The microcontroller used in the S&S is a TMC0270, itself derived from the TMS1000, a 4-bit microcontroller quite popular at the time, seeing all the devices that used it. It is mainly found in calculators, the end product for which it was originally designed. It has enough inputs to read a keyboard, and enough outputs to drive LED displays or VFDs thanks to the "O" outputs supporting the negative voltage necessary to light up the segments. Pins "K" are the inputs and pins "R" are the logic outputs.

The internal program is a mask ROM, and can spread over 2048 9-bits words, divided into 16 pages of 128 instructions. Each of these instructions take a word and 6 cycles to execute. The nominal frequency at which it operates in the S&S is 320kHz, although my version was able to go below 1kHz and exceed 500kHz without crashing.

The TMS1000 instruction set is available here.

Its built-in RAM is made of 8+1 pages of 16, 4-bit words (the 8th page is a bit special, see after... ).

It has three registers: a 4-bit work register "A", and 2 addressing registers X and Y, which are 4-bits also.
There is no instruction to set the value of A directly. To do it, we must clear A (CLA instruction) then add an immediate value to it (ACAAC # instruction).

Addressing RAM is done with the register X for the page (0 to 8), and Y for the index in the page (0 to 15).
Page 8 of RAM, also called DAM (Direct Access Memory, do not ask me why) is accessible through the special instruction COMX8, that allows to enter and exit this page by complementing the 4th bit of register X. Strictly speaking, there isn't a 4th bit in X, just a separate flag to access this RAM page (ignoring the 3 lower bits of X).

Speaking of flags, whereas other later CPU have multiple status flag for zero results, parity, errors... There is only one in the TMS1000. It is by default at 1 and becomes 0 when a conditional instruction's result is false. It returns a 1 automatically after the next instruction, so conditionnal jumps must be made immediately after the check.

The PA register (Page Address) holds the current ROM page number in which the instructions are read. It can't be accessed directly.
The PB register (Page Buffer) holds the ROM page number in which the next CALL or BRANCH will be made (PA then becomes PB). It is loaded with the LDP instruction.
The PC register (Program Counter) is the address of the current instruction (7-bit).

After a reset, PC is set to 0 and PA to 15 (the code starts at the first instruction of the last page).
On overflow, PC wraps to 0 without incrementing PA (stays on the same page).

The call stack isn't one of the deepest: there is only one slot made of 11 bits (7 to store PC, and 4 for PA).
Therefor, a call to a function can't be made inside a called function. If we make two CALLs without a RETURN in the middle, the second acts as a BRANCH (jump).

A PLA (Programmable Logic Array) allows to convert a numeric value to a set of states for the O outputs, those used for the display. This allows for the hardware conversion of an alphanumeric value to the one required to turn on the appropriate segments of the display. The TMS1000 had a 4 to 8 bits PLA because it was designed to only display numbers, which used 8 segments. For example, by setting the value 7 in the PLA, the O outputs corresponding to the segments A, B and C go to -12V, lighting up the right segments to display a "7".

The modifications to TMS1000 mainly consists of an increase of the number of inputs (5 instead of 4, to read 8x5 = 40 keys), and the number of O outputs of the PLA, which now accepts a 6-bit input and 16 bit output (the VFD has 16 segments characters to draw letters). In order to set this value with 4 bit registers, a "hack" was arranged to write to the PLA always with the same instruction (TDO). The 4 LSB are written with the status bit at 0, then the two MSB with the status bit at 1. Knowing that the status bit automatically returns to 1, it is possible to force it to 0 and do two consecutive TDO.

Characters codes for the PLA are: