1
\$\begingroup\$

On the internet, it always shows that each pin of the IC has its own Boundary Scan register (the yellow boxes)

enter image description here

But looking at BSDL files there are actually more BS registers than pins.

So for the questions:

  1. Is it right to say that there are always more BS registers than pins?
  2. What are the other BS registers used for OR Why are they there?
  3. How can we use JTAG(TAP controller, state machine etc) to find out which are the pin's BS register?

P.S. I have posted this question on StackExchange Reverse Engineering but there werent any reply. https://reverseengineering.stackexchange.com/questions/9119/jtag-finding-bs-registers-for-ics-pins

\$\endgroup\$
0
\$\begingroup\$

1) Usually yes but that will depend on the device. Sometimes you have devices that only have a few Boundary Scan enabled pins (and i.e. lots of power/gnd/analogue pins) and then the size of the Boundary-register may be smaller than the number of pins. But that is rare.

2) The most common structure behind a bidirectional pin are 3 Boundary Scan cells: 1 Input-cell (for reading the pin), 1 output-cell (output3 - meaning it can be tristated) for writing the pin and 1 control-cell for enabling/disabling the output3-cell. There can also be bidirectional cells and purely internal cells when i.e. the same architecture is used for multiple packages. If you have a pure output- or input-pin you may just find an output- or input-cell behind the pin.

3) That information is usually provided by the device manufacturer. There are ways to reverse engineer a BSDL-file but they are a lot of work. Usually that means you need the device on a board, powered up and functional without anything around (so you can freely toggle all pins). First you have figure out the size and commands of the Instruction-register and the size of the Boundary register. Then you shift in known pattern into the Boundary-register to switch pin-states and try to find the pin that actually changes state and construct your BSDL-file based on that information. As said earlier: Tedious work!

\$\endgroup\$
1
\$\begingroup\$

Ad 1) In most cases yes, but I wouldn't say it is always like this

Ad 2) Typically, a Pin will consist of multiple boundary cell register entries (think of one register controlling input/output and another register entry controlling output value - both for a single pin). This strongly depends on the type of the cell. There may also be linkage/internal pins where you do not get a corresponding boundary register at all or pins where you are only able to read (sometimes this can be seen at oscillator cells).

Ad 3) This is all given in the BSDL file. A tool like XJTAG or TopJTAG will read the BSDL file and display the contents in an easily readable format.

Regarding the statement in some other post that "sometimes BSDL files are not up to date" I have to strongly disagree. A BSDL file is usually an output of the chip design, not something you do later in the process. Within the last years, I haven't stumbled upon a single BSDL file which was "wrong". Some of them were for pre-series production parts, others maybe got the boundary scan cells redefined in some later version but none of them really had serious flaws.

\$\endgroup\$
  • \$\begingroup\$ Thanks for replying. Out of curiosity, if without the BSDL file, we will not be able to figure out the pin's boundary scan register? \$\endgroup\$ – menotyou Jun 15 '15 at 8:54
  • \$\begingroup\$ You could figure out part of the boundary scan register description (how the registers are actually connected; which register is the control/output register for a specific pin) by trying each pin individually, but this is an extremely error prone approach and you might even damage the IC. You are always free to create a custom BSDL file with only a single pin. As long as the instructions outlined in the BSDL file match your device, this could be an approach. Yet - don't do it :-) \$\endgroup\$ – Tom L. Jun 15 '15 at 9:12
  • \$\begingroup\$ Do you mean by going into EXTEST instruction mode and then toggle 1 register at a time? ie. 0001, 0010, 0100, 1000. \$\endgroup\$ – menotyou Jun 16 '15 at 7:35
  • \$\begingroup\$ Basically yes, but you need to pay attention to your register chain length. \$\endgroup\$ – Tom L. Jun 16 '15 at 8:16
  • \$\begingroup\$ But when you have multiple cells behind a pin you will likely have to drive more than a single 1 as you also need to enable the output before you will see the signal change. When I have done that sort of thing in the past I was using some sort of logic probe on the pin that was able to determine if the pin is H, L or Z which makes it a bit easier. You could then do a first round with just shifting a single 1 through the EXTEST-register and find all control-cells. Then you enable them all and shift a single 1 through the remaining cells to find the outputs. \$\endgroup\$ – og1L Jun 16 '15 at 10:18
0
\$\begingroup\$

This is interesting but I have also seen this while I did some jTAG boundary scan few years ago. Usually, the BSDL files aren't the best and up-to-date provided by the IC manufacturers. Previously I had reported few errors in the BSDL files to the manufacturers and were fixed. So my suggestion is, if you find anything weird, contact your IC manufacturers to support you. Hope they respond faster.

Answering your questions.

1 & 2. It is correct that the the ICs do have more BS registers than the pins. Again, it will depend on how up-to-date the manufacturers have kept their bsdl files. Also, some BS registers are associated with grounds and power pins of the IC and they should not be included as part of the jTAG chain.

  1. The pin mapping to the registers could be found in the BSDL file itself! You just have to exercise a bit of verilog.
\$\endgroup\$

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.