Since I couldn't find any clear documentation about the contents of the ROMs (even in the patent) set apart for the cartridges "magic bytes" in a post of Lord Nightmare, I took the time to copy the assembler listing file in OO Calc (downloadable here). I commented most of the code for the main functions such as access to the ROMs, communication with the synthesizer, and the way "Spell mode" works. There's still the hangman, "Say it" and word scramble code left, which wasn't really interesting for what I wanted to know.

Note that the majority of the LDP instructions have been omitted in the Ti listing, ertainly to "mine" the code and prevent people from having a functional copy.

Remember that the TMS1000 instruction set is available here.

By analyzing the code, I could understand how sentences were formed and what ROMs were accessed at what time.

There are different modes (games) available, but the best known is the one where a list of 10 words is randomly chosen internally, and each of these words is said before asking the user to write it correctly. Once these 10 words are done, the score is given then a new list is started.

When the S&S is turned on, this mode in level A (4 levels are available, A, B, C and D) and only the internal ROMs are used. The "Module select" button is used to read the words from the cartridge (That's for later...).

The number of words for the level is read from ROM at a fixed address, it's a 8-bit value so there can be a maximum of 255 words in each level.
A 12-bit internal counter which is normally used for the timeout for standby is used as a seed to generate a list of 10 words.
This seed is truncated to be less than the total number of words (DECLOOP routine).
The list is filled with 10 values ​​beginning at this number. If the count exceeds the total number of words, it starts back at 0 (routine RPLOOP).
This list of "linear" values is then mixed up by inverting the values ​​2 by 2 (RSCRAM routine).

Once this list is made in RAM, it is expected that the player presses the "GO" button (or passes to another mode, the list remains in RAM anyways).

When the game is started, things get a bit complicated. It will seem confusing at first but bear with me.
The data for the first word in the RAM list needs to be read from the ROM.
To get this data, a 16-bit pointer corresponding to the chosen level is read at a fixed address.
This pointer leads to the start of a pointer table that match each word level. The word number multiplied by 2 is added to it (the pointers are 2 bytes), to fall on the right word data pointer. The new pointer is followed and finally gives the spelling data for the word.

The spelling is read byte by byte and stored in RAM. As the letters are coded on only 6 bits, bit #6 is used to indicate the last letter (letter code + 0x40). Remember that words can't be more than 8 characters, I'm not responsible for what may happen if you put more!
For example, the word "HOME" (see codes PLA), we find:

 07 0E 0C 44

A "link list" is made in RAM to form the phrase "Spell -word-". For this, the first entry is a fixed address in ROM of the word "Spell" and the second is the one of the last read pointer, so the selected word. The microcontroller then processes this link list by asking the synthesizer to say these words.

Let's get the spelling wrong, the microcontroller knows that this is the first try, it erases the link list and prepares a new to say "Wrong, try again". One might think that this sentence is in one block and a link list isn't necessary, but it turns out that the word "Wrong" is also used to tell the score. "Wrong" and "Try again" are two separate words in the ROM, to save space. So there is two addresses needed in the link list.
The link list is processed again, the try flag is set to 1 and the player is asked a second time to spell the word.

Let's suppose we're wrong again, the microcontroller knows that this is the second try and gives the correct spelling. A new list link is made to say "Wrong, the correct spelling of -word- is ...". There are 4 needed addresses in the link list: "Wrong", "The correct spelling of", the word, and "is". Once the list is processed, the correct spelling of the word is read letter by letter from RAM and each one is spoken. Then the next word is read...

Multiple pointers are used for hardly intelligible words such as "isle". For this word, the S&S says "Spell isle, as in island", there are 3 pointers in the word data: for "isle", "as in" and "island". "As in island" is not a whole block because "Island" is also used as a word in another level. Everything is done to save space. Note that in this case there are 4 pointers in the link list, with "Spell..." at the beginning.

The rest contains tables of words, spellings and LPC data...

The rest is available for spellings and LPC data...