To virtually disconnect the core logic from the pins special boundary scan cells are inserted. These are connected in series as so call boundary scan register (BSR). The JTAG controller (TAP: test access port) connects this BSR (among others) between TDI and TDO.
 |
| Boundary Scan Register and other data registers (DR) between TDI and TDO |
Which scan chain is connected between TDI and TDO (i.e. used as data register, DR) is set by going through the JTAG state machine and shifting the according instruction into the instruction register (IR).
 |
| JTAG State Machine |
Later JTAG was extended for production test of the semiconductor interiors to check that all internal gates, transistors and connections are proper (DFT: design for test). All D-FF of the logic design are connected in series to so called scan chains. A test pattern is shifted in so that all flip-flop's outputs are set to a certain pattern. The combinational logic between these outputs and the inputs of other flip-flops will create a resulting pattern only depending on the hardwired logic functions and the pattern. This is then sampled and shifted out. Utilizing a (hopefully small) set of test patterns allows to test for (nearly) all possible production faults and sort out a chip as defective. Memories inside a chip also have to be tested after production which is accomplished by a built-in self test module which automatically fills and verifires the memory with a predefined set of patterns.
These two use cases of JTAG are used during production. Therefore only few people know about it.
Most widely known is JTAG as a debugging interface to microprocessors and microcontrollers. Special logic is activated and can be used to access CPU registers, memory, peripherals, set breakpoints and do other debugging related activities. Unfortunately each vendor invented his own "higher level" protocol, so they are not compatible. Even worse, most vendors keep the protocol description secret, so you have to buy a JTAG adapter from a small set of companies which were allowed to read the specifications.
 |
| JTAG Connector at the bottom left |
But did you ever wonder how this JTAG logic is getting into the semiconductor? Anybody hacking the TAP (test access port) with its state machine and signal connections in VHDL? Creating boundary scan cells for all chip IOs? For sure some will do so. But the good news is: All this can be generated automatically. Some ASIC tool vendors integrate the functionality into the synthesis tool (e.g. Synopsys Design Compiler) or offer stand alone tools to generate VHDL RTL code for the whole JTAG and boundary scan logic (e.g. Mentor BSDArchitect).
For a test chip to demonstrate the concepts developed for my PhD thesis I've successfully used Mentor BSDArchitect. It uses a VHDL entity of the core logic top level design, a pin definition file and a script file as input. It automatically generates VHDL files with RTL code of the tailored JTAG TAP, boundary scan cells and all connections as well as test benches. The RTL code wraps the core logic top level design and is used for synthesis as usual. The chip (produced in a 130nm CMOS 6 layer Cu plus 1 layer Al process) works perfectly. BSDArchitect allows to define custom scan chains which I've used as interface to download the configuration bit stream to the reconfigurable logic.
Another tool is Synopsys BSD Compiler which is integrated in the Design Compiler synthesis tool. With a few (more or less intuitive) commands you can setup the boundary scan chain, add custom scan chains, define the JTAG IDCODE, ... The tool will then automatically generate the logic for the JTAG TAP and all boundary scan cells. AFAIK it does not create RTL code but just a simulation testbench. I'll use this tool for the Invent a Chip ASIC. More discoveries to follow.
