DFT · Chapter 10 · Boundary Scan & JTAG
JTAG in Board & In-System Test
Earlier sections built the TAP, the boundary register, and the instructions; this lesson is the deployment on a whole board and in-system. On a board, the chips' JTAG ports are daisy-chained into one chain: the test clock and mode select are shared across all devices, while test data ripples out of each chip and into the next until it exits the last, driven by a single board controller. From that one chain flow all of JTAG's uses: board interconnect test with EXTEST to find opens, shorts, and solder defects without probes, in-system programming of flash and configuration, access to on-chip self-test to start BIST and read its signature, and CPU debug. BSDL files describe each chip so the tester can compose whole-chain operations. This is why JTAG became the universal test, debug, and programming backbone.
Intermediate13 min readDFTJTAGBoard TestIn-System ProgrammingDebug
Chapter 10 · Section 10.5 · Boundary Scan & JTAG
Project thread — the mini-SoC joins a board JTAG chain: its interconnect is tested (EXTEST) and its BIST (9.5) is started/read via JTAG. 10.6 walks the concrete path.
1. Why Should I Learn This?
This is how JTAG is actually used — one daisy-chained interface that tests the board, programs it, runs its BIST, and debugs it.
- Chips daisy-chain into one chain: shared TCK/TMS; TDI → chip → TDO → next chip's TDI → … → TDO.
- Uses: interconnect test (EXTEST), in-system programming (ISP), on-chip BIST access (9.5), debug.
- BSDL per chip describes its boundary scan/IR length; the tester composes the whole-chain operations.
- The universal test/debug/programming access backbone — one 4-wire interface.
2. Real Silicon Story — the operation that hit the wrong chip
A board with three JTAG devices in a chain had a test that kept hitting the wrong chip — an EXTEST meant for chip B seemed to affect chip C, and read-backs were shifted/garbled. The chips were fine individually; the chain-level operations were wrong.
The cause was chain composition. In a daisy chain, all devices are in the path at once, so to address one device you must account for every device's register length in the shift: the target's instruction/data bits must be surrounded by the right number of bits for the other devices (which should be in BYPASS, contributing 1 bit each, or their full IR/DR length otherwise). The tester's chain description had the device order wrong and mis-counted an IR length, so the shifted bits landed in the wrong device's register — the target got someone else's bits and vice versa.
The fix was to get the chain description right: the device order (as physically wired on the board), each device's IR length (from its BSDL), and BYPASS the non-targets so their contribution is a known 1 bit. Then operations addressed the right device. Lesson: on a daisy chain, operations are only correct if the chain composition — device order, IR/DR lengths, and which devices are in BYPASS — is exactly right; get it wrong and shifts hit the wrong chip.
3. Factory Perspective — the board chain through each lens
- What the board-test engineer sees: one daisy chain to drive — interconnect test (EXTEST + BYPASS non-targets), composed from each chip's BSDL — no bed-of-nails on hidden-pin boards (10.1).
- What the manufacturing engineer sees: board test, ISP (program devices), and BIST access over the same 4 wires — a cheap, universal test/program interface.
- What the system/software engineer sees: in-system uses — start BIST + read signatures (9.5), program firmware (ISP), debug the CPU — all via JTAG.
- What management cares about: that one JTAG interface covers board test, programming, self-test, and debug across the product lifecycle — a huge cost/access leverage point.
4. Concept — the daisy chain and its uses
The board JTAG chain (daisy chain):
- TCK and TMS are shared (bussed to all devices) — so all TAP FSMs step together through the same states.
- TDI → first chip → (its TDO) → next chip's TDI → … → last chip's TDO — one serial path through every device.
- A board tester / JTAG controller drives TCK/TMS/TDI and reads TDO.
Addressing one device — chain composition:
- Because all devices are in the path, a shift passes through every device's selected register. To operate one device, the tester composes the shift: the target's bits plus the right number of bits for every other device.
- BYPASS the non-target chips → each contributes 1 bit → the chain is short and the composition simple.
- The tester needs the device order (as wired) and each device's IR length (from BSDL) to compose operations correctly (the story).
The uses (all over the one chain):
- Board interconnect test (EXTEST, 10.4): drive/observe pins across chips → opens/shorts/solder defects, no probes (10.1).
- In-system programming (ISP): program flash / CPLD / FPGA config via JTAG (user instructions).
- On-chip BIST access (the 9.5 bridge): start LBIST/MBIST + read the signature/result via a user register — how in-system/in-field self-test is triggered and read (power-on/periodic, 9.5).
- Debug: CPU halt/step, memory access — most SoC debug ports are JTAG.
- Also: manufacturing board test, field diagnostics, silicon bring-up.
The enabling glue — BSDL and composition:
- BSDL (10.3) describes each chip's boundary scan and IR length; the tester composes the whole-chain operations (which instruction per device, total shift lengths). Multi-drop/addressable variants exist for large systems.
5. Mental Model — one intercom loop wired through every room
A board JTAG chain is like a single intercom loop wired through every room of a building, run from one front desk.
- The audio loop (TDI → room → room → … → TDO) passes through every room in series — a message ripples room to room back to the desk. The clock and channel selector (TCK/TMS) are broadcast to all rooms at once, so every room's panel is on the same step.
- To talk to one room, the desk must account for every room the message passes through — it surrounds the target's message with the right padding for the other rooms. Put the other rooms in 'pass-through' (BYPASS, a 1-bit hop) and the addressing is simple; get the room order or a panel's size wrong and your message lands in the wrong room (the story).
- From the one desk, over the one loop, you can check the wiring between rooms (interconnect test), update a room's settings (ISP), ask a room to run its self-check and report (BIST access, 9.5), or listen in to troubleshoot (debug).
- A directory (BSDL) tells the desk each room's panel layout and size so it can compose messages correctly.
One loop through every room, one desk, one directory — that's a board JTAG chain: reach, test, program, self-test, and debug every device from four wires.
6. Working Example — composing a chain operation
Address one device on a daisy chain, and access BIST:
# Board JTAG chain operation - REPRESENTATIVE, SIMPLIFIED, tool-neutral (chain: A -> B -> C):
GOAL: run EXTEST interconnect test between A and B ; C not involved.
1) From BSDL: device ORDER = A,B,C ; IR lengths (e.g. A=4, B=4, C=5 bits)
2) Compose the IR shift for the WHOLE chain (all IRs are in the path at once):
load EXTEST into A + B ; load BYPASS into C -> shift the concatenation of all three IRs in order
3) PRELOAD (10.4) the boundary cells of A + B (known drive values); C in BYPASS contributes 1 bit
4) EXTEST: shift the composed DR (A's BSR + B's BSR + C's 1-bit bypass) ; A drives, B captures
5) Read TDO -> extract B's captured bits (accounting for A's BSR + C's 1 bit around them) -> compare (open/short)
# WRONG composition (bad device order / IR length) -> bits land in the WRONG device's register -> operations hit the wrong chip.# In-system BIST access via JTAG - the 9.5 bridge - REPRESENTATIVE:
Load a USER instruction on the target chip (BYPASS the others) -> selects a USER register wired to the BIST controller
-> write 'start LBIST/MBIST' ; poll 'done' ; read the SIGNATURE / go-nogo out on TDO
-> this is HOW power-on/periodic in-field self-test (9.5) is TRIGGERED and READ, in-system, over JTAG.
Other in-system uses over the same chain: ISP (program flash), DEBUG (CPU halt/step, memory access).7. Industry Flow — one chain, many uses
The board JTAG chain serves the whole lifecycle from a single interface:
8. Debugging Session — chain operations hit the wrong device
On a multi-device board JTAG chain, operations hit the wrong device and read-backs are shifted/garbled while each chip works individually; the chain composition is wrong -- incorrect device order or IR/DR lengths, or a device not in the expected instruction -- so shifted bits land in the wrong device's register; the fix is to get the chain description exactly right (device order as wired, per-device IR length from BSDL, BYPASS non-targets) so operations address the right device
DAISY-CHAIN OPERATIONS NEED EXACT COMPOSITION — RIGHT ORDER, IR LENGTHS, BYPASS NON-TARGETSOn a multi-device board JTAG chain, operations hit the wrong device — an EXTEST for one chip seems to affect another, read-backs are shifted/garbled — even though each chip works individually.
In a daisy chain every device is in the serial path at once, so addressing one device requires composing the shift around every other device's register length — and if the chain description (device order, IR/DR lengths, which devices are in BYPASS) is wrong, the shifted bits land in the wrong device's register. Unlike a single-chip TAP, a board chain puts all devices' registers in series between TDI and TDO: to load, say, chip B's instruction, you must shift a concatenation of A's IR bits + B's IR bits + C's IR bits, in the physical order they're wired, with each device's field exactly the right length. Similarly, to read chip B's captured data, you must skip past the bits of the devices before/after it in the chain. If the tester's chain description has the device order wrong (A/B/C mis-ordered vs the board), a wrong IR length (so fields are mis-aligned), or a device in an unexpected instruction (contributing a different number of DR bits than assumed — e.g. its full BSR instead of BYPASS's 1 bit), then the bit boundaries shift and the target's bits overlap another device's register. The result: operations land on the wrong chip and read-backs are misaligned — a composition error, not a per-chip fault (each chip is fine on its own).
Get the chain description exactly right — device order as physically wired, per-device IR length from each BSDL, and BYPASS the non-target devices — so operations address the intended device. Build the tester's chain model from the board netlist (the physical TDI→…→TDO order) and each chip's BSDL (its IR length and register definitions, 10.3). For any operation, BYPASS all non-target devices (each then contributes a known 1-bit DR), load the target's instruction in the right IR field, and compose the DR shift accounting for the 1-bit contributions of the bypassed devices around the target's register. Verify by reading IDCODE from each device (a known value at a known position) to confirm order and lengths before running tests. The principle to lock in: on a board, chips are daisy-chained into one JTAG chain with shared TCK/TMS and TDI rippling TDO-to-TDI through every device, so every operation passes through all devices' registers at once — addressing one device therefore requires composing the shift from the correct device order and per-device IR/DR lengths (from BSDL), with non-target devices in BYPASS contributing one bit each; a wrong chain composition makes shifts land in the wrong device's register, so board JTAG operations are only correct when the chain description exactly matches the physical chain, which is what lets a single 4-wire interface reliably test the interconnect, program devices, access BIST (the 9.5 bridge), and debug. (Per-chip BSDL is 10.3; instructions like EXTEST/BYPASS are 10.4; the worked single-net path is 10.6.)
9. Common Mistakes
- Wrong chain composition. Get device order + IR/DR lengths (from BSDL) right, or shifts hit the wrong chip.
- Not BYPASSing non-targets. Their full BSR bloats/mis-aligns the chain — BYPASS them (1 bit each).
- Assuming a chip fault when it's composition. Each chip works alone — the chain model is wrong.
- Skipping IDCODE verification. Read IDCODE to confirm order/lengths before testing.
- Forgetting the in-system uses. The same chain does ISP, BIST access (9.5), and debug — not just interconnect.
10. Industry Best Practices
- Model the chain exactly (device order + IR lengths from BSDL); verify with IDCODE.
- BYPASS non-target devices to keep the chain short and composition simple.
- Use the one chain for the full lifecycle — interconnect test, ISP, BIST access (9.5), debug.
- Keep accurate BSDL per chip — the board plan depends on it (10.3).
- Consider addressable/multi-drop JTAG for large systems.
11. Senior Engineer Thinking
- Beginner: "The JTAG operation hits the wrong chip — a chip must be broken."
- Senior: "Each chip is fine alone — it's the chain composition. In a daisy chain, all devices' registers are in series, so I must compose shifts with the right device order and IR/DR lengths (from BSDL), BYPASS the non-targets (1 bit each), and verify with IDCODE. Then operations address the right device. One chain does interconnect test, ISP, BIST access (9.5), and debug."
The senior fixes chain composition (order/lengths/BYPASS) and uses the one chain for the whole lifecycle.
12. Silicon Impact
The board JTAG chain is where boundary scan's promise (10.1) becomes a practical, universal capability: a single 4-wire serial interface that reaches every device on a board for testing the interconnect, programming the devices, running and reading their self-tests, and debugging the system — across the entire product lifecycle (manufacturing, field, bring-up). The daisy-chain structure — shared TCK/TMS, TDI rippling TDO→TDI through every device — is what makes it scalable to a whole board from one controller, and the operational discipline it imposes is the chapter's key practical lesson: because all devices' registers are in series, every operation must be composed from the correct device order and per-device register lengths (from BSDL), with non-target devices in BYPASS — get the chain description wrong and operations land on the wrong chip (the story), a composition error that looks like a hardware fault but isn't. The breadth of uses is what elevated JTAG far beyond its board-test origin into the universal access backbone: EXTEST does probe-less interconnect test (10.1); ISP programs flash/CPLD/FPGA; debug ports (CPU halt/step, memory access) are JTAG-based; and — the direct 9.5 bridge — user instructions start on-chip LBIST/MBIST and read the signature, which is precisely how the in-system/in-field self-test of Chapters 8–9 is triggered and read at power-on and periodically. For the board/test engineer, the deliverable is an exact chain model (verified with IDCODE) that lets one interface do all of this; for the DFT engineer, accurate per-chip BSDL and user instructions are what the board plan depends on; and for the system engineer, the chain is the in-system doorway to program, self-test, and debug the product. This is the deployment that makes the mini-SoC — and every modern board — testable, programmable, self-testable, and debuggable from four wires, and it's the setting for the worked boundary-scan path in 10.6.
13. Engineering Checklist
- Modeled the chain composition (device order + IR lengths from BSDL); verified with IDCODE.
- BYPASSed non-target devices (1 bit each) for interconnect tests and access operations.
- Used the one chain for interconnect test (EXTEST), ISP, BIST access (9.5), and debug.
- Kept accurate BSDL per chip; considered addressable/multi-drop for large systems.
- Confirmed operations address the right device (composition correct) before running.
14. Try Yourself
- Draw a 3-chip daisy chain (shared TCK/TMS; TDI → A → B → C → TDO) driven by a controller.
- Compose an operation targeting chip B: load EXTEST in B, BYPASS A and C — account for the bit lengths.
- Show how a wrong device order / IR length makes shifts hit the wrong chip.
- Access on-chip BIST via a user instruction (start + read signature) — the 9.5 bridge.
- List the four uses of the one chain (interconnect, ISP, BIST access, debug) across the lifecycle.
The chain/uses are IEEE 1149.1; composition is tool-neutral. No paid tool required to reason about the board chain.
15. Interview Perspective
- Weak: "You connect JTAG to the board and test it."
- Good: "Chips daisy-chain into one JTAG chain; a controller drives interconnect test, programming, and debug."
- Senior: "On a board, chips daisy-chain into one JTAG chain: TCK/TMS shared, TDI rippling TDO→TDI through every device to TDO. One controller drives it for the whole lifecycle: interconnect test (EXTEST, BYPASS non-targets → opens/shorts, no probes), in-system programming (flash/CPLD/FPGA), BIST access (start LBIST/MBIST + read the signature — the 9.5 in-field self-test trigger/readout), and debug (CPU halt/step, memory). The catch is composition: all devices' registers are in series, so I compose shifts from the device order + IR/DR lengths (from BSDL), BYPASS non-targets, and verify with IDCODE — a wrong chain model makes operations hit the wrong chip. One 4-wire interface = the universal test/program/self-test/debug backbone."
16. Interview / Review Questions
17. Key Takeaways
- On a board, chips are daisy-chained into one JTAG chain: TCK and TMS shared (all TAP FSMs step together), TDI rippling TDO→TDI through every device to the last TDO — driven by one board tester / JTAG controller.
- The one chain serves the whole lifecycle: board interconnect test (EXTEST, BYPASS non-targets → opens/shorts, no probes), in-system programming (flash/CPLD/FPGA), on-chip BIST access (start LBIST/MBIST + read the signature — the 9.5 bridge), and debug (CPU halt/step, memory).
- Because all devices' registers are in series, every operation must be composed from the correct device order and per-device IR/DR lengths (from BSDL), with non-targets in BYPASS — a wrong chain description makes shifts hit the wrong chip.
- BSDL per chip describes each device's boundary scan/IR length; the tester composes whole-chain operations, and IDCODE verifies order/lengths; addressable/multi-drop variants exist for large systems.
- The result is the universal test/debug/programming access backbone — a single 4-wire interface that tests the board, programs the devices, runs/reads their self-tests, and debugs the system — the in-system access the whole Chapter 8–9 story depends on. Next: 10.6 — a worked JTAG boundary-scan path.
18. Quick Revision
JTAG in board & in-system test. Chips DAISY-CHAIN into ONE JTAG chain: shared TCK/TMS (all FSMs step together); TDI → chip → TDO → next chip's TDI → … → TDO. One controller drives it. USES (whole lifecycle): interconnect test (EXTEST across chips → opens/shorts, no probes; BYPASS non-targets), ISP (program flash/CPLD/FPGA), BIST ACCESS (start LBIST/MBIST + read signature — the 9.5 in-field trigger/readout), DEBUG (CPU halt/step, memory). BSDL per chip → the tester COMPOSES whole-chain ops (device order + IR/DR lengths); verify with IDCODE. Wrong composition → shifts hit the WRONG chip. One 4-wire interface = the universal test/program/self-test/debug backbone. Next: 10.6 — a worked JTAG boundary-scan path.