Hello, I did try this with no luck. I replaced SRAM to Sony cxk581000am-70 (standard 128kx8 SRAM, first what I did find in my storage). I didn't have 27C040, instead I used 29F040. Using 29F040 CM (plain communication software) works nicely with bigger memory, but when replaced to MM software, scope just freezes during boot up. 28C040 vs. 29F040 should be similar, if scope don't try to write anytyhing to memory.
OH2LIY
The difference between the 27C040 and the 29F040 is three pin assignments, Vpp and A18 at pin 1 respectively, and A18 and WE# at pin 31 respectively. So without a bit of PCB modification, the 29F040 is not expected to work as a drop-in replacement.
Pin 1 of the 29F040 is A18, the upper address bit, which on the 27C040 is at pin 31. Pin 31 on the 29F040 is the WE# pin. The TDS2MM firmware is likely larger than the CM firmware and may need access to this pin.
It is unlikely, as you guessed, that software would try writing to this region of memory, so it should be safe to connect pin 1 to pin 31 on the PCB. This same "trick" is done on the TDS220 motherboard, but is actually provided by a resistor shunt option, and a 29F040B works there!
To support this connection, the AM29F040 datasheet says (paraphrased), "Write cycles are inhibited by holding any one of OE# = low, CE# = high or WE# = high. To initiate a write cycle CE# and WE# must be low while OE# is high", so in the case where A18 is attached to WE#, then OE# = low (read cycle) will override the WE# function for any state of A18.
I also hope to use a 29F040B on my TDS2CM, but the TDS2CM will require a wiring modification. Unfortunately, pin 1 of the U206 PLCC socket is directly connected to a via to the ground plane (Vpp programming voltage on the 27C040), so this makes modification for a 29F040B tricky for pin 1, but not impossible.
As far as I can tell A18 traces from pin 1 of the J101 header to the 20-pin PLD at U104 pin 4 U104 and to pin 31 of the U206 PLCC socket (A18 on 27C040), so access to A18 to pin 1 of the 29F040 might be easiest as a wire from pin 4 of U104.
Also, for the 32-pin SRAM option, A18 is left floating on the PCB, so perhaps attaching a wire to ground at U204 pin 1 (A18) would allow larger capacity SRAM chips to work properly (often easier to source these days!); a floating address pin could lead to unexpected behavior.