Some details here only applies to the fx-570/991ES PLUS calculator model.

See also this file, which should contains all of the known information.

ROM Window (0:0000h - 0:7FFFh)

An image of segment 0 of the ROM. Writing to this part of memory has no effect.

RAM (0:8000h - 0:8DFFh)

Fully writable/readable.

Configuration information

  • Address: [0x8100 .. 0x8154] [citation-needed]

Mode

  • Address: 0x80F9
  • Size: 1 byte

Intended modes:

  • fx-ES PLUS series
    • 0xC1: COMP
    • 0xC4: CMPLX
    • 0x03: STAT
    • 0x02: BASE-N
    • 0x45: EQN
    • 0x06: MAT
    • 0x88: TABLE
    • 0x07: VECTOR
    • 0x4A: RATIO
    • 0x4B: INEQ
    • 0x0C: DIST

Unintended modes:

  • fx-ES PLUS series

Input area

  • Address: [0x8154 .. 0x81B8]
  • Size: 100 bytes

Stores the formula currently displayed on the screen.

Cache area

  • Address: [0x81B8 .. 0x821C]
  • Size: 100 bytes

Stores the last entered formula. Accessible by pressing [AC] [←].

Random seed

  • Address: [0x821C .. 0x8226]
  • Size: 10 bytes

Used for Ran# and RanInt# function.

Static part

  • Address: [0x821C .. 0x8224]
  • Size: 8 bytes

Only changed if Ran# or RanInt# is called, or change to all-zero pattern [citation-needed] when a reset is performed.

Dynamic part

  • Address: [0x8224 .. 0x8226]
  • Size: 2 bytes

This changes when:

  • A reset is performed: Change to all-zero pattern. {Cn}
  • The input cursor flashes: Increment by one. (if this is interpreted as a little-endian uint16_t), wraparound on overflow)
  • This changes to 0x99 {Cn} whenever Ran# or RanInt# is called.

Also known as the unstable character, used for typing hackstrings.

Variables

Variables are stored as BCD-coded floating-point numbers, 10 bytes per variable.

Variable Address
M 0x8226
Ans 0x8230
A 0x823a
B 0x8244
C 0x824e
D 0x8258
E 0x8262
F 0x826c
X 0x8276
Y 0x8280

Screen buffer

  • Address: 0x87D0
  • Size: 32 rows * 12 bytes per row

Some functions write to the screen buffer, then use the render function to copy it to the real screen.

Some other functions use the value of use_buffer configuration variable to determine if it should write to the buffer or the real screen.

Magic value

  • Address: [0x860e-0x861d]
  • Size: 15 bytes

This memory area always contains bytes 0x0f to 0x01, in decreasing order. Used by the calculator to check RAM integrity.

Special Function Registers (0:0F000h - 0:0FFFFh)

Summary of functions

Address Functions
0x0F00n Main control
0x0F01n (IE?) Unknown
0x0F02n Timer
0x0F03n Screen
0x0F04n I/O ports
0x0F22n (Unknown)

Details

Addr (from) Addr (to) R/W* Description
0xF000 W Unknown SFRs
0xF008 W STPACP
0xF009 SBYCON
0xF00A Unknown SFRs
0xF00B 0xF013 (unknown)
0xF014 R/W Unknown SFRs
0xF015 0xF01F (unknown)
0xF020 0xF021 R/W Timer interval.
0xF022 0xF023 Timer counter.
0xF024 probably TM0CON0
0xF025 TMnCON1 (for n = 0 or 1, I don't know) with bit 0 = TnRUN
0xF026 0xF02F (unknown)
0xF030 Set display range of the screen
0xF031 R/W (3) Set display mode of the screen.
0xF032 R/W (5) ''DSPCNT'' - Screen contrast. (from 0 to 0x1F)
0xF033 (3) Contrast. 0-3: normal contrast, 4-7: decreasing contrast with 7 lightest, 4 darkest (but still lighter than normal contrast = 0)
0xF034 Unknown SFRs
0xF035 0xF03F (unknown)
0xF040 0xF041 KI Keyboard
0xF042 0xF043 Corresponding to KI, specifies the keys that can wake up the CPU from STOP mode. See Keyboard.
0xF044 0xF045 R/W (10) Unknown SFRs
0xF046 0xF047 R/W (10) KO Keyboard
0xF047 0xF04C Unknown SFRs
0xF04D 0xF04F (unknown)
0xF050 RO? Emulator only. Pd number.
0xF051 0xF220 (unknown)
0xF221 0xF223 (3?) No observable effect (tested for 0F221).

(*): If (number) is included, it specifies number of usable bits in that SFR. (lowest significant bits, in little endian)

Video RAM (0:0F800h - 0:0F9FFh)

Address (from) Address (to) Read/write Description
0xF800 0xFA00 R/W Display

Segment 1 (1:0000h - 1:0FFFFh)

A read-only copy of code segment 1.

Segment 8 (8:0000h - 8:0FFFFh)

A read-only copy of code segment 0.