Serial Port Probing
With C62 replaced and the amp powering up, I connected the mini USB cable and opened /dev/ttyUSB4 at 115200 8N1 to see what the LPC2103F had to say for itself.
Silence. Complete silence. No boot banner, no command prompt, no error messages, nothing. The modem control lines confirmed the MCU was alive and well — CTS, DSR, and CD all asserted — but the UART was transmitting exactly zero bytes. I tried every obvious approach: sending ? for the ISP auto-baud sync, AT commands, STX/ETX framing, binary sync patterns (0x55, 0xAA 0x55), plain ASCII commands (version, help, CONNECT), and ENQ (0x05). I swept baud rates: 115200, 9600, 38400, 19200. I ran detect_baud_rate across 16 standard rates to see if the MCU was whispering at a frequency I was not tuned to.
Nothing came back. The application firmware is deliberately mute on the UART in OPERATE mode.
The UPDATE switch discovery
Section titled “The UPDATE switch discovery”I flipped the rear panel switch to UPDATE, power-cycled the amp, and expected to land in the LPC2103F’s ISP bootloader. The ISP bootloader in NXP’s LPC2100 series activates when pin P0.14 is held low during reset. If the UPDATE switch connected to P0.14, the MCU would skip the application firmware entirely and enter its ROM-based bootloader, which responds to a ? character with Synchronized\r\n.
The amp came up normally. The VFD lit up, the menu system was fully functional, the rotary encoder worked. The application firmware was running.
This changes everything about how the firmware update works. The UPDATE switch tells the application firmware to listen for a specific dealer tool handshake over the UART. The MCU boots normally, initializes its peripherals, and then checks the switch state. If the switch is in UPDATE position, the firmware enters a receive loop waiting for the right magic bytes from the host.
I tried probing in UPDATE mode as well. More silence. The firmware does not announce itself, does not send a prompt, does not echo. The protocol is entirely host-initiated: the dealer tool must send the correct handshake sequence, and the MCU responds only to that. Without knowing the handshake, the serial port is a one-way mirror.
What the modem lines tell us
Section titled “What the modem lines tell us”Throughout all of this, the CP2104’s modem status lines were consistent:
| Line | State | Meaning |
|---|---|---|
| CTS | Asserted | MCU is powered and UART is initialized |
| DSR | Asserted | MCU is ready for communication |
| CD | Asserted | Active connection (MCU is running) |
| RI | Deasserted | Normal (no ring indicator function) |
The MCU is alive, its UART peripheral is configured, and it is electrically ready to communicate. It simply will not talk until it hears the right words first.
Implications
Section titled “Implications”The ISP bootloader is not the intended update path. The application firmware contains its own update protocol, and the UPDATE switch enables it at the software level. This means the 32KB flash on the LPC2103F contains a UART command parser that we have no documentation for. The only way to determine the protocol is to either find the dealer tool (which has never been publicly released) or dump the MCU’s flash via JTAG and reverse-engineer the command handler from the disassembled ARM7 code.