Teardown
With the USB investigation confirming a UART bridge on the other side of the mini USB port, I opened the chassis to see what we are actually dealing with.
The source of Cameron’s rattle was immediately obvious. A 220uF 16V electrolytic capacitor had vented catastrophically, the entire plastic vent plug separating from the cap body and sitting loose on the chassis floor. Reference designator C62, it sits on the power supply board’s secondary side on the VCC 12V rail feeding control and DSP circuitry. Dried brown electrolyte residue on the cap body confirms a severe venting event. The brand marking reads “Econd,” tracing back to Elecond (ELEKOND) in Sarapul, Russia. Not a name that inspires confidence for a rail feeding sensitive digital logic.
Adjacent to the power supply section, the USB and microcontroller board carries the Silicon Labs CP2104 we already identified from the outside, plus a 2x5 pin header at 2.0mm pitch. That header is an ARM7 JTAG debug connector, the factory programming and debug interface for the board’s main processor.
The MCU is an NXP LPC2103FBD48: an ARM7TDMI-S core at 70MHz, 32KB flash, 8KB SRAM, in LQFP48. This is the system controller. It drives the VFD display, reads the rotary encoder and IR input, manages the menu system, and talks to the audio engine over I2C. The LPC2103F has a built-in ISP bootloader on UART0 that activates when pin P0.14 is held low during reset. That is almost certainly what the UPDATE switch does: tie P0.14 low so power-cycling in UPDATE mode drops the MCU into its ROM bootloader, ready to accept firmware over the CP2104 serial link.
The audio engine is a D2Audio D2-81431-LR in a 128-pin LQFP, a 4-channel Class D controller SoC now under Renesas (D2Audio to Intersil 2009, then Renesas 2017; now end-of-life). Its integrated DSP handles SRC, EQ, crossover, phase, compression, volume, and power limiting, with adaptive feedback that monitors PWM output and speaker current to correct distortion in real time. This explains the amp’s deep feature set — Episode is using one channel of a four-channel DSP.
The D2-81431 has no internal firmware storage. It boots entirely from U6, an Atmel AT24Cxx series I2C EEPROM in an 8-pin SOIC package. This single chip stores all D2Audio firmware, DSP coefficients, EQ presets, and user settings. In normal operation the D2-81431 self-boots from the EEPROM via its dedicated NVM I2C port on GPIO6/GPIO7. During firmware updates, the LPC2103F changes the boot mode pins to make the D2Audio an I2C slave, loads a temporary bootloader into its RAM, then feeds the new firmware image through for the bootloader to write into EEPROM. The full procedure is documented in Renesas application note R32AN0006.
A firmware update on this amp therefore involves two separate images: one for the LPC2103F MCU (delivered via ISP over UART through the USB port) and one for the D2Audio DSP (written to the EEPROM by the LPC2103F acting as an I2C master). The dealer tool, whatever it is, presumably handles both in sequence over the single USB serial connection.