Next Steps

What is done

The investigative groundwork is complete. We have identified every major IC on the board, decoded the firmware update mechanism from Renesas application notes and D2Audio datasheets, diagnosed the physical failure (vented capacitor C62), and backed up the DSP firmware from the EEPROM.

EEPROM dump: The AT24C512 at U6 has been read and verified (SHA-256 confirmed across two reads). The 17,049-byte DSP firmware image is not encrypted — we identified biquad filter coefficients including the subwoofer crossover, subsonic protection filters, and parametric EQ stages.
Boot mode mechanism: Decoded from the D2-1 Family datasheet. OPERATE mode uses BMS=0111 (self-boot from EEPROM at 384 kb/s). UPDATE mode uses BMS=1100 (I2C slave at address 0x44, host pushes firmware).
JTAG diagnosis: The NOYITO 2.0mm-to-2.54mm adapter is scrambling the pin mapping. The LPC2103F LQFP48 JTAG pinout has been verified against the NXP datasheet and the Olimex LPC-H2103 reference schematic.
D2Audio tooling: Audio Canvas III, the OEM development tool, is restricted to licensed customers under NDA. No public source exists for firmware images or the EEPROM boot format specification.

Cap replacement

Replacement capacitors have arrived. C62 (220uF 25V, vented electrolytic) and three suspect 1000uF neighbors on the ±15V rails need to be replaced before the amp can be powered on. See the Cap Replacement page for details.

After power-on

Once the caps are in and the amp powers up cleanly:

Serial console

Connect to /dev/ttyUSB3 (the CP2104 USB-to-UART bridge) at 115200 8N1 with the UPDATE/OPERATE switch in the OPERATE position. The LPC2103F may output diagnostic information, a boot banner, or a serial console prompt during normal startup.

Then switch to UPDATE mode and power cycle. The LPC2103F’s ISP bootloader should activate — send a ? character and watch for the Synchronized response. The open-source tool lpc21isp speaks this protocol and can read the chip’s part ID and flash contents.

JTAG: buzz out the header

With a multimeter in continuity mode, map each of the 10 header pins against the LPC2103F’s LQFP48 pads. Start with ground (MCU pin 7), then probe for TRST (pin 8), TMS (pin 9), TCK (pin 10), TDI (pin 15), TDO (pin 16), and nRESET (pin 6). See the JTAG Investigation page for the full verified pinout and buzzing procedure.

Dump the flash

Once the JTAG header is mapped and direct-wired to the DAP-Link probe (bypassing the NOYITO adapter), use OpenOCD to halt the ARM7TDMI core and dump the 32KB flash. This is the single most valuable step in the entire investigation — the LPC2103F firmware contains:

The serial protocol for firmware updates (what the dealer tool sends over USB)
The I2C command format for controlling the D2-81431
The EEPROM image structure and writing procedure
The menu system and UI logic
The boot mode switching sequence

Reverse engineer the firmware

ARM7TDMI disassembly of the flash dump to find:

UART command parser (the protocol the dealer update tool speaks)
I2C write sequences to the D2-81431
Boot mode switching logic (how BMS[3:0] is manipulated)
Parameter mapping (which I2C writes correspond to which menu settings)

Contact Episode support

Call Episode Technical Support at 866-838-5052 and ask directly about firmware updates via USB for the EA-AMP-SUB-1D-500R. The 2024 Rev B manual changed the UPDATE switch description from “future use” to “firmware update use only,” which confirms the capability exists even though the procedure is not public.

Check current firmware version

The current firmware version is accessible through the front panel menu under FACTORY RESET. Navigate into that menu item to see the version string (the manual shows V1.03), but do not confirm the reset. This establishes a baseline before any update attempts.