RealTime Systems Design JTAG testing and programming In

  • Slides: 17
Download presentation
Real-Time Systems Design JTAG – testing and programming

Real-Time Systems Design JTAG – testing and programming

In Circuit Emulators - ICE • In Circuit Emulators (ICE) make direct connections into

In Circuit Emulators - ICE • In Circuit Emulators (ICE) make direct connections into the processor slot or into a spare test socket • This allows the developer to completely control the machine and, albeit with a few issues around timing, to completely emulate the operation of the CPU or chip under test. • The ICE would offer the ability to monitor address and data lines, set break points and so on.

The testing problem • As microprocessors and other chips have become larger and more

The testing problem • As microprocessors and other chips have become larger and more sophisticated a problem has developed with the strategies for testing such devices. • The number of pins (some don’t even have pins!) or there inaccessibility has made the use of ICE either extremely difficult, expensive or impossible.

New Approaches - BDM • Motorola recognised this problem and introduced with their 68300

New Approaches - BDM • Motorola recognised this problem and introduced with their 68300 range the Background Debugging Mode (BDM). • This 26 pin interface allowed the developers to control and monitor the execution of programs onto the 68300 boards. • The developer would run some BDM diagnostic software and connect to the board through a host PC

Joint Test Action Group - JTAG • Under the auspices of the IEEE, chip

Joint Test Action Group - JTAG • Under the auspices of the IEEE, chip manufacturers developed a new testing standard, JTAG (IEEE 1149. 1) • This incorporated earlier boundary scan tests that had been developed for testing printed circuit boards. – Boundary scan allows the engineer to verify that the connections on a board are functioning.

JTAG • The JTAG standard uses an internal shift register which is built into

JTAG • The JTAG standard uses an internal shift register which is built into JTAG compliant devices. • This, boundary scan register, allows monitoring and control of all I/O pins, signals and registers • The interface to JTAG is through a standard PC parallel port to a JTAG port on the board to be tested.

PC o/p ports Boundary scan register TDI data in 0101 SR SP instruction Device

PC o/p ports Boundary scan register TDI data in 0101 SR SP instruction Device id IR TAP JTAG Control TCK TMS TRST clock mode reset 0101 TDO data out i/p ports

Boundary Scan Register • The BSR is a string of logic cells which permit

Boundary Scan Register • The BSR is a string of logic cells which permit the sampling and driving of pins regardless of the device’s core state. • The size of the BSR is dependant upon the pins and signals that are being monitored on the device. • For the SA 1110 the BSR is 292 bits – some device are much larger – for example FPGAs. – Many devices can be connected onto the boundary scan register making very large bit streams

Test Access Port TAP • The operation of the BSR is controlled by the

Test Access Port TAP • The operation of the BSR is controlled by the TAP state machine • This decodes the instructions sent through the BSR and decides what actions to take. • The actions mainly involve loading the BSR cells with data, executing the instructions and then examining the results. • The TAP is controlled by the state of TMS

JTAG commands • The TAP can be put into command mode, where it can

JTAG commands • The TAP can be put into command mode, where it can accept valid JTAG commands, or into shift or capture mode • There a core set of JTAG commands: – BYPASS, IDCODE, EXTEST, SAMPLE • For example IDCODE will output an id bit string, specific to the device, onto TDO • Chip manufacturers supplement the core with specialised commands for each chip

Example usage • The JTAG interface can be used to install a firmware bootstrap

Example usage • The JTAG interface can be used to install a firmware bootstrap onto a board • JTAG is especially useful, as during this phase the board will have no onboard software and wont be functioning. • The BSR data is loaded onto the CPU, and then EXTEST mode is executed. This forces the BSR data onto the external pins. • As long as the addresses, data and signal states are correct, the developer can do tasks such as query the flash chips, erase them, and load data in. • This is a slow process!

Installation using JTAG • The JTAG interface goes through a number of pins on

Installation using JTAG • The JTAG interface goes through a number of pins on the 100 way Liberator connector • I used the LART/BLOB design, but added TRST and a signal to hold the WP# pin high to allow unlocking of the boot sectors • Ported the JFlash program to work with the Puppeteer – Requires knowledge of JTAG BSR chain components and flash drivers

JTAG Programming • Once you get used to it, JTAG programming is pretty straight

JTAG Programming • Once you get used to it, JTAG programming is pretty straight forward – You need to know what is in your JTAG BSR chain and its order • The BSR is the size of the device + the bypass bits of the other chips – You need to know what commands are supported and the command word size of the device • Bypass for the Xilinx chip is 1111, Altera 111, Strong. ARM 11111 – You then feed instructions into the devices’ TAP controllers and read back the results

TAP Strong. ARM SA 1110 CPU TAP Alterabypass FLEX 6000 FPGA TAP Xilinxbypass XCR

TAP Strong. ARM SA 1110 CPU TAP Alterabypass FLEX 6000 FPGA TAP Xilinxbypass XCR 3064 A CPLD JTAG socket Puppeteer JTAG BSR Chain 294 bits Strong. ARM TAP Into IR mode Go into EXTEST Pump in data Shift DR (Pump out data) Execute instruction Update DR HOST JTAG APP Set up BSR chain bits Pump out on parallel port Read parallel port data Decide what next instruction

JTAG Programming • As the Strong. ARM does support JTAG debugging we are using

JTAG Programming • As the Strong. ARM does support JTAG debugging we are using it as a Flash blower – Could Strong. ARM JTAG debug? • The specific Flash chips need JTAG drivers porting • Connect the cable, put other devices into BYPASS mode, put the SA 1110 into IR (instruction) mode, load the data, execute the command read the results – BTW it comes out 1 cycle later, backwards and embedded in a 294 bit string! – Enjoy