Hacking the Standard Horizon HX890E
I purchased a Standard Horizon HX890E around the time I passed my Dutch Marcom A (Marine General Operator Certificate) to have a marine radio for use on small (Scouting sailing) boats. It has ATIS for use on Dutch inland waters and DSC for use on the A1 North Sea waters. The ATIS/DSC combination in a handheld is rare. :) And since I am a HAM Radio operator, I was also interested in delving into the programming of the HX890E.
The HX890(E) is the successor to the HX870(E) and I found a collection of information about the HX870 by Arne Johannessen. I recognized lots of similarities in the structure of the DAT file, but also some differences. So I started to analyze the DAT file and the result you can read below.
I will not duplicate all the info from Arne's page on the 870. I will however point to info on that page and describe where the DAT file contents differ between the 870 and 890. I divided the info into blocks dedicated to a specific subject, like adding channels or deleting MMSI/ATIS info. I added screenshots if needed.
The HX890E radio
The Standard Horizon HX890(E) is produced by Yaesu. It is a handheld marine radio, for use on inland waters and the sea. For use on inland waters where the Basel agreement is applicable (some European countries, like Germany and the Netherlands), it features ATIS (Automatic Transmitter Identification System). For use on SOLAS A1/A2/A3/A4 waters (read: most seas) it features DSC H (simplified set of SOLAS Digital Selective Calling). The HX890E can be used in 3 regional channel modes: US, International or one of the other regions (Canada, UK, Belgium, Netherlands, Sweden, Germany, set by a specific startup key combination).
Each of the regional channel sets is different:
- US contains all US channels (like 1001, 1003 and others).
- International contains the standard ITU Marine channel list.
- Canada contains the Canadian channels, mostly the International set but with some channels being simplex on the lower frequency.
- UK contains the International channels with M and M2 added.
- Belgium contains the International channels with the Dutch Marina channel 31 added.
- Netherlands contains the International channels with the Dutch Marina channel 31, channel 37 added and more channels set to LOW power.
- Sweden contains the International channels with the Scandinavian L1/L2/L3/F1/F2/F3 channels added.
- Germany contains the International channels with more channels set to LOW power.
Disclaimer
Modifying the memory image directly using a hex editor is likely not a supported function of the device or its accompanying software. As such, it might void your warranty or brick the radio or even put it into a state where it transmits or receives on frequencies forbidden by international Radio Regulations, local regulations (FCC / BNetzA / …) or local law. Using the radio in such a state might disrupt vital safety-of-life services. Many jurisdictions impose a fine or criminal penalty on it. You should not mess around with any of this stuff unless you know what you’re doing! This also applies to adding/deleting channels, it might be against applicable laws to use those. And, to finally state the obvious: whatever you do, I cannot be held responsible for it.
And: I do not work for Standard Horizon / Yaesu, nor do I have first-hand “inside” knowledge about any of their products. The information on this page was gathered by playing around some with HX890E radio and the YCE20 software that goes with it. Several radio users contributed information to this page; Norm Perron was particularly helpful. All info based on firmware version 2.01.
Differences and similarities in the DAT files
You can identify a DAT file for a specific product from the magic number at 0x0000: 0x0367 means it is for the 870, 0x037a means it is for the 890. The DAT file of the 890 is very similar to the one for the 870, the differences are mainly from added functionality in the 890 (extra space for RG and EXP channels as an example). So lots of info from the 870 page is still valid. This goes for the Setup 1, Setup 2, channel group names, preset groups, region selection and more. Some are at a different location, mentioned below.
Disabling DSC and changing the name for a channel group
YCE20 does not have a setting for turning off DSC for a specific channel group (it does for ATIS though), which leaves DSC enabled in the Dutch channel group. And using DSC is prohibited on inland water in the Netherlands (except for the IJsselmeer, Waddenzee and Osster- and Westerschelde on a voluntary basis). But with a Hex editor you can turn it off by setting 0x091 to 0x00, making you compliant with the law. ;) I think that for the European (E) version of the 890, Standard Horizon should make DSC configurable in YCE20, or disable it for all RAINWAT region groups by default.
You can also change the Group name here, I changed NL to NLD to show I am using the altered channel DAT file.
Marine Channel Flags
The Marine Channel Flags are found at a different file location (0x0700 versus 0x0600 for the 870), but contain mostly the same flags as described on the 870 page, but the 4th byte (0x03) now contains the Scrambler bitmask (see below) in stead of 0xFF.
This is where you can change the behavior of channels, like simplex versus duplex, high versus low power and more. One thing to note is that the 0x0080 bit listed as DSC intership is mentioned on the frequent combinations list as "ship/ship" without the DSC part. The difference between "simplex" and "ship/ship" is the possibility to send DSC (intership) messages to point to the "ship/ship" channel easily.
The channel ID mentioned on the 870 page is the marine channel number, 20 as an example. A marine channel can be listed more than once, as an example as the duplex version (20) and both the lower and upper simplex version (1020 and 2020). The flags will tell the radio whether it is duplex, lower simplex or upper simplex channel.
Scrambler bitmasks:
x000 0000 = scrambler disabled/enabled
0x00 0000 = type of scrambler (0 = CVS2500, 1 = FVP-42)
00x0 0000 = always 0 (1 is illegal value)
000x xxxx = scrambler code (0-3 for CVS2500, 0-31 for FVP-42)
Adding or removing channels from a regional channel group is possible by editing the bitmask (adding or removing 1's) at 0x160 (for the 3rd set), just like in the 870:
.
Dutch channel group and the Dutch law
The default Dutch channel group has some interesting settings, which are either against the law or unpractical:
- the International intership channels configured, which is quite wrong on some channels.
- Channel 37 is active, which is a special channel in the Netherlands and illegal to use (without the appropriate license).
- The 890E has no way to disable DSC for the regional channel group at the moment, you need a Hex editor for that. See above. However, you are allowed to use DSC on a voluntary basis on the IJsselmeer, Waddenzee, Ooster- and Westerschelde. So just make sure not to use it on all other inland waters.
- Channels 1018, 2018, 1020, 1078, 2078, 1079 and 2079 are active, but the corresponding duplex channels are used in the Netherlands. You will not need these channels (at this moment) and I doubt that transmitting on the 20xx channels is legal, since those are used by the shore station. The 10xx channels might be useful to listen to the ship transmissions if the shore station does not relays the transmissions on the shore (20xx) frequency.
- From 1-1-2023 on, channels 24, 25, 26, 84, 85 and 86 are reserves for VDES (VHF Data Exchange System), so will not be for analog use anymore.
- From 1-1-2023 on, channels 27 an 28 are changed to simplex (low frequency)
Below in the files section, you can download a DAT file (HX890E NL kanaalnamen + NL Legal config hex-edited.dat) which is edited to comply with the Dutch law (see Bijlage2 in the Regeling gebruik van frequentieruimte met meldingsplicht 2015). The changes made from the default NL channel group are:
- All channels which require low power are set to 1W (and cannot be changed to other power settings): this applies for channels 6, 10, 11-15, 17, 31, 71-77.
- All channels where low power is advised (all but 16 and the ones requiring low power) now default to 1W (but can be changed to higher power if needed): this applies for channels 1-5, 7-9, 18-28, 60-69, 73, 78-88.
- Only Dutch Intership channels are marked accordingly: channels 6, 8, 10, 13, 71, 72, 77.
- Channels 37, 1018, 2018, 1020, 2020, 1078, 2078, 1079 and 2079 are removed, they do not comply with the Dutch laws.
- The International channel group has the UK M and M2 marina channels added, since the INT and UK groups are identical (except for the M/M2 channels). This saves you from needing to change to the UK channel group (and losing the Dutch channel set from this DAT file, because it will be overwritten by the UK set), since the UK channel group is essential the International one plus M and M2. 😇
The 2023 file (HX890E NL kanaalnamen + NL Legal config 2023.dat) has some extra changes:
- Channels 24, 25, 26, 84, 85 and 86 are removed, since they are not for analog use anymore from 1-1-2023 on.
- Channels 27 and 28 are set to simplex, to comply with the use after 1-1-2023.
Note: the DAT files are edited with the Dutch law in mind, but you need to make sure to comply with the law yourself. I am not liable for any errors or omissions in the DAT files. And you need to reload the DAT file after switching channel regions, the internal NL channel group is the un-edited one.
Adding RG/EXP channels
Now things get interesting! :) Some regional channel groups on the HX890E have extra channels added. The UK group has M and M2 added as RG channels, the NL group has 31 an 37 inserted in the normal channels and the Swedish group adds L1/L2/L3/F1/F2/F3. But you might need other marine channels, as an example if your company operates on another non-standard marine channel. This is where adding channels comes in.
Normally you can let your dealer do this with the dealer software, but you can use a Hex editor to do it yourself. ;) Make sure you add only channels you are licensed to use. You can find the data for 20 RG channels at 0x0D00 and the data for 30 EXP channels at 0x0F00. Consequently on the HX890E, the RG channels are shown after the standard channels, the EXP channels are show after the RG channels.
This is also where the data structure differs between the 870 and 890 DAT file. Where the 870 uses 8 bytes, the 890 uses 16 bytes. They are coded like this (changes from 870 in bold):
Offset | Data | Format |
0x0 | Channel group | bitmask: 0x1000 = US, 0x0100=Intl, 0x0010 = NL (or other region), second half of 0x0 needs to be 0xC for TX or 0x0 for RX-only. |
0x1 | Scrambler | bitmask: see below |
0x2-0x3 | Channel ID | 2 * ASCII char (lower case not supported) |
0x4-0x6 | RX Frequency | 5 nibbles BCD (in kHz above 100 MHz) |
0x6 | padding? | lower nibble 0x0 |
0x7-0x9 | TX Frequency | 5 nibbles BCD (in kHz above 100 MHz) |
0x9 | channel definition flags | lower nibble: bitmask; see below |
0xA-0xF | padding | 0xFF |
Scrambler bitmasks:
x000 0000 = scrambler enabled
0x00 0000 = type of scrambler (0 = CVS2500, 1 = FVP-42)
00x0 0000 = always 0 (1 is illegal value)
000x xxxx = scrambler code (0-3 for CVS2500, 0-31 for FVP-42)
Channel definition flags:
0x08 = xxxx1xxx = low power
0x04 = xxxxx1xx - ?
0x02 = xxxxxx1x - ?
0x01 = xxxxxxx1 = user power up
Frequent combinations:
0x00 = xxxx0000 = standard
0x08 = xxxx1000 = limited to 1W
0x09 = xxxx1001 = defaults to 1W
0x06 = xxxx0110 = ?
Illegal combinations:
0x0a = xxxx1010
0x0b = xxxx1011
0x0c = xxxx1100
0x0d = xxxx1101
0x0e = xxxx1110
You should probably use 0x9 to default to low power for extra channels. The channel then defaults to 1W and you can power up if needed.
However, just adding the channels in the RG and EXP groups is not enough, they need enabling to show up:
The values start at 0x180, just as for the 870, but since the 890 has room for more RG and EXP channels, they span more bytes.
The WX channels are the same as for the 870: at 0x182 we see 0xFFC0 -> 1111111111000000 -> 10 channels
The RG channels now take 3 bytes instead of 2 for the 870, since the 890 can handle 20 RG channels: at 0x182 we see 0xFF FF F0 -> 20 bits for 20 channels. Keeping all 20 channels enabled here is fine, even when less are defined at 0xD00. The radio will ignore all enabled but not defined channels.
The EXP channels now start at 0x185 and uses 4 bytes for 30 channels: at 0x185 we see 0xFF FF FF FC -> 30 channels. You can also keep all 30 enabled.
RG/EXP channel names
You can assign channel names in YCE20, they will show up at 0x3800 for RG channels:
And at 0x3c00 for EXP channels:
Bug in naming EXP channels in YCE20?
YCE20 is way easier to use for naming channels than a Hex editor. But naming EXP channels in YCE20 I noticed they were shifted 1 character for each channel when programming the HX890E. On the HX890E it looked like the text scrolls. I eventually used a Hex editor to name the EXP channels, which shows the names shifted in YCE20 but normally on the HX890E.
Changing MMSI and ATIS
I expect the data at the beginning of Setup2 (shown above with no MMSI and ATIS code programmed) NOT to work for changing MMSI and/or ATIS, however I need to verify this. Resetting the "programmed" bytes from 0x01 to 0x00 at least makes it possible to change the ATIS code and own MMSI in YCE20, but I have not confirmed that the numbers are actually written to the HX890E. Chances are slim that it would work, since a DAT file read from a live radio does not contain the actual MMSI/ATIS and the "programmed" bytes are reset. If it would work, just writing a DAT file read from the radio directly to the radio again would reset the MMSI/ATIS values.
Since writing the above info, I have received word that the YCE20 software ignores the ATIS/MMSI data in a DAT file and will not write it to the mentioned memory addresses. So changing the MMSI/ATIS by editing the DAT file will 100% not work. If you need it changed, contact your dealer or Standard Horizon for a special reset code.
Waypoints and routes
The waypoints in the 890E DAT file are identically formatted as in the 870, but there are now 250 of them and they are listed from 0xD700 to 0xF63F instead of 0x4300 to 0x5BFF in the DAT file.
YCE20 sorts them alphabetically in the list, but they retain their Waypoint ID (shown at 0x0F), which starts at 0x01 for the first waypoint. That means that there can only be 255 waypoints (0xFF as the ID then), so the 250 is almost maxed out. When a waypoint is deleted, the Waypoint ID is free to be assigned for a new waypoint. If the Waypoint ID is part of a route, the route is effectively cleared. Only the name is retained and the route up to the deleted waypoint. If the waypoint was the start waypoint, that is also cleared in the route. YCE20 warns you for this with a popup.
Since 0x0E is always 0xFF and 0x0F is the ID, names can only be 14 characters. The 870 info list it as being 15 characters, but counts the 0xFF padding as being part of the name, I guess. ;)
Routes, still max 20 of them, start at 0xC700 (and end at 0xCBFF) and now use 64 bytes per route (where the 870 uses 32 bytes). Still 15 characters for the name (byte 0x0F is padded with 0xFF), but now 1 start waypoint and 30 via's for a total of 31 waypoint ID's.
The last 17 bytes are 0xFF padding, so maybe Standard Horizon will expand the number of via's to 63 in a future firmware version? ;)
DSC individual and group directory
The individual MMSI's are coded that same as for the 870, but now from 0x4200 to 0x4415. The names are also coded the same as for the 870, but also at a changed location: 0x4500 to 0x4b3f.
The Group MMSI's (always starting with 0) are also formatted the same, but are now at 0x500 to 0x5640. The names are now at 0x5100 to -x523F.
DSC Group Monitoring
The GM Setup info is structured the same as on the 870, but now at 0x5500 to 0x575F. The GM ID always starts with 0.
DSC Logs
The Transmitted Logs uses the same structure as in the 870, but starts at 0x8000. Same for the RX Other Call Logs, which now start at 0x9900. The Distress RX Logs now start at 0xB200.
FM Radio
The 890E has an FM radio, you can store up to 20 presets in the handheld and YCE20.
The radio presets are stored in the DAT file from 0x0500 to 0x063F like this:
Offset | Data | Format |
0x0 | Active preset flag | 0x01 (0x00 might mark a deleted preset) |
0x1-0x3 | FM frequency | 6 Nibbles, 3 for the MHz value, 3 for the kHz value |
0x4-0xA | Preset name | 12* ASCII character |
0xB-0xF | Padding? | 0xFF |
Presets are shown in alphabetic order in JCE20, but they appear in the DAT file in the order they were entered. Only when deleting a preset they are reordered in the DAT file to alphabetic order.
Interestingly, a preset with the frequency of 000.000MHz and 0x0 as 0x00 is stored at the end for each frequency that is deleted. This might be a bug in YCE20, or just a way to mark them deleted. Marking should not be needed, since unsaved presets are all 0xFF.
HX890E files
Below you find a collection of Standard Horizon HX890E specific files: DAT files, YCE20 programming software (to use the DAT files), firmware updates, manuals and brochures. All except the DAT files are downloaded from Standard Horizon UK or Yaesu.
The DAT files can be saved by using the right mouse button and selecting "Save link as..." or similar. If you just click on it, it will probably show the (non-readable) contents in a new window.
Using DAT files from my site can be illegal in your jurisdiction, make sure to comply with all applicable laws.
If you are using the DAT files below, please let me know if you like them at
Filename | Size |
---|---|
Firmware Update for HX890 Series_V0200.zip | 3.64 MB |
HX890BK_front.jpg | 1.39 MB |
HX890BK_left.jpg | 1.36 MB |
HX890E Factory default + NL region.dat | 64 KB |
HX890E NL channel names + config.dat | 64 KB |
HX890E NL kanaalnamen + NL Legal config 2023.dat | 64 KB |
HX890E NL kanaalnamen + NL Legal config hex-edited.dat | 64 KB |
HX890NB_front.jpg | 1.45 MB |
HX890NB_left.jpg | 1.44 MB |
HX890_E_OM_ENG_EM063N202_1905L-CC-2.pdf | 56.94 MB |
YCE20_1.0.1.2_setup.exe | 2.74 MB |
YCE20_Reference_Manual_1906-B.pdf | 5.28 MB |
hx890e-nederlandse-handleidingpdf.pdf | 53.91 MB |
standard-horizon-hx890-brochure-en-pdf.pdf | 4.58 MB |