Jaap's Psion II Page

  1. Home /
  2. Psion II /
  3. System Variables

The System Variables

The operating system of the Psion uses the memory area between addresses $0000 and about $2400 to hold all the information it needs to run properly. These so called system variables are useful for programming, especially when using machine code. I have collected as much information as I could from various sources, trying to make this list as complete as possible. If you have any information about any of the variables which is not here, please let me () know. I do not guarantee that this information is completely correct, nor am I responsible for any loss of data or any other damage resulting from your use of this information.

The system variables of the most interest are printed in bold letters.

The addresses in the range $01 to $1F are used as internal registers by the 6303 processor. OPL does not allow PEEK/POKE in the area 00-3F. Extreme care should be taken with these addresses. These addresses control/receive/send data to and from the other hardware. For example the operating system uses these for access to packs. It is obviously much easier to use the system routines for such tasks. Those marked W can only be written to, and similarly those marked R should only be read. The most useful and least dangerous is Port 5 ($15) which is used to read the keyboard and test for low battery.

  00     Not used
pob_ddr2 01 W   Port 2 data direction register. Bit 0 controls the direction of bit 0 of port 6 (1=output,0=input) and bit 1 control the direction of bits 1-7 of port 6.
  02 R/W   Port 1. This is the low byte of the address bus. Do not use.
pob_port2 03 R/W   Port 2. Used as data bus to slots, i.e. to packs etc.
  04 W   Port 3 data direction register of data bus. Do not use.
  05   Not used
  06 R/W   Port 3. This the data bus. Do not use.
  07 R/W   Port 4. This is the high byte of the address bus. Do not use.
pob_tcsr1 08 R/W   Timer Control/Status 1. Bit 3 (EOCI1) is used to enable or disable OCI interrupts.
pow_frc 09/0A R/W   Timer 1 Free Running Counter, automatically incremented by processor clock. Used for OCI interrupts.
pow_ocr1 0B/0C R/W   Timer 1 output compare register. When pow_frc (Timer 1 frc) reaches this value, pow_frc is set back to zero and an OCI interrupt is generated. The OCI interrupt is used in the Psion as the keyboard interrupt.
  0D/0E R   Input capture register
pob_tcsr2 0F R/W   Timer control/Status register 2
pob_rmcr 10 R/W   Rate, mode control register
pob_trcsr 11 R/W   Tx/Rx control status register
pob_rdr 12 R   Receive data register
pob_tdr 13 W   Transmit data register
pob_rcr 14 R/W   RAM/Port 5 control register. Note that bit 7 (STBY PWR) is used to test whether a cold or warm boot is needed on startup. If it is clear on startup, then it is set and a cold boot is performed, but if bit 7 was already set it only does a warm boot. If bit 6 (RAME) is cleared, it disables the internal RAM ($40-$FF) of the processor so that these addresses refer to external memory instead. This feature is not used on the Psion though it is probably possible. Bits 0-3 control whether the corresponding bits read from port 5 are the port lines or the lines IRQ1, IRQ2, MRE or HLTE respectively. On the Psion these 4 bits normally are clear, so that the normal port 5 lines are used. The external interrupts IRQ1 and IRQ2 are therefore ignored.
pob_port5 15 R   Port 5, input port only. On the Psion it is used to read the activated keyboard lines and ON/CLEAR key. Bit 7 is clear when ON/CLEAR pressed, and bits 2 to 6 are cleared whenever the corresponding key is pressed on one of the active keyboard lines. (See $0340). Bit 0 is clear when the battery is running low. Bit 1 (ACOUT) is connected to bit 12 of the clock counter (see $0340), so that when the organiser switches on this bit will show whether it was because the timer elapsed (e.g. an alarm or because 2048 seconds elapsed) or whether it was because ON/CLEAR was pressed (or an external device like the comms link caused it).
pob_ddr6 16 W   Port 6 data direction register, controlling the direction of each of the bits of port 6 individually.
pob_port6 17 R/W   Port 6. Bits 7 to 0 are labelled PACON, CS3, CS2, CS1, OE, PGM, MR, CLK. This port is used in the Psion to control whether the packs are on or off, which pack is selected, and to set the pack address.
  18 R/W   Port 7
  19/1A R/W   Output compare register
pob_tcsr3 1B   Timer control/Status register for timer 2. Bits 0-1 select the clock used (if both set then bit 7 of port 2 used for timing, otherwise the internal clock is used). Bits 2-3 selects the action is needed at bit 6 of port 2 when time-out is reached (if bit 3 is set then bit 2 will be output, if bit 3 clear and bit 2 set then port 2 bit 6 is toggled, if bit 2, 3 both clear then port2 bit 6 becomes an I/O port). If bit 4 cleared then timer 2 is temporarily disabled. Bit 5 is unused. If Bit 6 is set then a timeout causes an interrupt (CMI). Bit 7 is set whenever a timeout occurs (is not reset automatically).
pob_tconr 1C W   Timer constant register for timer 2. The timer 2 up counter is incremented until this value is reached at which time the action indicated by the control register is taken.
  1D R/W   Timer 2 Up counter.
  1E   Not used
  1F   Test register. Do not use.
  20-3F   Not used

The addresses in the range $40 to $FF are registers in the processor's internal memory. The machine code instructions to access these 'zero-page' addresses are shorter, and therefore execute faster than those accessing two-byte addresses.

utb_7e 40   JMP instruction for vector in utw_s0, used in sound routines.
utw_s0 41/42 General word variables S0 - S5. Can be freely used, but some OS calls use these too.
utw_s1 43/44
utw_s2 45/46
utw_s3 47/48
utw_s4 49/4A
utw_s5 4B/4C
utw_r0 4D/4E General word/byte variables R0 - R6. Their high and low bytes are denoted by utb_h* and utb_l*. These must be preserved. They can be stored/ retrieved on the stack using BT$PPRG (SWI 0B).
utw_r1 4F/50
utw_r2 51/52
utw_r3 53/54
utw_r4 55/56
utw_r5 57/58
utw_r6 59/5A
btb_nmfl 5B Cleared when an NMI occurs. It can be used to check for an NMI by setting this to non-zero, and waiting till it is cleared.
btw_ccnt 5C/5D Time (in seconds) that it is planned to be switched off (until next alarm check or end of temporary switch-off).
bta_rtop 5E/5F Address of Ramtop
rtb_lbat 60 Run time low battery flag
xxb_xxxx 61 Reserved. Unused in Rom versions 4.4 and earlier. Used in version 4.6.
dpb_cpos 62 Current cursor position (0-31 if 2 lines, 0-79 if 4 line mode on an LZ)
dpb_cust 63 Cursor state (as passed in DP$STAT, i.e. bit 7 set if cursor on, bit 0 set for line cursor or clear for block)
dpb_vlin 64 Scrolling line position (0-1 or 0-3) when used in VIEW. Current menu item number when used in MENU.
dpb_vsiz 65 Number of characters to scroll when used in VIEW. Total number of menu items when used in MENU.
dpb_vdir 66 Scroll direction (1=right, 2=left, 0=paused). Used in VIEW.
dpb_spos 67 Saved cursor position. Used by DP$SAVE and DP$REST.
dpb_scus 68 Saved cursor state. Used by DP$SAVE and DP$REST.
dpw_sped 69/6A Horizontal scrolling rate (in 50ms intervals). Default is 4. Delay before scrolling is four times dpw_sped.
dpw_dely 6B/6C Vertical scrolling rate (in 50ms intervals). Default is 10.
dpw_redy 6D/6E Decremented every 50ms (on keyboard interrupt) until it is zero. Used for timing, e.g. by DP$WRDY and TM$WAIT.
dpa_vadd 6F/70 Address of scrolling string. Used in VIEW.
kbw_tdel 71/72 This word controls the rate of keyboard interrupts. When an interrupt occurs the value in kbw_tdel is stored in the Timer 1 Output Compare Register 1, and the Free Running Counter is set to zero, so that the next interrupt will occur after kbw_tdel clock cycles. There is an overhead of 35 cycles for each interrupt. Hence, the time between interrupts = ( kbw_tdel + 35 ) / 921600 secs. The default value for kbw_tdel is $B3DD, giving a time interval of 0.05 secs. Note that a value of zero in kbw_tdel, will cause the machine to lock up. It is used extensively by the operating system for timing purposes.
kbb_back 73 Offset in kbt_buff to oldest key in buffer.
kbb_nkys 74 Number of keys in buffer
kbb_prev 75 Key pressed on last keyboard poll, used to check if same key is still pressed for auto-repeat.
kbb_wait 76 Unget key, zero if no key else the key
kbb_dlay 77 This byte stores the delay before auto-repeat of the keys begins in terms of the number of keyboard interrupts. The default value is 14, so with interrupts running at 20 times per second, the delay is 0.7 secs.
kbb_rept 78 This byte stores the delay between keys when auto-repeating in terms of keyboard interrupts. The default value is 0 which is the fastest value. A value of 1 will repeat at half normal speed, 2 at a third normal speed etc.
kbb_cntr 79 Keyboard counter, counts down from kbb_dlay at last new keypress. If zero and still same key pressed, then auto-repeat is activated.
kbb_knum 7A Offset into keyboard table
kbb_stat 7B
kbb_stat stores the following flags:
Bit 7 ky_shft Set if shift is depressed.
Bit 6 ky_numb Set if Num Lock on.
Bit 2 ky_mlky Set if Multi-lingual Key Lock. (Shift rightarrow, for accented characters etc). Multi-lingual machines only.
Bit 1 ky_cpnm Set if any lock keys were pressed. This is used by the key translate routine to signify that a keyboard click should occur despite returning no character.
Bit 0 ky_caps Set if Lower Case Lock.
kbb_stat can be read directly, but system service KB$STAT should be used to write to it.
tmb_swof 7C Auto-switch-off flag. Clear to disable. This will inhibit the NMI from decrementing tmw_tout and prevent KB$TEST testing it.
tmw_tout 7D/7E Time left before next switch off. The contents of tmw_tcnt are copied into tmw_tout whenever a key is pressed or KB$GETK is called and tmw_tout is decremented until zero by the NMI routine every second. If tmw_tout is found to be zero in KB$TEST, the machine will switch off.
edb_mlen 7F Maximum input length
edb_plen 80 Prompt length
edb_flin 81 First editable line
edb_poff 82 First editable character in first line
edb_clin 83 Current line edit
edb_stat 84 Editor cursor status
edw_cpos 85 Current position within line
edw_cb 87/88 Offset to current line
edw_bl 89/8A Total buffer length
pkb_curp 8B Set by PK$SETP this is the current device being looked at by the operating system. It contains the contents of B register on the last call to PK$SETP. If this is zero (i.e.. device A: internal RAM pack selected) then the ports may be left selecting device B,C or D.
pkb_cpak 8C Set by PK$SETP and PK$PKOF. Actual current slot. Only set if the current slot is powered up and selected. Set to $FF when packs are turned off by PK$PKOF. If this byte is zero then device A: has been selected but the slots will be still powered up.
pkw_rasi 8D/8E Length of internal RAM pack (device A:).
pkw_cmad 8F/90 Offset into RAM file. Set by all pack routines when accessing ram file.
pkb_hpad 91 High order byte of pack address. Set by all pack routines when accessing devices B,C,D.
pkw_cpad 92/93 Pack address. Set by all pack routines when accessing devices B,C,D.
pka_pkid 94/95 Pointer to current pack identifier in array pkt_id. Set by PK$SETP.
flb_rect 96 Current record type in use - set by FL$RECT, and implicitly set by FL$OPEN, FL$CRET etc. Returned by FL$OPEN, FL$CRET and others.
flb_cpak 97 Current device used by file system, set by FL$SETP, and implicitly set by FL$OPEN, FL$CRET etc.
flb_cont 98 Device being DIR-ed
flw_drec 99/9A Next directory record number
flw_crec 9B/9C Current record number, 1 is the first record. Counts the records of type flb_rect. Set by many routines including FL$RSET, FL$NEXT.
flw_fnad 9D/9E Address of file name
flw_nrec 9F/A0 Number of records
xfb_rect A1 Current record type
tlb_cpak A2 Current default pack (0-2)
tlb_mode A3 Which option: FIND, SAVE or ERASE
bzb_mute A4 Non-zero to mute buzzer
rta_sp A5/A6 Language stack pointer. rta_sp points at the lowest byte of the stack. So if an integer is stacked, rta_sp is decremented by 2 and the word is saved at the address pointed to by rta_sp.
rta_fp A7/A8 Frame (procedure) pointer. rta_fp points into the header of the current procedure. Each procedure header has the form:
Device (zero if top procedure)
Return rta_pc
ONERR address
base_sp
Previous rta_fp. rta_fp points to this word.
Start address of the global name table
Global name table
Indirection table for externals/parameters
This is followed by the variables, and finally by the Q code. rta_fp points at the previous rta_fp, so it is easy to jump up through all the procedures above. The language uses this when resolving external references and when handling errors.
rta_pc A9/AA Program counter. rta_pc points at the current operand/operator executed and is incremented after execution - except at the start of a procedure or a GOTO when rta_pc is set up appropriately.
lgw_clin AB/AC Current line being edited
lxa_curr AD/AE Current character pointer
lxb_ptok AF Previous token
acw_1x B0/B1 Array index
acw_2x B2/B3 Maximum string size
acw_prec B4/B5 Pointer to variable
acw_cons B6/B7 Temporary constants
acw_glcd B8/B9 Global O code size
acw_left BA/BB Current free O code bytes
acw_ocsz BC/BD Total O code size
acb_nest BE Structure next level
acw_labl BF/C0 Next new label number
acw_r0 C1/C2 General language word
acw_r1 C3/C4 General language word
 
Run time variables, overlayed against the language translator variables:
rtb_escf B0 Escape flag
rtb_logn B1 Current logical name
rtb_trap B2 Trap flag
rtb_eror B3 Current error condition
rtb_crfl B4 Carriage return flag
rtb_cdrv B5 Device of top procedure
rtw_s0 B6/B7 General word variables
rtw_s1 B8/B9
rtw_s2 BA/BB
rtw_s3 BC/BD
rtw_s4 BE/BF
rtw_s5 C0/C1
rtw_s6 C2/C3
rtb_top C4 ???
xtb_read C5 ???
 
mtt_aman C5-CB accumulator: guard byte and mantissa. Guard byte lengthens the mantissa for rounding purposes.
mtb_aexp CC accumulator exponent
mtb_asgn CD accumulator sign
mtt_oman CE-D4 operand: guard byte and mantissa
mtb_oexp D5 operand exponent
mtb_osgn D6 operand sign
 
Diary variables, overlayed against the maths variables:
dib_year C5 Year
dib_mons C6 Month
dib_days C7 Day
dib_hour C8 Hour
dib_mins C9 Mins
 
Alarm variables, overlayed against the maths variables:
amt_temp C5-CB Alarm temporary area
 
ita_pcnt D7/D8 Table program counter
ita_base D9/DA Table base
ita_sptr DB/DC Table stack pointer
itb_test DD Table flag
ima_gptr DE/DF General pointer
zpg_free E0 ???
amb_svei E1 ???
E0-FF Transient application area. Used by most device drivers as a temporary scratch area. For example, the Comms link copies its variables from dv_spar (214F) to here temporarily every time it is used so that the code is faster and more compact. Note also that a WARM BOOT uses $F8 to $FF.

In the memory map between $180 and $3FF lie the semi- custom chip addresses. These addresses do not point to a memory chip, but connect to the semi-custom chip which controls all external communication for the CPU including the LCD screen, the keyboard and the buzzer. OPL does not allow PEEK/POKE in the area 0182-03FF. The semi-custom chip does not decode all the address lines. For the LCD driver the even addresses $180,$182... up to $1BE are considered identical, as are the odd ones $181 up to $1BF. For the other addresses all of the bottom 6 bits are ignored by the semi-custom chip (except that LZ only ignores only bottom 5 bits, see below). Simply performing a TST instruction on any of these addresses will have the required effect. Only the LCD addresses are such that STA or LDA instructions are required.

sca_lcdcontrol 0180   Liquid Crystal Display control register. When bit 7 of the contents of this register is set it means that the LCD is busy and cannot take any commands. The remaining 7 bits contain the current address pointer in the LCD memory. Writing to this register (only when bit 7 is clear) is used to pass a command to the LCD chip. The most important of these are $40+x which sets the address pointer to the UDG pattern space (x in range 0 to $3F).
sca_lcddata 0181 LCD data register. Is used to pass data to/from the LCD chip (only do this when bit 7 of $0180 is clear). Any data written/read here is stored at/read from the current LCD address, after which the address pointer is automatically incremented. Therefore to store/read a new UDG pattern, pass $40+8*u to $0180 (u betw 0 and 7), then store/read the 8 bytes of the pattern at $0181. Before each read/write you must read $0180 to check whether the LCD is ready. Note that in OPL this is not necessary as the ROM will do it for you.
sca_switchoff 01C0 Switch off
sca_pulseenable 0200 Pulse enable. Enables a high voltage pulse used in writing to datapaks. Take extreme care.
sca_pulsedisable 0240 Pulse disable. Disables the high voltage pulse.
sca_alarmhigh 0280 Buzzer on
sca_alarmlow 02C0 Buzzer off
sca_counterreset 0300 Set counter for kybd + clock to zero.
sca_counterclock 0340 Counter for kybd + clock increment once. The keyboard has 7 lines of 5 keys (ON/Clear is separate). Bits 0 to 6 of the clock/keyboard counter determines which of these lines are active. When reset, all lines are active. To make only one line active, set the counter to 3F, 5F, 6F, 77, 7B, 7D or 7E which have only one of its low bits clear. These values activate the following key lines:
  3F mode up down left right
5F AGMS shift
6F BHNT delete
77 CIOUY
7B DJPVZ
7D EKQW space
7E FLRX exe
Which of these keys is pressed (and the ON/CLEAR key) can then be read at pob_port5 ($15). This counter is also used to control the number of seconds that the organiser is switched off, and the number of NMI's that were missed if they are disabled.
sca_nmimpu 0380 Enable NMI to processor. Links the NMI's to the processor, enabling them.
sca_nmicounter 03C0 Enable NMI to counter. Disables the NMI's to the processor but links them to the clock counter, so that they are counted.
 
The LZ, P350 and multi-lingual XP need more control lines for their memory management, and for this the following semi-custom addresses are used:
sca_bankreset 0360 Reset ROM and RAM to first banks (LZ/P350/M-XP).
sca_nextram 03A0 Select next RAM bank (LZ/P350).
sca_nextrom 03E0 Select next ROM bank (LZ/M-XP).
 
As bit 5 of the semi-custom addresses is now tested to distinguish the memory bank switches above, the following addresses are also available. These probably control the program mode of the Hitachi HD6303X CPU (lines MP0 and MP1 on the chip). The organiser uses only one of these modes, so these should not be used in any way. In fact these are only used once by the operating system, namely at the start of a cold or warm boot.
sca_setmode1 02A0 Select mode 1 bit (LZ/P350/M-XP).
sca_setmode2 02E0 Select mode 2 bit (LZ/P350/M-XP).
sca_modereset 0320 Clear mode bits (LZ/P350/M-XP).
  0400-1FFF   Low RAM area. If present it is used for code/data for booted devices. If the device code to be loaded still fits in Low RAM it will be placed here, otherwise the permanent allocator cell is used. This area is not available on CM's and normal XP's, but only on machines with 32k or more RAM.
 
alt_base 2000 Base of allocator cells. Allocator cells are parts of memory used for storing data of variable size. These cells are held consecutively in memory and immediately follow the system variables. 2000-203F are the so-called tags of the cells, and hold the addresses of the start of the allocator cells or zero of a cell is not in use. The cells are manipulated by the system calls AL$FREE (SWI 00) to AL$ZERO (SWI 06)
permcell 2000/01 Permanent cell, used for code/data from booted devices. If available, Low RAM is filled first. The first cell always starts at the same address (usually 23E9 for CM, 2413 for XP, 268D for LZ), so the device programs will not be moved about in memory. Other cells are moved when a previous cell changes size.
menucell 2002/03 Top level menu cell. Contains the main menu. Each item consists of an lbc string containing the name, followed by a word containing the address to jump to when that item is chosen. Inserted OPL items have a zero word, and on the LZ notepads have a 1, files a 2. The list is terminated by a zero byte.
dirycell 2004/05 Diary cell. Each diary item consists of:
0: Length byte. Contains length of the text of the diary entry.
1: Year (0-99 on CM/XP, 0-255 on LZ)
2: Month (0-11)
3: Day (0-30)
4: Hour (0-23)
5: Minutes (0 or 30 on CM/XP, 0,15,30,45 on LZ)
6: Alarm, 0=no alarm, else one more than the number of minutes before the given time it will sound.
This is followed by the text of the diary entry, its length byte is byte 0 above.
The list of diary entries is terminated by a zero byte.
textcell 2006/07 Language text cell, used for editing/translating OPL/CALC.
symbcell 2008/09 Symbol table cell, used when translating OPL/CALC.
globcell 200A/0B Global record cell, used when translating OPL/CALC.
ocodcell 200C/0D QCODE output cell, used when translating/running OPL/CALC.
fsy1cell 200E/0F Field name symbol tables. Contain field names for files opened in OPL, one allocator cell for each of the logical filenames A to D. Each field variable name is preceded by a byte that is 0 for an integer, 1 for a floating point variable and 2 for a string. Each name is followed by a TAB character to signify its end.
fsy2cell 2010/11
fsy3cell 2012/13
fsy4cell 2014/15
fbf1cell 2016/17 File buffers for files opened in OPL, one cell for each of the logical filenames A to D. Each opened file has a cell of 256 bytes. It contains the current record, each field separated by a TAB character.
fbf2cell 2018/19
fbf3cell 201A/1B
fbf4cell 201C/1D
datacell 201E/1F Database cell, contains all the data on device A: on CM/XP machines. The LZ (and P350) uses RAM banks, so this cell is used slightly differently.
ntpdcell 2020/21 Notepad cell (LZ)
dumycell 2022/23 Dummy cell for spreadsheet, contains only $FF. (LZ)
2024-203E 14 free cells for use by applications
ala_free 2040/41 Top of allocator area, the end of the last cell in use.
bta_2iq 2042/43 IRQ2 re-vector address, no effect.
bta_cmi 2044/45 CMI re-vector address, no effect.
bta_bug 2046/47 TRAP re-vector address
bta_sio 2048/49 SIO re-vector address, no effect.
bta_toi 204A/4B TOI re-vector address, no effect.
bta_oci 204C/4D OCI re-vector address, keyboard interrupt.
bta_ici 204E/4F ICI re-vector address, no effect.
bta_1iq 2050/51 IRQ1 re-vector address, no effect.
bta_swi 2052/53 SWI re-vector address
bta_nmi 2054/55 NMI re-vector address
bta_wrm 2056/57 WRM re-vector address
bta_sof 2058/59 SWOF re-vector address
bta_poll 205A/5B This vector points to the routine which polls the keyboard. It must return the number of the key pressed in the A register. The ROM routine returns 0 if no key was pressed, or a number from 1 to 36 otherwise. If the shift key is not disabled (see kbb_shfk, $20C4) and the shift key is pressed, the routine will set the shift flag (bit 7 of bta_stat, $7B) and return the number of the second key pressed if there is one.
bta_tran 205C/5D This vector points to the routine which translates the key number supplied by bta_poll in the A register into the ascii character it represents, returned in the A register. To decode the character, the ROM routine uses a table of characters pointed to by bta_tabl ($205E). The routine will check the shift flag (see bta_poll, $205A) and the other keyboard flags (see bta_stat, $7B) to decide how to translate the character. If the shift and numlock flags make it necessary, a character from the second half of the table is returned, which contains the numerical or 'shifted' characters. If the caps-lock flag is set and a letter would be returned, it is first changed to lower case. This routine also checks for the caps/numlock/multi-lingual key combinations (see kbb_capk $20C2 and kbb_numk $20C3) and sets the keyboard flags accordingly.
bta_tabl 205E/5F This is the vector which points to a table of characters used to translate a key press into an ascii character. The vector can be changed to point to a new set of characters and should contain 72 characters (36 'shifted') unless, of course, the translate routine has been changed or SHIFT has been disabled.
utw_fp 2060/61 Frame pointer for ENTER/LEAVE
btb_ignm 2062 If zero, next NMI is ignored (i.e. it will do nothing but set this flag).
btb_imsk 2063 Save interrupt mask while off.
btb_tcsr 2064 Save TCSR1 while off.
bta_sbas 2065/66 Language stack base.
bta_savstack 2067/68 Save stack pointer while off.
btw_1dontuse 2069/6A Used in SWI's to save D register.
btw_2dontuse 206B/6C Used in SWI's to save X register.
btw_3dontuse 206D/6E Used in SWI's to save return address.
btb_4dontuse 206F Used in SWI's to save flag register.
dpt_tlin 2070-7F 16 byte buffer containing contents of top line of the display (on 2-line machine, or on LZ when in 2-line mode).
dpt_blin 2080-8F 16 byte buffer containing contents of bottom line of the display (on 2-line machine, or on LZ when in 2-line mode).
dpa_scrn 2090/91 dpa_scrn contains the address of the current screen buffer. When in 2-line mode, it contains the address of dpt_tlin - the 2-line screen buffer at the same memory location as on 2-line Organisers (for compatibility) When in 4-line mode it contains the address of dpt_4lin - the new 80 character 4-line screen buffer. It is set by the operating system service DP$MSET. (LZ)
dpb_nlin 2092 dpb_nlin contains the number of screen lines in the current display mode, i.e. 2 or 4. It is set by the operating system service DP$MSET. (LZ)
dpb_wide 2093 dpt_wide contains the screen width in the current display mode, i.e. 16 or 20. It is set by the operating system service DP$MSET. (LZ)
dpb_mflg 2094 ???
dpb_clok 2095 dpb_clok stores the position of the left most character of the 6 character UDG clock, so is in the range 0-74. If bit 7 is set the clock will not be updated (i.e. it is off). It is set by the operating system service DP$CSET. (LZ)
dpb_cred 2096 dpb_cred is the "clock ready" flag, it is used to time the 1/2 second flashing of the colon. It counts down from 9 to 0 and the top bit is toggled for the flashing colon. If bit 7 is set, the ":" is printed, otherwise just an underline character. (LZ)
dpb_vpos 2097 Used in VIEW. Current position in scrolling string.
dpb_cmin 2098 Minute value when clock last displayed. Used to check whether UDG clock needs updating. (LZ)
dpb_bord 2099 dpb_bord contains the character used for the border when in 2-line compatibility mode. Default is $F5 (a chequered square). (LZ)
mnb_xmen 209A Screen position of menu. Cleared when menu finished, so of little use. (LZ)
mnb_xlin 209B Line of menu. Cleared when menu finished, so of little use. (LZ)
mnb_cptz 209C If this byte is set to 1, the entries in the menu will not be capitalized, i.e. they will appear as they are stored. Default is 0. Once set, ALL menus will appear as they are stored until the machine is reset or the byte restored to 0. This flag is used by the operating system in the FORMAT menu "PACK B: PACK C:". (LZ)
btw_toff 209D/9E Length of time in seconds that should be switched off, if there were no alarms to be checked. Highest bit set means 'permanent' switch-off (i.e. 2048 seconds). During the OFF X% command, this word contains X%, and afterwards the high byte is set to FF. (LZ)
lgb_flgs 209F Used to store editor flags, e.g. by LG$EDIT and LG$ENTR. (LZ)
lga_tag 20A0/A1 Used to store allocator tag, e.g. by LG$EDIT and LG$ENTR. (LZ)
lgb_spos 20A2 ??? (LZ)
ntb_spos 20A3 ??? (LZ)
lxa_fixp 20A4/A5 ??? Temporary storage of lxa_curr. (LZ)
tmb_24f 20A6 tmb_24f stores 2 flags: Bit 7 is set for daylight-saving ON, clear for OFF. Bit 0 is set for 24 hour mode, clear for 12 hour mode. All other bits are reserved. (LZ)
amb_wrkd 20A7 amb_wrkd is used to determine which days of the week are workdays. With bit 0 representing Monday, bit 1 Tuesday etc. Bits are set for workdays and cleared otherwise. The top bit is reserved. Setting amb_wrkd to 0 prevents checking for Workday alarms and removes the option from alarm setting. Note - amb_wrkd should not be set to $80, as this may cause the machine to lock-up. (LZ)
kbb_svst 20A8 Old keyboard state. Used to check whether display driver needs updated cursor state. (LZ)
dib_1slt 20A9 These three bytes hold the boundaries between the four WEEK VIEW "slots". They are stored in quarter-hours, so e.g. a value of 4 would mean 1:00am. This list shows how a day is divided into 4 slots IN THE WEEK VIEW:
0 (midnight a.m.)Slot 1 starts
dib_1sltSlot 1 ends/slot 2 begins
dib_2sltSlot 2 ends/slot 3 begins
dib_3sltSlot 3 ends/slot 4 begins
96 (midnight p.m.)Slot 4 ends
The values in the left hand column must be strictly increasing, and may only be equal when set to 96. Setting the start time of a slot to 96 disables that slot, and the flashing arrow in the week view will not move down onto it slot. (LZ)
dib_2slt 20AA
dib_3slt 20AB
dib_ap 20AC If this byte is not zero, alarm prompts are enabled in the diary and whenever the user types an entry and set its time so that its date/start time is greater than the current system time, an "Alarm? Y/N" prompt is given. If this byte is set to zero, the prompt will not be given. This feature is provided for users who rarely or never use alarms in the diary, and who don't want to have to type "N" after each entry. (LZ)
dib_palarm 20AD ??? (LZ)
dib_pdrtn 20AE ??? (LZ)
btb_wnmi 20AF Incremented on every NMI. Used to check whether an NMI has occurred, regardless of whether btb_ignm was clear. (LZ)
kbt_buff 20B0/BF 16 character wrap-around buffer, to hold keypresses typed ahead.
kbb_clik 20C0 This byte stores the length of the keyboard click in ms. A value of zero will turn off the key click altogether. The default value is 1 giving the shortest possible click.
kbb_pkof 20C1 This flag controls whether the packs are switched off by KB$TEST. If it is non- zero, which it is by default, the packs will be switched off whenever KB$TEST is called and there is are no keys in the keyboard buffer.
kbb_capk 20C2 This byte contains the number of the key (1 to 36) required to be the CAP key. It is used only by the keyboard translate routine at bta_tran. By default it is set to 32 (the up-arrow key). To disable the CAP key altogether, a number greater than 36 should be stored in kbb_capk.
kbb_numk 20C3 This byte contains the number of the key required to be the NUM key. It works in exactly the same way as kbb_capk.
kbb_shfk 20C4 This flag is used to disable the shift key. It is tested only in the keyboard poll routine at bta_poll. If the flag is set, the SHIFT function is disabled and the SHIFT key will act as a normal key. Hence, the key translate routine (see bta_tran $205C) will return the 26th character of its lookup table which is usually a "?" character.
tmb_year 20C5 Current year, 0 - 99 (0 - 255 on LZ)
tmb_mons 20C6 Current month, 0 - 11.
tmb_days 20C7 Current date of month, 0 - 30.
tmb_hour 20C8 Current hour, 0 - 23.
tmb_mins 20C9 Current minutes, 0 - 59.
tmb_secs 20CA Current seconds, 0 - 59. On a cold start, the clock is reset to 1 JAN 1987 (or 1989 on an LZ), 00:00:00. The real-time clock can be read or written directly from these variables but care should be taken that no NMI occurs while doing so, because the clock is updated by these interrupts. On the LZ, system services TM$TGET and TM$TSET can be used to get or set a valid time. On CM/XP machines, you can use btb_nmfl ($5B) to check if an NMI occurred during reading, or use it to wait till one has just occurred before writing.
tmw_fram 20CB/CC tmw_fram is incremented by 1 on each keyboard interrupt. When $FFFF is reached, it wraps back to $0000. It can be read at any time and used for accurate timing.
tmw_tcnt 20CD/CE Default number of seconds to auto-switch-off. Default is $012C, i.e. 5 mins. If it is set to less than 15, the machine will set it to 15 secs when next switched on.
utt_tbuf 20CF-D5 Temporary buffer, used in UT$DISP
pkb_imsk 20D6 Save interrupt mask while 'blowing' i.e. while writing to a pack.
pkt_id 20D7-FE An array of 4 elements each 10 bytes long that contain the id string of each of the 4 devices A:,B:,C: and D: respectively. Set by PK$SETP. Note that these are copies of the pack headers, which are stored in the first ten bytes of a pack (except for pack A:). It consists of:
0: an ID byte:
 bit 0 is clear for valid Org II pack
bit 1 is clear if it is a ram pack (else an EPROM datapack)
bit 2 is set if the pack is page counted, normally only packs of 8K or 16K are not paged.
bit 3 is clear if the pack is write protected
bit 4 is clear if the pack is bootable
bit 5 is clear if the pack is not copyable
bit 6 is normally set (reserved for future expansion)
bit 7 is set if the pack is a Organiser I datapack, in which case following bytes have been converted from old header format on pack.
1: a size byte: size of pack in 8K units, i.e. 8 for a 64K pack.
2-7: a 6 byte time string: indicates when pack was last sized. Has bytes indicating year, month, date, hour, and free running counter (Timer1) at time of sizing. If the pack wasn't sized on an organiser this may hold other information.
8/9:2 byte checksum: A word checksum of the first 4 words of the ID string.
If a pack (or device) is bootable, then the time string is replaced by the following 6 bytes:
2: Device/code byte: 1 if this is a hardware device (e.g. comms link), 0 if it is a software application with no extra hardware. Descriptive purposes only.
3: Device number byte: Non-zero number unique to this device. Used to identify the devices. Values 1-40, and 80-C0 are reserved to Psion for software resp. hardware devices. For example, C0 Comms link, BF Bar code reader, BE Swipe reader, 0A Concise oxford spelling checker.
4: Device version byte: Version number, for descriptive purposes only.
5: Device priority byte: Determines order in which devices are booted. Highest priority first. Usually identical to device number byte.
6/7: Device code address word: Pack address where boot code is located.
rtt_numb 20FF-214E 10 memory slots for calculator. Each 8 bytes long, in standard floating point format.
dvt_spar 214F-83 $35 bytes reserved for I/O drivers.
 
The Comms Link uses this space in the following way:
214F Length byte. Contains 1B, which means that the next 1B bytes ($2150-6A) are those that are saved in an .OB4 file.
rsb_baud 2150 Baud rate. Values 0-9 denote 50, 75, 110, 150, 300, 600, 1200, 2400, 4800, 9600. Default is 9 (9600).
rsb_parity 2151 Parity. Values 0-4 denote NONE, ODD, EVEN, MARK, SPACE. Default is 0 (NONE).
rsb_bits 2152 Data bits. Values 0-1 denote 7/8 bit data. Default is 1 (8 data bits).
rsb_stop 2153 Stop bits. Values 0-1 denote 1/2 stop bits. Default is 0 (1 stop bit).
rsb_hand 2154 Handshake. Values 0-7 denote NONE, XON, RTS, XON+RTS, DTR, DTR+XON, DTR+RTS, ALL. Default is 0 (none).
rsb_proto 2155 File transfer protocol. Values 0-2 denote NONE, XMODEM, PSION. Default is 0 (none).
rsb_echo 2156 Echo. Values 0-1 denote LOCAL, HOST for terminal emulation. Default is 0 (local).
rsb_width 2157 Width. Values 0-250 where 0 denotes no width. Default is 0 (none).
rsb_timout 2158 Timeout for LPRINT in seconds. Values 0-255 where 0 denotes no timeout.
rst_reol 2159-5B REOL string (lbc string of length <=2). Default is 02 0D 0A.
rst_reof 215C-5E REOF string (lbc string of length <=2). Default is 01 1A.
rst_rtrn 215F-61 RTRN string (lbc string of length <=2). Default is 00.
rst_teol 2162-64 TEOL string (lbc string of length <=2). Default is 02 0D 0A.
rst_teof 2165-67 TEOF string (lbc string of length <=2). Default is 01 1A.
rst_ttrn 2168-6A TTRN string (lbc string of length <=2). Default is 00.
rsb_off_del 216B Time to off delay in characters, 1-255. Default is 03.
rsb_xoff_del 216C Time to off delay with XON/XOFF. 1-255. Default is 07.
rsb_tcon_val 216D Time constant value for timer 2 baud rate gen. 0-255.
rsb_off_ticks 216E No. of ticks for baud rate dependent Tx off delay, 0-255.
rsw_off_tcon 216F/70 Time constant for single tick Tx off delay, 0-65535.
rsb_sec_timer 2171 General purpose decrement to zero second timer, 0-255. Decrements every second if non-zero. Used to implement time outs, for example by LPRINT.
2172/73 Reserved word.
rst_entry_point 2174-76 Entry point for assembler programs. Contains a jump instruction to the comms link programs. There are 12 possible function calls, and the instruction 'jsr rst_entry_point' is followed by a byte (0-11) to indicate which function is needed.
 
dpb_mode 2184 DPB_MODE shows the display mode that is currently in operation, 0 for 2-line mode, 1 for 4-line mode. To change it DP$MSET must be used. (LZ)
kbb_spec 2185 Contains flags to handle the 'special' keys.
Bit 7 - set to disable all special SHIFT keys.
Bit 1 - set to allow SHIFT-SPACE.
Bit 0 - set to allow SHIFT-EXE.
All other bits are reserved. It can be read and written to at any time but should be preserved around applications. (LZ)
btb_lang 2186 Current language. It has one of the following pre-assigned values: 0 for English (Default), 1 for French, 2 for German, 3 for Spanish, 4 for Italian, 5 for Portuguese, 6 for Swedish, 7 for Danish, 8 for Norwegian, 9 for Dutch, 10 for Turkish. Note that LZ machines only have 3 of these available. btb_lang can be read on ALL Organiser models but to change its value on multi-lingual machines TL$LSET must be used.
rtb_bl 2187 Run time buffer length
rtt_bf 2188-2287 Run time buffer ($100 long). Can be freely used in machine code programs. Many OPL commands and functions affect this area. Keep that in mind when using it to return data from a machine code program back to OPL.
mtt_wbuf 2288-C7 General purpose buffer for maths + overflow. XP and CM machines (from version 2.5 onwards) will store the UDG patterns here when switched off.
 
Overlayed against MTT_WBUF:
amt_now 2288-8D Copy of current time when checking alarms
amt_week 228E-93 Time one week from now
 
rtb_fl 22C8 Find buffer length
rtt_ff 22C9-E8 Find buffer
rtt_file 22E9-F8 4 file control blocks each 4 bytes long. The first byte contains the type of that file, between 90 and FE, or 0 if no file opened. The next byte contains the device on which the file exists (0 for A:, 1 for B: etc) Then follows a word containing the current record number.
amt_tab 22F9-2328 Alarm table, 6 bytes for each of the 8 alarms. Each entry contains a date-time in the usual format, i.e. year (0-99)/(0-255 LZ), month (0-11), day (0-30), hour (0-23), minutes (0-59), followed by a flag indicating the type of alarm. On CM and XP machines the flag has the following values: 0 means alarm not set, 1 non-repeating, 2 weekly, 3 daily, 4 hourly repeat. On the LZ machines, bits 0-2 give the repeat setting associated with the alarm: 0 means alarm not set, 1 hourly, 2 daily, 3 workdays, 4 weekly, 5 once. The top two bits give the associated tone to go with the alarm: 0 Normal, 1 Siren, 2 Chimes. An alarm entry is cancelled by setting the flag byte to zero. Before setting or modifying any alarms, the flag should be cleared and then set last of all. This is to prevent interrupts from checking that entry while it is being changed. The date-time of a repeating alarm is updated each time it rings so an alarm entry does not contain the original date-time.
dva_bot 2329/2A LA and LZ only: lowest addr used in low RAM $0400-$1FFF
dva_top 232B/2C LA and LZ only: highest addr used in low RAM.
mlb_case 232D ??? (LZ)
xtb_cold 232E Bit 7 is set to disable the language selection menu. Bit 0 is set to disable the 'second boot' after language selection (second boot allows devices to change language if necessary). All other bits are reserved. Default is 0. Note that if bit 7 is set, the second boot will still take place unless bit 0 is set. xtb_cold is reset to zero after language selection is attempted. (LZ)
kbb_lbfl 232F Set to skip low battery check when empty keyboard buffer found. (LZ)
2330-2334 reserved to PSION
amb_ei 2335 Disable alarm checking if non-zero.
amt_t0 2336-3B Temporary variable used checking for alarms
amt_t1 233C-41 ???
amt_t2 2342-47 ???
amw_r1 2348/49 ???
amb_doit 234A If set then does alarm check on next keyboard interrupt. An NMI sets this flag when the following conditions hold: btb_ignm is non-zero (else the NMI does nothing), amb_ei is non-zero (else alarm checking disabled), and tmb_secs is zero (i.e. we are on a minute boundary).
ita_uvc 234B/4C Table user vector for use with table interpreter IT$STRT.
itt_regs 234D-6C Table registers for use with table interpreter IT$STRT.
itt_stak 236D-AC Table stack for use with table interpreter IT$STRT.
imb_ssgn 23AD Saved sign
fnt_seed 23AE-B4 Random number seed
acw_stop 23B5/B6 Q code offset to stop at
acw_xtcd 23B7/B8 External O code size
act_ddat 23B9-BC Global & local data sizes
act_nvar 23BD-C0 Declared variables count
act_bran 23C1 Current branch label number
act_psym 23C9 Symbol table data pointer
lxa_cend 23CD/CE End of text pointer
lxa_strt 23CF/D0 Start of current token
lxb_stok 23D1 Saved token for un-lex
lxb_scla 23D2 Saved class for un-lex
lxb_ftyp 23D3 Function type
lgb_fixp 23D4 Decimal places in calculator display
lgb_nl 23D5 Last procedure name length
lgt_nf 23D6-DD Last procedure name
lgb_lant 23E0 Language type
lgb_menu 23E1 Set to ignore TRAN option after editing
rta_1vct 23E2/E3 Extension O code operator code
utw_reta 23E4/E5 Return address used in UT$DDSP
pkb_ovbl 23E6 Overblow factor
bta_vect 23E7/E8 Pointer to SWI vector table.
On machines with ROM version 2.4 (mostly early CM models) this is where the system variables end. The allocator cells then immediately follow.
 
Later ROM versions (2.5 onwards) also have the following:
flb_iglb 23E9 Set to skip low battery check.
pkb_bblw 23EA ???
flt_cfil 23EB-2402 6 bytes for each of the four packs. Used to store pointers to make file handling quicker when using files on several packs at the same time. The 6 bytes contain the following:
 0Flags
1/2 ???
3/4Current record number
5Record type
fla_flid 2403/04 Pointer into flt_cfil, for active file on current pack.
lna_svsp 2405/06 Saves Stack Pointer when LN$STRT is called.
pkb_ramb 2407 ???
pkb_blow 2408 ???
 
From this point on, the various models differ in their use of variables. First the single language XP/LA has the following variables:
pkb_hsav 2409 Holds highest byte of a pack address.
flb_r0 240A General variables used in file handling???
flb_r1 240B ???
flb_r3 240C ???
flb_r4 240D ???
flb_r5 240E ???
flb_r6 240F ???
flb_fnad 2410 Saves parameter X in DV$LKUP.
dvw_r0 2411/12
On XP/LA machines this is where the system variables end. The allocator cells then immediately follow.
 
Multi-lingual XP/LA machines have the following configuration instead.
240A-7D Used for system messages/menus. A string in the current language is copied here from a ROM bank before being used.
247E-8E Used to hold error message. The error message in the current language is copied here from a ROM bank before being displayed.
pkb_hsav 248F As above.
flb_r0 2490 As above.
flb_r1 2491 As above.
flb_r3 2492 As above.
flb_r4 2493 As above.
flb_r5 2494 As above.
flb_r6 2495 As above.
flb_fnad 2496 As above.
dvw_r0 2497/98 As above.
On multi-lingual XP/LA machines this is where the system variables end. The allocator cells then immediately follow.
 
The P350 has the same variables as the standard XP/LA, along with the following ones.
btt_mstack 2413-2512 ???
btb_rbnk 2513 Current RAM bank. (LZ uses 262A instead)
btb_wnmi 2514 Incremented on every NMI. Used to check whether an NMI has occurred, regardless of whether btb_ignm was clear. (LZ uses 20AF instead)
On P350 machines this is where the system variables end. The allocator cells then immediately follow.
 
The LZ has the same variables as the standard XP/LA, along with the following ones.
btt_mstack 2413-2512 (See P350 above.)
mlt_buf 2513-DB ???
dib_pastelen 25DC Length of the Paste buffer. (LZ)
dib_paste 25DD-261C Paste buffer. (LZ)
flt_dmat 261D ???
btb_rbnk 262A Current RAM bank. (LZ)
mlb_bank 262B Current ROM bank. (LZ)
dpt_4lin 262C-7B 4-line screen buffer. Used instead of the 2-line buffer at dpt_tlin when in 4-line mode. (LZ)
xfb_nlen 267C Length of name of opened file in Xfiles menu. (LZ)
xft_name 267D-84 Name of opened file in Xfiles menu. (LZ)
xfb_cpak 2685 Pack of opened file in Xfiles menu. (LZ)
wla_curr 2686/87 Current city in world. (LZ)
wla_base 2688/89 Current home in world. (LZ)
wlb_gmt 268A Number of half hours difference with GMT. (LZ)
dpb_vpar 268B Used by DP$PVEW to store how many non-scrolling characters there are on the line, so that viewing can be continued later. (LZ)
dpb_pvln 268C Used by DP$VIEW and DP$PVEW to store line (0-3) where viewing takes place, so that viewing can be continued later. (LZ)
End of these system variables, and usually start of first allocator cell of the LZ.
 
The LZ has some further system variables at the top of the RAM.
btt_bboot 7F00-21 ???
dpt_sudg 7F22-61 Area for saving UDG patterns when off. (LZ)
dpt_4sav 7F62-B1 Area for saving screen contents, used by DP$SAVE and DP$REST, whether in 2 or 4 line mode. (LZ)
mlt_ebuf 7FB2-C2 ???
rtt_fsav 7FC3 ???
xtt_pasw 7FD6 System password flag. Bit 0 is set if password exists, bit 1 is set if it is switched on. Can poke this to zero to remove system password without knowing what it was. (LZ)
7FD7-DF 9 byte system password. (LZ)
dis_e 7FE0 ???
dib_dmode 7FE9 ???
ntb_flgs 7FEA This byte contains flags for the editor (see LG$EDIT) used with the current notepad. The following bits are used:
bit 7 - true if numbered
bit 3 - true if on/clear exits editor : do not change
bit 2 - true if prompt to be capitalized
bit 1 - true if no title required
bit 0 - true if changed (used in editor)
The default value for a new notepad is $08 (bit3 set). Note that if bit3 is cleared then the notepad cannot be exited. This bit is 0 when using the editor with an OPL procedure where the menu includes the item EXIT. (LZ)
ntb_pssw 7FEB This byte is 0 if the current notepad in memory has no password or the password length if a password exists. It must not be poked or the editor may attempt to decrypt unencrypted data or not to decrypt encrypted data etc. which will cause a crash. (LZ)
7FEC-F3 ???
7FF4-7FFC 9 byte password code of the current notepad. (LZ)
ntw_clin 7FFD/FE This word contains the current line number in the current notepad. Line 0 is the line containing the notepad name. This defines which line the cursor is on. This variable may be poked to change the line number but should not be given a value greater than the last line number in the notepad. The maximum line number is 1 less than the number of zero line-delimiters in an unencrypted notepad. (LZ)
ntb_cpos 7FFF This byte contains the cursor position in the current line in the current notepad, and has a value between 0 and $FE. This variable may be poked to change the cursor position but should not be given a value greater than the length of the current line. (LZ)
 
The following addresses are in the ROM, so their contents can not be changed.
FFCB Model byte 2. See Model byte 1 (FFE8). Not used on CM/XP machines, and on these this byte is usually $FF.
FFCC-E6 Copyright message
FFE7 Language byte. Its value indicates which languages the organiser has available.
 00English only
01French only
02German only
8011 languages (English default)
813 languages (English default, French, German)
823 languages (English default, Spanish, Italian)
833 languages (English default, Swedish, Danish)
Note that bit 7 is set if the machine is multi-lingual. It is only implemented from Rom versions 3.6 and later. Earlier Roms are English only, and in those version this byte is FF. The current language used on a multi-lingual machine is held in btb_lang ($2186).
FFE8 Model byte 1. The bottom 3 bits indicate the basic model type.
Bits 0-2   Model   RAM   ROM
0CM832
1XP1632/64
2LA3232/64
3???
4P3509632
5LZ646464
6LZ3264
7See model byte 2.
If bits 0-2 are all set, then the basic model type is determined by the bottom three bits of model byte 2. These further basic types and type 3 have not been produced as far as I know.
The highest 5 bits of the model byte indicate the special model types. It seems that if bit 4 is set then the machine is a POS model with a standard keyboard, if instead bit 6 is set then it is an alpha POS model, and bit 7 indicates a normal POS model (numeric keyboard). If bit 3 is set then the special model type is indicated by the highest 5 bits of model byte 2. If model byte 2 is used then bit 7 indicates an LZ, and bit 6 indicates LCD type (set for the 66780 chip which allows foreign characters, clear for the standard HD44780 in earlier models which has Japanese katakana), and bits 3, 4 and 5 are reserved. Note that bit 5 is set on LZ versions 4.5 onwards. I have been able to verify the following values:
ModelByte 1   Byte 2 
CM00-
XP01-
LA02-
LZ0EC0/E0
LZ640DC0/E0
POS25012-
POS35014-
POS4641DC0/E0
Alpha POS200  41/42-
POS20082-
FFE9 ROM software version number. This is a bcd number, for example, if it contains $46 the Rom has version number 4.6 etc. LZ machines have versions 4.2 and above.
FFEA Address of IRQ2 interrupt routine. See bta_2iq (2042)
FFEC Address of CMI interrupt routine. See bta_cmi (2044)
FFEE Address of TRAP interrupt routine. See bta_bug (2046)
FFF0 Address of SIO interrupt routine. See bta_sio (2048)
FFF2 Address of TOI interrupt routine. See bta_toi (204A)
FFF4 Address of OCI interrupt routine. See bta_oci (204C)
FFF6 Address of ICI interrupt routine. See bta_ici (204E)
FFF8 Address of IRQ1 interrupt routine. See bta_1iq (2050)
FFFA Address of SWI interrupt routine. See bta_swi (2052)
FFFC Address of NMI interrupt routine. See bta_nmi (2054)
FFFE Address of cold boot routine (usually 8000 on CM/XP's, C000 on LZ's).