Real-Time Systems Design

1
Real-Time Systems Design

• JTAG testing and programming

2
In Circuit Emulators - ICE

• In Circuit Emulators (ICE) make direct
  connections into the processor slot or into a
  spare test socket
• This allows the developer to completely control
  the machine and, albeit with a few issues around
  timing, to completely emulate the operation of
  the CPU or chip under test.
• The ICE would offer the ability to monitor
  address and data lines, set break points and so
  on.

3
The testing problem

• As microprocessors and other chips have become
  larger and more sophisticated a problem has
  developed with the strategies for testing such
  devices.
• The number of pins (some dont even have pins!)
  or there inaccessibility has made the use of ICE
  either extremely difficult, expensive or
  impossible.

4
New Approaches - BDM

• Motorola recognised this problem and introduced
  with their 68300 range the Background Debugging
  Mode (BDM).
• This 26 pin interface allowed the developers to
  control and monitor the execution of programs
  onto the 68300 boards.
• The developer would run some BDM diagnostic
  software and connect to the board through a host
  PC

5
Joint Test Action Group - JTAG

• Under the auspices of the IEEE, chip
  manufacturers developed a new testing standard,
  JTAG (IEEE 1149.1)
• This incorporated earlier boundary scan tests
  that had been developed for testing printed
  circuit boards.
• Boundary scan allows the engineer to verify that
  the connections on a board are functioning.

6
JTAG

• The JTAG standard uses an internal shift register
  which is built into JTAG compliant devices.
• This, boundary scan register, allows monitoring
  and control of all I/O pins, signals and
  registers
• The interface to JTAG is through a standard PC
  parallel port to a JTAG port on the board to be
  tested.

7
PC
o/p ports
Boundary scan register
TDI data in
IR
0 1 0 1
TAP JTAG Control
Device id
instruction
clock
TCK
mode
TMS
reset
SR
TRST
0 1 0 1
TDO data out
SP
i/p ports
8
Boundary Scan Register

• The BSR is a string of logic cells which permit
  the sampling and driving of pins regardless of
  the devices core state.
• The size of the BSR is dependant upon the pins
  and signals that are being monitored on the
  device.
• For the SA1110 the BSR is 292 bits some device
  are much larger for example FPGAs.
• Many devices can be connected onto the boundary
  scan register making very large bit streams

9
Test Access Port TAP

• The operation of the BSR is controlled by the TAP
  state machine
• This decodes the instructions sent through the
  BSR and decides what actions to take.
• The actions mainly involve loading the BSR cells
  with data, executing the instructions and then
  examining the results.
• The TAP is controlled by the state of TMS

10
(No Transcript)
11
JTAG commands

• The TAP can be put into command mode, where it
  can accept valid JTAG commands, or into shift or
  capture mode
• There are a core set of JTAG commands
• BYPASS, IDCODE, EXTEST, SAMPLE
• For example IDCODE will output an id bit string,
  specific to the device, onto TDO
• Chip manufacturers supplement the core with
  specialised commands for each chip

12
Example usage

• The JTAG interface can be used to install a
  firmware bootstrap onto a board
• JTAG is especially useful, as during this phase
  the board will have no onboard software and wont
  be functioning.
• The BSR data is loaded onto the CPU, and then
  EXTEST mode is executed. This forces the BSR
  data onto the external pins.
• As long as the addresses, data and signal states
  are correct, the developer can do tasks such as
  query the flash chips, erase them, and load data
  in.
• This is a slow process!

13
(No Transcript)
14
Installation using JTAG

• The JTAG interface goes through a number of pins
  on the 100 way Liberator connector
• I used the LART/BLOB design, but added TRST and a
  signal to hold the WP pin high to allow
  unlocking of the boot sectors
• Ported the JFlash program to work with the
  Puppeteer
• Requires knowledge of JTAG BSR chain components
  and flash drivers

15
JTAG Programming

• Once you get used to it, JTAG programming is
  pretty straight forward
• You need to know what is in your JTAG BSR chain
  and its order
• The BSR is the size of the device the bypass
  bits of the other chips
• You need to know what commands are supported and
  the command word size of the device
• Bypass for the Xilinx chip is 1111, Altera 111,
  StrongARM 11111
• You then feed instructions into the devices TAP
  controllers and read back the results

16
Puppeteer JTAG BSR Chain
StrongARM TAP Into IR mode Go into EXTEST Pump in
data Shift DR (Pump out data) Execute instruction
Update DR
HOST JTAG APP Set up BSR chain bits Pump out on
parallel port Read parallel port data Decide
what next instruction
294 bits
17
JTAG Programming

• As the StrongARM does support JTAG debugging we
  are using it as a Flash blower
• Could StrongARM JTAG debug?
• The specific Flash chips need JTAG drivers
  porting
• Connect the cable, put other devices into BYPASS
  mode, put the SA1110 into IR (instruction) mode,
  load the data, execute the command and read the
  results
• BTW it comes out 1 cycle later, backwards and
  embedded in a 294 bit string!
• Enjoy