jtag boundary scan debug

**JTAG Boundary Scan and Debug Interface** is the **IEEE 1149.1 standard that provides a serial test access port (TAP) for board-level interconnect testing, chip-level scan access, and on-chip debug — enabling engineers to verify solder joints on assembled PCBs, access internal scan chains for manufacturing test, and perform interactive debug (breakpoints, register inspection, memory access) of running processors through a 4-5 wire interface that has become the universal debug port for every microprocessor, FPGA, and complex SoC**. **JTAG TAP Architecture** The TAP controller is a 16-state finite state machine controlled by two signals: - **TCK (Test Clock)**: Clock for all JTAG operations. Typically 10-50 MHz. - **TMS (Test Mode Select)**: Controls state transitions of the TAP FSM. Navigates between states: Test-Logic-Reset → Run-Test/Idle → Select-DR/IR → Capture → Shift → Update. - **TDI (Test Data In)**: Serial data input to the selected register. - **TDO (Test Data Out)**: Serial data output from the selected register. - **TRST (Test Reset, optional)**: Asynchronous reset of the TAP controller. **Instruction Register (IR)** selects which data register is connected between TDI and TDO. Standard instructions: - **BYPASS**: Connects a 1-bit bypass register — passes data through the chip in one cycle for daisy-chaining. - **EXTEST**: Connect Boundary Scan Register — test board-level interconnects by driving and observing IC pin values. - **SAMPLE/PRELOAD**: Capture pin states without interfering with normal operation. - **IDCODE**: Read the device identification register (manufacturer, part number, version). **Boundary Scan Testing** Each I/O pin has a boundary scan cell — a flip-flop that can capture the pin's current value or drive a user-specified value. All boundary scan cells form a shift register: 1. Shift test pattern into boundary scan register via TDI. 2. Apply pattern to pins (EXTEST instruction). 3. Capture pin values at receiving devices. 4. Shift out captured values via TDO. 5. Compare to expected — detects shorts, opens, and stuck pins on the PCB. Coverage: All connections between JTAG-compliant devices on a board. Essential for BGA packages where pins are inaccessible to bed-of-nails testers. **On-Chip Debug** JTAG evolved beyond board test into the primary debug interface for processors: - **Debug Module (RISC-V dm, ARM CoreSight)**: Accessible via JTAG, provides: halt/resume, single-step, hardware breakpoints (address comparators in the pipeline), watchpoints (data address match), register read/write, memory access through system bus. - **Run-Control**: Debugger halts the processor, inspects registers and memory, sets breakpoints, and resumes execution — all through JTAG at TCK speed. GDB connects to the target through a JTAG adapter (OpenOCD, J-Link, DSTREAM). - **Trace**: Real-time instruction and data trace (ARM ETM, Intel PT, RISC-V trace specification) captures execution flow without halting the processor. Trace data streamed off-chip through trace port or stored in on-chip trace buffer (ETB). Essential for debugging timing-sensitive issues that halt-mode debug disturbs. **Multi-Core and SoC Debug** Modern SoCs have 10-100+ cores, each requiring debug access. IEEE 1687 (IJTAG) and ARM CoreSight provide hierarchical debug access networks — a single JTAG port multiplexed to all debug-capable components through on-chip debug fabric (DAP, cross-trigger interface for synchronized halt of multiple cores). JTAG Boundary Scan and Debug is **the universal test and debug infrastructure wired into every advanced silicon device** — the 4-wire interface that enables board-level production testing, silicon bring-up debug, and runtime diagnostics from the earliest chip prototype through decades of field deployment.