B.5.5. Scan chains 1 and 2

The scan chains enable serial access to the core logic and to the EmbeddedICE hardware for programming purposes. Each scan chain cell is simple, and comprises a serial register and a multiplexor. A typical cell is shown in Figure B.4.

Figure B.4. Typical scan chain cell

The scan cells perform three basic functions:

For input cells, the capture stage involves copying the value of the system input to the core into the serial register. During shift, this value is output serially. The value applied to the core from an input cell is either the system input or the contents of the parallel register (loads from the shift register after UPDATE-DR state) under multiplexor control.

For output cells, capture involves placing the value of a core output into the serial register. During shift, this value is serially output as before. The value applied to the system from an output cell is either the core output or the contents of the serial register.

All the control signals for the scan cells are generated internally by the TAP controller. The action of the TAP controller is determined by current instruction and the state of the TAP state machine.

Scan chain 1

The scan chain 1 purpose, bit length, and description is given below:


Scan chain 1 is used for communication between the debugger and the ARM7EJ-S processor. It is used to read and write data, and to scan instructions into the instruction pipeline. The SCAN_N instruction is used to select scan chain 1.


67 bits.

Scan chain 1 allows you to separately access the internal ARM7EJ-S processor data or instruction busses. For data you can access RDATA_D[31:0] when the core is performing a read. This is the same as RDATA[31:0] when accessing data. You can access WDATA[31:0] when the core is performing a write. For instructions, access is available to the RDATA_I[31:0] bus. This is the same as the RDATA[31:0] when performing instruction accesses.

Scan chain 1 also provides access to the control bits, SYSPEED and WPTANDBKPT, there is one additional unused bit that must be zero when writing, and is UNPREDICTABLE when reading.

There are 67 bits in this scan chain, the order being (from serial data in to out):

  1. RDATA_I[31:0].



  4. Unused bit.

  5. RDATA_D[31:0] or WDATA[31:0].

Bit 0 of RDATA or WDATA is therefore the first bit to be shifted out.

Table B.3 shows the bit allocations for scan chain 1.

Table B.3. Scan chain 1 bit order

Bit number






























The two control bits serve the following purposes:

  • While debugging, the value placed in the SYSSPEED control bit determines whether the ARM7EJ-S processor synchronizes back to system speed before executing the instruction. See System speed access for further details.

  • After the ARM7EJ-S processor has entered debug state, the first time SYSSPEED is captured and scanned out, its value tells the debugger whether the core has entered debug state from a breakpoint (SYSSPEED LOW), or a watchpoint (SYSSPEED HIGH). If the instruction directly following one which causes a watchpoint has a breakpoint set on it, then the WPTANDBKPT bit is set. This situation does not affect how to restart the code.

  • For a read the data value taken from the 32 bits in the scan chain allocated for data is used to deliver the RDATA_D[31:0] value to the core.

  • When a write is being performed by the processor the WDATA[31:0] value is returned in the data part of the scanned out value.

Scan chain 2

The scan chain 2 purpose, bit length, scan chain order and operation description is given below:


Scan chain 2 enables access to the EmbeddedICE registers. To do this, scan chain 2 must be selected using the SCAN_N instruction, and then the TAP controller instruction must be changed to INTEST.


38 bits.

Scan chain order

From DBGTDI to DBGTDO. Read/write, register address bits 4 to 0, data values bits 31 to 0.

No action occurs during CAPTURE-DR.

During SHIFT-DR, a data value is shifted into the serial register. Bits 32 to 36 specify the address of the EmbeddedICE register to be accessed.

During UPDATE-DR, this register is either read or written depending on the value of bit 37 (clear is read, set is write).

Copyright ©  2001 ARM Limited. All rights reserved.ARM DDI 0214B