JTAG TAP State Diagram & Linear Scan Register (2D)

TAP Controller (IEEE 1149.1)

Scan Input

TDI bit fed in on next shift 0

Boundary-scan cells N 8

Instruction / mode

Live State

TAP state

Test-Logic-Reset

TDO out

Shifted

0 / 8

chain: 00000000

How it works

This is a 2D-native rendition of the identical IEEE 1149.1 TAP automaton and shift recurrence as the 3D version — never a flattened camera view of a chip die. The 16-state δ(state, TMS) → state′ machine is drawn here as an actual 2D state-transition graph (the textbook "double-loop" TAP diagram), and the boundary-scan register is drawn as a straight left-to-right strip of N cells instead of a ring wrapped around a die:

for each TCK rising edge, while in Shift-DR:
  TDO       = chain[N-1]
  chain[i]  = chain[i-1]   for i = N-1 … 1
  chain[0]  = TDI

SAMPLE/PRELOAD — Capture-DR loads the chain with the pins' live values; read-only, ideal for passively reverse-engineering a bus.
EXTEST — Capture-DR ignores the pins; whatever pattern you shift in is driven onto the output pins at Update-DR, overriding the chip's own logic — the exact hardware bypass a debug-port attacker uses to force a "secure boot OK" line high or walk a flash chip's bus to dump firmware.

The moving dot on the state graph is the TAP's actual current state; the moving dot on the register strip is the actual bit that just entered on TDI, so both panels show one live automaton from two 2D angles instead of one 3D angle.

Scan cell = 1 Scan cell = 0 Pin driven (EXTEST)