Motorola Radius SM 50/120

Creative Commons License
This work is licensed under a Creative Commons Attribution-ShareAlike 4.0 International License.

The Motorola Radius SM-series radios are discontinued land-mobile radios (FCC Part 90) that are available used for under $50. The VHF models can be converted to work on the 2m band, making them an inexpensive option for a dedicated APRS radio.

This article goes over the features of the radio, what you will need to set it up as a dedicated APRS/packet radio, how to program it for the 2m ham band, and my failed attempt to make it work for 9600 baud.

Making these work isn't for everyone. You have to be a little technically adventurous. But if you want a mobile packet radio for very little money, this could be for you.

If you are still reading, this article assumes you can read and understand basic schematic diagrams, have a soldering iron, can build your own cables, and can create basic circuits on a breadboard.

The article assumes you will be connecting the radio to a Mobilinkd TNC3, and have another APRS-capable transceiver for testing. You should also have a dummy load capable of 25W or more, and an RTL SDR.

SM 50 Image


One of the more common questions I get at Mobilinkd is for recommendations for inexpensive mobile radios that would work well for APRS or 1200 baud packet. That has not been something I have ever felt qualified to answer. To date Mobilinkd only provides cables for amateur mobile radios with a standard MiniDIN-6 data port. Les Poston WY0GTR over at HamMadeParts makes cables that work with our TNCs for a number of other ham radios.

I have done a review the the ubiquitous KT-8900D, which is rebranded under many names and model numbers, and discussed why it is unsuitable for APRS.

Recently I started to get interested in this question of inexpensive mobile radios for another reason. I have been working on adding 9600 baud support to the TNC3. And to do 9600 baud, you really need a mobile radio. The only hand-held radios capable of 9600 baud have built-in TNCs and are rather expensive. And all of the amateur mobile radios that are 9600 baud capable are fairly expensive as well. Partly inspired by the folks at TARPN, I wanted to see what was possible for under $100 in the US.

This means foregoing ham radios and going for used commercial gear.

And the focus is going to be on finding radios for dedicated APRS/packet use rather than a do-it-all radio. These are radios you can put in the trunk of your car, or set up as a packet node or digipeater/iGate. Voice communication is a secondary concern.

Because of their nature they won't have VFO knobs, or allow you to enter a specific frequency. They are channelized.

Motorola Radius SM50

In my search for inexpensive radios that might be usable for 9600 baud, I came across the Motorola Radius SM50 which I was able to purchase for $30. I had hopes that it could work for 9600 baud as it has flat audio input and output on an accessory port. But even if it was not capable of 9600 baud, it might be a great radio for APRS.

I did a little research at the Repeater Builder website. There was a lot of detailed information about this radio, including a service manual with full schematics. The service manual is a fairly low-resolution image scan, so it is not searchable and some of the images can be difficult to decipher.

Model Variations

There are two very similar models in this series -- the SM50, which is a 2-channel radio, and the SM120, which is a 16 channel radio. For this discussion, either will work for a dedicated APRS or packet radio.

More importantly, there are UHF and VHF versions of this radio. The one we need for APRS is the VHF version.

Second, there are 25 watt and 40 watt variants. These can all be determined based on the model number. The Repeater Builder page has breakdown of what each component of the model number means. In the end, you want one of these four models:

  • M33DGC20A2AA (SM50 VHF 25W) <-- this is the one I purchased.
  • M43DGC20A2AA (SM50 VHF 40W)
  • M33DGC20C2AA (SM120 VHF 25W)
  • M43DGC20C2AA (SM120 VHF 40W)

I prefer the simplicity of the two-channel SM50. But having 16 channels (really 16 "modes") offers more flexibility.

eBay Pricing

The radio pictured above is the exact radio I purchased for $30. That is a reasonable price for the radio. But there are sellers asking more than twice that. They just are not worth much more than what I payed, maybe a bit more if they come with needed accessories (see below). The reason is that these are commercial (FCC Part 90) and there are a bunch of land mobile radios on the market as municipalities switch over to newer digital radios.

In the $60 price range you can get even better radios. I'll do a separate article on a radio in this price range later.

If a seller is trying to sell one at a high price, don't be afraid to offer them what its worth. Lots of people sell stuff on eBay with no clue as to its actual worth. And, in the end, if it is worth $100 to them, they should certainly keep it!

[Note: this is written in Spring of 2020. Pricing can change dramatically over time.]


One of the things to note is that I purchased the radio you see at the top of the page. Nothing more, nothing less. This means that things you might get with a new radio were missing. I did not get a microphone. I did not get a power cable.

To get this working, you going to need to buy a few accessories.

Mini-UHF to BNC adapter SAE Power Cable RJ-45 Microphone

Antenna Adapter

The radio has a mini-UHF connector for the antenna. I don't have any mini-UHF adapters or cables. I purchased a Mini-UHF to BNC adapter for $5.

Power Cable

The radio has an SAE power connector. These are fairly common in the US. I didn't really need a power cable while it was on the bench. I plugged it into a bench supply using alligator clips. But I will likely put this in a vehicle, so I purchased a power cable. You can find these on Amazon for about $10.


For APRS, one does not really need a microphone. I bought one anyway. I don't have a Motorola mic in the lab and I wanted to see how well this radio would work for APRS Voice Alert. These can be found for about $10-15 new. This is the one I purchased. These plug in to a standard RJ-45 connector at the front of the radio.

Programming Cable

You can buy a programming cable (called a RIB Box), but they cost almost as much as the radio. I built a programming cable using parts I had in my junk drawers. Instructions for how to do that are below.


All in, I spent another $30 on parts. But you can get away with spending less than half that.

Hardware Walkthough

Let's take a quick look at the hardware.


Drawing Drawing

On the front we have the following features:

  1. A power/volume control knob.
  2. An RJ-45 jack for a speaker-mic and for programming.
  3. A monitor button to either ignore PL tones and use carrier squelch or open squelch completely.
  4. Two channel selector buttons. On the SM50 they are labeled 1/2 and on the SM120 they are up/down. These are also referred to as "modes" by Motorola.
  5. An option button whose function can be programmed by the user.
  6. A channel/mode indicator.
  7. Indicators for option and monitor indicators.


Drawing Drawing

On the rear we have three notable items:

  1. The MiniUHF antenna connector.
  2. The power cable with SAE connector.
  3. The 16-pin accessory port.

This is really the business end of the radio for APRS use and where we will focus most of our attention.

Antenna Connector

There is not a lot of cables or antennas for the ham bands that use MiniUHF. You will want to get an adapter for either SO-239 (female UHF) or, my preference, female BNC. I picked up a male mini-UHF to female BNC for under $5.

You can find them for under $2 from China -- including postage.

It should go without saying that you will also need an antenna for the radio.

Power Connector

My radio came with an intact power cable. Unfortunately you see a lot of these radios where it looks like someone just cut the cable while removing it from the last vehicle it was in. Repairing a power cable is trivial. And you can get replacement cables for these radios for under $10. Just search for "Motorola 3080486U01 Power Cable with Strain Relief".

These cables have a polarity to them. If you buy a power cord for it, make sure the polarity is correct.

These are soldered to the board, so you will need a soldering iron to replace the cable.

Accessory Port

The accessory port is one of the things that drew me to the radio. The pins have a standard 0.1" (2.54mm) spacing. You can plug standard Dupont connectors into these pins.

You can also get locking connectors for these ports for about $2 on DigiKey. These are TE Connectivity 104422 connectors.

The accessory port has a number of standard pins such as audio input and output, PTT, GND, speaker, ignition sense, and carrier squelch detect. It also has a number of progammable IO pins. You can add an auxilliary PTT signal, for example.

It has flat audio input. The audio output can be programmed to be either squelched and de-emphasized or open with a flat response.

For a full pinout of this port, please refer to the detailed description on the SM50 information page at the Repeater Builder website.

For APRS and packet use, we are going to make use of pins 5,7,9,11, which are the top, middle 4 pins. You may need to use 2,3,7,11 for Voice Alert.


There are two invaluable resources for information on the radio hardware, both at the Repeater Builder website.

  1. This is the main SM50 information page.
  2. The service manual for the radios.


Programming the radio is probably one of the bigger challenges for people. The software to program it is not exactly freely available. And it was made 25+ years ago for MS-DOS.

But I was able to make a programming cable for next to $0, using parts I had in my junk bins. And the programming software worked flawlessly under DOSBox on Linux.

When talking about Motorola radios you'll see a lot of talk about RSS, code plugs, and RIBs. It's good to know what these terms mean, but I am going to stick to common terminology and avoid Motorola jargon. RSS is the programming software, code plugs are just radio configuration data, and RIBs are programming cables.

In this section we are going to:

  1. Build a programming cable
  2. Install and configure DOSBox
  3. Download and install the programming software
  4. Read an save the radio's current configuration
  5. Modify the programming software to allow programming 2m ham band frequencies
  6. Configure the radio's accessory port
  7. Program in the APRS channels

So, let's get started!

Programming Cable

Programming cables for these radios can be purchased from various online sources. But they are not exactly cheap. They are also very easy to make using a USB UART adapter, a 1N4148 diode, and an old RJ-45 Ethernet cable.

The progamming interface uses a one-wire serial bus. Our programming cable has to convert a two-wire serial bus into a one-wire signal. The protocol used on the Motorola is as simple as it gets, where the transmitter receives everything it sends.

George Smart M1GEO has a schematic diagram for a very simple programmer that works really well.

Programming Cable

Things yourll need:

  1. A USB to TTL UART. It needs to be able to handle 3.3V & 5V.
  2. A general purpose switching diode, such as the 1N4148. Just about any will work.
  3. An old Ethernet cable with an RJ-45 connector.
  4. A DMM or continuity tester with sharp probes.

If you want to solder it like I did, you'll need a soldering iron, some solder, and maybe some shrink tubing.

Review the instructions from M1GEO's site linked above. In the image above you can see the blue/white wire connected to ground (GND), the diode bridging TX and RX UART pins, and the orange wire connected to RX. As simple as it is, I still managed to struggle a bit with it because the labels for TX/RX on the UART adapter I used are swapped.

  1. Cut one end off the Ethernet cable. If it is a long one, just cut the length you need.
  2. Strip off about 2cm of the the outer insulation from the bare end.
  3. Find the solid orange and white/blue wires.
  4. Stip about 1cm of insulation from the orange and white/blue wires.
  5. Use a continuity tester to verify the two wires correspond with the connections on the RJ-45 connector shown here. Pin 2 of the RJ-45 should be orange and pin 5 should be blue/white.
    1. If these do not match up, you have a non-standard cable and need to find out what color wires match these pins. In this document I will be referring to them as orange and blue/white.
  6. Connect the blue/white wire to ground on the USB UART device.
  7. Connect the orange wire to the RX pin.
  8. Connect the diode between the TX and RX pins, with the cathode (the stripe) towards the TX pin.

The one you see above is nicely soldered together. But when I was initially figuring out the radio on the bench, this was all done on a breadboard. If you are just going to program one radio, it doesn't have to be well-engineered.

You can buy a RIB on Amazon or eBay and pay $20-40, or you can make one for next to nothing with parts from your junk drawer.

Programming Software

As we go through the programming steps, I am going to be using Fedora Linux. You will need to adjust these commands to suit your operating system of choice.

To program the SM50, you will need to google for "RSS SM50". I provided a link above to a site that has the software. This is DOS-based software. In this section I am going to show you how to configure DOSBox, run the software, make some required changes so we can program frequencies in the 2m ham band, and then program the radio for 2m APRS.

Download the Programming Software

You will need to download the SM50/SM120 R04.00.00 RSS from this repository.

Create a directory under your home directory called SM50 (for me, that's /home/rob/SM50), download and unzip the file there.

mkdir ~/SM50
cd ~/SM50

After you unzip the ZIP file, you will find a self-extracting archive called SM.EXE.

The next step is to plug in your programming cable and determine the device name assigned. For me that's /dev/ttyUSB5 or /dev/serial/by-id/usb-Silicon_Labs_CP2102_USB_to_UART_Bridge_Controller_0001-if00-port0.

Leave the programming cable plugged in.

Installing & Configuring DOSBox

Next, if you don't already have DOSBox installed, install it:

sudo dnf install dosbox

Now we need to start DOSBox at least once. When you start up DOSBox the first time, it will create a configuration file in ~/.dosbox/dosbox-0.74-3.conf. We need to edit this file. If that file (or one with a similar version number) does not exist, start DOSBox and then just close the window that opens.

We need to edit the config file.

gedit ~/.dosbox/dosbox-0.74-3.conf &

Specifically, we need to edit two sections near the end. The first is the [serial] section.

serial1=directserial realport:serial/by-id/usb-Silicon_Labs_CP2102_USB_to_UART_Bridge_Controller_0001-if00-port0

Change the device to match your own. This maps our USB serial device to COM1 on DOS. Note that the /dev/ prefix is missing from the path. You can also do:

serial1=directserial realport:ttyUSB5

The drawback with this method is that you may have to change it frequently if you change USB connections regularly. You will end up with different tty port assignments.

The next section we need to change is the [autoexec] section.

# Lines in this section will be run at startup.
# You can put your MOUNT lines here.

mount d /home/rob/SM50

Change the path to where you created it. This mounts the directory as a DOS drive (drive D:) and changes to drive D:.

Install the Programming Software

Next we need to run the self-extracting archive in dosbox. If you have configured the drive correctly, you can run:

dosbox SM.EXE

Capitalization is important here. This will open a DOSBox window with the extraction running. This is an interactive program, you will will need to respond.

Terminal Window DOSBox Window

Answer "Y" to all of the questions.

Reading the Radio

You can now plug the programming cable into the radio and power on the radio.

The first thing we are going to do is read the radio configuration and save it as a backup.

Reading and Saving the Radio Configuration

Once that is done, you can type SM50 in the DOSBox window and start the application. Press the "Any Key" to continue. This brings us to the main menu.

DOSBox Window DOSBox Window

One thing to note about the SM50 configuration software is that it is very much driven by function keys. Navigation is done via function keys, tab/shift-tab and the up/down keys. The escape key always takes you back to the main menu.

GET/SAVE Codeplug

The first thing we need to do is to read the configuration from the radio. Press F3 -- GET/SAVE Codeplug.

In the GET/SAVE menu, press F2 -- READ Data From Radio Codeplug.

DOSBox Window DOSBox Window

If everything works as it should, this second screen should pop up while it reads from the radio, and the return you to the GET/SAVE menu. You should also hear the radio beep as it leaves programming mode.

If this does not work, you will need to check your serial adapter and cable connections. Make sure that dosbox opened the serial port successfully.

When it finishes reading the radio configuration, you will see the radio model in the upper right panel.

SAVE Codeplug Data to Disk

The next step is to save this to disk. Press F7 -- SAVE Codeplug Data to Archive File Disk.

Change the archive path to D:\ARC and press enter. Add a meaningful name in the Customer ID box. I called mine ORIGINAL. Press F8 to save the file.

It will then want to write the backup to a diskette as well. We don't need to do that. We are just going to press F10 to exit here.

DOSBox Window DOSBox Window

We are then going to press F10 again to get back to the main menu.

Viewing the Configuration

Press F4 -- CHANGE/VIEW Codeplug. Then press F2 -- RADIO WIDE Configuration.

This gives us information about the radio based on the model information, such as power output, the frequency range it supports, and the number of channels (labelled conventional modes).

DOSBox Window DOSBox Window

The thing to note here is that the frequency range supported, 150-170MHz is outside the 2m ham band. This information is hardcoded into the RSS software's own configuration file. We need to change this in order to get the radio to operate in the 2m ham band.

It was important to read the radio configuration and save it with the unpatched version of the software before making this change.

At this point we need to exit the programming softare and make some changes. Press F10 as many times as needed to get back to a DOS prompt. Then close the DOSBox window. We are going back to the Linux terminal window.

Patching the Software

The SM50.MDF file in the SM50 directory contains hard-coded band ranges based on model number. There are a few online documents which show how to change this file. They are all manual processes that are prone to error.

To make this process easier, I wrote a program in Python that edits the file, shifting the range of the radio down 6MHz to 144-164MHz.

Download the program from this repository and put it in the ~/SM50/ directory where we unzipped the RSS program. This is where the SM50.MDF file is. Then run the program, giving it the SM50.MDF filename as a command-line parameter.

cp ~/Downloads/ .
./ SM50.MDF

This will modify the file and write a backup of the original.

Terminal Window

Configuring the Radio

Start up DOSBox again, this time giving it the SM50.EXE command to run.

dosbox SM50.EXE

This will launch straight into the programming software. We need to read the radio configuration again, then go back to the radio-wide configuration screen. You can follow the steps below or refer to the steps we went through above you if get lost.

  1. Press the any key to get to the main menu.
  2. Press F3 -- GET/SAVE Codeplug.
  3. Press F2 -- READ Data From Radio Codeplug.
  4. Press F10 -- EXIT/Return To MAIN Menu to get back to the main menu.
  5. Press F4 -- CHANGE/VIEW Codeplug.
  6. Press F2 -- RADIO WIDE Configuration.

Now we can see that the radio supports the 2m ham band!

Accessory Port Configuration

Press F9 -- OTHER ACCESSORY. This will let us modify the accessory port on the back of the radio.

DOSBox Window DOSBox Window

We need to make three changes here:

  1. Set the Acc. Rx Audio to Unmuted.
  2. Set the Current Limiter to Post.
  3. Set the pin 9 function to External PTT.

Use the tab and shift-tab to navigate forwards and backwards. Use the up/down keys to change selections.

When you are done, press F10 twice to exit back to the CHANGE/VIEW CODEPLUG MENU.

Channel Configuration

Press F5 -- MODE Configuration. This will let us change the two channels (or modes). The reason they are called modes is that they can refer to the same frequency, but with parameters like power output or squelch type changed.

We're going to set the first channel to the North American APRS frequency, and the second channel to the ARISS/satellite APRS frequency (we have a lot of APRS satellites at the moment). We are going to use low-power for the ARISS channel.

Set the modes as shown. Use F4 to switch between the modes.

DOSBox Window DOSBox Window

Press F10 twice when you are done to get back to the main menu.

  1. Press F3 -- GET/SAVE Codeplug.
  2. Press F8 -- PROGRAM Data Into Radio Codeplug
  3. Press F2 -- CONTINUE
DOSBox Window DOSBox Window

Congratulations! You have programmed your SM50 for APRS. In the next section, we are going to make a cable to connect the radio to a TNC3 and test it out.

TNC Cable

In this section we are going to build a basic TNC cable using an IDC cable with female Dupont connectors and a 3.5mm 4-pole connector.

We are also going to convert the basic cable to one that is custom designed for this radio.

Basic Cable Construction

We are going to start building the basic cable. This is also the foundation for the advanced cable, so start here.

You will need the following:

  1. A strip of 4 wires from an IDC connector with female Dupont connectors on at least one end. This is what I used: Breadboard Jumper Wires Ribbon Cables Kit
  2. A 3.5mm 4-pole connector
  3. Diagonal cutters.
  4. Wire stripper/crimper.
  5. A soldering iron.
  6. Fine 0.5mm rosin core solder.

    TNC Cable Items Finished TNC Cable

Construction steps:

  1. With the strip of 4 wires, cut the ends off one end, leaving four female Dupont connectors on the other end.
  2. Separate the sleeve from the plug of the 3.5mm connector.
  3. Slide the plastic sleeve over the 4 wires.
  4. Strip about 4mm (5/32") of insulation from each wire.
  5. Make sure the connector sleeve is over the 4 wires.
  6. Solder the connectors in order: sleeve, ring 2, ring 1, tip. This is so you can look at the cable and know which wire is which.
  7. Verify once more that you slid the connector sleeve over the 4 wires.
  8. Crimp the connector over the wires for strain relief.
  9. Screw the plastic sleeve onto the plug.


Prep the cable by cutting the ends off of one end of the cable, unscrewing the sleeve from the plug, sliding the sleeve over the IDC cable, and stripping 4mm of insulation from the ends. Verify the order in which you will be soldering the wires.

TNC Cable Step 1 TNC Cable Step 4 TNC Cable Step 5


Soldering the connector and getting the connections right is easy if you use the 3.5mm connector from the Mobilinkd store. Start at the bottom connecting the sleeve and then go counter-clockwise in order to ring 2, ring 1 and the tip.

TNC Cable Step 6 TNC Cable Step 6
TNC Cable Step 6 TNC Cable Step 6


Crimp the connector to the insulation of the wires, being careful not to damage the insulation. Thread the sleeve onto the plug.

TNC Cable Step 8 TNC Cable Step 8 TNC Cable Complete

That's it. The cable is ready.

Connect Radio to TNC

The pinout of the cable is as follows:

  • Tip: SPKR -- Radio audio output / TNC audio input.
  • Ring 1: PTT -- Key the transmitter.
  • Ring 2: MIC -- Radio audio input / TNC audio output
  • Sleeve: GND -- Common

We are now ready to connect the radio to a TNC. Just plug the wires in like so:

Left _ _ Top _ _ Ri ght
15 13 SPKR PTT GND MIC 03 01
16 14 12 10 08 06 04 02

Then plug the cable into the TNC3.

TNC/Radio Connection TNC/Radio Connection TNC/Radio Connection

If you want to use APRS Voice Alert, you will need to connect the TNC to the radio slightly differently. In fact, this is probably the most useful configuration. After completing this article, what you see below is the recommended pinout to use.

Left _ _ Top _ _ Ri ght
15 13 SPKR 09 GND 05 PTT 01
16 14 12 10 08 06 04 MIC

Connect the TNC PTT and MIC wires to the External Mic PTT (pin 3) and External Mic Audio (pin 2) inputs on the accessory connector.

TNC/Radio Connection

You can skip the next step and come back to it later. This cable is perfectly usable to get started with the radio.

Advanced Cable

To constuct the advanced cable, you will need the following additional items:

  1. The basic cable we constructed earlier.
  2. A TE Connectivity 104422 connector.
  3. A small zip tie.
  4. A hot glue gun.
  5. An Exacto knife or similar thin pointy tool.
  6. Some tape.

Use the Exacto knife to pry up the small plastic tab on the Dupont connector, releasing the crimped wire on all four wires. These are going to slide straight into the 16-pin connector.

TNC/Radio Connection TNC/Radio Connection TNC/Radio Connection

The radio's 16-pin connector looks like this:

Left _ _ Top _ _ Ri ght
15 13 11 09 07 05 03 01
16 14 12 10 08 06 04 02

Since you've been using the cable constructed early to connect to the radio and test it out, this should be familiar to you by now.

We are going to connect the cable like so:

Left _ _ Top _ _ Ri ght
15 13 SPKR PTT GND MIC 03 01
16 14 12 10 08 06 04 02

Push the wires into the connector. Tape the wires down to the plastic tab. Test the cable with the TNC.

TNC/Radio Connection TNC/Radio Connection

If everything works, use the zip tie to fasten the cable to the connector but running it through two of the holes and over the cable.

TNC/Radio Connection

1200 Baud APRS

At this point we have the TNC3 connected to the SM50. In this section we are going to run through the configuration steps for the TNC using the Mobilinkd Config App for iOS and use the app on iOS to send and receive our first packets.

Equipment Needed

To configure the radio and the TNC, we need a few pieces of equipment. Besides the Motorola SM50 radio, the Mobilinkd TNC3, and the cable we built earlier, we will need the following:

  1. A dummy load.
  2. RF cables and adapters to connect the radio to the dummy load.
  3. An RTL SDR (one with a TXCO is best), along with antenna.
  4. Software such as GQRX or SDR# to view the RF spectrum.
  5. An Android or iOS phone to run the TNC configuration app.

We will go through the steps below using GQRX on Linux. This assumes you have installed the Mobilinkd Config App on your phone and that you are familiar with its use. We will be using the iOS version of this app.

You will see me using 144.910MHz for testing, but you can use whatever frequency is easiest. If channel 1 is programmed to 144.390MHz for APRS, use that. I recommend programming the radio for low power while doing this configuration.

I have a large 100W dummy load that I use quite a bit in the lab. However, I also have a 25W 40dB attenuator along with a 50Ω terminator that I will use in a pinch. This is a more flexible option for those on a budget. I don't recommend connecting the radio through the attenuator directly to the RTL SDR. Even with 40dB attenuation, it can overdrive the input of the SDR.

There is enough RF emitted via the cables and connectors that can be picked up with an antenna connected to the RTL SDR.

TNC/Radio Connection SDR Connection

Connect the radio to the dummy load, to the TNC and to power.

Connect an antenna to the RTL SDR, plug it into a USB port on the computer, and start GQRX.

GQRX IO configuration SDR Input Controls

Start up GQRX. We need to configure the SDR for a narrow frequency span. Click on the "Configure IO Devices" icon. Then select the RTL SDR device and configure the input rate for 1.8Msps, 32x decimation, and 50kHZ (0.050MHz) bandwidth.

Next, on the Input Controls tab, configure the input controls for your RTL SDR device. Add any frequency correction necessary.

SDR Receiver Options SDR FFT Settings

Switch to the Receiver Options tab and set the frequency you will be testing at, the filter width to Wide, the mode to Narrow FT and disable AGC. In the FFT Settings tab, set the FFT size to 8192 and adjust the dispay so that the panadapter (the top part) takes up at least 2/3 of the view. I also recommend muting the output. Click on the images above to get a higher resolution view of the settings.

Connect to TNC Adjust audio input levels Adjust audio output levels

Turn on the radio and the TNC. Open the config app. You should see the TNC appear in the connection screen. Tap the TNC to connect. Tap Audio Input Settings... to go to that screen. Tap on Auto-Adjust Levels. You should see the audio input a gain set to 0 and the input twist level somewhere close to 0. +/-2dB is normal since we are using flat audio input.

Here is where we will be using GQRX. Press the Start DSP button in QGRX.

Tap the back button in the config app and tap Audio Output Settings.... Select Simplex PTT style, and a 1200Hz test tone. Then tap Transmit. You should see the transmission in GQRX on the panadapter and in the waterfall display. It should appear as a set of distinct lines, each 1200Hz appart.

Bessel Null

We are going to use the Bessel Null method to set our output level.

Starting a level of 0, slowly adjust the output level up. You will see more and more peaks appear. At some point you will notice the carrier (the middle frequency peak) start to dip. Adjust the level until the carrier is at its lowest level (see image above). For me, the output level was 172. Fine tuning this level can be a bit challenging in the app. Just know that it does not have to be perfect. Setting the output level a little bit higher than the perfect Null is OK. This provides almost 3kHz deviation. Since we are using the pre-emphasis, the 2200Hz tone will have higher deviation -- somewhere closer to 3.3kHz.

Now that we are done, tap Back in the app to go back to the main menu, then tap Save to save these settings to the TNC.

That's it. You can now exit the app and close GQRX. At this point you can start up the app or, if you are using Android, APRSDroid.

In the next section we will be exploring 9600 baud operation.

9600 Baud Modifications

I am going to start right now by telling you that my attempt to modify the radio for 9600 baud failed. I was able to send and receive packets over 9600 baud. But the modification required for transmit had a horrible impact on the behavior of the transmitter.

Tools and Equipment

We are going to be using a spectrum analyzer, an RTL SDR, a vector signal generator, a function generator, and an oscilloscope. To make simialar changes, you will need good soldering skills. And having access to a bench microscope, such as the AmScope SE400-Z, which is what I use, will be helpful.

A note about the test setup.

signal generator

An HP E4433B vector signal generator is used to generate the 9600 baud GMSK signal to the radio.

To get the eye diagrams you will see below, I used a Siglent SDG2042X arbitrary waveform generator to generate a 9600Hz square wave which was fed into the trigger input of the oscilloscope. The oscilloscope was set to 180us delay and 1s persistence. This delay causes the trigger to occur a number of bit periods before the display. What we see on the screen is the waveform 180us after the trigger.

First off, let's discuss why modification of the radio was necessary.

Receive Audio

discriminator output accessory output

When looking at the receive audio that came out of the discriminator, and which was available at the feature port inside the radio, it was a clean signal, easily usable for 9600 baud demodulation. However, the signal that was present at the flat audio output pin of the accessory port on the back was not. It seemed as if there was a high-pass filter in the audio path that was affecting the low frequency response.

rx schematic

Looking at the schematic and probing around a bit with the oscilloscope, I suspected that C559 was the culprit (or at least part of it).

capacitor bodge fixed accessory output

C559 is a 0603 MLCC surface mount capacitor. To test my hypothesis, I soldered a 2.2uF capacitor in parallel, by piggy-backing an 0805 package MLCC on top.

What you see above is the result. The demodulated output looked clean and I was able to decode 9600 baud packets easily.

Transmit Audio

Transmit audio was a bit trickier. It turns out that flat TX audio isn't flat, and is completely attenuated beyond 3kHz. The audio is routed through the AFIC (Motorola's audio processor IC) U402. There are multiple paths depending on whether the MIC PTT is pressed or an auxilliary PTT signal is used, and whether pre- or post-limiter is selected in the audio path configuration when setting up the accessory port. None of those options provided clean, unfiltered access to the the VCO.

One of the tricks used to make the GM300 support 9600 baud is to bypass the AFIC as described here. I found a similar path on the SM50.

rx schematic TX bodge

This routes the signal when an auxilliary PTT is used around the AFIC and straight into the VCO. I could not quite get R671 into the image through the microscope. Luckily, R671 and R655 & R656 are on the same side of the PCB and near each other.

This worked! I could now send and receive data at 9600 baud.

But something was not right. When I went to fine tune the deviation on the radio using an RTL-SDR and GQRX, I observed the TX frequency jumping around +/- almost 3kHz.

tx waterfall

All of these transmissions should line up perfectly. This is a 1200Hz tone being sent in multiple bursts.

When transmitting just a carrier, by triggering PTT with the output level set to 0, the carrier is always centered on the expected transmit frequency (within its specification).

What I believe happens is that during normal operation the AFIC suppresses the modulation output until after the VCO PLL locks. Bypassing the AFIC and preseting a modulated signal to the VCO before the PLL is locked causes the PLL to lock to the wrong frequency.

The radio always transmits on the proper frequency after modifying the firmware in the TNC to key the transmitter and wait about 60ms (determined empirically) before sending the preamble (TX Delay) and the HDLC frame.

But that is not done on any TNC that I am aware of. What happens (or what is specified to happen) is that the transmitter is keyed and either IDLE or FLAG bytes are immediately sent (the standard says FLAG, but there are advantages to sending IDLE).

So, in the end I abandoned my attempt to use this radio for 9600 baud.

The good news is that reverting the change on the TX side eliminated the problem and allowed me to complete the 1200 baud section above using both flat and pre-emphasized TX audio.


The SM50 is a fine radio for 1200 baud APRS when it can be found for a reasonable price. Accessories are easy to come by and inexpensive. The programming cable is easy to make. The programming software runs easily in DOSbox on virtually any platform. And the accessory connector allows the use common Dupont connectors when constructing a cable.

While it is unsuitable for 9600 baud operation, the radio is still a very good value for a dedicated mobile APRS radio.

There is further research to be done if there are other modifications possible to achieve 9600 baud without the problems docuemented here. And it may be worth researching whether adding an additional "modulation delay" parameter to a TNC, where PTT is engaged without modulation for some time period, would be a generally useful feature to implement.

As others have documented a similar modification to Motorola MaxTrac radios, it may be worthwhile to investigate whether similar transmit frequency errors occur with these radios and, if not, how the problem is avoided in these radios.

I would like to encourage radio manufacturers to make the software required to program their radios publicly and freely available to radio amateurs when the radio equipment is no longer an economically viable products. Requiring that radio amateurs download software from unofficial sites in order to program their equipment is undesireable.

At the same time, I would also encourage more radio amateurs to take on the task of decoding the programming protocols of these radios and providing open software for programming them. Chirp is a great resource for a large number of radios.

But since Motorola apparently encrypts the data between programmer and radio, it seems will not be an option for owners of Motorola equipment unless Motorola themselves step forward to addres.

In [ ]: