EEVblog #499 - What is JTAG and Boundary Scan?

[EEVblog]

What is the JTAG interface and Boundary Scanning, how does it work, and what is it useful for?

[babi]

As always, thank you Dave.

Has anyone tried to configure a Xilinx chip using an embedded microcontroller (even SVF or XSVF player)? That would be an interesting subject.
There are some libraries out there based on xapp058 App Note, but I wonder which of them is better to get started with.

I also wanted to know if it is better to use an FT2232 in conjunction with an application on the PC in order to configure FPGA/CPLD chips instead of using a microcontroller.

Thanks.

[ivan747]

The problem with that is that the PC will have to essentially bit bang the whole JTAG protocol. The good side is that it can be reconfigured by software very easily.

[mikeselectricstuff]

As always, thank you Dave.

Has anyone tried to configure a Xilinx chip using an embedded microcontroller (even SVF or XSVF player)? That would be an interesting subject.
There are some libraries out there based on xapp058 App Note, but I wonder which of them is better to get started with.

I also wanted to know if it is better to use an FT2232 in conjunction with an application on the PC in order to configure FPGA/CPLD chips instead of using a microcontroller.

Thanks.

Most FPGAs have simpler configuration options than JTAG for use with microcontrollers, so you'd normally use that rather then JTAG.
Not sure what Xilinx offer, but Lattice supply some nice code for JTAG  device programming (CPLDs and FPGAS) from microcontollers, which is very easy to integrate, and can program from a file from your filesystem (SD etc) , or from a CONST data array, auto-generated by their ISPVM programmer software from the device JEDEC file.. 

[robrenz]

Very informative Dave, excellent

[babi]

Most FPGAs have simpler configuration options than JTAG for use with microcontrollers, so you'd normally use that rather then JTAG.
Not sure what Xilinx offer, but Lattice supply some nice code for JTAG  device programming (CPLDs and FPGAS) from microcontollers, which is very easy to integrate, and can program from a file from your filesystem (SD etc) , or from a CONST data array, auto-generated by their ISPVM programmer software from the device JEDEC file.. 

Thanks Mike.

So, you say that using a microcontroller to program an FPGA/CPLD is better than bit banging the configuration file directly to the chip from the PC?

Yeah, I know that there are better ways to configure modern FPGAs, but I want to use JTAG to program low-cost Xilinx chips.

Xilinx also offers a code library for configuring their chips using JTAG, but I didn't find it easy to start with.

[mikeselectricstuff]

Bit-banging anything from a PC is going to be slow, and impossible when USB is the only IO available.Use a proper JTAG inteface - either one with an MCU, or the FTDI solution which handles the  low-level protocol in hardware.

I was referring to embedded systems where a MCU needs to update CPLD/FPGA code in the field. 

[mikeselectricstuff]

JTAG reverse engineering video  :

[Smokey]

I remember you opening up a dangerous prototypes Bus Blaster in a mail bag a while back.  That would be a good open source hobbyist alternative to the pro tools. 
http://dangerousprototypes.com/docs/Bus_Blaster

[free_electron]

its not necessary to go through all pins. jtag has a number of commands. there are general commands and device specific commands.

in a chain, after powerup, you would first send the command to identify how many devices are on the bus. (basically you send in a single logic 1 and clock. count the number of clockticks before the one comes back out. that the number of devices. then send the identify command. each device will send out manufacturer and part number.
then you can tell individual devices to temporarily go in 'bypass'. meaning they pull their chain out of the loop and short their tdi and tdo together. that is how you speed up since you don't need to race through those shifters.

there are even ttl chips with jtag. there is an equivalent of a 74245 with 4 jtag pins. this allows you to inject such a device in a critical pathway on a complex board and ease testing.
or , using a little adapter board, temporarily remove the 74245 and pop the jtag version in. hook up the jtag dongle to the little adapter board and bob's your uncle.

74bct8245 is such a part. there is a whole family of em http://www.ti.com/lsds/ti/logic/boundary-scan-jtag-logic-products.page

now, before you get all excited and think about building your own superduper jtag tool : most of the information pertaining to guts of the devices are secret. some manufacturer specify some of the codes (the comon ones as mandated by the standard,but some of the advanced stuff is under NDA ...
therefore the JTAG probes with that fancy software that dave showed cost $$$

[cthree]

Another excellent FF video. Thanks Dave!

[chicken]

Great video!

Is there an OSS/free equivalent to the XJAnalyser software for use with Bus Blaster or similar tools? Definitely looks like a useful tool for reverse engineer and hw hacking.

[free_electron]

Great video!

Is there an OSS/free equivalent to the XJAnalyser software for use with Bus Blaster or similar tools? Definitely looks like a useful tool for reverse engineer and hw hacking.

limited, yes. like i said : the real algorithms are only made available to select partners under NDA.

[FrankT]

How does the XJTAG tool compare to the jtag tools offered by, say, Atmel for programming and debugging their own chips?
Can XJTAG be used instead of the atmel tools?  On my todo list is to get an ARM dev board and play with that - will any JTAG tool allow me to program the ARM?

Frank

[xrunner]

Another excellent FF video. Thanks Dave!

Seconded, never heard of it until now, but fascinating stuff.

[babi]

How does the XJTAG tool compare to the jtag tools offered by, say, Atmel for programming and debugging their own chips?
Can XJTAG be used instead of the atmel tools?  On my todo list is to get an ARM dev board and play with that - will any JTAG tool allow me to program the ARM?

Frank

Yes, there are a couple of JTAG Programmer/Debugger tools for ARM processors. You can use XJTAG for that purpose in ARM RealView, but you know, XJTAG is quite expensive.

You can use J-Link Programmer and Debugger for ARM processors. It is easy to use and much cheaper than the XJTAG.

[EEVblog]

limited, yes. like i said : the real algorithms are only made available to select partners under NDA.

Altium Designer has this ability to live view the boundary scan data and map to images of the chip and pins (via the USB JTAG adapter), even funkier than the XJTAG software if you are the PCB designer (no capability for production test system etc). I don't recall it having any of that additional secret squirrel capability though.

[EEVblog]

will any JTAG tool allow me to program the ARM?

In theory, yes. In practice, the software has to support the device on question.

[tinhead]

other good boundary scan programms:

Universal Scan - http://www.universalscan.com/

TopJTAG - http://www.topjtag.com/


The TOPJtag is already good enought for most things, it is as well cheaper than UniversalScan.
UniversalScan have excellent videos as well, easy to understand how to use that app.

Both can use tons of other/known JTAG cables, no need to buy special one from Boundary Scan tool manufacturer.
Their software is comparable to XJAnalyser, where (in my opinion) UniversalScan is a bit better than TopJTAG.

[daqq]

Thanks Dave, that was a very useful video.


Another fun usage of JTAG reverse engineering I've seen was here:

http://nsa.unaligned.org/jrev.php

Where he reverse engineered the schematic (or rather some of it) for a whole really big board.

[RoadRunner]

i am a bit confused about the hardware & the software for JTAG.

there are a number of different devices, like pic32 ,xilinx FPGA, Altera FPGA and ARM processor they all have JTAG . i know they we can access them by a same jtag cable but.

what i am wondering  if  FT2232 based JTAG hardware will work for all of them ?

is there software or hardware tool available for hobby use like with limited functionality.

[lewis]

Excellent video Dave! 

Found a quick pricelist for the XJTAG thing - have a look at this: http://www.anacom.com.br/downloads/pdf/XJTAG-USPL-Q1-2011.pdf

[RJdaMoD]

what i am wondering  if  FT2232 based JTAG hardware will work for all of them ?

is there software or hardware tool available for hobby use like with limited functionality.

Hi, look for urjtag. Although it is cmdline-tool (that might limit its functionality for some, but it's open source, so you can write your own gui if you want one) it should be sufficient for the hobbyist.

[Ericho]

Excellent video Dave  thanks

[RoadRunner]

what i am wondering  if  FT2232 based JTAG hardware will work for all of them ?

is there software or hardware tool available for hobby use like with limited functionality.

Hi, look for urjtag. Although it is cmdline-tool (that might limit its functionality for some, but it's open source, so you can write your own gui if you want one) it should be sufficient for the hobbyist.

 Thank you

[KedasProbe]

Also belongs in this thread:
SWD/SWV
http://support.code-red-tech.com/CodeRedWiki/HardwareDebugConnections
http://www.arm.com/products/system-ip/debug-trace/coresight-soc-components/serial-wire-debug.php

[free_electron]

The base scanning functionality is well documented. If a device has 40 pins the scanchain is 40 bits long. It doesnt matter there are power or ground pins. Its one bit per pin, irrespective of its functionality.
This is part of the common command set.

Altium has a jtag dongle that can be used during fpga or board design. You can actually open the pcb layou and it colors the pins of the ic packages (the pads and attached traces) in function of the logic voltage. If you have a button tied to an input and you press it you see the pcb layout change color in realtime (as fast as the jtag can scan...)

If you have an led connected to an output you can click on a pad and say 'make it high (or low) and the led will react.

I jave debugged boards like that.

Altium has had that capability since it was DXP 2002 i believe...

The altium dongles is like 150$ and has two jtag ports. One is used for your board hardware, the other one can be used to debug and i teract with the soft processors you cram in an fpga.

Here is a really cool video of altium doing that.: it identifies all devices in the scanchain, flashes the fpga through the hardware jtag and then boots the cpu. They emulate a serial port via the software jtag so you can directly talk to the running code ,put breakpoints, trace it and much more. The debug and tracing works via the built in compilers for all the soft cores altium delivers.

http://m.youtube.com/watch?v=T9WcjF8h_S8&desktop_uri=%2Fwatch%3Fv%3DT9WcjF8h_S8

Here is afood general get started video :

I couldnt find a video showing the realtimepcb layout color change, but here is a document that explains it :


http://altium.com/files/pdfs/techtip/tip6bringingsoftpcbstolife.pdf

[xrunner]

Sorry if I missed the answer to this - but the software that was demoed could show pins toggling. My question is how does it determine toggling? Of course I know what toggling means, but that also implies a freq. If it toggles every 10 minutes it wouldn't catch it right? So is it a matter of it (the software) just happening to catch a state change when it captures a pin state or is there more to it like {stop and see if pin x is toggling for y microseconds}?

[andersm]

Also belongs in this thread:
SWD/SWV

While the ARM debug port specifications allow for it, I don't think any of the Cortex-M cores support boundary scan over SWD, only debug and trace.

[all_repair]

It can be made much more useful if the JTAG fuse is not blown.
Now if a JTAG device is burnt, the whole device or equipment has to be thrown away. 

[Citizen]

So. do i understand it right?
 To be able to hack into the enemy electronics i don't need a decent hardware since  JTAG is pretty simple and uniform, but i would need a decent software that would recognize   almost every hardware  and be able to decode it?

Many people are talking about bus blaster v2/v4 , would it do the job?

[iva]

To be able to hack into the enemy electronics i don't need a decent hardware since  JTAG is pretty simple and uniform, but i would need a decent software that would recognize   almost every hardware  and be able to decode it?

Well, having "JTAG" doesn't automatically imply you can use it for every chip on the board, there are several ways to disable or make it very difficult on the manufacturer side, probably this was missing in the video.

In any case very nice one Dave! I wonder if you have enough material for a part II.

And you were spot on, most of the people working with JTAG know programmers and debuggers but have no clue about the origin and other possibilities given by the interface.

[amyk]

Sorry if I missed the answer to this - but the software that was demoed could show pins toggling. My question is how does it determine toggling? Of course I know what toggling means, but that also implies a freq. If it toggles every 10 minutes it wouldn't catch it right? So is it a matter of it (the software) just happening to catch a state change when it captures a pin state or is there more to it like {stop and see if pin x is toggling for y microseconds}?

If you have a button tied to an input and you press it you see the pcb layout change color in realtime (as fast as the jtag can scan...)

So yes, if the pin happens to toggle a few times between scans and returns to the same state, it won't catch it, just like a DSO aliasing.

[FrankBuss]

Another nice solution for JTAG programming is FPGALink: http://www.makestuff.eu/wordpress/software/fpgalink/
Can be used with a range of microcontrollers, from small Atmel ones with Full Speed USB to high speed FX2 Cypress devices and provides a generic communication channel from your PC application to your FPGA, too. The author is very helpful, has fixed the SVF parser so that it worked with my Lattice parts. Currently I'm porting the microcontroller firmware part to LPC NXP chips, with the http://microbuilder.eu framework (I don't like LPCOpen, too bloated and difficult to use from Eclipse instead of just plain old Makefiles).

[amd]

The altium dongles is like 150$ and has two jtag ports. One is used for your board hardware, the other one can be used to debug and i teract with the soft processors you cram in an fpga.

Do you know where to get the dongle from? I live in Austria and distributors like Farnell and RS say that it is no longer manufactured. Don't know where else to get it from.
I have the situation that I would need to connect two JTAG devices (not in a chain) and debug them simultanously. Since the adapter would have two ports this should be possible, is that correct?
Could I also use the Nanoboard from Altium instead?

Dave didn't mention SWD. I also have one ARM chip that only supports SWD and no JTAG. Is there any way to use the JTAG adapter to debug a device connected with SWD? I think it is the same protocol and just another hardware interface, or am I wrong?

[hpux735]

The base scanning functionality is well documented. If a device has 40 pins the scanchain is 40 bits long. It doesnt matter there are power or ground pins. Its one bit per pin, irrespective of its functionality.
This is part of the common command set.

Altium has a jtag dongle that can be used during fpga or board design. You can actually open the pcb layou and it colors the pins of the ic packages (the pads and attached traces) in function of the logic voltage. If you have a button tied to an input and you press it you see the pcb layout change color in realtime (as fast as the jtag can scan...)

If you have an led connected to an output you can click on a pad and say 'make it high (or low) and the led will react.

I jave debugged boards like that.

Altium has had that capability since it was DXP 2002 i believe...

The altium dongles is like 150$ and has two jtag ports. One is used for your board hardware, the other one can be used to debug and i teract with the soft processors you cram in an fpga.

Here is a really cool video of altium doing that.: it identifies all devices in the scanchain, flashes the fpga through the hardware jtag and then boots the cpu. They emulate a serial port via the software jtag so you can directly talk to the running code ,put breakpoints, trace it and much more. The debug and tracing works via the built in compilers for all the soft cores altium delivers.

http://m.youtube.com/watch?v=T9WcjF8h_S8&desktop_uri=%2Fwatch%3Fv%3DT9WcjF8h_S8

Here is afood general get started video :

I couldnt find a video showing the realtimepcb layout color change, but here is a document that explains it :


http://altium.com/files/pdfs/techtip/tip6bringingsoftpcbstolife.pdf

I have some extra Altium dongles (ordering error in purchasing), and I was hoping that I could use them with other JTAG software.  I haven't had any luck finding support in the usual OSS sources.  Do you know of any applications that have a driver for the Altium dongle?  At the moment, I've been able to get OpenOCD compiled with the TI ICDI driver.

I have looked at the schematic for the Altium dongle, it's provided as an example project in Altium Designer, and it's seems to be a pretty simple device based around an ARM micro controller.  If you download the datasheet for the uC, it's pretty easy to find the boot select pins broken out to a set of pads.  From what I understand, I could use an SD card in the installed SD card port and set the pins to boot off of that.  I haven't had the time (and honestly that's getting to be outside of my skills) to do it, but it's been kicking around in the back of my mind for a while...

[free_electron]

altium dongle works with altium only. the firmware in the dongle is theirs.

you can buy the altium dongle from amazon. ( they are an authorized distributor for the dongle and have it in stock. )

[hpux735]

altium dongle works with altium only. the firmware in the dongle is theirs.

I realize that they're not going to open source their firmware, but that's not necessary.  It's possible to reverse-engineer usb protocols.  If that weren't true, there wouldn't be a lot of OSS drivers.

As much as anything, I thing the Altium dongles could be an interesting way to play with LPC ARM devices.  Certainly much cheaper than this: http://www.icetech.com/emularm/lpc2800_board.html

[tinhead]

I have looked at the schematic for the Altium dongle, it's provided as an example project in Altium Designer, and it's seems to be a pretty simple device based around an ARM micro controller. 

there are two versions of the Altium USB JTAG :
- one based on LPC2xxx ARM (http://www.applelogic.org/SRKH/DT01.html)
- one based on FTDI chip (http://www.applelogic.org/SRKH/DT04.html)

For the ARM based version no chance, it does use proprietary crap drivers from a german company.
For the FTDI version you can of course use OpenOCD (or use that Altium Adapter with OpenOCD and other tools that can speak to FTDI).

[ejeffrey]

I realize that they're not going to open source their firmware, but that's not necessary.  It's possible to reverse-engineer usb protocols.  If that weren't true, there wouldn't be a lot of OSS drivers.

I am not sure about this particular device, but normally in these devices the firmware doesn't come with the device.  The Altium software would load the firmware when it connects.  So yeah, you could reverse engineer it, but unless you distribute the copyrighted firmware, you are just reverse engineer a relatively dumb pod.  Which is fine, but then you might as well start with one of the many free / open source "digital interface on a USB cable" projects.  The hard part is getting all the software and device databases.

[hpux735]

I've been playing around with it for a bit, and with my skill level it's essentially a non-starter.  I've found and soldered wires to the mode select bits to allow for USB DFU mode, but I can't seem to get a working DFU uploader for it.

I also soldered a header onto the JTAG port, but I don't have a working JTAG dongle.  I think I'll need to just get a cheap FT2232-based one.  I was able to play around with OpenOCD and I grasp the basics.  NXP sells a version of this chip with the JTAG port disabled, and I haven't been able to verify which version is soldered on the board.

Anyway, it has been fun to play around with it.  If I can get the JTAG port to work, it'll be fun to write some code for it.

[elcomtel]

JTAG Boundary Scan can be a bit confronting for a newbie with all the different software vendors and applications (development and repair), not to mention the plethora of JTAG interfaces.

My experience with JTAG has concerned electronic repair, so I have mainly been concerned with boundary scan tests and to a lesser degree with using JTAG as a serial programing interface or the several incarnations of microprocessor ICE (In Circuit Emulation).

From my personal experience with 'Universal Scan' software (see below) and some research I have done there are three software packages which I have identified that are affordable and would compliment a small business or hobbyist who is concerned with repairing modern digital equipment that uses JTAG technology. Just imagine the futility of trying to probe some BGA 'pins' and you will quickly appreciate the value of JTAG boundary scan in a practical sense.

JTAG SOFTWARE FOR ELECTRONICS REPAIR

Software Option No.1
Universal Scan $850
http://www.ricreations.com/
Comments: Comes with USB 'software security' dongle, but if you have a parrot on your shoulder and a patch over one eye using the appropriate search parameters in Google will reward you with a pirates bounty of pirate solutions. Comes with FLASH memory support.

Software Option No.2
JTAG Test $120
http://www.jtagtest.com/
Comments: Supplied with their own USB JTAG interface (possibly FT2232H derived). Provided with programming information on application API including C++ header files so this opens up development opportunities for those who are this way inclined.

Software Option No.3
TopJTAG Probe $100
http://www.topjtag.com/
Comments: Supports various JTAG interface devices which is a good thing. For an additional $100 you can also buy FLASH memory support.

I have used Universal Scan (No. 1 above) JTAG boundary scan software and I can say that it is everything you need for servicing digital electronics equipment with JTAG. It supports most of the Xilinx JTAG interfaces (Cable III,IV, USB Platform) which compliments someone who works in a Xilinx environment. I will add that the JTAG interface on a Altium 'Nano Board Series I' is a Xilinx IV standard interface so unofficially Universal Scan also worked on the Altium Nano Board.

I think it's important to have an open mind about the various JTAG interfaces out there. Several vendors market 'propriety' JTAG interfaces which happen to be some original JTAG standard used by Xilinx, Altera, etc but are sold as something specifically different. You simply might find more compatibility between the various JTAG interfaces than you thought. Given the existence of the FT2232H device it's highly likely that many of the USB JTAG interfaces might be compatible.

Most JTAG Boundary Scan compliant devices (ICs, components) have had a BSDL (Boundary Scan Definition Library) file that has been created by a manufacturer which will make your life very easy. These BSDL files are easy to find on the internet with the help of Google and various vendors have these BSDL files available on their websites or FTP servers. You must have these files to make any of the listed software work. When you cannot locate a BSDL file you might need to 'borrow' a BSDL file from another similar device and edit it so that you have one. You must have a BSDL file for each JTAG device because none of the listed software will work.

If you are in the business of repairing modern digital equipment that uses JTAG then my advice is that you will be very well served by the software listed above. The beauty of the software above is that it is not restricted to specific vendors such as Xilinx, Altera, Lattice, etc. The software doesn't care about the vendor as long as you can provide a JTAG interface that complies with IEEE Std. 1149.1 and BSDL file for each device.

I have only used the $850 Universal Scan software, but I think there is better value in the $100 offerings. At the end of the day you basically want to input from a pin or output to a pin and all three software solutions will do this.

I cannot emphasize how valuable the training videos are on the following link.
http://www.ricreations.com/JTAG-Software-Downloads.htm
Whilst the videos are for the Universal Scan software, the similarity between the listed three packages is very close that even if you were to decide to buy the $100-$120 solution much of what is discussed is still relevant.

The JTAG software presented is of little value for electronics product development except to verify that your development system is working. It's a must have if you repair any modern digital electronics equipment that has a JTAG interface.

[Richard_Fry]

elcomtel, do you have any experience of the scripting function in Universal Scan?

I've been looking for something that will let me  'walking ones' around connectors and talk to non-boundary scan devices such as DAC / ADCs?
Obviously the big boys XJtag, Jtag.com and (I think) Corelis do this, but they're a lot of money!
Jtaglive does offer this functionality reasonably cheaply, but it's still nearly 3 times the price of Universal Scan.

I know it's this and other add-ons that make the price the big boys charge, but if Universal Scan is acceptably useful - if a little clunky, it's probably ok for me.
I see I can download a demo, so will try that, but first hand experience always useful.

Failing that, I'll start learning C#

[elcomtel]

elcomtel, do you have any experience of the scripting function in Universal Scan?

I've been looking for something that will let me  'walking ones' around connectors and talk to non-boundary scan devices such as DAC / ADCs?
Obviously the big boys XJtag, Jtag.com and (I think) Corelis do this, but they're a lot of money!
Jtaglive does offer this functionality reasonably cheaply, but it's still nearly 3 times the price of Universal Scan.

I know it's this and other add-ons that make the price the big boys charge, but if Universal Scan is acceptably useful - if a little clunky, it's probably ok for me.
I see I can download a demo, so will try that, but first hand experience always useful.

Failing that, I'll start learning C#

Richard, my apologies for taking so long to reply. I have simply been too busy with life. 

To answer your question, no I haven't used the scripting language with Universal Scan because I simply had no need for it. I appreciate your need for the 'walking ones', but I can say that from memory (last time I used Universal Scan was 1.5 years ago) Universal Scan has a 'toggle' feature for each pin that lets you toggle (clock) the output and observe the response.

[Richard_Fry]

I have simply been too busy with life. 

Hey, no worries...I know what you mean.  I've just moved to Australia and currently looking for work etc., so time on forums is sporadic at best.

[Hooch]

Another excellent FF video.
I'm just learning about it right now. Your video explained a lot.
Thanks Dave!