When switched on, the Spectrum goes through an initialisation process that determines the amount of RAM and divides it up into a number of areas.

Note that some boundaries are fixes and other variable. The display always starts at 16384 and ends at 23296; however a BASIC program is located above the Microdrive mapping area which are set by the Microdrive.

For this reason, system variables are used to determine where things are, e.g. PROG determines the start of BASIC programs. All system variables are stored as two bytes (to hold an address) and are located in addresses 23552 to 23734.

The main areas are as follows: Display File: stores the pixel data for the display
Attributes: stores the colour information for the display (24 line by 32 columns)
Printer Buffer: Holds a line of 32 characters
Microdrive Maps: Only valid if a Microdrive is present, represents free sectors and such
Channel Info: Maps streams to channels - discussed here
BASIC Program: where a basic program is stored. To VARS -1
Variables: BASIC program variables. To E Line -2
Edit Buffer: the current command line. To WORKSP -1
INPUT data buffer: data from the INPUT command. To STKBOT -1
Calculator Stack: Stores intermediate results. To STKEND -1
Machine Stack: Stores temporary data by the Z80. Not available from BASIC. To ERR SP
GOSUB Stack: Stores line numbers by used by RETURNS (to RAMTOP)
User Defined Graphics: Allows user defined alternate character set. To P RAMT

Free memory is found by subtracting the stack pointer and the STKEND.

System Variables

There are five groups of system variables: RAM boundary variables (as discussed in the Introduction); keyboard state; system state; I/O variables; video display variables.
I/O variables are described here and video display variables are described here

When accessing memory for 16 bit numbers, the least significant byte (LSB) is stored (bits 0 to 7) is stored in the lower memory address and the most significant byte (MSB) is stored (bits 8 to 15) in the higher memory address. There are exception to this but not relevant to this section and are described in the assembly language tutorial.

This means that the bits corresponding to the MSB are bigger than those corresponding to the LSB by a factor of 256. Thus if two numbers are stored in addresses N and N+1, then:

DEF FND(N) =PEEK(N)+256*PEEK(N+1)

Will return the address stored in these two addresses.

And:
POKE N,V-256*INT(V/256)
POKE N+1.INT(V/256)

Will store the 16 bit number V to locations N and N+1. Using similar methods to reading, DEF FNH(V)=INT(V/256) and DEF FNL(V)=V-INT(V/256)*256 can be used. DEF FNx is a BASIC instruction to define a macro kind of thing. Trust me, I'm a Doctor :)

System variables are:

23627: VARS
23635: PROG
23641: E LINE
23613: ERR SP
23653: STKEND

Keyboard State Variables

These control the way the keyboard work:
KSTATE: 8 locations from 23552 to 23559
LAST K -1: 23560
REPDEL -1: 23561
REPPER-1: 23562
RASP -1: 23608
PIP -1: 23609

KSTATE records which keys have been pressed for the purpose of controlling the auto-repeat facility. LAST K holds the code of the last key pressed, updated 1/50th of a second, i.e. a single character type a head buffer. REPDEL and REPPER control the auto-repeat. REPDEL sets the time needed before autorepeat starts and REPPER is the repeat rate.

RASP and PIP control the sound made by the keyboard. RASP alters the duration of warning tones, PIP alters the duration of the keypress tone.

System State Variables

These keep track of the state of the machine.
ERR NR -1: 23610
ERR SP -2: 23613 to 23614
(forgot!): 23672

ERR NR holds one less than the error report code.

ERR SP holds the address of the ZX BASIC ROM that is jumped to when an error occurs. If you decrease the contents of this pair of locations by two the BREAK key is disabled, but any errors will cause the machine to crash. This address is modified by the Spectrum to cater for different error states (e.g. using INPUT command).

(forgot!) means I forgot the name of the variable (or specifically, can't find it) and returns the number of TV frames that have been displayed since the Spectrum was switched on:

DEF FNt()=(PEEK(23672)+256*PEEK(23673)+65536*PEEK(23674))/50 returns the time in seconds since the spectrum was switched on. Meaning that it will run for almost 4 days before resetting (I think).

Other System Variables

Refer to the sections on Memory.