Boundary Scan Test in Secure Facilities: Running JTAG on Air-Gapped, Access-Controlled Lines

If your boards are tested inside a secure, access-controlled, or air-gapped facility, the boundary scan problem is not the boards — it is everything around them. No internet on the test PC. No cloud license check-in. Often no phone, no USB stick, and no vendor engineer allowed past the badge reader. That rules out a large share of test tools before you ever look at fault coverage. It does not rule out automated boundary scan test. An IEEE 1149.x boundary scan station runs entirely from a locally licensed PC and a USB JTAG controller, which is exactly the shape of tool a controlled area can absorb. This is how to stand one up without fighting your own security policy.

What a Secure Facility Actually Changes About Boundary Scan Test

Very little about the test itself, and almost everything about how the test gets licensed, delivered, and updated. The scan chain does not care where the room is. The TAP still shifts vectors through TDI and TDO, the boundary register still drives and samples pins, and diagnostics still resolve to the pin level. What changes is the supply chain around the tool:

• License validation — anything that phones home to a vendor server on launch will fail on an air-gapped bench, permanently.
• Software delivery — updates arrive by download, which means someone outside the controlled area has to fetch and transfer them under your media-control rules.
• Vendor access — remote screen-share debugging, the fastest way to resolve a stubborn test, may not be permitted at the station itself.
• Data egress — netlists, BSDL files, and diagnostic logs from a controlled program may not be able to leave, which changes who can develop the test.
• Hardware provenance — the controller that sits on the bench becomes an accountable asset, not a cable someone borrows.

Every one of those is solvable. They just have to be solved before the purchase order, not after the equipment is already inside.

Solve the License Question First, Not Last

This is where most controlled-area test projects stall. onTAP Series 4000 is licensed as a perpetual, single-user seat, and the portable license can be embedded in a USB dongle or directly in the onTAP JTAG controller itself. There is no subscription heartbeat and no activation server to reach. The license is a physical object that lives in the room with the board.

The practical consequence is that a test station can be built, sealed, and operated with no network path outward at all. It also means license custody becomes a badge-and-cabinet problem your facility already knows how to solve: the dongle is controlled the way any other accountable item is controlled. If a station moves between labs or between programs, the license moves with the dongle rather than requiring a deactivation and reactivation cycle through a vendor portal.

The onTAP JTAG Controller for Secure Areas

Flynn Systems offers a dedicated USB Dual Channel JTAG Controller for Secure Areas alongside the standard unit. Both are dual-channel controllers with an adjustable TCK rate up to 30 MHz, and both cover the same test and programming workload: JTAG interconnect test, memory and cluster test, flash programming, FPGA, CPLD and PROM configuration, and general-purpose GPIO. Two ribbon cables ship with each. The secure-areas variant is listed at $1,085.75 against $855.00 for the standard controller on the onTAP pricing page — a small delta relative to what a re-badged, re-approved piece of test equipment costs to introduce into a controlled space a second time.

Specify the low-voltage option if your targets sit below the standard 1.8V–5.5V range. On mixed programs that is a common miss: the controller gets ordered, arrives, clears the security review, and then cannot drive a 1.2V core rail without a second procurement cycle. The full onTAP JTAG controller specifications list the voltage ranges, VREF auto-sensing behavior, and adaptor options so the decision happens once.

Getting the Test Program In and the Results Out

Boundary scan splits cleanly into a development step and a run step, and that split is what makes controlled-area deployment workable. Development produces industry-standard Serial Vector Format files. Production runs them. The SVF file, plus any flash programming files, is the entire payload that has to cross into the secure area — a small, reviewable, text-based artifact rather than a live tool connection.

On the way out, an onTAP Manufacturing Test Only (MTO) station signs its reports with part numbers, time stamps, and usernames, and restricts access to the development screen so a released test cannot be quietly edited on the floor. For a program under configuration control, that combination — a fixed SVF, a locked development screen, and signed results — is usually what an auditor is actually asking for.

Where Test Development Should Happen

If your netlist, BSDL set, and schematics can leave the facility, the fastest path is to have the test built outside and delivered as SVF. That is precisely what the FS-ATG test vector generation service and the SVF file generation service exist to do, and it removes the need for a full development seat inside the controlled area at all.

If that data cannot leave, the development license comes inside instead. The onTAP turnkey test development service is still available in a modified form here — Flynn Systems will sign an NDA before quoting, and much of the back-and-forth on jumpers, guards, and device interactions can be handled at the file level rather than over a live screen-share. Teams working this way should expect the debug phase, not the generation phase, to absorb the extra schedule. Our post on why custom test development still matters in automated JTAG testing covers what that hands-on phase involves.

Plan Support Renewals Around the Air Gap

This is the item that quietly bites two years in. onTAP licenses are perpetual, so a lapsed support agreement never stops a station from running. What it stops is access to updates and upgrades, which are distributed by download from the Flynn Systems site — a site an air-gapped test PC by definition cannot reach.

Two habits prevent trouble. First, name someone outside the controlled area as the licensee of record for support, so renewal notices reach a person who can act on them; the onTAP support policy spells out that renewals are keyed to the anniversary of the original license purchase and must be ordered before the current period expires. Second, pull each release when it is published and stage it through your media-transfer process on a schedule, rather than discovering three years of missed updates on the day a new device family shows up on a board.

A Deployment Checklist for a Controlled-Area JTAG Station

1. Confirm the license form factor. Portable license embedded in a USB dongle or in the JTAG controller. No network activation required.
2. Order the correct controller variant. Secure-areas unit, and specify low voltage if any target operates below the standard range.
3. Decide where development happens. Outside the facility if netlists and BSDLs can travel; inside, under NDA, if they cannot.
4. Define the inbound artifact. SVF test files plus flash programming files, version-controlled and reviewable.
5. Define the outbound artifact. Signed MTO reports carrying part number, time stamp, and username.
6. Assign a support renewal owner outside the air gap and set a recurring calendar item ahead of the anniversary date.
7. Schedule an update transfer window so staged software never falls more than one release behind.

Frequently Asked Questions

Does onTAP require an internet connection to run? No. The portable license can be embedded in a USB dongle or in the onTAP JTAG controller, so the test station runs with no outbound network path. Internet access is only needed to download software updates, which can be staged from outside the controlled area.

What is different about the onTAP JTAG Controller for Secure Areas? It is offered as a distinct part for facilities that require it, with the same dual-channel operation, adjustable TCK up to 30 MHz, and test and programming capability as the standard controller. It is listed at $1,085.75 versus $855.00 for the standard unit.

Can Flynn Systems develop our boundary scan test if our netlists cannot leave the facility? Yes, with adjustments. An NDA can be executed before quoting, and where source data genuinely cannot travel, the development license is brought inside instead and support is provided at the file level rather than by live screen-share.

What happens to our test station if the support agreement lapses? Nothing stops. onTAP licenses are perpetual, so tests continue to run. You lose access to software updates, upgrades, and technical support until the agreement is renewed.

How does a test get from engineering into a controlled area? As Serial Vector Format files and flash programming files. Development generates the SVF; the MTO or DLL run-time executes it. Only that compiled artifact needs to cross the boundary.

Build the Station Once, Correctly

Boundary scan is one of the few board-test technologies that genuinely fits inside a secure facility, because the whole tool chain reduces to a licensed PC, a USB controller, and a file. The programs that struggle are the ones that treat licensing, update delivery, and vendor access as afterthoughts and discover the constraint after the equipment is already inside.

Talk it through before you buy. Contact Flynn Systems with your facility constraints and target voltages and we will specify the right controller and license form factor for your environment, or review the full onTAP boundary scan products and services line and current pricing first. If you are still scoping the approach, our comparison of bed-of-nails ICT versus JTAG boundary scan and our look at cutting PCB test cycle time in aerospace and defense low-volume, high-mix production cover the strategy side, and understanding the IEEE 1149.x standards covers the fundamentals your test will be graded against.