Close

Work algorithm

A project log for JTAG Knock-Knock

A device that helps you track wires on a circuit board.

MorriganRMorriganR 05/01/2020 at 18:520 Comments

  This document describes the work algorithm of the JTAG Knock-Knock(Device). All experiments were performed with a G-Sync board containing an Intel Arria V GX . The first few steps do not describe the actual usage of the Device, instead they do explain preparatory steps.

Step 1

  To actually start working, it is needed to determine the placement of the JTAG port on the board. First thought was about two connectors on the end of the board, that has 6 pins each, that is the one we are going to check. With a regular tester it is not difficult to determine which pins in connected to the ground. Unfortunately, it is not enough to deal with other pins. Since it is not the purpose of the Device, JTAGenum was used. Click on the link, in order to find detailed instructions on how to use it and the Arduino sketch code. Connect Arduino to the board to start searching for JTAG pins.

Fig.1 ArduinoEnumPhoto

  After just a few seconds of functioning we see the following result in the terminal:

Fig.2 JTAGEnumTerminal

  The line we need is highlighted with white. That so conformity of JTAF signals and physical pins is found.

pin 1 - TMS
pin 2 - TDI
pin 4 - TDO
pin 5 - TCK

Step 2

  Using the information from the previous step, it is possible to make a cable to connect USB Blaster easily. Now connect the USB Blaster to the board and make sure that the Quartus Programmer sees the FPGA installed on the board.

Fig.3 ProgrammerPhoto

  With Quartus Programmer it is important to delete the configuration stored in flash memory. If you carefully read the documentation on the Intel Arria V GX , you may notice that the BSDL file contains information, that is relevant only for the unconfigured FPGA chip. The warning is given at the beginning and end of the BSDL file .

Fig.4 BlankCheck

  Once again make sure that the flash memory is clean, that so the FPGA will remain unconfigured after the board starts.

Step 3

  Find the BSDL file for the Altera Arria V GX chip, in order to know following information:

attribute INSTRUCTION_LENGTH of ARRIA_V_5AGXMA3DF31 : entity is 10;
attribute BOUNDARY_LENGTH of ARRIA_V_5AGXMA3DF31 : entity is 1488;
...
"SAMPLE (0000000101), "&

  This info can be added directly to the Arduino Code of the Device or entered manually while using the Device with the command "s" - Set SAMPLE Code.

Step 4

  As you can see on photos below Serial USB Terminal for Android is used, though you can use any Serial Terminal, such as PuTTY for Windows/macOS. The Arduino board is connected to the phone with an OTG cable, the speed is given here .

Fig.5 JTAG_Knock_Info

  When everything is connected properly, the command "i" - Info will give us some basic information about the chips connected to the JTAG Chain and display them on the terminal. Check carefully that the received information matches expectations.

Step 5

  At this point, you can try monitoring mode by entering the command "m" - Monitor

Fig.6 JTAG_Knock_MonitorWithoutBlock

  The terminal will show numbers of bits that change in the Boundary scan register. These can be bits that reflect the state of real chip pins, as well as bits of some internal states. It is almost impossible to work with such a flow of information, so it is necessary to block displaying of bits that change without externally affecting the board. This can be done with entering the lock mode using the command "b" - Block.

Fig.7 JTAG_Knock_Block

  After a while, new lines will stop appearing on the screen, this usually takes from 5 to 20 seconds. Then we can see the bit numbers that have been added to the lock register by typing "l" - List in the terminal.

Fig.8 JTAG_Knock_BlockListAndMonitor

  As a result, we have a list of over twenty Boundary scan register bits that are constantly changing. This list of bits can be divided into two groups. First one contain bits, in our case, it is 0, 2, 9, 12, 13, 14, 15, 17, 21, 22, for which the only information, that can be found in the BSDL file is this:

  "0     (BC_4, *, internal, X)," &
  "2     (BC_4, *, internal, X)," &
  "9     (BC_4, *, internal, X)," &
  "12    (BC_4, *, internal, X)," &
  "13    (BC_4, *, internal, 1)," &
  "14    (BC_4, *, internal, X)," &
  "15    (BC_4, *, internal, X)," &
  "17    (BC_4, *, internal, X)," &
  "21    (BC_4, *, internal, X)," &
  "22    (BC_4, *, internal, 1)," &

  Another includes the following bits 591, 627, 639, 642, 651, 663, 675, 687, 699, 714, 735, 747, 777 for which FPGA external pins were found.

  --BSC group 197 for I/O pin H6
  "591   (BC_1, IOH6, input, X)," &
  "592   (BC_1, *, control, 1)," &
  "593   (BC_1, IOH6, output3, X, 592, 1, Z)," &
  ...
  "627   (BC_1, IOF4, input, X)," &
  "639   (BC_1, IOM7, input, X)," &
  "642   (BC_1, IOL6, input, X)," &
  "651   (BC_1, IOJ4, input, X)," &
  "663   (BC_1, IOM6, input, X)," &
  "675   (BC_1, IOJ3, input, X)," &
  "687   (BC_1, ION8, input, X)," &
  "699   (BC_1, IOL4, input, X)," &
  "714   (BC_1, ION9, input, X)," &
  "735   (BC_1, IOR10, input, X)," &
  "747   (BC_1, IOP4, input, X)," &
  "777   (BC_1, IOT4, input, X)," &

  Looking in the BSDL file, we can match the bits we received and external pins, as H6, F4, M7, L6, J4, M6, J3, N8, L4, N9, R10, P4, T4. These can be either clock pins or pins, that is connected to microcontroller MSP430G2553 on the board.

Step 6

  This is the final step, where the main goal is to go through all the pins on the board, in order to find a matching pin of FPGA. Entering monitor mode with command "m" and connecting a special probe pin to external one gives us information about bits on the terminal, which we find in the BSDL file and write down information about pin.

Fig.9 JTAG_Knock_TouchPin

  The information that was found for 1170:

--BSC group 390 for I/O pin AB18
  "1170  (BC_1, IOAB18, input, X)," &
  "1171  (BC_1, *, control, 1)," &
  "1172  (BC_1, IOAB18, output3, X, 1171, 1, Z)," & 
Fig.10 JTAG_Knock_MonitorTouchPin

  After a few hours this process is finally over and as a result we get the file with pinout .

Discussions