RAM Addresses and Routines

Page Customization

Display Decimal Addresses

Display Labels

Note:

This page needs some love. There are duplicate lines which may say the same thing. Anyone who is willing to help clean up any part of this page, please speak up! Thanks!

The following keys for DOSes apply:

T1 - Model 1 TRSDOS	T3 - Model 3 TRSDOS
N1 - Model 1 NEWDOS	N3 - Model 3 NEWDOS
L1 - Model 1 LDOS	L3 - Model 3 LDOS
M1 - Model 1 MULTIDOS	M3 - Model 3 MULTIDOS
D1 - Model 1 DOSPLUS	D3 - Model 3 DOSPLUS
All - All DOSes, Model I and Model 3.

RAM Addresses and Routines:

Address (Hex/Dec/Label)	Model Code	Description
3000H-37DDH ↳12288-14301	Model 1	Reserved. Unused in Model I.
3000H ↳12288	3	Write 500 baud cassette leader and sync byte.
3003H ↳12291	3	Write 1500 baud cassette leader and sync byte.
3006H ↳12294	3	Search for 500 baud cassette leader and sync byte.
3009H ↳12297	3	Search for 1500 baud cassette leader and sync byte.
300CH ↳12300	3	Turn off cassette.
300FH ↳12303	3	Turn on cassette.
3012H ↳12306	3	Disk bootstrap routine.
3015H ↳12309	3	Power-up routine (jump here from 0002H).
3018H ↳12312	3	Maskable interrupt handler.
301BH ↳12315	3	RS-232-C initialization driver routine.
301EH ↳12318	3	RS-232-C input driver routine.
3021H ↳12321	3	RS-232-C output driver routine.
3024H ↳12324	3	Keyboard driver routine.
3027H ↳12327	3	I/O Route driver routine (not available on Model 4).
3029H ↳12329	3/4	To determine if a computer is a Model 3 or Model 4, peek this location. 0 = Model 4
302AH ↳12330	3	Part of routine to search for cassette leader and sync byte (jumps here from 0229H).
302DH ↳12333	3	Part of LIST command (jumps here from 2B91H).
3030H ↳12336	3	BASIC TIME$ function routine.
3033H ↳12339	3	$DATE routine (date to 8-character buffer pointed to by HL).
3036H ↳12342	3	$TIME routine (time to 8-character buffer pointed to by HL).
3039H ↳12345	3	Non-maskable interrupt handler.
3042H ↳12354	3	$SETCAS routine (prompt user to set cassette baud rate)
37DEH ↳14302	Model 1	Communication Status Address
37DFH ↳14303	Model 1	Communication Data Address
37E0H ↳14304	Model 1	Interrupt Latch Address
37E1H ↳14305 ↳DSEL$	Model 1	Disk Drive Select Latch Address. 01H = Drive :0
37E4H ↳14308	Model 1	Cassette Select Latch Address 0 = Tape Drive #1 1 = Tape Drive #2
37E8H ↳14312 ↳PRTAD$	1/3	$PRSTAT: Printer Status Byte a/k/a Line Printer Address. If a parallel line printer is in use, it is mapped to this address. Writing a byte to this address sends it to the printer, while reading this address determines printer status as follows: Bit 7 = 0 if NOT BUSY Bit 6 = 0 if NOT OUT OF PAPER Bit 5 = 1 if DEVICE SELECTED Bit 4 = 1 if NO PRINTER FAULT Bits 0-3 are NOT USED 63 [00111111] = Printer On (i.e., no printer fault, device selected) 143 [10001111] = Printer Off (i.e., printer fault, device not selected, busy)
37E9H ↳14313	1/3	$PROUT: Output a Byte to the Printer.
37EAH ↳14314	Model 1	Contains the byte from 37E8H (PRTAD)
37EBH ↳14315	Model 1	Contains the byte from 37E8H (PRTAD)
37ECH ↳14316 ↳FDCAD$	Model 1	Floppy Disk Controller COMMAND/STATUS. This location is tested during the power-up sequence to determine if a floppy disk controller is online, and if so, the TRS-80 will jump to the disk bootstrap routine (unless the `BREAK` key is held). 00H or FFH = No disk controller found, TRS-80 will jump to Level II BASIC Bit 1 from this memory location is DIM READY 1BH = Command to SEEK 88H = Command to READ SECTOR D0H = Command to FORCE INTERRUPT
37EDH ↳14317	Model 1	DISK TRACK SELECT
37EEH ↳14318 ↳FDCAD$+2	Model 1	DISK SECTOR SELECT
37EFH ↳14319 ↳FDCAD$+3	Model 1	Byte read from disk (DISK DATA)
3800H-3840H ↳14336-14400 ↳KEYAD$	1/3	Keyboard Memory / Address Matrix
3B80H ↳15232	1/3	Keyboard Memory / Address Matrix for SHIFT Keys
3C00H-3FFFH ↳15360-16383 ↳DSPAD$	1/3	$VIDRAM: The beginning of video ram or VIDRAM. It ends at 3FFFH or 16383.
3FFFH ↳16383	3	END OF VIDEO MEMORY
4000H ↳16384 ↳RST1$	1/3	RST 08 (Syntax Check): Compare value pointed to by HL to that immediately following RST instruction.
4000H ↳16384	Model 1	Start of Level II BASIC Fixed RAM.
4003H-4005H ↳16387-16389	TD	RST 10H (Get Next Character): Jump Vector.
4003H ↳16387		RST 10 Examine next symbol pointed to by HL.
4003H	Model 1	The next 3 bytes are used to hold the length and address of a string when it is moved to the string area.
4006H	Model 1	RST 18 vector
4006H ↳16390		RST 18H (Cp HL, DE) Jump Vector.
4006H ↳16390		RST 18 Compare DE and HL.
4009H ↳16393		RST 20 Test the type of current variable.
4009H	Model 1	RST 20 vector
4009H ↳16393		RST 20H (Get Current Type) Jump Vector.
400CH-400EH ↳16396-16398 ↳RST5$	1/3	RST 28H (Break Key Vector). By default, it contains C9 00 00 (201 00 00) which is RET in NON-DOS BASIC. Any 3 byte instruction code put here will execute on hitting the `BREAK` key. On a Model I, to disable the `BREAK` key, Radio Shack recommends filling 16396 with 23 (17H) which is RLA (which just messes with Register A), and with 201 (C9H) RET to re-enable it. On a Model 3, to disable the `BREAK` key, Radio Shack recommends filling the area with AF C9 00 (175 and 201) which is XOR A / RET. Other methods include filling the area with C3 9A 0A (195 154 10) which is JP 0A9AH.
400CH ↳RST5$	Model 1	RST 28 DOS request processing
400CH ↳16396		RST 28 3 byte `BREAK` key vector (cass. BASIC & TRSDOS1.3) and normal DOS function call.
400FH ↳16399		RST 30 Reserved for DOS; normally for invoking Debug
400FH ↳RST6$	Model 1	Load debug (ld a,xx/RST 28)
400FH ↳16399 ↳RST6$	Model 3	RST 30H Jump Vector.
4012H-4014H ↳16402-16404 ↳RST7$ or INTERP	1/3	RST 38H Jump Vector.
4012H ↳RST7$ or INTERP	Model 1	RST 38 interrupt service call
4012H ↳16402		RST 38 Maskable interrupt vector.

4015H-401CH - Keyboard Device Control Block

Address (Hex/Dec/Label)	Model Code	Description
4015H ↳16405 ↳KDCB$	Model 1/3	Beginning of Keyboard DCB. One byte device type. Value = 1
4016H ↳16406	Model 3	Two byte keyboard driver vector. Model 3 it's 3024H, which JUMPs to 338EH which then processes the keyboard)
4016H-4017H ↳16406-16407	Model I	Keyboard Device Control Block. Two byte keyboard driver vector. To Disable The Model I Keyboard: N1=PEEK(16406) N2=PEEK(16407) POKE 16406,154 POKE 16407, 10 To Enable The Model I Keyboard: POKE 16406,N1 POKE 16407,N2
4015H ↳16405 ↳KDCB$	Model I	Keyboard DCB+0: This address holds the DCB Type
4016H ↳16406	Model I	Keyboard DCB+1: This address holds byte 1 of the 2 byte Driver Address
4016H ↳16406		Two byte keyboard driver vector.
4017H ↳16407	Model I	Keyboard DCB+2: This address holds byte 2 of the 2 byte Driver Address
4018H ↳16408	Model I	Keyboard DCB+3: This address holds Value = 0
4018H ↳16408	1/3	Keyboard DCB: Right Shift Toggle
4019H ↳16409	Model I	Keyboard DCB+4: This address holds Value = 0
4019H ↳16409		Caps lock switch Not 0 = Caps only
4019H ↳16409	Model 3	Caps Lock Toggle 0 = Off (i.e., upper and lower case) Anything else = ALL CAPS Note: A DOS driver might take over this function.
401AH ↳16410	Model I	Keyboard DCB+5: This address holds Value = 0
401AH ↳16410	Model 3	Cursor Blink Count.
401BH ↳16411	Model I	Keyboard DCB+6: This address holds `K`
401BH ↳16411	Model 3	Cursor Blink Status. 0 = Off NZ = On
401CH ↳16412	Model I	Keyboard DCB+7: This address holds `I`
401CH ↳16412	1/3	Cursor Blink Switch. 0 = Blink Anything else = No blink

401DH-4024H - Video Display Control Block

Address (Hex/Dec/Label)	Model Code	Description
401DH-4024H ↳16413-16420 ↳DDCB$	1/3	Beginning of Video Display Control Block (DCB). DCB is Number 7. Classification is both Input and Output.
401DH ↳16413		Beginning of Video DCB. One byte device type. Value = 7
401EH-401FH ↳16414-16415 ↳IX+1, IX+2	1/3	Two byte video driver address in LSB / MSB order
401EH ↳16414		Two byte video driver vector.
4020H-4021H ↳16416-16417 ↳CURSOR, IX+3, IX+4	1/3	Cursor Position On Screen. 2 Bytes in LSB/MSB Order.
4020H ↳16416		Two byte cursor position.
4022H ↳16418 ↳IX+5	Model 1	Cursor Character: 0 = Cursor Off Not 0 = Cursor Character
4022H ↳16418	Model 3	Cursor On/Off Flag: Z = Off NZ = Character Under Cursor
4023H ↳16419	1/3	Cursor Character (in ASCII). Defaults to 176. Must be between 32 and 255.
4024H ↳16420		FLAG: 0 = Space compression Not 0 = Special character
4024H ↳16420	3	Character Set To Use 0 = Regular 1 = Alternate
4024H ↳16420	Model 3	Tape RAM - Video DCB: Tabs/Special Characters Switch Z = Tabs

4025H-402CH - Printer Control Block

Address (Hex/Dec/Label)	Model Code	Description
4025H ↳16421 ↳PDCB$, IX+0	1/3	Beginning of Printer DCB. This location, IX+0, is the DCB Type which is set for 6. Classification = Write Only
4026H-4027H ↳16422-16423 ↳IX+1, IX+2	1/3	Two byte Print Driver Address (stored in LSB/MSB Order).
4028H ↳16424 ↳IX+3	1/3	Printer: Maximum Number of Lines which can be Printed per Page plus 1. The default is 67. 0 = Top-of-page
4029H ↳16425 ↳IX+4	1/3	Printer: Number of lines already printed +1. To reset the counter POKE 16425,1
402AH ↳16426	Model 1	Model 1: Not Used
402AH ↳16426	Model 3	Number of characters printed already + 1
402BH ↳16427	Model 3	Line printer maximum characters (width) per line less 2. Set at 255 for no maximum.
402CH ↳16428		`R`
402DH ↳16429 ↳SYS1IN		EXIT: Normal program exit back to DOS. (Disk systems only).
402DH ↳16429 ↳SYS1IN	Model 3	Tape RAM - Printer DCB: JP 5000H Unused DOS Vector
4030H ↳16432 ↳ABORT	Model 1	DOS request code for SYS1
4030H ↳16432 ↳ABORT		For all DOSes except TRSDOS, jumping here is for an abnormal return to DOS ready, such as after an unsuccessful program exit.
4030H ↳16432	Model 3	Tape RAM - Printer DCB: RST 0
4032H ↳16434	Model 1	Write 'DOS ready' message
4033H ↳16435 ↳CIO$	Model 1	Call device driver ala DOS
4033H ↳16435	Model 3	Tape RAM - Printer DCB: XOR A and RET
4036H-403CH ↳16438-16444 ↳KYBT$	1/3	Keyboard Bit Image (7 Byte Buffer). This is the work area for keyboard input routine. The contents of the keyboard rows are stored here so that when the keyboard routine is called, it can determine whether the key has just been depressed (or is still being held down). 4036H = keyboard row address 3801H: @ABCDEFG keys 4037H = keyboard row address 3802H: HIJKLMNO keys 4038H = keyboard row address 3804H: PQRSTUVW keys 4039H = keyboard row address 3808H: XYZ keys 403AH = keyboard row address 3810H: 01234567 keys 403BH = keyboard row address 3820H: 89:;,-./ keys 403CH = keyboard row address 3840H: Enter, Clear, Break, Up, Down, Left, Right, and Space keys
4036H ↳16438		Keyboard buffer (7 bytes).
403DH ↳16445	Level 2	Cassette port and print size flag (bit 3) copy (For Model 3, see 4210H). Bit 3: Select video 32 character mode if set Bit 2: Turn the cassette tape relay on if set Bits 1 and 0: Positive and negative audio pulses to the AUX plug Value 0: Video is in 64 characters per line Value 8: Video is in 32 characters per line
403DH ↳16445 ↳CAST$	M1 DOS / Model 3	Tape RAM - Interrupt Vector 3 - JP 35FAH. This MAY be the routine to add a task to the interrupt chain.
403DH ↳16445 ↳CAST$	M3 DOS	Used primarily by the Disk Operating System, vectors at 403DH, 4040H, and 4043H service interrupt vectors 3, 6, and 7 respectively (under non-disk systems all contain a jump to 35FAH, which in turn contains a "RET" instruction). 4046H is an interrupt vector servicing the clock (interrupt vector 2) and contains a jump to 35A9H in a non-disk system. 4049H is the Non-Maskable Interrupt vector and normally contains a RST 0 instruction. The remainder of this area is unused in non-disk systems.
403DH ↳16445		Cassette port and print size flag (bit 3) copy (For Model 3, see 4210H). L3: location of routine to add task to interrupt chain.
403EH-407FH ↳16446-16511 ↳CURDOS	M1	Unused in non-Disk systems. Real time clock storage locations are kept here. For the Model 3 this would be 4216H-421CH.
403EH ↳16446 ↳CURDOS	Model 1	Used by DOS
403EH ↳16446 ↳CURDOS	D1	OSVER$: Holds the DOS Version Number. Stored in DCB format. Note: on a M3 this is stored in 441FH and on the M4 in 0085H
403EH ↳16446		For Model I DOSPLUS, holds DOS version in DCB format.
403FH ↳16447	Model 1	Used by DOS
4040H ↳16448	Model 1	System bits
4040H ↳16448	Model I	25 ms heartbeat counter.
4040H ↳16448	Model 3	Interrupt Vector 6 - JP 35FAH. Vector 6 may be "remove task from interrupt chain".
4040H ↳16448	For L1 & M1	25 ms heartbeat counter. For L3, used to remove task from interrupt chain.
4041H-4043H ↳16449-16451 ↳XTIME	L1, D1, and M1	TIME$, time of day: Seconds, Minutes, Hours
4041H ↳16449 ↳XTIME	Model 1	Seconds
4041H ↳16449		Beginning of Time and Date bytes: seconds, minutes, hours, year, day, month. Ends at 4046H or 16454. L1, D1, and M1
4042H ↳16450	Model 1	Minutes
4043H ↳16451	Model 1	Hours
4043H ↳16451	Model 3	Tape RAM - Interrupt Vector 7 - JP 35FAH
4043H ↳16451	L3	Change address of interrupt task.
4044H-4046H ↳16452-16454	L1, D1, and M1	DATE$, date: Year, Day, Month. Stored in BCD.
4044H ↳16452	Model 1	Year
4044H ↳16452	L1, D1, & M1	Contains date in binary format.
4045H ↳16453	Model 1	Day
4046H ↳16454	Model 1	Month
4046H ↳16454	L3	Remove task from interrupt chain.
4046H ↳16454	Model 3	Tape RAM - Interrupt Vector 2 - JP 35A9H
4047H ↳16455	Model 1	Load address for system utilities 2 bytes, initialized to 5200 by sys0/sys
4047H ↳16455	L1	Current day in coded form.
4048H ↳16456	Model 1	Current interrupt status word
4049H-404AH ↳16457-16458 ↳MEMEND	Model 1	DOS MEMORY SIZE. Highest available memory location (On a Model 3 it is stored at 4411H)
4049H ↳16457 ↳MEMEND	Model 3	Tape RAM - RST 0 NMI Vector (Reset If So)
4049H ↳16457		For the Model 3 disk is non-maskable interrupt vector, for Model I disk is highest available memory location (Model 3 = 4411H)
404BH ↳16459	L1	Contains image of interrupt latch.
404CH ↳16460	Model 1	Interrupt subroutine mask
404DH-404EH ↳16461-16462	T1	Address of interrupt service routine for interrupt bit 0
404DH ↳16461	Model 1	Reserved (interrupt bit 0)
404FH-4050H ↳16463-16464	T1	Address of interrupt service routine for interrupt bit 1
404FH ↳16463	Model 1	Reserved (interrupt bit 1)
4050H-4051H ↳16464-16465	Model I	FDC Interrupt Vector
4050H ↳16464	Model 1	Stack during IPL
4051H-4052H ↳16465-16466	T1	Address of interrupt service routine for interrupt bit 2
4051H ↳16465	Model 1	Communications interrupt subroutine
4052H-4053H ↳16466-16467	Model I	Communications Interrupt Vector
4053H-4054H ↳16467-16468	T1	Address of interrupt service routine for interrupt bit 3
4055H-4056H ↳16469-16470	T1	Address of interrupt service routine for interrupt bit 4
4057H-4058H ↳16471-16472	T1	Address of interrupt service routine for interrupt bit 5
4058H ↳16472	Model 1	Address of clock interrupt routine
4059H-405AH ↳16473-16474	T1	Address of interrupt service routine for interrupt bit 6 (which is the DISK interrupt routine)
405BH-405CH ↳16475-16476	T1	Address of interrupt service routine for interrupt bit 7
405EH ↳16478	Model I	25 MSec Heartbeat Interrupt
4070H ↳16496	Model 1	Start of stack during ROM IPL
407DH ↳16509 ↳TSTK$	DOS	Stack pointer for DOS, set by the ROM bootstrap routine
407EH ↳16510	Model 1	Reserved
407FH ↳16511	Model 1	Reserved
4080H ↳16512 ↳FDIVC or RAMLOW	Model 1	Subtraction routine used by division code. Code is moved from 18F7H - 1904H during non-disk IPL or by BASIC UTILITY FOR DISK SYSTEMS
4081H ↳16513 ↳FDIVC+1	Model 1/3	Used in the single precision division routine (stores the LSB). On power up, this routine is moved from 18F7H-1904H to here.
4084H ↳16516 ↳FDIVB	Model 1/3	Used in the single precision division routine.
4085H ↳16517 ↳FDIVB+1	Model 1/3	Used in the single precision division routine (stores the NMSB).
4088H ↳16520 ↳FDIVA	Model 1/3	Used in the single precision division routine.
4089H ↳16521 ↳FDIVA+1	Model 1/3	Used in the single precision division routine (stores the MSB).
408BH ↳16523 ↳FDIVG	Model 1/3	Used in the single precision division routine
408CH ↳16524 ↳FDIVG+1	Model 1/3	Used in the single precision division routine (stores the High Order).

USR and Random Number Routines

Address (Hex/Dec/Label)	Model Code	Description
408EH-408FH ↳16526-16527 ↳USRTAB	I/III Tape RAM	Entry point to the USR subroutine. If you poke the starting addresses correctly, then X=USR(0) will run that routine. 16526 gets the LSB and 16527 gets the MSB.
408EH ↳16526 ↳MAXFIL	T1	TRSDOS 2.3 stores the answer to the FILES? Question
408FH ↳16527 ↳VARREC	T1	TRSDOS 2.3 Flag for whether Variable Files were permitted on Entry into BASIC
4090H ↳16528 ↳MULTR	I/III	Random number seed
4093H-4098H ↳16531-16536 ↳STAINP	Model 1/3	Input and output port routines
4096H ↳16534 ↳OUTWRD	Model 1/3	Tape RAM - Tape RAM: Out Support
4099H ↳16537 ↳CHARC	Model 1/3	INKEY$ storage. This holds the most recently typed keyboard character, stored in ASCII.
409AH ↳16538 ↳ERRFLG	Model 1/3	Current Error Code is stored at this address (for BASIC only). It would be returned by the ERR function.
409BH ↳16539 ↳LPTPOS	Level 2 / Model 3	Number of characters already printed in the current line. This would also make it the printer carriage position. It may be used to simulate a TAB function that works correctly past the 63 or 127 character limit of the BASIC TAB function, as TAB cannot be greater than 63 for an old Model I or 127 for a new Model I or any Model 3.
409CH ↳16540 ↳PRTFLG, OUTSEL	Model 1/3	This is the device output flag. -1 (or 129) = Cassette Output 0 = Video Output 1 = Printer Output
409DH ↳16541 ↳LINLEN	Level 2	Maximum number of characters on video display line. Used by PRINT command routine when printing numeric variables or constants so that a number does not overflow the end of a video display line. This location is set to 64 at power-up and is not changed by the BASIC interpreter once set. However, a POKE to this location may be used to prevent the PRINTing of numerics beyond a certain point on a line. Also, if you are operating in 32-character display mode it may be necessary to POKE 16541, 32 to prevent numeric printouts from overflowing the end of the line. The setting of this location does not affect the printout of strings (variables or constants).
409EH ↳16542 ↳CLMLST	Model 1	Size of print line
409EH ↳16542 ↳CLMLST	Model 3	The value in this location specifies the maximum number of 16-character print zones on a line (used when items in a PRINT statement are separated by commas). Value stored here is decoded as follows: 0 = One print zone 16 = Two print zones 32 = Three print zones 48 = Four print zones per line When a comma separator is found in a PRINT statement, BASIC checks the cursor line position byte at 40A6H and if it is greater than or equal to the value stored here, a carriage return is output to the video display driver. This location is set to 48 (four print zones) at power-up and is not changed by the BASIC interpreter once set.
409FH ↳16543	Model 1	Reserved
409FH ↳16543	Model 3	Tape RAM - Data flag. Will indicate if the parser is in a QUOTED STRING (Bit 0 high), REM (Bit 2 high), or DATA (Bit 1 high).

BASIC Memory Management

Address (Hex/Dec/Label)	Model Code	Description
40A0H-40A1H ↳16544-16545 ↳STKTOP	Model 1/3	String Storage Area: 2 Bytes point to the lowest address available for string storage. This is ALSO the top of free memory. Start of string storage area, set to 50 less than top of memory pointer (at 40B1H) at power-up to provide 50 bytes of string storage area. Changed by use of CLEAR n command (with argument).
40A2H-40A3H ↳16546-16547 ↳CURLIN	Model 1/3	Holds the Last executed (or current) line number in a BASIC Program in 2 Bytes (LSB/MSB) or FFFFH if in direct mode.
40A4H-40A5H ↳16548-16549 ↳TXTTAB	Model 1/3	Points to the beginning of the BASIC program in RAM, stored in 2 bytes (LSB/MSB). It is the start of the BASIC program in RAM (referred to sometimes as the PST). Normal values for: (L2)=42E9; (Disk BASIC)=varies with version of DOS/BASIC. TO APPEND: POKE 16548,PEEK(16633)-2 : POKE 16549,PEEK(16634) CLOAD POKE 16548,233 : POKE 16549,66 . What this does is trick the NEW command, which is called as part of CLOAD, into clearing everything AFTER your current program and then restoring where the beginning of the program is afterwards). This is NOT a MERGE, it will APPEND, and leave line numbers out of order.
40A6H ↳16550 ↳TTYPOS	Model 1/3	Holds the current cursor position (column number) on the video display line (as returned by the POS function).
40A7H-40A8H ↳16551-16552 ↳BUFPNT	Model 1/3	Input Buffer Pointer (in BASIC). The address of the BASIC keyboard buffer. Note: Also used by BASIC while encoding and decoding BASIC lines (as during LIST, etc.)
40A9H ↳16553 ↳CASFLG	Model 1/3	Used by INPUT command routine, contains zero byte if (and only if) input is from cassette. A bug in the first release of the Model I Level II BASIC ROM required that this location be POKEd with a non-zero value prior to reading program DIM statements. This bug was corrected soon after Level II BASIC was released, so that this POKE is required only for older TRS-80 Model I machines.
40AAH-40ACH ↳16554-16556 ↳RNDX	Model 1/3	Seed Number 1 for Random Number
40ABH ↳16555 ↳RNDX+1	Model 1/3	Value from refresh register. When a RANDOM is executed in BASIC, this is the byte that gets changed (it is loaded with current value of Refresh register whenever RANDOM statement is executed).
40ACH ↳16556 ↳RNDX+2	Model 1	Last random number (2 bytes)
40ADH ↳16557	Model 1/3	Unused in non-disk systems.
40AEH ↳16558 ↳DIMFLG	Model 1	Flag: 0 = Locate named variable -1 = Create entry for named variable
40AEH ↳16558 ↳DIMFLG	Model 1/3	This flag is used by the BASIC locate or create variable routine. If location contains zero, variable is to be created or located (if already created). If byte is not zero, variable is to be created only and an error exists if the variable is found to be already created. The latter situation exists when an array is being created using the DIM statement.
40AFH ↳16559 ↳VALTYP, SAFLAG	Model 1/3	Contains the variable type flag for the number sitting in the software accumulator (also known as the Work-Register-Area-1). 2 = Integer 3 = String 4 = Single-precision 8 = Double precision
40B0H ↳16560 ↳DORES	Model 1	Holds intermediate value during expression evaluation
40B0H ↳16560 ↳DORES	Model 1/3	Used to flag DIM statements while encoding BASIC lines, and to store operator number during expression evaluation.
40B1H-40B2H ↳16561-16562 ↳MEMSIZ, MEMTOP	Model 1/3	Top of memory pointer. Last usable location for BASIC. This pointer is set by one of the following: If the user answers Memory Size? question with a value, it will be used. However, if only `ENTER` is pressed in response to Memory Size?, then on a non-disk system the highest available memory location will be used, but under Disk BASIC the DOS top of memory pointer will be copied into this location. If one is programming in BASIC and attempting to change this pointer by POKEing in new values, a CLEAR n statement (with a mandatory numeric argument) should be used immediately following the POKEs, in order to adjust other system pointers to the new memory size. Also, temporarily changing this pointer will allow a short BASIC program to CLEAR more than 32767 bytes of string space on a 48K system, provided that enough free memory is available (BASIC normally does not permit this).
40B1H ↳16561		Two byte MEMTOP (for BASIC).
40B3H-40B4H ↳16563-16564 ↳TEMPPT	Level 2	Pointer to the next available location for storage of a three-byte string variable VARPTR in the string VARPTR storage area that begins at 40B5H.
40B5H-40D2H ↳16565-16597 ↳TEMPST	Level 2	String variable VARPTR storage area. Holds three-byte string descriptors (first byte contains length, second and third bytes contain address of string) for strings currently being used in BASIC string operations (such as "temporary" strings).
40D3H-40D5H ↳16595-16597 ↳DSCTMP		VARPTR storage area for string currently being created by BASIC. (first byte contains length, second and third bytes contain address of string).
40D3H ↳16595		Saves length ASCII representation of binary integer.
40D4H ↳16596		Two byte address. Points to buffer where ASCII decimal representation written.
40D6H-40D7H ↳16598-16599 ↳FRETOP	Model 1/3	Pointer to next free byte in string storage area. Strings build downward from the top of memory, therefore at power-up (or when a CLEAR command is executed) this pointer will contain the same address as the top of memory pointer (40B1H-40B2H). If a ten byte long string is then created, this pointer will point to the top of memory minus ten, and so on. When there is not enough room left to insert a new string (the difference between this pointer and the one at 40A0H-40A1H is less than the length of a string to be stored), a "garbage collection" is performed, and if that does not free enough string space an Out of String Space error occurs. Under some circumstances, we may be able to manipulate this pointer in order to forestall a "garbage collection" (which may appear to "lock up" the computer for as much as several MINUTES). For example, if we are performing some operation that will create many "temporary" strings (but none that we want to save after a certain point), we could PEEK at the values in these pointer locations and store them in numeric variables. At the completion of our string operation, we could then re-POKE the original pointer values, thus abandoning the unneeded strings without performing a "garbage collection". Under certain circumstances this technique could cut program execution time considerably.
40D6H ↳16598		String pointer. Keeps track within CLEARed area as to where last string data was put.
40D8H-40D9H ↳16600-16601 ↳TEMP3	Level 2	This pair (two byte) of locations is used as temporary storage location by more than one routine. Uses include program pointer during expression evaluation, pointer to data while processing DIM statement, pointer to end of array while packing strings, and within the PRINT USING routine the byte at 40D8H is used to temporarily store the PRINT USING format flag bits.
40D8H ↳16600 ↳TEMP3	Model 1	Index of last byte executed in current statement Edit flag during print using
40D8H ↳16600		Two byte location of where BASIC is currently reading program.
40DAH-40DBH ↳16602-16603 ↳DATLIN	Level 2	Line number of last DATA item read. Line number is saved so that in the event of a syntax error in a DATA statement, the proper error line number will be displayed and the EDIT mode will function on the correct line.
40DCH ↳16604 ↳SUBFLG	Model 1	FOR command flag: 1 = FOR loop is in progress 0 = No FOR loop in progress
40DCH ↳16604 ↳SUBFLG	Level 2	If this byte contains 64 a FOR-NEXT loop is being processed, otherwise byte will contain zero. Used to prevent an array variable from being used as the index counter in a FOR-NEXT loop (for example, the statement FOR X(0) = 1 TO 10 will cause a syntax error, because X(0) is an array variable and cannot be used as the counter variable).
40DDH ↳16605 ↳BFKLFL	Model 1	0 = During input phase Zero otherwise
40DDH ↳16605 ↳BFKLFL	Level 2	Flag indicates whether inputting text. Used by RETURN and RESUME NEXT commands.
40DEH ↳16606 ↳FLGINP	Model 1	Read flag: 0 = READ statement active 1 = INPUT statement active Also used in print using to hold separator between string and variable
40DEH ↳16606 ↳FLGINP	Level 2	Used for two different purposes: Flags whether READ or INPUT statement when processing those commands (zero represents INPUT). Also used to store delimiter character during processing of PRINT USING statement.
40DFH-40E0H ↳16607-16608 ↳TEMP	Model 1/3	Used by several routines, as a pointer to variable receiving new value during evaluation of a LET expression, execution address of BASIC program, etc. Also, after a SYSTEM tape is loaded these locations contain the entry point address of the program (which is used if only a `/` is typed in response to the next SYSTEM command prompt). Is in LSB, MSB order.
40DFH ↳16607 ↳TEMP	Model 1	Holds execution address for program loaded with DOS request
40DFH ↳16607		Default entry point for SYSTEM tapes.
40E1H ↳16609 ↳AUTFLG		AUTO command. 0 = AUTO numbering is off Any non-zero entry = Next line number
40E2H-40E3H ↳16610-16611 ↳AUTLIN	Level 2	Line Number: Current line number for the AUTO command. This number is stored in binary during the input phase.
40E4H ↳16612 ↳AUTINC		AUTO command increment value
40E6H-40E7H ↳16614-16615 ↳SAVTXT	Model 1/3	Pointer to terminator (end of line 00H byte or ":") of the last executed BASIC statement is at this address.
40E6H ↳16614 ↳SAVTXT	Model 1	During input: address of code string for current statement. During execution: line number for current statement
40E6H ↳16614		Pointer to terminator (end of line 00H byte or ":") of last executed BASIC statement is at this address.
40E8H-40E9H ↳16616-16617 ↳SAVSTK	Model 1/3	Pointer to the beginning of the STACK POINTER.
40E8H ↳16616 ↳SAVSTK	Model 1	During execution: holds stack pointer value when statement execution begins
40E8H ↳16616		Beginning of BASIC's stack.
40EAH-40EBH ↳16618-16619 ↳ERRLIN	Model 1/3	Line Number: The line number which generated an error. This is used for RESUME. If it is 65535, the error originated in command mode instead of in a program.
40EAH ↳16618 ↳ERRLIN	Model 1	Line number in which error occurred
40EAH ↳16618		Two byte address. Contains line number with error.
40ECH-40EDH ↳16620-16621 ↳DOT	Level 2	Stores the current line number. Can also be the Line Number for the EDIT command.
40ECH ↳16620		Two byte address. "." line number.
40EEH-40EFH ↳16622-16623 ↳ERRTXT	Level 2	Pointer to last byte executed when error occurred. Used by RESUME command.
40EEH ↳16622		Pointer to I/O buffer.
40F0H-40F1H ↳16624-16625 ↳ONELIN	Level 2	Line Number: ON ERROR location for ON ERROR GOTO. That means it is the line number which the error will jump to.
40F2H ↳16626 ↳ONEFLG		Flag to indicate whether an error has occurred. Set to -1 (FFH) on error, otherwise set to zero (such as after RESUME statement has been executed). POKEing the appropriate values into this location will allow you to do many things that BASIC normally does not permit, such as exiting an error trap without using a RESUME statement, or redefining the error trap (by using an ON ERROR GOTO statement) from within a previously defined error trap.
40F3H-40F4H ↳16627-16628 ↳TEMP2	Model 1	Address of decimal point in pbuff
40F5H-40F6H ↳16629-16630 ↳OLDLIN	Level 2	Last line number executed prior to execution of STOP or END statement or termination using the `BREAK` key.
40F7H-40F8H ↳16631-16632 ↳OLDTXT	Level 2	Pointer to end of last statement executed (points to the colon or zero byte terminator). Used by CONT command.
40F9H-40FAH ↳16633-16634 ↳VARTAB	Level 2	Starting address of the simple variables list table. This is also one higher than the last of the three zero bytes marking the end of the BASIC program. Used to determine end of BASIC program when saving the program. Note that by taking the address stored here, subtracting 2, and POKEing the resulting address into the start of BASIC program pointer at 40A4H-40A5H, then loading a program with higher line numbers than the one presently in memory, and finally re-POKEing the original values of 40A4H-40A5H back into those locations, it is possible to append a program to a program already in memory.
40FBH-40FCH ↳16635-16636 ↳ARYTAB	Model 1/3	Starting address of the ARRAY VARIABLE TABLE (end of simple variables)
40FDH-40FEH ↳16637-16638 ↳STREND	Model 1/3	Pointer to the END of array variables a/k/a start of free memory pointer in LSB, MSB order
40F0H ↳16624		Pointer to line of BASIC error handling.
40F2H ↳16626		Error flag.
40F5H ↳16629		Current line number.
40F9H ↳16633		End of BASIC program/ start of simple variable list pointer.
40FBH ↳16635		Start of arrays variables pointer.
40FDH ↳16637		End of arrays variables/ start of free memory pointer.
40FFH ↳16639		Two byte address. Current location of BASIC's DATA pointer.
40FFH-4100H ↳16639-16640 ↳DATPTR	Model 1/3	DATA Pointer (2 Byte Address; LSB, MSB). Points to comma or other terminator at end of last item read - search for next DATA item to be read will begin here. RESTORE changes this pointer to point to one byte prior to beginning of BASIC program. A selective RESTORE to some data item past the first can be accomplished by manipulating this pointer. For example, suppose that at some point in your program you will want to RESTORE to the 51st DATA item. At the start of your program you could insert a line similar to this: FOR X=1 TO 50 : READ X$ : NEXT R1=PEEK(16639): R2=PEEK(16640) : RESTORE Then, whenever you wanted to RESTORE to the 51st DATA item, you would simply execute the following statements: POKE 16639,R1: POKE 16640,R2 The next READ instruction would then get the 51st DATA item.
4101H-411AH ↳16641-16666 ↳DEFTBL	Model 1/3	Variable declaration list. There are 26 entries (1 for each letter of the alphabet). The location at 4101H applies to variables starting with the letter A, 4102H applies to variables starting with B, 4103H to variables starting with C and so on up to 411AH, which contains the default type for all variables starting with the letter Z. Each location contains one of the following values: 2 = Integer 3 = String 4 = Single precision 8 = Double precision When a variable name is used in a BASIC program and does not have a specific type declaration character (%, $, !, or #) following, its type defaults to the type specified in this table. All defaults are set to single-precision when a program is RUN, and may be changed through use of the DEFINT, DEFSTR, DEFSNG, or DEFDBL statements.
4101H ↳16641		Beginning of variable type table.
411AH ↳16666		End of variable type table.
411BH ↳16667		Trace flag.
411BH ↳16667 ↳TRCFLG	Model 1	TRON Trace flag 0 = Off (TROFF) Non-zero = On
411CH ↳16668 ↳DFACLO-1	Model 1	Temporary storage used by numeric routines when unpacking a floating point number. Usually it holds the last byte shifted out of the LSB position
411DH-4124H ↳16669-16676 ↳DFACLO	Model 1/3	Software Accumulator (SA) - 2 Bytes
411DH ↳16669 ↳DFACLO	Model 1	Work-Register-Area-1 - LSB of double precision value
411DH ↳16669		First byte of SA.
4124H ↳16676		Last byte of SA.
4127H ↳16679		First byte of SA1.
412EH ↳16686		Last byte of SA1.
4120H ↳16672 ↳FACLO-1	Model 1	Work-Register-Area-1 - double precision value
4121H-4122H ↳16673-16674 ↳FACLO	Model 1/3	Single precision number storage area for single precision math routines - 2 Bytes (4121H=MSB)
4123H-4124H ↳16675-16676 ↳FAC-1	Model 3	Single precision number storage area for single precision math routines - 2 Bytes (4123H=MSB)
4123H ↳16675 ↳FAC-1	Model 1	Work-Register-Area-1 - MSB for single precision
4124H ↳16676 ↳FAC	Model 1	Work-Register-Area-1 - exponent for single precision
4125H ↳16677 ↳FAC+1	Model 1	Sign of result during math & arithmetic operations
4126H ↳16678 ↳ARGLO-1	Model 1	Bit bucket used during double precision addition
4127H-412EH ↳16679-16686 ↳ARGLO a/k/a ARG-7	Model 1/3	Alternate Software Accumulator (SA1 or REG2) - 2 Bytes
4127H ↳16679 ↳ARGLO	Model 1	Work-Register-Area-2 - LSB
4128H ↳16680	Model 1	Work-Register-Area-2
4129H ↳16681	Model 1	Work-Register-Area-2
412AH ↳16682	Model 1	Work-Register-Area-2
412CH ↳16684	Model 1	Work-Register-Area-2
412DH ↳16685 ↳ARG-1	Model 1	Work-Register-Area-2 - MSB
412EH ↳16686 ↳ARG	Model 1	Alternate Software Accumulator - exponent
412FH ↳16687 ↳FBUFFR	Level 2 (Non-Disk)	Unused.
4130H-4149H ↳16688-16713 ↳FBUFFR+1	Level 2	Multipurpose Storage/Work Area. Buffer used to store result of conversion of numbers to displayable ASCII characters. When positive integers (BASIC line numbers, etc.) are converted, the area from 4130H to 4136H is used, and the string is stored right justified with leading spaces in locations 4130H to 4135H (4130H always contains a space character), while 4136H always contains a zero byte to terminate the string. Other routines (such as PRINT USING) may use more of this area.
414AH ↳16714 ↳FBUFFR+27	Model 3	Tape RAM - Workspace For Double Precision Division (8 Bytes). Basically, a temporary ACCUM sometimes used by arithmetic routines (such as to hold divisor used by double precision division routine).
414FH ↳16719 ↳FMLTT1	Model 1	Temporary Storage
4150H ↳16720 ↳FMLTT2	Model 1	Temporary Storage
4151H ↳16721 ↳FBUFFR+34	Model 1	End of temporary area. Locations 4152H through 41E2H contain DOS exits and disk BASIC exits. On non-disk systems these locations are initialized to RETurns (RET'S) while on disk based systems they will be initialized as shown.

4152H-41A6H - DISK BASIC entry points

Address (Hex/Dec/Label)	Model Code	Description
4152H ↳16722 ↳ERCALL	Model 1/3	Disk BASIC Vector: CVI vector (3 byte jump command to handler)
4155H ↳16725	Model 1/3	Disk BASIC Vector: FN vector (3 byte jump command to handler)
4158H ↳16728	Model 1/3	Disk BASIC Vector: CVS vector (3 byte jump command to handler)
415BH ↳16731	Model 1/3	Disk BASIC Vector: DEF vector (3 byte jump command to handler)
415EH ↳16734	Model 1/3	Disk BASIC Vector: CVD vector (3 byte jump command to handler)
415FH ↳16735	Model 1	Work-Register-Area-1 - double precision value
4160H ↳16736	Model 1	Disk basic exit (MKS$)
4161H ↳16737	Model 1/3	Disk BASIC Vector: EOF vector (3 byte jump command to handler)
4164H ↳16740	Model 1/3	Disk BASIC Vector: LOC vector (3 byte jump command to handler)
4167H ↳16743	Model 1/3	Disk BASIC Vector: LOF vector (3 byte jump command to handler)
416AH ↳16746	Model 3	Disk BASIC Vector: MKI$ vector (3 byte jump command to handler)
416DH ↳16749	Model 3	Disk BASIC Vector: MKS$ vector (3 byte jump command to handler)
4170H ↳16752	Model 1/3	Disk BASIC Vector: MKD$ vector (3 byte jump command to handler)
4173H ↳16755	Model 1/3	Disk BASIC Vector: CMD vector (3 byte jump command to handler)
4176H ↳16758	Model 1/3	Disk BASIC Vector: TIMES$ vector (3 byte jump command to handler)
4179H ↳16761	Model 1/3	Disk BASIC Vector: OPEN vector (3 byte jump command to handler)
417CH ↳16764	Model 1/3	Disk BASIC Vector: FIELD vector (3 byte jump command to handler)
417FH ↳16767	Model 1/3	Disk BASIC Vector: GET vector (3 byte jump command to handler)
4182H ↳16770	Model 1/3	Disk BASIC Vector: PUT vector (3 byte jump command to handler)
4185H ↳16773	Model 1/3	Disk BASIC Vector: CLOSE vector (3 byte jump command to handler)
4188H ↳16776	Model 1/3	Disk BASIC Vector: LOAD vector (3 byte jump command to handler)
418BH ↳16779	Model 1/3	Disk BASIC Vector: MERGE vector (3 byte jump command to handler)
418EH ↳16782	Model 1/3	Disk BASIC Vector: NAME vector (3 byte jump command to handler)
4191H ↳16785	Model 1/3	Disk BASIC Vector: KILL vector (3 byte jump command to handler)
4194H ↳16788	Model 1/3	Disk BASIC Vector: & vector (3 byte jump command to handler)
4197H ↳16791	Model 1/3	Disk BASIC Vector: LSET vector (3 byte jump command to handler)
419AH ↳16794	Model 1/3	Disk BASIC Vector: RSET vector (3 byte jump command to handler)
419DH ↳16797	Model 1/3	Disk BASIC Vector: INSTR vector (3 byte jump command to handler)
41A0H ↳16800	Model 1/3	Disk BASIC Vector: SAVE vector (3 byte jump command to handler)
41A3H ↳16803	Model 1/3	Disk BASIC Vector: LINE vector (3 byte jump command to handler)
41A6H ↳16806 ↳RETCNT		ERROR Error processing jumps to this three byte vector. In cassette BASIC it contains RET instruction, in Disk BASIC, contains a jump (through RST) to display long error messages.
41A6H ↳16806		ERROR Error processing jumps to this 3-byte vector. In cassette BASIC it contains RET instruction; in Disk BASIC, contains a jump (through RST) to long error message
41A6H ↳16806 ↳RETCNT	Model 1	Disk basic exit (USR) the following addresses are the DOS exit addresses.
41A9H ↳16809		USR 3 byte vector.
41A9H ↳16809	Model 1/3	DOS Link For USR N (3 byte vector) which is used to expand function to provide up to ten USR calls. If you want to knock out all uses of USR in a BASIC program, POKE 16809,215:POKE 16810,216:POKE 16811,43:POKE 16812,201 to load this with RST 10, RET C, DEC HL, RET. To be super sure, also then POKE 16527,65:POKE 16526,171 which will point to the RET.
41ACH ↳16812		Ready prompt
41ACH ↳16812	Model 1	DOS exit from 1A1C
41ACH ↳16812		Ready prompt
41ACH ↳16812	Model 3	Tape RAM - DOS Links: Link For Ready
41AFH ↳16815		Called from 0368H to input line from keyboard to I/O buffer.
41AFH ↳16815	Model 1	DOS exit from 0368
41AFH ↳16815		Called from 0368H to input line from keyboard to I/O buffer. Inputs a line from the keyboard into the I/O buffer (zeroes INKEY$ buffer and video tab position indicator prior to call).
41AFH ↳16815	Model 3	Tape RAM - DOS Links: Link For INKEY$
41B2H ↳16818		Called from 1AA1H immediately after BASIC line is tokenized. HL points to tokenized line.
41B2H ↳16818	Model 1	DOS exit from ROM address 1AA1
41B2H ↳16818	Model 3	Called from 1AA1H immediately after BASIC line is tokenized. HL points to tokenized line.
41B5H ↳16821		Called from 1AECH immediately after BASIC's table of program lines are updated. After call to 41B5H, BASIC calls CLEAR routine at 1B5DH then calls this DOS exit from 1AF2H
41B5H ↳16821	Model 1	DOS exit from ROM address 1AEC
41B5H ↳16821	Model 3	Called from 1AECH immediately after BASIC's table of program lines are updated (insertion or replacement of a BASIC line). After call to 41B5H, BASIC calls CLEAR routine at 1B5DH then calls this DOS exit from 1AF2H
41B8H ↳16824	Model 1	DOS exit from ROM address 1AF2
41B8H ↳16824	Model 3	Called at 1AF2H, after above call followed by call to 1B5DH (CLEAR command, leaves HL pointing to start of BASIC program -1).
41BBH ↳16827	Model 1	DOS exit from ROM address 1B8C
41BBH ↳16827	Model 3	Called from 1B8CH and 1DB0H during NEW and END processing to allow Disk Basic to close any open files.
41BBH ↳16827		Called from 1B8CH and 1DB0H during NEW and END processing to allow Disk Basic to close open files.
41BEH ↳16830		PRINT# processing called from 2174H
41BEH-41C0H ↳16830-16832	Level 2	(L2 only) Jumps here on `RESET` button hit. You can put your own 3 byte instruction here to jump to your own routine.
41BEH ↳16830	Model 1	DOS exit from ROM address 2174
41BEH ↳16830	Model 3	Called at 2174H, at termination of PRINT statement (used to terminate output to disk using PRINT# statement).
41C1H ↳16833		Byte output to any device. Called from 032CH so output to disk can be handled as to other devices.
41C1H ↳16833	Model 1	DOS exit from ROM address 032C
41C1H ↳16833	Model 3	Byte output to any device. Called from 032CH so output to disk can be handled as to other devices.
41C4H ↳16836		ROM KB scan (0358H) calls this exit. BASIC processes INKEY$ here and also after each command when system searches for `BREAK` or `SHIFT`+`@`.
41C4H ↳16836	Model 1	DOS exit from ROM address 0358
41C4H ↳16836	Model 3	ROM KB scan (0358H) calls this exit. BASIC processes INKEY$ here and also after each command when system searches for `BREAK` or `SHIFT`+`@`.
41C7H ↳16839		Called from 1EA6H when RUN is followed by filename or line number
41C7H ↳16839	Model 1	DOS exit from ROM address 1EA6
41C7H ↳16839	Model 3	Called from 1EA6H when RUN is followed by filename or line number
41CAH ↳16842		Related to 41BEH above. Called at Beginning of print processing from 206FH to check for possible disk output.
41CAH ↳16842	Model 1	DOS exit from ROM address 206F
41CAH ↳16842	Model 3	Related to 41BEH above. Called at Beginning of print processing from 206FH to check for possible disk output (i.e., PRINT# ).
41CDH ↳16845		Called from 20C6H. Call made during print processing after number is in ASCII and just before printing. Could be used for Hex and Binary printing.
41CDH ↳16845	Model 1	DOS exit from ROM address 2103
41CDH ↳16845	Model 3	Called from 20C6H. Call is made during print processing after number is in ASCII and just before printing. Could be used for Hex and Binary printing.
41D0H ↳16848		Called from 2103H (from PRINT routine after code that send CR.) Could be used for screen wrap-around.
41D0H ↳16848	Model 1	DOS exit from ROM address 2103
41D0H ↳16848	Model 3	Called from 2103H (from PRINT routine after code that send CR.) Could be used for screen wrap-around.
41D3H ↳16851		Called from 2108H and 2141H. First is for printing with comma tabs, second is for printing with TAB statement. Could be used to increase length of original tabs from 63 or 127 up to 255.
41D3H ↳16851	Model 1	DOS exit from ROM address 2108
41D3H ↳16851	Model 3	Called at 2108H (from PRINT command when a comma is used to separate items to be printed) and at 2141H (from PRINT command routine when the TAB function is used, after the TAB argument has been evaluated and placed in the E register. It is worth noting that the original argument (if within the range 0-255) is still stored as an integer in ACCUM, with the NTF set to 2, indicating an integer (when this vector is called from the comma separator routine the NTF will normally be set to 3, indicating a string).
41D6H ↳16854	Model 1	DOS exit from ROM address 219E
41D6H ↳16854	Model 3	INPUT# processing. Called from 219EH to check for INPUT# command and to provide input from disk.
41D6H ↳16854		INPUT# processing. Called from 219EH to check for INPUT# command and to provide input from disk.
41D9H ↳16857		Left side of MID$ processing. Only DOS exit BASIC jumps to instead of calls. Used to allow MID$ on left side of equals sign.
41D9H ↳16857	Model 3	The Disk BASIC routine that permits MID$ to be on the left side of an "=". FTI this is the only DOS exit BASIC jumps to instead of calls.
41DCH ↳16860		Variables assignment. During processing of READ & INPUT statements, after computer receives value and before assigned to variable, BASIC calls this exit from 222DH.
41DCH ↳16860	Model 1	DOS exit from ROM address 222D
41DCH ↳16860	Model 3	Called at 222DH. Part of READ / INPUT command routine, called just prior to assigning data that has been read or INPUT to variable. After computer receives value and before assigned to variable, BASIC calls this exit from 222DH.
41DFH ↳16863		Called twice from BASIC: From 2278H after BASIC assigns input value to variable and just before BASIC searches for extra data that will generate "Extra ignored" message, and from 2B44H from the midst of list processing. Could be used to alter list command.
41DFH ↳16863	Model 1	DOS exit from ROM address 2278
41DFH ↳16863		Called twice from BASIC: From 2278H after BASIC assigns input value to variable and just before BASIC searches for extra data that will generate "Extra ignored" message, and from 2B44H from the midst of list processing. Could be used to alter list command.
41E2H ↳16866		SYSTEM command processing. Called from 02B2 just before "*?" prompt. A system tape will automatically start if a jump to its starting address is placed here. Keep in mind this is a 3 byte location. The first byte should be C3H which is the code for "JP" and should be followed by the starting address of your program.
41E2H ↳16866	Model 1	DOS exit from ROM address 0282
41E2H ↳16866	Model 3	SYSTEM command processing. Called from 02B2 just before "*?" prompt. A system tape will automatically start if a jump to its starting address is placed here. Keep in mind this is a 3 byte location. The first byte should be C3H which is the code for "JP" and should be followed by the starting address of your program.
41E5H-41FCH ↳16869-16892 ↳BUFINI-3	Model 3 ONLY	Device Control Blocks for RS-232-C Input, Output, and Initialization.
41E5H-42E8H ↳16869-17128 ↳BUFINI-3	Model I ONLY	Addresses 41E5H-41E7H are initialized by ROM code at 0080H-0089H to contain the bytes 3AH, 0, and 2CH (a colon, zero byte, and comma). The BASIC input/output buffer (also used while encoding and decoding BASIC lines) begins one byte higher (41E8H) and is defined by a continuation of the above mentioned ROM code (008AH - 008DH), which initializes the buffer pointer at 40A7H-40A8H. The buffer is exactly 256 (100H) bytes long, and is immediately followed by a byte that is always zero, and marks the end of reserved RAM (42E8H).
41E5H ↳16869 ↳BUFINI-3	Model 3	Tape RAM - RS-232 Input DCB: Type = 1 = Read Only
41E6H-41E7H ↳16870-16871	Model 3	Tape RAM - RS-232 Input DCB: 2 Byte Driver Address (301EH)
41E8H ↳16872		$RSRCV input buffer (1 byte)
41E8H ↳16872 ↳BUFINI	Model 1/3	Tape RAM - RS-232 Input DCB: RS-232 Input Buffer (1 Character)
41E9H ↳16873	Model 3	Tape RAM - RS-232 Input DCB: Bit 2 = Driver On/off Bit 1 = Wait/no Wait
41EAH ↳16874	Model 3	This sits in the RS-232 INPUT DCB, but I have no idea what it does and what uses it
41EBH, 41ECH, and 41F3H ↳16875, 16876 and 16883	4 in 3 Mode	ASCII character that will be returned when `F1`, `F2`, or `F3` key is depressed. Normally set to 60H ( `SHIFT`+`@`) during BASIC initialization, but the character stored at this location may be changed, so that any desired character may be returned when the appropriate function key is pressed.
41EBH-41ECH ↳16875-16876	Model 3	The "RI" device name.
41EDH ↳16877	Model 3	Tape RAM - RS-232 Output DCB: Type = 2 = Write Only
41EEH ↳16878	Model 3	Tape RAM - RS-232 Output DCB: 2 Byte Driver Address (3021H)
41F0H ↳16880 ↳RSTX	Model 1/3	RS-232 Output DCB: Output Buffer (1 Character)
41F0H ↳16880		$RSTX output buffer (1 byte)
41F1H ↳16881	Model 3	Tape RAM - RS-232 Output DCB: Bit 2 = Driver On/off Bit 1 = Wait/no Wait
41F2H ↳16882	Model 3	This sits in the RS-232 OUTPUT DCB, but I have no idea what it does and what uses it
41F3H-41F4H ↳16883-16884	Model 3	The "RO" device name.
41F4H ↳16884	Model 1/3	Value 103 – 1st of 2 to Change LINE keyword to act as LPRINT
41F4H ↳16884	4 in 3 Mode	Storage location for keyboard scan routine. The contents of the keyboard "row" at 3880H is stored here. Bit 0: `LEFT SHIFT` Bit 1: `RIGHT SHIFT`: Bit 2: `CONTROL` Bit 3: `Caps` Bit 4: `F1` Bit 4: `F1` Bit 5: `F2` Bit 6: `F3` Bit 7: Unused
41F5H ↳16885	Model 1/3	Value 32 2nd of 2 to Change LINE keyword to act as LPRINT
41F5H ↳16885	Model 3	Tape RAM - RS-232 Initialization DCB: Type = 2 = Write Only
41F6H-41F7H ↳16886-16887	Model 3	Tape RAM - RS-232 Initialization DCB: 2 Byte Driver Address (301BH)
41F8H ↳16888 ↳BUFINI+20	Model 1/3, Model 3	$RSINIT: Baud Rate Code. Bits 7-4=Transmit Baud, Bits 3-0=Received Baud. These two tend to be the same so they range from 00H-EEH for 50 (00H), 75 (11H), 110 (22H), 134.5 (33H), 150 (44H), 300 (55H), 600 (66H), 1200 (77H), 1800 (88H), 2000 (99H), 2400 (AAH), 3600 (BBH), 4800 (CCH), 7200 (DDH), 9600 (EEH)
41F8H ↳16888		$RSINIT baud rate code. TX code = most sig. nibble, RCV code = least significant nibble.
41F9H ↳16889	Model 1/3	Tape RAM - RS-232 Initialization DCB - $RSINIT: Parity/Word Length/Stop-Bit code. Default is 108.
41F9H ↳16889	Model 3	RS-232 Configuration Byte. Bit 0=Data Transmit Ready (always 0), Bit 1=Ready to Send (always 0), Bit 2=Transmit Enable/Disable (1=Enable, 0=Disable), Bit 3=Parity Enable (1=Parity Enable, 0=No Parity), Bit 4=Stop Bits (1=2 Stop Bits, 0=1 Stop Bit), Bits 6-5=Word Length (00=5, 01=6, 10=7, 11=8), Bit 7=Parity Odd/Even (1=Odd, 0=Even)
41F9H ↳16889		$RSINIT parity/word/length stop-bit code
41FAH ↳16890	Model 1/3	$RSINIT: Wait Switch 0 = wait Not 0 = no wait
41FAH ↳16890		$RSINIT wait switch (0 = wait, Not 0 = no wait)
41FBH-41FCH ↳16891-16892	Model 3	The "RN" device name.
41FDH ↳16893	Model 3 Only	Used by repeating key routine. Saves LSB of keyboard buffer pointer (buffer at 4036H-403CH) when key is found depressed.
41FEH ↳16894	Model 3 Only	Used by repeating key routine. Saves contents of current keyboard "row" when key is found depressed.
41FFH-4200H ↳16895-16896	Model 3 ONLY	Used by repeating key routine. Holds maximum repeat delay count (1500 decimal or 5DCH for first repeat delay, 150 decimal or 96H for subsequent repeats of same character).
4200H-51FFH ↳16896-20991 ↳MEM$	Level 2	TRSDOS v2.3 4200H-42FFH - This is where the LEVEL II ROM dumps Drive 0, Track 0, Sector 0. The ROM routine which does this is located at 06B6H-06CBH. 4D00H-4DFFH - This is where BOOT/SYS loads SYS0/SYS. 4E00H, TRSDOS v2.3 disables interrupts, selects Interrupt Mode 1, and sets the utility load address to 5200H. 4E0FH-4E1BH - Calculate how much RAM is present and puts that in 4049H. 4E20H-4E55H - Initialize the device address table (43B8-43BF) and the device mnemonic table (43C0-43CC). These tables are used by the DEVICE command.
4200H-42FFH ↳16896-17151	Model 1	System Sector Buffer Area
4201H-4202H ↳16897-16898	Model 3 ONLY	Used by repeating key routine. Holds current repeat delay count, which is compared with value at 41FFH-4200H to determine if it is time to repeat the character.
4203H-4205H ↳16899-16901	Model 3 ONLY	Three byte BREAK key vector used when BREAK is pressed during cassette tape or RS-232-C operations. Initialized to contain a jump to 022EH, which in turn contains EI and JP 1A19H instructions.
4206H-4208H ↳16902-16904	Model 3 ONLY	Three byte vector services interrupt # 4. Under non-disk systems contains a jump to 35FAH, which in turn contains a "RET" instruction.
4209H ↳16905	L3	Checks for drive and mounted disk.
4209H-420BH ↳16905-16907	Model 3 ONLY	Three byte vector services interrupt # 5. Under non-disk systems contains a jump to 35FAH, which in turn contains a "RET" instruction.
420CH-420DH ↳16908-16909	Model 3 ONLY	Pointer to "write byte to cassette" routine. Initialized by "write cassette leader" routine, normally contains address of either 500 baud (3241H) or 1500 baud (32BAH) byte output routine.
420EH-420FH ↳16910-16911	Model 3 ONLY	Pointer to "read byte from cassette" routine. Initialized by "read cassette leader" routine, normally contains address of either 500 baud (3203H) or 1500 baud (32CAH) byte input routine.
4210H ↳16912	Model 3 ONLY	A flag byte used by the BASIC interpreter, this location contains the CURRENT PORT 0ECH OUTPUT BITS, which are organized as follows: BIT 6: Enables fast clock speed if set on Model 4 ONLY BIT 5: Disables video wait states if set (not used on Model 4). BIT 4: Enables I/O bus if set BIT 3: Japanese Kana character set used as "special" characters if set BIT 2: Select video 32 character mode if set BIT 1: Turns on cassette tape relay if set BIT 0: Enables clock display on video if set Programmers that attempt to output to port ECH should be aware that at various points in the BASIC interpreter ( such as when returning to BASIC "READY", doing tape I/O, etc.) some or all of the bits stored here may be output to port ECH, thereby canceling the previous status of port ECH. Also, it must once again be noted that in all current editions of the Model 3 ROM, an error exists in that the test for double-width characters at 0348H has not been changed to test the flag at 4210H rather than the flag at 403DH. This can cause serious problems when attempting to make use of the 32-character mode on the Models III and 4.
4210H ↳16912	Model 3 ONLY	Port ECH Bit Mask: Bit 1: Cass motor [0 = on, 1 = off] Bit 2: Double width [0 = normal, 1 = double] Bit 3: Alt. char. [0 = disable, 1 = enable] Bit 4: I/O bus [0 = disable, 1 = enable] - Model 4 ONLY Bit 5: Video waits [0 = disable, 1 = enable] - Model 4 ONLY Bit 6: CPU clock speed [0 = 2 MHz, 1 = 4 MHz] - Model 4 ONLY Bit 7: not used
4211H ↳16913	Model 3 ONLY	Cassette Info: Cassette Baud Rate Select (0 = 500 baud, Not 0 = 1500 baud)
4212H ↳16914	Model 3 ONLY	Cassette Info: Cassette Blinker Counter. Each time a byte is read from tape, this counter is incremented and ANDed with 5FH. If the result is zero, the status of the asterisk in the upper right corner of the video display is reversed (turned on if it was off, or off if it was on).
4213H ↳16915	Model 3 ONLY	Cassette Info: Default Interrupt Vector Setting. This byte is output to port E0H (the maskable interrupt latch) whenever the "turn off cassette" routine is executed.
4214H ↳16916	Model 3 ONLY	Video display scroll protect: # Video Lines To Protect (0-7). Default is 0. Only the lowest three bits are used (byte is ANDed with 7 to determine number of protected lines).
4214H ↳16916		Video display scroll protect (range = 0 - 7)
4215H ↳16917	Model 3 ONLY	Unused In non-Disk System
4216H ↳16918	Model 3 ONLY	Tape RAM - Clock Data: Heartbeat Counter
4217H ↳16919	Model 3 ONLY	Tape RAM - Clock Data: Seconds (Value: 00-59). You can POKE to change.
4217H ↳16919		Model 3 time. Contains time in binary format.
4218H ↳16920	Model 3 ONLY	Tape RAM - Clock Data: Minutes (Value: 00-59). You can POKE to change.
4219H ↳16921	Model 3 ONLY	Tape RAM - Clock Data: Hours (Value: 00-23). You can POKE to change.
421AH ↳16922	Model 3 ONLY	Tape RAM - Clock Data: Year (Value: 00-99). You can POKE to change.
421AH ↳16922		Model 3 date. Contains date in binary format.
421BH ↳16923	Model 3 ONLY	Tape RAM - Clock Data: Day (Value: 01-31). You can POKE to change.
421CH ↳16924	Model 3 ONLY	Tape RAM - Clock Data: Month (Value: 01-12). You can POKE to change.
421DH ↳16925	Model 3	Tape RAM - I/O Router DCB: Type = 2 = Write Only
421EH ↳16926	Model 3	Tape RAM - I/O Router DCB: Driver Address (3739H)
4220H-4221H ↳16928-16929	Model 1/3	$ROUTE: Destination Device Name for ROUTE Routine. 2 Bytes
4220H ↳16928		$ROUTE destination device (two bytes)
4222H-4223H ↳16930-16931	Model 3	Tape RAM - I/O Router DCB: Source Device Name. 2 Bytes.
4222H ↳16930		$ROUTE source device (two bytes)
4224H ↳16932	Model 3 ONLY	Control key flag used by keyboard driver routine. Contains 1FH if control key sequence (`LEFT SHIFT` and `DOWN-ARROW` keys was pressed), else contains FFH. Can be tested to determine how certain control codes were produced ( for example, whether a carriage return character was produced by pressing the `ENTER` key, or through the use of the Control-M sequence).
4225H ↳16933	Model 3 Cassette	Undefined, except that the SYSTEM command places its Stack Pointer within this area, at 4288H.
4225H ↳16933	Model 3, L3, Model 3	DOS command buffer.
4271H ↳17009	Model 3 TRSDOS	ASCII-coded drive number "0," "1," "2," or "3" for use with the Display Short Directory routine.
4288H ↳17032	L3	33.33 ms heartbeat counter.
4288H ↳17032 ↳BUFINI+160	Model 3 Cassette	Presumed starting location for a SYSTEM command.
428AH ↳17034	L3	Send message to Job Log and CRT.
428DH ↳17037	Model 3, Model 3	Find drive and file number for open file. For L3, send message to Job Log.
4290H ↳17040	Model 3, L3, Model 3	Copy directory to RAM buffer.
4293H ↳17043		Get file name from directory.
4296H ↳17046	L3	Execute DOS command and return to DOS ready.
4299H ↳17049	Model 3	Do DOS command and return to DOS ready. L3: returns to caller is @EXIT and @ABORT vectors change to jump to return address.
429CH ↳17052	Model 3	Do DOS command and return to caller.
42ADH ↳17069	Model 3	Contains address of break key routine.
42B3H ↳17075	Model 3	Which disk drive is the master drive number.
42B4H ↳17076	Model 3	This is the CLEAR RAM flag.
42E5H-43E8H ↳17125-17384	Model 3 ONLY	Addresses 42E5H-42E7H are initialized by ROM code at 0080H-0089H to contain the bytes 3AH, 0, and 2CH (a colon, zero byte, and comma). The BASIC input/output buffer (also used while encoding and decoding BASIC lines) begins one byte higher (42E8H) and is defined by a continuation of the above mentioned ROM code (008AH - 008DH), which initializes the buffer pointer at 40A7H-40A8H. The buffer is exactly 256 (100H) bytes long, and is immediately followed by a byte that is always zero, and marks the end of reserved RAM (43E8H).
42E8H ↳17128 ↳ENBINI, TSTACK	Model 1	Always Zero
42E9H ↳17129	Model 1/3 (Non-DOS)	Start of user RAM for program storage. Fills down from this memory address in the following order: Program Text, Simple Variables, Arrays, String Variable Names and Overhead, Free Memory.
42FFH ↳17151	Model 3	Protection Override Flag (If Bit 0 is set, password checking is disabled).
4300H ↳17152	Model 1	Used by TRSDOS 2.3 to store the last track addressed on Drive 0
4301H ↳17153	Model 1	Used by TRSDOS 2.3 to store the last track addressed on Drive 1
4302H ↳17154	Model 1	Used by TRSDOS 2.3 to store the last track addressed on Drive 2
4303H ↳17155	Model 1	Used by TRSDOS 2.3 to store the last track addressed on Drive 3
4304H ↳17156	Model 1	Used by TRSDOS 2.3 to store the directory Track for Drive 0
4305H ↳17157	Model 1	Used by TRSDOS 2.3 to store the directory Track for Drive 1
4306H ↳17158	Model 1	Used by TRSDOS 2.3 to store the directory Track for Drive 2
4307H ↳17159	Model 1	Used by TRSDOS 2.3 to store the directory Track for Drive 3
4308H ↳17160	Model 1	Used by TRSDOS 2.3 to store the last disk drive accessed
4309H ↳17161	Model 1	Used by TRSDOS 2.3 to store the last unit mask for the last drive selected
430AH-430CH ↳17162-17164	Model 1	Used by TRSDOS 2.3 to store the DCB/Buffer address, current operation
430CH-430DH ↳17164-17165	Model 1	Used by TRSDOS 2.3 to store the DCB address for the current operation
430EH ↳17166	Model 1	Used by TRSDOS 2.3 to store the last Overlay Load Request
430FH ↳17167 ↳XMODE	Model 1	Used by TRSDOS 2.3 to track certain system conditions. If Bit 4 is set, then SYS6/SYS is loaded in RAM (and can be called by RST 28H). If Bit 5 is set, then CHAINING is in effect. If Bit 7 is set, then DEBUG was set to active.
4312H ↳17170	ND1, Model 1	Break Key Vector 195=Off 201=On
4313H ↳17171 ↳XFCN	ND1, Model 1	This is in the middle of a JP nnnn command and the Jump Vector will be put here
4315H ↳17173 ↳XPROT	ND1, Model 1, Model 1	This is an OPCODE and can be swapped to RET or JUMP based on a CMD"S" or CMD"A" command
4318H ↳17176	Model 1, L1, Model 1	DOS command buffer. Contains the last DOS command entered. Maximum of 64 Characters.
4396H ↳17302	L1	Read directory into memory.
43E9H- ↳17385-	Model 3	RAM - BASIC PROGRAM IN A CASSETTE SYSTEM
4400H ↳17408		CMD is a routine that accepts a new command to be evaluated. To Use: CALL 4400H
4400H ↳17408	L1, Model 1/3, N1, N3, Model 1/3	Same as 402D: return to DOS ready.
4402H ↳17410		Send text to file or device.
4405H ↳17413		CMNDI is the entry into the command interpreter. To use, the following 3 lines are necessary only if this is called at the end of BASIC program. LD HL,402D ;DOS return address LD (41FAH),HL LD SP,41FAH ;reset stack pointer for DOS Your ASCII DOS command should be in the command buffer terminated by a carriage return. To Use: LD HL,4318H ;DOS command buffer JP 4405H ;if from BASIC CALL 4405H ;else this way
4405H ↳17413	L1, Model 1/3, N1, N3, Model 1/3	Do DOS command and return to DOS ready.
4409H ↳17417		Display error message on CRT.
440DH ↳17421	L1, L3, Model 1/3, N1, N3, Model 1/3	Enter Debug.
4410H ↳17424	L1, Model 1, N1, Model 1	Add task to interrupt chain.
4411H-4412H ↳17425-17426	Model 3	MEMORY SIZE Model 3 DISK BASIC
4411H ↳17425		Address of highest available memory location (Model 3 disk only - Model 1 disk = 4049H)
4413H ↳17427	L1, Model 1, N1, N3, Model 1	Remove task from interrupt chain. For Model 3, add task to interrupt chain.
4413H ↳17427	Model 3	Highest Disk Drive attached to the system.
4414H ↳17428 ↳TSTACK+300	Model 3	System OVERLAY number Currently in RAM.
4415H ↳17429	Model 3	Second copy of high memory address. Copied to 4411H in case of I/O error during DO processing.
4416H ↳17430	L1, Model 1	Change entry address of task in interrupt chain. Model 3: Remove task from interrupt chain. N1, N3: Keep drives rotating and reselect current drive.
4417H ↳17431	L3	Contains current day in coded format.
4419H ↳17433	Model 3, L3	Write disk directory to screen or buffer. N1, N3: Execute DOS command and return to caller.
441CH ↳17436		FSPEC fetches a file specification in TRSDOS standard format. To Use: CALL 441CH
441CH ↳17436	Model 3, L1, L3, Model 1/3, N1, N3, Model 1/3	Move filespec to FCB.
441FH ↳17439	Model 3 Disk	OSVER$: Holds the DOS Version Number. Stored in DCB format. Note on a Model 1 this is stored in 403EH and on the Model 4 at 0085H
4420H ↳17440		INIT creates a new file in the directory and opens the DCB for this file. If the filespec name is found then the file is simply opened for use, else a new file is created first. To Use: LD HL,BUFFER LD DE,DCB LD B,LRL CALL 4420H JP Z,OK ;no error JP C,NEWFIL ;no error, but new file was created ;A= TRSDOS error code
4420H ↳17440	All	Open or create a file.
4424H ↳17444	All	OPEN opens the DCB of an existing file. To Use: LD HL,BUFFER LD DE,DCB LD B,LRL CALL 4424H JP Z,OK ;no error JP NZ,NOFILE ;file does not exist ;A= TRSDOS error code
4428H ↳17448	All	CLOSE: Closes a file. Updates the directory and then closes the file from any more processing. To Use: LD DE,DCB CALL 4428H JP Z,OK ;no error ;A= TRSDOS error code
442CH ↳17452	All	KILL: Remove a file from a directory. Deletes the directory for an open file and then closes the DCB. To Use: LD DE,DCB CALL 442CH JP Z,OK ;no error ;A= TRSDOS error code
442FH ↳17455	Model 3	DUAL/ROUTE Flag. 80H=ROUTE is ACTIVE, FFH=DUAL is ACTIVE, 00H=Neither is active.
4430H ↳17456	All	(undocumented in Model 1) Load and Execute a Model I Program into Memory. Can be used with CALL 4430H.
4433H ↳17459	All	(undocumented in Model 1) Load and Execute a Model I Program. Can be used with JP 4433H.
4436H ↳17462	All	Read logical record into memory. This will transfer one logical or physical disk record into memory. To access: LD HL,urec LD DE,dcb CALL 4436H JP Z,ok ;No error If there is an error, Register A will contain the TRSDOS Error Code.
4439H ↳17465	All	Write logical record to disk. This will transfer one logical or physical disk record from memory. To access: LD HL,UREC LD DE,DCB CALL 4439H JP Z,ok ;No error If there is an error, Register A will contain the TRSDOS Error Code.
443CH ↳17468		VERF is the same as WRITE except that it verifies what was written to disk. To use: LD HL,UREC LD DE,DCB CALL 443C BP Z,OK ;No error If there is an error, Register A will contain the TRSDOS Error Code.
443CH ↳17468	All	Write record and verify.
443FH ↳17471	Model 3, L1, L3, Model 1/3, N1, N3, Model 1/3	Point to first record in file.
4442H ↳17474		POSN positions a file to read or WRITE a randomly selected logical record. To use: LD DE,DCB LD BC,nnnn ;logical rec'd # to position for CALL 4442H JP Z,OK ;no error ;A= TRSDOS error code
4442H ↳17474	All	Position file to specified record.
4445H ↳17477	Model 3, L1, L3, Model 1/3, N1, N3, Model 1/3	Backspace file one record.
4448H ↳17480	Model 3, L1, L3, Model 1/3, N1, N3, Model 1/3	Position to end of file.
444BH ↳17483	Model 3, L3, Model 3, Model 3	Add extension to filespec in FCB (see also 4473). L1: Check for end of file. Model 1: Multiply 16 bit by 8 bit integer. N1, N3: Allocate disk space to file.
444DH ↳17485	Model 3	[This is the start of RAM for a Model 3 as far as the memory test goes].
444EH ↳17486	Model 3, L3, Model 3	Multiply 16 bit by 8 bit integer. L1: Update directory with current record as end of file. Model 1: Divide 16 bit by 8 bit integer. N1, N3: Position file to specified byte record.
4451H ↳17489	Model 3, L3, Model 3	Divide 16 bit by 8 bit integer. Model 1: Check for end of file. N1, N3: Update directory with record as end of file.
4454H ↳17492	L1	Read current sector. L3, Model 3, Model 3: Parse parameters in command line. Model 1: Find drive and file number of a file.
4457H ↳17495	L1	Rewrite current sector. Model 3: Check for end of file. Model 1: Read directory to user buffer.
4458H ↳17496	L3	Check for end of file.
445AH ↳17498	L1	Calculate current logical record number. Model 1/3: Display directory on CRT.
445BH ↳17499	L3	Update directory with current record as end of file. N1, N3: Select and power up specified drive.
445DH ↳17501	L1	Calculate EOF record number.
445EH ↳17502	L3	Reread current sector. N1, N3: Test drive and disk.
4460H ↳17504	L1	Skip next logical record.
4461H ↳17505	L3	Rewrite current sector. N1, N3: Add user routine to DOS library chain.
4462H ↳17506	Model 1/3	Send text to printer.
4463H ↳17507	L1	Read directory to buffer or CRT.
4464H ↳17508	L3	Skip next logical record. N1, N3: Remove user routine from DOS library chain.
4467H ↳17511	L1, L3, Model 1/3, N1, N3, Model 1/3	Display text on CRT.
446AH ↳17514	L1, L3, N1, N3, Model 1/3	Send text to printer.
446DH ↳17517		TIME will return the current time in ASCII. To use: LD HL,nnnn ;address of 8 byte buffer CALL 446DH ;put time in buffer
446DH ↳17517	Model 1, L1, Model 1/3, N1, N3, Model 1	Get time in ASCII format. L3: Calculate current logical record number.
4470H ↳17520		DATE will return the current date in ASCII. To use: LD HL,nnnn ;address of 8 byte buffer CALL 4470H ;put date in buffer
4470H ↳17520	L3	Calculate end of file record number.
4473H ↳17523	L3	Holds image of interrupt latch. Model 1, L1, Model 1/3, N1, N3, Model 1/3: Add default extension to filespec in FCB. (See also 444BH)
4476H ↳17526	L1, Model 1, Model 1/3	Parse parameters in command line.
4478H ↳17528		NewDOS/80 v2.0 for Model 3 Break Vector (195=Off, 201=On).
4478H ↳17528	Model 1	MODEL 3 NEWDOS/80 V2.0 BREAK VECTOR – 195=OFF, 201=ON
447BH ↳17531	L1	Send text to job log and CRT. N3: Add task interrupt chain.
447CH ↳17532	Model 1/3	Compare filespec to wildcard mask.
447EH ↳17534	L1	Send text to joblog.
447FH ↳17535	Model 1/3	Get device number for file or I/O device.
4480H ↳17536	Model 1	System DCB Address for TRSDOS v2.3
4482H ↳17538	Model 1/3	Sort block of memory.
4485H ↳17541	Model 1	10 disk I/O functions depending on value in A.
4488H ↳17544	Model 3	10 disk I/O functions depending on value in A. Model 1: Locate device control block for any device.
448BH ↳17547	Model 1	Locate drive control table for any drive.
44A0H ↳17568	Model 3	Locate device control block for any device.
44A3H ↳17571	Model 3	Locate drive control table for any drive.
44B8H ↳17592	L1	Check drive and disk.
44BBH ↳17595	L1	Get file name from directory.
44C1H ↳17601	L1	Multiply 16 bit by 8 bit integer.
44C4H ↳17604	L1	Divide 16 bit by 8 bit integer.
44D2H ↳17618	Model 3	Add task to interrupt chain.
44D5H ↳17621	Model 3	Remove task from interrupt chain.
44D8H ↳17624	Model 3	Change execution address of task in interrupt chain.
44DBH ↳17627	Model 3	Set task pointer to default of RET.
44DEH ↳17630	Model 1/3	Verify a sector without reading to RAM.
44E1H ↳17633	Model 1/3	Read sector.
44E4H ↳17636	Model 1/3	Write sector.
44E8H ↳17640	Model 1/3	Read directory sector.
44EBH ↳17643	Model 1/3	Write directory sector.
44EEH ↳17646	Model 1/3	Read directory.
44F1H ↳17649	Model 1/3	Write directory.
44F4H ↳17652	Model 1/3	User function.
44F7H ↳17655	Model 1/3	Get directory track number.
4500H-4517H ↳17664-17687	Level 2	DOS interrupt table contains address pairs for interrupt routines (i.e. CLOCK, TRACE, etc.). You can place your own routine addresses in this table. An example is below: DI ;disable interrupts LD HL,4510H ;address of table link LD (HL),myrout ;address of interrupt routine EI ;enable interrupts
45F8H ↳17912	Model 3	Part of the WP (write protect) code. This byte is checked before doing a write.
46DDH ↳18141		RDSECT. On Model I, allows you to read a disk sector. Register C contains the drive selected, D contains the track, E contains the sector number, HL points at data buffer. On return, Z is set if successful; otherwise A contains error code.
46E6H ↳18150		WTSECT. On Model I, allows you to write a disk sector. Same conditions as RDSECT at 46DDH.
4754H ↳18260	L1, L3	Select drive.
4759H ↳18265	L1, L3	Continually reselect drive until it is ready.
475EH ↳18270	L1, L3	Seek specified cylinder (track).
4763H ↳18275	L1, L3	Write sector to disk.
4768H ↳18280	L1, L3	Write system (directory) sector.
476DH ↳18285	L1, L3	Write track to disk (used for formatting).
4772H ↳18290	L1, L3	Verify sector without transferring data to memory.
4777H ↳18295	L1, L3	Read sector to buffer.
4779H ↳18297	L1	Send text to file or device. Model 1/3: Scan and evaluate command line.
478FH ↳18319	L1, L3	Get address of drive code table for specified drive.
479CH ↳18332	L1, L3	Get byte field from drive code table.
4AC1H ↳19137		This routine will read sectors 2 - 9 of the disk directory track (11H) into your designated buffer. It is just like the DOS routine at 5CC8 which is overlaid by BASIC/CMD. (not for Newdos 80). To Use: LD B,0 LD DE,BUFFER ;256*8 bytes read CALL 4AC1H ;read sector LD L,0 PUSH BC LD BC,256 LDIR POP BC INC B LD A,B CP 8 JR NZ,read RET
4B10H ↳19216	L1, L3	Read directory sector with specified entry code.
4B1FH ↳19231	L1, L3	Write system buffer to specified directory sector.
4B45H ↳19269	L1, L3	Read directory sector to user buffer.
4B64H ↳19300	L3	Get cylinder (track) number of directory.
4B65H ↳19301	L1	Get cylinder (track) number of directory.
4B6BH ↳19307	L3	Multiply 8 bit by 8 bit integers.
4B6CH ↳19308	L1	Multiply 8 bit by 8 bit integers.
4B7AH ↳19322	L3	Divide 8 bit by 8 bit integers.
4B7BH ↳19323	L1	Divide 8 bit by 8 bit integers.
4CE7H ↳19687	Model 3	Storage Location for Video Driver. Used when invoking DUAL.
4CF8H ↳19704	Model 3	Storage Location for Printer Driver. Used when invoking DUAL.
4D00H-4DFFH ↳19712-19967	Model 1	BOOT/SYS Resides Here in Memory
4E00H-50A7H ↳19968-20647	Model 1	SYS1/SYS Resides Here in Memory
4FFFH ↳20479	Model 1/3	4K System Top of Memory
5200H-6FFFH ↳20992-28671	Level 2	Disk BASIC or DOS utilities when loaded, or user memory
5203H ↳20995 ↳ERRTAB	Model 1	TRSDOS BASIC Extended Error Messages. These get used instead of the L2 built-in messages.
54C3H ↳21699	Model 1	DOS Vector - CVI Command
57F0H ↳22512	Level 2	61 character ASCII copyright notice (DOS)
582CH ↳22572 ↳SCRMBL	Model 1	The copyright message "THIS BASIC WAS AUTHORED AND IS COPYRIGHTED BY MICROSOFT, 1978"
586BH ↳22635 ↳PROTMS	Model 1	The message "PROTECTION HAS CLEARED MEMORY"
5A77H ↳23159 ↳DIRTMP	Model 1	The status of FILE 0 (open or closed) in TRSDOS v2.3 BASIC
5B77H ↳23415 ↳USRTAB	Model 1	The start of the USR(0)...USR(15) Jump Table
5B8BH ↳23435 ↳MAXTRK	Model 1	A Byte which toggles whether the command being processed was a GET or a PUT
5B8CH ↳23436 ↳DSKERR	Model 1	Storage location for the DOS error code
5B8DH-5B8EH ↳23437-23438 ↳PTRFIL		The address in RAM of the file being used
5B8FH ↳23439 ↳FILPTR	Model 1	Start of the File Block Pointer Table for Files 01 to 15 (i.e., OPEN "I",n,"FILENAME")
5BAFH ↳23471 ↳FILPT1	Model 1	Copy of the FILPTR for File 0
5BB1H ↳23473 ↳LSTFRE	Model 1	A flag as to whether to run a BASIC program or not once the current operation is done
5C98H ↳23704 ↳PTCMD	Model 1	A flag to see if TRSDOS v2.3 was restarted or cold booted
5C99H ↳23705 ↳SVTXTT	Model 1	BASIC Program Beginning Pointer
5C9BH ↳23707 ↳FILSVS	Model 1	The answer to the FILES? question entered by the user when entering BASIC
5C9DH ↳23709 ↳OLSTTP	Model 1	Pointer to the lowest address available for string storage a/k/a top of free memory
5D51H ↳23889 ↳NXTFCN+1	Model 1	Exit JUMP Address Storage location for a CMD"S" or CMD"A" return to DOS from BASIC
5E57H ↳24151 ↳BADMVS	Model 1	Pointer to the message "USE TRSDOS 2.2 OR LATER"
5E70H ↳24176 ↳FILMES	Model 1	Pointer to the message "HOW MANY FILES"
5E7FH ↳24191 ↳MESG	Model 1	Pointer to the message "RADIO SHACK DISK BASIC VERSION 2.2"
5EA3H ↳24227 ↳FILNAM	Model 1	32 character buffer to store the current filename
651EH ↳25886 ↳FLRL	Model 1	Storage for the record size used in a FIELD command
651FH ↳25887 ↳DOPROT	Model 1	Flag as to whether an action is permitted based on the protection level of the file in the directory
6520H ↳25888 ↳PROTFL	Model 1	A different format of the protection level flag for the current file
6574H ↳25972 ↳DERTAB-1	Model 1	The byte before the table of DOS specific error message table that uses SYS4 to process the error instead of BASIC
6575H ↳25973 ↳DERTAB	Model 1	Table of DOS specific error message table that uses SYS4 to process the error instead of BASIC
68D9H ↳26841	Model 3	RAM - BASIC PROGRAM IN TRS-DOS 1.3
7A00H ↳31232	Model 3	Network 4 Read Buffer
7FFFH ↳32767	Model 1/3	16K SYSTEM TOP OF PHYSICAL MEMORY
BFFFH ↳49151	Model 3	32K System Top of Memory
FFFFH ↳65535	Model 3	48K System Top of Memory

RAM Addresses and Routines for Level 1

Address (Hex/Dec)	Description
3C00H ↳15360	Start of screen memory
3FFFH ↳16383	End of screen memory
4000H ↳16384	A value
4004H ↳16388	B value
4008H ↳16392	C value
400CH ↳16396	D value
4010H ↳16400	E value
4014H ↳16404	F value
4018H ↳16408	G value
401CH ↳16412	H value
4020H ↳16416	I value
4024H ↳16420	J value
4028H ↳16424	K value
402CH ↳16428	L value
4030H ↳16432	M value
4034H ↳16436	N value
4038H ↳16440	O value
403CH ↳16444	P value
4040H ↳16448	Q value
4044H ↳16452	R value
4048H ↳16456	S value
404CH ↳16460	T value
4050H ↳16464	U value
4054H ↳16468	V value
4058H ↳16472	W value
405CH ↳16476	X value
4060H ↳16480	Y value
4064H ↳16484	Z value
4068H ↳16488	Pointer to cursor position
406AH ↳16490	Points to top of physical memory
406CH ↳16492	Pointer to top of used memory
406EH ↳16494	Current FOR end value
4070H ↳16496	A$ Value (16 bytes)
4080H ↳16512	B$ Value (16 bytes)
4090H ↳16528	Cassette port status cache (byte)
4091H ↳16529	Current FOR step value
4093H ↳16531	Pointer to top of current FOR statement
4095H ↳16533	Pointer to current FOR statement
4097H ↳16535	Save for pointer to current line
4099H ↳16537	Pointer to print buffer
409BH ↳16539	Pointer to NEXT variable
409DH ↳16541	Parse pointer saved at a STOP
409FH ↳16543	Pointer to current line being executed
40A1H ↳16545	READ pointer
40A3H ↳16547	Saved SP for this BASIC frame
40A5H ↳16549	Pointer to current FOR variable
40A7H ↳16551	Three bytes of RNG state
40AAH ↳16554	Unused
40ACH ↳16556	Buffer for command input, print output to cassette
40F3H ↳16627	End of buffer
40F4H ↳16628	Bottom of floating point stack. Each entry is 5 bytes consisting of LSB, Middle, MSB (with Bit 7 set), Exponent and Sign (in Bit 7)
4180H ↳16768	Bottom of system stack pointer
4200H ↳16896	Top of system stack pointer
4201H ↳16897	Start of BASIC Program Storage. 16 bit line number followed by line text, terminated with a 0DH