JTAG and Boundary Scan: Board-Level Test Implementation
JTAG (Joint Test Action Group), formally standardized as IEEE 1149.1, is the foundation of modern Design-for-Test (DFT) at the board level. As BGA packages, fine-pitch components, and dense multilayer PCBs eliminated physical access for bed-of-nails test fixtures, boundary scan became the primary method for verifying interconnects, programming devices, and debugging silicon. This guide covers the architecture, signals, state machine, and instruction set you need to implement boundary scan in real designs.
Quick Summary
| Standard | IEEE 1149.1 - serial test access via a 4 or 5 wire Test Access Port (TAP) |
| Core Purpose | Test board interconnects without physical probe access to pins |
| Key Components | TAP controller FSM, instruction register, boundary scan register, BYPASS register |
IEEE 1149.1 Architecture Overview
A boundary scan compliant device wraps each functional I/O pin with a boundary scan cell (BSC). These cells are connected as a long shift register between the device's data input and output pins. By shifting data into this chain, a test controller can drive known values onto output pins and capture the logic levels present at input pins, all without the core logic participating.
The mandatory architectural blocks defined by the standard are:
- Test Access Port (TAP): The dedicated pin interface used to control test operations
- TAP Controller: A 16-state finite state machine driven by TMS and TCK
- Instruction Register (IR): Holds the current test instruction, minimum 2 bits wide
- Boundary Scan Register (BSR): The chain of boundary scan cells around the periphery
- BYPASS Register: A single-bit register that shortcuts the device in the scan path
- Optional Registers: IDCODE/USERCODE (32-bit) device identification register
TAP Signals
The Test Access Port uses four mandatory signals plus one optional asynchronous reset:
- TCK (Test Clock): Free-running test clock, independent of the system clock. All TAP operations are synchronous to TCK. TMS and TDI are sampled on the rising edge; TDO changes on the falling edge.
- TMS (Test Mode Select): Sampled on the rising edge of TCK to navigate the TAP controller state machine. Must have an internal pull-up so an undriven TMS reads as logic 1.
- TDI (Test Data In): Serial input to the instruction register or selected data register. Also pulled up internally.
- TDO (Test Data Out): Serial output. It is tri-stated except during the Shift-IR and Shift-DR states, allowing multiple device TDOs to share a daisy chain.
- TRST (Test Reset, optional): Active-low asynchronous reset that forces the TAP controller to Test-Logic-Reset. The same reset is always reachable synchronously by holding TMS high for five TCK cycles.
The TAP Controller: 16-State FSM
The TAP controller is a Moore finite state machine with exactly 16 states. State transitions occur on the rising edge of TCK and are determined solely by the value of TMS. The machine is organized into two symmetric columns, one for the Data Register (DR) operations and one for the Instruction Register (IR) operations, sharing a common idle path.
State Machine Operation
The controller separates register access into three phases: Capture (parallel-load the register from a source), Shift (serially clock data through TDI/TDO), and Update (transfer the shifted value to the parallel output latch). The Run-Test/Idle state is used to execute self-tests such as RUNBIST, while Test-Logic-Reset disables all test logic and allows normal device operation.
TAP State Diagram Navigation
From Test-Logic-Reset, a TMS sequence of 0 moves to Run-Test/Idle. A TMS of 1 from Run-Test/Idle enters Select-DR-Scan; a further 1 enters Select-IR-Scan.
The two scan branches are structurally identical: Select → Capture → Shift → Exit1 → Update. The Shift state self-loops on TMS=0 (one bit shifted per clock), and TMS=1 leaves it. Pause and Exit2 states allow the shift to be suspended and resumed without losing register contents.
Universal reset: holding TMS=1 for five consecutive TCK rising edges returns the FSM to Test-Logic-Reset from any state.
| State | Group | Function |
|---|---|---|
| Test-Logic-Reset | Reset | Test logic disabled; IDCODE or BYPASS loaded |
| Run-Test/Idle | Idle | Idle, or runs internal self-test (RUNBIST) |
| Select-DR/IR-Scan | Both | Branch point into DR or IR scan path |
| Capture-DR/IR | Both | Parallel-load register from its data source |
| Shift-DR/IR | Both | Serially shift data TDI → TDO, one bit per TCK |
| Exit1 / Exit2-DR/IR | Both | Terminate or branch to Pause/Update |
| Pause-DR/IR | Both | Temporarily halt shifting without data loss |
| Update-DR/IR | Both | Latch shifted value to parallel output |
Instruction Register and Mandatory Instructions
The instruction register selects which data register sits between TDI and TDO and defines the test mode. It is at least 2 bits wide. During Capture-IR, the two least significant bits must load the fixed pattern 01, a built-in integrity check that lets a tester confirm the chain is intact before any real test runs.
Mandatory and Common Instructions
| Instruction | Status | Selected Register | Function |
|---|---|---|---|
| BYPASS | Mandatory | Bypass (1 bit) | Shortcuts device to a single bit; all-ones opcode |
| SAMPLE | Mandatory | Boundary Scan | Captures live pin values during normal operation |
| PRELOAD | Mandatory | Boundary Scan | Loads known data into BSR before EXTEST |
| EXTEST | Mandatory | Boundary Scan | Drives output pins to test board interconnects |
| IDCODE | Optional | Device ID (32 bit) | Reads JEDEC manufacturer/part/version ID |
| INTEST | Optional | Boundary Scan | Applies test vectors to internal core logic |
| RUNBIST | Optional | Internal BIST | Triggers built-in self-test in Run-Test/Idle |
| CLAMP | Optional | Bypass (1 bit) | Holds pins at preloaded values while bypassing |
Note that SAMPLE and PRELOAD share the same opcode in IEEE 1149.1-2001 and are often written as a single SAMPLE/PRELOAD instruction. SAMPLE captures pin state on entry to Capture-DR, while the PRELOAD action loads the parallel update latch on exit, so one instruction conveniently serves both purposes.
The Boundary Scan Register and Cells
Each boundary scan cell typically contains a capture flip-flop and an update flip-flop plus two multiplexers. The cell can operate in four modes depending on the active instruction:
- Normal mode: System data passes straight through the cell; the core sees and drives its pins unaffected.
- Capture mode: The capture FF samples either the system signal (SAMPLE) or the BSR shift-in value.
- Shift mode: Capture FFs form the serial chain, moving data from TDI toward TDO.
- Update mode: The update FF latches the shifted value and drives it onto the output pin (EXTEST).
Cells come in several types: a BC_1 general-purpose cell, observe-only cells (BC_4) for input-only monitoring, and control cells that gate the output enable of tri-state and bidirectional pins. A single control cell often steers an entire bus of output drivers, which is why bidirectional pins occupy multiple positions in the chain.
BSDL: Describing the Device to Test Tools
The Boundary Scan Description Language (BSDL), defined in IEEE 1149.1-1990 Supplement B, is a subset of VHDL that formally describes a device's boundary scan implementation. Automated test pattern generation (ATPG) and in-system programming tools consume BSDL files to understand how to drive each device. A BSDL file specifies:
- Pin mapping: The logical port-to-physical-pin assignment for the package
- TAP port identification: Which pins are TCK, TMS, TDI, TDO, TRST
- Instruction opcodes: The
INSTRUCTION_OPCODEattribute mapping each instruction to its binary code - IDCODE value: The 32-bit identification register pattern
- Boundary register description: The
BOUNDARY_REGISTERattribute listing every cell, its type, function, and control relationships in chain order
Board-Level Interconnect Test
The signature application of boundary scan is verifying the copper between devices, catching opens, shorts, and stuck-at faults that manufacturing introduces. The procedure pairs a driving device with a receiving device:
- Load EXTEST into every boundary scan device on the net under test.
- Preload a stimulus pattern into the output cells of the driving device via PRELOAD.
- Update to drive the pattern onto the board nets.
- Capture the resulting values at the receiving device input cells.
- Shift out and compare the captured data against the expected response.
Test vectors are usually generated with a counting (walking) sequence so that every net carries a unique code. A short between two nets produces a captured value that is the logical AND or OR of the two driven values, immediately revealing both the fault and which nets are involved. An open shows up as a net stuck at its pull resistor value rather than the driven pattern.
Chaining Multiple Devices
On a real board, several JTAG devices are connected in a single daisy chain: TDO of one device feeds TDI of the next, while TCK and TMS are bussed in parallel to all devices. The whole chain behaves as one long shift register, with TDI entering the first device and TDO leaving the last.
- Combined IR length: The total instruction shift length is the sum of every device's IR width. The tester must know each device's IR length to position instructions correctly.
- BYPASS for inactive devices: Devices not under test are loaded with BYPASS, contributing only a single register bit, which minimizes the bits that must be shifted.
- Chain integrity check: Because every device loads
01into its IR LSBs during Capture-IR, shifting out the concatenated pattern verifies the entire chain is connected and the device count is correct. - Signal integrity: Buffer or split long TCK/TMS nets across the chain, and terminate appropriately. Keep TCK clean, as skew between TCK and the serial data is the leading cause of intermittent chain failures.
Implementation Best Practices
- Expose the TAP on a connector: Always route TCK, TMS, TDI, TDO (and TRST if used) to an accessible, keyed test header for production test and field debug.
- Pull TMS and TDI high: Rely on the standard's mandatory internal pull-ups, but add external pull-ups on chain-level TMS/TDI for noise margin during bring-up.
- Drive or pull TRST correctly: If TRST is unused, tie it through a pull-up (not directly to VCC) so it can still be exercised; never leave it floating.
- Keep TCK clean and slow during debug: Start at a conservative TCK frequency, add series termination, and only increase speed once the chain scans reliably.
- Verify IDCODE first: Read every device's IDCODE before running interconnect tests to confirm chain order and silicon revision against your BSDL.
- Validate BSDL files: Use a BSDL syntax checker and cross-check cell counts against the datasheet to avoid false fault diagnoses.
- Isolate non-boundary-scan devices: Document clusters of non-JTAG parts so ATPG tools can apply cluster or interconnect tests around them.
- Plan the chain topology early: Decide chain order, buffering, and connector pinout at schematic capture, not after layout.
Conclusion
Boundary scan transformed board test from a probe-access problem into a software-driven, serial operation. By understanding the TAP signals, the 16-state controller, the instruction register, and the mandatory BYPASS/SAMPLE/PRELOAD/EXTEST instructions, engineers can build designs that are testable from prototype through volume production.
A boundary-scan-ready board pays back its modest pin and area cost many times over in faster manufacturing test, in-system programming, and field diagnostics. Investing in clean TAP routing, validated BSDL, and a well-planned daisy chain is one of the highest-leverage DFT decisions a hardware team can make.
Vcores provides DFT consulting, IEEE 1149.1 compliant test IP, BSDL generation, and boundary scan integration services to make your FPGA and ASIC designs fully testable at the board level.
