EEVblog #499 - What is JTAG and Boundary Scan?

[KedasProbe]

Also belongs in this thread:
SWD/SWV
http://support.code-red-tech.com/CodeRedWiki/HardwareDebugConnections
http://www.arm.com/products/system-ip/debug-trace/coresight-soc-components/serial-wire-debug.php

[free_electron]

The base scanning functionality is well documented. If a device has 40 pins the scanchain is 40 bits long. It doesnt matter there are power or ground pins. Its one bit per pin, irrespective of its functionality.
This is part of the common command set.

Altium has a jtag dongle that can be used during fpga or board design. You can actually open the pcb layou and it colors the pins of the ic packages (the pads and attached traces) in function of the logic voltage. If you have a button tied to an input and you press it you see the pcb layout change color in realtime (as fast as the jtag can scan...)

If you have an led connected to an output you can click on a pad and say 'make it high (or low) and the led will react.

I jave debugged boards like that.

Altium has had that capability since it was DXP 2002 i believe...

The altium dongles is like 150$ and has two jtag ports. One is used for your board hardware, the other one can be used to debug and i teract with the soft processors you cram in an fpga.

Here is a really cool video of altium doing that.: it identifies all devices in the scanchain, flashes the fpga through the hardware jtag and then boots the cpu. They emulate a serial port via the software jtag so you can directly talk to the running code ,put breakpoints, trace it and much more. The debug and tracing works via the built in compilers for all the soft cores altium delivers.

http://m.youtube.com/watch?v=T9WcjF8h_S8&desktop_uri=%2Fwatch%3Fv%3DT9WcjF8h_S8

Here is afood general get started video :

I couldnt find a video showing the realtimepcb layout color change, but here is a document that explains it :


http://altium.com/files/pdfs/techtip/tip6bringingsoftpcbstolife.pdf

[xrunner]

Sorry if I missed the answer to this - but the software that was demoed could show pins toggling. My question is how does it determine toggling? Of course I know what toggling means, but that also implies a freq. If it toggles every 10 minutes it wouldn't catch it right? So is it a matter of it (the software) just happening to catch a state change when it captures a pin state or is there more to it like {stop and see if pin x is toggling for y microseconds}?

[andersm]

Also belongs in this thread:
SWD/SWV

While the ARM debug port specifications allow for it, I don't think any of the Cortex-M cores support boundary scan over SWD, only debug and trace.

[all_repair]

It can be made much more useful if the JTAG fuse is not blown.
Now if a JTAG device is burnt, the whole device or equipment has to be thrown away. 

[Citizen]

So. do i understand it right?
 To be able to hack into the enemy electronics i don't need a decent hardware since  JTAG is pretty simple and uniform, but i would need a decent software that would recognize   almost every hardware  and be able to decode it?

Many people are talking about bus blaster v2/v4 , would it do the job?

[iva]

To be able to hack into the enemy electronics i don't need a decent hardware since  JTAG is pretty simple and uniform, but i would need a decent software that would recognize   almost every hardware  and be able to decode it?

Well, having "JTAG" doesn't automatically imply you can use it for every chip on the board, there are several ways to disable or make it very difficult on the manufacturer side, probably this was missing in the video.

In any case very nice one Dave! I wonder if you have enough material for a part II.

And you were spot on, most of the people working with JTAG know programmers and debuggers but have no clue about the origin and other possibilities given by the interface.

[amyk]

Sorry if I missed the answer to this - but the software that was demoed could show pins toggling. My question is how does it determine toggling? Of course I know what toggling means, but that also implies a freq. If it toggles every 10 minutes it wouldn't catch it right? So is it a matter of it (the software) just happening to catch a state change when it captures a pin state or is there more to it like {stop and see if pin x is toggling for y microseconds}?

If you have a button tied to an input and you press it you see the pcb layout change color in realtime (as fast as the jtag can scan...)

So yes, if the pin happens to toggle a few times between scans and returns to the same state, it won't catch it, just like a DSO aliasing.

[FrankBuss]

Another nice solution for JTAG programming is FPGALink: http://www.makestuff.eu/wordpress/software/fpgalink/
Can be used with a range of microcontrollers, from small Atmel ones with Full Speed USB to high speed FX2 Cypress devices and provides a generic communication channel from your PC application to your FPGA, too. The author is very helpful, has fixed the SVF parser so that it worked with my Lattice parts. Currently I'm porting the microcontroller firmware part to LPC NXP chips, with the http://microbuilder.eu framework (I don't like LPCOpen, too bloated and difficult to use from Eclipse instead of just plain old Makefiles).

[amd]

The altium dongles is like 150$ and has two jtag ports. One is used for your board hardware, the other one can be used to debug and i teract with the soft processors you cram in an fpga.

Do you know where to get the dongle from? I live in Austria and distributors like Farnell and RS say that it is no longer manufactured. Don't know where else to get it from.
I have the situation that I would need to connect two JTAG devices (not in a chain) and debug them simultanously. Since the adapter would have two ports this should be possible, is that correct?
Could I also use the Nanoboard from Altium instead?

Dave didn't mention SWD. I also have one ARM chip that only supports SWD and no JTAG. Is there any way to use the JTAG adapter to debug a device connected with SWD? I think it is the same protocol and just another hardware interface, or am I wrong?

[hpux735]

The base scanning functionality is well documented. If a device has 40 pins the scanchain is 40 bits long. It doesnt matter there are power or ground pins. Its one bit per pin, irrespective of its functionality.
This is part of the common command set.

Altium has a jtag dongle that can be used during fpga or board design. You can actually open the pcb layou and it colors the pins of the ic packages (the pads and attached traces) in function of the logic voltage. If you have a button tied to an input and you press it you see the pcb layout change color in realtime (as fast as the jtag can scan...)

If you have an led connected to an output you can click on a pad and say 'make it high (or low) and the led will react.

I jave debugged boards like that.

Altium has had that capability since it was DXP 2002 i believe...

The altium dongles is like 150$ and has two jtag ports. One is used for your board hardware, the other one can be used to debug and i teract with the soft processors you cram in an fpga.

Here is a really cool video of altium doing that.: it identifies all devices in the scanchain, flashes the fpga through the hardware jtag and then boots the cpu. They emulate a serial port via the software jtag so you can directly talk to the running code ,put breakpoints, trace it and much more. The debug and tracing works via the built in compilers for all the soft cores altium delivers.

http://m.youtube.com/watch?v=T9WcjF8h_S8&desktop_uri=%2Fwatch%3Fv%3DT9WcjF8h_S8

Here is afood general get started video :

I couldnt find a video showing the realtimepcb layout color change, but here is a document that explains it :


http://altium.com/files/pdfs/techtip/tip6bringingsoftpcbstolife.pdf

I have some extra Altium dongles (ordering error in purchasing), and I was hoping that I could use them with other JTAG software.  I haven't had any luck finding support in the usual OSS sources.  Do you know of any applications that have a driver for the Altium dongle?  At the moment, I've been able to get OpenOCD compiled with the TI ICDI driver.

I have looked at the schematic for the Altium dongle, it's provided as an example project in Altium Designer, and it's seems to be a pretty simple device based around an ARM micro controller.  If you download the datasheet for the uC, it's pretty easy to find the boot select pins broken out to a set of pads.  From what I understand, I could use an SD card in the installed SD card port and set the pins to boot off of that.  I haven't had the time (and honestly that's getting to be outside of my skills) to do it, but it's been kicking around in the back of my mind for a while...

[free_electron]

altium dongle works with altium only. the firmware in the dongle is theirs.

you can buy the altium dongle from amazon. ( they are an authorized distributor for the dongle and have it in stock. )

[hpux735]

altium dongle works with altium only. the firmware in the dongle is theirs.

I realize that they're not going to open source their firmware, but that's not necessary.  It's possible to reverse-engineer usb protocols.  If that weren't true, there wouldn't be a lot of OSS drivers.

As much as anything, I thing the Altium dongles could be an interesting way to play with LPC ARM devices.  Certainly much cheaper than this: http://www.icetech.com/emularm/lpc2800_board.html

[tinhead]

I have looked at the schematic for the Altium dongle, it's provided as an example project in Altium Designer, and it's seems to be a pretty simple device based around an ARM micro controller. 

there are two versions of the Altium USB JTAG :
- one based on LPC2xxx ARM (http://www.applelogic.org/SRKH/DT01.html)
- one based on FTDI chip (http://www.applelogic.org/SRKH/DT04.html)

For the ARM based version no chance, it does use proprietary crap drivers from a german company.
For the FTDI version you can of course use OpenOCD (or use that Altium Adapter with OpenOCD and other tools that can speak to FTDI).

[ejeffrey]

I realize that they're not going to open source their firmware, but that's not necessary.  It's possible to reverse-engineer usb protocols.  If that weren't true, there wouldn't be a lot of OSS drivers.

I am not sure about this particular device, but normally in these devices the firmware doesn't come with the device.  The Altium software would load the firmware when it connects.  So yeah, you could reverse engineer it, but unless you distribute the copyrighted firmware, you are just reverse engineer a relatively dumb pod.  Which is fine, but then you might as well start with one of the many free / open source "digital interface on a USB cable" projects.  The hard part is getting all the software and device databases.

[hpux735]

I've been playing around with it for a bit, and with my skill level it's essentially a non-starter.  I've found and soldered wires to the mode select bits to allow for USB DFU mode, but I can't seem to get a working DFU uploader for it.

I also soldered a header onto the JTAG port, but I don't have a working JTAG dongle.  I think I'll need to just get a cheap FT2232-based one.  I was able to play around with OpenOCD and I grasp the basics.  NXP sells a version of this chip with the JTAG port disabled, and I haven't been able to verify which version is soldered on the board.

Anyway, it has been fun to play around with it.  If I can get the JTAG port to work, it'll be fun to write some code for it.

[elcomtel]

JTAG Boundary Scan can be a bit confronting for a newbie with all the different software vendors and applications (development and repair), not to mention the plethora of JTAG interfaces.

My experience with JTAG has concerned electronic repair, so I have mainly been concerned with boundary scan tests and to a lesser degree with using JTAG as a serial programing interface or the several incarnations of microprocessor ICE (In Circuit Emulation).

From my personal experience with 'Universal Scan' software (see below) and some research I have done there are three software packages which I have identified that are affordable and would compliment a small business or hobbyist who is concerned with repairing modern digital equipment that uses JTAG technology. Just imagine the futility of trying to probe some BGA 'pins' and you will quickly appreciate the value of JTAG boundary scan in a practical sense.

JTAG SOFTWARE FOR ELECTRONICS REPAIR

Software Option No.1
Universal Scan $850
http://www.ricreations.com/
Comments: Comes with USB 'software security' dongle, but if you have a parrot on your shoulder and a patch over one eye using the appropriate search parameters in Google will reward you with a pirates bounty of pirate solutions. Comes with FLASH memory support.

Software Option No.2
JTAG Test $120
http://www.jtagtest.com/
Comments: Supplied with their own USB JTAG interface (possibly FT2232H derived). Provided with programming information on application API including C++ header files so this opens up development opportunities for those who are this way inclined.

Software Option No.3
TopJTAG Probe $100
http://www.topjtag.com/
Comments: Supports various JTAG interface devices which is a good thing. For an additional $100 you can also buy FLASH memory support.

I have used Universal Scan (No. 1 above) JTAG boundary scan software and I can say that it is everything you need for servicing digital electronics equipment with JTAG. It supports most of the Xilinx JTAG interfaces (Cable III,IV, USB Platform) which compliments someone who works in a Xilinx environment. I will add that the JTAG interface on a Altium 'Nano Board Series I' is a Xilinx IV standard interface so unofficially Universal Scan also worked on the Altium Nano Board.

I think it's important to have an open mind about the various JTAG interfaces out there. Several vendors market 'propriety' JTAG interfaces which happen to be some original JTAG standard used by Xilinx, Altera, etc but are sold as something specifically different. You simply might find more compatibility between the various JTAG interfaces than you thought. Given the existence of the FT2232H device it's highly likely that many of the USB JTAG interfaces might be compatible.

Most JTAG Boundary Scan compliant devices (ICs, components) have had a BSDL (Boundary Scan Definition Library) file that has been created by a manufacturer which will make your life very easy. These BSDL files are easy to find on the internet with the help of Google and various vendors have these BSDL files available on their websites or FTP servers. You must have these files to make any of the listed software work. When you cannot locate a BSDL file you might need to 'borrow' a BSDL file from another similar device and edit it so that you have one. You must have a BSDL file for each JTAG device because none of the listed software will work.

If you are in the business of repairing modern digital equipment that uses JTAG then my advice is that you will be very well served by the software listed above. The beauty of the software above is that it is not restricted to specific vendors such as Xilinx, Altera, Lattice, etc. The software doesn't care about the vendor as long as you can provide a JTAG interface that complies with IEEE Std. 1149.1 and BSDL file for each device.

I have only used the $850 Universal Scan software, but I think there is better value in the $100 offerings. At the end of the day you basically want to input from a pin or output to a pin and all three software solutions will do this.

I cannot emphasize how valuable the training videos are on the following link.
http://www.ricreations.com/JTAG-Software-Downloads.htm
Whilst the videos are for the Universal Scan software, the similarity between the listed three packages is very close that even if you were to decide to buy the $100-$120 solution much of what is discussed is still relevant.

The JTAG software presented is of little value for electronics product development except to verify that your development system is working. It's a must have if you repair any modern digital electronics equipment that has a JTAG interface.

[Richard_Fry]

elcomtel, do you have any experience of the scripting function in Universal Scan?

I've been looking for something that will let me  'walking ones' around connectors and talk to non-boundary scan devices such as DAC / ADCs?
Obviously the big boys XJtag, Jtag.com and (I think) Corelis do this, but they're a lot of money!
Jtaglive does offer this functionality reasonably cheaply, but it's still nearly 3 times the price of Universal Scan.

I know it's this and other add-ons that make the price the big boys charge, but if Universal Scan is acceptably useful - if a little clunky, it's probably ok for me.
I see I can download a demo, so will try that, but first hand experience always useful.

Failing that, I'll start learning C#

[elcomtel]

elcomtel, do you have any experience of the scripting function in Universal Scan?

I've been looking for something that will let me  'walking ones' around connectors and talk to non-boundary scan devices such as DAC / ADCs?
Obviously the big boys XJtag, Jtag.com and (I think) Corelis do this, but they're a lot of money!
Jtaglive does offer this functionality reasonably cheaply, but it's still nearly 3 times the price of Universal Scan.

I know it's this and other add-ons that make the price the big boys charge, but if Universal Scan is acceptably useful - if a little clunky, it's probably ok for me.
I see I can download a demo, so will try that, but first hand experience always useful.

Failing that, I'll start learning C#

Richard, my apologies for taking so long to reply. I have simply been too busy with life. 

To answer your question, no I haven't used the scripting language with Universal Scan because I simply had no need for it. I appreciate your need for the 'walking ones', but I can say that from memory (last time I used Universal Scan was 1.5 years ago) Universal Scan has a 'toggle' feature for each pin that lets you toggle (clock) the output and observe the response.

[Richard_Fry]

I have simply been too busy with life. 

Hey, no worries...I know what you mean.  I've just moved to Australia and currently looking for work etc., so time on forums is sporadic at best.

[Hooch]

Another excellent FF video.
I'm just learning about it right now. Your video explained a lot.
Thanks Dave!