Real-Time Systems Design JTAG – testing and programming

In Circuit Emulators - ICE In Circuit Emulators (ICE) make direct connections into the processor slot or into a spare test socket This allows the developer to completely control the machine and, albeit with a few issues around timing, to completely emulate the operation of the CPU or chip under test. The ICE would offer the ability to monitor address and data lines, set break points and so on.

The testing problem As microprocessors and other chips have become larger and more sophisticated a problem has developed with the strategies for testing such devices. The number of pins (some don’t even have pins!) or there inaccessibility has made the use of ICE either extremely difficult, expensive or impossible.

New Approaches - BDM Motorola recognised this problem and introduced with their range the Background Debugging Mode (BDM). This 26 pin interface allowed the developers to control and monitor the execution of programs onto the boards. The developer would run some BDM diagnostic software and connect to the board through a host PC

Joint Test Action Group - JTAG Under the auspices of the IEEE, chip manufacturers developed a new testing standard, JTAG (IEEE ) This incorporated earlier boundary scan tests that had been developed for testing printed circuit boards. –Boundary scan allows the engineer to verify that the connections on a board are functioning.

JTAG The JTAG standard uses an internal shift register which is built into JTAG compliant devices. This, boundary scan register, allows monitoring and control of all I/O pins, signals and registers The interface to JTAG is through a standard PC parallel port to a JTAG port on the board to be tested.

PC IR SR SP o/p ports i/p ports TAP JTAG Control Device id instruction TDO data out 0 1 TRST TMS TCK TDI data in 0 1 clock mode reset Boundary scan register

Boundary Scan Register The BSR is a string of logic cells which permit the sampling and driving of pins regardless of the device’s core state. The size of the BSR is dependant upon the pins and signals that are being monitored on the device. For the SA1110 the BSR is 292 bits – some device are much larger – for example FPGAs. –Many devices can be connected onto the boundary scan register making very large bit streams

Test Access Port TAP The operation of the BSR is controlled by the TAP state machine This decodes the instructions sent through the BSR and decides what actions to take. The actions mainly involve loading the BSR cells with data, executing the instructions and then examining the results. The TAP is controlled by the state of TMS

JTAG commands The TAP can be put into command mode, where it can accept valid JTAG commands, or into shift or capture mode There are a core set of JTAG commands: –BYPASS, IDCODE, EXTEST, SAMPLE For example IDCODE will output an id bit string, specific to the device, onto TDO Chip manufacturers supplement the core with specialised commands for each chip

Example usage The JTAG interface can be used to install a firmware bootstrap onto a board JTAG is especially useful, as during this phase the board will have no onboard software and wont be functioning. The BSR data is loaded onto the CPU, and then EXTEST mode is executed. This forces the BSR data onto the external pins. As long as the addresses, data and signal states are correct, the developer can do tasks such as query the flash chips, erase them, and load data in. This is a slow process!

Installation using JTAG The JTAG interface goes through a number of pins on the 100 way Liberator connector I used the LART/BLOB design, but added TRST and a signal to hold the WP# pin high to allow unlocking of the boot sectors Ported the JFlash program to work with the Puppeteer –Requires knowledge of JTAG BSR chain components and flash drivers

JTAG Programming Once you get used to it, JTAG programming is pretty straight forward –You need to know what is in your JTAG BSR chain and its order The BSR is the size of the device + the bypass bits of the other chips –You need to know what commands are supported and the command word size of the device Bypass for the Xilinx chip is 1111, Altera 111, StrongARM –You then feed instructions into the devices’ TAP controllers and read back the results

Puppeteer JTAG BSR Chain StrongARM SA1110 CPU Altera FLEX 6000 FPGA Xilinx XCR3064A CPLD JTAG socket TAP bypass TAP bypass TAP StrongARM TAP Into IR mode Go into EXTEST Pump in data Shift DR (Pump out data) Execute instruction Update DR HOST JTAG APP Set up BSR chain bits Pump out on parallel port Read parallel port data Decide what next instruction 294 bits

JTAG Programming As the StrongARM does support JTAG debugging we are using it as a Flash blower –Could StrongARM JTAG debug? The specific Flash chips need JTAG drivers porting Connect the cable, put other devices into BYPASS mode, put the SA1110 into IR (instruction) mode, load the data, execute the command and read the results –BTW it comes out 1 cycle later, backwards and embedded in a 294 bit string! –Enjoy