SVF Interpreter for VHDL Testbench

Digital chips often contain a JTAG port, which is used to implemente boundary scan and to access internal functionality of the chip, like programming and debugging.

One widespread "standard" to specify JTAG operations is SVF (Serial Vector Format). Many tools can generate SVF files which are then used to operate the JTAG signals of a chip, e.g. with Lib(X)SVF.

As everything in chip design, the JTAG functionality also has to be verified during development. At this time, all modules as well as the whole chip are simulated. vhdl-svf provides an SVF interpreter, written in pure VHDL, which reads a SVF file and exercises the JTAG signals. It is inteded to be integrated in a testbench to verify the chip design.

MSP430 LaunchPad with Debian

The TI MSP430 are ultra-low-power 16-bit RISC microcontrollers. Since a while, TI sells eval kits called "LaunchPad" for $ 4.30 for their "value line" (i.e. cheap) MSP430 products. These have a debugging and programming interface (USB).

To use the LaunchPad with Debian GNU/Linux (sid, as of 2012-10-04), some packages have to be installed

aptitude install gcc-msp430 gdb-msp430 \
  msp430-libc msp430mcu mspdebug binutils-msp430

Debugging

mspdebug supports the LaunchPad for programming and debugging using its rf2500 driver (which is also used for the eZ430-RF2500 and Chronos watch). It is started with

mspdebug rf2500

This program offers a powerful command line interface for memory dump, programming and debugging. It also has a GDB remote stub, so you can debug your programs with GDB. Connecting via the debugger stops the currently running program (presumably the preloaded demo program). To continue execution, type

run

and press ^C to stop again. This will show the current register values and a short disassembly.

(mspdebug) run
Running. Press Ctrl+C to interrupt...
^C
    ( PC: 0fc86)  ( R4: 00282)  ( R8: 0ab57)  (R12: 00000)  
    ( SP: 0027a)  ( R5: 05a08)  ( R9: 0fb5b)  (R13: 0fd90)  
    ( SR: 000dd)  ( R6: 0adff)  (R10: 0aee2)  (R14: 00000)  
    ( R3: 00000)  ( R7: 0fa3f)  (R11: 0bf73)  (R15: 0ffff)  
0xfc86:
    0fc86: 30 41                     RET     
    0fc88: f2 40 0a 00 00 02         MOV.B   #0x000a, &0x0200
    0fc8e: 03 3c                     JMP     0xfc96
    0fc90: 92 42 70 01 72 01         MOV     &0x0170, &0x0172

You can switch on beautifully colorized output:

opt color true

My LaunchPad came with a MSP430G2231. It seems that newer LaunchPads come with a different device. Features of the MSP430G2231:

• 1.8-3.6V
• 16MHz
• 2kB Flash, 128B RAM
• 10-Bit ADC, 8 IOs, WDT, Timer, USI (SPI, I2C)

Memory map:

• F800h-FFFFh: Flash, 4 segments of 512 bytes
• 1000h-10FFh: Information Memory, 4 segments of 64 bytes, stores calibration values!
• 0200h-027Fh: RAM
• 0000h-01FFh: SFR, Peripherals
• FFC0h-FFFFh: Interrupt Vectors, Reset = FFFEh

The LaunchPad has a red LED (connected to P1.0) and a green LED (P1.6) and a button (P1.3).

After reset, the 16-bit value at FFFEh is read. This is used as initial value of the PC register to start execution. Let's examine the boot process!

(mspdebug) md 0xFFFE 2
    0fffe: c2 fc                                           |..              |
(mspdebug) dis 0xFCC2
0xfcc2:
    0fcc2: 31 40 7e 02               MOV     #0x027e, SP
    0fcc6: b2 40 6e fd 36 02         MOV     #0xfd6e, &0x0236
    0fccc: b2 40 6e fd 38 02         MOV     #0xfd6e, &0x0238
    0fcd2: b0 12 66 fd               CALL    #0xfd66
    0fcd6: 0c 93                     TST     R12
    0fcd8: 02 24                     JZ      0xfcde
    0fcda: b0 12 8e fb               CALL    #0xfb8e
    0fcde: 0c 43                     CLR     R12
    0fce0: b0 12 00 f8               CALL    #0xf800
    ...

Before our own program is programmed, we should save the Flash memory content. The following command will save 2048 bytes, starting at F800h, to the Intel HEX file MSP-EXP430G2-2231.ihx.

hexout 0xF800 2048 MSP-EXP430G2-2231.ihx

During playing, I had an accident, inadvertently typing "mw 0xFFFE 2" instead of "md 0xFFFE 2" which overwrites the value C2h at FFFEh with 02h. It was not possible to correct this with "mw 0xFFFE 0xC2" because the Flash is initialized to all logic 1s and can be set bit-wise to 0. Writing the memory to an Intel HEX file, correcting the value at FFFEh to C2h (and correcting the checksum), and reprogramming the device with "prog MSP-EXP430G2-2231.ihx" restored the old contents. BTW: The "prog" command complained for the invalid checksum and also said which value it expected. So no hand calculation of the value was necessary. :-)

Compiling

As first example program, let's use the blinking LED proposed by TI at http://processors.wiki.ti.com/index.php/Blink_your_first_LED (you have to scroll down a bit). Copy-paste the example program to a file called blink.c and change the included .h-file to the device you own. Then compile using

msp430-gcc -mmcu=msp430g2231 -o blink.elf blink.c

The result can be examined (and disassembled) using

msp430-objdump -d blink.elf

Back in the mspdebug commmand line, program the new firmware to the MCU and start it:

prog blink.elf
run

Nice blinking should be visible.

MSP430 FRAM Devices

The MSP-EXP430FR5739 Experimenter Board with an MSP430 FRAM MCU can also be programmed. It comes with an MSP430FR5739 soldered to the board. Its features are

• 2-3.6V
• 24MHz
• 16kB FRAM, 1kB SRAM
• 10-BIT ADC, 32 IOs, Comparator, Timer, USCI (UART, IrDA, SPI, I2C)

The memory map is as follows:

• C200h-FFFFh: FRAM
• 1C00h-1FFFh: RAM
• 1A00h-1A7Fh: Device Descriptor Info (FRAM)
• 1800h-19FFh: Information memory (partly mirrored, FRAM)
• 1000h-17FFh: Bootstrap loader (ROM)
• 0000h-0FFFh: SFRs, Peripherals
• FF80h-FFFFh: Interrupt Vectors, Reset = FFFEh

The MSP-EXP430FR5739 Experimenter Board is a bit more expensive than the LaunchPad (but has a similar form factor). It comes with 8 blue LEDs (everything needs blue LEDs!), an accelerometer, an NTC, two buttons, ... These are connected as follows:

• LED0..3: PJ.0 .. PJ.3
• LED4..8: P3.4 .. P3.7
• S1: P4.0
• S2: P4.1
• Accel X: P3.0/A12
• Accel Y: P3.1/A13

Simple alternate blink program

#include  <msp430fr5739.h>

unsigned int i = 0;

void main(void) {
  // Stop watchdog timer.
  WDTCTL = WDTPW + WDTHOLD;

  // enable PJ.0 and PJ.1 as outputs
  PJDIR |= 0x01 | 0x02;
  // switch on first LED and switch off second LED
  PJOUT = (PJOUT & ~(0x01 | 0x02)) | 0x01;

  // main loop
  for (;;) {
    // toggle LEDs
    PJOUT ^= 0x01 | 0x02;
    // delay
    for(i=0; i< 20000; i++);
  }
}

Save this to a file blink-fram.c and compile with

msp430-gcc -mmcu=msp430fr5739 -o blink-fram.elf blink-fram.c

Important: To download, the mspdebug command "prog" cannot be used, because it issues a Flash erase command. The FRAM devices don't need an erase, because it can be written like normal RAM. Therefore program the device with the "load" command. But first, the FRAM contents should be backuped:

hexout 0xC200 0x3E00 MSP-EXP430FR5739-Demo.ihx
load blink-fram.elf
run

And again, nice blue blinking should be visible

This was only a very coarse run through the tools, but the usage is really astonishing simple, yet powerful. More to come (GDB, Makefile, Eclipse, ...)

NXP LPC11U14 and the LPCXpresso Board

The NXP LPC11xx series microcontrollers include an ARM Cortex-M0 CPU with SRAM, Flash and numerous peripherals. The low-cost LPCXpresso development board offers a debug adapter (JTAG, more precisely SWD) via USB. This is used with the Eclipse-based LPCXpresso IDE. Fortunately NXP offers it for Linux users too, even including the drivers for the debug connection.

After rapt contemplation I concluded, that most, if not all, of my ideas for nice projects require the connection to a PC. I prefer USB, so the LPC11Uxx microcontrollers including a USB 1.1 (12 MBit) device core come in handy.

NXP really tries to establish a community around their microcontrollers with forums and near-open-source software. The ARM Cortex-M0 MCUs are positioned as 8-bit and 16-bit MCU replacement. Therefore they have quite small packages (QFN33, LQFP48). The LPC1102 is sold in a WLCSP-16 package of which I've posted microscope images some time ago.

The low-cost LPCXpresso boards come without pin headers. I've added sockets, because its easier to connect wires to them.

One feature of these boards is that they can be used as debug adapter for custom boards. The connections from the debug adapter part to the device part of the board are layed out to holes for a 8x2 pin head with 100mil pitch. When delivered, the connection is made with small solder dots which can be removed using desoldering braid. I've added the pin head and put 8 jumpers on it to re-connect the on-board microcontroller.

One massive drawback of these microcontrollers is their extremley slow Flash memory. This gets even worse because it is (nearly) kept secret. The datasheet as well as the web page praise the fast operating frequency of 50 MHz. You have to dig deeply into the user manual to find a third-level section called "Flash memory access" describing a register called "Flash configuration register". Only the specific description of the two bits "Flash memory access time" reveals that wait-states (this word is avoided too) are required at higher frequencies. The maximum flash frequency is 20 MHz, so at the praised 50 MHz CPU frequency only every third cycle is an active one, effectively dividing the performance by three! Only the timers and other peripherals can utilize the higher clock frequency.

While ranting, nearly all ARM microcontrollers have slow flash and nearly all companies try to obscure that fact. Some microcontrollers try to speed up things using some kind of cache, others put loads of (fast) SRAM for code storage. It is still disappointing to be mucked around.

Control and communicate with a Cypress EZ-USB

When developing a device with the Cypress EZ-USB AN2131 microcontroller, eztool might come in handy. It is a command line tool to control and to communicate with these microcontrollers via USB. It can also communicate to any USB device in a custom user mode.

eztool offers a convenient command line interface. It uses Tcl as scripting language and command interpreter. Actually, every command you enter is implemented as a Tcl command (but written in Pascal and compiled in the executable). The Tcl programming language offers unlimited options to use, customize and automate eztool.

eztool prints a prompt at the screen which signals the current mode. To wait for the user input, GNU Readline is used. This offers comforable command line editing, history and auto-completion.

For each Tcl command and variable a dedicated manual page is provided.

Please find the source code at https://github.com/hansiglaser/eztool. It uses the Pascal OOP wrappers for GNU Readline, Tcl and LibUSB. Its device firmware is based on the EZ-USB firmware template.

JTAG

The JTAG port of chips (signals TMS, TCK, TDI, TDO) was introduced for production tests of PCBs to  check that all connections to other chips are soldered and no shorts occur (so called boundary scan). The pins of the chip can be virtually disconnected from the core logic and their output signals remote controlled and input signals queried. This is used to set signal values and query from other chips.

To virtually disconnect the core logic from the pins special boundary scan cells are inserted. These are connected in series as so call boundary scan register (BSR). The JTAG controller (TAP: test access port) connects this BSR (among others) between TDI and TDO.

Boundary Scan Register and other data registers (DR) between TDI and TDO

Which scan chain is connected between TDI and TDO (i.e. used as data register, DR) is set by going through the JTAG state machine and shifting the according instruction into the instruction register (IR).

JTAG State Machine

Later JTAG was extended for production test of the semiconductor interiors to check that all internal gates, transistors and connections are proper (DFT: design for test). All D-FF of the logic design are connected in series to so called scan chains. A test pattern is shifted in so that all flip-flop's outputs are set to a certain pattern. The combinational logic between these outputs and the inputs of other flip-flops will create a resulting pattern only depending on the hardwired logic functions and the pattern. This is then sampled and shifted out. Utilizing a (hopefully small) set of test patterns allows to test for (nearly) all possible production faults and sort out a chip as defective. Memories inside a chip also have to be tested after production which is accomplished by a built-in self test module which automatically fills and verifires the memory with a predefined set of patterns.

These two use cases of JTAG are used during production. Therefore only few people know about it.

Most widely known is JTAG as a debugging interface to microprocessors and microcontrollers. Special logic is activated and can be used to access CPU registers, memory, peripherals, set breakpoints and do other debugging related activities. Unfortunately each vendor invented his own "higher level" protocol, so they are not compatible. Even worse, most vendors keep the protocol description secret, so you have to buy a JTAG adapter from a small set of companies which were allowed to read the specifications.

JTAG Connector at the bottom left

But did you ever wonder how this JTAG logic is getting into the semiconductor? Anybody hacking the TAP (test access port) with its state machine and signal connections in VHDL? Creating boundary scan cells for all chip IOs? For sure some will do so. But the good news is: All this can be generated automatically. Some ASIC tool vendors integrate the functionality into the synthesis tool (e.g. Synopsys Design Compiler) or offer stand alone tools to generate VHDL RTL code for the whole JTAG and boundary scan logic (e.g. Mentor BSDArchitect).

For a test chip to demonstrate the concepts developed for my PhD thesis I've successfully used Mentor BSDArchitect. It uses a VHDL entity of the core logic top level design, a pin definition file and a script file as input. It automatically generates VHDL files with RTL code of the tailored JTAG TAP, boundary scan cells and all connections as well as test benches. The RTL code wraps the core logic top level design and is used for synthesis as usual. The chip (produced in a 130nm CMOS 6 layer Cu plus 1 layer Al process) works perfectly. BSDArchitect allows to define custom scan chains which I've used as interface to download the configuration bit stream to the reconfigurable logic.

Another tool is Synopsys BSD Compiler which is integrated in the Design Compiler synthesis tool. With a few (more or less intuitive) commands you can setup the boundary scan chain, add custom scan chains, define the JTAG IDCODE, ... The tool will then automatically generate the logic for the JTAG TAP and all boundary scan cells. AFAIK it does not create RTL code but just a simulation testbench. I'll use this tool for the Invent a Chip ASIC. More discoveries to follow.

LPC1102 WL-CSP Images

NXP (former Philips Semiconductor) sent a sample of a LPC1102 ARM Cortex-M0 microcontroller in a tiny 16-pin WL-CSP (wafer-level chip-scale-package). This means that the package has the size of the chip die, or the pure die is used directly. The die is only 2.2x2.3mm with a ball pitch of 0.5mm. At the top of the die solder bumps similiar to a BGA package are used to connect the chip to a PCB.

The first image shows the whole chip (tightly fitting in the microscope's view at a magnification of 2x). The 16 balls are easily visible. At the border of the chip all pads are placed. Only a few of them are connected to the balls via the signal redistribution layer. On some unconnected pads there are scratches from the wafer prober needles during final product test.

At a magnification of 5x the connections of the redistribution layer to the chip pads reveal a nice pit.

At the top right corner a chip label shows that it really is a LPC111XL with just some peripherals not connected to the outer world. It is not sure whether NXP uses fully functional dies and just doesn't tell anybody, or if the product test revealed that these unused peripherals don't work. The latter case is clever, because they can sell chips which would otherwise be rejects.

An even close look at a magnification of 20x shows one wire of the redistribution layer and the underlying semiconductor layers. The following images have three different focus settings. Watch the sharp spots.

       

There are a lot more colorful places on the chip. These complicated and irregular parts usually are analog peripherals. These are hand crafted by design engineers.

At 50x magnification it is really tedious to find a focus plane. The following images are details of the previous two.

The digital parts are implemented with standard cell libraries of logic gates (AND, OR, D-FF, ...). Automatic tools optimize the placement and routing to connect them. The following image shows a detail of logic structures. In the mostly green area many horizontal connections between the cells are visible. Below these (yellowish) vertical connections are visible. These wires completely cover the actual logic cells below them. At some places filler structures are inserted to avoid areas of too inhomogeneous metal distribution. The two vertical lines at the left might be power distribution at the chip.

Many more images with varying magnifications and focus depths are available in the album.