Reverse-engineering the HP-35

New high-resolution chip photographs: chip photos

New ROM dump of HP-35 version 2: 35v2.obj

hp-35 version 4 assembler: 35.asm
hp-35 version 2 assembler: 35v2.asm
diff between them: 35.diff
disassembler, from obj to asm:

This version has the exp(ln(2.02)) bug and a few other bugs as well; see the errata list from HP. The three ROM chips included in this dump have part numbers 1818-0006, 1818-0017, and 1818-0020.

Below is a chip photograph of one of the three HP-35 ROMs. The array contains 2560 bits.

Here is a 128-bit portion of the ROM array (8 rows by 16 columns); the contacts representing individual bits are visible. The light source is from the right. A contact (dimple) represents a "1" bit, and no contact represents "0"; so reading in raster order, the bits go "000010011010...". The contacts are about 10 microns (0.0004 inch) on a side, enormous compared with modern versions, about 2000 of which would fit inside each one.

Reorganizing the raw bit array into a list of machine code instructions requires knowledge of how the address bits decode the array. After some trial and error, and staring at the decoder and mux transistors on the side of the chip, this recipe seems to do the trick:


Here is a revised casmsim distribution containing the full 768 words of HP-35 code (as hp35.asm) and modifications to xio.c for an X Window System simulation of the HP-35 keyboard and display. Just type "make ; ./hp35" (ignore the warnings when assembling the hp-35 code, which is raw from the disassembler below). All three simulators (HP-35, HP-45, and HP-55) seem to be fully working, with the exception of the HP-55 program and timer modes, for which I don't know how to emulate the selector switch.


This code is based on Eric Smith's original assembler and simulator, CASMSIM. Note that his version has some errors in the HP-45 and HP-55 code which have been corrected in the revised version above.

Screenshot of the HP-35 emulator after calculating arcsin(arccos(arctan(tan(cos(sin(9)))))). This is the function used by Calculator Forensics; the result matches the listing for the (bugless) HP-35.

Here is a quick-hack disassembler for the HP Classic CPUs, written in Python.

The HP-35 processor circuit board. The ROMs are the three central chips in metal-can packages, the tops of which have been removed.