Complete guide to JTAG IEEE 1149.1 boundary scan: TAP controller states, boundary scan register cells, EXTEST/INTEST/BYPASS instructions, BSDL files, and Verilog BSR cell implementation.
Boundary scan (IEEE 1149.1 — commonly called JTAG) is a hardware testing standard that places a small shift-register cell at every I/O pin of a compliant IC. These cells form a serial chain — the Boundary Scan Register (BSR) — that allows a test controller to:
Sample the logic values at every pin simultaneously and shift them out serially via TDO — without physical probes on each pin.
Load test vectors into the BSR via TDI and force them onto device pins — allowing interconnect testing between chips on a PCB.
Using INTEST mode, apply patterns to internal flip-flops while isolating from the board — useful for in-system IC diagnostics.
JTAG is used for FPGA configuration, flash programming, and microcontroller firmware loading in addition to structural testing.
| Pin | Direction | Function |
|---|---|---|
TCK | Input | Test Clock — all TAP state transitions and register shifts happen on TCK edges |
TMS | Input | Test Mode Select — sampled on TCK rising edge to drive the 16-state TAP FSM |
TDI | Input | Test Data In — serial data shifted into the selected register (MSB first) |
TDO | Output | Test Data Out — serial data shifted out of the selected register (LSB first) |
TRST | Input | Test Reset (optional) — async reset to Test-Logic-Reset state |
Rule: Apply TMS=1 for 5 consecutive TCK cycles from any state — the TAP controller always lands in Test-Logic-Reset. This is the universal recovery sequence used by all ATE tools.
The TAP controller is a 16-state finite state machine that interprets TMS pulses to navigate between test states. The states split into two paths: the DR path (data register operations) and the IR path (instruction register operations).
| Instruction | Opcode | Function | Use Case |
|---|---|---|---|
EXTEST | All 0s | BSR driven onto pins; capture board-level signals | PCB interconnect test |
SAMPLE/PRELOAD | Device-specific | Non-intrusive capture of current pin state | In-circuit observation |
BYPASS | All 1s | Connects TDI to TDO through 1-bit bypass register | Skip device in daisy chain |
INTEST | Device-specific | Apply BSR data to internal core logic inputs | In-system IC logic test |
IDCODE | Device-specific | Shift out 32-bit device identification code | Device discovery/verification |
CLAMP | Device-specific | Drive BSR preloaded values, bypass active | Hold bus while testing neighbors |
Each I/O pin has a Boundary Scan Cell — a small shift register with capture and update latches. The cell sits between the core logic and the pin, normally transparent in functional mode.
// IEEE 1149.1 Boundary Scan Cell — Type BC_1 (output with control) module bsc_cell ( input tck, // JTAG clock input shift_dr, // Shift-DR TAP state input capture_dr, // Capture-DR TAP state input update_dr, // Update-DR TAP state input extest, // EXTEST instruction active input tdi, // Serial data in from previous cell output reg tdo, // Serial data out to next cell input core_out, // Data from core logic (normal operation) input pin_in, // Signal from I/O pin output pin_out // Signal to I/O pin ); reg capture_latch; // Shift register stage reg update_latch; // Output latch (stable during shift) // Shift register: capture or shift always @(posedge tck) begin if (capture_dr) capture_latch <= pin_in; // Capture current pin value else if (shift_dr) capture_latch <= tdi; // Shift test data in end // TDO is the shift stage output always @(negedge tck) tdo <= capture_latch; // Output on falling edge // Update latch: stable during shift operations always @(posedge tck) begin if (update_dr) update_latch <= capture_latch; end // Pin mux: in EXTEST, drive BSR value; otherwise, core drives pin assign pin_out = extest ? update_latch : core_out; endmodule
Every JTAG-compliant device needs a BSDL (Boundary Scan Description Language) file. It's a VHDL-based description that ATE tools use to generate test vectors automatically.
-- Example BSDL snippet for a simple 8-pin device entity MY_CHIP is -- Pin mapping attribute PIN_MAP of MY_CHIP : entity is PHYSICAL_PIN_MAP; constant CHIP_PKG : PIN_MAP_STRING := "TCK:1, TMS:2, TDI:3, TDO:4, TRST:5, " & "IO_A:6, IO_B:7, IO_C:8"; -- JTAG instruction register length attribute INSTRUCTION_LENGTH of MY_CHIP : entity is 4; -- Instruction opcodes (4-bit) attribute INSTRUCTION_OPCODE of MY_CHIP : entity is "EXTEST (0000), " & "SAMPLE (0001), " & "IDCODE (0010), " & "BYPASS (1111)"; -- 32-bit IDCODE value attribute IDCODE_REGISTER of MY_CHIP : entity is "0000" & -- version "0001000000000001" & -- part number "00000001001" & -- manufacturer (JEDEC) "1"; -- required lsb=1 -- Boundary scan cell descriptions for each I/O pin attribute BOUNDARY_REGISTER of MY_CHIP : entity is -- Cell# : cell_type, port_name, function, safe_value "0 (BC_1, IO_A, output3, X), " & "1 (BC_1, IO_B, output3, X), " & "2 (BC_1, IO_C, input, X) "; end MY_CHIP;
| Fault Type | Description | Detection Method |
|---|---|---|
| Stuck-at-0 (SA0) | Net permanently low regardless of driver | Drive 1, capture 0 → mismatch |
| Stuck-at-1 (SA1) | Net permanently high | Drive 0, capture 1 → mismatch |
| Open (disconnected) | No electrical connection on trace/pin | Drive 1/0, capture floating (weak pull → mismatch) |
| Short to GND/VCC | Net shorted to power rail | Drive opposite level, mismatch confirms short |
| Bridge (net-to-net short) | Two nets shorted together | Drive different values, both capture same value |
Boundary scan testing (IEEE 1149.1 / JTAG) is a method for testing PCB interconnects and IC logic without physical probes. Each I/O pin has a BSR cell that can capture/drive pin values serially, allowing board-level interconnect testing without bed-of-nails fixtures.
TCK (Test Clock), TMS (Test Mode Select), TDI (Test Data In), TDO (Test Data Out). TRST (Test Reset) is optional. TMS+TCK drive the TAP state machine; TDI/TDO form the serial data path through the device.
EXTEST drives BSR values onto device pins to test PCB interconnects. INTEST applies BSR test patterns to internal core logic while isolating from the board. EXTEST = board-level interconnect; INTEST = IC internal logic.
BSDL (Boundary Scan Description Language) is a VHDL-based file describing a device's boundary scan architecture: pin names, IR length, instruction opcodes, and BSR cell types. ATE tools use BSDL files to automatically generate test vectors.
In EXTEST, force a specific value onto an output pin. The receiving IC's BSR captures the pin value. If driven=1 but captured=0 → SA0. If driven=0 but captured=1 → SA1. The bit position in the BSR chain identifies the exact faulty net.
BYPASS connects TDI directly to TDO through a single 1-bit register, effectively skipping the device's full BSR. Used when you want to test only one device in a multi-device daisy chain without shifting through every device's full register length.