JTAG boundary scan registers

Question

On the internet, it always shows that each pin of the IC has its own Boundary Scan register (the yellow boxes)

But looking at BSDL files there are actually more BS registers than pins.

So for the questions:

1. Is it right to say that there are always more BS registers than pins?
2. What are the other BS registers used for OR Why are they there?
3. How can we use JTAG(TAP controller, state machine etc) to find out which are the pin's BS register?

P.S. I have posted this question on StackExchange Reverse Engineering but there werent any reply. https://reverseengineering.stackexchange.com/questions/9119/jtag-finding-bs-registers-for-ics-pins

Answer 1

1) Usually yes but that will depend on the device. Sometimes you have devices that only have a few Boundary Scan enabled pins (and i.e. lots of power/gnd/analogue pins) and then the size of the Boundary-register may be smaller than the number of pins. But that is rare.

2) The most common structure behind a bidirectional pin are 3 Boundary Scan cells: 1 Input-cell (for reading the pin), 1 output-cell (output3 - meaning it can be tristated) for writing the pin and 1 control-cell for enabling/disabling the output3-cell. There can also be bidirectional cells and purely internal cells when i.e. the same architecture is used for multiple packages. If you have a pure output- or input-pin you may just find an output- or input-cell behind the pin.

3) That information is usually provided by the device manufacturer. There are ways to reverse engineer a BSDL-file but they are a lot of work. Usually that means you need the device on a board, powered up and functional without anything around (so you can freely toggle all pins). First you have figure out the size and commands of the Instruction-register and the size of the Boundary register. Then you shift in known pattern into the Boundary-register to switch pin-states and try to find the pin that actually changes state and construct your BSDL-file based on that information. As said earlier: Tedious work!

Answer 2

Ad 1) In most cases yes, but I wouldn't say it is always like this

Ad 2) Typically, a Pin will consist of multiple boundary cell register entries (think of one register controlling input/output and another register entry controlling output value - both for a single pin). This strongly depends on the type of the cell. There may also be linkage/internal pins where you do not get a corresponding boundary register at all or pins where you are only able to read (sometimes this can be seen at oscillator cells).

Ad 3) This is all given in the BSDL file. A tool like XJTAG or TopJTAG will read the BSDL file and display the contents in an easily readable format.

Regarding the statement in some other post that "sometimes BSDL files are not up to date" I have to strongly disagree. A BSDL file is usually an output of the chip design, not something you do later in the process. Within the last years, I haven't stumbled upon a single BSDL file which was "wrong". Some of them were for pre-series production parts, others maybe got the boundary scan cells redefined in some later version but none of them really had serious flaws.

Answer 3

This is interesting but I have also seen this while I did some jTAG boundary scan few years ago. Usually, the BSDL files aren't the best and up-to-date provided by the IC manufacturers. Previously I had reported few errors in the BSDL files to the manufacturers and were fixed. So my suggestion is, if you find anything weird, contact your IC manufacturers to support you. Hope they respond faster.

Answering your questions.

1 & 2. It is correct that the the ICs do have more BS registers than the pins. Again, it will depend on how up-to-date the manufacturers have kept their bsdl files. Also, some BS registers are associated with grounds and power pins of the IC and they should not be included as part of the jTAG chain.

3. The pin mapping to the registers could be found in the BSDL file itself! You just have to exercise a bit of verilog.