Introduction to JTAG Boundary Scan – Structured techniques in DFT (VLSI)

Issues in Full System Testing

Until now, in this Design For Testability (DFT) course, we came across various combinational ATPG techniques like D-Algorithm, PODEM, etc. We also studied the testing of sequential circuits through Internal Scan Path using DFT Insertion. But the most significant drawback in these techniques is that these are only applicable to individual circuits on full system design.

In the real world, we have more complex circuits. The television has a whole system of circuits, including microprocessors and peripherals lying interconnected on a PCB. Our smartphones have an entire system integrated inside a single chip (SoC, System on Chip). There are no more straightforward circuits in the real-world, actually. That makes it hard to apply all the above tests in the real world.

If you have hired a technician for repairing your TV or c0omputer or any electronic appliances, you might have observed that they come with a testing kit, where they use a multimeter and probe to check specific pinouts behind the circuit board. These pins are easily accessible for analog or power-electronics circuits, which have a lesser number of components and ICs.

But in VLSI circuits (as the acronym already says Very Large Scale Integrated), it is quite challenging to access each of the ports or pins inside the circuitry by using hand probes.

Manufacturers are increasingly using multilayer boards, ball-grid arrays (BGAs), surface-mount technology (SMT), multi-chip modules (MCMs), systems-in-package (SIPs), smaller PCB traces, increased IC pin-count, fine pitch components, and other technologies. All of these make it significantly more challenging to test the circuit during operation. It is not practical for us to reach each port of individual chips. Let’s discuss a very popular method to address this problem.

IEEE Boundary Scan Standard

Back in the days, individual manufacturers provided various solutions to the testing problem. For instance, by adding special circuitry on the board to test the functionality of the chip by using various instructions which can be fed in through special testing ports. But the protocols for testing varied over different manufacturers, so it was a pain for the tester. Because when they need to test an integrated system with chips from different vendors, they need to learn a completely new documentation every time. This made the testing process very difficult, inefficient, and time-consuming. There was no universal port to test the functionality of all the ICs together.

To counter this problem, an action group known as Joint Tech Action Group (JTAG) was formed, which comprised of several of the leading manufacturers and academicians and finally, a standard called IEEE 1149.1 (also called Boundary Scan Standard) emerged. It became so popular that it is primarily known as the JTAG standard.

Features of Boundary Scan:

1. Allows test instructions and test data to be serially fed into a Component Under Test (CUT). It also allows us to collect responses from the CUT. Hence, it facilitates tests on system logic.
2. Allows system interconnects to be tested separately from components.
3. It is a well-recognized standard; hence it allows chips from different vendors to be tested together similarly.
4. JTAG can operate at the chip, PCB, and system levels.

The JTAG Architecture

Assume you have developed a PCB for a Smart TV consisting of microprocessors, microcontrollers, and several peripheral chips, which can also be interfaced with ports. There are a total of six chips inside your PCB. Now you need to test the chip. Disassembling all the six chips and reassembling the circuit again would be costly, time-consuming, and frankly, ridiculous.

JTAG Port

Let’s see how Boundary Scan facilitates our Design Testing process. No free lunch here, Boundary Scan will require some circuit overhead and some extra I/O pins. These pins will be available by a separate port, popularly known as JTAG Port. If you have done hands-on projects on FPGAs in the VHDL course or Verilog course, you might have already come across the JTAG port. Here’s an image of a JTAG connector.

The pins in the ports are referred to as Test Access Port (TAP). Let’s see what those TAPs are.

Test Access Ports (TAPs)

On the left side is your TV PCB (System) with its standard I/O pins like HDMI, Audio Jack, Power, etc. On your right is the modified PCB block featuring Boundary Scan support using JTAG Port. The pins in red are the mandatory pins, while the pin in blue is optional.

JTAG Scan Chain

Let’s dig a little deeper into the system (i.e., PCB).

As we discussed, our PCB has six different ICs. We can observe that TDI TAP (Test Data Input – Test Access Port, remember this acronym from now) is serially interconnected (or stitched) to each IC using one JTAG Scan Chain. This wire is highlighted in Dark Green. On tracing, this wire emerges out through the TDO (Test Data Output) TAP.

TMS (Test Mode Select) signal is applied to every chip. Boundary Scan Standard is a synchronous design, so every chip also gets the TCK (Test Clock) TAP, i.e., test clock.

We can see that TAPs need to be connected to individual ICs mounted on the system too. Adhering to Boundary Scan Standard, chip manufacturers need to modify their ICs accordingly to add the testing functionality.

JTAG Components

Let’s unpack one of the ICs to get a clear picture of what’s happening.

The Frontend Wrapper

The Core Logic is the IC itself without Boundary Scan functionality. It is embedded inside a blue wrapper, which consists of extra circuits required for the Boundary Scan functionality. There are various registers inside a Boundary Scan wrapper:

• Data Registers: Boundary Scan Register, Bypass Register,
• Instruction Register
• Optional Register

Boundary Scan Cells

Notice that the Core Logic chip’s I/O pins are “bounded” by a series of Boundary Scan Cells. That’s how it got its name. The Boundary Scan Cell consists of multiplexers and registers, which can either be  bypassed in normal operation mode (no testing) , or in test mode, the inputs and outputs of the  Core Logic can be easily captured . In JTAG wrapper, we stitch the system input pins and system output pins into Boundary Scan Register. In this diagram, the Boundary-scan register consists of input Boundary Scan Cells on the left/top and output Boundary Scan Cells on the right side.

Notice the red wires; these are stitched all way from Data In (TDI) into each Boundary Scan Cells towards Data Out (TDO). These connections make all the Boundary Scan Cells replicate the behavior of a standard Shift Register. Therefore, we can call a series of Boundary Scan Cells as a single Boundary Scan Register. In this way, I/O data captured through these cells can be serially transferred out of the system through JTAG port. This provides seamless access to I/O ports of each system component.

Please note that this testing doesn’t interfere with the original Core Logic or interconnection between the ICs, so both  on-line testing and off-line debug facilities are available .

Let’s start discussing each individual component inside the JTAG Wrapper.

Tap Controller

The TAP controller is a 16 state Finite State Machine, which controls the operation of the JTAG Boundary Scan. The input of the FSM is the Test Mode Select signal (TMS). The FSM is clocked by TCK.

The yellow blocks on the left represent the state related to the Data Register (DR), while the green blocks on the right represent the state of the Instruction Register (IR). On the upper left corner, we have the test logic reset state. This is the initial state from where we should start. There are two methods to return to the test logic reset state:

1. Applying reset of test logic, TRST = 0
2. Keep applying a sequence of 1’s

The Tap Controller FSM is an ingenious design. Observe the red arrow lines, no matter where we are,  we will eventually return to Reset State on applying a sequence of 1’s.  Here’s a question. What do you think, how many maximum sequences of 1 are required to reset the FSM?

Well, the answer is five.

If the current state is ShiftDR/ ShiftIR or CaptureDR/ CaptureIR. You can trace the red signals yourself. Now you can easily figure out the reason for the TRST is to be an optional TAP.

The state machine is controlled by TMS TAP input. We can shift into any state by altering the sequence of the input (i.e., TMS TAP). We can also hold into a specific state by continuously holding TMS TAP at zero. We can reset the FSM, as we discussed. Hence, the whole state machine can be controlled with just one input pin. Very smart!

JTAG Registers

JTAG Registers are classified into three types:

1. Data registers (DR):

• • Bypass register (BR)
  • Boundary Scan Register (BSR)

2. Instruction Register (IR)
3. Optional Register

The first two are mandatory registers. There can also be few optional registers providing extra functionality as per the manufacturer. So, the vendors can easily upgrade this with their own testing functionality.

The TDI TAP is broadcasted to all the registers. The state machine decides whether the register captures the data or blocks it. The state machine can be controlled by the user using the TMS TAP. We can shift to any desired state to capture data, or we can also block the entry of data in IR as well as DR. Don’t worry, later we will have a thorough exercise of data movements and testing. This is just an introduction to have a glimpse of the functionality provided by JTAG.

Bypass Register

The purpose of the Bypass register is to  provide a shortcut from TDI to TDO . The structure of a bypass register is straightforward. It is just one-bit flip-flop. When the control signal ShiftDR is equal to logic-1, we can shift our test data from TDI to TDO. In this way, we provide a shortcut through this chip, so this chip is not tested by JTAG if it is already verified or you trust the chip.

In the above example,

No. of I/O pins in each chip                                                        = 4+4 = 8

Clock cycles required to test one pattern in single chip       = 8+8+8 = 24

Clock cycles required to test one pattern in two chips         = 24

Clock cycles required to test one pattern in all three chips = 24

Since this is serial communication, there is a disadvantage that we need to pass the data to all the three chips. So, no matter how many chips you test, you will always require 24 clocks.

But this can be solved using a Bypass Register! Say you trust the chip 1, so only one clock cycle would be required if you use the Bypass Register path (shown in red arrow).

Clock cycles required to test one pattern in two chips (using BR) =   1+8+8 = 17

That’s a 29% reduction in test time!

Boundary Scan Register

Boundary Scan Register (BSC) is the most critical register. It has the power to control or observe the system I/O pins. Let’s dive deep into the internal structure of the input Boundary Scan Cell.

Each input BSC has:

2 flip-flops: Capture/Scan FF, Output FF

2 Control Signals: ShiftDR, Mode

2 Clocks: ClockDR, UpdateDR

The two control signals support four different operations:

Let’s understand the different operations of BSC:

Here’s a summary of all input BSC operations from an eagle’s view.

Output Boundary Scan Cells have an exact similar structure and functionality as input BSC. The only difference being, the System Logic is on the left, while the System Pin is on the right.

Instruction Register

The purpose of the Instruction Register is to shift in instructions from TDI TAP. It stores the JTAG instructions for the Instruction Decoder. It is very similar to Boundary Scan Register as it also has two layers of FFs. The first layer comprises the Scan flip-flop, and the second layer consists of the Output flip-flop.

For loading the instruction, we need to:

• Hold the control signal ShiftIR to logic-1.
• Shift the data from the TDI TAP into the Instruction Register with each subsequent trigger of ClockIR.
• Trigger the clock UpdateIR to update the instruction into the output flip-flop register.

After the above three steps, the instruction is sent to the Instruction Decoder to generate control signals. This two-layer flip-flop design isolates instruction decoder from the scan operation. Hence, the scan operation does not interfere with the instruction decoder.

But we can’t control the Instruction Register this easy. Remember, in the JTAG port, we only had four Test Access Ports (TAPs) available outside the chip. Those were TDI, TDO, TCK, and TMS. We need to do this operation only by using these four signals. Let’s see how we can load the instruction using only the JTAG port with the help of the TAP Controller.

Loading instruction to Instruction Register

Reset Machine: Reset the TAP Controller state machine. Apply as a sequence of five 1’s; TMS = 1→1→1→1→1. Another approach is to apply the TRST signal if available.

Select IR: From the Test-Logic-Reset state, apply TMS = 0→1→1→0→0. This will bring the control to the Shift-IR state. This state configures the control signals (ClockIR, ShiftIR, and UpdateIR) automatically to their respective values for loading the instruction register.

Load Instruction: Load the instruction serially through TDI TAP. In this step, we need to continuously apply TMS = 0 until the complete instruction is loaded. This will control the state machine to stay in the Shift-IR state.

Finish: When the Instruction Register is completely initialized, we can leave the Shift-IR state by applying TMS = 1→1→0. This will bring the state machine to the Idle state.

In this way, we don’t need to access internal signals like ClockIR, ShiftIR, and UpdateIR to control the Instruction Register. This is the salient feature of the JTAG port that we only need four TAPs to control the whole Boundary Scan operation.

Boundary Scan Wrapper overview

The following picture is a detailed overview of the Boundary Scan wrapper.

All the data registers like Boundary Scan Register, Bypass Register, and Optional Register (like Device ID) are enclosed in a red dotted square.

Instruction Decoder generates control signals like Mode and also the Select signal, which controls the scan output for the Data Registers.

On the lower left, there is the TAP controller, which is a 16-state finite state machine. This state machine is configured by the TMS TAP to generate control signals like ClockDR, ShiftDR, and UpdateDR for the data registers and ClockIR, ShiftIR, and UpdateIR for the instruction register.

ClockDR and ClockIR are active at the positive edge of TCK, while UpdateDR and UpdateIR are active at the negative edge of TCK. The TAP controller always makes the state transition at the rising edge of TCK. Also, the TDO output is available after the falling edge of TCK. This is specified in the JTAG standard (IEEE 1149.1).

Summary

In this section, we learned how Boundary Scan facilitates testing of full system design. This is done by enclosing the design in a wrapper that stitches the I/O ports of the chip with the Boundary Scan Register. The wrapper also contains various Boundary Scan components like Instruction Register, Instruction Decoder, Data Registers, TAP Controller, and several other interconnecting components. The Boundary Scan wrapper is very popular and supported by many EDA and CAD tools in the form of free IPs and HDL to be included in the design. ATPG and DFT techniques like Scan Chain, BIST, etc. are also supported by the Boundary Scan Standard.

We learned about the internal functioning of Boundary Scan Cells, Instruction Register, and their control operation using the TAP controller state machine. Boundary Scan registers and components are completely isolated from the core logic. This enables Boundary Scan to provide seamless access to internal ports of a system in runtime without interfering with its normal operation.

In the next article of Boundary Scan, we will discuss the entire testing process using JTAG instructions and programming.