[1][2] The boundary scan architecture provides a means to test interconnects (including clusters of logic, memories, etc.)
These cells are then connected together to form the external boundary scan shift register (BSR), and combined with JTAG Test Access Port (TAP) controller support comprising four (or sometimes more) additional pins plus control circuitry.
On-chip debugging solutions are heavy users of such internal scan chains.
Overhead for this additional logic is minimal, and generally is well worth the price to enable efficient testing at the board level.
Once a complete data word has been shifted into the circuit under test, it can be latched into place so it drives external signals.
The path creates a virtual access capability that circumvents the normal inputs and provides direct control of the device and detailed visibility at its outputs.
[3] The contents of the boundary scan are usually described by the manufacturer using a part-specific BSDL file.
Among other things, a BSDL file will describe each digital signal exposed through pin or ball (depending on the chip packaging) exposed in the boundary scan, as part of its definition of the Boundary Scan Register (BSR).
There are JTAG instructions to SAMPLE the data in that boundary scan register, or PRELOAD it with values.
A JTAG Test Access Port (TAP) can be turned into a low-speed logic analyzer.