Remember, these SYNTRX Plus radios are now 25+ years old now!!

Capacitor problems:

https://ntrs.nasa.gov/api/citations/20190001592/downloads/20190001592.pdf

So the 10n ceramic caps with unprotected sides (not encapsulated in epoxy) may be a big problem.
A radio here has, by the look of the case casting been out in the weather for perhaps months. And, may well be why they were on the "throw out" table at the Dural T&T.
The next BIG problem is in programming. Apart from the software issues with DOS and DOSBOX etc. There's the 10n capacitor C414 (2nd part left of the 4MHz xtal) fair across the data line into the micro and has a devastating effect on the waveform at 9600 baud. I chop of the 10n cap and put a 1n5 cap under the board across the diode to the right of the X24C16 chip. I notice, the software for the earlier Pro and before uses 1200 or 2400 baud where the 10n cap is not so serious across the data line.

The WATCHDOG TIMER, pin 1 of the micro, is reset (quiet) when the Rx PLL is locked or an eeprom with no channels, ie. is ready to be programmed, is in. Resets the micro around every 2 secs, plays havock with programming.

Hardware Handshake on the programming cable onthe drawing, no mention of RTS/CTS or CD and they should be!
I've found CTS (5) should be linked to DSR (6) and DTR (20) but CD (8) should be left OPEN. Or for a DB9, 4 to 6 and 8.

The serial port on the computer. USB or, on the motherboard, it must be capable of full-duplex operation WITHOUT framing errors! Hook up your programming cable, do not connect to a radio and run up dosbox-x and SYNPLUS.EXE and watch the error messages from dosbox-x. SYNPLUS.EXE will give "No radio connected". This means, because of the one wire communication systen, the message SYNPLUS.EXE sent was received back. "Framing errors" from dosbox-x will mean problems programming as it shows either the serial port cannot handle simultaneous Tx and Rx or, the radio is responding and the data is clashing with what's being sent by SYNPLUS.EXE meaning your PC speed is too fast or too slow.
I have three USB to Serial adapters here, one FTDI chipset, may be a fake and two PL2303 one is ATTEN brand.
The FTDI chipset on Linux works but will not do the 5bit mode initialised by SYNPLUS.EXE before setting the 9600,8,n,1 mode. One of the PL2303 units occasionally shows the "will not do 5bit mode" error - puzzling.
I fired up my old Pentium P233mmx box with Slackware 8 and DOS 3.10 that also has the Sunshine EPROM programmer from 1985 in an ISA slot. SYNPLUS.EXE runs but will not show in MENU2 F5 "Show PERSONALITY of connected radio". Does better booted from floppy and Win95 DOS.
This PC has a serial port and yes, does "talk" to my Plus radio, but not perfectly - bummer.
I've created a NSW eeprom ie. with CTCSS tone 91.5 Hz set for all frequencies except those actually 123Hz. The radio this is in, has "issues" in that the mute won't close and the Rx audio when fed with a tone either 400Hz or 1KHz at 2KHz deviation wanders up and down in level and goes distorted. And noise shows clear crossover distortion??? Now fixed, leakage around U4d.

Command line options to SYNPLUS.EXE "xtend" and "factory" and COM1 or 2. No "/" is required as was customary for DOS command line switches.

The tone messages from the radio four beeps and a space repeated means Rx PLL is not locked.
You'll notice this same beep when metal objects bump the Rx VCO and a PLL unlock is detected. This can be checked by a sensible voltage on the pad next to the yellow 15nJ100 capacitor in the VCO area.


My advice, get a Minipro TL866 "Universal Programmer" which can read and write the X24C16 eeprom. The X24C16 eeprom can take 100,000 reprogrammings according to the data sheet.
It's noted, before removing or replacing the X24C16 chip, short out the 5VC power on pin 40 of the micro. Though I've noted, it doesn't stay above 1V for more than about five secs after removal of the 12V power.

M170 to Plus changes take the bottom cover off and for the M170 you will find a drill hole under the micro, not visable from topside as it's under a plastic bridge of the 40pin CPU socket. It opens the data line which is pulled high by R425. A solder blob shorting pin 6 of the 40way row of holes is an indication, this is a converted radio. If converted, check the drill hole doesn't cut the track and thus the other end of the track is left open.

The MC68HC705C8P CPU firmware versions I have five. Three OC16W and two 5102105D01 dated 9246 and another dated 9232.
Of the three OC16W chips, two were 5165761A02and one 5102105D01. I've had lots of trouble with 5102105D01, two channels works, three and it goes haywire??

=========== EEPROM files read from the threee radios from Dural T&T =====
bash-5.0$ hd -c x24c16a490.rom
000000  02  00  00  00  00  00  00  00  00  00  00  00  00  00  00  00
000010  00  01  37  00  00  00  00  00  00  00  00  00  00  00  00  00
000020  00  00  00  00  00  00  00  08  44  4d  53  43  03  80  03  07             844MSC0380
        \0  \0  \0  \0  \0  \0  \0  \b   D   M   S   C 003 200 003  \a <- Serial # NNNLLLNNNN
000030  0c  03  61  00  00  00  00  00  00  00  00  00  00  00  fd  9a <- checksum??
000040  00  d1  86  c0  01  a3  0d  80  03  12  03  14  00  5e  03  0f
000050  01  45  03  18  03  0a  00  fc  30  0f  0f  09  fa  5b  23  12
000060  51  e1  e5  11  36  06  0a  1a  23  12  82  e1  e5  11  32  36

===========
bash-5.0$ hd -c x24c16b.rom
000000  02  00  41  54  54  33  34  57  42  41  37  47  32  32  42  4b
       002  \0   A   T   T   3   4   W   B   A   7   G   2   2   B   K <- Model number as text
000010  00  01  06  00  00  00  00  00  00  00  00  00  00  00  00  00 <- Model 06
000020  00  00  00  00  00  00  00  08  44  4d  54  4c  09  00  02  05
        \0  \0  \0  \0  \0  \0  \0  \b   D   M   T   L  \t  \0 002 005 <- s/n 844MTL0900
000030  1e  06  5d  00  00  00  00  00  00  00  00  00  00  00  fa  94
000040  00  d1  86  c0  01  a3  0d  80  04  48  04  48  00  5e  04  45
000050  01  2c  03  18  03  0a  01  c0  32  0f  00  00  fa  22  43  11
000060  72  01  98  71  1e  3c  08  82  43  11  72  11  98  71  1e  3d

===========
bash-5.0$ hd -c x24c16ham70.rom    90 channels (0x50), scan groups etc..
000000  02  00  00  00  00  00  00  00  00  00  00  00  00  00  00  00 <- Blank model info
000010  00  01  15  00  00  00  00  00  00  00  00  00  00  00  00  00 <- When 15 read by SYNPLUS shows Low Band
000020  00  00  00  00  00  00  00  08  44  4d  53  53  01  18  03  07 <- Serial # 844MSS0118
        \0  \0  \0  \0  \0  \0  \0  \b   D   M   S   S 001 030 003  \a
000030  04  01  50  00  00  00  00  00  00  00  00  00  00  00  fe  31
000040  ff  22  86  c0  fe  51  0d  80  03  e4  04  3c  00  5e  03  e1
000050  47  5a  18  18  03  14  00  cc  3a  0f  0f  09  f7  3f  83  51
000060  f0  90  00  01  0e  29  09  c3  83  51  f0  a0  00  01  0e  2a
------
==== Scan group, all 90 channels
0003e0  00  00  00  01  0a  01  02  03  04  05  06  07  08  09  0a  0b
0003f0  0c  0d  0e  0f  10  11  12  13  14  15  16  17  18  19  1a  1b
000400  1c  1d  1e  1f  20  21  22  23  24  25  26  27  28  29  2a  2b
000410  2c  2d  2f  30  31  32  33  34  35  36  37  38  39  3a  3b  3c
000420  3d  3e  3f  40  41  42  43  44  45  46  47  48  49  4a  4b  4c
000430  4d  4e  4f  50  51  52  53  55  56  57  58  59  da  ef  f9  08

============
bash-5.0$ hd ZERO440.EES    (just 64 bytes)
000000 01 00 41 54 54 33 34 57 42 41 37 47 32 32 42 4b   ATT34WBA7G22BK UHF 440-480 12.5KHz
000010 00 01 06 00 00 00 00 00 00 00 00 00 00 00 00 00
000020 00 00 00 00 00 00 00 00 00 4e 49 4c 00 00 03 08 <- magic s/no 000NIL0000
000030 03 09 15 00 00 00 00 00 00 00 00 00 00 00 00 00 <- no ckecksum (yet)
000040

===== After SYNPLUS.EXE that now asked for a s/no. eeprom read by Minipro TL866
bash-5.0$ hd zero440.rom
000000 02 00 41 54 54 33 34 57 42 41 37 47 32 32 42 4b
000010 00 01 06 00 00 00 00 00 00 00 00 00 00 00 00 00
000020 00 00 00 00 00 00 00 08 44 41 46 42 00 01 03 08 <- s/no 844AFB0001
000030 15 0a 15 00 00 00 00 00 00 00 00 00 00 00 fb 09 <- checksum
000040 00 ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
000050 ff ff ff ff ff ff ff ff ff ff ff ff e5 1b ff ff
000060 ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff <- channel data starts here??

============

So it looks like one can use simple Linux tools to make blank eeprom files for the radio.
bash$ dd if=file1 of=top bs=1 count=64; dd if=file2.EES of=bot bs=1 skip=64; cat top bot > out_file.EES

Note the magic serial number 000NIL0000 present in the ZERO440.EES file, this causes "SYNPLUS.EXE XTEND" (no "factory") to ask for serial number when doing F3 Program the Radio.

Note also, the MC68HC705 micro does not use the model info in the eeprom (as far as I know) but SYNPLUS reads it out and uses it in the "calculate" phase, after entering frequency data. So the model number must be correct in the eeprom for SYNPLUS.EXE to read, modify and rewrite.

Success with dosbox-x and MC68HC705 firmware 5165761A02

1) PC, Linux, Fedora 32 Intel(R) Core(TM) i3-8100 CPU @ 3.60GHz
2) dosbox-x 0.83.17 settings 286 CPU 4000 cycles, serial1 directserial realport ttyUSB0.
3) PL2303 serial port.
4) SYNTRX ATT34WBA7G22BK: C414 10n removed and replaced with 1n5 under the board on D481 as it's accessable.

I started with template file 433_125.EES (UHF 12.5KHz) generated by M150 prom generator s/w then "convert.exe" to get an EES file.
Then used in dosbox, SYNPLUS.EXE XTEND, Ver R01.00.06, read in 433_125.EES and added 90 channels all "433.1 ZZ 438.1 cs" and programmed the radio. Then, did F5 "Read PERSONALITY from radio" and it looks good, shows UHF model, 403 to 440 MHz, as I want!
(This has been my main problem, wrong model set in the radio's eeprom. A problem with f/w 5102105D01 ??)


Understanding the synthesizer MC145146 and MC12017 divide by 32 or 33

prompt$ hd 2c432_1_425.rom    <- two channels 432.1 MHz and 431.425 MHz, 12.5KHz channel spacing
000000 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
000010 00 01 d5 00 00 00 00 00 00 00 00 00 00 00 00 00
000020 00 00 00 00 00 00 00 08 44 4d 53 53 01 18 03 08
000030 19 0a 15 00 00 00 00 00 00 00 00 00 00 00 fd 8d
000040 00 d1 86 c0 01 a3 0d 80 00 74 00 74 00 5e 00 71  <- 0d 80 the divisor 0x0d80 14.4 MHz down to (12.5KHz / 3)
000050 01 02 03 18 03 0a 00 c0 32 0f 0f 09 f9 bd c3 a3  <- start of channel info, M & N numbers.
000060 d1 00 00 0a 58 00 00 00 c3 a4 e3 00 00 0a 69 20
000070 00 00 fa 8a ff ff 01 08 ff ff ff ff ff ff ff ff
000080 08 ff ff ff ff ff ff ff ff f0 00 ff ff ff ff ff
000090 ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
*
prompt$ hd 2c480h494.rom    <- two channels 480.0 MHz and 494.0 MHz
000000 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
000010 00 01 05 00 00 00 00 00 00 00 00 00 00 00 00 00
000020 00 00 00 00 00 00 00 08 44 4d 53 53 01 18 03 08
000030 19 0a 15 00 00 00 00 00 00 00 00 00 00 00 fe 5d
000040 ff 22 86 c0 fe 51 0d 80 00 74 00 74 00 5e 00 71
000050 01 02 03 18 03 0a 00 c0 32 0f 0f 09 f8 c2 c3 e3
000060 63 80 00 0a 1c 08 00 00 c3 e3 71 20 00 0a 1c 22
000070 00 00 fa ca ff ff 01 08 ff ff ff ff ff ff ff ff
000080 08 ff ff ff ff ff ff ff ff f0 00 ff ff ff ff ff
000090 ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
*