I dumped the S&S TMC0351NL and TMC0352NL and the Vowel Power TMC0350NL/CD2302, and got the same bytes as the previous dumps. I do have one odd issue- the data is dumping at a different address than it should be. Something about how I'm setting the address must not be correct, since all 3 VSMs are offset by nearly 1K. I built a very simplified interface- just power and ground and 4 signals (CLK, M0, M1 and DATA/ADD8). I tied the address lines to ground with resistors so that the address is loaded with 00000, then read 262,144 bytes to cover the full 18-bit address range (it takes 54 seconds). The '352 and '350 dumped all the correct bytes, but about 1K sooner than they should have. The '351 started dumping in the middle of the ROM, then dumped a bunch of zeros, then dumped the beginning of the ROM. When I cut and pasted the two parts together, they were correct. It appears the address is somehow getting loaded with 3F000+/- instead of 00000. It's usually 3F002, both when doing sequential dumps and powering off between the dumps. I've used a logic analyzer to compare the signals to the datasheet's timing diagram and everything looks OK. My timing is not rock steady; it varies a bit but stays within range (100-200KHz). But all the bits are dumping correctly; it's just the address that's wrong....
I blowtorched the S&S TMC0271NL and TMC0281NL. Unfortunately, the '271 die stuck in the plastic, and when I was working on it I must have stressed one corner, because about 1/4 of the chip flaked off. Of course that included part of the ROM array The '281 came out fine. I've only got quickie ICE composites so far- www.seanriddle.com/tmc0271quickice.jpg and www.seanriddle.com/tmc0281quickice.jpg ICE didn't do a very good job, and I'll replace them when I have time. Not surprisingly, the '281 looks a lot like the '280 on siliconpr0n, and the '271 looks a lot like their '2708.