I did some investigatory probing.
Confusingly, only four of the six PROMs are connected to the 8X300. The two others send their data lines to a latch elsewhere on the board and seem like they must be used for something else. In some way this is a relief: the contents of those two PROMs are strange, with contents like these typical:
Code:
00000000: 0922 2200 2222 2243 0022 2222 2222 2222 .""."""C."""""""
00000010: 2222 2200 2222 223a 6214 6215 34f5 2222 """.""":b.b.4.""
00000020: e222 22e2 2222 e222 2222 2222 1415 2222 ."".""."""""..""
00000030: 2222 22e2 2222 e222 223c 6216 6217 36f7 """."".""<b.b.6.
00000040: 2222 e222 22e2 2222 e222 2222 2222 2222 ""."".""."""""""
00000050: 2209 2222 0022 2222 1cfc 2222 e222 22e2 ".""."""..""."".
00000060: 2222 e222 22e2 2222 e222 2222 2222 2222 ""."".""."""""""
00000070: 2222 3839 e21c 3c22 3839 2218 2222 3a18 ""89..<"89"."":.
00000080: d922 22e2 2222 e222 22e2 2222 e222 22e2 ."".""."".""."".
It reminds me of some kind of lookup table or of using a ROM as a replacement for combinational logic.
The four PROMs connected to the processor are U385 and U475 (connected to processor data lines I8-I15) and U375 and U495 (connected to processor data lines I0-I7). I think Signetics counts bits backwards, so the first two are the least significant byte and the last two are the most significant byte. The physical layout of the chips is puzzling, and it suggests to me that Tek was leaning on the autorouter to help out with the layout (the right-angle traces are another clue, of course).
Looking at some arrangements of the ROM data, the layout that makes the most sense to me is this:
Code:
MS8 LS8
-----+-----
U495 U385, followed by
U375 U475
This arrangement has the most JMP instructions followed by locations that are the targets of other JMP instructions, like this:
Code:
jmp x0219
x022b: xmit 0h,dliv
where
x022b:
is a generic label generated by the disassembler. The reason I think this is a good sign is because (as I understand it) the 8X300 has no stack and no instructions for call/return, so if you wanted to run something like a "subroutine" and then jump back to the caller, you'd need to be able to get to the instruction after the JMP.
There are other recognisable patterns like this jump table making use of the odd XEC instruction:
Code:
x0050: xec x0051,r11
x0051: nop
jmp x070d
jmp x0728
My reason for putting U495,U385 in front of U375,U475 is because the second pair of ROMs has an empty bit at the end; I assume it's extra space that wasn't needed.