A post by Nick G4TAI on the OARC forums about a boot sale find, turned into a few discussions about it as he was wondering how it worked and if it would be possible to change the frequencies. It was on the old 1980’s 144Mhz frequencies. A few discussions later and I agreed, for a few beer coins, to take it and see what I could find out as a little interesting project (I have always wanted to know how things work inside the box, from a young age).

The 144 PK is a 4 channel ~5w 2meter transceiver made specifically for packet. It has no speaker, no RX light, just a TX light and some adjustment pots and a 4 channel switch.

From the pictures Nick had posted online, it was already thought that an EPROM was at the heart of the controls. It had a few other chips on-board that were of interested.

• NJ88C22 - Frequency Synthesiser with resettable counters
• HEF4040 - 12-stage binary ripple counter
• CD4001 – 2 input OR gate x 4
• CD4070 – 2 input NOR gate X 4

The 4 channel switch is wired directly to some of the EPROM address lines, which Nick had already put to his multimeter.

Once in my hands ( a 400mile round trip back to my old QTH location, having just moved, which is coincidentally where Nick lives and I just happened to be there to visit family) and with all this information, it quickly lead me to work out that the binary counter driving the EPROM address lines and driving the synthesiser to setup the frequencies. What I didn’t know, is how.

I removed the EPROM and dumped it and noticed some very repeated patterns.

eprom.zip

The next phase was to trace out the digital circuit around the EPROM and these other chips to understand what was happening. This is where things started to get less straight forward (this was a quick dump of tracing things. Most are surface mount and dont have any silkscreen identifiers).

Some points I noted about the circuit:

• The address lines from the ripple counter are not in order to the EPROM address lines
• The EPROM was clocked via the RC NOR gate oscillator
• This oscillator could be stopped by D7 of the EPROM going HIGH
• The reset circuit was triggered each time the channel switch position was changed, which would start the counter again from zero

After working all the connections out, and reading the NJ88 datasheet, I knew I was looking for a 28 bit configuration string. To help me work it out, I wrote a quick C program to read the EPROM according to the set address lines.

The output was like this:

Count:    0 | 0000011110011 Addr: 00F3 | 0025 | 00100101 | Data: 0 | Clock: 1 | Enable: 0
Count:    1 | 0010011110011 Addr: 04F3 | 0025 | 00100101 | Data: 0 | Clock: 1 | Enable: 0
Count:    2 | 0000111110011 Addr: 01F3 | 0025 | 00100101 | Data: 0 | Clock: 1 | Enable: 0
Count:    3 | 0010111110011 Addr: 05F3 | 0065 | 01100101 | Data: 0 | Clock: 1 | Enable: 1
Count:    4 | 0001011110011 Addr: 02F3 | 0065 | 01100101 | Data: 0 | Clock: 1 | Enable: 1
Count:    5 | 0011011110011 Addr: 06F3 | 0045 | 01000101 | Data: 0 | Clock: 0 | Enable: 1
Count:    6 | 0001111110011 Addr: 03F3 | 0065 | 01100101 | Data: 0 | Clock: 1 | Enable: 1
Count:    7 | 0011111110011 Addr: 07F3 | 0045 | 01000101 | Data: 0 | Clock: 0 | Enable: 1
Count:    8 | 0100011110011 Addr: 08F3 | 007D | 01111101 | Data: 1 | Clock: 1 | Enable: 1
Count:    9 | 0110011110011 Addr: 0CF3 | 005D | 01011101 | Data: 1 | Clock: 0 | Enable: 1
Count:   10 | 0100111110011 Addr: 09F3 | 007D | 01111101 | Data: 1 | Clock: 1 | Enable: 1
Count:   11 | 0110111110011 Addr: 0DF3 | 005D | 01011101 | Data: 1 | Clock: 0 | Enable: 1
SNIP…

The enable line goes high after 4 counts and then the data is set followed by the clock pulses. The data appears to be set as the clock is high and the NJ88 clocks this in on low. So the data is present for 2 bytes.

The total 28 bytes sent were calculated as 0001110000100110100011001000 or 0x1C268C8.

Working backwards from the datasheet, this worked out as a frequency of 123.850. Oh dear , that’s not right, it was suppose to be 145.250 !

During this time, I had reached out to the company that had bought W&D when it sold up, to enquire if they had any information regarding this unit. To my surprise, I got a quick and helpful reply. They had nothing for me but did reach out to Mr Wood to see if he had anything. That didn’t come to anything but they did suggest contacting the engineer who originally designed it. That turned into quite a few back and forward emails, reminiscing over the design. Alas, no paperwork, as W&D kept things quite tight with their intellectual property.

What I did get back was this:

From my recollection, Bipolar front end (LC filters) into a dual gat MOSFET mixer and a conventional superhet IF stip.
TX was all bipolar using TO39 cased RF PA parts
PLL was an NJ8822 with an external dual modulus prescaler.
As far as I can remember, the EPROM was part of the state machine generating the SPI for the PLL, status flags and parts of the TX/RX timing.

Looking over the circuit I noticed that I’d missed a piece of the circuit where PTT linked to part of the reset circuit. On closer inspection of the EPROM, this switched A7 and enabled a split RX/TX frequency to be programmed in and at same time, initiated a reset to the counter chip, therefore resetting the EPROM and lowering A7, starting the binary counter and sending another 28 byte sequence. In the EPROM data, it was obvious that after each block of data (64 bytes), there was an 0xA4 which set bit 7 high, stopping the clock after all the data was sent.

I modified my C program to account for the PTT line changes and found that on TX the frequencies were correct but at RX they were low. But they were all low by 21.4Mhz, which sounded very much like a standard IF frequency! So that answered that, phew! At this point, I was confident that I could change the data for a frequency I wanted. A quick modification to the C program made a new EPROM image and I was ready to test. On the bench, I plugged it into the dummy load and tested the channels according to what I had calculated from the EPROM image. They were all wrong

So I double checked the switch connections and EPROM data lines and found that there was a jumper, JP5, that pulls A2 and A3 to ground if bridged, which it was. So I adjusted the address lines in the program and re-ran it and the frequencies matched, wahoo! With the new found addresses, I wrote a new EPROM image. I only had a 27c256 to hand and so I wrote it to both 128k sections. Pulled it out of the programmer and plugged pushed it into the socket on the board. I tentatively powered it up, watching for magic smoke, which there wasn’t any, thankfully!

With a jumper wire for activating PTT, I had the H/H set to 144.950Mhz and went for it. And it only went and bloody worked! I quickly connected a set of headphones to the audio out and repeated the test from H/H to 144 PK on RX and it was working as well. JOB DONE! Well, not quite. I wanted to test it on packet, after all, that’s what it was designed for! So I unplugged my Motorola GM350 from the NinoTNC and plugged in the 144PK with the lead that came with it (5 pin DIN to standard 9pin TNC connector, as used by Kantronics and the standard that the Nino also uses).

“C MB7NSC” I wrote at the node prompt. The TX light lit and the H/H screeched and “Connected to MB7NSC” appeared. It connected and on 5watts, over 63kms. Wow, impressive. I did a few more test over the air, getting nodes lists, going to GB7IOW and posting on this wall there etc

(07-Jul 17:32) < G7TAJ > Testing using 144PK Wood&Douglas TcRX with modified frequencies

Over all, it worked really really well and when I plugged in my GM350, reverting my station to it’s normal configuration, and tested the connection to MSC to make sure thing were still OK after the re-wire, it was having trouble decoding it. So the 144PK may have a better front end that the GM ! Time for a TAIT ?

• I need to check the on-air signal and bandwidth with an SDR.
• The EPROM drives another output, which is an OP-AMP, I think. I have yet to trace this part of the circuit. Looking at the EPROM data, it only drives this while the 28 bits are being clocked into the NJ8822, so it is probable something to kick / lock the PLL or something. If I get time I will look into that.
• The frequency of the EPROM clocking would be nice to know. My scope is in one of a million cardboard boxes from the house move, so I have no idea what its running at. The resistors are 223’s, so 22k. The capacitor is something I can’t measure. This would enable me to determine the startup timing from RX to TX and visa-versa. This may be <10ms or maybe far more, which wont make much difference at 1200baud (as my tests works just fine with no change on my normal TXDelays etc) but it might at a higher rate.
• Its programmed for 25khz. I can change this to the NJ8822 but the front end will no doubt be hardware LC filtered for that. More investigation needed
• What is the audio path like for 3600 or 9600 ? I think it’s going to be restricted and may need some modification.