Skip to content
VLSIMentor

DFT · Chapter 10 · Boundary Scan & JTAG

The JTAG TAP Controller

This lesson builds the JTAG test access port and its TAP controller. The interface is deliberately tiny: four mandatory signals, a test clock, a mode select, test data in, and test data out, plus an optional test reset. The brain is the TAP controller, a sixteen-state finite state machine driven entirely by the mode select sampled on the rising edge of the clock, so a sequence of mode-select values navigates the machine. Its structure is standard across every JTAG device: a reset and idle state, then two parallel columns for the data register and the instruction register, each doing capture, shift, and update. From this fall two operations: load an instruction, which selects which data register is active, then shift data through it. Holding mode select high for five clocks always returns the machine to a known reset state.

Intermediate13 min readDFTTAP ControllerJTAGTMSFinite State Machine

Chapter 10 · Section 10.2 · Boundary Scan & JTAG

Project thread — the mini-SoC's TAP is the serial engine that drives its boundary scan (10.3) and BIST access (10.5); 10.6 walks a full TAP sequence.

1. Why Should I Learn This?

The TAP controller is the serial engine of all of JTAG — every boundary-scan or BIST-access operation is a TMS walk through its 16 states.

  • 4 signals: TCK (clock), TMS (mode select), TDI (in), TDO (out); optional TRST.
  • 16-state FSM driven by TMS on TCK — two columns: IR (instruction) and DR (data).
  • Two operations: load an instruction (IR → selects the data register), then shift data (DR).
  • Each column: Capture → Shift → Update; 5 TMS-high clocks → Test-Logic-Reset (guaranteed reset).

2. Real Silicon Story — the chain stuck in an unknown state

A bring-up team connected their JTAG probe to a board and got nothing — the chain wouldn't respond, TDO was garbage. They suspected a broken TAP, a wiring fault, or a dead chip.

The real issue was state. The TAP controller is a 16-state FSM, and on connection (or after a glitch) it can be in any state — not necessarily the known Test-Logic-Reset. Their software started shifting data assuming a known starting point, but the FSM was somewhere else, so the TMS sequence navigated to the wrong states and the operations were meaningless.

The fix is the guaranteed reset: hold TMS = 1 for five TCK clocks, which drives the FSM to Test-Logic-Reset from any state (or assert TRST if present). From that known state, the standard navigation worked and the chain responded. Lesson: the TAP is a stateful FSM — always reset it to a known state first (5 TMS-high clocks → Test-Logic-Reset), because a chain in an unknown state looks broken but is just lost.

3. Factory Perspective — the TAP through each lens

  • What the board-test engineer sees: the TMS sequences that navigate the FSM to Shift-IR (load instruction) and Shift-DR (shift data) — and the 5-TMS-high reset to recover a known state.
  • What the DFT engineer sees: the standard 16-state TAP to implement per 1149.1 — a fixed FSM every device shares.
  • What the software/tools engineer sees: that all JTAG operations are TMS walks + TDI/TDO shifts — a uniform driver across devices (given BSDL, 10.3).
  • What the system engineer sees: the TAP as the in-system access engine — the same FSM used for BIST/ISP/debug (10.5), always reset to a known state first.

4. Concept — the signals, the FSM, and the two operations

The TAP signals:

  • TCK — test clock (all TAP activity is synchronous to it).
  • TMS — test mode select — sampled on the rising edge of TCK; its sequence navigates the FSM.
  • TDI — test data in (serial input); TDO — test data out (serial output).
  • TRST (optional) — asynchronous test reset to Test-Logic-Reset.

The 16-state FSM (standard, shared by every device):

  • Home states: Test-Logic-Reset (reset), Run-Test/Idle (idle / run a self-test).
  • Two parallel columns, selected by TMS:
    • DR column (data): Select-DR → Capture-DR → Shift-DR → Exit1-DR → (Pause-DR → Exit2-DR) → Update-DR.
    • IR column (instruction): Select-IR → Capture-IR → Shift-IR → Exit1-IR → (Pause-IR → Exit2-IR) → Update-IR.
  • TMS on each TCK moves between states; e.g. from Run-Test/Idle, TMS = 1,1,0,0 → Shift-DR.

The three-beat operation in each column (Capture → Shift → Update):

  • Capture: load the register (IR or the selected DR) from its source (e.g. capture the pin values, or a fixed instruction pattern).
  • Shift: serially shift data TDI → register → TDO (this is where you read out the old contents and shift in new ones).
  • Update: latch the shifted-in value to the register's output (parallel latch) — so it takes effect.

The two fundamental operations:

  1. Load an instruction (IR column): navigate to Shift-IR, shift the instruction in, Update-IR → the instruction selects which data register sits between TDI and TDO (10.4).
  2. Shift data (DR column): navigate to Shift-DR, shift data through the selected register, Update-DR → the operation (e.g. drive/observe pins) takes effect.

The guaranteed reset:

  • TMS = 1 for 5 TCK clocks → Test-Logic-Reset from any state — always start here to reach a known state.
The JTAG TAP controller finite state machine with Test-Logic-Reset, Run-Test/Idle, and the DR and IR columns each doing capture, shift, and updateTMS=0→ DR colTMS=0shift → exit →update→ IR colTMS=0shift → exit →updateinstruction selectsDRdata takes effectTest-Logic-ResetRun-Test/IdleCapture-DRShift-DRUpdate-DRCapture-IRShift-IRUpdate-IR
Figure 1 - the TAP controller FSM (representative, key states). From TEST-LOGIC-RESET, TMS=0 goes to RUN-TEST/IDLE. TMS then navigates two parallel columns. DR column: SELECT-DR -> CAPTURE-DR -> SHIFT-DR (shift data TDI->register->TDO) -> EXIT1-DR -> UPDATE-DR. IR column: SELECT-IR -> CAPTURE-IR -> SHIFT-IR (shift the instruction) -> EXIT1-IR -> UPDATE-IR. Loading an INSTRUCTION (IR column) selects which DATA REGISTER the DR column shifts. Holding TMS=1 for 5 TCKs returns to TEST-LOGIC-RESET from ANY state (guaranteed reset). (Pause/Exit2 states omitted for clarity.)

The FSM sits between the pins and the registers:

TCK, TMS, TDI, TDO and optional TRST drive the TAP controller FSM, which selects the instruction register or a data register between TDI and TDOTCK / TMS / TDI / TDO(+TRST)4 mandatory signalsTAP controller(16-state FSM)TMS on TCK →Capture/Shift/UpdateInstruction Register(IR)selects the data registerData Register(selected)BYPASS / boundary-scan /IDCODE / userTDI → register → TDOserial shift path12
Figure 2 - the TAP signals and datapath (representative). The 4 mandatory signals: TCK (clock), TMS (navigates the FSM), TDI (serial in), TDO (serial out); optional TRST. The TAP CONTROLLER (16-state FSM) decodes the TMS sequence into Capture/Shift/Update controls. Loading the INSTRUCTION REGISTER (IR) selects which DATA REGISTER (BYPASS / boundary-scan register / IDCODE / user) is connected between TDI and TDO. Shifting the selected DR moves data in/out. So a few wires + this standard FSM = load any instruction and shift any register in any JTAG device.

5. Mental Model — a vending machine with one button

The TAP controller is like a vending machine navigated with a single button (TMS), stepped by a clock (TCK).

  • The machine has a map of states (the 16-state FSM). Each button press (a TMS value on a TCK tick) moves you one step along the map — so a sequence of presses walks you to where you want to go.
  • There are two aisles: the instruction aisle (IR) where you tell the machine what you want to do, and the data aisle (DR) where you actually move product (shift data). You first visit the instruction aisle to pick the operation (which selects which product bin is in the data aisle), then the data aisle to collect/deposit.
  • Each aisle works the same way: grab what's there (Capture), swap it in/out (Shift), commit (Update).
  • And there's a panic button: hold the button (TMS=1) for five ticks and you're always returned to the entrance (Test-Logic-Reset) — no matter where you were lost.

One button, a clock, a map: press your way to the instruction aisle, pick the operation, then the data aisle to move data — and five held presses always take you home.

6. Working Example — a TMS walk to shift a register

Trace the TMS navigation for the two operations:

Azvya Education Pvt. Ltd.VLSI Mentor
Snippet
# TAP navigation (TMS sampled on rising TCK) - REPRESENTATIVE, SIMPLIFIED, tool-neutral:
  RESET first (known state):  TMS = 1,1,1,1,1  -> TEST-LOGIC-RESET (from ANY state)  [+ TMS=0 -> Run-Test/Idle]
  LOAD AN INSTRUCTION (IR):
    from Run-Test/Idle: TMS = 1,1  -> Select-IR ; TMS=0 -> Capture-IR ; TMS=0 -> SHIFT-IR
    in SHIFT-IR: shift the instruction bits in on TDI (old IR out on TDO), TMS=0 each bit; last bit TMS=1 -> Exit1-IR
    TMS=1 -> UPDATE-IR  -> the instruction now SELECTS the data register (e.g. boundary-scan register)
  SHIFT DATA (DR):
    from Run-Test/Idle: TMS = 1 -> Select-DR ; TMS=0 -> Capture-DR ; TMS=0 -> SHIFT-DR
    in SHIFT-DR: shift data through the SELECTED register (TDI->reg->TDO); last bit TMS=1 -> Exit1-DR
    TMS=1 -> UPDATE-DR  -> the shifted value takes effect (e.g. drives the boundary cells onto pins)
# Every JTAG operation = navigate (TMS) to Shift-IR/Shift-DR, shift (TDI/TDO), Update. The FSM is identical everywhere.

7. Industry Flow — reset, load instruction, shift data

Every JTAG operation follows the same FSM sequence:

Reset to Test-Logic-Reset, load an instruction via Shift-IR, then shift data via Shift-DR, updating each to take effectReset → load instruction (IR) → shift data (DR)Reset → load instruction (IR) → shift data (DR)1Reset (5× TMS=1)→ Test-Logic-Reset (known state)2Load instruction (Shift-IR)shift instruction → Update-IR (selects DR)3Shift data (Shift-DR)TDI → selected register → TDO4Update-DRshifted value takes effect5Run-Test/Idle (optional)e.g. run a self-test (BIST)
Figure 3 - the standard JTAG operation sequence (representative). RESET: TMS=1 for 5 TCKs -> Test-Logic-Reset (known state, from anywhere). LOAD INSTRUCTION: navigate to Shift-IR, shift the instruction (selects the data register), Update-IR. SHIFT DATA: navigate to Shift-DR, shift through the selected register (TDI->reg->TDO), Update-DR (takes effect). Optionally sit in Run-Test/Idle (e.g. to run a self-test). This same sequence drives boundary scan (10.3), every instruction (10.4), and BIST/ISP/debug access (10.5) -- the universal serial engine.

8. Debugging Session — the JTAG chain won't respond

1

A JTAG chain won't respond and TDO is garbage, and the team suspects broken wiring or a dead TAP; the TAP controller is a stateful FSM that can be in any state on connection, and software that starts shifting assumes a known state -- the fix is to reset the TAP to a known state first by holding TMS high for five TCK clocks (or asserting TRST), which reaches Test-Logic-Reset from any state, and then navigate normally

A STATEFUL FSM IN AN UNKNOWN STATE LOOKS BROKEN — RESET WITH 5 TMS-HIGH CLOCKS FIRST
Symptom

A JTAG chain won't respond — TDO is garbage, operations do nothing. The team suspects broken wiring, a dead TAP, or a bad chip.

Root Cause

The TAP controller is a stateful 16-state FSM that can be in any state when you connect (or after a glitch), and software that begins shifting data assumes a known starting state — so its TMS sequence navigates from the wrong state and every operation is meaningless. The entire JTAG protocol is relative to the FSM's current state: a given TMS sequence means 'go to Shift-DR' only if you start from a known state (e.g. Run-Test/Idle). On connection, the TAP could be anywhere — mid-shift, in a Pause state, in an IR column — because nothing has reset it. If the driver assumes it's at, say, Run-Test/Idle and issues the navigate-to-Shift-DR TMS pattern, but the FSM is actually somewhere else, the pattern lands in the wrong states, so the shifts read/write the wrong register (or none) and TDO looks like garbage. This looks identical to a hardware failure (no valid response), which is why teams chase wiring/chip faults — but the TAP hardware is fine; it's simply lost, and the protocol has no way to recover without an explicit reset to a known state.

Fix

Reset the TAP to a known state first — hold TMS high for five TCK clocks (which reaches Test-Logic-Reset from any state), or assert TRST — then navigate normally. Begin every JTAG session (and after any suspected glitch) with the guaranteed reset: drive TMS = 1 for at least 5 TCK rising edges, which the FSM is designed to interpret as 'go to Test-Logic-Reset' regardless of the current state (the 5 covers the longest path back). If the device has TRST, asserting it does the same asynchronously. From Test-Logic-Reset, the known navigation works: TMS=0 → Run-Test/Idle, then the standard Shift-IR / Shift-DR sequences (Section 6) behave as expected and TDO becomes valid. Make the 5-TMS-high reset the first step of the JTAG driver so a lost chain always recovers. The principle to lock in: the TAP controller is a standard 16-state FSM driven by TMS sampled on TCK, with parallel instruction-register and data-register columns each doing capture, shift, and update — so every JTAG operation is a TMS walk to Shift-IR (load an instruction that selects a data register) then Shift-DR (shift that register) then Update; and because the FSM is stateful and can power up or glitch into any state, a chain that won't respond is usually simply in an unknown state, recovered by the guaranteed reset of holding TMS high for five TCK clocks to reach Test-Logic-Reset from anywhere, after which normal navigation works — a lost TAP looks broken but only needs a reset. (Boundary cells the DR shifts are 10.3; instructions the IR loads are 10.4; board/in-system use is 10.5.)

9. Common Mistakes

  • Not resetting the TAP first. It can be in any state — 5 TMS-high clocks → Test-Logic-Reset (known state).
  • Assuming a starting state. All navigation is relative — always start from a reset (known) state.
  • Confusing the IR and DR columns. Load an instruction (IR) to select a register, then shift data (DR).
  • Forgetting Update. Capture/Shift aren't enough — Update latches the value to the register's output (takes effect).
  • Sampling TMS on the wrong edge. TMS is sampled on the rising edge of TCK — get the timing right.

10. Industry Best Practices

  • Start every session with the 5-TMS-high reset (or TRST) — a known state first.
  • Model the FSM navigation in the driver — reset → Shift-IR → Shift-DR → Update.
  • Use Run-Test/Idle to run self-tests (BIST) between operations (10.5).
  • Implement a compliant 16-state TAP per 1149.1 — the standard every tool expects.
  • Treat a non-responding chain as 'lost' (reset it) before suspecting hardware.

11. Senior Engineer Thinking

  • Beginner: "The JTAG chain is dead — must be a wiring or chip fault."
  • Senior: "The TAP is a stateful FSM — on connect it can be anywhere. If my software assumes a known state and it isn't, every shift lands in the wrong state and TDO is garbage — looks broken, isn't. I reset first: TMS=1 for 5 TCKs → Test-Logic-Reset from any state, then navigate. A lost TAP needs a reset, not a repair."

The senior resets the TAP to a known state first and reads a non-responding chain as lost, not broken.

12. Silicon Impact

The TAP controller is the universal serial engine that makes all of JTAG work — boundary scan (10.3), the instruction set (10.4), and in-system BIST/ISP/debug access (10.5, the 9.5 bridge) are all just TMS walks through this one standard 16-state FSM plus TDI/TDO shifts. Its genius is uniformity: every compliant device implements the identical FSM, so a single driver model — reset → load instruction (Shift-IR) → shift data (Shift-DR) → Update — controls any JTAG chip, which is exactly why JTAG became a universal, tool-portable standard. Two properties are worth internalizing for real work. First, the two-operation structure: you always load an instruction first (the IR column) to select which data register is in the path, then shift that register (the DR column) — and each column's Capture → Shift → Update three-beat is what reads out old contents while shifting in new ones and then commits them. Second — and the single most common bring-up bug — the FSM is stateful, so a chain that won't respond is almost always not broken but lost (in an unknown state), recovered by the guaranteed reset: hold TMS high for 5 TCK clocks → Test-Logic-Reset from anywhere. For the DFT engineer, the TAP is a standard block to instantiate for 1149.1 compliance (a board-testability and access requirement, 10.1); for the board/software engineer, it's a fixed navigation model to encode; and for bring-up, the discipline of always resetting to a known state first turns a mysterious 'dead chain' into a one-step recovery. This standard FSM is the foundation on which the rest of the chapter — the boundary cells it shifts (10.3), the instructions it loads (10.4), and the board/in-system operations it drives (10.5/10.6) — all rest.

13. Engineering Checklist

  • Implemented a compliant 16-state TAP per 1149.1 (TCK/TMS/TDI/TDO; optional TRST).
  • Driver resets to a known state first (5 TMS-high clocks → Test-Logic-Reset, or TRST).
  • Modeled the two operations: Shift-IR (load instruction → selects DR) then Shift-DR (shift data).
  • Included Update (latch to output) — not just Capture/Shift.
  • Used Run-Test/Idle for self-tests (BIST); treated a non-responding chain as lost (reset it).

14. Try Yourself

  1. List the 4 mandatory TAP signals (+ optional TRST) and what each does.
  2. Draw the FSM skeleton: Test-Logic-Reset, Run-Test/Idle, and the IR and DR columns (Capture/Shift/Update).
  3. Write the TMS sequence from Run-Test/Idle to Shift-DR, and from Run-Test/Idle to Shift-IR.
  4. Explain the two operations: load an instruction (selects a register), then shift data.
  5. Give the guaranteed reset (5 TMS-high clocks → Test-Logic-Reset) and why bring-up should reset first.

The FSM is fixed by IEEE 1149.1; navigation is tool-neutral. No paid tool required to trace the TAP.

15. Interview Perspective

  • Weak: "The TAP controller runs the JTAG interface."
  • Good: "It's a state machine driven by TMS on TCK that shifts the instruction and data registers via TDI/TDO."
  • Senior: "The TAP has 4 signals — TCK, TMS, TDI, TDO (+ optional TRST) — and the TAP controller is a standard 16-state FSM driven by TMS sampled on TCK. It has two 'home' states (Test-Logic-Reset, Run-Test/Idle) and two parallel columns — IR (instruction) and DR (data) — each doing Capture → Shift → Update. Every operation is: load an instruction via Shift-IR (which selects the data register between TDI/TDO), then shift that register via Shift-DR, then Update to take effect. It's the same FSM in every device, so one driver controls anything. And the key bring-up rule: the FSM is stateful, so hold TMS=1 for 5 TCKs to reach Test-Logic-Reset from any state — a non-responding chain is usually just lost, not broken; reset it first."

16. Interview / Review Questions

17. Key Takeaways

  • The TAP (Test Access Port) has four mandatory signals — TCK (clock), TMS (mode select), TDI (in), TDO (out) — plus an optional TRST (reset); all of JTAG flows over these few wires.
  • The TAP controller is a standard 16-state FSM driven by TMS sampled on TCK, with two 'home' states (Test-Logic-Reset, Run-Test/Idle) and two parallel columns — IR (instruction) and DR (data) — each doing Capture → Shift → Update.
  • JTAG's two fundamental operations: load an instruction via Shift-IR (which selects which data register sits between TDI/TDO), then shift data through that register via Shift-DR — Update latches each to take effect.
  • The FSM is identical in every compliant device, so one driver model (reset → Shift-IR → Shift-DR → Update) controls any JTAG chip — the reason JTAG is a universal, portable standard.
  • The FSM is stateful, so hold TMS high for 5 TCK clocks → Test-Logic-Reset from any state (guaranteed reset) — a non-responding chain is usually just lost, not broken; always reset to a known state first. Next: 10.3 — boundary-scan cells & the register.

18. Quick Revision

The JTAG TAP controller. TAP = 4 signals: TCK (clock), TMS (mode select), TDI (in), TDO (out); optional TRST. The TAP controller = a standard 16-state FSM driven by TMS sampled on rising TCK. Home states: Test-Logic-Reset, Run-Test/Idle; two parallel columns — IR (instruction) + DR (data) — each: Capture → Shift → Update. Two operations: load an INSTRUCTION (Shift-IR → selects which data register is between TDI/TDO) then SHIFT DATA (Shift-DR through the selected register), Update = take effect. Same FSM in EVERY device → one driver model. Guaranteed reset: TMS=1 for 5 TCKs → Test-Logic-Reset from ANY state → a non-responding chain is usually just LOST (reset first, not broken). Next: 10.3 — boundary-scan cells & the register.