I couldn't figure out how to electronically dump the ROM; the INIT line isn't bonded out on the TMS1980, so I don't think it's possible.
I clocked a couple of TMS1400s with INIT and R9 (not R10) asserted, and they both clock the same 64 bits out O7, over and over. It didn't matter if I toggled K1-K8 the same as with dumping a TMS1100, or not at all. Since the bits were the same for both chips, I assume they have something to do with the LFSR, not ROM or PLA contents. I'll try setting different R lines and see what else I get.
TI30 patent US4064554A barely mentions the test mode for TMS0980; it says the ROM can be shifted out like the TMS1000, except that it is 9 bits wide instead of 8. But Fig. 15 shows KC and K4 controlling BRNCAL (to load the ROM contents at the address shifted in), while the TMS1000/TMS1100 use KC and K2 for that.
