The jtag utilities!!!

[gessle]

The thread gets started soon!!!

[gessle]

Fundamental, testul in-circuit se bazează pe posibilitatea de acces fizic la nodurile electrice ale PCB-ului. Tehnologia SMD a avut un impact serios in abilitatea de plasare cu acurateţe a pad-urilor de testare. Device-urile SMD şi PCB-urile multistrat au făcut ca accesul fizic la nodurile electrice să fie serios limitat.
Miniaturizarea plăcilor electronice face ca anumite componente SMD să aibă pinii foate apropiaţi, iar accesul la aceşti pini pentru testare este dificil, spaţiul util fiind sub 25 mils (0.6 mm). De asemenea, structura internă a IC-ului poate fi foarte complicată fiind necesari milioane de vectori de test pentru o testare integrală. Sesizand acest trend la mijlocul anilor 80' un grup de ingineri de test a examinat posibilitatea testării plăcilor electronice care prezintă acces limitat la nodurile electrice. Soluţia propusă a avut la bază accesul la pinii circuitelor integrate folosind un registru de deplasare conectat intern la toţi pinii componentei. Tehnologia a fost denumită “Boundary Scan”.
Organizaţia care a dezvoltat standardul Boundary Scan - la care au aderat toţi producatorii de componente - se numeşte Join Test Action Group (JTAG). Această tehnologie a fost standardizată internaţional şi a primit codul IEEE1149.1-1990, fiind publicată prima dată in 1990. Astăzi, ea este cunoscută sub numele Boundary Scan sau JTAG.

Principiul de lucru Boundary Scan (JTAG)
Un circuit integrat ce conţine structură de tip Boundary Scan are adăugat la fiecare pin de intrare sau de ieşire un element suplimentar de memorie de 1 bit (0 sau 1 logic) care se numeşte celulă Boundary Scan. Această celulă poate capta informaţia de nivel logic de la un pin de input sau poate scrie un nivel logic la un pin de output. Celulele de memorie sunt inlănţuite formand un registru serial, astfel că ele pot permuta date secvenţial pornind de la un pin standard de intrare TDI (Test Data In) sau pot transmite date colectate serial printr-un pin standard dedicat numit TDO (Test data Out).
Transmisia şi recepţia datelor se face sincronizat folosind un pin de clock TCK (Test Clock), iar modurile de operare in regim de testare sunt controlate prin pinul TMS (Test Mode Select).
Comportamentul celulelor scanate şi logica de lucru Boundary Scan este controlată prin intermediul unui controler dedicat numit TAP controller (Test Access Port controller). Pinul opţional TRST (Test Reset) ne permite să resetăm logica de testare Boundary Scan independent de structura logică funcţională a circuitului integrat. Este foarte important de reţinut că la nivelul circuitului integrat elementele de testare Boundary scan (celule de memorie, pinii TDI, TDO, TMS, TCK, TRST, TAP controller) sunt total separate de structura logică a circuitului integrat şi nu o influenţează in nici un fel.
Firmele care produc circuite integrate ce conţin această tehnologie furnizează gratuit descrierea modelului comportamental in regim de autotestare Boundary Scan, pentru fiecare circuit integrat in parte sub forma unui fişier cu extensia *.BDSL.
In cazul in care există mai multe componente de tip Boundary Scan ele sunt interconectate din faza de design a plăcii electronice şi astfel se creează un lanţ de tip Boundary Scan. In cazul de faţă avem 4 IC-uri, pinul de ieşire serial TDO al IC1 este conectat la pinul de intrare serial TDI al IC2, pinul TDO al IC2 este conectat la pinul TDI al IC3, pinul TDI al IC4 este conectat la pinul TDO al IC3. Practic s-a creat un lanţ de transmisie serială a informaţiei de la pinul TDI al IC1 la pinul TDO al IC4.
Pinii de clock TCK sunt conectaţi in paralel la toate IC-urile. Pinii de selecţie TMS sunt conectaţi in paralel la toate IC-urile.
Pinii TDI, TDO, TCK, TMS ai PCB-ului sunt conectaţi prin intermediul unei interfeţe standard la un computer ce rulează un software de aplicaţie Boundary Scan. Acest software sesizează prezenţa celor 4 IC-uri cu celule Boundary Scan, furnizează serial vectori de testare şi compară informaţia transmisă prin pinul TDI al lui IC1 cu informaţia recepţionată prin pinul TDO al IC-ului IC4, la o frecvenţă setată variabilă. (maxim 50MHz).

PCB demo şi Interfaţa XJ Link de la XJTAG
Alimentarea plăcii electronice se face fie direct din interfaţa USB (dacă permite schema) sau separat.
Astfel, se pot realiza patru operaţiuni de bază: incărcarea unei informaţii prin permutare serială (shift-in), prin pinul TDI; aplicarea unui stimul pe un anumit pin (update); capturarea nivelului logic de pe un anumit pin (capture); recepţionarea unei valori de la un anumit pin serial prin pinul TDO. Practic aceste celule boundary scan au rolul unor pini de test virtuali şi permit execuţia următoarelor tipuri de teste:
- verificarea tipului, a producătorului şi a versiunii circuitelor integrate (ID code pe 32 de biţi);
- diagnoza rapidă a scurt-circuitelor, intreruperilor pentru IC-urile altfel inacesibile (Extest);
- izolarea componentelor prin punerea pinilor in stare de impedanţă ridicată fără a utiliza tehnologia ICT clasică de backdriving;
- programarea datelor serial şi verificarea lor;
- testarea altor componente care sunt conectate la pinii circuitelor integrate cu Boundary scan prin folosirea acestora ca pini virtuali.
Software-ul dezvoltat de firma XJTAG (www.xjtag.com) - specializată in soluţii de test Boundary Scan ce rulează in mediul Windows 2000/XP/Vista este format din următoarele module:
1 XJ Runner - modulul operator, in care paşii de test executaţi sunt vizibili pe monitor, iar mesajul de valid/defect este dat la nivel de componentă.
2 XJ Analyzer - Modulul de software de analiză şi debug - permite recunoaşterea automată a tipului de componentă şi vizualizarea stării pinilor tuturor circuitelor integrate din lanţul Boundary Scan in timpul testării.
Culoarea pinilor specifică valoarea lor curentă, iar starea pinilor se poate seta pentru pinii de output şi cei bidirecţionali in “1” logic, “0” logic, oscilare rapidă şi oscilare lentă. De asemenea, se poate selecta vizualizarea semnalelor de la componente diferite sub formă de tabel, astfel incat putem analiza funcţionarea PCB-ului in diverse regimuri.
3 XJ Ease - modul compilator al codului de testare, utilizat pentru:
- generarea testelor de interconectare;
- programarea circuitelor integrate Boundary Scan (CPLDs, FPGAs);
- programarea circuitelor integrate ce nu sunt standard Boundary Scan (memorii flash);
- testarea circuitelor integrate ce nu sunt standard Boundary Scan, dar care sunt conectate la pinii de test virtuali Boundary Scan: pentru aceste componente se creează intr-un limbaj propriu librării (XJ Ease device files) care pot fi apelate de mai multe ori in acelaşi proiect sau pot fi folosite in proiecte ulterioare.
Astfel, avantajul major la XJTAG este mutarea centrului de greutate dinspre generarea de vectori de test spre dezvoltarea de librării de componente, acoperirea unei plăci electronice fiind foarte bună in cazul componentelor non-Boundary Scan.
Pe baza librăriilor existente, compilatorul XJTAG generează vectorii de test adecvaţi in funcţie de pinii virtuali Boundary Scan ai schemei respective.

Concluzie
Putem spune că testul Boundary Scan (JTAG) asigură o testabilitate ridicată a PCB-ului prin utilizarea numai a 5 pini standard de interfaţare utilizandu-se acelaşi test in faza de dezvoltare şi in cea de producţie. Suplimentar de la caz la caz, putem adăuga teste funcţionale şi putem realiza programarea circuitelor integrate, reducand timpii de dezvoltare şi costurile de realizare a programelor de test pentru plăci electronice populate.

[gessle]

JTAG is a serial protocol, similar to SPI in some respects, that is used for boundary scan testing, in circuit emulation, and flash programming. It is standardized in IEEE 1149.1-1990. In boundary scan mode, all the I/O pins on all JTAG devices on a board may be connected together in one giant shift register with one or more bits per pin. There are control registers and ways to bypass the shift register for individual devices (replacing them with a one bit register).
The picture above shows a slightly ficticious chip with a simple 8 bit D-flip flop register with clock and output enable controls with a JTAG TAP (Test Access Port) controller and 18 boundary cells, one on each I/O pin, added. The boundary cells are connected together in a big daisy chain loop. It shows only the data path in that loop, there are a number of control signals as well. Individual chips are then connected together in a longer loop. It says that the chip is ficticious but there are similar parts: TI SN74BCT8374A is almost identical. The amount of test logic on such a simple device far exceeds the amount of operational logic.
JTAG is not an open standard in the sense that internet RFCs and USB are and the way all standards should be, where you can download the standard documents for free. Instead, they fund the standards process by selling copies of the standards documents.
JTAG is availible on far fewer chips than it should be. It is found on most FPGAs, CPLDs, better microcontrollers and processors, and some peripherals. It still isn't available on gates and most other discrete logic parts; there are a few overpriced registers and bus transceivers with JTAG, similar to the one pictured above. But it is several times cheaper to replace those parts with a CPLD and instead of needing glue logic to drive the logic chip, you can reprogram the CPLD to be compatible with your signals and maybe suck in some extra glue logic as well. Now that some of the programable logic vendors provide free (as in beer) software, small logic parts are mostly obsolete. And to take best advantage of JTAG for testability, you will want to use programable logic and microcontrollers instead of discrete logic. And JTAG is widely used, beyond its original intended purpose, for programming those microcontrollers and programmable logic devices.

What JTAG can do?



Here are things JTAG can do or potentially do:

• Boundary scan test of connections between JTAG compliant ICs and boards.
• Test of logic connected between JTAG devices
• In system programming of flash based FPGAs, CPLDs, and other progammable logic. Parts can also be programmed while installed in a zif socket with a JTAG connector.
• Temporary configuration of ram based FPGAs and other programmable logic
• Loading FPGA or CPLD bitstreams into JTAG enabled serial configuration flash devices (such as Xilinx Platform Flash) used to configure FPGAs on reset.
• Loading code into JTAG enabled parallel flash chips (if you can find one)
• Loading code into FLASH memory devices that are not JTAG enabled by manipulating address, data, and control lines on other JTAG enabled chips (such as a micro or CPLD). This can be very inefficient and slow (possible workarounds listed below).
• In system (or Zif) programming of Microcontrollers.
• Test that internal logic of a chip conforms to specifications, provided you have a model or test vectors.
• Detailed internal chip testing with internal cells inserted to allow breaking the design into smaller, testable pieces.
• On chip debugging (hardware assisted debugger built into micro). Breakpoints, single stepping, memory examine/change, etc.
• Test of external connectors on a board, provided you have JTAG devices to connect it to such as a JTAG based test fixture, other JTAG enabled boards that normally connect to the board, loopback connections, or have connected bidirectional I/Os between two similar boards together.
• De-brick routers, motherboards, etc. after a botched firmware download.
• Communicate with logic or software inside a micro, FPGA, CPLD, or other programable logic provided that the chip provides JTAG accessable data registers.
• Check jumper settings to digital logic to check if board is jumpered to factory configuration before shipping.
• Eliminate jumpers in many applications.
• Production programming and test of assembled boards. You can test the solder connections, download Microcontroller, FPGA, and CPLD firmware, and perform basic (low frequency) testing of board logic. All in a single operation with hookup to one or two jtag connectors. You may also be able to set the real time clock by twiddling SPI or I2C pins.
• Measure supply voltages, if you have a JTAG ADC on board.
• Trim boards, if you can find a JTAG DAC or have a DAC or digital potentiometer driven from programmable logic.
• Design one board to be used for multiple functions reducing design, NRE, and inventory costs and achieving better economy of scale. Board can be personalized just in time for shipment.
• Update or reconfigure systems in the field. You can send a technician with a PDA or LAPTOP, send JTAG pod and software to customer, ship a small inexpensive device with flash memory and a microcontroller that acts as a JTAG player, or design the system to perform self upgrades.
• Build in USB JTAG for easy field upgrades.
• Do built in self test by providing a mechanism for an onboard micro to access the JTAG chain.
• Perform analog tests (limited number of devices support 1149.4, though).
• Re-purpose off the shelf devices to serve new applications the designer may not have even imagined.
• Perform basic RAM tests.
• Software developers may be able to use JTAG to produce a partial netlist sufficient to describe the connectivity information needed for software development.
• JTAG could be used to program nonvolatile "fuses" on IIC bus devices to set the node address, thereby overcoming the achiles heal of IIC.

Limitations


Attempts to use JTAG in the ways described above can be hampered by:

• Standards which aren't free
• Commercial software that is too expensive for many applications and which may be difficult to modify or extend.
• "free" software that is either too limited in function or has a copyleft license that prevents you from owning your own enhancements which may contain sensitive information or substantial value added.
• Limited part availability. Obtuse semiconductor manufacturers often omit JTAG when the marginal cost would be negligable or even negative (due to enhanced testability) or when JTAG might substantially increase part sales and/or allow one part to replace many.
• JTAG pods which lack adequate documentation.
• Software that will only work with PODs supplied by the software vendor.
• For the most part, JTAG can not be used to perform high speed functional testing although it may assist in configuration for such testing by setting mode pins to appropriate states or downloading test code to programmable devices capable of high speed signal generation and checking.
• Many pods are cable of far less than the 20Mbps allowed by the standard which limits certain applications like programming large flash devices via bit twiddling of attached chips.
• Different connectors used on different products.
• Programable logic vendors who don't provide easy ways to reconfigure parts without resynthesis which is needed to trim parts or make minor (software jumper) configuration changes.
• JTAG boundary scan was designed in the days of TTL logic which had asymetric drive. If two pins were shorted together and you drove a 0 on one and a 1 on the other, you would usually get a consistent 0 as a result. With many modern logic families the result is far less predictable. This could be improved with programmable pull-up and pull-down combined with output and I/O cells that can be operated in open drain or tristate mode and/or receivers that have multiple thresholds. A part may even have these features in normal operation but they may not be available via JTAG.
• Components such as pull-up resistors may not be adequately tested.

[gessle]

Single Chip

TAP Connector connects directly to the JTAG pins on a single chip. A lot of microcontrollers require this since they also use the TAP for a non-jtag compliant On-Chip debug mode.

Single Scan Chain

Multiple Chips are connected with TDO of one chip driving TDI of the next chip. TAP TDI connects to first chip and TAP TDO connects to last chip. TMS and TCK are connected in parallel to each device.

Separate chain for microcontroller




Another configuration is to have a completely separate chain for a microcontroller. This is because the microcontroller often supports on-chip debug via the JTAG pins but it may use the port in non-standard ways or the software may be confused by other chips on the bus. The microcontroller has a pin that selects whether the TAP port is in JTAG mode or OCD mode.

Multiple chips with separate TDI and TDO





TAP port has separate TDI and TDO pins for each chip but TMS and TCK are shared. Allows faster access to each chip.


Multiple scan chains sharing TMS and TCK






Similar to above but more than one chip on each TDI/TDO pair.

[gessle]

JTAG muxes and multidrop


There are devices that provide access to multiple scan chains. These typically provide two levels of multiplexing. Second, a number of multdrop chips are wired in parallel on the backplane. Second, each device typically provides a number of TAP ports that can be switched into the chain.Some of the others basically appear in the JTAG chain and control data is shifted into the instruction register. Until a device on the backplane bus has been selected, TDO is tristate. The linking shadow protocol is less consistent, perhaps, with JTAG philosophy but it could be advantagous when using software that doesn't understand port multiplexors as a utility program can be used to configure the multiplexor(s) and then the presence of the multiplexor is invisible to the software (provided it does not wiggle TDI in states where it is inappropriate to do so). Some multiplexors also have the ability for one of the slave ports to take over a master. This allows an embedded CPU to perform built in self test or reconfiguration while still allowing external test. Many of the multiplexors also allow the JTAG slave ports to be tristated allowing an external JTAG tester to be connected.

JTAG Details


A JTAG Test Access Port (TAP) consists of 4 signals, with an optional fifth signal:

• TMS - Test Mode Select (input from controller) (pullup required to force entry into reset state in event of a bad connection on TMS).
• TCK - Test Clock (input from controller)
• TDI - Test Data In (input from controller)
• TDO - Test Data Out (output to controller or next chip in chain)
• TRST* - Test Reset (optional, input from controller)

Some JTAG ports have some additional non-standard signals. Microcontrollers often have a debug enable signal that switches between normal JTAG mode and OCD mode. Some ports have a RTCK signal which echos the TCK signal. In many cases TCK is tied to RTCK at the JTAG connector and this may be used to adjust for cable delay. On some ARM7TDMI based chips, this is used to synchronize TCK to the internal system clock. Thus the idea is for the JTAG pod to assert an edge on TCK and wait for the processor to return that edge on RTCK before proceeding. The philips LPC2468 microntroller has RTCK but the Ateml AT91SAM7XC256 does not, though both use the ARM7TDMI core. Many ports have a SRST signal, to reset the processor and other logic. It may also indicate to a debugger that the processor has been manually reset. Some processors have a separate reset input and reset output. Other processors will pull their reset line low when an internal reset is generated. This is a smarter design as it not only saves a pin but it allows one or more chips to hold the system reset low. On the LPC2400 family, RSTOUT is a 1.8V output while JTAG pins are 5V tolerant 3.3V signals, presenting level translation issues if one were to attempt to read this signal. Most JTAG interface connectors have a Vcc/Vdd/Vref pin that is used to adjust the level translators to the appropriate voltage level for the system. In addition, many JTAG interfaces have a system reset line; you may want to sense the state of that line to signal a debugger when a chip has been reset. You may also want to measure the presence of Vref. Since some systems use the JTAG pins for other purposes as well, you may want to tristate the outputs. The voltage level varies depending on the technology being used. Multiple chips (or even boards) with JTAG support can be chained together with the TDO of each chip connected to the TDI of the next. The remaining signals are connected in parallel. Timing is based on the TCK pin so a PC parallel port (with appropriate voltage translation if needed) can be used as a controller. TDI/TMS data is latch on the rising edge of TCK. TDI/TDO/TMS typically change on the falling edge of TCK. You could probably do a full synchronous implementation where the data changes on the rising edge but you would have to be carefull with cable skew and hold types.
Note that the idea of having a TRST line may be less so the pod can reset the TAP controller, which is unnecessary since 5 TCKs with TMS high will accomplish the same result, and more so the board design can pull TRST low through a low value pull-down resistor which the POD can override. Thus, it may be necessary to implement TRST even if you have no need to use it.
In addition, some microcontrollers have a trace port (called ETM on ARM7TDMI). Since the internal address and databus are not usually brought out to pins the trace port can be used to monitor the flow of program execution. On the ARM7TDMI, this is about 8 signals clocked out at the CPU clock rate. By decoding those signals, you can tell when the next instruction in sequence has been executed and when a branch has been taken. A debugger with access to a copy of the code loaded into the micro, a which thus knows the size of each instruction and the destination of each branch can map the flow. Interrupts, however, could complicate this. On ARM7TDMI, a low on RTCK during reset may enable the ETM port. The ETM is configured through the JTAG interface. Use of ETM involves giving up some I/O lines.


Registers





A JTAG device contains multiple registers or chains accessable via the TAP port. If the TAP controller is in the Shift-IR state, the instruction register will be used. In the Shift-DR, the register inserted into the chain will depend on the currently active instruction in the instruction register.

Standard Data Registers

In addition, to the instruction register, each device has more than one data register. At any given time, data is shifted though either the instruction register or one of the data registers depending on the state of the TAP controller and the last instruction loaded. Registers are shifted LSB first.
The boundary-scan register (required)

The boundary-scan register typically contains one or more bits for each logic pin on the device. More than one bit is needed to deal with output enables and direction controls for some pins. All device inputs must be observable and all device outputs controllable through the boundary scan register. The register may provide access to internal states associated with each pin.
The bypass Register (required)

This is a single bit wide shift register connecting TDI and TDO. It is selected in bypass mode and is used to minimize the number of bits that need to be shifted when accessing other chips. Why a one bit delay? Without it, you would end up with an analog delay in TDI proportional to the number of chips and under some conditions, TCK would get there before TDI would.
Device ID register (optional)

This is a 32 bit register that contains information that can be used to identify the specific chips in the chain.