Hi welcome to Fundamentals! Friday Today we're going to take a look at the JTAG interface. JTAG stands for the Joint Test Action Group and I'm sure you probably heard of JTAG and you may have even used it in terms of Uh programming a micro controller or an Fpga, or and or using it as a debugging uh interface or something like that, for example. Well, that's not the only thing it can do. In fact, it originally wasn't designed for that.

Uh, JTAG came about uh in the late 80s when manufacturers started realizing that oh, you know, we're having real lot of trouble testing assembled Pcbs, uh, packages were getting more dense I Moving towards packages like BGA where the balls are on the bottom of the device, you can't use a traditional Bed of Nails tester to come down. And if you did, if you got a you know a 500 pin chip or something Bo that's a lot of test pins to come down and test your assembled PCB It was getting very difficult, so a bunch of Manufacturers got together and said, well, what can we do about it? Can we actually embed, come up with a standard that allows us to embed some Hardware into the chips so that they can? We can use that to test themselves so we can access all of these pins under the PCB without having to use a traditional Bed of Nails test system. And that's exactly what they came up with. and it was ratified by the I E as a standard in around about 1990.

And that's where the name comes from. The Joint Test Action Group Test was originally designed as a way to actually get in there and test individual pins on Uh a chip which has JTAG built into it on the assembled PCB in cases where you couldn't physically get access like big BGA chips for example. or there were just too many pins on a huge system that you just you know you'd have need thousands of pins to actually test it on your better nails or your flying probe tester. It'll take too long to move all the probes around to test it all.

So that's what it was originally designed for and hence the name. Boundary Scan JTAG is also known Uh as boundary Scan Testing and as the name implies, we have to have a look at a block diagram here of a typical chip that includes Uh JTAG Or this boundary scan testing Now chip could be Uh, an Fpga for example. it could be a modern microcontroller that has JTAG built in. It could be a Uh special purpose custom chip that Uh implements JTAG as well, or practically anything on the market.

A dead giveaway for a chip that has JTAG buildin are the pin names here. If they got Tdo, TDI Tck, and TMS, you can bet your bottom dollar it's got JTAG built in now. Not all all of the chips have all of the same functionality because they don't need it. But let's take for example, a Micro a modern micro controller with a JTAG interface.

Not only will it contain your traditional boundary scan around here, which we'll talk about, but it is also used as the interface where you can program your flash memory built-in So it's going to talk to the flash controller built-in. And yes, that microcontroller may also um, have another block in here which then goes out to your traditional Icsp your in circuit serial programming method and you may have two different methods actually program your Uh flash microcontroller for example. um. but it's also going to go into debug controllers these days.

We've talked about ice systems before in circuit emulators which pretty much have gone the way of the doto and have been replaced by the JTAG interface so that will also Connect into the debug controller and that allows you to uh Monitor and debug your code inside your microcontroller in real time. So but that originally that wasn't really thought of when the Uh JTAG The Joint test Action Group originally started this, what they started it for is this boundary scan stuff around here. Now this is the interesting thing about JTAG which a lot of people aren't familiar with. they're used to using it to program and debug their microcontroller for example, but there's much more powerful function ity behind it.

and most chips which have JTAG build-in will also have this boundary scan capability around here. Now what is boundary scan? Well, as the name implies, uh, the it has some circuitry attached to each pin. You could call it like a Uh JTAG cell. for example I've drawn it as one big block here for that sort of you know, joins all the pins, but in reality it's like an individual JTAG cell.

A little bunch of logic in in there which connects in between the usual chip IO which we've looked at in the last video. For example, with Fpgas we looked at all the complex IO stuff they had. Well, not only did they have that I didn't show something last week and that's that bound. additional boundary scan circuitry in there which is tucked away between the chip IO and the pin.

or right. you know this is a just a a crude graphical representation of of how it works. How they actually implement it in there is up to the uh individual manufacturer, but it's easy to think of it as being between your regular IO drivers on your microcontroller or your Fpga for example and the pin and during uh normal use you program and debug your microcontroller. You don't even know this.

JTAG this boundary scan circuitry is actually in there. It just defaults to off when you power on the chip and it does nothing. It just passes the signal straight through from your regular chip. IO circuitry here.

So what they do with these little J tag cells is they actually what I've kind of shown it here I've shown an arrow going out like this and going into here. but in reality as I said, they're like individual cells and they go from one to the other and there's a Serial of one one line serial IO which goes in to each cell and then comes out and they're cascaded like that in a Serial fashion until the data comes out. So you feed data into the Chip And you can and it just Cascades and ripples all the way through like this. Uh, Ripple's a bad term because it's actually a synchronous uh clock in here which does everything.

so don't confuse that. But and the data flows through in a Serial fashion like that and pops out. and what does that allow you to do? well? It depends on the functionality built into the boundary scan, but most of them are going to allow you full direct control over that IO pin. Not only are you able to read the value back directly on the pin of the chip and this is why I've shown it um, actually sort of after the chip.

IO Here, it's in between the chip IO driver and the pin because the idea of boundary scan is you physically read the actual electrical value on that pin, not after any of the chip Iio or anything like that. It actually allows you to read exactly what's on the pin itself so you can read back all that data and shift it out and do whatever you want with it. But not only can you read it, you can that they can have a driver in there as well that allows you to set a value on that pin and being able to set and read values. That gives you an incredibly powerful tool to do ins system debugging.

For example, we if this Uh was a microcontroller for example and we hadn't finished doing our firmware yet, we hadn't programmed the chip, it was empty. It does nothing. It doesn't matter if we've got a populated PCB what we can do is hook it up to our Uh JTAG programmer and we can individually talk to to and drive and read all of the pins on the board. So for example, let's say we had an external memory hooked up to this thing.

Uh, onto all these IO pins here. how do you test that memory to make sure it's okay? Well, we can write individual B values to the address uh and and data buses and then we can read it all back and we can actually exercise and test an external memory for example through our JTAG interface. But not only that, the assembled PCB it allows you to test for your more traditional things like shorts and opens and things like that so and stuck bits. Let's say this pin here is shorted to ground like that.

Well what you try and do is you try and write a one to it and then read it back and if you can't do that, oops, then you know it's shorted. If it always reads back to zero then you know it's always shorted to ground. And also. and then if you had say two pins shorted like that on your PC on your assembled PCB you had a little solder Bridge or something like that.

Well, based on your testin algorithm, you can drive one and read the other Etc and you can actually do all that in various combinations. and you can check for shorts between this pin over here and this pin depending on your layout of your board and all sorts of stuff. Incredibly powerful, And that is one of the main uses of JTAG which a lot of people aren't familiar with. They just think it's programming and debugging.

But nope. There's lots of powerful stuff hidden inside your chip you're probably already using. We've already briefly looked at the four main pins of the JTAG controller and that's all it takes. Four pins.

There's always going to be four pins. There's a Tdo, which is the data coming out of the chip. Don't confuse them in terms of uh, your traditional TX and RX when you get them mixed up. Tdo on a chip, when it's labeled, Tdo is always the data coming out, and TDI is always the data going, the serial data going into the chip, and then you've got your uh Tclock line which is your synchronous clock which actually controls all the data shif in and everything else in there.

And you got TMS which is a control line which does stuff as well based on that T clock and everything else. And those four pins allow you to feed data into the chip and read data back out. and one other powerful feature as well. After you've programmed your microcontroller here and you're running your firmware, you can also at the same time access this boundary scan stuff and read live data changing on your pins here.

Who? That can be incredibly powerful, but unfortunately, because it's a big serial shifted interface, it's not going to be very fast. It's not real time all that sort of stuff. And as I said, it's not incredibly fast because it is a Serial shifted system. And if you've got an Fpga for example, that that's got eight, a huge one that's got 800 IO pins, you got to shift through all that data and all the other Control Data that's hooked into and reading stuff like that can be a massively long serial data stream.

But not only that, not only can you talk to one ship, we can hook our programmer. Ignoring all this, We haven't talked about that yet. We will in a second. you have your programmer your JTAG programmer hooked up directly to the JTAG pins.

Okay, you can just talk to this one chip. But the beautiful thing about the serial, uh, daisy chaining nature of the JTAG system is that you can have additional chips on your board essentially an unlimited number uh, essentially and then daisy chain those together. So the TDI So you're so, instead of plugging directly into this chip, here's our programmer plugged onto our head header on our board. Over here, we've got our data coming in.

Okay, it goes through this chip Boop Bo Boop all the stuff it needs to and then it shifts the data out and then the data goes into the TDI pin of Chip number two here and it goes through its big jtagged daisy chain. In there comes out the TD pin. Then you can daisy chain that to a third chip and so on. and so on.

And you can have as many chips as you as you like subject to Electrical uh design rules and you know bus, You know, loading and all that sort of stuff. You can have as many devices in series as you like and the data finally spits back out. So you could have 100 chips on your board that all have JTAG interfaces in them. You can hook them all onto one JTAG header lousy four pins.

You can test every single pin on every chip on your entire board, both at the assembly stage and when it's actually running and you can read data back. Fantastic! So that's all known as the JTAG chain and it's very common to have more than one device hooked on here and I won't go into uh well, I have to go into another video how Fpga are also uh, like they will have their external flash memory on the JTAG chain as well. We talked about that and how that's all tied in and then how it can actually load data and you program your external flash memory for your Fpga via this huge JTAG chain and each individual device will have its own internal ID and that can be all read out. and there's a whole uh, well.

There's a standard protocol behind all this which then allows you to talk and respond to any one of these chips, but you have to understand that you can't just uh go. oh I Want to talk to this chip Only You have to get the data if you've physically daisy chain them all like this. Or you know, if you got 100 chips on your board, you've Daisy chained them all. Well, you had to get the data just out of this one.

You have to wait until you've got the data out of all the others. Well, it depends where it is in the Uh line, where it physically is in the daisy chain part of the system. Now a lot of boards in in case of development and also production as well. You'll actually build in jumpers on the board here so that you can actually you know a little two pin jumper ah header so that you can actually you know jump out that and bypass that particular chip from the JTAG interface.

That's useful for uh, speeding up, uh, debugging and stuff like that. Let's say you wanted really fast debugging, well as fast as possible on the pins of this chip. Well, you could short out all the other chips in your JTAG J daisy chain to do just that. And any JTAG chip that meets the JTAG standard will have an Associated file that you can just download from the manufacturer's website and it defines the entire Uh JTAG interface for that particular chip and that's known as a boundary scan description language or Bsdl file that you can get from the manufact and that's a Uh variant of Vhdl.

So it's like a a Vhdl sort of language that describes what each individual pin does and the description ID for each chip and all that sort of stuff. So your JTAG system software that you're using on your PC or your test system will be able to read that Bsdl file and know exactly how to talk to and operate and have the all the Io mapping and the pin mapping and all the internal stuff for uh, interfacing with a particular chip on that uh JTAG daisy chain. And yes, I know what some people are thinking if there's a JTAG header as you've seen in many of my tear Downs inside a product, not only can you hook up to it and uh, read the data back out, potentially read the firmware and everything else, but you can also access the individual pins via the boundary scan here and you can use that to hack products h H Now I did actually leave out one line here because it's actually optional and it's not always used the Trst pin which is uh, once again, uh, parallel connected to all the devices in the JTAG chain here and that can just reset the entire chip uh, all of your chips all at once but you don't have to do that. CU You can actually reset them through uh, commands through the serial lines anyway.

or the chip itself may actually have individual, like a different sort of reset circuitry building. Now when you got a JTAG daisy chain like this, the maximum system operation of the JTAG chain is going to be determined by the slowest device in the chain. So if one device is only capable of working at 10 MHz for example, then well, that's what you have to run your entire daisy chain at. But um, you know they can work from anywhere from say, 10 up to 100 MHz or so.

They can be actually very quick, but still shifting all that data through. It's not going to be able to read pins in real time, that's for sure. and thankfully we have something in the mail bag from Xjtag Purveyors of Fine JTAG pornography. Uh, that should be able to help us have a look at the hardware side of things and the software.

so let's crack it open and see what we got. Oh look at this beautiful with compliments. Oh we have ourselves a JTAG demo board. Looks very impressive.

We have ourselves an XJ tag, uh, XJ Link 2, J tag interface and some software. M Now we'll just take a quick look at a practical uh example of looking at a a basic Hardware JTAG interface using this Xjtag 2 programmer that we got here. Now this is not a hobbyist level tool. this is a real professional high-end JTAG development not only programmer, but the software and and the whole Uh system behind it.

And it comes with this very nice demo board which should allow us to do um, which should allow us to like open pins and put various Uh shorts and fault conditions on that as well. Now it's got an Arm9 uh processor on here that's a TI Stellaris LM uh 3s 300. It's got a Zyink CP on here as well that's got built-in flash so that doesn't have like an external configuration prom or anything like that and that CP is hooked into uh some flash memory and some SRAM up here. and then we can like introduce opens on the Uh data bus and uh do things like that.

So we're going to have uh, two programmable devices in our JTAG chain for this thing. Now this programmer is actually capable of doing a lot more. It's capable of uh, reconfiguring all its pins on the output to match uh, you know, Xyl Linkx or Altera or any any one or any other manufacturer, or even your custom own custom interface. It can supply power through to this board as well, all configurable on each individual pin.

It's uh, hooked up to an I Squar C bus on here as well, which is then hooked into an I Squ C pre Uh E prom. It's hooked up to an analog to digital converter on the I Squ C bus and we've got some analog inputs and stuff like that. Don't have time we muck around with that, but we definitely want to look at these two devices on the JTAG chain. That should be easy.

now. What I'm running at the moment is this XJ tag program that comes with it called the Pin Map Chain Debugger And this is sort of like a lowlevel interface where we can just get sort of the raw data and we can configure As I said, the uh, you can see that the header connector on this thing is completely reconfigurable. Now, every JTAG programmer and their software is going to be different. This is not going to be a review of the XJ tag stuff.

This is just how this one happens to work and here we go. We can actually reconfigure all of these pins here. We can choose different types, we can choose the XJ tag interface multi ice the B Alterior bite Blaster compatible interface so we can choose that if we want. uh, we can use the the Xyl interface or a custom interface.

But anyway, what we want is the XJ tag and you can see the pin here. we've got TDI TMS Tclock Tdo You'll notice that there is no uh T reset. it's not actually uh used in this Uh configuration and we want to actually power the board from this device so we can actually choose power on there. Do I want to continue? Yes I know what I'm doing I won't blow up my board and it applies power to pin number one and you can see that these pins change State That's actually a live view there and anyway what we can do is then we can, uh, go down here and we can check.

Well let's start ID codes. Let's try that. There we go Bang! We're starting to read the ID codes. It's found two different IDs chip IDs here and you would have to know uh, what these IDs are.

You would have to know that. Okay, that chip but there's definitely two chips on there so I can stop scanning that. There we go. So it's found two devices on that JTAG chain and what we can do is actually a neat function of this is we can get the maximum T clock so what it's going to do, we can hit that and then it's just going to cycle through uh, the frequencies until it basically gets an error to find the maximum frequency of this signal.

and Bingo there it is Max Frequency 26 MHz So this uh XJ tag JTAG uh, Two Devic is capable of 166 MHz So if your system was capable of that, this is a neat little tool to find that. Anyway, just thought I'd show you that we can clear and now, um, let's check the chain. Here we go. Starting chain check and there's two devices found Bingo There they are.

It doesn't know the actual Uh codes. Uh, it doesn't know how to translate those Uh codes yet through to. you know to map it to a particular device to tell you if it's an Fpga But there you go. It tells you the length of the various chains.

But if we go over to device configuration over here Bingo It has found them. Look the Zyink one. There we go. it's matched it, zyink and an arm.

There we go and the xylin is an XC 9536. It's automatically found that and it's automatically found the arm process. This is an LM 3s 300. Awesome! And what we can do now is we can go up into tools and then view JTAG data and we can check that chain again and wo look at what we got.

all this goodness. There's our raw data from device number one and device number two from both of these uh devices on the JTAG chain. Brilliant! And of course you've got to know what each of the individual uh bits do and things like that. but this just allows you to suck the raw data out of this thing just as a first pass.

Now I'm running What's called the XJ analyzer program and this allows us to do lots of really funky analysis and I've loaded in the example demo uh board. it's already uh, preconfigured with our device types and it shows both of the devices down here. Now we've actually, uh, stopped this. but we can actually go in there and run it.

and here we go. Bingo We get and now a live map of what our individual pins are doing here. The yellow ones look that pin on that particular Uh Cpld is oscillating. for example, these ones are low, high, fantastic.

And we can go in there and modify individual pins. So we now got it running and look, if we right, click here. We can set individual pins Li uh low high. We can set them to toggle, uh, low or fast.

The pin properties. The device properties. Ah, fantastic. There it is.

Read, value, output in net, all sorts of stuff, and you can, you know, configure all this to the cows. Come home for your specific, of course you'd set it all up for your specific, our board, and your application. For what you want to do, we can go into the device properties there: Max J tag frequency of this device for example: Uh 10 MHz I'm currently running it at 20, so it looks like we're overclocking it a bit like that. I Mean we can go in there and then we can uh, set the chain frequency here and I've got it running at 20.

but we can, you know, drop that back down. It's adjustable from 10 khz to 166 in 10 khz steps. for example. we can drop that down.

Not a problem. So there's all the instruction length, the boundary length, how many bytes? I Think that figure was exactly what we saw before in the previous program. 46 pins on here and that's the ID code that we got out of it that matched it. Fantastic.

Now the thing you have to remember here is that we're using the JTAG interface to read all the data of all these pins out live. While that microcontroller is doing running its regular firmware, it's they're to completely independent systems and we can get in there while that microcontroller firmware in this uh LM 3s for example is running. we can go in there and individually override pins and disable pins and set them and toggle them and do whatever. and the firmware doesn't know that we're actually doing that.

Completely independent. Now look what happens if I press this button here? Here we go. look at that. there's a pin on this CP the button obviously connected to C3 there and if I press that There we go, it goes high, low and if I continue to press it, it tells us that it goes yellow to tell us that it's oscillating and watch this.

We can now go in here to this pin for example, which is currently set low and we can. which is it's telling us because it's uh, it's blue. it's got a cross in it that we're actually setting it and we can make that toggle like that and bingo. Look what we got over here.

pin 48 up here of our um, arm micro controller is obviously, uh, connected through to that or they've got some sort of, you know, linkage somehow either through the firmware is doing that or whatever because if this pin over here was going to an input to this microcontroller and then it was outputting, it was just you know, inverting and then outputting that signal or something like that, then we can actually see it doing that. So we can just set that high and look at that too easy. so that one's actually low so they're not actually physically connected, they're inverted and then extremely briefly because well, I haven't played with it much is the full-on developer software with this thing and we can have our boards. For example, I've loaded it in, We can have uh, we've got the schematic of the board, all the parts, we can categorize our devices on it, We can set up all our pins, all our logic files, our test circuits, and all sorts of stuff designed for test, run and deploy.

and we can configure this thing to basically test any JTAG uh enabled system imaginable. So you can really see the power of this uh JTAG system I mean imagine if we opened up a product like an oscilloscope or something and it had a JTAG header in there, we could hook up our JTAG programmer to it. We can see what all the pins are doing, not quite in real time, but you know it does allow you to uh see things happening. We can set and modify things all independent of the firmware.

It's very powerful and that doesn't include all the you know. That's nothing to be said for the production testing side of things. The you know: testing assembled boards, which is basically what all this stuff is about. programming devices, and pretty much.

it's not just about the programmer Hardware that's you know. almost irrelevant. Uh, really. the JTAG uh, Hardware It's all about the software.

And yes, this is big professional level software package, but there are many, many ones on the market built into uh many different Uh tools and things like that. Or they have independent tools like this one. So that's JTAG And it is. As I have shown, it's an incredibly powerful system that you probably didn't know is lurking behind any chip that has this JTAG uh that has a JTAG interface that you may have used for programming or debugging.

So there you go: I Hope you found that uh video useful and you've learned a bit about JTAG and I'm sure. um I'll be doing more on it in the future. So if you like fundamentals Friday Please give it a big thumbs up. You can't see my thumbs but I am sticking them up here and if you want to discuss it, jump on over to the evev log Forum Catch you next time.