient to reference the terms input and
output to the interconnect between two or more devices.) See diagram above.
The collection of boundary-scan cells is configured into a parallel-in, parallel-out shift
register. A parallel load operation called a Capture operation causes signal values
on device input pins to be loaded into input cells, and signal values passing from the
internal logic to device output pins to be loaded into output cells. A parallel unload
operation called an Update operation causes signal values already present in the
output scan cells to be passed out through the device output pins. Signal values already
present in the input scan cells will be passed into the internal logic.
Data can also be Shifted around the shift register, in serial mode, starting from a
dedicated device input pin called Test Data In (TDI) and terminating at a dedicated
device output pin called Test Data Out (TDO). The Test ClocK, TCK, is fed in via yet
another dedicated device input pin and the various modes of operation are controlled by a
dedicated Test Mode Select (TMS) serial control signal.
Page 12

BA
June, 2006
Motivation For Boundary Scan: Summary
Major change of device packaging: from thru-hole (DIL) to

surface mount (SOIC, QFP, BGA, etc), leading to
increasing density of devices on the boards, leading to
development of double-sided and, eventually, multi-layer
Printed-Circuit Boards (PCBs), leading to ...
reduced physical access for MDA/ICT nails
Question: how to test for manufacturing defects?

Answer: use boundary scan structures

Slide 13
To summarize, the basic motivation for boundary scan was the miniaturization of device
packaging, the development of surface-mounted packaging, and the associated
development of the multi-layer board to accommodate the extra interconnects between
the increased density of devices on the board. These factors led to a reduction of the
one thing an in-circuit tester requires: physical access for the bed-of-nails probes.
The long-term solution to this reduction in physical probe access was to consider building
the access inside the device i.e. a boundary scan register. In the next section, we will
take a look at the device-level architecture of a boundary-scan device, and begin to
understand how the boundary-scan register solves the limited-access board-test problem
Page 13

BA
June, 2006
JTAG Meeting, 17 September, 1988

Slide 14
Such was the situation in the mid-1980s when a group of concerned test engineers in a
number of European electronics systems companies got together to examine the boardtest problem of limited access and its possible solutions. The group of people initially
called themselves the Joint European Test Action Group (JETAG). Their preferred
method of solution was to bring back the access to device pins by means of an internal
serial shift register around the boundary of the device - a boundary scan register.
Later, the group was joined by representatives from North American companies and the
E for European was dropped from the title of the organization leaving it Joint Test
Action Group, JTAG see photograph above. (The author is in the front row, third from
the right-hand end.)
JTAG did not invent the concept of boundary scan. Several
companies, such as IBM, Texas Instruments and Philips, were already working on the
idea. What JTAG did was to convert the ideas into an international Standard, the IEEE
1149.1-1990 Standard, first published in April 1990.
Page 14

BA
June, 2006
Using The Boundary-Scan Path
TDI
Any Digital Chip
Any Digital Chip
TCK
Input Scan Cell:
Sensor (RX)
Output Scan Cell:

Driver (TX)
Any Digital Chip
Any Digital Chip
TMS
TDO

Slide 15
At the device level, the boundary-scan elements contribute nothing to the functionality of
the internal logic. In fact, the boundary-scan path is independent of the function of the
device. The value of the scan path is at the board level as shown in the diagram above
The figure shows a board containing four boundary-scan devices. Notice that there is an
edge-connector input called TDI connected to the TDI of the first device. TDO from the
first device is permanently connected to TDI of the second device, and so on, creating a
global scan path terminating at the edge connector output called TDO.
TCK is
connected in parallel to each device TCK input. TMS is connected in parallel to each
device TMS input.
Page 15

BA
June, 2006
What The Tester Sees
TDI
TCK
TMS
TDO

Slide 16
What the tester sees from the edge connector is simply the concatenation of the various
boundary-scan registers that is, a single register that provides access to all device
outputs now considered to be drivers (sometimes called a transmitter) onto an
interconnect) and all device inputs (now considered to be sensors (sometimes called a
receiver) from the interconnect see diagram above.
In this way, particular tests can be applied across the device interconnects via the global
scan path by loading the stimulus values into the appropriate device-output scan cells via
the edge connector TDI (shift-in operation), applying the stimulus across the
interconnects (update operation), capturing the responses at device-input scan cells
(capture operation), and shifting the response values out to the edge connector TDO
(shift-out operation).
Essentially, boundary-scan cells can be thought of as virtual nails, having an ability to
set up and apply tests across the interconnect structures on the board.
Page 16

BA
June, 2006
Even Simpler
Driver (TX) boundary-scan cells
TDI
20 interconnects
TDO
Sensor (RX) boundary-scan cells
Question:
Question:how
howmany
manytests
teststotocatch
catchall
allopens
opens(modelled
(modelled
by
the
s-a-1/s-a-0
model),
and
all
2-net
by the s-a-1/s-a-0 model), and all 2-netshorts
shorts
(modelled
(modelledby
bythe
thewired-AND/wired-OR
wired-AND/wired-ORmodel)?
model)?
Slide 17
We will answer the question later in the course.
Page 17

BA
June, 2006
Basic Boundary-Scan Cell (BC_1)

= 0, Functional mode
Mode = 1, Test mode
(for BC_1)
Scan Out
(SO)
Data In
(PI)
Capture
Scan Cell
00
11
Update
Hold Cell
D
Clk
Scan In ShiftDR ClockDR

(SI)
00
11
Data Out
(PO)
Clk
UpdateDR

C U
S
Slide 18
The figure shows a basic universal boundary-scan cell, known as a BC_1. The cell has
four modes of operation: normal, update, capture, and serial shift. The memory elements
are two D-type flip-flops with front-end and back-end multiplexing of data. (As with all
circuits in this tutorial, it is important to note that the circuit shown in the Figure is only an
example of how the requirement defined in the Standard could be realized. The IEEE
1149.1 Standard does not mandate the design of the circuit, only its functional
specification.)
During normal mode, Data_In is passed straight through to Data_Out.
During update mode, the content of the Update Hold cell is passed through to Data_Out.
During capture mode, the Data_In signal is routed to the input Capture Scan cell and the
value is captured by the next ClockDR. ClockDR is a derivative of TCK.
During shift mode, the Scan_Out of one Capture Scan cell is passed to the Scan_In of
the next Capture Scan cell via a hard-wired path.
Note that both capture and shift operations do not interfere with the normal passing of
data from the parallel-in terminal to the parallel-out terminal. This allows on the fly
capture of operational values and the shifting out of these values for inspection without
interference. This application of the boundary-scan register has tremendous potential for
real-time monitoring of the operational status of a system a sort of electronic camera
taking snapshots and is one reason why TCK is kept separate from any system clocks.
Page 18

BA
June, 2006
Summary
Boundary scan targets manufacturing defects around the

boundary of a device and between the interconnects
between devices caused by
Electrical stress: electro-static discharge
Mechanical stress: bent pins (causing opens and shorts), mis-oriented
positioning, missing devices
Thermal stress: solder-to-solder shorts, open-circuit bond wires
The region targeted (driver cell - driver amplifier - pad - bond

wire - leg - solder - interconnect - solder - leg - bond wire pad - sensor amplifier sensor cell) is the region most likely
to be damaged during board assembly

Slide 19
Given that boundary-scan registers were seen as an alternative way of testing for the
presence of manufacturing defects, we should question what these defects are, what
causes them, and where they occur.
An examination of the root cause for board manufacturing defects shows them to be
caused by any one of three reasons: electrical stress (e.g., electrostatic discharge
causing damage to input or output amplifiers), mechanical stress (e.g., bent legs caused
by clumsy handling when mounting devices on the board), or thermal stress (e.g., hot
spots caused by the solder operation). A defect, if it occurs, is likely present either in the
periphery of the device (leg, bond wire, driver amplifier), in the solder, or in the
interconnect between devices. It is very unusual to find damage to the internal logic
without some associated damage to the periphery of the device.
In this respect, the boundary-scan cells are precisely where we want them at the
beginning and ends of the region most likely to be damaged during board assembly i.e.
the region between the output driver scan cell and the input sensor scan cell. This region
is more-commonly referred to as the interconnect region.
Page 19

BA
June, 2006
Defect Coverage: Extest

Driver
Sensor
Virtual
nails
In
Inthis
thismode
mode(EXternal
(EXternalTEST),
TEST),defects
defectscovered:
covered:
driver
(TX)
scan
cell
driver
amp
bond
wire
driver (TX) scan cell - driver amp - bond wire--leg
leg--solder
solder-interconnect
interconnect
--solder
leg
bond
wire
solder - leg - bond wire--sensor
sensoramp
amp--sensor
sensor(RX)
(RX)scan
scancell
cell
Slide 20
Using the boundary-scan cells to test the interconnect structure between two devices is
called External Test, shortened to Extest see diagram above. The use of the cells for
Extest is the major application of boundary-scan structures, searching for opens and
shorts plus damage to the periphery of the device. In this mode, the boundary-scan cells
are often referred to as virtual nails
Page 20

BA
June, 2006
Defect Coverage: Intest

Driver
Sensor
Driver Sensor
In
Inthis
thismode
mode(INternal
(INternalTEST),
TEST),defects
defectscovered:
covered:
driver
scan
cell
device
sensor
scan
driver scan cell - device - sensor scancell
cell
Slide 21
It is also possible to use boundary-scan cells to test the internal functionality of a device.
This use of the boundary-scan register is called Internal Test, shortened to Intest.
Intest is only really used for very limited testing of the internal functionality to identify
defects such as the wrong variant of a device, or to detect some gross internal defect.
In the next section, we will take a closer look at the overall architecture of an 1149.1compliant device and, particularly, the function of the Instruction register.
Page 21

BA
June, 2006
1149.1 Chip Architecture

Boundary-Scan Register
Internal Register
Any Digital Chip

1
Bypass register
TDI
TDO
Identification Register
1
TMS
TCK
Instruction Register
TAP
Controller
1
TRST* (optional)

Slide 22
After nearly five years discussion, the JTAG organization finally proposed the device
architecture shown above
The Figure shows the following elements:
A set of four dedicated test pins Test Data In (TDI), Test Mode Select (TMS), Test
Clock (TCK), Test Data Out (TDO) and one optional test pin Test Reset (TRST*).
These pins are collectively referred to as the Test Access Port (TAP).
A boundary-scan cell on each device primary input and primary output pin, connected
internally to form a serial boundary-scan register (Boundary Scan).
A finite-state machine TAP controller with inputs TCK, TMS, and TRST*.
An n-bit (n >= 2) Instruction register, holding the current instruction.
A 1-bit Bypass register (Bypass).
An optional 32-bit Identification register capable of being loaded with a permanent
device identification code.
At any time, only one Data register can be connected between TDI and TDO e.g., the
Instruction register, Bypass, Boundary-Scan, Identification, or even some appropriate
register internal to the device. The selected Data register is identified by the decoded
parallel outputs of the Instruction register. Certain instructions are mandatory, such as
Extest (boundary-scan register selected), whereas others are optional, such as the
Idcode instruction (Identification register selected).
Page 22

BA
June, 2006
Mandatory Instructions and Reset Modes

Internal Register
Any Digital Chip

1
Instruction
Target (Active)
Register
Code
Extest
Boundary Scan
Formerly All-0s
Bypass
Bypass
All-1s
Preload
Boundary Scan
Undefined
Sample
Boundary Scan
Undefined
Bypass register
TDI
TDO
1
TMS
TCK
TAP
Controller
IR
IR22
Reset:
Reset:
TMS
TMS==1,1,55xxTCK
TCK
1
TRST* (optional)
Slide 23
Before we look closer at each part of this architecture there are three general points to
note:
Point 1. Since 1149.1-2001, the latest version of the Standard, there are only four
mandatory instructions: Extest, Bypass, Sample and Preload. The behaviour of these
instructions is explained in a little while but the fact that there are only four mandatory
instructions dictates the minimum size of the Instruction register to be 2-bits long. The
maximum size is left undefined in the Standard. One of the instructions Bypass
takes a mandatory codes of all-1s. Extest used to take a mandatory code of all-0s but
this requirement has now been relaxed in the 2001 version of the Standard. The codes
for all other instruction are not defined by the Standard and are left to the device designer
to define.
Point 2. Until the publication of 1149.1-2001, the Sample and Preload instructions were
merged into a single Sample/Preload instruction, often abbreviated to just Sample. It is
now possible to allocate a different code to Sample compared to Preload and consider
them to be two completely separate instructions. It is also possible to allocate the same
code to each instruction and consider them still to be a single merged Sample/Preload
instruction.
Point 3. The asynchronous Reset signal, TRST*, is optional. If present, the signal is
active low. If not present, there is always a synchronous reset available within the TAP
controller. If TMS is held at logic 1, a maximum of five consecutive TCKs is guaranteed
to return the TAP controller to the reset state of Test_Logic Reset. This will be referred
to as the TMS = 1, 5 x TCK synchronous reset.
Page 23

BA
June, 2006
Target Register Modes

Internal Register
Select
Any Digital Chip
Capture
1
Bypass register
TDI
TDO
Shift
Update
1
TMS
TCK
TAP
Controller
1
TRST* (optional)

Slide 24
Whenever a register is selected to become active between TDI and TDO, it is always
possible to perform three operations on the register: parallel Capture followed by serial
Shift followed by parallel Update. The order of these operations is fixed by the statesequencing design of the TAP controller. For some target Data registers, some of these
operations will be effectively null operations, no ops.
Page 24

BA
June, 2006
Loading The Instruction Registers
TDI
TDO
11111111
00000000
00000000
TMS
TCK
TRST*
Problem: Set device 1 in Bypass, devices 2 and 3 in Extest ready for

interconnect test between 2 and 3.
Step 1: Using TMS and TCK, select IRs as active registers in all devices.
Step 2: Load Bypass code into 1 (all-1s); Extest code into 2 and 3
(assumed to be all-0s)
Slide 25
Before proceeding with a description of other parts of the architecture, we will examine
how to load the Instruction register and decode its contents. Consider the board circuit
shown above.
Assume that what we want to do is to place Chip 1 into Bypass mode (to shorten the time
it takes to get test stimulus to follow-on devices) and place chips 2 and 3 into Extest
mode preparatory to setting up tests to check the four interconnects between Chips 2 and
3. This set-up requires loading the Bypass instruction (all-1s) into the Instruction register
of chip 1, and the Extest instruction (assumed to be all-0s) into the Instruction registers of
Chips 2 and 3.
Step 1 is to connect the Instruction registers of all three devices between their respective
TDI and TDO pins. This is achieved by a special sequence of values on the board control
line TMS going to each TAP controller in each device. Note that the TMS (and TCK)
lines are connected to all devices in parallel. Any sequence of values on TMS will be
interpreted in the same way by each device TAP controller. Later, we will see the precise
TMS sequence to select the Instruction register between TDI and TDO. For now, we will
assume that such a sequence exists.
Step 2 is to load the appropriate instructions into the various Instruction registers via the
global connection of Instruction registers. If we assume simple two-bit Instruction
registers per device, this operation amounts to a 6 x TCK serial load of the sequence
110000 into the edge-connector TDO entry to place 00 in the Instruction registers of
Chips 2 and 3, and 11 in the Instruction register of Chip 1. The Instruction registers are
now set up with the correct instructions loaded in their serial scan sections
Page 25

BA
June, 2006
Interconnect Test Setup
TDI
TDO
TMS
TCK
TRST*
Step 3: decode and execute new instructions. New target

registers are selected
Devices now set up to apply interconnect tests between
devices 2 and 3
Slide 26
Step 3 is to continue with values on TMS to cause each TAP controller to issue the
control-signal values to transfer the instruction codes in the scan sections of the
Instruction registers to the hold sections where they become the current instruction. This
is the Update operation. At this point, the various instructions are executed that is,
Chip 1 deselects the Instruction register and selects the Bypass register between its TDI
and TDO (Bypass instruction), and Chips 2 and 3 deselect their Instruction registers and
select their Boundary-Scan registers between their TDI and TDO (Extest instruction).
Devices 2 and 3 are now set up ready for Extest operation.
Page 26

BA
June, 2006
Open-Circuit TDI, TMS and TRST*?

An open-circuit TDI, TMS
or TRST* must go to
logic-1. Why?
Internal Register
Any Digital Chip

1
Bypass register
TDI
TDO
1
TMS
TCK
TAP
Controller
1
TRST* (optional)

Slide 27
The 1149.1 Standard mandates that an open circuit TDI, TMS or TRST* input must go
to logic 1. This can be achieved with internal weak resistive pull ups, or with active
transistor pull ups. The reasons are explained in subsequent slides.
Page 27

BA
June, 2006
TDI Open-Circuit Behaviour
TDI
TDO
11111111
00000000
11111111
TMS
TCK
TRST*
Open-circuit TDI. A safe instruction (Bypass, all-1s code) is

loaded and executed into the device with the open-circuit TDI
and to all devices downstream of this device.
Slide 28
For TDI. If the Instruction register is selected as the target register between TDI and
TDO ready to be loaded with a new instruction, then a safe instruction (Bypass, all-1s
code) is loaded and executed into the device with the open-circuit TDI and to all devices
downstream of this device.
Page 28

BA
June, 2006
TMS Open-Circuit Behaviour
TDI
TDO
TMS
TCK
TRST*
Open-circuit TMS. TMS floats high. In a maximum of 5 x TCK

cycles, the TAP controller of this device will be placed into its
Test_Logic Reset state.
Slide 29
For TMS. In a maximum of 5 x TCK cycles, the TAP controller of this device will be
placed into its Test_Logic Reset state. In this state, the boundary-scan logic is inactive
but the device can continue to operate functionally.
Page 29

BA
June, 2006
TRST* Open-Circuit Behaviour
TDI
TDO
TMS
TCK
TRST*
Open circuit TRST*. TRST* floats at inactive level (logic-1).

Reset reverts back to the synchronous reset cycle (TMS = 1, 5
x TCK) rather than through its asynchronous TRST* signal.
Slide 30
For TRST*, logic 1 is the inactive state and so the device is not prevented from being
used either in functional mode or in 1149.1 modes. The device must be reset with the
synchronous reset cycle (TMS = 1, 5 x TCK) rather than through its asynchronous TRST*
signal.
Page 30

BA
June, 2006
Warning
In the following slides,

any circuit diagrams are
for illustrative purposes
only. The Standard
mandates what should
happen but not how to
implement.

Slide 31
Page 31

BA
June, 2006
DR select and control signals routed to selected target register
Hold
Holdregister
register
(Holds
(Holdscurrent
currentinstruction)
instruction)
Decode
DecodeLogic,
Logic,IfIfany.
any.
From
TDI
TAP
TAP
Controller
Controller
To
TDO
Scan
ScanRegister
Register
(Scan-in
(Scan-innew
newinstruction/scan-out
instruction/scan-outcapture
capturebits)
bits)
0
1
Higher order bits:
IR Control current instruction, status bits, informal identification,
results of a power-up self test, (recommended to define)

Slide 32
An Instruction register has a shift scan section that can be connected between TDI and
TDO, and a hold section that holds the current instruction. There may be some decoding
logic beyond the hold section depending on the width of the register and the number of
different instructions. The control signals to the Instruction register originate from the TAP
controller and either cause a shift-in/shift-out through the Instruction register shift
section, or cause the contents of the shift section to be passed across to the hold section
(parallel Update operation). It is also possible to load (Capture) internal hard-wired
values into the shift section of the Instruction register. The Instruction register must be at
least two-bits long to allow coding of the four mandatory instructions Extest, Bypass,
Sample, Preload but the maximum length of the Instruction register is not defined. In
capture mode, the two least significant bits must capture a 01 pattern. (Note: by
convention, the least-significant bit of any register connected between the device TDI and
TDO pins, is always the bit closest to TDO.) The values captured into higher-order bits
of the Instruction register are not defined in the Standard. One possible use of these
higher-order bits is to capture an informal identification code if the optional 32-bit
Identification register is not implemented. In practice, the only mandated bits for the
Instruction register capture is the 01 pattern in the two least-significant bits. We will return
to the value of capturing this pattern later in this section.
Page 32

BA
June, 2006
Use of The Capture 01 Feature
TDI
TDO
01
01
01
TMS
TCK
TRST*
Problem: how to test the tester i.e. chip-to-chip TDO-to-TDI,

plus TMS and TCK connections
Slide 33
In an earlier section, we discussed the capture of the fixed 01 pattern into the least two
significant positions of the Instruction scan register. Normally, we would think only of shift
and update operations for the Instruction register. The question arises what is the use
of the capture 01 pattern?
To answer this question, we need to think about the use of the boundary-scan registers at
the board level. Consider again the circuit shown above.
Previously, we saw how to set up a test environment preparatory to carrying out
interconnect tests. To do this, we made use of the test infrastructure i.e., the on-chip
boundary-scan features plus the board-level TMS and TCK connections and the chip-tochip TDO-to-TDI interconnects. It is important to know that this infrastructure is fault-free
before making use of it. In other words, we must first test the tester before using the
tester to test other parts of the board. This is the purpose of the Instruction register
capture 01 operation.
Essentially, what happens is as follows: (see next slide also)
Step 1: Apply the sequence to TMS which causes each device to place its Instruction
register between TDI and TDO. At this stage, there is a serial shift register that starts at
the board TDI and ends at the board TDO and which is made up of the various Instruction
registers in the devices an Instruction register chain.
Step 2: Apply an additional sequence to TMS to cause each Instruction register to capture
the hardwired 01 into the least two significant positions of each Instruction scan register.
Higher-order bits capture what they are set up to capture. These values are not mandated
by the Standard. The captured 01 values constitute a checkerboard flush test for the
serial Instruction register chain.
Step 3: As the new Instructions codes are clocked into the Instruction scan registers via
TDI onto the board, then so the captured 01 values will be clocked out via TDO off the
board.
If the sequence 010101 emerges at the board TDO, then we can be
reasonably sure of the following facts:
Page 33

BA
June, 2006
Use of The Capture 01 Feature
Sentinel
bits
10
TDI
TDO
01
01
01
TMS
TCK
TRST*
Solution: select IRs, go to Capture_IR to load the hardwired 01 patterns, shift out 01 patterns. Terminate
with 10 sentinel bits
Slide 34
1. The TMS control signal is properly connected from the boards TMS input to the TMS inputs of
every device.
2. The TCK control signal is properly connected from the boards TCK input to the TCK inputs of
every device.
3. The TDO from one device is properly connected to the TDI of its logical neighbor.
4. Each internal TAP controller is at least capable of responding correctly to the sequence on
TMS that causes the Instruction register both to capture and to shift.
5. The TDO of the last device in the chain is properly connected to the TDO off the board
6. The TDI of the first device in the chain is properly connected to the TDI onto the board. Note
that it is usual to feed the inverse values 10 into the board TDI so as to know when to terminate
the shift-out phase (Step 3) and also to test this part of the chain. These bits are called the
sentinel bits. They have an added benefit as they help to remove a possible cause of incorrect
diagnosis if there is a TDI-to-TDO short circuit on one of the devices.
Steps 1 to 3 represent a minimum integrity test for the boundary-scan infrastructure.

Additional tests can be included. For example: load and execute the Bypass
instruction into all devices to show that the Bypass registers are functioning correctly;
load a non-test instruction (e.g., Preload) to select the boundary-scan register and
pass a flush test through the register to check the integrity of the Boundary-Scan cells.
The question that is raised is why do all these additional integrity tests? If our purpose
is just to test for manufacturing defects on the test infrastructure, the Instruction
register checkerboard test is probably sufficient. All additional integrity tests deal with
testing the functionality of the IEEE 1149.1 features on the devices. We could argue
that this is more a chip test requirement, not a board test requirement - in fact, the
same argument used earlier to explain why the Intest instruction is not mandatory.
Most test programmers run the extra integrity tests as time permits. These tests
provide additional confidence that the test infrastructure is healthy before using it to
test other parts of the board.
Page 34

BA
June, 2006
Standard Instructions
Instruction
Selected Data Register
Mandatory:
Bypass
Sample
Preload
Extest
Bypass (initialised state, all-1s code)

Boundary scan (device in functional mode)
Boundary scan (device in functional mode)
Boundary scan (formerly all-0s code)
Optional:
Intest
Idcode
Usercode
Runbist
Clamp
HighZ
Boundary scan
Identification (initialised state if present)
Identification (for dual personality devices)
Result register
Bypass (output pins in safe logic state)
Bypass (output pins in high-Z state)
NB. All unused instruction codes must default to Bypass

Slide 35
The IEEE 1149.1 Standard describes four mandatory instructions: Extest, Bypass,
Sample, and Preload, and six optional instructions: Intest, Idcode, Usercode, Runbist,
Clamp and HighZ. These nine instructions are known as the public instructions. We will
look first at the mandatory instructions
Page 35

BA
June, 2006
Extest Instruction
Internal Register
Any Digital Chip

1
Bypass register
TDI
TDO
1
TMS
TCK
Boundary-scan register
selected
Used to apply patterns to
the interconnect
structures on the board
Boundary-scan cells have
permission to write to their
outputs (device in test
mode)
TAP
Controller
1
TRST* (optional)

Slide 36
The Extest instruction selects the boundary-scan register when executed, preparatory to
interconnect testing. The code for Extest used to be defined to be the all-0s code. This
requirement has been relaxed in the 2001 version of the Standard.
Extest puts the device in test mode that is, the boundary-scan cells on the input side of
the device have permission to write logic values into the device, and the boundary-scan
cells on the output side of the device have permission to write logic values onto the output
pins of the device. This means that there should be no risk of the device being placed
into its boundary-scan test mode of operation by means of the accidental loading and
execution of the Extest instruction. If this happened, then either this device or other
devices connected to this device might be placed into an unsafe state. This is the reason
why the requirement for the Extest instruction code be all-0s has been relaxed in 1149.12001. A stuck-at-0 short to Ground on a TDI input pin could load an all-0s code into the
Instruction register causing the device to be placed in an unsafe mode when executed.
Page 36

BA
June, 2006
Bypass Instruction
Bypass register selected

Used to allow quick
passage through this
device to another device
connected in the chain
Internal Register
Any Digital Chip

1
Bypass register
TDI
TDO
1
TMS
TCK
TAP
Controller
1
TRST* (optional)

Slide 37
The Bypass instruction must be assigned an all-1s code and when executed, causes the
Bypass register to be placed between the TDI and TDO pins. By definition, the initialized
state of the hold section of the Instruction register should contain the code for the Bypass
instruction unless the optional Identification register has been implemented, in which
case, the code for the Idcode instruction should be present in the hold section.
Note: all unused instruction codes should be interpreted as the Bypass instruction
Page 37

BA
June, 2006
Sample and Preload Instructions

Internal Register
Any Digital Chip

1
Bypass register
TDI
TDO
1
TMS
TCK
Boundary scan register

selected
Preload: used to preload
known values in the
boundary scan cells.
Sample: used to capture
mission-mode signals into
the boundary-scan cells
Device in functional
mode, not test mode
TAP
Controller
1
TRST* (optional)

Slide 38
The Sample and Preload instructions, and their predecessor the Sample/Preload
instruction, selects the Boundary-Scan register when executed. The instruction sets up
the boundary-scan cells either to sample (capture) values or to preload known values
into the boundary-scan cells prior to some follow-on operation. The codes for the Sample
and Preload instructions are not defined. The codes may either be the same or they
may be different.
Both instructions leave the device in functional mode, not test mode. This means that
any values preloaded or sampled into the boundary scan cells are not passed through
into the device or to the device output pins, unlike Extest. Thus the device is still under
the control of the mission mode signals i.e. is in functional mode. This is an important
distinction between Preload and Sample, compared to Extest.
Note that the 1149.1-2001 Sample instruction now captures values coming into the chip
on signal Input pins and values being generated by the chip logic and passing through to
the signal Output pins.
Previous versions of the Standard did not allow capture of
values generated by the chip logic and passing through to the signal Output pins.
Page 38

BA
June, 2006
Intest Instruction
Internal Register
Any Digital Chip

1
Bypass register
TDI
TDO
1
TMS
TCK
Boundary scan register

selected
Used to apply patterns to
the device itself
Boundary scan cells have
permission to write to their
outputs (device in test
mode)
TAP
Controller
1
TRST* (optional)

Slide 39
The IEEE 1149.1 Standard defines a number of optional instructions that is, instructions
that do not need to be implemented but which have a prescribed operation if they are
implemented.
The instruction illustrated here is Intest, the instruction that selects the boundary-scan
register preparatory to applying tests to the internal logic of the device.
Page 39

BA
June, 2006
Idcode Instruction
Internal Register
Any Digital Chip

1
Bypass register
TDI
TDO
1
TMS
TCK
Optional Identification
register selected, if
available, else Bypass
register selected
Used to capture internal
32-bit identification code
(manufacturer, part
number, version number)
and then shift out through
TDO
TAP
Controller
1
TRST* (optional)

Slide 40
Idcode is the instruction to select the Identification register between TDI and TDO,
preparatory to loading the internally-held 32-bit identification code and reading it out
through TDO. Note that if the Idcode instruction is loaded and there is no Identification
register present in the device, then the Idcode instruction code must be interpreted as if it
were the Bypass instruction.
Page 40

BA
June, 2006
Usercode Instruction
Internal Register
Any Digital Chip

1
Bypass register
TDI
TDO
1
TMS
TCK
Optional Identification
register selected, if
available, else Bypass
register selected
Use to capture an
alternative 32-bit
identification code for dual
personality devices e.g.
PLDs
TAP
Controller
1
TRST* (optional)

Slide 41
Usercode selects the same 32-bit register as Idcode, but allows an alternative 32 bits of
identity data to be loaded and serially shifted out. This instruction is used for dualpersonality devices, such as Complex Programmable Logic Devices and Field
Programmable Gate Arrays. Such devices have data pertaining to the original PLD
manufacturer e.g. Altera and, once programmed, to the final user of the device,. The
original manufacturers data is accessed though Idcode, whereas the new user identity
data is accessed through Usercode.
.
Page 41

BA
June, 2006
RunBist Instruction
BIST Registers
Any Digital Chip

1
Bypass register
TDI
TDO
1
TMS
TCK
Control registers for

initiating internal BIST
(Memory or Logic)
Pass/fail register targeted
as final selected register
Chip in test mode with
safe values set on the
output pins using Preload
instruction
TAP
Controller
1
TRST* (optional)

Slide 42
An important optional instruction is RunBist. Because of the growing importance of

internal self-test structures, the behavior of RunBist is defined in the Standard. The selftest routine must be self-initializing (i.e., no external seed values are allowed), and the
execution of RunBist essentially targets a self-test result register between TDI and TDO.
Once the self-test routine is initiated, the TAP controller is held in its Run_Test/Idle state
for the duration of the test. The self-test clock could be TCK but is more-usually a highspeed system clock.
At the end of the self-test cycle, the targeted data register holds the Pass/Fail result. It
is important that any subsequent pulses on TCK do not change this result. In this way,
parallel self-tests of different lengths on different devices on the same board can be
carried out. When the final (i.e., the longest in run time) self-test is complete, all results
can be clocked out along the register path made up of the linked individual Pass/Fail
result registers.
Page 42

BA
Clamp Instruction
Internal Register
Any Digital Chip

1
Bypass register
TDI
TDO
1
TMS
TCK
June, 2006
TAP
Controller
1
TRST* (optional)

Safe logic values are preloaded into boundary scan

cells using Preload
instruction.
Clamp drives these values
to the output pins but leaves
the Bypass register as the
selected register.
Note: if some outputs can be
placed into a high-Z mode
(3-state) or Input mode
(bidirectionals), Preload is
used to load the appropriate
logic values in the control
cells prior to execution of
Clamp.
Slide 43
Two new instructions introduced in the 1993 revision, 1149.1a-1993, were Clamp and
HighZ. Clamp is an instruction that uses boundary-scan cells to drive preset values
established initially with the Preload instruction onto the outputs of devices, and then
selects the Bypass register between TDI and TDO (unlike the Preload instruction which
leaves the device with the boundary-scan register still selected until a new instruction is
executed or the device is returned to the Test_Logic Reset state: see later).
Clamp would be used to set up safe guarding values on the outputs of certain devices in
order to avoid bus contention problems, for example.
Page 43

BA
HighZ Instruction
Internal Register
Any Digital Chip

1
Bypass register
TDI
TDO
1
TMS
TCK
June, 2006
TAP
Controller
1
TRST* (optional)

The device is designed such

that all outputs can be
placed in either a high-Z
mode (3-state outputs) or
input receive mode
(bidirectionals).
HighZ establishes these
values on the output pins but
leaves Bypass register as the
selected register
Note: the Enable control
signal to do this is supplied
directly from the Instruction
Register upon execution of
the HighZ instruction.
Preload is not used.
Slide 44
HighZ is similar to Clamp, but it leaves the device output pins in a high-impedance state
rather than drive fixed logic-1 or logic-0 values. HighZ also selects the Bypass register
between TDI and TDO.
Note that HighZ does not require an a priori Preload activity. The ability to drive all
outputs to a high-Z (3-state outputs) or input-only mode (bidirectionals) is an inherent
feature of the design and must be designed in by the designer.
Page 44

BA
June, 2006
Accessing Other Internal Registers

Internal Scan Registers
Any Digital Chip

1
Bypass register
TDI
TDO
Any internal register can

be accessed by means of
private instructions
An example could be
access to internal scan
registers through an
instruction called InScan
1
TMS
TCK
TAP
Controller
1
TRST* (optional)

Slide 45
With the exception of Bypass (and previously Extest), the codes for all instructions are
undefined in the Standard. Given the need for four mandatory instructions, the minimum
length of the Instruction register is two bits. The maximum length is undefined. Any
instruction can have more than one code and all unused codes are interpreted as
Bypass.
Note that the designer may use certain codes to implement private instructions to access
any suitable internal data registers that is, instructions that are not defined in the
Standard and whose detailed functions are not made public. An example could be an
instruction InScan to allow access to an internal scan-path register via the TDI-TDO
route. In these circumstances, the designer must state that these codes are private so
that the board test-programmer can avoid loading the codes.
Page 45

BA
June, 2006
Test Access Port (TAP)

Internal Scan Registers
Test Data In
(TDI)
Serial data in
Sampled on rising edge
Default = 1
Test Data Out

(TDO)
Serial data out

Changes on falling edge
Default = Z (only active
during a shift operation)
Any Digital Chip

1
Bypass register
TDI
TDO
Test Mode Select Input Control

(TMS)
Sampled on rising edge
Default = 1
1
TMS
TCK
TAP
Controller
Test Clock
(TCK)
Dedicated clock
Any frequency
Test Reset
(TRST*)
Optional async reset

Active low
Default = 1
1
TRST* (optional)
Slide 46
We turn now to the Test Access Port (TAP) and its Controller. The TAP consists of
four mandatory terminals plus one optional terminal.
The mandatory terminals are:
Test Data In (TDI): serial test data in with a default value of 1.
Test Data Out (TDO): serial test data out with a default value of Z and only active
during a shift operation.
Test Mode Select (TMS): serial input control signal with a default value of 1.
Test Clock (TCK): dedicated test clock, any convenient frequency (usually determined
by the maximum TCK frequency of the external tester).
The optional terminal is:
Test Reset (TRST*): asynchronous TAP controller reset with default value of 1 and
active low.
Page 46

BA
June, 2006
TAP Controller
TMS
ClockDR
TCK
ShiftDR
UpdateDR
TRST*
16-state
16-stateFSM
FSM
TAP
TAPController
Controller
(Moore
(Mooremachine)
machine)
Reset*
Select
ClockIR
ShiftIR
UpdateIR
Enable

Slide 47
TMS and TCK (and the optional TRST*) go to a 16-state finite-state machine controller,
which produces the various control signals. These signals include dedicated signals to the
Instruction register (ClockIR, ShiftIR, UpdateIR) and generic signals to all data registers
(ClockDR, ShiftDR, UpdateDR). The data register that actually responds is the one
enabled by the conditional control signals generated at the parallel outputs of the
Instruction register, according to the particular instruction.
The other signals, Reset, Select and Enable are distributed as follows:
Reset is distributed to the Instruction register and to the target Data Register
Select is distributed to the output multiplexer
Enable is distributed to the output driver amplifier
Note: the Standard uses the term Data Register to mean any target register except the
Instruction register
Page 47

BA
June, 2006
Distribution of Signals
To Data Registers (DRs)
ShiftDR
ClockDR
UpdateDR
Reset
IR (Hold Section)
IR (Decoder)
TDI
From
DRs
TDO
IR (Shift Section)
Reset
TMS
TCK
TRST*
ShiftIR
ClockIR
UpdateIR
Select
Enable
TAP
Controller

Slide 48
The slide shows how the various signals generated by the TAP controller are distributed
to the Instruction register, the various data registers and also how they control the
selection of the Instruction register, plus ensure that TDO is inactive except when
required to shift data out of the selected register.
Page 48
TAP Controller State Diagram

1
Test_Logic
Reset
BA
June, 2006
Run_Test/
Idle
0
1
Select
DR_Scan
0
1
0
1
Capture_DR
Capture_IR
0
0
Shift_DR
Shift_IR

Pause_IR
1
0
Exit2_DR
Exit2_IR
1
1
Update_DR
1
Exit1_IR
0
Pause_DR
1
1
Exit1_DR
Transitions between
states are controlled
by the logic value on
TMS (as shown in
the state diagram)
plus the rising edge
of TCK.
Select
IR_Scan
Update_IR
1
Slide 49
The diagram shows the 16-state state table for the TAP controller. The value on the state
transition arcs is the value of TMS. A state transition occurs on the positive edge of TCK
and the controller output values change on the negative edge of TCK.
The TAP controller initializes in the Test_Logic Reset state (Asleep state). While TMS
remains a 1 (the default value), the state remains unchanged. In the Test_Logic Reset
state and the active (selected) register is determined by the contents of the Hold section
of the Instruction register. The selected register is either the Identification register, if
present, else the Bypass register.
Pulling TMS low causes a transition to the
Run_Test/Idle state (Awake, and do nothing state). Normally, we want to move to
the Select IR_Scan state ready to load and execute a new instruction.
An additional 11 sequence on TMS will achieve this. From here, we can move through the
various Capture_IR, Shift_IR, and Update_IR states as required. The last operation is
the Update_IR operation and, at this point, the instruction loaded into the shift section of
the Instruction register is transferred to the Hold section of the Instruction register to
become the new current instruction. This causes the Instruction register to be de-selected
as the register connected between TDI and TDO and the Data register identified by the
new current instruction to be selected as the new target Data register between TDI and
TDO. For example, if the instruction is Bypass, the Bypass register becomes the
selected data register. From now on, we can manipulate the target data register with the
generic Capture_DR, Shift_DR, and Update_DR control signals.
Page 49
Initialising The TAP Controller

1
Test_Logic
Reset
BA
June, 2006
Run_Test/
Idle
0
1
Select
DR_Scan
0
1
0
1
Capture_DR
Capture_IR
0
0
Shift_DR
Shift_IR
0
Pause_IR
1
0
Exit2_DR
Exit2_IR
1
1
Update_DR

Exit1_IR
0
Pause_DR
1
1
Exit1_DR
Select
IR_Scan
Update_IR
1
Slide 50
Note that there is no master reset to the TAP controller if the optional TRST* is not
implemented. The TAP controller is mandated to power up in the Test_Logic Reset
state. If there is a need to re-initialize the controller, it can be done by observing the
following properties of the controller state diagram.
In general, TMS = 1 causes a state-to-state transition to be made when the positive edge
of TCK occurs. The exception is the Test_Logic Reset state. This state is one of six
stable states i.e. a state that can be maintained for consecutive TCK clock pulses as long
as TMS is constant.
The other five stable states are Run_Test/Idle, Shift_DR,
Pause_DR, Shift_IR and Pause_IR. For these five stable states, TMS = 0 will maintain
the state for consecutive TCK clock pulses.
Consequently, no matter what state the TAP controller is in, if TMS is held at logic 1, the
next five consecutive TCK clocks are guaranteed to drive the controller to its Test_Logic
Reset state.
Note that five is the maximum number of TCKs required to do this.
Depending on the start state, the Test_Logic Reset state may be reached in less than
five TCKs.
The student is invited to verify that from any start state, five TCKs is
sufficient to return the controller to the Test_Logic Reset state, given that TMS remains
at logic 1.
In this way, the TAP controller can always be initialized using a TMS = 1, 5 x TCK
protocol the synchronous reset referred to earlier in the tutorial.
Page 50

BA
June, 2006
TAP Controller: Output Signals

Slide 51
The diagram above, taken straight from the Standard, illustrates the details of the control
signals generated by each of the sixteen states. In this diagram, the first two rows show
TCK and TMS respectively. The third row shows the transmission status of the device
TDO output: active or high impedance. The fourth row defines the sixteen states in a
hexadecimal format. The allocation of the hexadecimal identifier is shown in the next
slide. The remaining rows show the values on the various output control signals that are
distributed to the Instruction register and to the selected Data register.
Page 51

BA
June, 2006
TAP Controller: States

1
Test_Logic
Reset
0
Run_Test/
Idle
Select
DR_Scan
0
1
Capture_IR
20
Shift_DR
A0
Shift_IR
1
1
Exit1_DR
Exit1_IR
30
Pause_DR
B0
Pause_IR
Exit2_DR
Exit2_IR
Update_DR
1
Capture_DR
Select
IR_Scan
Update_IR
1

Slide 52
The allocation of the sixteen state hexadecimal identifiers are shown in this figure.
Page 52

BA
June, 2006
A Reason for the Pause State
1024 bits
Driver
RAM
RAM
TDI
Assume 30 devices
at 100-bits/device
= 3000-bit BScan Register
RAM
TDO
RAM
1024 bits
Sensor

Slide 53
Each of the main branches of the state table contains additional Exit and Pause states.
The Exit1 state allows a transition from the shift operation to Update. It also allows the
controller to be placed in a Pause state. This might be necessary if, for example, all
devices have their boundary-scan registers selected as the data registers and an external
tester driver/sensor pin channel is either loading or unloading test data e.g., as in the use
of Extest to test interconnect structures. If the length of the chained boundary-scan
registers is longer than the memory associated with the tester driver/sensor pin channel
then it will become necessary periodically to update or unload the content of the channel
memory before resuming the shift operation through the boundary-scan path. The Pause
state enables this action and Exit2 state allows a return to the shift operation. The slide
illustrates this situation.
Note: it is also possible to stop the TCK clock whilst in the Shift_DR state but some
global board-level boundary-scan controllers have a free-running TCK to maintain the
boundary-scan devices in their Test_Logic Reset state. If this is the case, then the
Pause_DR state is the only other way of temporarily suspending the shift operation.
Page 53

BA
June, 2006
Instruction Register: Default Values

In
Inthe
theTest-Logic/Reset
Test-Logic/Reset
state,
the
state, thevalue
valueforced
forced
into
the
Hold
into the Holdsection
sectionof
of
the
Instruction
Register
the Instruction Registerisis
Idcode
Idcodeififthe
the
Identification
IdentificationRegister
Registerisis
present,
present,else
elseBypass
Bypass
Hold
Holdregister
register
(Holds
current
(Holds currentinstruction)
instruction)
Decode
DecodeLogic
Logic
Scan
ScanRegister
Register
(Scan-in
(Scan-innew
newinstruction/scan-out
instruction/scan-outcapture
capturebits)
bits)
0
1
Slide 54
Page 54

BA
June, 2006
Bypass register
One-bit shift register, selected by the
Bypass instruction
Captures a hard-wired 0
Note: in the Test-Logic/Reset state, the
Bypass register is the default register
selected between TDI and TDO if no
Identification Register is present
0
To TDO
From TDI
Clk
ShiftDR
ClockDR

Slide 55
The slide shows a typical design for a Bypass register. It is a 1-bit register, selected by
the Bypass instruction and provides a basic serial-shift function. There is no parallel
output (which means that the Update_DR control has no effect on the register), but there
is a defined effect with the Capture_DR control the register captures a hard-wired
value of logic 0. We will shortly explain the value of this.
Page 55

BA
June, 2006
32-bit shift register, selected by Idcode
and Usercode instruction
Captures an internal hard-wired 32-bit
word
Main function: identify device owner
and part number
Can be the last 32 bits of the boundary
scan register (next slide)
Note: in the Test-Logic/Reset state, the
Identification register is the default
register selected between TDI and
TDO.

Slide 56
The optional Identification register is a 32-bit register with capture and shift modes of
operation. The register is selected by the Idcode and Usercode instructions and the 32bits of internal data are loaded into the shift part of the register and scanned out through
the device TDO pin. Recall also that this register, if present, is the selected active
register when the TAP controller is in the Test_Logic Reset state, else the Bypass
register is selected in this state.
Page 56

BA
TDI
June, 2006
32-Bit Identification Format

Version
Version
Manufacturer
Manufacturer
Identity
Identity
Part
PartNumber
Number
4-bits
Any format
16-bits
Any format
11-bits
Coded form
of JEDEC
LSB
LSB
TDO
ID Code bit
Shift in
ShiftDR
Shift out
Clk
ClockDR
Slide 57
When the register is selected, the Capture_DR state captures 32 bits of internal data.
The captured 32 bits identify the device through the following four fields:
Bit 0 (least significant bit) is always a logic 1.
Bits 1 - 11 identify the manufacturer or owner of the device using a compact form of
the JEDEC identification code see next slide for more detail on how JEDEC allocates
their numbers.
Bits 12 - 27 provide a 16-bit free-format part number field.
Bits 28 - 31 provide a 4-bit free-format field to specify up to 16 different versions of the
same basic device.
Once captured, the 32-bit identification code can be shifted out through TDO for
inspection off the board. The diagram also shows a possible implementation of one
cell in the 32-bit register.
Page 57

BA
June, 2006
JEDEC Coding
Bank
Bank00
77bits
bits++Parity
Parity
Bank
Bank11
77bits
bits++Parity
Parity
Bank
Bank15
15
77bits
bits++Parity
Parity
Each manufacturer receives a unique JEDEC number

All-1s codes are used as continuation codes from one bank to the
next i.e. not allocated to any company
www.jedec.org
www.jedec.org
# Codes = 16 (27 - 1) = 2032 (Bank 6, May 2006)
Search
Searchfor
forJEP106T
JEP106T
Slide 58
The Joint Electron Device Engineering Council, JEDEC, is an organization in

Arlington, Virginia, that allocates unique identification codes to electronic semiconductor
manufacturers and to system companies. The codes are based on a 7-bit number, plus
odd-1 parity bit, and placed in one of sixteen banks.
The 11-bit code in the
Identification register is built from the 7-bit number plus 4-bits to identify in which bank the
number is located. The parity bit is discarded. Note that JEDEC does not use the last
(all-1s) binary numbers in any bank.
We will now investigate why the least significant bit (lsb) of the Identification register is a 1
and why the Bypass register captures a hard-wired value of 0
Page 58
TAP Controller State Diagram

1
Test_Logic
Reset
BA
June, 2006
Run_Test/
Idle
0
1
Select
DR_Scan
0
1
0
1
Capture_DR
Capture_IR
0
0
Shift_DR
Shift_IR
Exit1_IR
0
0
Pause_DR
Pause_IR
1
0
Exit2_DR
Exit2_IR
1
1
Update_DR
1
1
1
Exit1_DR
Select
IR_Scan

Update_IR
1
Slide 59
This slide is required to follow the reasoning in the next slide.
Page 59

BA
June, 2006
Blind Interrogation
TDI
TDO
TMS
TCK
Problem: determine how many devices on the board have

boundary scan; where they are in the chain; and identify
those with Identification Registers
All this from the edge connector!! (Blind interrogation)
Slide 60
Consider the following field servicing scenario. A customers computer system has broken
down. The cause is suspected to be a hardware fault on a particular board. There are
many variations of the board and the service engineer needs to identify the board type
and the component versions. All the engineer knows is that there are boundary-scan
components on the board and the location of the primary (edge-connector) TDI entry,
TMS, TCK and TDO exit ports plus Power and Ground. The following procedure, known
as a blind interrogation, identifies the boundary-scan components on the board and
whether or not they have Identification registers.
Page 60

BA
June, 2006
Blind Interrogation Seven Questions
4
1
Q1: Do on-board devices

meet the 1149.1 Standard?
Q2: Simple board TMS and

TCK infrastructure?
Q3: TDO off the board?
Q4: TMS onto the board?
Q5: TCK onto the board?
Q6: Power (pin and value)?
Q7: Ground (pin)?
GND 3.5v TCK TMS TDO

Slide 61
Page 61

BA
June, 2006
How It Works
Apply power to the board
Apply TMS = 1, 5 x TCK to enter TLR state
31+1
0
3
Test_Logic
Reset
0
Run_Test/ 1
Idle
1
Select
DR_Scan
0
1
+
3
1
Contain
Identification
registers
0
1
Capture_DR
Capture_IR
Shift_DR
Shift_IR
0
0
Pause_IR
1
0
Exit2_IR
Update_DR
Exit2_DR
Exit1_IR
0
Pause_DR
0
Exit1_DR
Select
IR_Scan
Update_IR
1
Logic 1
GND 3.5v TCK TMS TDO
0 = 1149.1 device, no identification

1 = 1149.1 device, with 31-bits identification
1 + 1111111 = end of chain

Slide 62
Step 1: Power up the board and apply the 010sequence to TMS to enter the Select
DR_Scan state. By default, the instruction loaded into the hold stage of every boundaryscan Instruction register on power-up must be Idcode if the device contains an
Identification register, or Bypass if the device does not contain an Identification register.
This is mandated by the Standard and is shown above..
Devices 2 and 4 have
Identification registers; devices 1, 3 and 5 do not.
Step 2: Capture the hard-wired values (Capture_DR state) in the default selected Bypass
or Identification register. Bypass captures 0; Identification captures 1 + 31 bits of interest.
Step 3: Shift (Shift_DR state) the captured values out through the primary TDO exit
output. A leading 0 identifies a device without an Identification register. A leading 1
identifies a device with an Identification register, in which case the next 31 bits identifies
the device JEDEC code, part number and version number.
In the situation of a true blind interrogation (i.e., one in which it is not known how many
boundary-scan devices there are on the board), the process can be terminated by feeding
in an illegal sequence through the primary TDI entry input and waiting for this sequence to
appear at the primary output TDO. Such a sequence is seven consecutive 1s.
The
JEDEC coding system avoids this sequence and it should never appear naturally from the
content of Identification registers. It is usual to add a further 0 to this sequence just in
case the primary TDI entry input is stuck-at-1.
Page 62

BA
June, 2006
Shift register with boundary-scan cells
on:
device input pins

device output pins
control of three-state outputs
control of bidirectional cells
Selected by the Extest, Intest, Preload

and Sample instructions

Slide 63
We are now ready to take a more detailed look at the boundary-scan cells and their
concatenation into a general-purpose boundary-scan register. For a given device,
boundary-scan cells are placed on the device digital input ports, digital output ports, and
on the control lines of bidirectional (IO) ports and tristate (0Z) ports. The scan cells are
linked together to form the boundary-scan register. The order of linking within the device
is determined by the physical adjacency of the pins and/or by other layout constraints.
The boundary-scan register is selected by the Extest, Sample, Preload, and Intest
instructions.
Page 63

BA
June, 2006
Full-Featured BS Cell (BC_1)

Scan Out
(SO)
Data In
(PI)
Capture
Scan Cell
00
11
Mode
Update
Hold Cell
D
Clk

(SI)
00
11
Data Out
(PO)
Clk
UpdateDR
Slide 64
The figure shows a more universal design for a boundary-scan cell a BC_1. The BC_1
is capable of all three operations of capture, shift, and update, and is suitable as a cell on
the device inputs or device outputs. This design has separate flip-flops for capture-andshift and for hold functions. Data can be shifted through the boundary-scan shift path
without interfering with the value in the hold section (which could be routed to the data-out
port through the output multiplexer).
Page 64

BA
June, 2006
Full-Featured BS Cell (BC_2)

Scan Out
(SO)
Data In
(PI)
Capture
Scan Cell
00
11
Mode
Update
Hold Cell
D
Clk

(SI)
00
11
Data Out
(PO)
Clk
UpdateDR
Slide 65
A simple variation of the BC_1 is shown above. In this design, known as a BC_2, the
captured signal is taken downstream of the output multiplexer. This design has the
advantage of being able to sense the signal passing to the output pin (if the cell is
connected directly to a digital output pin of the device) or the signal going into the internal
logic (if the cell is connected directly to a digital input to the device). In this way, if the
device output or input is itself faulty, the cell can capture the faulty value, thereby
increasing the overall defect coverage.
Page 65

BA
June, 2006
Reduced-Feature Input Cell (BC_4)

Scan Out
(SO)
Data In
(PI)
Capture
Scan Cell
00
11
Clk

(SI)
Data Out
(PO)
Only Capture and Shift: no

Update
Note: mandatory instructions
do not require Update on
input pins
Used on timing-sensitive
inputs e.g. Clock
Slide 66
There are many different designs for boundary-scan cells. The slide shows a simple
design, known as a BC_4, capable only of capture and shift operations. Such a cell could
be used on device inputs that are especially sensitive to extra loading on the Data_In
signal e.g., a high-speed system clock. (Note: the four mandatory instructions do not
require an update operation on the input scan cells.)
Page 66

BA
June, 2006
Providing Boundary-Scan Cells: OZ
On all device signal IO, control of three-state:

dual-mode input signal or additional scan cell
Slide 67
Primarily, boundary-scan cells must be provided on all device digital input and digital
output signal pins, with the exception of Power and Ground. Note that there must be no
circuitry between the pin and the boundary-scan cell other than driver amplifiers or other
forms of analog circuitry such as electro-static discharge protection circuitry.
In the case of pin fan-in, boundary-scan cells should be provided on each primary input to
the internal logic. In this way, each input can be set up with an independent value. This
provides the maximum flexibility for Intest.
Similarly, for the case of pin fan-out: if each output pin has a boundary-scan cell, then so
Extest is able to set different and independent values on the multiple outputs.
Where there are OZ tristate output pins, there must be a boundary-scan cell on the status
control signal into the output driver amplifier. The diagram shows this situation. The input
pin has two modes: as an input and as an output status-control signal. For this situation,
an extra boundary-scan cell is not required.
Page 67

BA
June, 2006
Providing Boundary-Scan Cells: OZ
On all device signal IO, control of three-state:

dual-mode input signal or additional scan cell
Slide 68
For some devices, the control signal for tristate outputs may be generated internally. If
this is so, an extra control boundary-scan cell is inserted in the boundary-scan register
with the sole purpose of allowing boundary-scan control of the status of the outputs.
The slide shows this extra scan cell. Usually, just one control cell controls all tristate
outputs simultaneously, not one control cell per tristate output.
Page 68

BA
June, 2006
Providing Boundary-Scan Cells: IO
Special cells:
BC_7, BC_8, BC_9
On control of bidirectional IO:

dual-mode input signal
Slide 69
This slide shows the set up for a bidirectional IO pin. Here, we see that, conceptually at
least, three boundary-scan cells are required: one on the input side, one on the output
side, and one to allow control of the IO status.
In practice, the two IO scan cells are
usually combined into a single multi-function cell called a BC_7.
This is the end of the part of the tutorial that has mostly concentrated on the device-level
features of an 1149.1-compliant device. From now on, we will develop the board-level
application of 1149.1, starting with the interconnect test-pattern generation process.
Page 69

BA
June, 2006
BC_7 Boundary Scan Cell
BC_7 Bidirect Cell

Slide 70
This slide shows the set up for a bidirectional IO pin. Here, we see that, conceptually at
least, three boundary-scan cells are required: one on the input side, one on the output
side, and one to allow control of the IO status.
In practice, the two IO scan cells are
usually combined into a single multi-function cell called a BC_7.
This is the end of the part of the tutorial that has mostly concentrated on the device-level
features of an 1149.1-compliant device. From now on, we will develop the board-level
application of 1149.1, starting with the interconnect test-pattern generation process.
Page 70

BA
June, 2006
1149.1: To Probe Further .
Ken Parker, The boundary-scan handbook: analog and digital,

Kluwer, 2003 (3rd Edition)
Ben Bennetts Boundary-scan tutorial
http://www.asset-intertech.com/tutorial/tutorial.htm
ITC Proceedings, IEEE D&TC
Boundary-scan cells on Power and Ground? See ITC96,
Tegethoff, Parker and Lee, Paper 12.2 See also, de Jong et
al., ITC2000, P22.1, Schuttert et al. VTS 2002
Reducing time-to-market using BSDArchitect New edition,
available from www.mentor.com/dft/

Slide 71
Page 71

JTAGchip PDF

Caricato da

Informazioni sul documento

Titolo originale

Copyright

Formati disponibili

Condividi questo documento

Condividi o incorpora il documento

Opzioni di condivisione

Hai trovato utile questo documento?

Questo contenuto è inappropriato?

Copyright:

Formati disponibili

JTAGchip PDF

Caricato da

Copyright:

Formati disponibili

1149.

1 Boundary Scan Standard: Chip Level Architecture

Bennetts Associates, 2006

1149.1 Boundary Scan Standard: Chip Level Architecture

2006, Bennetts Associates

The core reference is the IEEE 1149.1 Standard:

Bennetts Associates, 2006

1149.1 Boundary Scan Standard: Chip Level Architecture

In-Circuit & Functional Board Test

Bed-Of-Nails (ICT, FPT, MDA)

Bennetts Associates, 2006

1149.1 Boundary Scan Standard: Chip Level Architecture

In-Circuit Test & Test Objectives

Bennetts Associates, 2006

1149.1 Boundary Scan Standard: Chip Level Architecture

Defect Coverage: Bed-Of-Nails

Defects covered: nail - plated-through-hole - interconnect

2006, Bennetts Associates

Bennetts Associates, 2006

1149.1 Boundary Scan Standard: Chip Level Architecture

Device Packaging Styles

2006, Bennetts Associates

Fundamentally, the in-circuit bed-of-nails technique relied on physical access to all

Bennetts Associates, 2006

1149.1 Boundary Scan Standard: Chip Level Architecture

Multi-Layer Board Construction

Bennetts Associates, 2006

1149.1 Boundary Scan Standard: Chip Level Architecture

Probing Multi-Layer Boards

2006, Bennetts Associates

Bennetts Associates, 2006

1149.1 Boundary Scan Standard: Chip Level Architecture

So, What Went Wrong?

2006, Bennetts Associates

Bennetts Associates, 2006

1149.1 Boundary Scan Standard: Chip Level Architecture

What Problem Did This Cause?

2006, Bennetts Associates

Bennetts Associates, 2006

1149.1 Boundary Scan Standard: Chip Level Architecture

What Was The Solution?

Joint (European) Test Action Group, 1985 - 90

Bennetts Associates, 2006

1149.1 Boundary Scan Standard: Chip Level Architecture

Principle of Boundary Scan

Test Clock (TCK)

Any Digital Chip

Each boundary-scan cell can:

Bennetts Associates, 2006

1149.1 Boundary Scan Standard: Chip Level Architecture

Motivation For Boundary Scan: Summary

Major change of device packaging: from thru-hole (DIL) to

Question: how to test for manufacturing defects?

2006, Bennetts Associates

Bennetts Associates, 2006

1149.1 Boundary Scan Standard: Chip Level Architecture

JTAG Meeting, 17 September, 1988

2006, Bennetts Associates

Bennetts Associates, 2006

1149.1 Boundary Scan Standard: Chip Level Architecture

Using The Boundary-Scan Path

Any Digital Chip

Output Scan Cell:

Open circuit TRST. TRST floats at inactive level (logic-1).