JTAG (IEEE 1149.1) is the universal standard for testing PCBs, programming FPGAs, and debugging CPUs — all through a 4-pin serial interface. Every JTAG-compliant device contains a TAP (Test Access Port) controller — a 16-state FSM that controls scan register access. Boundary scan cells sit at every I/O pin, forming a shift register that can observe and control board-level signals without a physical probe.
JTAG requires only 4 mandatory pins plus one optional reset. All devices on a chain share TCK and TMS; TDI/TDO form the daisy chain.
| Signal | Direction | Sampled On | Description |
|---|---|---|---|
| TCK | Input (all devices) | — | Test Clock. All JTAG signals are synchronous to TCK. Controller drives it; there is no frequency requirement — TCK can be as slow as needed. |
| TMS | Input (all devices) | Rising edge of TCK | Test Mode Select. Drives the TAP controller FSM. All devices in a chain see the same TMS — the chain navigates to the same FSM state together. |
| TDI | Input → daisy chain | Rising edge of TCK | Test Data In. Serial data enters the chain here, shifts through each device's active register (IR or DR), and exits as TDO of the last device. |
| TDO | Output → next device | Falling edge of TCK | Test Data Out. Data is shifted out on the falling edge, giving downstream devices half a TCK period to capture it cleanly. |
| TRST* | Input (optional) | Async (active low) | Test Reset. Optional pin that asynchronously forces the TAP controller to Test-Logic-Reset. Without TRST, TLR is reached by holding TMS high for 5+ TCK cycles. |
The TAP controller is driven entirely by TMS sampled on rising TCK edges. Each state transition shows the TMS value (0 or 1) required to take that path.
Fig 1 — TAP controller FSM. TMS=1 for 5+ TCK cycles always reaches Test-Logic-Reset from any state. The DR path (blue) and IR path (yellow) are structurally symmetric — Capture, Shift, Exit1, Update.
Multiple JTAG devices on the same board are connected in a serial chain. TCK and TMS are bussed to all devices; TDO of each device feeds TDI of the next.
Fig 2 — JTAG daisy chain. TCK and TMS are shared across all devices. TDI enters Device 1, shifts through its active register, exits as TDO, then enters Device 2, and so on. The total shift length equals the sum of all active register lengths.
A boundary scan cell (BSC) sits at every I/O pin. Together they form the boundary scan register (BSR) — the shift register that allows test vectors to be applied to and captured from board nets.
Fig 3 — Boundary scan cell (output cell shown). The Capture MUX selects what to load into the Shift Register during Capture-DR. During Shift-DR the shift register clocks data between TDI and TDO. During Update-DR the shift register value latches into the Update Register. The Output MUX selects between normal core output and the Update Register value (EXTEST mode).
| Instruction | Mandatory? | Active Register | Purpose |
|---|---|---|---|
| BYPASS | Yes | 1-bit Bypass Register | Connects TDI directly to TDO through a single flip-flop. Used to skip a device in the chain when testing others. All-ones IR code (e.g. 1111 for 4-bit IR). |
| IDCODE | Recommended | 32-bit IDCODE Register | Shifts out the 32-bit device identification code (manufacturer ID + part number + version). Loaded automatically on TAP reset. Allows toolchains to auto-detect devices in the chain. |
| SAMPLE/PRELOAD | Yes | Boundary Scan Register | SAMPLE: captures current pin states into BSR without affecting device operation. PRELOAD: loads new values into BSR update register for later application. Device continues operating normally. |
| EXTEST | Yes | Boundary Scan Register | External test. Isolates device core from its pins. Drives BSR update register values onto output pins; captures input pin states into capture cells. Used to test board interconnects between devices. |
| INTEST | Optional | Boundary Scan Register | Internal test. Drives BSR values into the device core (not the pins) and captures core outputs. Used to test the device's internal logic with controlled inputs. |
| CLAMP | Optional | Bypass + BSR update held | Forces output pins to BSR-preloaded values while connecting TDI→TDO via the 1-bit bypass register. Useful for driving safe values onto board nets while rapidly shifting data through the chain. |
| RUNBIST | Optional | Device-defined | Triggers the device's internal Built-In Self Test. The TAP stays in Run-Test/Idle for a defined number of TCK cycles, then result is captured into a data register and shifted out. |
| Feature | JTAG (IEEE 1149.1) | SWD (ARM Serial Wire Debug) | cJTAG (IEEE 1149.7) |
|---|---|---|---|
| Pins | 4 (+ optional TRST) | 2 (SWCLK + SWDIO) | 2 (TCKC + TMSC, compatible with JTAG) |
| Standard | IEEE 1149.1 (1990) | ARM proprietary | IEEE 1149.7 (2009) |
| Boundary Scan | Yes | No | Yes |
| Multi-device chain | Yes | No | Yes |
| FPGA programming | Yes | No | Yes |
| CPU debug | Yes (ARM, RISC-V, x86) | Yes (ARM Cortex-M only) | Yes |
| Pin-count advantage | Moderate (4 pins) | Best (2 pins) | Good (2 pins, backward compat.) |
| Use case | Board test, FPGA prog, full debug | Small Cortex-M MCUs (pin limited) | Automotive / embedded, 2-pin JTAG |
JTAG (IEEE 1149.1) solves the PCB testability problem created by BGA packaging. Before JTAG, board faults were detected with bed-of-nails testers that physically probed every solder joint. BGAs made this impossible — hundreds of balls sit under the chip. JTAG moves the test probes inside the chip: boundary scan cells at each pin let a serial controller observe and drive every I/O without physical access. The same 4-pin interface was later adopted for in-circuit programming and on-chip debug.
The TAP (Test Access Port) is a 16-state FSM clocked by TCK and controlled entirely by TMS. There are two symmetrical paths: the DR (Data Register) path for shifting data registers, and the IR (Instruction Register) path for loading new instructions. Each path has Capture, Shift, Exit1, Pause, Exit2, and Update states. TMS=1 always moves toward Test-Logic-Reset; TMS=0 advances through the active operation. Holding TMS=1 for 5 TCK cycles reaches TLR from any state.
A boundary scan cell (BSC) is a small scan flip-flop placed at each I/O pin of a JTAG device. It has three sub-registers: a capture register (loaded from the pin during Capture-DR), a shift register (chained with neighbouring cells to form the BSR, shifted during Shift-DR via TDI→TDO), and an update register (loaded from the shift register during Update-DR and used to drive the pin during EXTEST). In normal operation the BSC is transparent — data flows through as if it wasn't there.
The 32-bit IDCODE register format is defined by IEEE 1149.1: bit 0 is always 1 (distinguishes IDCODE from BYPASS in the chain), bits 1–11 are the JEDEC manufacturer ID (11 bits), bits 12–27 are the part number (16 bits), and bits 28–31 are the version (4 bits). JTAG toolchains read the IDCODE on reset to automatically identify every device in the chain and look up the corresponding BSDL file, which describes the device's IR length, register map, and boundary scan cell definitions.
BSDL (Boundary Scan Description Language) is a VHDL-based language (IEEE 1149.1b) used by IC vendors to describe a device's JTAG implementation: its IDCODE value, IR length, supported instructions, and the boundary scan cell definitions for each pin (order in the BSR, cell type, safe value). Board-level JTAG tools (XJTAG, Goepel, JTAG Technologies) use BSDL files to automatically generate test vectors for interconnect testing without manual programming.
CPU debug uses JTAG as a transport to reach an on-chip debug access port (DAP). ARM CoreSight includes an AHB-AP or APB-AP behind the JTAG-DP (Debug Port). The debugger shifts read/write commands into the DAP, which then reads/writes CPU registers, memory, and debug registers (halt, breakpoint, watchpoint). GDB sends remote serial protocol commands to OpenOCD, which translates them into JTAG TDI sequences via a USB probe (J-Link, FTDI, CMSIS-DAP). RISC-V uses a similar DTM (Debug Transport Module) accessed via the same JTAG TAP.