Short answer from memory:

- At the beginning of a frame the address ist set to zero
- The address is incremented over a line for R0 (total chars aka horizontal timing) character access cycles 
- Only R1 (displayed characters) are visible
- The address is resettet after R0 character access cycles.
- Scan line counter is incremented
- When the scan line counter reaches R9 (Max Scan Line -1)
  - Scan line counter is reset
  - Address is incremented by R1

Rinse and repeat.