JTAG & Boundary Scan
TAP Controller · BSR · IEEE 1149.1

What is JTAG?

JTAG stands for Joint Test Action Group — the industry consortium that in 1990 published IEEE Standard 1149.1, formally titled "Standard Test Access Port and Boundary-Scan Architecture." What started as a solution to the PCB interconnect testing crisis of the 1980s has grown into the universal interface for chip testing, embedded debug, flash programming, and in-system instrumentation.

In the 1980s, through-hole PCB components could be tested with bed-of-nails fixtures that physically contacted every pin on every chip. Surface-mount technology (SMT) made this impossible — pins were too small and too densely packed. The JTAG committee's answer was elegant: add a standardized serial test port to every chip, so board-level interconnects could be tested through software by shifting test patterns through the chips themselves.

Today, JTAG is used for:

• Board interconnect testing: test solder joints and PCB traces between chips using boundary scan (EXTEST instruction)
• Chip-level scan access: access internal scan chains through the JTAG TAP for DFT without dedicated external scan pins
• Embedded debug: ARM CoreSight, RISC-V Debug, MIPS EJTAG — all use JTAG to halt CPUs, read registers, and set breakpoints
• Flash programming: FPGA configuration files and NOR flash are programmed via JTAG in the field
• Embedded instruments: IEEE 1687 (IJTAG) extends JTAG access to on-chip instruments like MBIST, PLL calibration, and temperature sensors

JTAG Signals — The 5 Pins

IEEE 1149.1 defines five signals for the Test Access Port (TAP). Only TRST is optional — the other four are mandatory on every IEEE 1149.1 compliant device.

TAP Controller — 16-State FSM

The Test Access Port (TAP) controller is the heart of every JTAG implementation. It is a 16-state Moore FSM whose only input is TMS (sampled every TCK rising edge). The current state determines what the chip does with TCK, TDI, and TDO. All 16 states and their TMS=0/TMS=1 transitions are defined by IEEE 1149.1.

The states naturally split into two parallel paths: a Data Register (DR) path for accessing data registers (like the BSR), and an Instruction Register (IR) path for loading the instruction that selects which data register is active.

Key TAP States Explained

Instruction Register (IR)

The Instruction Register (IR) determines which data register is connected between TDI and TDO during the next DR-scan operation. The IR is a shift register that is updated via the Capture-IR → Shift-IR → Update-IR sequence. IEEE 1149.1 requires a minimum IR length of 2 bits — most chips implement 3 to 10 bits.

On Capture-IR, the IR shift register loads a fixed pattern (typically ...0001 with the two LSBs always 01, per IEEE 1149.1 § 7.2.1) — this allows the tester to detect the IR length and verify connectivity.

The standard mandatory IR codes are:

Boundary Scan Register (BSR)

The Boundary Scan Register (BSR) is a chain of individual boundary scan cells (BSCs) — one per I/O pin of the chip — connected to form a shift register that encircles the entire chip periphery. The BSR sits at the interface between the chip's core logic and its I/O pads.

Each Boundary Scan Cell (BSC) contains:

• System cell: connects the I/O pad to the chip's functional logic during normal operation
• Capture cell (shift register): a flip-flop that can capture the pad value (for SAMPLE) or be shifted to form part of the serial chain
• Update cell: a second flip-flop that holds the stable output value while the shift register is being updated
• Multiplexer: selects between the functional data path and the test data path based on the active JTAG instruction

During EXTEST: the update cells drive the output pads from preloaded BSR data, and input pad values are captured into capture cells on the rising edge of TCK when in Capture-DR state. This lets you drive arbitrary patterns onto board traces and read back what the neighboring chips' pins see — without any physical probe access.

Key JTAG Instructions in Detail

EXTEST — External Test

EXTEST is the core board-level interconnect test instruction. With EXTEST active, the output pins of the chip are driven by the BSR's update cells (not by the chip's core logic). The test engineer pre-loads the BSR with a test pattern using SAMPLE/PRELOAD, then switches to EXTEST. Now:

• Output pins drive the test pattern onto the PCB traces
• Adjacent chips (also in EXTEST) capture what arrives at their input pins
• The captured values are shifted out via the BSR scan chain and compared against expected values
• A mismatch indicates an open or shorted net on the PCB

SAMPLE/PRELOAD — Non-Destructive Snapshot

SAMPLE/PRELOAD has two roles: in sample mode, it takes a non-destructive snapshot of all I/O pin values during normal chip operation — useful for debugging. In preload mode, data shifted into the BSR via TDI is staged in the update cells, ready to be driven out when the instruction changes to EXTEST. This prevents glitches on the PCB during the instruction transition.

BYPASS — Skip in Chain

The bypass register is a single flip-flop connecting TDI to TDO with one clock cycle of latency. When a chip is set to BYPASS, it is effectively removed from the scan chain — it only adds 1 bit of delay. This is crucial in systems with many chips in the JTAG daisy chain: if you need to test only one chip, bypass all others to make the effective chain length = (target chip BSR length + N×1 bit for N bypassed chips).

IDCODE — Device Identification

The IDCODE register is a 32-bit read-only register containing the chip's identity per IEEE 1149.1 §12:

The IDCODE instruction is typically selected automatically after reset (it is often the power-on-reset default instruction), allowing a tester to immediately identify all chips in the chain by reading their 32-bit IDs.

Verilog: Simplified TAP Controller

Below is a simplified Verilog implementation of the TAP FSM covering the key states. A real implementation would also include the IR/DR register logic, the data mux, and the TDO output register — but the FSM skeleton shows the state encoding and TMS-driven transitions.

// Simplified IEEE 1149.1 TAP Controller FSM
// 16-state Moore machine driven by TMS (sampled on TCK posedge)

module tap_controller (
    input  tck,       // Test Clock
    input  tms,       // Test Mode Select
    input  trst_n,    // Test Reset (active low, optional)
    output reg shift_dr,   // 1 in Shift-DR state
    output reg capture_dr, // 1 in Capture-DR state
    output reg update_dr,  // 1 in Update-DR state
    output reg shift_ir,   // 1 in Shift-IR state
    output reg capture_ir, // 1 in Capture-IR state
    output reg update_ir   // 1 in Update-IR state
);

// State encoding (4 bits for 16 states)
localparam [3:0]
    TLR        = 4'h0,  // Test-Logic-Reset
    RTI        = 4'h1,  // Run-Test/Idle
    SEL_DR     = 4'h2,  // Select-DR-Scan
    CAP_DR     = 4'h3,  // Capture-DR
    SHIFT_DR   = 4'h4,  // Shift-DR
    EXIT1_DR   = 4'h5,  // Exit1-DR
    PAUSE_DR   = 4'h6,  // Pause-DR
    EXIT2_DR   = 4'h7,  // Exit2-DR
    UPD_DR     = 4'h8,  // Update-DR
    SEL_IR     = 4'h9,  // Select-IR-Scan
    CAP_IR     = 4'hA,  // Capture-IR
    SHIFT_IR   = 4'hB,  // Shift-IR
    EXIT1_IR   = 4'hC,  // Exit1-IR
    PAUSE_IR   = 4'hD,  // Pause-IR
    EXIT2_IR   = 4'hE,  // Exit2-IR
    UPD_IR     = 4'hF;  // Update-IR

reg [3:0] state, next_state;

// ── State register (synchronous on TCK, async reset) ────────────
always @(posedge tck or negedge trst_n) begin
    if (!trst_n)
        state <= TLR;
    else
        state <= next_state;
end

// ── Next-state logic (combinational) ────────────────────────────
always @(*) begin
    case (state)
        TLR:      next_state = tms ? TLR      : RTI;
        RTI:      next_state = tms ? SEL_DR   : RTI;
        SEL_DR:   next_state = tms ? SEL_IR   : CAP_DR;
        CAP_DR:   next_state = tms ? EXIT1_DR : SHIFT_DR;
        SHIFT_DR: next_state = tms ? EXIT1_DR : SHIFT_DR;
        EXIT1_DR: next_state = tms ? UPD_DR   : PAUSE_DR;
        PAUSE_DR: next_state = tms ? EXIT2_DR : PAUSE_DR;
        EXIT2_DR: next_state = tms ? UPD_DR   : SHIFT_DR;
        UPD_DR:   next_state = tms ? SEL_DR   : RTI;
        SEL_IR:   next_state = tms ? TLR      : CAP_IR;
        CAP_IR:   next_state = tms ? EXIT1_IR : SHIFT_IR;
        SHIFT_IR: next_state = tms ? EXIT1_IR : SHIFT_IR;
        EXIT1_IR: next_state = tms ? UPD_IR   : PAUSE_IR;
        PAUSE_IR: next_state = tms ? EXIT2_IR : PAUSE_IR;
        EXIT2_IR: next_state = tms ? UPD_IR   : SHIFT_IR;
        UPD_IR:   next_state = tms ? SEL_DR   : RTI;
        default:  next_state = TLR;
    endcase
end

// ── Output decode (Moore outputs from current state) ─────────────
always @(*) begin
    shift_dr   = (state == SHIFT_DR);
    capture_dr = (state == CAP_DR);
    update_dr  = (state == UPD_DR);
    shift_ir   = (state == SHIFT_IR);
    capture_ir = (state == CAP_IR);
    update_ir  = (state == UPD_IR);
end

endmodule

Key implementation notes:

• TDI is sampled on TCK rising edge (in Shift-DR or Shift-IR) by the shift register logic (not shown here)
• TDO is driven on TCK falling edge to give setup time at the receiving device's TDI
• TMS must have a valid setup time before TCK rising edge — typically 5–10 ns at 10 MHz TCK
• TRST_N is asynchronous — it can reset the TAP at any time, regardless of TCK

JTAG Chain on PCB

On a multi-chip PCB, all JTAG-compliant chips share a common TCK and TMS bus, but TDI and TDO form a daisy chain: the TDO output of chip N connects to the TDI input of chip N+1. The host controller's TDI connects to chip 1's TDI, and chip N's TDO connects back to the host's TDO input.

When Chip 2 is in BYPASS mode, the effective chain length is only 225 bits (128 + 1 bypass bit + 96) instead of 288 bits (128+64+96). For a 100-chip board where you're testing one chip, BYPASS reduces chain length from thousands of bits to just a few hundred — dramatically reducing test time.

JTAG Beyond Boundary Scan

ARM CoreSight Debug via JTAG

ARM's CoreSight debug architecture connects to the processor via a Debug Access Port (DAP), which is accessed through JTAG (or its two-wire successor, SWD — Serial Wire Debug). The DAP contains an AHB Access Port (AHB-AP) that gives the debugger a 32-bit master port onto the chip's AHB bus. Through this, a JTAG probe running GDB or OpenOCD can halt CPU cores, read/write all registers and memory, set hardware breakpoints, and single-step through code — all without any internal logic analyzer hardware.

FPGA Programming via JTAG

FPGA vendors (Xilinx/AMD, Intel/Altera, Lattice) implement JTAG-accessible BSCAN primitives. The FPGA's configuration memory (SRAM-based or flash-based) is loaded via JTAG using the vendor's boundary scan instructions (e.g., CFG_IN, CFG_OUT on Xilinx). At power-up or on demand, the full configuration bitstream is shifted in through TDI. In-system logic analyzers (ChipScope, SignalTap) also use the BSCAN TAP to capture internal signals without external pins.

SVF — Serial Vector Format

SVF is a standard ASCII file format for describing JTAG operations. An SVF file specifies the IR values to load, the DR data to shift, and the expected responses — making JTAG test programs portable between different ATEs and JTAG controllers. SVF is used to distribute boundary scan test programs, FPGA configuration images, and flash programming sequences.

IEEE 1149.6 — High-Speed Differential Signals

Standard boundary scan cannot directly test high-speed differential pairs (PCIe, DDR, LVDS) because the boundary scan cell operates at low frequency (TCK). IEEE 1149.6 extends the standard with AC-coupled boundary scan cells that can test differential connections by injecting and detecting AC waveforms. It is used on multi-gigabit SerDes interfaces.

IEEE 1687 — IJTAG (Embedded Instruments)

IEEE 1687 (IJTAG — Internal JTAG) extends the original 1149.1 framework to provide standardized access to embedded instruments: MBIST controllers, temperature sensors, PLL calibration engines, power management units, and on-chip oscilloscopes. The key innovation is the Instrument Connectivity Language (ICL) and Procedural Description Language (PDL), which describe the scan topology and test procedures in a machine-readable way — enabling tools to automatically generate TMS/TDI sequences to reach any instrument on the chip through the JTAG TAP.

Frequently Asked Questions