Harman Kardon Allure Teardown

by 11 min read #teardown #hardware #electronics

Contents

This is part 1 of three posts about the Harman Kardon Allure: the hardware. Part 2 covers allure-os, the firmware I wrote for it, and part 3 the open-source release of software and boards.

Introduction#

The Harman Kardon Allure has aged well; its software has not. Everything that makes the speaker “smart” sits on one plug-in module running a LinkPlay firmware from 2019, while the amplifiers, the DAC, the microphone DSP and the microcontroller for buttons and lights sit on Harman’s own boards. That split is what this project is built on: replace the module with a Raspberry Pi Zero 2 W and keep the rest. This post looks at what is inside and how the parts talk to each other.

The Allure is a smart speaker with Amazon Alexa. Harman unveiled it at IFA in Berlin on 31 August 2017, at $249.95, with sales planned for winter 2017. Harman had become a subsidiary of Samsung Electronics six months earlier, in a deal worth about $8 billion. At CES 2018 a battery-powered sibling followed, the Allure Portable.

The Allure has a translucent body, two light rings, four far-field microphones and a touch-sensitive volume ring. One light ring sits right on top, around the microphones; the second sits under the microphone array and points downward, lighting the translucent dome from inside. Harman’s spec sheet lists:

ItemSpecification
Output power60 W total
Frequency response40 Hz – 20 kHz
Drivers3 × 38 mm, plus a 90 mm subwoofer
Dimensions, weight166 × 166 × 193 mm, 2.5 kg
Power supply19 V, 3 A
Wi-FiIEEE 802.11 a/b/g/n/ac, 2.4 and 5 GHz
Bluetooth4.2, A2DP 1.3, AVRCP 1.5

Setup required Harman’s “HK Alexa Setup” app, and everything after it went through Alexa and the cloud services of LinkPlay and Amazon.

The Allure upside down on a desk, its down-firing woofer facing up, the harman/kardon logo on the translucent body
The Allure upside down, woofer facing up

Teardown#

The Allure opens from the bottom. Under the bottom cover sits the woofer, facing down.

The bottom of the Allure: the woofer surrounded by a black ring with six screw posts and two micro-USB openings
Bottom view
The woofer in its metal ring inside a light blue plastic chassis, with a small board with two micro-USB ports at the top and a board with a DC jack at the bottom
Bottom cover removed

Next to the woofer are two small boards. One carries two micro-USB ports, labeled MIC Test and A88 Upgrade: factory ports for testing the microphones and flashing the A88. The other carries the DC jack and the reset button.

Close-up of a blue board with two micro-USB connectors labeled MIC Test and A88 Upgrade, protection diodes and an LED
Service board with the factory ports
A small board with a DC barrel jack and a tactile switch inside the plastic chassis
DC jack and reset button

The woofer comes out after six screws. Behind it is the woofer chamber of the light blue chassis that the whole speaker is built around.

The woofer lifted out of the chassis on its red and black wires, the magnet facing the camera
Woofer removed
Looking into the chassis from below: cables in foam sleeves, the aluminum heat spreader and the service board
Inside the woofer chamber

With the perforated grille band removed, the mid/high drivers are visible in the sides of the chassis, between aluminum covers.

The light blue chassis with a square mid/high driver and two aluminum covers, standing on the translucent top section, which faces down here
Mid/high driver in the side of the chassis
A square mid/high driver lifted out of the chassis on its wires, the service board above it
Mid/high driver removed

The electronics sit in the translucent top section, above the chassis. To reach them, the chassis comes off the top section with all cables still attached.

Three Allure chassis on a workbench; one lies on its side, opened, with the top section and its cables next to it
Chassis and top section separated
The black inner ring of the top section with foam-wrapped cables, the aluminum heat spreader and the amplifier board inside
Top section opened, seen from below

The top panel is one unit: the touch buttons, the dots of the volume ring, the microphones and the top light ring are all built into this disc.

The opened Allure lying on its side with the boards pulled out; in front, the removed black top panel with a microphone-mute icon, a round action button, plus and minus and a row of volume dots
Top panel removed
The parts of a disassembled Allure on a mat: chassis, top section, the amplifier board with its heat spreader, the A88 module, cables and the service board
A disassembled Allure

Amplifier board#

The amplifier board stands upright in the top section. Its silkscreen names it HK_Allure_AMP_Board. On the front is the TI PCM5121 DAC. Its two channels feed two amplifier channels: one for the woofer, one for the mid/high drivers. The amplifier chips sit under an aluminum heat spreader. The back carries the output filter inductors and the 470 µF supply capacitors.

The amplifier board with the TI PCM5121 DAC, a pin header at the left edge and the aluminum heat spreader screwed on with red threadlocker
Amplifier board with the PCM5121 DAC
The back of the amplifier board with four large output inductors, yellow film capacitors and six 470 µF 25 V electrolytic capacitors
Amplifier board, rear view

Mainboard#

The mainboard lies flat under the top surface, covered with foam. It holds the M.2 slot for the A88, a header for the amplifier board and the cable connectors. On its underside sit the two chips that matter most after the module: the Conexant CX20924 for the microphones and the TI MSP430FR2533 for buttons and light.

The mainboard in the top section, seen from inside: an empty M.2 slot, a pin header and connectors, partly covered with foam
Mainboard with the empty M.2 slot
The underside of the round mainboard: the Conexant CX20924 with its 24 MHz crystal on the left, flat-cable connectors in the middle, the TI MSP430FR2533 with its crystal on the right; a label on the left is blurred
Underside of the mainboard: CX20924 on the left, MSP430FR2533 on the right (label blurred)

The chips#

Conexant CX20924#

Close-up of the Conexant CX20924 in a QFN package with the Conexant logo, an inductor above it and a 24 MHz crystal below right
Conexant CX20924

The CX20924 is the part of the Allure that hears. It belongs to Conexant’s AudioSmart line. Synaptics’ product brief calls it a “4-mic far-field voice input processor” with a dual-core 32-bit DSP and inputs for four PDM microphones. On top of that come noise suppression that Conexant calls Smart Source Pickup, full-duplex echo cancellation, and a Smart Source Locator that estimates the direction of the person speaking, all around the speaker. The chip boots its firmware from its own SPI flash and is controlled over I2C; the processed voice leaves over I2S.

The chip comes from the first wave of Alexa devices. Conexant was one of two suppliers Amazon recommended for far-field microphone kits for the Alexa Voice Service. A 2-microphone kit appeared in December 2016, followed by a 4-microphone kit with the CX20924. That kit was designed to work with Amazon’s Alexa sample project for the Raspberry Pi, and that is where the Linux driver used in part 2 comes from. In June 2017, less than three months before the Allure was announced, Synaptics agreed to buy Conexant for $300 million in cash plus stock; the CX20924 has been a Synaptics product since.

Documentation is another matter. Synaptics publishes a two-page product brief [pdf], but no datasheet: the register map, the command protocol and the boot options are not public. I asked a dozen sellers on Alibaba who listed the CX20924, some with full reels in stock. All of them could sell the chip; none could send a datasheet. The only document that comes close is a datasheet of the 2-microphone CX20921 marked “Conexant Confidential”, which circulates on datasheet sites. Everything else I know about the CX20924 comes from the stock firmware and from measuring the chip itself.

TI PCM5121 and MSP430FR2533#

The two TI parts are well documented. The PCM5121 [pdf] is a stereo DAC with a 106 dB dynamic range, I2S input and I2C control. Its PLL can derive the master clock from the I2S bit clock, so it needs no separate clock line. That matters for the replacement board, because the Raspberry Pi provides none. The DAC can process audio on its own, but only with one fixed process flow from its ROM. Harman’s tuning does not fit into it, so the Allure uses the PCM5121 as a plain converter, and the tuning runs in software on the module (part 2 takes it apart).

Close-up of a TI MSP430FR2533 microcontroller in a VQFN package with a crystal and passive components around it
TI MSP430FR2533 on the underside of the mainboard

The MSP430FR2533 [pdf] is a 16 MHz FRAM microcontroller with TI’s CapTIvate capacitive touch peripheral. In the Allure it reads the touch buttons and the capacitive volume ring, controls the amplifier and drives the LEDs of both rings, and it talks to the module over a UART at 115200 baud.

LinkPlay A88#

LinkPlay Technology was founded in 2014 by engineers from Google, Broadcom, InterVideo and Harman, and it builds streaming modules and their firmware for other audio brands. Today it also sells streamers under its own brand, WiiM. A speaker maker buys the module with Wi-Fi, streaming, multiroom, a phone app and voice assistant support ready to use, and adds its own acoustics, amplifiers and industrial design. For Alexa, LinkPlay went further: according to Amazon, it supplied reference designs, schematics and mobile apps, and acted as the certification proxy that checked a product against Amazon’s acoustic and functional requirements. For the Allure this meant that Harman designed the speaker and LinkPlay supplied its brain.

The A88 is an M.2 card with key A that plugs into the mainboard. Under its shield sit the SoC, which the firmware identifies as an Amlogic A111, the NAND flash and a Wi-Fi and Bluetooth module. It runs Linux and the whole “smart” part: network, Alexa, streaming, the voice pipeline and the control of every other chip. The A111 is the entry-level part of Amlogic’s 2017 audio SoCs: four 32-bit Arm Cortex-A5 cores in 28 nm, with I2S and TDM audio interfaces. That is why everything on the module, Harman’s DSP plugin included, is 32-bit ARM code, while allure-os is a 64-bit (arm64) system; part 2 shows how the plugin still runs. I found no public datasheet for the A111 either.

The A88 module in its M.2 slot on the mainboard, under a metal shield; its labels are blurred
LinkPlay A88 in the speaker (labels blurred)
The back of the A88 module: a NAND flash chip with a date sticker and the solder outline of the shield
LinkPlay A88, rear view with the NAND flash

LinkPlay does not publish documentation for its modules. What made this project possible is a side effect of radio regulation. The A88 contains a Wi-Fi and Bluetooth radio, so it needed an FCC equipment authorization before it could be sold in the US, and LinkPlay filed the module’s specification with it under FCC ID 2ANOG-A88 (WiFiAudio-A88 Specification, Rev 1.5 [pdf]). That document was my only source for the pin names and signal directions of all 67 contacts and for the card itself: M.2 key A, 0.8 mm thick. Without it, the replacement board would have had to be measured from a module that was in use, contact by contact.

The A88’s card edge carries 5 V and ground, two I2C buses, two UARTs, an I2S bus with one input and one output, GPIOs, and USB, SPI, PWM and JTAG signals that the Allure leaves unused. The speaker uses a small subset of them:

SignalConnects
5 V, groundpower for the module
I2Cthe CX20924 at 0x41 and the PCM5121 at 0x4C
UARTthe MSP430
I2S outmusic to the PCM5121
I2S inprocessed microphone signal from the CX20924
GPIOreset and wake-word pins of the CX20924 (the Allure’s CX20924 firmware leaves the wake-word pin unused)

Part 3 shows the signals the Pi carrier uses; allure-boards lists all 67 contacts.

How the parts work together#

On the stock firmware, the A88 does all the thinking and the other chips do the work. I learned most of this from the module’s own flash; part 2 shows how I got it.

  • Music passes Harman’s DSP chain, which runs on the A88 as software, and leaves the module over I2S to the PCM5121. The DSP sums the stereo signal to mono and splits it with a crossover at about 300 Hz: the left channel of the DAC carries the woofer, the right channel the mid/high drivers.
  • Voice reaches the A88 already processed. The CX20924 combines the four microphones into one beam, removes the speaker’s own music with echo cancellation, and sends the result over I2S.
  • Buttons and light go through the MSP430. It sends a short text message for every button press and every step of the volume ring, and it mutes the amplifier on command. It also switches the amplifier off by itself 60 s after a mute. The light rings turned out to be a video stream: the module sends every frame, 99 bytes of RGB for 33 LEDs, up to 25 times per second. The MSP430 itself draws only the volume arc and a fade at start-up.

The viewer below generates frames the way allure-os does: 54 bytes for the top ring around the microphones and 45 for the bottom ring that lights the dome, framed by an 11-byte marker on each side. At 121 bytes every 40 ms that is 3,025 bytes/s, about a quarter of what the 115200-baud UART carries.

Show the frame in hex
One frame as the MSP430 receives it: a start marker, three bytes per LED, an end marker. Effects as generated by allure-os.
The bottom LED ring, a white ring-shaped board with RGB LEDs in front of the opened speaker, the mainboard, the amplifier board under its heat spreader and the DC jack board; a label on the mainboard is blurred
Bottom light ring, removed (label blurred)
Conclusion#
The Allure is well-built hardware with a replaceable brain.
Harman put the amplifiers, the microphone processing, and the buttons and light into chips on its own boards, and bought the smart part, tuning software included, as a module.
Every function of the speaker passes through the module’s card edge over I2C, I2S and a UART, buses a Raspberry Pi Zero 2 W has as well.
A board with the A88’s outline that carries a Pi can take the module’s place, and the speaker’s own chips keep their stock firmware.
That leaves the hard part: knowing exactly what the module said to every chip.
The module was not telling; its flash would not even mount.
Part 2 starts there.
Sources#
The Allure
Conexant CX20924
Texas Instruments
LinkPlay A88
 
cd ~/projects