Firmware Update Mechanism

The EA-AMP-SUB-1D-500R has two processors with two independent firmware images, updated through two separate mechanisms. The firmware analysis clarified the exact boundary between them — and corrected several assumptions from the earlier architecture research.

Correction from firmware analysis

The original version of this page described the UPDATE switch as activating ISP mode on the LPC2103F. That was wrong. The UPDATE switch controls only the D2-81431’s BMS[3:0] boot mode pins. The LPC2103F enters ISP mode through JP24 (P0.14 LOW during reset). The application firmware contains no update logic whatsoever — UART0 is TX-only and there is no code to receive data, parse commands, or write flash. Everything described below has been corrected to match the firmware-confirmed behavior.

Path 1: LPC2103F MCU firmware (via ROM ISP bootloader)

The LPC2103F’s 32 KB on-chip flash is updated through the chip’s factory-programmed ISP bootloader, stored in a protected ROM region at 0x7FFFE000. This bootloader is completely independent of the application firmware — it is silicon-level code baked in by NXP at the factory.

Entry mechanism: Jumper JP24 pulls P0.14 LOW. When the MCU resets (power cycle), the boot ROM checks P0.14 before transferring control to application code. If P0.14 is LOW, the ROM enters ISP mode on UART0 at 115200 baud, 8N1. The application firmware never runs.

Protocol: The ISP bootloader speaks NXP’s documented serial protocol. It begins with auto-baud synchronization (the host sends ”?” until the bootloader responds with “Synchronized”), then accepts commands to read, erase, and write flash sectors. The open-source tool lpc21isp handles the complete protocol.

Data path:

USB → CP2104 → UART0 → LPC2103F ROM ISP bootloader → on-chip flash

The application firmware is not involved at any point. The ROM bootloader has direct access to the flash controller and performs the erase/write operations itself.

Path 2: D2-81431 DSP firmware (via EEPROM)

The D2-81431 has no internal non-volatile memory. It boots entirely from an external Atmel AT24C512 I2C EEPROM (U6 on the board). Updating the DSP firmware means rewriting this EEPROM.

Normal boot: OPERATE mode

During normal power-on with the rear-panel switch in OPERATE position, the BMS[3:0] pin strapping on the D2-81431 is set to 0111 (Boot Mode 7). This configures the chip as an I2C master at 384 kb/s on its dedicated GPIO port — SCL on GPIO7, SDA on GPIO6 — where it reads its entire firmware image from the AT24C512 EEPROM autonomously. The LPC2103F releases nRESET, and the D2-81431 handles everything from there: loading DSP coefficient tables, filter configurations, protection parameters, and program code from the EEPROM into internal memory.

Once booted, the LPC2103F communicates runtime parameter changes (volume, EQ, crossover) via the separate control I2C bus at address 0xB2. This is the steady-state architecture: the D2-81431 runs autonomously from its EEPROM image, and the LPC2103F sends adjustments as the user interacts with the menu.

DSP update: UPDATE mode

Flipping the rear-panel switch to UPDATE changes the BMS[3:0] strapping to 1100 (Boot Mode C). Instead of self-booting from EEPROM, the D2-81431 becomes an I2C slave at address 0x44 and waits for an external master to push firmware into it.

The update procedure, reconstructed from Renesas application note R32AN0006, proceeds in a carefully sequenced set of steps. The LPC2103F asserts nRESET, holds it briefly, and deasserts it. After the 2.4 ms tEXTbootRDY delay for the D2-81431’s boot ROM to initialize in slave mode, the LPC2103F writes a bootloader image — a small hex file — to the D2-81431 at I2C address 0x88. This loads a temporary bootloader program into the D2-81431’s internal RAM. The bootloader is not the final firmware; it is a utility whose sole purpose is to act as a bridge between the I2C control bus and the EEPROM.

With the bootloader running in RAM, the LPC2103F then writes the full firmware image to the D2-81431 at I2C address 0xB2. The bootloader in RAM receives this data and writes it through to the Atmel EEPROM on GPIO6/GPIO7. After another 200 ms wait for the EEPROM write cycle to complete, the LPC2103F asserts nRESET again and the switch returns to OPERATE, setting BMS[3:0] back to 0111 and commanding the D2-81431 to boot from the freshly written EEPROM image.

Two independent paths

The critical insight from the firmware analysis is that these two update paths are independent, not orchestrated. The original theory was that the LPC2103F application firmware contained update logic — receiving data over UART, then relaying it to the D2-81431 via I2C. The firmware proves this is not the case. UART0 is TX-only. There is no receive handler, no command parser, no flash write code, and no EEPROM relay logic in the application firmware.

This means:

• MCU updates go through the ROM ISP bootloader (JP24 + power cycle), completely bypassing the application firmware
• DSP updates require the LPC2103F application firmware to be running (to perform the I2C relay sequence), but the trigger mechanism and data source are still unknown

The dealer update tool likely handles both paths as separate operations: first, it uses the ISP protocol to flash a new MCU image (which may contain updated DSP relay logic), then it commands the newly-flashed MCU to perform the DSP EEPROM update. But the exact protocol for the second step remains undocumented — the V1.19 firmware we dumped contains no code for receiving DSP images over UART.

Where does the DSP update code live?

One possibility is that the dealer tool flashes a special-purpose MCU firmware that contains the UART-to-I2C relay logic, performs the DSP EEPROM update, and then reflashes the normal application firmware. This would explain why the production firmware has no update code — it was never meant to. The update firmware would be a separate binary, loaded temporarily via ISP, used once, and then replaced with the application firmware.

The firmware images for the D2-81431 are generated with D2Audio’s “Audio Canvas” OEM tool, a Windows application that was distributed only to licensed customers of D2Audio (later Intersil, now Renesas). There is no public source for these images, no download on the SnapAV support portal, and no documentation of the dealer tool’s protocol. The update capability was built into the hardware from day one — the USB port and UPDATE switch have been on the rear panel since 2015 — but Episode kept the tooling strictly within the dealer channel.