Bitbang JTAG from standalone microcontroller IO

[steaky1212]

Hi,

I'm in the process of designing a test rig, and wanted to get 100% test coverage.
The test rig acts as a GO/NOGO for the unit under test, and has a load of IO to verify UUT operation.

I've gone as far as functional test on what the unit is supposed to do, but I've only checked that the interfaces work in isolation, not that they dont interfere with neighbouring IO - hence the need to use the JTAG interface for a boundary scan.

The device in question is an XPLA3 Xilinx Coolrunner, and I wanted to go through the process of setting a pin high and making sure that neighbouring pins didnt go high too. I have limited experience driving JTAG (using urJTAG), and was wondering if anyone had implemented something similar.

I've tried having a look through the urJTAG source to see how they drive various parallel port JTAG interfaces, but come up empty. I've got a copy of the JTAG state machine, but I'm missing the link between that, and how to actually manipulate pins.

Can anyone help, or point me in the right direction?

Thanks,

Steaky

Just to clarify, the hardware already exists, and I only have 4 IO from a large microcontroller to drive the CPLD JTAG port in Boundary Scan mode

[abyrvalg]

Hi,

In a few words: jtag pins give you an access to two registers, IR (instruction) and DR (data, a set of registers actually, value in IR selects particular register to access). With SAMPLE instruction in IR you can read state of all pins from DR (one very long register with bit count ~ 3x pin count will be seen). Read this sampled value, then flip bits for pins you want to control, set EXTEST instruction into IR, write that prepared value into DR - pins will change. Now just use SAMPLE again to see the results.

More details: find a BSDL file for your particular device. It will look like this http://bsdl.info/view.htm?sid=907f2d83182655ef88ca59b002289d77
A section beginning with "attribute INSTRUCTION_OPCODE" contains IR instruction values (i.e. EXTEST is 00000, SAMPLE is 00010)
"attribute BOUNDARY_LENGTH" is length of DR for sample/extest in bits (yes, huge 740 bits there)
"attribute BOUNDARY_REGISTER" section contains description of every bit of DR for sample/extest:
- bit position
- cell type (ignore it)
- port name (translate to real pin number using attribute PIN_MAP)
- cell function (single physical pin usually has 3 associated cells - an INPUT cell to read pin value, an OUTPUT cell to set pin value and an INTERNAL or CoNTROL type cell to control output enable)
- safe value (ignore it)
- control cell number (bit position of corresponding output enable cell for this output cell)
- control cell value that disables this output
- output value in disabled state

Example:
     " 738   (BC_1, IO_0,       INPUT,    X)," &
     " 737   (BC_1, IO_0,       OUTPUT3,  X,     736,     0,Z),"&
     " 736   (BC_1,  *,     CONTROL,  0)," &
- these 3 cells are for pin E18 (from PIN_MAP attribute IO_0:E18), bit 738 is used to read pin state (in SAMPLE state), bit 737 holds an output value, to activate output we need to write 1 (inverted disval) to cell 736, which is, surprise, of type CONTROL

[abyrvalg]

A simple JTAG boundary scan example. It is written for PC, driving jtag signals on a remote board, but this can be adapted to MCU easily - just add your own dio_in(), dio_out() functions to access GPIOs and remove printf/puts console output. IR len, DR len, EXTEST value must be adjusted for your target device also.
This example reads the boundary scan register in a loop, detecting and showing changes (used to reverse engineer board traces - touch a trace with grounded needle and watch for a pin change). It doesn't uses SAMPLE instruction, but EXTEST only (some cell types BC_xx allow both reading and writing in EXTEST state, but in general you should use separate SAMPLE instruction for read)