RAM Addresses and Routines – Ira Goldklang's TRS-80 Revived Site

RAM Addresses and Routines

The following keys for DOSes apply:
T1 – Model 1 TRSDOS
T3 – Model 3 TRSDOS
N1 – Model 1 NEWDOS
N3 – Model 3 NEWDOS
L1 – Model 1 LDOS
L3 – Model 3 LDOS
M1 – Model 1 MULTIDOS
M3 – Model 3 MULTIDOS
D1 – Model 1 DOSPLUS
D3 – Model 3 DOSPLUS
All – All DOSes, Model I and Model III.

RAM Addresses and Routines:
Address
(Hex/Dec)
Official
Symbol
Model Code
Description
3000H-37DDH
 ↳ 12288-14301
1
Reserved.  Unused in Model I.
3000H
 ↳ 12288
3
Write 500 baud cassette leader and sync byte.
3003H
 ↳ 12291
3
Write 1500 baud cassette leader and sync byte.
3006H
 ↳ 12294
3
Search for 500 baud cassette leader and sync byte.
3009H
 ↳ 12297
3
Search for 1500 baud cassette leader and sync byte.
300CH
 ↳ 12300
3
Turn off cassette.
300FH
 ↳ 12303
3
Turn on cassette.
3012H
 ↳ 12306
3
Disk bootstrap routine.
3015H
 ↳ 12309
3
Power-up routine (jump here from 0002H).
3018H
 ↳ 12312
3
Maskable interrupt handler.
301BH
 ↳ 12315
3
RS-232-C initialization driver routine.
301EH
 ↳ 12318
3
RS-232-C input driver routine.
3021H
 ↳ 12321
3
RS-232-C output driver routine.
3024H
 ↳ 12324
3
Keyboard driver routine.
3027H
 ↳ 12327
3
I/O Route driver routine (not available on Model 4).
3029H
 ↳ 12329
3/4
To determine if a computer is a Model 3 or Model 4, peek this location.  If it is 0, it is a Model 4.
302AH
 ↳ 12330
3
Part of routine to search for cassette leader and sync byte (jumps here from 0229H).
302DH
 ↳ 12333
3
Part of LIST command (jumps here from 2B91H).
3030H
 ↳ 12336
3
Basic TIME$ function routine.
3033H
 ↳ 12339
3
$DATE routine (date to 8-character buffer pointed to by HL).
3036H
 ↳ 12342
3
$TIME routine (time to 8-character buffer pointed to by HL).
3039H
 ↳ 12345
3
Non-maskable interrupt handler.
3042H
 ↳ 12354
3
$SETCAS routine (prompt user to set cassette baud rate)
37DEH
 ↳ 14302
1
Communication Status Address
37DFH
 ↳ 14303
1
Communication Data Address
37E0H
 ↳ 14304
1
Interrupt Latch Address
37E1H
 ↳ 14305
DSEL$
1
Disk Drive Select Latch Address.  Value of 01H is Drive :0
37E4H
 ↳ 14308
1
Cassette Select Latch Address
(Values: 0-1 – SELECT TAPE DRIVE: 0=#1 1=#2
37E8H
 ↳ 14312
PRTAD$
1/3
$PRSTAT:  Printer Status Byte a/k/a Line Printer Address.

		If a parallel line printer is in use, it is mapped to this address. Writing a byte to this address sends it to the printer, while reading this address determines printer status as follows

		Bit 7 = 0 if NOT BUSY
Bit 6 = 0 if NOT OUT OF PAPER
Bit 5 = 1 if DEVICE SELECTED
Bit 4 = 1 if NO PRINTER FAULT
Bits 0-3 are NOT USED
63 [00111111] = Printer On (i.e., no printer fault, device selected)
143 [10001111] =Printer Off (i.e., printer fault, device not selected, busy).

	
37E9H
 ↳ 14313
1/3
$PROUT:  Output a Byte to the Printer.
37EAH
 ↳ 14314
1
Contains the byte from 37E8H (PRTAD)
37EBH
 ↳ 14315
1
Contains the byte from 37E8H (PRTAD)
37ECH
 ↳ 14316
FDCAD$
1
Floppy Disk Controller COMMAND/STATUS —

		This location is tested during the power-up sequence to determine if a floppy disk controller is online, and if so, the TRS-80 will jump to the disk boostratp routine (unless the BREAK key is held).  If either 00H or FFH is found, then no disk controller is found, and the TRS-80 will jump to Level II BASIC.

		Bit 1 from this memory location is DATA READY.

		Passing 1BH to this memory location is a command to SEEK.

		Passing 88H to this memory location is a command to READ SECTOR.

		Passing D0H to this memory location is a command to FORCE INTERRUPT.
	
37EDH
 ↳ 14317
1
DISK TRACK SELECT
37EEH
 ↳ 14318
FDCAD$+2
1
DISK SECTOR SELECT
37EFH
 ↳ 14319
FDCAD$+3
1
Byte read from disk (DISK DATA)
3800H-3840H
 ↳ 14336-14400
 ↳ 15105-15168
KEYAD$
1/3
Keyboard Memory / Address Matrix
3B80H
 ↳ 15232
1/3
Keyboard Memory / Address Matrix for SHIFT Keys
3C00H-3FFFH
 ↳ 15360-16383
DSPAD$
1/3
$VIDRAM:  The beginning of video ram.
3FCDH-3FCEH
 ↳ 16333-16334
 
End of BASIC Program Pointer (LSB,MSB)
3FFFH
 ↳ 16383
3
END OF VIDEO MEMORY
4000H
RST1$
1
RST 8 vector
4000H
 ↳ 16384
RST1$
TD
RST 08 (Syntax Check): Compare value pointed to by HL to that immediately following RST instruction.
4000H
 ↳ 16384
RST1$
1
Start of Level II BASIC Fixed RAM.
4003H-4005H
 ↳ 16387-16389
TD
RST 10H (Get Next Character): Jump Vector.
4003H
 
1
RST 10 vector
4003H
 
1
The next 3 bytes are used to hold the length and addr of a string when it is moved to the string area.
4006H
 
1
RST 18 vector
4006H
 ↳ 16390
 
RST 18H (Cp HL, DE) Jump Vector.
4009H
 
1
RST 20 vector
4009H
 ↳ 16393
 
RST 20H (Get Current Type) Jump Vector.
400CH-400EH
 ↳ 16396-16398
RST5$
1/3
RST 28H (Break Key Vector).  By default, it contains C9 00 00 (201 00 00) which is RET in NON-DOS BASIC.  Any 3 byte instruction code put here will execute on hitting the break key.

On a Model I, to disable the break key, Radio Shack recommends filling 16396 with 23 (17H) which is RLA (which just messes with Register A), and with 201 (C9H) RET to re-enable it.

On a Model III, to disable the break key, Radio Shack recommends filling the area with AF C9 00 (175 and 201) which is XOR A / RET.  Other methods include filling the area with C3 9A 0A (195 154 10) which is JP 0A9AH.
400CH
RST5$
1
RST 28 DOS request processing
400FH
RST6$
1
Load debug (ld a,xx/RST 28)
400FH
 ↳ 16399
RST6$
Model III
RST 30H Jump Vector.
4012H-4014H
 ↳ 16402-16404
RST7$ or INTERP
1/3
RST 38H Jump Vector.
4012H
 
RST7$ or INTERP
1
RST 38 interrupt service call

4015H-401CH – Keyboard Device Control Block
4015H-401CH
 ↳ 16405-16412
KDCB$
1/3
Keyboard Device Control Block (DCB)
4015H
 ↳ 16405
KDCB$<
Model III
Tape RAM – Keyboard DCB Type = 1 = Read Only
4015H
 
KDCB$<
1
Keyboard dcb (8 bytes)
4016H
 ↳ 16406
Model III
Two byte keyboard driver vector.
Model III its 3024H, which JUMPs to 338EH which then processes the keyboard)
4016H-4017H
 ↳ 16406-16407
Model I
Keyboard Device Control Block
Two byte keyboard driver vector.
To Disable The Model I Keyboard:
N1=PEEK(16406)
N2=PEEK(16407)
POKE16406,154
POKE16407, 10To Enable The Model I Keyboard:
POKE 16406,N1
POKE 16407,N2
4015H
 ↳ 16405
KDCB$
Model I
Keyboard DCB + 0: This address holds the DCB Type
4016H
 ↳ 16406
Model I
Keyboard DCB + 1: This address holds byte 1 of the 2 byte Driver Address
4017H
 ↳ 16407
Model I
Keyboard DCB + 2: This address holds byte 2 of the 2 byte Driver Address
4018H
 ↳ 16408
Model I
Keyboard DCB + 3: This address holds “0”
4018H
 ↳ 16408
1/3
Keyboard DCB: Right Shift Toggle
4019H
 ↳ 16409
Model I
Keyboard DCB + 4: This address holds “0”
4019H
 ↳ 16409
Model III
Caps Lock Toggle.  0=Off (i.e., upper and lower case).  Anything else, ALL CAPS.  Note: A DOS driver might take over this function.
401AH
 ↳ 16410
Model I
Keyboard DCB + 5: This address holds “0”
401AH
 ↳ 16410
Model III
Cursor Blink Count.
401BH
 ↳ 16411
Model I
Keyboard DCB + 6: This address holds “K”
401BH
 ↳ 16411
Model III
Cursor Blink Status. (0=Off Nz=On)
401CH
 ↳ 16412
Model I
Keyboard DCB + 7: This address holds “I”
401CH
 ↳ 16412
1/3
Cursor Blink Switch.  Set to 0 for blink, and anything else for no blink.

401DH-4024H – Video Display Control Block
401DH-4024H
 ↳ 16413-16420
DDCB$
1/3
Beginning of Video Display Control Block (DCB).  DCB is Number 7.  Classification is both Input and Output.
401EH-401FH
 ↳ 16414-16415
IX+1
IX+2
1/3
Two byte video driver address in LSB / MSB order
4020H-4021H
 ↳ 16416-16417
CURSOR
IX+3
IX+4
1/3
Cursor Position On Screen.  2 Bytes in LSB/MSB Order.
4022H
 ↳ 16418
IX+5
1
Cursor Character:  0 = Cursor Off, Not 0 = Cursor Character.
4022H
 ↳ 16418
Model III
Cursor On/off Flag (z = Off Nz = Character Undercursor)
4023H
 ↳ 16419
 
Cursor Character (in ASCII).  Defaults to 176.  Must be between 32 and 255.
4023H
 ↳ 16419
Model III
Tape RAM – Video DCB: Cursor Character (default 0b0h)
4024H
 ↳ 16420
 
FLAG : 0 = Space compression; Not 0 = special character.
4024H
 ↳ 16420
3
Character Set To Use:  0=Regular, 1=Alternate
4024H
 ↳ 16420
Model III
Tape RAM – Video DCB: Tabs/special Characters Switch (z = Tabs)

4025H-402CH – Printer Control Block
4025H
 ↳ 16421
PDCB$
IX+0
1/3
Printer DCB.  IX+0 = DCB Type (6).  Classification = Write Only
4026H-4027H
 ↳ 16422-16423
IX+1
IX+2
1/3
Print Driver Address (stored in LSB/MSB Order).
4028H
 ↳ 16424
IX+3
1/3
Printer: Maximum Number of Lines which can be Printed per Page plus 1.  The default is 67.  0 if top-of-page
4029H
 ↳ 16425
IX + 4
1/3
Printer: Number of lines already printed +1.  To reset the counter, POKE 16425,1.
402AH
 ↳ 16426
1/3
Model 1: Not Used
402AH
 ↳ 16426
Model III
Printer DCB: # Characters Printed + 1
402BH
 ↳ 16427
Model III
Line printer maximum characters (width) per line less 2.  Set at 255 for no maximum.

… continues
402DH
 
SYS1IN
1
Make sys1 (10) DOS request
402DH
 ↳ 16429
SYS1IN
 
EXIT:  Normal program exit back to DOS.  (Disk systems only).
402DH
 ↳ 16429
SYS1IN
Model III
Tape RAM – Printer DCB: Jp 5000h Unused Dos Vector
4030H
 
ABORT
1
DOS request code for sys1
4030H
 ↳ 16432
ABORT
 
For all doses except TRSDOS, Jumping here is for an abnormal return to DOS ready, such as after an unsuccessful program exit.
4030H
 ↳ 16432
Model III
Tape RAM – Printer DCB: RST 0
4032H
 
1
Write ‘DOS ready’ msg
4033H
 
CIO$
1
Call device driver ala DOS
4033H
 ↳ 16435
Model III
Tape RAM – Printer DCB: XOR A and RET
4036H-403CH
 ↳ 16438-16444
KYBT$
1/3
Keyboard Bit Image (7 Byte Buffer).  This is the work area for keyboard input routine.

	The contents of the keyboard rows are stored here so that when the keyboard routine is called, it can determine whether the key has just been depressed (or is still being held down).

	4036H = keyboard row address 3801H: @ABCDEFG keys.

	4037H = keyboard row address 3802H: HIJKLMNO keys.

	4038H = keyboard row address 3804H: PQRSTUVW keys.

	4039H = keyboard row address 3808H: XYZ keys.

	403AH = keyboard row address 3810H: 01234567 keys.

	403BH = keyboard row address 3820H: 89:;,-./ keys.

	403CH = keyboard row address 3240H: Enter, Clr, Brek, Up, Down, Left, Right, and Space keys.
	
403DH
 ↳ 16445
Level 2

	Cassette port and print size flag (bit 3) copy (For Model III, see 4210H).

	Bit 3 – Select video 32 character mode if set

	Bit 2 – Turn the cassette tape relay on if set

	Bits 1 and 0 – Positive and negative audio pulses to the AUX plug.

	So if the value is 0, then the video is in 64 characters per line.  If the value is 8, then the video is in 32 characters per line.
	
403DH
 
CAST$
1
Display control word (u/l case)
403DH
 ↳ 16445
CAST$
M1 DOS / Model III
Tape RAM – Interrupt Vector 3 – JP 35FAH.  This MAY be the routine to add a task to the interrupt chain.
403DH
 ↳ 16445
CAST$
M3 DOS
Used primarily by the Disk Operating System, vectors at 403DH, 4040H, and 4043H service interrupt vectors 3, 6, and 7 respectively (under non-disk systems all contain a jump to 35FAH, which in turn contains a “RET” instruction). 4046H is an interrupt vector servicing the clock (interrupt vector 2) and contains a jump to 35A9H in a non-disk system. 4049H is the Non-Maskable Interrupt vector and normally contains a RST 0 instruction. The remainder of this area is unused in non-disk systems.
403EH-407FH
 ↳ 16446
CURDOS
M1
Unused in non-Disk systems.  Real time clock storage locations are kept here.  For the Model III this would be 4216H-421CH.
403EH
 
CURDOS
1
Used by DOS
403EH
 ↳ 16446
CURDOS
D1
OSVER$: Holds the DOS Version Number.  Stored in DCB format.  Note on a M3 this is stored in 441FH and on the M4 in 0085H
403FH
 
1
Used by DOS
4040H
 
1
System bst’s
4040H
 ↳ 16448
Model I
25 ms heartbeat counter.
4040H
 ↳ 16448
Model III
Interrupt Vector 6 – JP 35FAH.  Vector 6 may be “remove task from interrupt chain”.
4041H-4043H
 ↳ 16449-16451
XTIME
L1, D1, and M1
TIME$, time of day: Seconds, Minutes, Hours
4041H
 
XTIME
1
Seconds
4042H
 
1
Minutes
4043H
 
1
Hours
4043H
 ↳ 16451
L3
Change address of interupt task.
4043H
 ↳ 16451
Model III
Tape RAM – Interrupt Vector 7 – JP 35FAH
4044H-4046H
 ↳ 16452-16454
L1, D1, and M1
DATE$, date: Year, Day, Month.  Stored in BCD.
4044H
 
1
Year
4045H
 
1
Day
4046H
 
1
Month
4046H
 ↳ 16454
L3
Remove task from interupt chain.
4046H
 ↳ 16454
Model III
Tape RAM – Interrupt Vector 2 – JP 35A9H 
4047H
 
1
Load address for system utilities 2 bytes, initialized to 5200 by sys0/sys
4047H
 ↳ 16455
L1
Current day in coded form.
4048H
 
1
Current interrupt status word
4049H-404AH
 ↳ 16457-16458
MEMEND
1
DOS MEMORY SIZE.  Highest available memory location (On a Model III it is stored at 4411H)
4049H
 ↳ 16457
MEMEND
Model III
Tape RAM – RST 0 NMI Vector (Reset If So)
404BH
 ↳ 16459
L1
Contains image of interrupt latch.
404CH
 
1
Interrupt subroutine mask
404DH-404EH
 
T1
Address of interrupt service routine for interrupt bit 0
404DH
 
1
Reserved (interrupt bit 0)
404FH-4050H
 
T1
Address of interrupt service routine for interrupt bit 1
404FH
 
1
Reserved (interrupt bit 1)
4050H-4051H
 ↳ 16463-16464
Model I
FDC Interrupt Vector
4050H
 
1
Stack during ipl
4051H-4052H
 
T1
Address of interrupt service routine for interrupt bit 2
4051H
 
1
Communications interrupt subroutine
4052H-4053H
 ↳ 16465-16466
Model I
Communications Interrupt Vector
4053H-4054H
 ↳ 16465-16466
T1
Address of interrupt service routine for interrupt bit 3
4053H
 
1
Reserved (interrupt bit 3)
4055H-4056H
 
T1
Address of interrupt service routine for interrupt bit 4
4055H
 
1
Reserved (interrupt bit 4)
4057H-4058H
 
T1
Address of interrupt service routine for interrupt bit 5
4057H
 
1
Reserved (interrupt bit 5)
4058H
 
1
Addr of clock interrupt routine
4059H-405AH
 
T1
Address of interrupt service routine for interrupt bit 6
4059H
 
1
Addr of disk interrupt routine 
405BH-405CH
 
T1
Address of interrupt service routine for interrupt bit 7
405EH
 ↳ 16478
Model I
25 MSec Heartbeat Interrupt
4070H
 
1
Start of stack during ROM ipl
407DH
 ↳ 16509
TSTK$
DOS
Stack pointer for DOS, set by the ROM bootstrap routine
407EH
 
1
Reserved
407FH
 
1
Reserved
4080H
 
FDIVC or RAMLOW
1
Subtraction routine used by division code. Code is moved from ’18f7′ – ‘1904’ during non-disk ipl or by baSIC UTILITY FOR DISK SYSTEMS
4081H
 ↳ 16513
FDIVC+1
Model 1/3
Used in the single precision division routine (stores the LSB).  On power up, this routine is moved from 18F7H-1904H to here.
4084H
 ↳ 16516
FDIVB
Model 1/3
Used in the single precision division routine.
4085H
 ↳ 16517
FDIVB+1
Model 1/3
Used in the single precision division routine (stores the NMSB).
4088H
 ↳ 16520
FDIVA
Model 1/3
Used in the single precision division routine.
4089H
 ↳ 16521
FDIVA+1
Model 1/3
Used in the single precision division routine (stores the MSB).
408BH
 ↳ 16523
FDIVG
Model 1/3
Used in the single precision division routine
408CH
 ↳ 16524
FDIVG+1
Model 1/3
Used in the single precision division routine (stored the High Order).
408EH-408FH
 ↳ 16526-16527
USRTAB
Level 2
(L2 only) Entry point to USR routines.  If you poke the starting addresses correctly, then X=USR(0) will run that routine.  16526 gets the LSB and 16527 gets the MSB.
408EH
 
USRTAB
1
Contains address of user subroutine
408EH
 ↳ 16526
USRTAB
Model III
Tape RAM – Tape RAM: Address Of USR Subroutine
408EH
 ↳ 16526
MAXFIL
T1
TRSDOS 2.3 stores the answer to the FILES? Question
408FH
 ↳ 16527
VARREC
T1
TRSDOS 2.3 Flag for whether Variable Files were permitted on Entry into BASIC
4090H
 
MULTR
1
Random number seed
4090H
 ↳ 16528
MULTR
Model III
Tape RAM – Tape RAM: Random Number Seed 2
4093H-4098H
 ↳ 16531-16536
STAINP
1/3
Input and output port routines
4096H
 ↳ 16534
OUTWRD
1/3
Tape RAM – Tape RAM: Out Support
4099H
 ↳ 16537
CHARC
1/3
INKEY$ storage. Most recent keyboard character, stored in ASCII.
409AH
 ↳ 16538
ERRFLG
1/3
Current Error Code is stored at this address (for BASIC only).  It would be returned by the ERR function.
409BH
 
LPTPOS
1
No. Of chars. In current print line
409BH
 ↳ 16539
LPTPOS
Level 2 / Model III
Current TAB position of line printer. This byte contains a count of the number of characters already printed on the current line, and may be used to simulate a TAB function that works correctly past the 63 or 127 character limit of the BASIC TAB function, as TAB cannot be greater than 63 for an old Model I or 127 for a new Model I or any Model III.
409CH
 ↳ 16540
PRTFLG
1/3
$OUTSEL. This is the device output flag.  It will contain -1 (or 129) for Cassette Output, 0 for Video Output, 1 for Printer Output.
409DH
 ↳ 16541
LINLEN
Level 2
Maximum number of characters on video display line. Used by PRINT command routine when printing numeric variables or constants so that a number does not overflow the end of a video display line. This location is set to 64 at power-up and is not changed by the BASIC interpreter once set. However, a POKE to this location may be used to prevent the PRINTing of numerics beyond a certain point on a line. Also, if you are operating in 32-character display mode it may be necessary to POKE 16541, 32 to prevent numeric printouts from overflowing the end of the line. The setting of this location does not affect the printout of strings (variables or constants).
409EH
 
CLMLST
1
Size of print line
409EH
 ↳ 16542
CLMLST
Model III
The value in this location specifies the maximum number of 16-character print zones on a line (used when items in a PRINT statement are separated by commas). Value stored here is decoded as follows: 0 = one print zone, 16 = two print zones, 32 = three print zones, and 48 = four print zones per line (when a comma separator is found in a PRINT statement, BASIC checks the cursor line position byte at 40A6H and if it is greater than or equal to the value stored~here, a carriage return is output to the video display driver). This location is set to 48 (four print zones) at power-up and is not changed by the BASIC interpreter once set.
409FH
 
1
Reserved
409FH
 ↳ 16543
Model III
Tape RAM – Data flag.  Will indicate if the parser is in a QUOTED STRING (Bit 0 high), REM  (Bit 2 high), or DATA (Bit 1 high).
40A0H-40A1H
 ↳ 16544-16545
STKTOP
1/3
String Storage Area:  2 Bytes point to the lowest address available for string storage.  This is ALSO the top of free memory.  Start of string storage area, set to 50 less than top of memory pointer (at 40BlH) at power-up to provide 50 bytes of string storage area. Changed by use of CLEAR n command (with argument).
40A2H-40A3H
 ↳ 16546-16547
CURLIN
1/3
Current Line Number in a BASIC Program in 2 Bytes (LSB/MSB) or FFFFH if in direct mode.
40A4H-40A5H
 ↳ 16548-16549
TXTTAB
1/3
BASIC Program Beginning Pointer in 2 bytes (LSB/MSB).  It is the start of the BASIC program in RAM (referred to sometimes as the PST).

Normal values for: (L2)=42E9; (Disk BASIC)=varies with version of DOS/BASIC.

TO APPEND, first POKE 16548,PEEK(16633)-2 : POKE16549,PEEK(16634).  Then CLOAD.  Then POKE16548,233 : POKE 16549,66.

(What this does is trick the NEW command, which is called as part of CLOAD, into clearing everything AFTER your current program and then restoring where the beginning of the program is afterwards.)

This is NOT a MERGE, it will APPEND, and leave line numbers out of order.
40A6H
 ↳ 16550
TTYPOS
1/3
Current cursor position on video display line (as returned by the POS function).
40A7H-40A8H
 ↳ 16551-16552
BUFPNT
1/3
Input Buffer Pointer (in BASIC).  The address of the basic keyboard buffer.
Note: Also used by BASIC while encoding and decoding BASIC lines (as during LIST, etc.)
40A9H
 ↳ 16553
CASFLG
1/3
Used by INPUT command routine, contains zero byte if (and only if) input is from cassette. A bug in the first release of the Model I Level II BASIC ROM required that this location be POKEd with a non-zero value prior to reading program DATA statements. This bug was corrected soon after Level II BASIC was released, so that this POKE is required only for older TRS-80 Model I machines.
40AAH-40ACH
 ↳ 16554-16556
RNDX
1/3
Seed Number 1 for Random Number
40AAH
 
RNDX
1
Random number seed
40ABH
 
RNDX+1
1
Value from refresh register
40ABH
 ↳ 16555
RNDX+1
1/3
When a RANDOM is executed in BASIC, this is the byte that gets changed (it is loaded with current value of Refresh register whenever RANDOM statement is executed).
40ACH
 
RNDX+2
1
Last random number (2 bytes)
40ADH
 ↳ 16557
1/3
Unused in non-disk systems.
40AEH
 
DIMFLG
1
Flag: 0 – locate named variable, -1 – create entry for named variable
40AEH
 ↳ 16558
DIMFLG
1/3
This flag is used by the BASIC locate or create variable routine. If location contains zero, variable is to be created or located ( if already created). If byte is not zero, variable is to be created only and an error exists if the variable is found to be already created. The latter situation exists when an array is being created using the DIM statement.
40AFH
 
VALTYP
1
Type flag for value in Work-Register-Area-1.  2 – Integer 3 – string 4 – single precision 8 double precision
40AFH
 ↳ 16559
VALTYP
1/3
$SAFLAG. Contains the variable tyle flag for the software accumulator.  It will contain a 2 for integer, 3 for string, 4 for single-precision, and 8 for double precision.
40B0H
 
DORES
1
Holds intermediate value during expression eva
40B0H
 ↳ 16560
DORES
1/3
Used to flag DATA statements while encoding BASIC lines, and to store operator number during expression evaluation.
40B1H-40B2H
 ↳ 16561-16562
MEMSIZ
1/3
$MEMTOP.  Top of memory pointer. Last usable location for BASIC. This pointer is set by one of the following: If the user answers Memory Size? question with a value, it will be used. However, if only ENTER is pressed in response to Memory Size?, then on a non-disk system the highest available memory location will be used, but under Disk BASIC the DOS top of memory pointer will be copied into this location. If one is programming in BASIC and attempting to change this pointer by POKEing in new values, a CLEAR n statement (with a mandatory numeric argument) should be used immediately following the POKEs, in order to adjust other system pointers to the new memory size. Also, temporarily changing this pointer will allow a short BASIC program to CLEAR more than 32767 bytes of string space on a 48K system, provided that enough free memory is available (BASIC normally does not permit this).
40B3H-40B4H
 ↳ 16563-16564
TEMPPT
Level 2
Pointer to the next available location for storage of a three-byte string variable VARPTR in the string VARPTR storage area that begins at 40B5H.
40B5H-40D2H
 ↳ 16565-16597
TEMPST
Level 2
String variable VARPTR storage area. Holds three-byte string descriptors (first byte contains length, second and third bytes contain address of string) for strings currently being used in BASIC string operations (such as “temporary” strings).
40D3H-40D5H
 ↳ 16585-16587
DSCTMP
 
VARPTR storage area for string currently being created by BASIC. (first byte contains length, second and third bytes contain address of string).
40D6H-40D7H
 ↳ 16598-16599
FRETOP
1/3
Pointer to next free byte in string storage area. Strings build downward from the top of memory, therefore at power-up (or when a CLEAR command is executed) this pointer will contain the same address as the top of memory pointer ( 40BlH-40B2H) . If a ten byte long string is then created, this pointer will point to the top of memory minus ten, and so on. When there is not enough room left to insert a new string (the difference between this pointer and the one at 40A0H-40A1H is less than the length of a string to be stored), a “garbage collection” is performed, and if that does not free enough string space an Out of String Space error occurs. Under some circumstances, we may be able to manipulate this pointer in order to forestall a “garbage collection” (which may appear to “lock up” the computer for as much as several MINUTES) . For example, if we are performing some operation that will create many “temporary” strings (but none that we want to save after a certain point), we could PEEK at the values in these pointer locations and store them in numeric variables. At the completion of our string operation, we could then re-POKE the original pointer values, thus abandoning the unneeded strings without performing a “garbage collection”. Under certain circumstances this technique could cut program execution time considerably.	 
40D6H-40D7H
 ↳ 16598-16599
FRETOP
>1
Pointer to next available loc. In string area
40D8H-40D9H
 ↳ 16600-16601
TEMP3
Level 2
This pair (two byte) of locations is used a temporary storage location by more than one routine. Uses include program pointer during expression evaluation, pointer to data while processing DIM statement, pointer to end of array while packing strings, and within the PRINT USING routine the byte at 40D8H is used to temporarily store the PRINT USING format flag bits.
40D8H
 
TEMP3
1
1: Index of last byte executed in current statement. 2: Edit flag during print using
40DAH-40DBH
 ↳ 16602-16603
DATLIN
Level 2
Line number of last DATA item read. Line number is saved so that in the event of a syntax error in a DATA statement, the proper error line number will be displayed and the EDIT mode will function on the correct line.
40DAH
 
DATLIN
1
Line no. Of last data statement
40DCH
 
SUBFLG
1
For flag (1 = for in progress 0 = no for in progress)
40DCH
 ↳ 16604
SUBFLG
Level 2
If this byte contains 64 a FOR-NEXT loop is being processed, otherwise byte will contain zero.  Used to prevent an array variable from being used as the index counter in a FOR-NEXT loop (for example, the statement FOR X(0) = 1 TO 10 will cause a syntax error, because X(0) is an array variable and cannot be used as the counter variable).	
40DDH
 
BFKLFL
1
0 During input phase, zero otherwise
40DDH
 ↳ 16605
BFKLFL
Level 2
Flag indicates whether inputing text.  Used by RETURN and RESUME NEXT commands.
40DEH
 
FLGINP
1
Read flag: 0 = read statement active, 1 = input statement active also used in print using to hold separatoR BETWEEN STRING AND VARIABLE
40DEH
 ↳ 16606
FLGINP
Level 2
Used for two different purposes: Flags whether READ or INPUT statement when processing those commands (zero represents INPUT).  Also used to store delimiter character during processing of PRINT USING statement.
40DFH-40E0H
 ↳ 16607-16608
TEMP
1/3
Used by several routines, as a pointer to variable receiving new value during evaluation of a LET expression, execution address of BASIC program, etc. Also, after a SYSTEM tape is loaded these locations contain the entry point address of the program (which is used if only a / is typed in response to the next SYSTEM command prompt).  Is in LSB, MSB order.
40DFH
 
TEMP
1
Holds execution addr for pgm loaded with DOS request
40E1H
 
AUTFLG
1
Auto increment flag 0 = no auto mode non-zero holds next line
40E1H
 ↳ 16609
AUTFLG
 
AUTO on or off flag.  0=AUTO is off.
40E2H-40E3H
 ↳ 16610-16611
AUTLIN
Level 2
Line Number:  Current line number for the AUTO command.
40E2H
 
AUTLIN
1
Current line number in binary (during input phase)
40E4H
 ↳ 16612
AUTINC
 
AUTO command increment value
40E6H-40E7H
 ↳ 16614-16615
SAVTXT
1/3
Pointer to terminator (end of line 00H byte or “:”) of the last executed Basic statement is at this address.
40E6H
 
SAVTXT
1
During input: addr of code string for current statement.  During execution: line no. For current statement
40E8H-40E9H
 ↳ 16616-16617
SAVSTK
1/3
Pointer to the beginning of the STACK POINTER.
40E8H
 
SAVSTK
1
During execution: holds stack pointer value when statement execution begins
40EAH-40EBH
 ↳ 16618-16619
ERRLIN
1/3
Line Number:  The line number which generated an error.  This is used for RESUME.  If it is 65535, the error originated in command mode instead of in a program.
40EAH
 
ERRLIN
1
Line no. In which error occurred
40ECH-40EDH
 ↳ 16620-16621
DOT
Level 2
Stores the current line number.  Can also be the Line Number for the EDIT command.
40EEH-40EFH
 ↳ 16622-16623
ERRTXT
Level 2
Pointer to last byte executed when error occured. Used by RESUME command.
40F0H-40F1H
 ↳ 16624-16625
ONELIN
Level 2
Line Number:  ON ERROR location for ON ERROR GOTO.  That means it is the line number which the error will jump to.
40F2H
 ↳ 16626
ONEFLG
 
Flag to indicate whether an error has occured. Set to -1 (FFH) on error, otherwise set to zero (such as after RESUME statement has been executed). POKEing the appropriate values into this loca0ion will allow you to do many things that BASIC normally does not permit, such as exiting an error trap without using a RESUME statement, or redefining the error trap (by using an ON ERROR GOTO statement) from within a previously defined error trap.
40F3H-40F4H
 
TEMP2
1
Addr of decimal point in pbuff
40F5H-40F6H
 ↳ 16629-16630
OLDLIN
Level 2
Last line number executed prior to execution of STOP or END statement or termination using the BREAK key.
40F7H-40F8H
 ↳ 16631-16632
OLDTXT
Level 2
Pointer to end of last statement executed (points to the colon or zero byte terminator). Used by CONT command.
40F9H-40FAH
 ↳ 16633-16634
VARTAB
Level 2
Starting address of the simple variables list table.  This is also one higher than the last of the three zero bytes marking the end of the BASIC program. Used to determine end of BASIC program when saving the program. Note that by taking the address stored here, subtracting 2, and POKEing the resulting address into the start of BASIC program pointer at 40A4H-40A5H, then loading a program with higher line numbers than the one presently in memory, and finally re-POKEing the original values of 40A4H-40A5H back into those locations, it is possible to append a program to a program already in memory.
40FBH-40FCH
 ↳ 16635-16636
ARYTAB
1/3
Starting address of the ARRAY VARIABLE TABLE (end of simple variables)
40FDH-40FEH
 ↳ 16637-16638
STREND
1/3
Pointer to the END of array variables a/k/a start of free memory pointer in LSB, MSB order
40FFH-4100H
 ↳ 16639-16640
DATPTR
1/3
‘DATA’ Pointer (2 Byte Address; LSB, MSB).
Points to comma or other terminator at end of last item read – search for next DATA i tern to be read will begin here. RESTORE changes this pointer to point to one byte prior to beginning of BASIC program.
A selective RESTORE to some data item past the first can be accomplished by manipulating this pointer.  For example, suppose that at some point in your program you will want to RESTORE to the 51st DATA item. At the start of your program you could insert a line similar to this:FOR X=l TO 50 : READ X$ : NEXT
R1=PEEK(16639): R2=PEEK(16640) : RESTOREThen, whenever you wanted to RESTORE to the 51st DATA item, you would simply execute the following statements:POKE 16639,R1: POKE 16640,R2The next READ instruction would then get the 51st DATA item.
4101H-411AH
 ↳ 16641-16666
DEFTBL
1/3
Variable declaration list. There are 26 entries (1 for each letter of the alphabet).  The location at 4101H appiies to variables starting with the letter A, 4102H applies to variables starting with B, 4103H to variables starting with C and so on up to 411AH, which contains the default type for all variables starting with the letter Z. Each location contains one of the following values: 2 (integer), 3 (string), 4 (single precision), or 8 (double precision). When a variable name is used in a BASIC program and does not have a specific type declaration character ( % , $, ! , or #) following, its type defaults to the type specified in this table. All defauits are set to single-precision when a program is RUN, and may be changed through use of the DEFINT, DEFSTR, DEFSNG, or DEFDBL statements.
411BH
 ↳ 16667
TRCFLG
1
Trace flag: 0=off (TROFF), non-zero=on (TRON)
411CH
 
DFACLO-1
1
Temp storage used by numeric routines when unpacking a floating point number. Usually it holds the last byTE SHIFTED OUT OF THE LSB POSITION
411DH-4124H
 ↳ 16669-16676
DFACLO
1/3
Software Accumulator (SA) – 2 Bytes
411DH
 
DFACLO
1
Work-Register-Area-1 – lsb of dbl prec. Value
4120H
 
FACLO-1
1
Work-Register-Area-1 – dbl prec value
4121H-4122H
 ↳ 16673-16674
FACLO
Model III
Single precision number storage area for single precision math routines – 2 Bytes (4121H=MSB)
4123H-4124H
 ↳ 16675-16676
FAC-1
Model III
Single precision number storage area for single precision math routines – 2 Bytes (4123H=MSB)
4123H
 
FAC-1
1
Work-Register-Area-1 – msb for single prec
4124H
 
FAC
1
Work-Register-Area-1 – exponent for single prec
4125H
 
FAC+1
1
Sign of result during math & arithmetic operations
4126H
 
ARGLO-1
1
Bit bucket used during dp addition
4127H-412EH
 ↳ 16679-16686
ARGLO a/k/a ARG-7
1/3
Alternate Software Accumulator (SA1 or REG2) – 2 Bytes
4127H
 
ARGLO
1
Work-Register-Area-2 – lsb
4128H
 
1
Work-Register-Area-2
4129H
 
1
Work-Register-Area-2
412AH
 
1
Work-Register-Area-2
412CH
 
1
Work-Register-Area-2
412DH
 
ARG-1
1
Work-Register-Area-2 – msb
412EH
 
ARG
1
Alternate Software Accumulator – exponent
412FH
 ↳ 16687
FBUFFR
Level 2 (Non-Disk)
Unused.
4130H-4149H
 ↳ 16688-16689
FBUFFR+1
Level 2
Multipurpose Storage/Work Area.  Buffer used to store result of conversion of numbers to displayable ASCII characters. When positive integers (BASIC line numbers, etc.) are converted, the area from 4130H to 4136H is used, and the string is stored right justified with leading spaces in locations 4130H to 4135H (4130H always contains a space character), while 4136H always contains a zero byte to terminate the string. Other routines (such as PRINT USING) may use more of this area.
414AH
 ↳ 16714
FBUFFR+27
Model III
Tape RAM – Workspace For Double Precision Division (8 Bytes).  Basically, a temporary ACCUM sometimes used by arithmetic routines (such as to hold divisor used by double precision division routine).
414FH
 
FMLTT1
1
Temp. Storage
4150H
 
FMLTT2
1
Temp. Storage
4151H
 
FBUFFR+34
1
End of temp area locations 4152 thru 41e2 contain DOS exits and disk basic exits. On non-disk systems thesE LOCATIONS ARE INITIALIZED TO RETURNS (RET’S) WHILE ON DISK BASED SYSTEMS THEY WILL BE INITIALIZED AS SHOWN.

4152H-41A6H – DISK BASIC entry points
4152H
 ↳ 16722
ERCALL
1/3
Disk BASIC Vector: CVI vector (3 byte jump command to handler)
4155H
 ↳ 16725
1/3
Disk BASIC Vector: FN vector (3 byte jump command to handler)
4158H
 ↳ 16728
1/3
Disk BASIC Vector: CVS vector (3 byte jump command to handler)
415BH
 ↳ 16731
1/3
Disk BASIC Vector: DEF vector (3 byte jump command to handler)
415EH
 ↳ 16734
1/3
Disk BASIC Vector: CVD vector (3 byte jump command to handler)
415FH
 
1
Work-Register-Area-1 – dbl prec value
415?H
 
1
Disk basic exit (cvd)
4160H
 
1
Disk basic exit (mks$)
4161H
 ↳ 16737
Model 1/3
Disk BASIC Vector: EOF vector (3 byte jump command to handler)
4164H
 ↳ 16740
Model 1/3
Disk BASIC Vector: LOC vector (3 byte jump command to handler)
4167H
 ↳ 16743
Model 1/3
Disk BASIC Vector: LOF vector (3 byte jump command to handler)
416AH
 ↳ 16746
Model III
Disk BASIC Vector: MKI$ vector (3 byte jump command to handler)
416DH
 ↳ 16749
Model III
Disk BASIC Vector: MKS$ vector (3 byte jump command to handler)
4170H
 ↳ 16752
Model 1/3
Disk BASIC Vector: MKD$ vector (3 byte jump command to handler)
4173H
 ↳ 16755
1/3
Disk BASIC Vector: CMD vector (3 byte jump command to handler)
4176H
 ↳ 16758
1/3
Disk BASIC Vector: TIMES$ vector (3 byte jump command to handler)
4179H
 ↳ 16761
1/3
Disk BASIC Vector: OPEN vector (3 byte jump command to handler)
417CH
 ↳ 16764
1/3
Disk BASIC Vector: FIELD vector (3 byte jump command to handler)
417FH
 ↳ 16767
1/3
Disk BASIC Vector: GET vector (3 byte jump command to handler)
4182H
 ↳ 16770
1/3
Disk BASIC Vector: PUT vector (3 byte jump command to handler)
4185H
 ↳ 16773
1/3
Disk BASIC Vector: CLOSE vector (3 byte jump command to handler)
4188H
 ↳ 16776
1/3
Disk BASIC Vector: LOAD vector (3 byte jump command to handler)
418BH
 ↳ 16779
1/3
Disk BASIC Vector: MERGE vector (3 byte jump command to handler)
418EH
 ↳ 16782
1/3
Disk BASIC Vector: NAME vector (3 byte jump command to handler)
4191H
 ↳ 16785
1/3
Disk BASIC Vector: KILL vector (3 byte jump command to handler)
4194H
 ↳ 16788
1/3
Disk BASIC Vector: & vector (3 byte jump command to handler)
4197H
 ↳ 16791
1/3
Disk BASIC Vector: LSET vector (3 byte jump command to handler)
419AH
 ↳ 16794
1/3
Disk BASIC Vector: RSET vector (3 byte jump command to handler)
419DH
 ↳ 16797
1/3
Disk BASIC Vector: INSTR vector (3 byte jump command to handler)
41A0H
 ↳ 16800
1/3
Disk BASIC Vector: SAVE vector (3 byte jump command to handler)
41A3H
 ↳ 16803
1/3
Disk BASIC Vector: LINE vector (3 byte jump command to handler)
41A6H
 
RETCNT
1
Disk basic exit (usr) the following addresses are the DOS exit addresses.
41A6H
 ↳ 16806
RETCNT
 
ERROR Error processing jumps to this three byte vector. In cassette BASIC it contains RET instruction, in Disk BASIC, contains a jump (through RST) to display long error messages.
41A9H
 ↳ 16809
M1, M3

		DOS Link For USR N (3 byte vector) which is used to expand function to provide up to ten USR calls.

		If you want to knock out all uses of USR in a BASIC program, POKE 16809,215:POKE 16810,216:POKE 16811,43:POKE 16812,201 to load this with RST 10, RET C, DEC HL, RET.  To be super sure, also then POKE 16527,65:POKE 16526,171 which will point to the RET.

	
41ACH
 
1
DOS exit from 1a1c
41ACH
 ↳ 16812
 
Ready prompt
41ACH
 ↳ 16812
Model III
Tape RAM – DOS Links: Link For Ready
41AFH
 
1
DOS exit from 0368
41AFH
 ↳ 16815
 
Called from 0368H to input line from keyboard to I/O buffer.
Inputs a line from the keyboard into the I/O buffer (zeroes INKEY$ buffer and video tab position indicator prior to call).
41AFH
 ↳ 16815
Model III
Tape RAM – DOS Links: Link For Inkey$
41B2H
 
1
DOS exit from ROM address 1aa1
41B2H
 ↳ 16818
Model III
Called from 1AA1H immediately after BASIC line is tokenized. HL points to tokenized line.
41B5H
 
1
DOS exit from ROM address 1aec
41B5H
 ↳ 16821
Model III
Called from 1AECH immediately after BASIC’s table of program lines are updated (insertion or replacement of a BASIC line). After call to 41B5H, BASIC calls CLEAR routine at 1B5DH then calls this dos exit from 1AF2H
41B8H
 
1
DOS exit from ROM address 1af2
41B8H
 ↳ 16824
Model III
Called at 1AF2H, after above call followed by call to 1B5DH (CLEAR command, leaves HL pointing to start of BASIC program -1).
41BBH
 
1
DOS exit from ROM address 1b8c
41BBH
 ↳ 16827
Model III
Called from 1B8CH and 1DB0H during NEW and END processing to allow Disk Basic to close any open files.
41BEH-41C0H
 ↳ 16830-16832
Level 2
(L2 only) Jumps here on RESET button hit.  You can put your own 3 byte instrtction here to jump to your own routine.
41BEH
 
1
DOS exit from ROM address 2174
41BEH
 ↳ 16830
Model III
Called at 2174H, at termination of PRINT statement (used to terminate output to disk using PRINT# statement).
41C1H
 
1
DOS exit from ROM address 032c
41C1H
 ↳ 16833
Model III
Byte output to any device. Called from 032CH so output to disk can be handled as to other devices.
41C4H
 
1
DOS exit from ROM address 0358
41C4H
 ↳ 16836
Model III
ROM KB scan (0358H) calls this exit.  BASIC processes INKEY$ here and also after each command when system searches for break or shift @.
41C7H
 
1
DOS exit from ROM address 1ea6
41C7H
 ↳ 16839
Model III
Called from 1EA6H when RUN is followed by filename or line number
41CAH
 
1
DOS exit from ROM address 206f
41CAH
 ↳ 16842
Model III
Related to 41BEH above. Called at beggining of print processing from 206FH to check for possible disk output (i.e., PRINT#).
41CDH
 
1
DOS exit from ROM address 2103
41CDH
 ↳ 16845
Model III
Called from 20C6H. Call is made during print processing after number is in ASCII and just before printing. Could be used for Hex and Binary printing.
41D0H
 
1
DOS exit from ROM address 2103
41D0H
 ↳ 16848
Model III
Called from 2103H (from PRINT routine after code that send CR.)  Could be used for screen wrap-around.
41D3H
 
1
DOS exit from ROM address 2108
41D3H
 ↳ 16851
Model III
Called at 2108H (from PRINT command when a comma is used to separate items to be printed) and at 2141H (from PRINT command routine when the TAB function is used, after the TAB argument has been evaluated and placed in the E register. It is worth noting that the original argument (if within the range 0-255) is still stored as an integer in ACCUM, with the NTF set to 2, indicating an integer (when this vector is called from the comma separator routine the NTF will normally be set to 3, indicating a string).
41D6H
 
1
DOS exit from ROM address 219e
41D6H
 ↳ 16854
Model III
INPUT# processing. Called from 219EH to check for INPUT# command and to provide input from disk.
41D9H
 ↳ 16857
Model III
The Disk BASIC routine that permits MID$ to be on the left side of an “=”.  FTI this is the only DOS exit BASIC jumps to instead of calls.
41DCH
 
1
DOS exit from ROM address 222d
41DCH
 ↳ 16860
Model III
Called at 222DH. Part of READ/INPUT command routine, called just prior to assigning data that has been READ or INPUT to variable.  After computer recieves value and before assigned to variable, BASIC calls this exit from 222DH.
41DFH
 
1
DOS exit from ROM address 2278
41DFH
 ↳ 16863
 
Called twice from BASIC: From 2278H after BASIC assigns input value to variable and just before BASIC searches for extra data that will generate “Extra ignored” message, and from 2B44H from the midst of list processing. Could be used to alter list command.
41E2H
 
1
DOS exit from ROM address 0282
41E2H
 ↳ 16866
Model III
SYSTEM command processing. Called from 02B2 just before “*?” prompt. A system tape will automatically start if a jump to its starting address is placed here. Keep in mind this is a 3 byte location. The first byte should be C3H which is the code for “JP” and should be followed by the starting address of your program.
41E5H-41FCH
 ↳ 16869-16892
BUFINI-3
Model III ONLY
Device Control Blocks for RS-232-C Input, Output, and Initialization.
41E5H-42E8H
 ↳ 16869-17128
BUFINI-3
Model I ONLY
 Addresses 41E5H-41E7H are initialized by ROM code at 0080H-0089H to contain the bytes 3AH, 0, and 2CH (a colon, zero byte, and comma). The BASIC input/output buffer (also used while encoding and decoding BASIC lines) begins one byte higher (41E8H) and is defined by a continuation of the above mentioned ROM code (008AH – 008DH), which initializes the buffer pointer at 40A7H-40A8H. The buffer is exactly 256 (100H) bytes long, and is immediately followed by a byte that is always zero, and marks the end of reserved RAM (42E8H).
41E5H
 ↳ 16869
BUFINI-3
Model III
Tape RAM – RS-232 Input DCB: Type = 1 = Read Only
41E6H-41E7H
 ↳ 16870-16871
Model III
Tape RAM – RS-232 Input DCB: 2 Byte Driver Address (301EH)
41E8H
 ↳ 16872
BUFINI
1/3
Tape RAM – RS-232 Input DCB: RS-232 Input Buffer (1 Character)
41E9H
 ↳ 16873
Model III
Tape RAM – RS-232 Input DCB: Bit 2 = Driver On/off Bit 1 = Wait/no Wait
41EAH
 ↳ 16874
Model III
This sits in the RS-232 INPUT DCB, but I have no idea what it does and what uses it
41EBH, 41ECH, and 41F3H
 ↳ 16875, 16876 and 16883
4 in 3 Mode
ASCII character that will be returned when “F1”, “F2”, or “F3” key is depressed. Normally set to 60H (shift-@) during BASIC initialization, but the character stored at this location may be changed, so that any desired character may be returned when the appropriate function key is pressed.
41EBH-41ECH
 ↳ 16875-16876
Model III
The “RI” device name.
41EDH
 ↳ 16877
Model III
Tape RAM – RS-232 Output DCB: Type = 2 = Write Only
41EEH
 ↳ 16878
Model III
Tape RAM – RS-232 Output DCB: 2 Byte Driver Address (3021H)
41F0H
 ↳ 16880
1/3
$RSTX:  RS-232 Output DCB: Output Buffer (1 Character)
41F1H
 ↳ 16881
Model III
Tape RAM – RS-232 Output DCB: Bit 2 = Driver On/off Bit 1 = Wait/no Wait
41F2H
 ↳ 16882
Model III
This sits in the RS-232 OUTPUT DCB, but I have no idea what it does and what uses it
41F3H-41F4H
 ↳ 16883-16884
Model III
The “RO” device name.
41F4H
 ↳ 16884
1/3
Value 103
 ↳ 1st of 2 to Change LINE keyword to act as LPRINT
41F4H
 ↳ 16884
4 in 3 Mode
Storage location for keyboard scan routine. The contents of the keyboard “row” at 3880H is stored here.Bit 0: Left Shift
Bit 1: Right Shift:
Bit 2: Control
Bit 3: Caps
Bit 4: F1
Bit 4: F1
Bit 5: F2
Bit 6: F3
Bit 7: Unused
41F5H
 ↳ 16885
1/3
Value 32
2nd of 2 to Change LINE keyword to act as LPRINT
41F5H
 ↳ 16885
Model III
Tape RAM – RS-232 Initialization DCB: Type = 2 = Write Only
41F6H-41F7H
 ↳ 16886-16887
Model III
Tape RAM – RS-232 Initialization DCB: 2 Byte Driver Address (301BH)
41F8H
 ↳ 16888
BUFINI+20
1/3, T3
$RSINIT: Baud Rate Code. Bits 7-4=Transmit Baud, Bits 3-0=Received Baud.  These two tend to be the same so they range from 00H-EEH for 50 (00H), 75 (11H), 110 (22H), 134.5 (33H), 150 (44H), 300 (55H), 600 (66H), 1200 (77H), 1800 (88H), 2000 (99H), 2400 (AAH), 3600 (BBH), 4800 (CCH), 7200 (DDH), 9600 (EEH)
41F9H
 ↳ 16889
1/3
Tape RAM – RS-232 Initialization DCB – $RSINIT: Parity/Word Length/Stop-Bit code.  Default is 108.
41F9H
 ↳ 16889
T3
RS-232 Configuration Byte.
Bit 0=Data Transmit Ready (always 0), Bit 1=Ready to Send (always 0), Bit 2=Transmit Enable/Disable (1=Enable, 0=Disable), Bit 3=Parity Enable (1=Parity Enable, 0=No Parity), Bit 4=Stop Bits (1=2 Stop Bits, 0=1 Stop Bit), Bits 6-5=Word Length (00=5, 01=6, 10=7, 11=8), Bit 7=Parity Odd/Even (1=Odd, 0=Even)
41FAH
 ↳ 16890
1/3
$RSINIT: Wait Switch (0 = wait, Not 0 = wait)
41FBH-41FCH
 ↳ 16891-16892
Model III
The “RN” device name.
41FDH
 ↳ 16893
Model III Only
Used by repeating key routine. Saves LSB of keyboard buffer pointer (buffer at 4036H-403CH) when key is found depressed.
41FEH
 ↳ 16894
Model III Only
Used by repeating key routine. Saves contents of current keyboard “row” when key is found depressed.
41FFH-4200H
 ↳ 16895-16896
Model III ONLY
Used by repeating key routine. Holds maximum repeat delay count (1500 decimal or 5DCH for first repeat delay, 150 decimal or 96H for subsequent repeats of same character).
4200H-51FFH
 ↳ 16896-20991
MEM$
Level 2
TRSDOS v2.34200H-42FFH – This is where the LEVEL II ROM dumps Drive 0, Track 0, Sector 0.  The ROM routine which does this is located at 06B6H-06CBH.
4D00H-4DFFH – This is where BOOT/SYS loads SYS0/SYS.
4E00H, TRSDOS v2.3 disables interrups, selects Interrupt Mode 1, and sets the utility load address to 5200H.
4E0FH-4E1BH – Calculate how much RAM is present and puts that in 4049H.
4E20H-4E55H – Initialize the device address table (43B8-43BF) and the device mnemonic table (43C0-43CC). These tables are used by the DEVICE command.
4200H-42FFH
 ↳ 16896-20991
T1
System Sector Buffer Area
4201H-4202H
 ↳ 16897-16898
Model III ONLY
Used by repeating key routine. Holds current repeat delay count, which is compared with value at 41FFH-4200H to determine if it is time to repeat the character.
4203H-4205H
 ↳ 16899-16901
Model III ONLY
Three byte BREAK key vector used when BREAK is pressed during cassette tape or RS-232-C operations. Initialized to contain a jump to 022EH, which in turn contains EI and JP 1A19H instructions.
4206H-4208H
 ↳ 16902-16904
Model III ONLY
Three byte vector services interrupt # 4. Under non-disk systems contains a jump to 35FAH, which in turn contains a “RET” instruction. 
4209H
 ↳ 16905
L3
Checks for drive and mounted disk.
4209H-420BH
 ↳ 16905-16907
Model III ONLY
Three byte vector services interrupt # 5.  Under non-disk systems contains a jump to 35FAH, which in turn contains a “RET” instruction.	
420CH-420DH
 ↳ 16908-16909
Model III ONLY
Pointer to “write byte to cassette” routine.  Initialized by “write cassette leader” routine, normally contains address of either 500 baud (3241H) or 1500 baud (32BAH) byte output routine.
420EH-420FH
 ↳ 16910-16911
Model III ONLY
Pointer to “read byte from cassette” routine.  Initialized by “read cassette leader” routine, normally contains address of either 500 baud (3203H) or 1500 baud (32CAH) byte input routine. 
4210H
 ↳ 16912
Model III ONLY

		A flag byte used by the BASIC interpreter, this location contains the CURRENT PORT 0ECH OUTPUT BITS, which are organized as follows:

		BIT 6: Enables fast clock speed if set on Model 4 ONLY

		BIT 5: Disables video wait states if set (not used on Model 4).

		BIT 4: Enables I/O bus if set

		BIT 3: Japanese Kana character set used as “special” characters if set

		BIT 2: Select video 32 character mode if set

		BIT 1: Turns on cassette tape relay if set

		BIT 0: Enables clock display on video if set

		Programmers that attempt to output to port ECH should be aware that at various points in the BASIC interpreter ( such as when returning to BASIC “READY”, doing tape I/O, etc.) some or all of the bits stored here may be output to port ECH, thereby canceling the previous status of port ECH. Also, it must once again be noted that in all current editions of the Model III ROM, an error exists in that the test for double-width characters at 0348H has not been changed to test the flag at 4210H rather than the flag at 403DH. This can cause serious problems when attempting to make use of the 32-character mode on the Models III and 4.
4210H
 ↳ 16912
Model III ONLY
Port ECH Bit Mask:Bit 1: Cass motor [0 = on, 1 = off]
Bit 2: Double width [0 = normal, 1 = double]
Bit 3: Alt. char. [0 = disable, 1 = enable]
Bit 4: I/O bus [0 = disable, 1 = enable] – Model 4 ONLY
Bit 5: Video waits [0 = disable, 1 = enable] – Model 4 ONLY
Bit 6: CPU clock speed [0 = 2 mhz, 1 = 4 mhz] – Model 4 ONLY
Bit 7: not used
4211H
 ↳ 16913
Model III ONLY
Cassette Info: Cassette Baud Rate Select (0 = 500 baud, Not 0 = 1500 baud)
4212H
 ↳ 16914
Model III ONLY
Cassette Info: Cassette Blinker Counter.
Each time a byte is read from tape, this counter is incremented and ANDed with 5FH. If the result is zero, the status of the asterisk in the upper right corner of the video display is reversed (turned on if it was off, or off if it was on}.
4213H
 ↳ 16915
Model III ONLY
Cassette Info: Default Interrupt Vector Setting.
This byte is output to port E0H (the maskable interrupt latch) whenever the “turn off cassette” routine is executed.
4214H
 ↳ 16916
Model III ONLY
Video display scroll protect: # Video Lines To Protect (0-7).  Default is 0.  Only the lowest three bits are used (byte is ANDed with 7 to determine number of protected lines).
4215H
 ↳ 16917
Model III ONLY
Unused In non-Disk System
4216H
 ↳ 16918
Model III ONLY
Tape RAM – Clock Data: Heartbeat Counter
4217H
 ↳ 16919
Model III ONLY
Tape RAM – Clock Data: Seconds (Value: 00-59).  You can POKE to change.
4218H
 ↳ 16920
Model III ONLY
Tape RAM – Clock Data: Minutes (Value: 00-59).  You can POKE to change.
4219H
 ↳ 16921
Model III ONLY
Tape RAM – Clock Data: Hours (Value: 00-23).  You can POKE to change.
421AH
 ↳ 16922
Model III ONLY
Tape RAM – Clock Data: Year (Value: 00-99).  You can POKE to change.
421BH
 ↳ 16923
Model III ONLY
Tape RAM – Clock Data: Day (Value: 01-31).  You can POKE to change.
421CH
 ↳ 16924
Model III ONLY
Tape RAM – Clock Data: Month (Value: 01-12).  You can POKE to change.
421DH
 ↳ 16925
Model III
Tape RAM – I/O Router DCB: Type = 2 = Write Only
421EH
 ↳ 16926
Model III
Tape RAM – I/O Router DCB: Driver Address (3739H)
4220H-4221H
 ↳ 16928-16929
1/3
$ROUTE:  Destination Device Name for ROUTE Routine.  2 Bytes
4222H-4223H
 ↳ 16930-16931
Model III
Tape RAM – I/O Router DCB: Source Device Name.  2 Bytes.
4224H
 ↳ 16932
Model III ONLY
Control key flag used by keyboard driver routine. Contains 1FH if control key sequence (left SHIFT and down-arrow keys was pressed), else contains FFH. Can be tested to determine how certain control codes were produced ( for example, whether a carriage return character was produced by pressing the ENTER key, or through the use of the Control-M sequence).
4225H
 ↳ 16933
Model III Cassette
Undefined, except that the SYSTEM command places its Stack Pointer within this area, at 4288H.
4225H
 ↳ 16933
T3, L3, D3
DOS command buffer.
427AH
xxxx
T3
BASIC in RAM flag.  FFH = BASIC is not in RAM.
4288H
 ↳ 17032
L3
33.33 ms heartbeat counter.
4288H
 ↳ 17032
BUFINI+160
Model III Cassette
Presumed starting location for a SYSTEM command.
428AH
 ↳ 17034
L3
Send message to Job Log and CRT.
428DH
 ↳ 17037
T3, D3
Find drive and file number for open file. For L3, send message to Job Log.
4290H
 ↳ 17040
T3, L3, D3
Copy directory to RAM buffer.
4293H
 ↳ 17043
 
Get file name from directory.
4296H
 ↳ 17046
L3
Execute Dos command and return to DOS ready.
4299H
 ↳ 17049
T3
Do DOS command and return to DOS ready. L3: returns to caller is @EXIT and @ABORT vectors change to jump to return address.
429CH
 ↳ 17052
T3
Do DOS command and return to caller.
42ADH
 ↳ 17069
D3
Contains address of break key routine.
42B3H
 ↳ 17075
T3
Which disk drive is the master drive number.
42B4H
 ↳ 17076
T3
This is the CLEAR RAM flag.
42E5H-43E8H
 ↳ 17125-17384
Model III ONLY
 Addresses 42E5H-42E7H are initialized by ROM code at 0080H-0089H to contain the bytes 3AH, 0, and 2CH (a colon, zero byte, and comma). The BASIC input/output buffer (also used while encoding and decoding BASIC lines) begins one byte higher (42E8H) and is defined by a continuation of the above mentioned ROM code (008AH – 008DH), which initializes the buffer pointer at 40A7H-40A8H. The buffer is exactly 256 (100H) bytes long, and is immediately followed by a byte that is always zero, and marks the end of reserved RAM (43E8H).
42E8H
 ↳ 17128
ENBINI or TSTACK
1
Always Zero
42E9H
 ↳ 17129
1/3 (Non-DOS)
Start of user RAM for program storage.  Fills down from this memory address in the following order:  Program Text, Simple Variables, Arrays, String Variable Names and Overhead, Free Memory.
42FFH
 ↳ 17151
T3
Protection Override Flag (If Bit 0 is set, password checking is disabled).
4300H
 ↳ 17152
T1
Used by TRSDOS 2.3 to store the last track addressed on Drive 0
4301H
 ↳ 17153
T1
Used by TRSDOS 2.3 to store the last track addressed on Drive 1
4302H
 ↳ 17154
T1
Used by TRSDOS 2.3 to store the last track addressed on Drive 2
4303H
 ↳ 17155
T1
Used by TRSDOS 2.3 to store the last track addressed on Drive 3
4304H
 ↳ 17156
T1
Used by TRSDOS 2.3 to store the directory Track for Drive 0
4305H
 ↳ 17157
T1
Used by TRSDOS 2.3 to store the directory Track for Drive 1
4306H
 ↳ 17158
T1
Used by TRSDOS 2.3 to store the directory Track for Drive 2
4307H
 ↳ 17159
T1
Used by TRSDOS 2.3 to store the directory Track for Drive 3
4308H
 ↳ 17160
T1
Used by TRSDOS 2.3 to store the last disk drive accessed
4309H
 ↳ 17160
T1
Used by TRSDOS 2.3 to store the last unit mask for the last drive selected
430AH-430CH
 ↳ 17160
T1
Used by TRSDOS 2.3 to store the DCB/Buffer address, current operation
430CH-430DH
 ↳ 17160
T1
Used by TRSDOS 2.3 to store the DCB address for the current operation
430EH
 ↳ 17160
T1
Used by TRSDOS 2.3 to store the last Overlay Load Request
430FH
 ↳ 17167
XMODE
T1
Used by TRSDOS 2.3 to track certain system conditions.
If Bit 4 is set, then SYS6/SYS is loaded in RAM (and can be called by RST 28H).
If Bit 5 is set, then CHAINING is in effect.
If Bit 7 is set, then DEBUG was set to active.
4312H
 ↳ 17170
ND1, D1
Break Key Vector: (195=Off, 201=On).
4313H
 ↳ 17171
XFCN
ND1, D1
This is in the middle of a JP nnnn command and the Jump Vector will be put here
4315H
 ↳ 17173
XPROT
ND1, D1, T1
This is an OPCODE and can be swapped to RET or JUMP based on a CMD”S” or CMD”A” command
4318H
 ↳ 17176
T1, L1, D1
DOS command buffer.  Contains the last DOS command entered.  Maximum of 64 Characters.
4396H
 ↳ 17302
L1
Read directory into memory.
43E9H-
 ↳ 17385-
3
RAM – BASIC PROGRAM IN A CASSETTE SYSTEM
4400H
 ↳ 17408
 
CMD is a routine that accepts a new command to be evaluated. To Use:CALL    4400H
4400H
 ↳ 17408
L1, D1, D3, N1, N3, M1, M3
Same as 402D: return to DOS ready.
4402H
 ↳ 17410
 
Send text to file or device.
4405H
 ↳ 17413
 
CMNDI is the entry into the command interpreter.  To use, the following 3 lines are necessary only if this is called at the  end  of BASIC program.LD      HL,402D   ;DOS return address
LD      (41FAH),HL
LD      SP,41FAH  ;reset stack pointer for DOSYour ASCII DOS command should be in the command buffer terminated by a carriage return.  To Use:LD      HL,4318H  ;DOS command buffer
JP      4405H     ;if from BASIC
CALL    4405H     ;else this way
4405H
 ↳ 17413
L1, D1, D3, N1, N3, M1, M3
Do DOS command and return to DOS ready.
4409H
 ↳ 17417
 
Display error message on CRT.
440DH
 ↳ 17421
L1, L3, D1, D3, N1, N3, M1, M3
Enter Debug.
4410H
 ↳ 17424
L1, D1, N1, M1
Add task to interrupt chain.
4411H-4412H
 ↳ 17425-17426
3
MEMORY SIZE M3 DISK BASIC
4411H
 ↳ 17425
 
Address of highest available memory location (Mod III disk only – Mod 1 disk = 4049H)
4413H
 ↳ 17427
L1, D1, N1, N3, M1
Remove task from interrupt chain. For D3, add task to interrup chain.
4413H
 ↳ 17427
T3
Highest Disk Drive attached to the system.
4414H
 ↳ 17428
TSTACK + 300
T3
System OVERLAY number Currently in RAM.
4415H
 ↳ 17429
T3
Second copy of high memory address. Copied to 4411H in case of I/O error during DO processing.
4416H
 ↳ 17430
L1, M1
Change entry address of task in interrupt chain. D3: Remove task from interrupt chain. N1, N3: Keep drives rotating and reselect current drive.
4417H
 ↳ 17431
L3
Contains current day in coded format.
4419H
 ↳ 17433
T3, L3
Write disk directory to screen or buffer. N1, N3: Execute DOS command and return to caller.
441CH
 ↳ 17436
 
FSPEC fetches a file specification in TRSDOS standard format. To Use:CALL    441CH
441CH
 ↳ 17436
T3, L1, L3, D1, D3, N1, N3, M1, M3
Move filespec to FCB.
441FH
 ↳ 17439
Model 3 Disk
OSVER$: Holds the DOS Version Number.  Stored in DCB format.  Note on a M1 this is stored in 403EH and on the M4 at 0085H
4420H
 ↳ 17440
 
INIT creates a new file in the directory and opens the DCB for this file.  If the filespec name is found then the file is simply opened for use, else a new file is created first. To Use:LD      HL,BUFFER
LD      DE,DCB
LD      B,LRL
CALL    4420H
JP      Z,OK      ;no error
JP      C,NEWFIL  ;no error, but new file was created
;A= TRSDOS error code
4420H
 ↳ 17440
All
Open or create a file.
4424H
 ↳ 17444
All
OPEN opens the DCB of an existing file. To Use:LD      HL,BUFFER
LD      DE,DCB
LD      B,LRL
CALL    4424H
JP      Z,OK      ;no error
JP      NZ,NOFILE ;file does not exist
;A= TRSDOS error code
4428H
 ↳ 17448
All
CLOSE:  Closes a file.  Updates the directory and then closes the file from any more processing. To Use:LD      DE,DCB
CALL    4428H
JP      Z,OK     ;no error
;A= TRSDOS error code
442CH
 ↳ 17452
All
KILL:  Remove a file from a directory.  Deletes the directory for an open file and then closes the DCB.  To Use: LD      DE,DCB
CALL    442CH
JP      Z,OK     ;no error
;A= TRSDOS error code
442FH
 ↳ 17455
T3
DUAL/ROUTE Flag.  80H=ROUTE is ACTIVE, FFH=DUAL is ACTIVE, 00H=Neither is active.
4430H
 ↳ 17456
All
(undocumented in T1) Load and Execute a Model I Program into Memory.  Call be used with CALL 4430H.
4433H
 ↳ 17459
All
(undocumented in T1) Load and Execute a Model I Program.  Can be used with JP 4433H.
4436H
 ↳ 17462
All
Read logical record into memory.  This will transfer one logical or physical disk record into memory.  To access:LD     HL,urec
LD     DE,dcb
CALL   4436H
JP     Z,ok    ;No errorIf there is an error, Register A will contain the TRSDOS Error Code.
4439H
 ↳ 17465
All
Write logical record to disk.  This will transfer one logical or physical disk record from memory.  To access:LD      HL,UREC
LD      DE,DCB
CALL    4439H
JP      Z,ok    ;No errorIf there is an error, Register A will contain the TRSDOS Error Code.
443CH
 ↳ 17468
 
VERF is the same as WRITE except that it verifies what was written to disk.  To use:LD      HL,UREC
LD      DE,DCB
CALL    443C
BP      Z,OK      ;No errorIf there is an error, Register A will contain the TRSDOS Error Code.
443CH
 ↳ 17468
All
Write record and verify.
443FH
 ↳ 17471
T3, L1, L3, D1, D3, N1, N3, M1, M3
Point to first record in file.
4442H
 ↳ 17474
 
POSN positions a file to READ or WRITE a randomly selected logical record.  To use:LD      DE,DCB
LD      BC,nnnn   ;logical rec'd # to position for
CALL    4442H
JP      Z,OK      ;no error
;A= TRSDOS error code
4442H
 ↳ 17474
All
Position file to specified record.
4445H
 ↳ 17477
T3, L1, L3, D1, D3, N1, N3, M1, M3
Backspace file one record.
4448H
 ↳ 17480
T3, L1, L3, D1, D3, N1, N3, M1, M3
Position to end of file.
444BH
 ↳ 17483
T3, L3, D3, M3
Add extension to filespec in FCB (see also 4473). L1: Check for end of file. D1: Multiply 16 bit by 8 bit integer. N1, N3: Allocate disk space to file.
444DH
 ↳ 17486
Model III
[This is the start of RAM for a Model III as far as the memory test goes].
444EH
 ↳ 17486
T3, L3, D3
Multiply 16 bit by 8 bit integer. L1: Update directory with current record as end of file. D1: Divide 16 bit by 8 bit integer. N1, N3: Position file to specified byte record.
4451H
 ↳ 17489
T3, L3, D3
Divide 16 bit by 8 bit integer. D1: Check for end of file. N1, N3: Update directory with record as end of file.
4454H
 ↳ 17492
L1
Read current sector. L3, D3, M3: Parse parameters in command line. D1: Find drive and file number of a file.
4457H
 ↳ 17495
L1
Rewrite current sector. D3: Check for end of file. D1: Read directory to user buffer.
4458H
 ↳ 17496
L3
Check for end of file.
445AH
 ↳ 17498
L1
Calculate current logical record number. D1, D3: Display directory on CRT.
445BH
 ↳ 17499
L3
Update directory with current record as end of file. N1, N3: Select and power up specified drive.
445DH
 ↳ 17501
L1
Calculate EOF record number.
445EH
 ↳ 17502
L3
Reread current sector. N1, N3: Test drive and disk.
4460H
 ↳ 17504
L1
Skip next logical record.
4461H
 ↳ 17505
L3
Rewrite current sector. N1, N3: Add user routine to DOS library chain.
4462H
 ↳ 17506
D1, D3
Send text to printer.
4463H
 ↳ 17507
L1
Read directory to buffer or CRT.
4464H
 ↳ 17508
L3
Skip next logical record. N1, N3: Remove user routine from DOS library chain.
4467H
 ↳ 17511
L1, L3, D1, D3, N1, N3, M1, M3
Display text on CRT.
446AH
 ↳ 17514
L1, L3, N1, N3, M1, M3
Send text to printer.
446DH
 ↳ 17517
 
TIME will return the current time in ASCII.  To use:LD      HL,nnnn   ;address of 8 byte buffer
CALL    446DH     ;put time in buffer
446DH
 ↳ 17517
T1, L1, D1, D3, N1, N3, M1
Get time in ASCII format. L3: Calculate current logical record number.
4470H
 ↳ 17520
 
DATE will return the current date in ASCII.  To use:LD      HL,nnnn   ;address of 8 byte buffer
CALL    4470H     ;put date in buffer
4470H
 ↳ 17520
L3
Calculate end of file record number.
4473H
 ↳ 17523
L3
Holds image of interrupt latch. T1, L1, D1, D3, N1, N3, M1, M3: Add default extension to filespec in FCB. (See also 444BH)
4476H
 ↳ 17526
L1, D1, M1, M3
Parse parameters in command line.
4478H
 ↳ 17528
 
NewDOS/80 v2.0 for Model 3 Break Vector (195=Off, 201=On).
4478H
 ↳ 17528
1
MODEL 3 NEWDOS/80 V2.0 BREAK VECTOR
 ↳ 195=OFF, 201=ON
447BH
 ↳ 17531
L1
Send text to job log and CRT. N3: Add task interrupt chain.
447CH
 ↳ 17532
D1, D3
Compare filespec to wildcard mask.
447EH
 ↳ 17534
L1
Send text to joblog.
447FH
 ↳ 17535
D1, D3
Get device number for file or I/O device.
4480H
 ↳ 17536
T1
System DCB Address for TRSDOS v2.3
4482H
 ↳ 17538
D1, D3
Sort block of memory.
4485H
 ↳ 17541
D1
10 disk I/O functions depending on value in A.
4488H
 ↳ 17544
D3
10 disk I/O functions depending on value in A. D1: Locate device control block for any device.
448BH
 ↳ 17547
D1
Locate drive control table for any drive.
44A0H
 ↳ 17568
D3
Locate device control block for any device.
44A3H
 ↳ 17571
D3
Locate drive control table for any drive.
44B8H
 ↳ 17592
L1
Check drive and disk.
44BBH
 ↳ 17595
L1
Get file name from directory.
44C1H
 ↳ 17601
L1
Multiply 16 bit by 8 bit integer.
44C4H
 ↳ 17604
L1
Divide 16 bit by 8 bit integer.
44D2H
 ↳ 17618
M3
Add task to interrupt chain.
44D5H
 ↳ 17621
M3
Remove task from interrupt chain.
44D8H
 ↳ 17624
M3
Change execution address of task in interrupt chain.
44DBH
 ↳ 17627
M3
Set task pointer to default of RET.
44DEH
 ↳ 17630
M1, M3
Verify a sector without reading to RAM.
44E1H
 ↳ 17633
M1, M3
Read sector.
44E4H
 ↳ 17636
M1, M3
Write sector.
44E8H
 ↳ 17640
M1, M3
Read directory sector.
44EBH
 ↳ 17643
M1, M3
Write directory sector.
44EEH
 ↳ 17646
M1, M3
Read director.
44F1H
 ↳ 17649
M1, M3
Write directory.
44F4H
 ↳ 17652
M1, M3
User function.
44F7H
 ↳ 17655
M1, M3
Get directory track number.
4500H-4517H
 ↳ 17664-17687
Level 2
DOS interrupt table contains address pairs for interrupt routines (ie. CLOCK, TRACE, etc.).  You can place your own routine addresses in this table.  An example is below:
DI             ;disable interrupts
LD HL,4510H    ;address of table link
LD (HL),myrout ;address of interrupt rtn
EI             ;enable interrupts
45F8H
 ↳ 17912
T3
Part of the WP (write protect) code.  This byte is checked before doing a write.
46DDH
 ↳ 18141
 
RDSECT. On Model I, allows you to read a disk sector. Register C contains the drive selcted, D contains the track, E contains the sector number, HL points at data buffer. On return, Z is set if successful; otherwise A contains error code.
46E6H
 ↳ 18150
 
WTSECT. On Model I, allows you to write a disk sector. Same conditions as RDSECT at 46DDH.
4754H
 ↳ 18260
L1, L3
Select drive.
4759H
 ↳ 18265
L1, L3
Continually reselect drive until it is ready.
475EH
 ↳ 18270
L1, L3
Seek specified cylinder (track).
4763H
 ↳ 18275
L1, L3
Write sector to disk.
4768H
 ↳ 18280
L1, L3
Write system (directory) sector.
476DH
 ↳ 18285
L1, L3
Write track to disk (used for formatting).
4772H
 ↳ 18290
L1, L3
Verify sector without transfering data to memory.
4777H
 ↳ 18295
L1, L3
Read sector to buffer.
4779H
 ↳ 17529
L1
Send text to file or device. D1, D3: Scan and evaluate command line.
478FH
 ↳ 18319
L1, L3
Get address of drive code table for specifed drive.
479CH
 ↳ 18332
L1, L3
Get byte field from drive code table.
4AC1H
 ↳ 19137
 
This routine will read sectors 2 – 9 of the disk directory track (11H) into your designated buffer.  It is just like the DOS routine at 5CC8 which is overlayed by BASIC/CMD. ( not for Newdos 80).  To Use:          LD      B,0
         LD      DE,BUFFER ;256*8 bytds
READ     CALL    4AC1H     ;read sector
         LD      L,0
         PUSH    BC
         LD      BB,256
         LDIR
         POP     BC
         INC     B
         LD      A,B
         CP      8
         JR      NZ,READ
         RET
4B10H
 ↳ 19216
L1, L3
Read directory sector with specified entry code.
4B1FH
 ↳ 19231
L1, L3
Write system buffer to specified directory sector.
4B45H
 ↳ 19269
L1, L3
Read directory sector to user buffer.
4B64H
 ↳ 19300
L3
Get cylinder (track) number of directory.
4B65H
 ↳ 19301
L1
Get cylinder (track) number of directory.
4B6BH
 ↳ 19307
L3
Multiply 8 bit by 8 bit integers.
4B6CH
 ↳ 19308
L1
Multiply 8 bit by 8 bit integers.
4B7AH
 ↳ 19322
L3
Divide 8 bit by 8 bit integers.
4B7BH
 ↳ 19323
L1
Divide 8 bit by 8 bit integers.
4CE7H
 ↳ 19687
T3
Storage Location for Video Driver.  Used when involking DUAL.
4CF8H
 ↳ 19688
T3
Storage Location for Printer Driver.  Used when involking DUAL.
4D00H-4DFFH
 ↳ 19712-19967
T1
BOOT/SYS Resides Here in Memory
4E00H-50A7H
 ↳ 19968-20647
T1
SYS1/SYS Resides Here in Memory
4FFFH
20479
M1, M3
4K System Top of Memory
5200H-6FFFH
20992-28671
Level 2
Disk BASIC or DOS utilities when loaded, or user memory
5203H
ERRTAB
T1
TRSDOS BASIC Extended Error Messages.  These get used instead of the L2 built-in messages.
54C3H
54C3H
T1
DOS Vector – CVI Command
57F0H
22512
Level 2
61 character ASCII copyright notice (DOS)
582CH
SCRMBL
T1
The copyright message “THIS BASIC WAS AUTHORED AND IS COPYRIGHTED BY MICROSOFT, 1978”
586BH
PROTMS
T1
The message “PROTECTION HAS CLEARED MEMORY”
5A77H
DIRTMP
T1
The status of FILE 0 (open or closed) in TRSDOS v2.3 BASIC
5B77H
USRTAB
T1
The start of the USR(0)…USR(15) Jump Table
5B8BH
MAXTRK
T1
A Byte which toggles whether the command being processed was a GET or a PUT
5B8CH
DSKERR
T1
Storage location for the DOS error code
5B8DH-5B8EH
PTRFIL
The address in RAM of the file being used
5B8FH
FILPTR
T1
Start of the File Block Pointer Table for Files 01 to 15 (i.e., OPEN “I”,n,”FILENAME”)
5BAFH
FILPT1
T1
Copy of the FLIPTR for File 0
5BB1H
LSTFRE
T1
A flag as to whether to run a BASIC program or not once the current operation is done
5C98H
PTCMD
T1
A flag to see if TRSDOS v2.3 was restarted or cold booted
5C99H
SVTXTT
T1
BASIC Program Beginning Pointer
5C9BH
FILSVS
T1
The answer to the FILES? question enterd by the user when entering BASIC
5C9DH
OLSTTP
T1
Pointer to the lowest address available for string storage a/k/a top of free memory
5D51H
NXTFCN+1
T1
Exit JUMP Address Storage location for a CMD”S” or CMD”A” return to DOS from BASIC
5E57H
BADMVS
T1
Pointer to the message “USE TRSDOS 2.2 OR LATER”
5E70H
FILMES
T1
Pointer to the message “HOW MANY FILES”
5E7FH
MESG
T1
Pointer to the message “RADIO SHACK DISK BASIC VERSION 2.2”
5EA3H
FILNAM
T1
32 character buffer to store the current filename
651EH
FLRL
T1
Storage for the record size used in a FIELD command
651FH
DOPROT
T1
Flag as to whether an action is permitted based on the protection level of the file in the directory
6520H
PROTFL
T1
A different format of the protection level flag for the current file
6574H
DERTAB-1
T1
The byte before the table of DOS specific error message table that yses SYS4 to process the error instead of BASIC
6575H
DERTAB
T1
Table of DOS specific error message table that yses SYS4 to process the error instead of BASIC
68D9H-26841
3
RAM – BASIC PROGRAM IN TRS-DOS 1.3
7A00H
32767
3
Network 4 Read Buffer
7FFFH
32767
1/3
16K SYSTEM TOP OF PHYSICAL MEMORY
BFFFH
49151
3
32K System Top of Memory
FFFFH
65535
3
48K System Top of Memory

RAM Addresses and Routines for Level 1:
Address
(Hex)
Address
(Decimal)
Model Code
Description
3C00
 ↳ 15360
L1
Start of screen memory
3FFF
 ↳ 16383
L1
End of screen memory
4000
 ↳ 16384
L1
A value
4004
 ↳ 16388
L1
B value
4008
 ↳ 16392
L1
C value
400C
 ↳ 16396
L1
D value
4010
 ↳ 16400
L1
E value
4014
 ↳ 16404
L1
F value
4018
 ↳ 16408
L1
G value
401C
 ↳ 16412
L1
H value
4020
 ↳ 16416
L1
I value
4024
 ↳ 16320
L1
J value
4028
 ↳ 16324
L1
K value
402C
 ↳ 16328
L1
L value
4030
 ↳ 16332
L1
M value
4034
 ↳ 16336
L1
N value
4038
 ↳ 16340
L1
O value
403C
 ↳ 16344
L1
P value
4040
 ↳ 16348
L1
Q value
4044
 ↳ 16352
L1
R value
4048
 ↳ 16356
L1
S value
404C
 ↳ 16360
L1
T value
4050
 ↳ 16464
L1
U value
4054
 ↳ 16468
L1
V value
4058
 ↳ 16472
L1
W value
405C
 ↳ 16476
L1
X value
4060
 ↳ 16480
L1
Y value
4064
 ↳ 16484
L1
Z value
4068
 ↳ 16488
L1
Pointer to cursor position
406A
 ↳ 16490
L1
Points to top of physical memory
406C
 ↳ 16492
L1
Pointer to top of used memory
406E
 ↳ 16494
L1
Current FOR end value
4070
 ↳ 16496
L1
A$ Value (16 bytes)
4080
 ↳ 16512
L1
B$ Value (16 bytes)
4090
 ↳ 16528
L1
Cassette port status cache (byte)
4091
 ↳ 16529
L1
Current FOR step value
4093
 ↳ 16531
L1
pointer to top of current FOR statement
4095
 ↳ 16533
L1
pointer to current FOR statemnt?
4097
 ↳ 16535
L1
Save for pointer to current line
4099
 ↳ 16537
L1
pointer to print buffer 
409B
 ↳ 16539
L1
pointer to NEXT variable
409D
 ↳ 16541
L1
Parse pointer saved at a STOP
409F
 ↳ 16543
L1
pointer to current line being executed
40A1
 ↳ 16545
L1
READ pointer
40A3
 ↳ 16547
L1
Saved SP for this BASIC frame
40A5
 ↳ 16549
L1
pointer to current FOR variable
40A7
 ↳ 16551
L1
Three bytes of RNG state
40AA
 ↳ 16554
L1
??
40AC
 ↳ 16556
L1
Buffer for command input, print output to cassette
40F3
 ↳ 16627
L1
End of buffer
40F4
 ↳ 16628
L1
Bottom of floating point stack.  Each entry is 5 bytes consisting of LSB, Middle, MSB (with Bit 7 set), Exponent and Sign (in Bit 7)
4180
 ↳ 16768
L1
Bottom of system stack pointer
4200
 ↳ 16896
L1
Top of system stack pointer
4201
 ↳ 16897
L1
Start of BASIC Program Storage.  16 bit line number followed by line text, terminated with a 0DH