EEVblog #499 - What is JTAG and Boundary Scan? - Page 1
Forum section: electronics / general

author: EEVblog
author_rank: Unknown
timestamp: July 27, 2013, 12:00:57 am
content: What is the JTAG interface and Boundary Scanning, how does it work, and what is it useful for?

author: babi
author_rank: Contributor
timestamp: July 27, 2013, 12:23:48 am
content: As always, thank you Dave.Has anyone tried to configure a Xilinx chip using an embedded microcontroller (even SVF or XSVF player)? That would be an interesting subject.There are some libraries out there based on xapp058 App Note, but I wonder which of them is better to get started with.I also wanted to know if it is better to use an FT2232 in conjunction with an application on the PC in order to configure FPGA/CPLD chips instead of using a microcontroller.Thanks.

author: ivan747
author_rank: Super Contributor
timestamp: July 27, 2013, 12:27:13 am
content: The problem with that is that the PC will have to essentially bit bang the whole JTAG protocol. The good side is that it can be reconfigured by software very easily.

author: mikeselectricstuff
author_rank: Super Contributor
timestamp: July 27, 2013, 12:44:56 am
content: Quote from: babi on July 27, 2013, 12:23:48 amMost FPGAs have simpler configuration options than JTAG for use with microcontrollers, so you'd normally use that rather then JTAG.Not sure what Xilinx offer, but Lattice supply some nice code for JTAG device programming (CPLDs and FPGAS) from microcontollers, which is very easy to integrate, and can program from a file from your filesystem (SD etc) , or from a CONST data array, auto-generated by their ISPVM programmer software from the device JEDEC file..

author: robrenz
author_rank: Super Contributor
timestamp: July 27, 2013, 12:54:57 am
content: Very informative Dave, excellent

author: babi
author_rank: Contributor
timestamp: July 27, 2013, 12:58:41 am
content: Quote from: mikeselectricstuff on July 27, 2013, 12:44:56 amThanks Mike.So, you say that using a microcontroller to program an FPGA/CPLD is better than bit banging the configuration file directly to the chip from the PC?Yeah, I know that there are better ways to configure modern FPGAs, but I want to use JTAG to program low-cost Xilinx chips.Xilinx also offers a code library for configuring their chips using JTAG, but I didn't find it easy to start with.

author: mikeselectricstuff
author_rank: Super Contributor
timestamp: July 27, 2013, 01:34:24 am
content: Bit-banging anything from a PC is going to be slow, and impossible when USB is the only IO available.Use a proper JTAG inteface - either one with an MCU, or the FTDI solution which handles the low-level protocol in hardware.I was referring to embedded systems where a MCU needs to update CPLD/FPGA code in the field.

author: mikeselectricstuff
author_rank: Super Contributor
timestamp: July 27, 2013, 01:39:32 am
content: JTAG reverse engineering video :

author: Smokey
author_rank: Super Contributor
timestamp: July 27, 2013, 01:52:19 am
content: I remember you opening up a dangerous prototypes Bus Blaster in a mail bag a while back. That would be a good open source hobbyist alternative to the pro tools.http://dangerousprototypes.com/docs/Bus_Blaster

author: free_electron
author_rank: Super Contributor
timestamp: July 27, 2013, 01:59:27 am
content: its not necessary to go through all pins. jtag has a number of commands. there are general commands and device specific commands.in a chain, after powerup, you would first send the command to identify how many devices are on the bus. (basically you send in a single logic 1 and clock. count the number of clockticks before the one comes back out. that the number of devices. then send the identify command. each device will send out manufacturer and part number.then you can tell individual devices to temporarily go in 'bypass'. meaning they pull their chain out of the loop and short their tdi and tdo together. that is how you speed up since you don't need to race through those shifters.there are even ttl chips with jtag. there is an equivalent of a 74245 with 4 jtag pins. this allows you to inject such a device in a critical pathway on a complex board and ease testing.or , using a little adapter board, temporarily remove the 74245 and pop the jtag version in. hook up the jtag dongle to the little adapter board and bob's your uncle.74bct8245 is such a part. there is a whole family of emhttp://www.ti.com/lsds/ti/logic/boundary-scan-jtag-logic-products.pagenow, before you get all excited and think about building your own superduper jtag tool : most of the information pertaining to guts of the devices are secret. some manufacturer specify some of the codes (the comon ones as mandated by the standard,but some of the advanced stuff is under NDA ...therefore the JTAG probes with that fancy software that dave showed cost $$$

author: cthree
author_rank: Frequent Contributor
timestamp: July 27, 2013, 02:17:18 am
content: Another excellent FF video. Thanks Dave!

author: chicken
author_rank: Frequent Contributor
timestamp: July 27, 2013, 02:27:02 am
content: Great video!Is there an OSS/free equivalent to the XJAnalyser software for use with Bus Blaster or similar tools? Definitely looks like a useful tool for reverse engineer and hw hacking.

author: free_electron
author_rank: Super Contributor
timestamp: July 27, 2013, 02:45:11 am
content: Quote from: chicken on July 27, 2013, 02:27:02 amlimited, yes. like i said : the real algorithms are only made available to select partners under NDA.

author: FrankT
author_rank: Regular Contributor
timestamp: July 27, 2013, 03:13:00 am
content: How does the XJTAG tool compare to the jtag tools offered by, say, Atmel for programming and debugging their own chips?Can XJTAG be used instead of the atmel tools? On my todo list is to get an ARM dev board and play with that - will any JTAG tool allow me to program the ARM?Frank

author: xrunner
author_rank: Super Contributor
timestamp: July 27, 2013, 03:14:28 am
content: Quote from: cthree on July 27, 2013, 02:17:18 amSeconded, never heard of it until now, but fascinating stuff.

author: babi
author_rank: Contributor
timestamp: July 27, 2013, 06:22:17 am
content: Quote from: FrankT on July 27, 2013, 03:13:00 amYes, there are a couple of JTAG Programmer/Debugger tools for ARM processors. You can use XJTAG for that purpose in ARM RealView, but you know, XJTAG is quite expensive.You can use J-Link Programmer and Debugger for ARM processors. It is easy to use and much cheaper than the XJTAG.

author: EEVblog
author_rank: Unknown
timestamp: July 27, 2013, 07:42:53 am
content: Quote from: free_electron on July 27, 2013, 02:45:11 amAltium Designer has this ability to live view the boundary scan data and map to images of the chip and pins (via the USB JTAG adapter), even funkier than the XJTAG software if you are the PCB designer (no capability for production test system etc). I don't recall it having any of that additional secret squirrel capability though.

author: EEVblog
author_rank: Unknown
timestamp: July 27, 2013, 07:44:04 am
content: Quote from: FrankT on July 27, 2013, 03:13:00 amIn theory, yes. In practice, the software has to support the device on question.

author: tinhead
author_rank: Super Contributor
timestamp: July 27, 2013, 08:44:01 am
content: other good boundary scan programms:Universal Scan -http://www.universalscan.com/TopJTAG -http://www.topjtag.com/The TOPJtag is already good enought for most things, it is as well cheaper than UniversalScan.UniversalScan have excellent videos as well, easy to understand how to use that app.Both can use tons of other/known JTAG cables, no need to buy special one from Boundary Scan tool manufacturer.Their software is comparable to XJAnalyser, where (in my opinion) UniversalScan is a bit better than TopJTAG.

author: daqq
author_rank: Super Contributor
timestamp: July 27, 2013, 09:48:49 am
content: Thanks Dave, that was a very useful video.Another fun usage of JTAG reverse engineering I've seen was here:http://nsa.unaligned.org/jrev.phpWhere he reverse engineered the schematic (or rather some of it) for a whole really big board.

author: RoadRunner
author_rank: Frequent Contributor
timestamp: July 27, 2013, 11:17:18 am
content: i am a bit confused about the hardware & the software for JTAG.there are a number of different devices, like pic32 ,xilinx FPGA, Altera FPGA and ARM processor they all have JTAG . i know they we can access them by a same jtag cable but.what i am wondering if FT2232 based JTAG hardware will work for all of them ?is there software or hardware tool available for hobby use like with limited functionality.

author: lewis
author_rank: Frequent Contributor
timestamp: July 27, 2013, 11:40:21 am
content: Excellent video Dave!Found a quick pricelist for the XJTAG thing - have a look at this:http://www.anacom.com.br/downloads/pdf/XJTAG-USPL-Q1-2011.pdf

author: RJdaMoD
author_rank: Contributor
timestamp: July 27, 2013, 12:52:35 pm
content: Quote from: Gaurav on July 27, 2013, 11:17:18 amHi, look for urjtag. Although it is cmdline-tool (that might limit its functionality for some, but it's open source, so you can write your own gui if you want one) it should be sufficient for the hobbyist.

author: Ericho
author_rank: Regular Contributor
timestamp: July 27, 2013, 01:45:17 pm
content: Excellent video Davethanks

author: RoadRunner
author_rank: Frequent Contributor
timestamp: July 27, 2013, 01:47:39 pm
content: Quote from: RJdaMoD on July 27, 2013, 12:52:35 pmThank you

author: KedasProbe
author_rank: Frequent Contributor
timestamp: July 27, 2013, 03:07:28 pm
content: Also belongs in this thread:SWD/SWVhttp://support.code-red-tech.com/CodeRedWiki/HardwareDebugConnectionshttp://www.arm.com/products/system-ip/debug-trace/coresight-soc-components/serial-wire-debug.php

author: free_electron
author_rank: Super Contributor
timestamp: July 27, 2013, 03:31:28 pm
content: The base scanning functionality is well documented. If a device has 40 pins the scanchain is 40 bits long. It doesnt matter there are power or ground pins. Its one bit per pin, irrespective of its functionality.This is part of the common command set.Altium has a jtag dongle that can be used during fpga or board design. You can actually open the pcb layou and it colors the pins of the ic packages (the pads and attached traces) in function of the logic voltage. If you have a button tied to an input and you press it you see the pcb layout change color in realtime (as fast as the jtag can scan...)If you have an led connected to an output you can click on a pad and say 'make it high (or low) and the led will react.I jave debugged boards like that.Altium has had that capability since it was DXP 2002 i believe...The altium dongles is like 150$ and has two jtag ports. One is used for your board hardware, the other one can be used to debug and i teract with the soft processors you cram in an fpga.Here is a really cool video of altium doing that.: it identifies all devices in the scanchain, flashes the fpga through the hardware jtag and then boots the cpu. They emulate a serial port via the software jtag so you can directly talk to the running code ,put breakpoints, trace it and much more. The debug and tracing works via the built in compilers for all the soft cores altium delivers.http://m.youtube.com/watch?v=T9WcjF8h_S8&desktop_uri=%2Fwatch%3Fv%3DT9WcjF8h_S8Here is afood general get started video :I couldnt find a video showing the realtimepcb layout color change, but here is a document that explains it :http://altium.com/files/pdfs/techtip/tip6bringingsoftpcbstolife.pdf

author: xrunner
author_rank: Super Contributor
timestamp: July 27, 2013, 11:15:54 pm
content: Sorry if I missed the answer to this - but the software that was demoed could show pins toggling. My question is how does it determine toggling? Of course I know what toggling means, but that also implies a freq. If it toggles every 10 minutes it wouldn't catch it right? So is it a matter of it (the software) justhappeningto catch a state change when it captures a pin state or is there more to it like {stop and see if pin x is toggling for y microseconds}?

author: andersm
author_rank: Super Contributor
timestamp: July 28, 2013, 01:35:52 am
content: Quote from: KedasProbe on July 27, 2013, 03:07:28 pmWhile the ARM debug port specifications allow for it, I don't think any of the Cortex-M cores support boundary scan over SWD, only debug and trace.

author: all_repair
author_rank: Frequent Contributor
timestamp: July 28, 2013, 03:17:26 am
content: It can be made much more useful if the JTAG fuse is not blown.Now if a JTAG device is burnt, the whole device or equipment has to be thrown away.

author: Unknown
author_rank: Unknown
timestamp: July 28, 2013, 08:12:26 am
content: So. do i understand it right?To be able to hack into the enemy electronics i don't need a decent hardware since JTAG is pretty simple and uniform, but i would need a decent software that would recognize almost every hardware and be able to decode it?Many people are talking about bus blaster v2/v4 , would it do the job?

author: iva
author_rank: Contributor
timestamp: July 28, 2013, 09:32:07 am
content: Quote from: Citizen on July 28, 2013, 08:12:26 amWell, having "JTAG" doesn't automatically imply you can use it for every chip on the board, there are several ways to disable or make it very difficult on the manufacturer side, probably this was missing in the video.In any case very nice one Dave! I wonder if you have enough material for a part II.And you were spot on, most of the people working with JTAG know programmers and debuggers but have no clue about the origin and other possibilities given by the interface.

author: amyk
author_rank: Super Contributor
timestamp: July 28, 2013, 11:09:32 am
content: Quote from: xrunner on July 27, 2013, 11:15:54 pmQuote from: free_electron on July 27, 2013, 03:31:28 pmSo yes, if the pin happens to toggle a few times between scans and returns to the same state, it won't catch it, just like a DSO aliasing.

author: FrankBuss
author_rank: Unknown
timestamp: July 28, 2013, 11:26:43 am
content: Another nice solution for JTAG programming is FPGALink:http://www.makestuff.eu/wordpress/software/fpgalink/Can be used with a range of microcontrollers, from small Atmel ones with Full Speed USB to high speed FX2 Cypress devices and provides a generic communication channel from your PC application to your FPGA, too. The author is very helpful, has fixed the SVF parser so that it worked with my Lattice parts. Currently I'm porting the microcontroller firmware part to LPC NXP chips, with thehttp://microbuilder.euframework (I don't like LPCOpen, too bloated and difficult to use from Eclipse instead of just plain old Makefiles).

author: amd
author_rank: Contributor
timestamp: July 29, 2013, 09:31:56 pm
content: Quote from: free_electron on July 27, 2013, 03:31:28 pmDo you know where to get the dongle from? I live in Austria and distributors like Farnell and RS say that it is no longer manufactured. Don't know where else to get it from.I have the situation that I would need to connect two JTAG devices (not in a chain) and debug them simultanously. Since the adapter would have two ports this should be possible, is that correct?Could I also use the Nanoboard from Altium instead?Dave didn't mention SWD. I also have one ARM chip that only supports SWD and no JTAG. Is there any way to use the JTAG adapter to debug a device connected with SWD? I think it is the same protocol and just another hardware interface, or am I wrong?

author: hpux735
author_rank: Contributor
timestamp: July 29, 2013, 09:32:59 pm
content: Quote from: free_electron on July 27, 2013, 03:31:28 pmI have some extra Altium dongles (ordering error in purchasing), and I was hoping that I could use them with other JTAG software. I haven't had any luck finding support in the usual OSS sources. Do you know of any applications that have a driver for the Altium dongle? At the moment, I've been able to get OpenOCD compiled with the TI ICDI driver.I have looked at the schematic for the Altium dongle, it's provided as an example project in Altium Designer, and it's seems to be a pretty simple device based around an ARM micro controller. If you download the datasheet for the uC, it's pretty easy to find the boot select pins broken out to a set of pads. From what I understand, I could use an SD card in the installed SD card port and set the pins to boot off of that. I haven't had the time (and honestly that's getting to be outside of my skills) to do it, but it's been kicking around in the back of my mind for a while...

author: free_electron
author_rank: Super Contributor
timestamp: July 29, 2013, 09:46:34 pm
content: altium dongle works with altium only. the firmware in the dongle is theirs.you can buy the altium dongle from amazon. ( they are an authorized distributor for the dongle and have it in stock. )

author: hpux735
author_rank: Contributor
timestamp: July 29, 2013, 10:03:50 pm
content: Quote from: free_electron on July 29, 2013, 09:46:34 pmI realize that they're not going to open source their firmware, but that's not necessary. It's possible to reverse-engineer usb protocols. If that weren't true, there wouldn't be a lot of OSS drivers.As much as anything, I thing the Altium dongles could be an interesting way to play with LPC ARM devices. Certainly much cheaper than this:http://www.icetech.com/emularm/lpc2800_board.html

author: tinhead
author_rank: Super Contributor
timestamp: August 08, 2013, 11:58:00 am
content: Quote from: hpux735 on July 29, 2013, 09:32:59 pmthere are two versions of the Altium USB JTAG :- one based on LPC2xxx ARM (http://www.applelogic.org/SRKH/DT01.html)- one based on FTDI chip (http://www.applelogic.org/SRKH/DT04.html)For the ARM based version no chance, it does use proprietary crap drivers from a german company.For the FTDI version you can of course use OpenOCD (or use that Altium Adapter with OpenOCD and other tools that can speak to FTDI).

author: ejeffrey
author_rank: Super Contributor
timestamp: August 08, 2013, 04:16:16 pm
content: Quote from: hpux735 on July 29, 2013, 10:03:50 pmI am not sure about this particular device, but normally in these devices the firmware doesn't come with the device. The Altium software would load the firmware when it connects. So yeah, you could reverse engineer it, but unless you distribute the copyrighted firmware, you are just reverse engineer a relatively dumb pod. Which is fine, but then you might as well start with one of the many free / open source "digital interface on a USB cable" projects. The hard part is getting all the software and device databases.

author: hpux735
author_rank: Contributor
timestamp: August 08, 2013, 04:26:35 pm
content: I've been playing around with it for a bit, and with my skill level it's essentially a non-starter. I've found and soldered wires to the mode select bits to allow for USB DFU mode, but I can't seem to get a working DFU uploader for it.I also soldered a header onto the JTAG port, but I don't have a working JTAG dongle. I think I'll need to just get a cheap FT2232-based one. I was able to play around with OpenOCD and I grasp the basics. NXP sells a version of this chip with the JTAG port disabled, and I haven't been able to verify which version is soldered on the board.Anyway, it has been fun to play around with it. If I can get the JTAG port to work, it'll be fun to write some code for it.

author: elcomtel
author_rank: Regular Contributor
timestamp: September 01, 2013, 02:54:47 am
content: JTAG Boundary Scan can be a bit confronting for a newbie with all the different software vendors and applications (development and repair), not to mention the plethora of JTAG interfaces.My experience with JTAG has concerned electronic repair, so I have mainly been concerned with boundary scan tests and to a lesser degree with using JTAG as a serial programing interface or the several incarnations of microprocessor ICE (In Circuit Emulation).From my personal experience with 'Universal Scan' software (see below) and some research I have done there are three software packages which I have identified that are affordable and would compliment a small business or hobbyist who is concerned with repairing modern digital equipment that uses JTAG technology. Just imagine the futility of trying to probe some BGA 'pins' and you will quickly appreciate the value of JTAG boundary scan in a practical sense.JTAG SOFTWARE FOR ELECTRONICS REPAIRSoftware Option No.1Universal Scan$850http://www.ricreations.com/Comments: Comes with USB 'software security' dongle, but if you have a parrot on your shoulder and a patch over one eye using the appropriate search parameters in Google will reward you with a pirates bounty of pirate solutions. Comes with FLASH memory support.Software Option No.2JTAG Test$120http://www.jtagtest.com/Comments: Supplied with their own USB JTAG interface (possibly FT2232H derived). Provided with programming information on application API including C++ header files so this opens up development opportunities for those who are this way inclined.Software Option No.3TopJTAG Probe$100http://www.topjtag.com/Comments: Supports various JTAG interface devices which is a good thing. For an additional $100 you can also buy FLASH memory support.I have used Universal Scan (No. 1 above) JTAG boundary scan software and I can say that it is everything you need for servicing digital electronics equipment with JTAG. It supports most of the Xilinx JTAG interfaces (Cable III,IV, USB Platform) which compliments someone who works in a Xilinx environment. I will add that the JTAG interface on a Altium 'Nano Board Series I' is a Xilinx IV standard interface so unofficially Universal Scan also worked on the Altium Nano Board.I think it's important to have an open mind about the various JTAG interfaces out there. Several vendors market 'propriety' JTAG interfaces which happen to be some original JTAG standard used by Xilinx, Altera, etc but are sold as something specifically different. You simply might find more compatibility between the various JTAG interfaces than you thought. Given the existence of the FT2232H device it's highly likely that many of the USB JTAG interfaces might be compatible.Most JTAG Boundary Scan compliant devices (ICs, components) have had a BSDL (Boundary Scan Definition Library) file that has been created by a manufacturer which will make your life very easy. These BSDL files are easy to find on the internet with the help of Google and various vendors have these BSDL files available on their websites or FTP servers. You must have these files to make any of the listed software work. When you cannot locate a BSDL file you might need to 'borrow' a BSDL file from another similar device and edit it so that you have one. Youmusthave a BSDL file for each JTAG device because none of the listed software will work.If you are in the business of repairing modern digital equipment that uses JTAG then my advice is that you will be very well served by the software listed above. The beauty of the software above is that it is not restricted to specific vendors such as Xilinx, Altera, Lattice, etc. The software doesn't care about the vendor as long as you can provide a JTAG interface that complies with IEEE Std. 1149.1 and BSDL file for each device.I have only used the $850 Universal Scan software, but I think there is better value in the $100 offerings. At the end of the day you basically want to input from a pin or output to a pin and all three software solutions will do this.I cannot emphasize how valuable the training videos are on the following link.http://www.ricreations.com/JTAG-Software-Downloads.htmWhilst the videos are for the Universal Scan software, the similarity between the listed three packages is very close that even if you were to decide to buy the $100-$120 solution much of what is discussed is still relevant.The JTAG software presented is of little value for electronics product development except to verify that your development system is working. It's amust haveif you repair any modern digital electronics equipment that has a JTAG interface.

author: Richard_Fry
author_rank: Contributor
timestamp: September 13, 2013, 08:09:35 am
content: elcomtel, do you have any experience of the scripting function in Universal Scan?I've been looking for something that will let me 'walking ones' around connectors and talk to non-boundary scan devices such as DAC / ADCs?Obviously the big boys XJtag, Jtag.com and (I think) Corelis do this, but they're a lot of money!Jtaglive does offer this functionality reasonably cheaply, but it's still nearly 3 times the price of Universal Scan.I know it's this and other add-ons that make the price the big boys charge, but if Universal Scan is acceptably useful - if a little clunky, it's probably ok for me.I see I can download a demo, so will try that, but first hand experience always useful.Failing that, I'll start learning C#

author: elcomtel
author_rank: Regular Contributor
timestamp: October 03, 2013, 12:29:27 pm
content: Quote from: Richard_Fry on September 13, 2013, 08:09:35 amRichard, my apologies for taking so long to reply. I have simply been too busy with life.To answer your question, no I haven't used the scripting language with Universal Scan because I simply had no need for it. I appreciate your need for the 'walking ones', but I can say that from memory (last time I used Universal Scan was 1.5 years ago) Universal Scan has a 'toggle' feature for each pin that lets you toggle (clock) the output and observe the response.

author: Richard_Fry
author_rank: Contributor
timestamp: October 07, 2013, 09:10:27 am
content: QuoteHey, no worries...I know what you mean. I've just moved to Australia and currently looking for work etc., so time on forums is sporadic at best.

author: Hooch
author_rank: Contributor
timestamp: October 07, 2013, 02:36:16 pm
content: Another excellent FF video.I'm just learning about it right now. Your video explained a lot.Thanks Dave!