How to capture boundary scan information from a BGA-packaged IC -

How to capture boundary scan information from a BGA-packaged IC

It’s an engineers worst case scenario – you spend countless late nights trying to complete that board design to beat an impossible deadline, rush it off to the fab shop, get it back, plug it in and what do you get, Nothing. And wouldn’t you know it, the signals you need to see are buried under the Ball Grid Array (BGA). Now what do you do?

If we could just peel back the BGA cover and take a peek under it, there would be no problem. But we can’t so we need to find other options.

X-Rays are an option, but it only gives you a static picture of the solder joint, not a dynamic electrical one that tells you for a fact that you have connectivity. I’ve actually taken a board to a machine shop to have a tiny precision hole drilled in the back of the board to get access to a BGA ball so I could prove to an FAE that his part was not functioning properly (embarrassing but true and even worse – his part was fine).

You can replace the BGA and hope the problem goes away. This is usually an expensive and time-consuming option with very low yield.

Traditional Boundary Scan is an option, but that usually requires some expensive tools and the creation of test vectors and test executives which can take quite a while, depending on the stability and accuracy of your design documentation. And the results are not dynamic – they are usually a summary of issues found with the board.

The good news is there is a new option that is quick, easy, inexpensive and best of all; it probably already exists in your design! It is the boundary scan capability built into most current generation ICs with JTAG pins. You just need to learn how to take advantage of it.

The bottom line is to find out if a signal is connected to the part under the BGA. It could be a clock, an address line, a data bus, etc. – it doesn’t matter. Most of the time we just want to know if it is high, low or toggling and if we have continuity.

By using the boundary scan built into in your IC(s) in a non-traditional manner, you can do just that. The concept is simple – you tell the IC(s) to capture the state of all the pins and shift it out via the boundary scan chain over and over again and display it on your PC screen. The user sees a great dynamic indication of activity on every scan-enabled pin under the BGA.

You can now “see” if the oscillator is connected to pin G17 or what the address or data busses are doing – all in real time, all at a glance, and all without touching the board. And the best part of this technique is the circuit doesn’t know you are doing it – it is completely transparent to the operation of the circuit. Your application can run at full speed and it will never know you are monitoring every pin on the part.

Figure One below is an example of a new commercially available tool that uses this technique. Here you can see every pin on every part in the JTAG chain. Each pin is color coded to show high/low status or toggling between two colors to indicate activity. It’s very intuitive, easy to use and only takes a few seconds to setup and run since there are no test vectors or test executives to create.

You can also command each device into a mode called EXTEST that allows you to take complete control over each and every pin on the device. This allows you to drive the address bus, or toggle a line to a connector or an LED to see if you have connectivity all with a simple click of the mouse.

The Details: How to capture the pin information
Almost every IC with a JTAG port will have boundary scan built in. This is nothing more than a giant shift register around the boundary of the part and a state machine to control the behavior of the shift register. Each register bit in the boundary register captures or control some aspect of one of the pins on the device. If the bit is a buffer enable it may control several pins.

You simply tell the state machine to capture the state of every pin into the boundary register, and then shift everything out the JTAG port. Do this over and over again and display the results on the screen and you have an indication of what every pin on every part in the chain is doing in real time!

There are typically 300 to 400 bits in one of these registers for a typical FPGA or processor. The definition of what each bit in the register represents is found in the BSDL file (BSDL = Boundary Scan Description Language). This is a free file you can download off of the IC vendor website that describes in great detail exactly what each cell in the boundary scan chain does and how it relates to the physical pins.

You will see in the BSDL file that there are typically three scan cells associated with each pin in a device: one to capture/control the signals coming IN the device, one to capture/control signals going OUT of the device and one to capture/control the output buffer enable. If the pin is a dedicated INPUT then it would only have a single scan cell, of course.

The interface is just 4 wires: Test Data In (TDI), Test Data Out (TDO), Test Clock(TCK), and Test Mode Select (TMS). The TCK is the asynchronous clock used to clock data in the TDI pin while data comes out the TDO pin. The TMS pin is used to transition the TAP controller state machine.

If you want to take control of a pin and shift data into the part that will appear on the pins, you just enter a command to the state machine (also called the TAP controller) for the part to go into EXTEST. Now every bit you put in the shift register is applied to its respective pin.

The advantages of this approach are that BSDL file is free, the boundary scan circuitry is already built into the JTAG parts, and the details of accessing the JTAG state machine (called the TAP controller) are well documented in IEEE1149.1 and on many websites. The downside is that it does require time and effort to implement. But new tools are available that can further simplify the process.

Virtual LEDs and Switches can be attached to the pins on your BGA to help you monitor and control the signals under test and a script recorder allows the developer to create simple test scripts that include loops and user prompts and queries.

The script is stored in an industry standard SVF file that can be played back in JSCAB or on any SVF player. This allows you to test multiple boards very quickly and know instantly which boards are not behaving.

Craig Haller is the chief engineer at Macraigor Systems LLC and has been supplying tools to, and consulting with, the embedded debug market for 15 years.

Leave a Reply

This site uses Akismet to reduce spam. Learn how your comment data is processed.