Keyboard shortcuts

Press or to navigate between chapters

Press S or / to search in the book

Press ? to show this help

Press Esc to hide this help

System overview

Target: ti84plus.rom (1 MiB flash dump). OS self-identifies as 2.55MP. CPU: Zilog Z80 (16-bit address bus, 64 KiB logical space) with hardware flash/RAM paging. Ghidra project: ti84.gpr (rebuild: tools/build.sh).

Confidence is flagged: [confirmed] = verified in disassembly/decompiler; [standard] = matches documented TI-83+/84+ architecture and is consistent with the disassembly; [hypothesis] = inferred, not yet verified.

The big picture

The TI-84+ is a Z80 machine that can only see 64 KiB at once. The target has 1 MiB of Flash and eight RAM selector values. Community hardware reports assign eight independent 16 KiB RAM blocks to early units. They assign 48 KiB to later units, with selectors 8287 sharing one block. No physical result is recorded for the calculator used by this project. A four-slot paging scheme and a system-call (bcall) mechanism expose code and data beyond the current address space. The OS is a single-tasking monitor. Its boot/kernel core occupies Flash page 0, other OS routines span banked Flash pages, and fixed RAM windows hold system state. See RAM pages for the revision evidence.

Everything the user interacts with — the homescreen, TI-BASIC programs, graphing, the catalog — is built on four pillars:

  1. Paging + bcalls — how code and data beyond 64 KiB are reached. (see paging.md, bcall-mechanism.md)
  2. The floating-point engine — 9-byte BCD reals/complex in the OP1–OP6 registers; all math flows through these. (floating-point.md)
  3. The variable system (VAT) — named objects (reals, lists, matrices, strings, programs, appvars…) catalogued in the Variable Allocation Table. (variables-vat.md)
  4. The tokenizer/parser — TI-BASIC is stored as 1- and 2-byte tokens; the parser executes them. (tokenizer-basic.md)

Around those sit the I/O subsystems: the Flash command path and boot write APIs; the IM1 interrupt dispatcher (interrupts.md); the standard timers, RTC, and low-power state machine (clock-timers-power.md); the MD5 round accelerator; the LCD driver; the keypad scanner; and the link port.

Subsystem index

Each row maps a documentation page to the subsystem it covers and its analysis status.

DocSubsystem
memory-map.mdAddress space, ports, RAM layout
flash-memory.mdFlash geometry, protection, command sequences, boot write APIs, archive traces, and emulator differences
paging.mdPaired and independent Flash/RAM mapping, extended selectors, boot transition, and forced overlays
bus-timing.mdCPU-speed-selected Flash, RAM, LCD, and timer wait-state registers
asic-status-gpio.mdASIC status and identity, battery comparison, protection mode, and GPIO
bcall-mechanism.mdrst 28h system calls + jump table
interrupts.mdIM1 entry, USB/legacy routing, masks, status, acknowledgement, priority, and wake
clock-timers-power.mdClock domains, programmable timer API, RTC, APD cadence, and power-off
md5-hardware.mdMD5-assist ports, boot digest API, round descriptors, and Rabin hash transformation
variables-vat.mdVariable Allocation Table, object types
floating-point.mdBCD float format, OP registers
tokenizer-basic.mdToken tables, parser/interpreter
display-lcd.mdLCD ports, screen buffers
keyboard-link.mdKeyboard and link overview
keypad-on-hardware.mdMatrix electrical behavior, scan timing, debounce, repeat, ON interrupts, and wake
subsystem-map.mdbcall API surface, system through-line
boot-contexts-errors.mdBoot, context system, _JError/onSP
memory-management.mdRAM heap, VAT/userMem, Flash archive/GC
flash-page-map.mdWhat each of the 64 flash pages contains
ram-pages.mdRAM page selectors, page 83, and restore rules
open-questions.mdPrioritized future-work roadmap
sub-calculation.mdCalculation engine: FP ops, transcendentals, formatting, errors
sub-graphing.mdGraphing: window vars, coord↔pixel, draw primitives, Y= eval
sub-tibasic.mdTI-BASIC: program execution, control flow, I/O commands
sub-tibasic-tracing.mdTI-BASIC fixture traces, smoke runner, coverage anchors
sub-vat-archive.mdVariables, Sto/Rcl, Archive/Unarchive, Flash GC
sub-apps-mem-settings.mdApps find/launch, RAM-reset, MODE/format flags
sub-statistics.mdSTAT: 1/2-var, regressions, statVars
sub-matrix-list.mdMatrix/list element access, Gauss-Jordan inverse/det, matmul
sub-solver-numeric.mdSolver root-finder, nDeriv/fnInt, TVM finance
sub-table-yvars.mdTABLE generation/cache, Y= equation vars
sub-equation-display.mdEquation display / MathPrint layout (page 0x39 eqdisp_*)
sub-link-transfer.mdLink protocol: byte/packet/var-transfer (page 0x3C)
sub-usb-asic.mdUSB ASIC/link-assist ports and OS transport selection

(The sub-* docs are deep dives covering user-facing functionality and I/O internals: calculation, graphing, TI-BASIC, VAT/archive, apps, stats, matrices, solver, table, equation display, link, and USB/link assist.)

New to these notes? Start with Conventions & methodology (how to read the addresses and confidence flags) and the Glossary; the bcall index is the full alphabetical system-call reference.

The main 0x4xxx bcall table and the retail boot bcall table (0x8xxx, from the local complete ROM) both carry TI-OS types. Most boot bcall bodies are on page 3F; USB boot routines such as _AttemptUSBOSReceive, _ReceiveOS_USB, _InitUSB, and _KillUSB are on page 2F. Rebuild: tools/build.sh.