Further examination has placed EPROM U19 at memory address &6800-&6FFF. EPROM U9 appears to have its address decided by the contents of the two 7641 ROMs. Extracting the ROM contents will, presumably, reveal more - perhaps the EPROM moves around or is mirrored into several blocks of memory.

All 19 of the MK36000 ROMs have extensive corrosion on the pins, and only three came out without losing at least one pin. The EPROMs and 7641s are all unaffected. As modern EEPROMS aren't pin compatible with the MK36000s, I will likely replace the 16 paged ROMs with a single 128K EEPROM on a carrier board, and have another EEPROM replacing the fixed ROMs. For initial testing, I will likely just use jumper wires to connect U18's socket to a breadboard or stripboard adaptor, and leave the paged ROMs and other fixed ROMs empty. The OS ROM will probably be replaced by a 28C256 with some diodes and flying leads to the two secondary chip selects - I've built something similar for my BBC Master's paged ROMs.

I have knocked up a possible design for the paged ROM carrier board, which sits across U32 and U33, as well as picking up the bank addresses from U41 (which will need to be removed and replaced with a socket).