Jaap's Psion II Page

The Psion Organiser Series 1 System Variables

The Organiser Series 1 has only 2K of RAM, with the address range $4000 to $47FF. Most of the system variables, the settings and bookkeeping information it needs to run properly, are however stored in the small amount of space provided by the processor, in the address range $00 to $FF.
The only source for this information I have is from partially disassembling the ROM, so this list is very incomplete. If you have any information about any of the variables which is not here, please let me () know. I obviously cannot guarantee that this information is completely correct, nor am I responsible for any loss of data or any other damage resulting from your use of this information.

The addresses in the range $01 to $1F are used as internal registers by the 6303 processor. Extreme care should be taken with these addresses. They control/receive/send data to and from the other hardware - for example the operating system uses these for access to packs. The addresses marked W can only be written to, and similarly those marked R should only be read. The most useful and least dangerous is Port 5 ($15) which is used to read the keyboard and test for low battery.

  00     Not used
pob_ddr2 01 W   Port 2 data direction register. Bit 0 controls the direction of bit 0 of port 6 (1=output,0=input) and bit 1 control the direction of bits 1-7 of port 6.
  02 R/W   Port 1. This is the low byte of the address bus. Do not use.
pob_port2 03 R/W   Port 2. Used as data bus to slots, i.e. to packs etc.
  04 W   Port 3 data direction register of data bus. Do not use.
  05   Not used
  06 R/W   Port 3. This the data bus. Do not use.
  07 R/W   Port 4. This is the high byte of the address bus. Do not use.
pob_tcsr1 08 R/W   Timer Control/Status 1. Bit 3 (EOCI1) is used to enable or disable OCI interrupts.
pow_frc 09/0A R/W   Timer 1 Free Running Counter, automatically incremented by processor clock. Used for OCI interrupts.
pow_ocr1 0B/0C R/W   Timer 1 output compare register. When pow_frc (Timer 1 frc) reaches this value, pow_frc is set back to zero and an OCI interrupt is generated. The OCI interrupt is used in the Psion as the keyboard interrupt.
  0D/0E R   Input capture register
pob_tcsr2 0F R/W   Timer control/Status register 2
pob_rmcr 10 R/W   Rate, mode control register
pob_trcsr 11 R/W   Tx/Rx control status register
pob_rdr 12 R   Receive data register
pob_tdr 13 W   Transmit data register
pob_rcr 14 R/W   RAM/Port 5 control register. Note that bit 7 (STBY PWR) is used to test whether a cold or warm boot is needed on startup. If it is clear on startup, then it is set and a cold boot is performed, but if bit 7 was already set it only does a warm boot. If bit 6 (RAME) is cleared, it disables the internal RAM ($40-$FF) of the processor so that these addresses refer to external memory instead. This feature cannot be used as there is no external memory for those addresses. Bits 0-3 control whether the corresponding bits read from port 5 are the port lines or the lines IRQ1, IRQ2, MRE or HLTE respectively. On the Psion these 4 bits normally are clear, so that the normal port 5 lines are used. The external interrupts IRQ1 and IRQ2 are therefore ignored.
pob_port5 15 R   Port 5, input port only. On the Psion it is used to read the activated keyboard lines and ON/CLEAR key. Bit 7 is clear when ON/CLEAR pressed, and bits 2 to 6 are cleared whenever the corresponding key is pressed on one of the active keyboard lines. (See $3000). Bit 0 is clear when the battery is running low. Bit 1 (ACOUT) is connected to bit 12 of the clock counter (see $3000), so that when the organiser switches on this bit will show whether it was because the timer elapsed (i.e. 2048 half-seconds elapsed) or whether it was because ON/CLEAR was pressed.
pob_ddr6 16 W   Port 6 data direction register, controlling the direction of each of the bits of port 6 individually.
pob_port6 17 R/W   Port 6. Bits 7 to 0 are labelled PACON, CS3, CS2, CS1, OE, PGM, MR, CLK. This port is used in the Psion to control whether the packs are on or off, which pack is selected, and to set the pack address. The series 1 has no top slot to select, so CS3 is used in a different way that I don't quite understand.
  18 R/W   Port 7
  19/1A R/W   Output compare register
pob_tcsr3 1B   Timer control/Status register for timer 2. Bits 0-1 select the clock used (if both set then bit 7 of port 2 used for timing, otherwise the internal clock is used). Bits 2-3 selects the action is needed at bit 6 of port 2 when time-out is reached (if bit 3 is set then bit 2 will be output, if bit 3 clear and bit 2 set then port 2 bit 6 is toggled, if bit 2, 3 both clear then port2 bit 6 becomes an I/O port). If bit 4 cleared then timer 2 is temporarily disabled. Bit 5 is unused. If Bit 6 is set then a timeout causes an interrupt (CMI). Bit 7 is set whenever a timeout occurs (is not reset automatically).
pob_tconr 1C W   Timer constant register for timer 2. The timer 2 up counter is incremented until this value is reached at which time the action indicated by the control register is taken.
  1D R/W   Timer 2 Up counter.
  1E   Not used
  1F   Test register. Do not use.
  20-3F   Not used

The addresses in the range $40 to $FF are registers in the processor's internal memory. The machine code instructions to access these 'zero-page' addresses are shorter, and therefore execute faster than those accessing two-byte addresses.

40 Timer for switch off
41 Non-zero if natural updating disabled (B pressed) while setting clock.
tmb_hfsec 42 Current time, half-seconds
tmb_mins 43 Current time, minutes
tmb_hours 44 Current time, hour
tmb_date 45 Current date, day
tmb_mons 46 Current date, month
47/48 Saved SP for when error occurs
49 Not used?
4B Number of unread bytes of currently selected record on pack
4C Byte length of currently selected record on pack
4E Record ID of currently selected record
4F Number of bits remaining in first byte of 16-bit pack buffer
50 Number of bits to be read to make next character
pk_buf 52/53 16 bit buffer read/written to pack.
pk_addr 54/55 Current pack address
56/57 Index number of record being read (?)
58/59 Index number of current record (?)
5C Number of half-seconds till packs switched off, or ignored if bit 7 set.
5D Length of activity indication
5E Current cursor type (00001EUF)
swap_reg 62/63 Swap register. The SWI command swaps its contents with X register.
buf1_len 64 Length of Buffer1 at 4006.
buf2_len 65 Length of Buffer2 at 40DD.
66 ? Amount by which buffer is scrolled for display
67 Current reading/cursor position in Buffer1 | current date/time section selected for editing
6D Length of floating point stack at D4 in bytes
6E Maximum length of buffer1 when reading in a record
revector 70 If bit 0 set, warm reboot jumps to 47FC. If bit 1 set, OCI jumps to 47F9. If bit 2 set, NMI jumps to 47F6.
71 non-zero if boot code already run and loaded
pk_curpk 72 Current pack (10 for pack A, 20 for pack B)
73 Pack used according to menu item
76/77 Address of current menu option routine
79 Current menu item, or FF for clock
7A Pack id of pack 1
7B Pack id of pack 2
pk_size 7C/7D Size of current pack (in bytes)
82 Key currently depressed
8B Error flag. bit 0 set when parsing or arithmetical error occurs
8C Used as loop counter in calculation routines
93-96 Extra mantissa working space
97 Extra mantissa byte of register below, for rounding
fp_acc1 98-9B,9C,9D Floating point register, mantissa, sign, exponent
9E Extra mantissa byte of register below, for rounding
fp_acc2 9F-A2,A3,A4 Floating point register, mantissa, sign, exponent
A5-A9 Mantissa temporary register
AA-AE Mantissa temporary register (can be combined with previous)
B0 Exponent sign during parsing
kbw_tdel B2/B3 OCI interrupt interval (B3F6)
bta_tabl B4/B5 Address of keyboard table (key_tabl)
B6 Number of menu items (initially 05, can be 06)
B7/B8 Enter menu item (F939)
B9/BA Find2 menu item (F887)
BB/BC Save2 menu item (F8A5)
BD/BE Erase menu item (F948)
BF/C0 Off menu item (F987)
C1/C2 Calc menu item (F977)
fpstack D4-?? Floating point stack. Length is in 6D
FA Bootable pack slot
FD/FE Bootable pack, pack address of data

The address range $100 to $3FFF does not point to physical memory storage. Some of this address range is used to control the semi-custom chip, which controls all external communication for the CPU including the LCD screen, the keyboard and the buzzer. The semi-custom chip does not decode all the address lines. For the LCD driver the even addresses $2000, $2002 ... up to $27FE are considered identical, as are the odd ones $2001 up to $27FF. For the other addresses all of the bottom 10 bits are ignored by the semi-custom chip. Simply performing a TST instruction on any of these addresses will have the required effect. Only the LCD addresses are such that STA or LDA instructions are required.

sca_lcdcontrol 2000 Liquid Crystal Display control register. When bit 7 of the contents of this register is set it means that the LCD is busy and cannot take any commands. The remaining 7 bits contain the current address pointer in the LCD memory. Writing to this register (only when bit 7 is clear) is used to pass a command to the LCD chip.
sca_lcddata 2001 LCD data register. Is used to pass data to/from the LCD chip (only do this when bit 7 of $2000 is clear). Any data written/read here is stored at/read from the current LCD address, after which the LCD address pointer is automatically incremented.
sca_counterreset2800 Reset counter for kybd + clock
sca_pulseenable 2C00 Pulse enable. Enables a high voltage pulse (21V) used in writing to datapaks. Take extreme care.
sca_switchoff 2E00 Switch off
sca_counterclock3000 Counter for kybd + clock increment once. The keyboard has 7 lines of 5 keys (ON/Clear is separate). Bits 0 to 6 of the clock/keyboard counter determines which of these lines are active. When reset, all lines are active. To make only one line active, set the counter to 3F, 5F, 6F, 77, 7B, 7D or 7E which have only one of its low bits clear. These values activate the following key lines:
 3Fmode save find << >>
5FAGMS shift
7BDJPV space
7DEKQW delete
7EFLRX execute
Which of these keys is pressed (and the ON/CLEAR key) can then be read at pob_port5 ($15). This counter is also used to control the number of seconds that the organiser is switched off, and the number of NMI's that were missed if they are disabled.

The address range $4000 to $47FF is the ordinary RAM.

Buffer1 4006 Buffer 1, with length in 64
Buffer2 40DD Buffer 2, with length in 65
... ... ...
47EF Top of stack
47F0-2 TRAP revector entry point (enough room for JMP xxxx)
47F3-5 SIO revector entry point (enough room for JMP xxxx)
47F6-8 NMI interrupt revector entry point (enough room for JMP xxxx)
47F9-B OCI interrupt revector entry point (enough room for JMP xxxx)
47FC-E Warm boot revector entry point (enough room for JMP xxxx)