Glossary of terms
(c) Mission Technologies Ltd (MTL) 2004 for the benefit of visitors and customers, copying or reproduction is prohibited without prior permission from MTL or its directors.

Address decode

A function that, in the early days of microprocessors, used to be performed with glue logic off chip, but now generally gets done internally whereby one or more chip select signals are generated to correspond to bus activity within a specific address range.


Originally meaning Acorn RISC Machine, but changed to Advanced RISC Machines when Apple took a 40% stake in the company founded by Acorn Computers.  ARM do not manufacture or sell ICs themselves, but they sell their knowledge (intellectual property) associated with the ARM family of devices: they licence the ability to create ARM processors to third party manufacturers.  The 4MHz ARM2 (the first mass produced RISC processor in the world) was released in 1988 and powered the Acorn Archimedes computer.  This was a desktop machine with stereo sound, high resolution colour graphics that ran software around 50 times faster than the IBM PC of the day. The operating system was RISC-OS, a very high performance graphical windowing system that survives today in embedded and handheld devices.

Acorn held the record for the company that made its directors into millionaires the quickest after being floated on the stock exchange.  ARM is now the worlds number 1 processor (it surpassed Intel in late 2001), and based on market capitalisation, ARM is one of (if not the) biggest electronics companies in the UK.


Asserting a signal means 'to activate it'- and this depends on the polarity of the signal.  An active low signal is one that actions when its signal goes low whereas an active high signal causes its action to occur when it is pulled high. 

So to assert an active low signal means to pull it low (to around 0.8v or less) whilst asserting an active high signal means pulling it high (to around 2.4v or more).

You can often (but not always - for that you should read the datasheet) tell the polarity of signals from their name:
Signal name
Causes a reset when it is pulled low
A high voltage indicates logic high: a low voltage indicates logic low
When low, indicates a read is in process
When high indicates a read, when low indicates a write
A high voltage indicates logic high: a low voltage indicates logic low
When high enables the power supply, when low disables it


Booting is the process by which a CPU turns on with an empty state and starts executing program code (and basically starts to do anything useful).  Most ARM processors boot from memory address 0x0000 0000 and usually on chip select line 0 (often called nCS0 or nGCS0).  This means that immediately after reset, they assert nCS0, set the address bus to output 0x0000 0000 and then assert the output enable line (nRD or nOE).  A flash memory device is usually connected to all of these lines, and it would respond by fetching data from its internal address 0x0000 0000 and placing this on the data bus for the ARM to read.  The ARM accepts this as its first instruction and executes it. 

The process mentioned is the main hardwired response the ARM has following a reset.  Whatever happens after this point is determined solely by what the first instruction was!

The first instruction is usually the first entry in an interrupt vector table and is a branch to some useful code - the bootloader.


Not every system has a bootloader - but most do.  This is similar to the BIOS in your PC: it sets up the processor, the lowest level of peripherals (such as SDRAM memory and similar) and causes the next highest piece of code in the software hierarchy to run.  Often this will be the operating system.  Some bootloaders allow a user (connected via serial port of ethernet for example) to interact with the system to upload new code, run self-tests, or to choose which operating system to execute.

A typical bootloader is written solely (or mostly) in assembly language and occupies less than about 10kbytes of memory, depending on its exact functionality.

The Mission Technologies JTAG flash memory programmer aims to install such a bootloader into the flash memory of your system.

Boundary scan testing

Boundary scan testing is the generic name given to the type of testing that uses a scan chain around the periphery of a device. Popularised the the easy-to-use JTAG standard, this allows the user (tester) to insert known data on the output and input drivers (on the silicon chip) of a device, apply this data to the output buffers and device core respectively and then gather the output of core and input buffer data from the device.  There are two main categories of use in this way:

1. Apply known data to the output pins of a device and then determine their effect on the PCB upon which the device is installed (which may show some logic lines changing state, may display an image on LCD or program an externally connected flash memory!), or apply voltages to the PCB lines going in to a device and then read the logic levels from within the chip corresponding to these lines.
2. Apply known data to the core of an IC and gather the resulting output data.

These applications respectively are external and internal. External tests generally look for faults on the soldering, output drives and peripherals  around a chip whereas  Internal tests generally fall into the debugging software category.  JTAG can (if properly installed by the manufacturer - and ARM and TI both do it properly), do both and more.

Chip Select

A chip select pin is one of a few address decoded enable signals available on modern microprocessors.  These are generally named something like nCS0 or nGCS4 or similar, and will each have a specific (or programmable) address range associated with them.  When writing a program for the processor, and writes or reads issued to/from an address within the range for one of these pins will cause that pin to become active, along with the address bus, read and write signals and data bus (in the case of a write).

Flash memory is usually located on the lowest chip select address (because this corresponds to address 0x0000 0000 and is where you would boot from).

Circuit Diagram

The circuit diagrams in the table below show how flash memory can be connected to an ARM CPU (or in fact any of the JTAG connected CPUs), where the ARM has a 32-bit data bus and the flash is either 8, 16 or 32-bit wide. 

The final diagram is very common: this shows how two 16-bit flash memory devices can be connected in parallel to provide a 32-bit wide connection to the ARM processor.  In this case the address connections are identical to those shown for the 32-bit single device flash memory connection.  Data bus bits D0 to D15 on the ARM connect to D0 to D15 on the first flash memory device, whilst ARM data bus bits D16 to D31 connect to D0 to D15 on the second flash memory device.

It should be noted here that some flash manufacturers and some CPU manufacturers (most notably Texas Instruments) seem to like to confuse the connections beware, and check the data sheet of whatever system you are using.
Connection for 32-bit flash
Connection for 16-bit flash
Connection for 16-bit flash
Connection arrangement for 32-bit wide flash memory to a 32-bit ARM processor
Connection arrangement for 16-bit wide flash memory to a 32-bit ARM processor Connection arrangement for 8-bit wide flash memory to a 32-bit ARM processor
32-bit connection with two 16-bit devices

Connection arrangement for two 16-bit wide flash memory devices to a 32-bit ARM processor

Note the other pins shown: nCE is the chip enable input of the flash memory, driven by the nCS0 chip select output from the ARM processor.  nOE and nWE are the output enable and write enable pins respectively on the flash memory device(s).

In the diagrams above, we can work out the amount of storage each of the flash memory devices.  It is easiest for the 8-bit connection, where we just read from the address bus size that the flash memory contains 2^18 bytes of memory (256kbytes).

In the 16-bit connection diagram, the highest address pin on the flash is again A18, indicating that there are 2^18 locations - but in this case each location is 16-bits (2 bytes), and so it is a 512kbyte flash memory.

For the 32-bit connection with a single device, there are 2^18 locations each containing 4-bytes, and so it is a 1Mbyte flash memory.

For the 32-bit connection provided by two devices, the connections to the CPU are identical to the single device 32-bit case, and so there is 1MByte in total, but this is provided by two devices which must be 512kbytes in size each.  This can be verified - each device has a highest address of A18, so 2^18 locations, each of which is 16-bits wide: 512kbytes.

Flash Memory

Flash memory is often used to store the boot program in an embedded system.  It is a non-volatile memory cell system. An erased flash memory cell has all bits set high.  So if you read blank or freshly-erased flash memory you get (in hex) 0xFF, 0xFFFF or 0xFFFFFFFF depending on whether you did an 8-bit, 16-bit or 32-bit read.

Programming flash memory consists in changing some of those high bits into low bits.  This to program the value 0x00 into an 8-bit flash cell would require toggling every bit whereas programming the value 0xFE only needs a single bit toggled.

Once a memory cell bit is low, it stays low until erased (back to high).  Repeated programming of a flash cell without erasing it will cause the result value to be the bitwise nor of each programmed number in a particular cell.

Reading from flash can be very fast, writing may be slower (and gets worse with age!) but erasing flash memory can be very slow - taking up to a few seconds.  Again it is worse with device ageing.  Erasure is usually only available for an entire device or for entire blocks of flash (blocks can be very large).

Interrupt vector table

A table of instructions usually located at the beginning of memory.  When certain events occur on a processor, the program counter (the register that determines where the next instruction will be read from) will jump to one of the locations in the table.  This is usually hardwired (although sometimes the start address of the table can be set in software).  At that table location is usually another jump to a separate piece of code than handles the event that caused the original jump.

Some examples of events are CPU interrupts, and address errors.

The first entry in the table is the reset vector.  It is at address 0 and is (of course) the first address that gets executed one a processor gets reset or turned on (see booting for more details).


JTAG stands for Joint Test Action Group.  Not very helpful is it!  What we normally know of as JTAG is actually a standard (IEEE1149) version of an established testing method called boundary scan testing.  Having said that, JTAG extends the concept of boundary scan testing by additional 'scanchains' that allow the user connected to the external JTAG port to have access to the internals of the CPU.  Now whilst the boundary scan part of JTAG is fairly standard, the other capabilities are not.  ARM themselves have standard debug blocks that can be part of ARM processors (such as the Debug Communications Channel) but it depends whether the manufacturer/licensee of the particular part you are using chose to include it!  This means that you can do full JTAG debugging with breakpoints, watchpoints and so on in an Atmel AT9xx ARM processor, but you can not do so with an Intel StrongARM!!  Luckily both of these have a boundary scan which can be used to program external flash memory.

The JTAG signals themselves are delivered to the chip as a serial bitstream, and this same bitstream actually loops back from transmit to receive, passing through the CPU on the way.  If you have two CPUs with JTAG ports on the same PCB, it is quite possible for the JTAG path to scan through both of these!

JTAG port

The physical jtag port consists of the following signals:
Test Data In is the data signal supplied from the MTJ01_5 programmer to the JTAG input pin of a CPU
Test Data Out is the output from the CPU to the MTJ01_5 programmer
Test Mode Select is part of the JTAG protocol to determine the function of the TAP
Test Clock is a variable rate clock supplied by the MTJ01_5 programmer to the CPU.  Data on the TDI pin is sampled on the falling edge of this signal, and TDO data is driven on the rising edge.
Test Reset resets the JTAG scanchain to a known position.  On some hardware this also resets the CPU whereas on other hardware it is not used. This is driven by the MTJ01_5 programmer under user control.
*TRST is sometimes written as nTRST.  TAP stands for "Test Access Port" and reflects the fact that the primary driving factor behind the development of JTAG was its use in testing - today it is primarily used for programming and debugging!

The standard JTAG pinout connections for three vendors (ARM, TI and Altera), and adopted by a number of other vendors, are shown in the diagram below which reflects the connections of the MTJ01_5 programmer unit:
JTAG pinouts

Output enable

A control signal to a microprocessor peripheral such as flash memory that causes the device to look at whatever address is present on the address bus, look up the contents of memory at that address and place the value on the data bus.  This signal is known as nOE, or sometimes as read.  Of course most peripherals (including memory) require the chip select signal to be active at the same time otherwise they ignore this control line.  Like most signals of this type, it is active low.

Read signal

The read signal (and the names are given with respect to the controller - a microprocessor or DSP) has the same action as output enable above.  It may be abbreviated as nRD or simply RD.

Write signal

The write signal is a control signal of a microprocessor that tells a peripheral such as flash memory to read the value currently driving the data bus and store it internally at the location determined by the value on the address bus. This signal is known as nWE, nWR or similar.  Of course most peripherals (including memory) require the chip select signal to be active at the same time otherwise they ignore this control line.  Like most signals of this type, it is active low.