The manual lists the following, per channel, options:
  • TX Frequency
  • RX Frequency
  • TX PL/DPL
  • RX PL/DPL
  • PTT Priority (0=disabled, Wireline, Repeater, Local)
  • TOT - Wireline
  • TOT - Repeater
  • TOT - Local
  • Drop Out Delay
  • Repeater Key
  • Repeater maintain
  • RX1 audio
  • Station ID
  • TX audio mute during data
Repeater key and RX1 audio is a function of ANDing Squelch, Code (PL or DPL) and Aux
The version 3 and 4 codeplugs are very similar. Version 3 uses 23 bytes for channel data. Version 4 uses 24 bytes.
The codeplug resides at address 0x2000. Here is a basic map of the version 3 codeplug:
0123456789ABCDEF
2000checksumlast word01Version??Channel size# chans??????????????
2010??????ID end +1Channel address-16 bytesChannel data address15??09ID speed
2020ID speed??????????????????????????????
2030????????????????????????????????
2040????????????????????????????????
22E0??????????CW ID??????????
22F0????????????????????????????????
2300????????????????????????????????
2310????RX FrequencyTX FrequencyRX1 audioPriorityLine TOTLocal TOTDrop out RPT TOTTX PL
2320TX PLRX PLRX PL??RPT hold keyID????????????????????
2330????????????????????????????????
Color key:
Navy - certain
Olive - uncertain
Red - no idea
Channel Data:
The MSF5000 is capable of multi-channel operation. I have not identified info on using additional channels.
Here is a byte by byte breakdown (not 100% complete)

** Note that A0 and B0 are inverted **
Receive Frequency
A3A2A1A0  B1B0A5A4 A and B divisor bits for receive VCO * Note two bits are inverted *
B5B4B3B2  B9B8B7B6 Remaining B divisor bits for receive VCO
1 1 C1C0  0 0 R1 R0 C bits for receive VCO. The bits in red are unknown. The 7th bit controls modulation compensation for DPL. No function for receive. The MSB bit forces the adaptive VCO filter, normally 1. Ref Freq: 01 - 6.25KHz, 10 - 4.167KHz, 11 - 5.0 KHz
Transmit Frequency
A3A2A1A0  B1B0A5A4 A and B divisor bits for transmit VCO
B5B4B3B2  B9B8B7B6 Remaining B divisor bits for transmit VCO
1 1 C1C0  0 0 R1 R0 C bits and Reference freq. for transmit VCO. The red bits are unknown. The 7th bit controls VCO modulation compensation. 0 for DPL, 1 for PL. MSB forces adaptive loop filter. Normally 1. Ref Freq: 01 - 6.25KHz, 10 - 4.167KHz, 11 - 5.0KHz
Receiver 1 Audio
1 C 0 S  0 0 0 0C=Code (PL/DPL) S=Squelch Use 0 to disable. 1's are ANDed together. I think bit 5 is for AUX. Not sure what 'AUX' is.
PTT Priority
0 0 W1W0  L1L0R1R0 W=wireline L=local R=repeater Be sure they are not the same. 00=no function 01=highest 11=lowest priority
Wireline TOT
0 0 0W4  W3W2W1W0 Wireline input time-out-timer. 15 second increments. 00000=disabled
Local (Front panel Control) TOT
0 0 0 L4  L3 L2L1L0 Local (Control) input time-out-timer. 15 second increments. 00000=disabled
Drop Out & Repeater TOT
D2D1D0R4  R3R2R1R0 Dropout timer (tail) & Repeater time-out-timer. DOD is 0 (disabled)-7 seconds. TOT is 15 second increments. 00000=disabled
Transmit Code (PL/DPL)
P 0 T13T12  T11T10T9T8 Transmit Code Squelch for PL P=0, for DPL P=1 T13=1 T12=0 T11=0 T10=0
T7T6T5T4  T3T2T1T0 T0 in DPL mode: 0=normal, 1=inverted T9 - T1 are Octal DPL code
Receive Code (PL/DPL)
P 0 T13T12  T11T10T9T8 Receive Code Squelch for PL P=0, for DPL P=1 T13=1 T12=0 T11=0 T10=0
T7T6T5T4  T3T2T1T0 T0 in DPL mode: 0=normal, 1=inverted T9 - T1 are Octal DPL code
Codeplug is located at 0x2000. This means that an address pointing to 2308 is actually in the EPROM at 0308.
To make testing easy, change 0002:0003 to something near start of EPROM and the checksum becomes easy to calculate and you can change other bytes at will.
This data was derived from hours of experimentation using two available codeplugs.
AddressDescription
0000:0001Checksum. Use 16 bit math and add words starting with 0002:0003 and ending with last word of code plug data.
0002:0003Address of last word of code plug data. (used for checksum)
0005Version
0007Channel byte count
0008Number of channels +1 (tune channel adds one)
0011:0012Address of first CW ID data (same number of bytes per channel)
0013:0014Address of byte following final callsign terminator (00)
0015:0016Address of 16 bytes (all 01 ?)preceeding channel data
0017:0018Address of channel data
0019Unknown
001BUnknown
001F:0020ID character speed
02E5First byte of callsign. Terminate with 00. write it out in binary: 00=short space, 01=dit, 10=dah,11=long space
03??Channel data starts in here. Starting point seems to relate to callsign length