The various phones have different ICs in them, when shipping. This is an (incomplete) overview.

^ Owner  ^ Device              ^ Revision  ^ Firmware IC 1         ^ Firmware IC 2        ^ Voiceware IC 1        ^ Voiceware IC 2       ^ Additional       ^
| Foulab | Multipay            | "2.0" SMD | U2: M29F040B (4MBit)  | X1: M29F040B (4MBit) | U16: M27C801 (8MBit)  | U26: M27C801 (8MBit) |                  |
| Martin | Multipay "Nevada"   | "1.0" THT | U5: M27C2001 (2MBit)  | n/a                  | U10: M27C4001 (4MBit) | n/a                  |                  |
| Martin | Multipay "Bell"/TTY | "1.5" THT | U5: unknown           | n/a                  | U10: unknown          | n/a, perhaps -->     | U22: unknown     |
| Sam    | Multipay "Bell"     | "1.5" THT | U5: M27C2001 (2MBit)  | n/a                  | U10: AT27C040 (4MBit) | n/a, perhaps -->     | U22: unpopulated |
| TP     | Deskset             | Rev 2     | U22: M27C2001 (2MBit) | n/a                  | U35: M27C4001 (4MBit) | n/a                  |                  |
| Martin | Deskset "Bell"      | Rev 2     | U22: unknown          | n/a                  | U35: unknown          | n/a                  |                  |

====== Controlboard Revisions ======
The controlboard-revisions mentioned here probably do not conform to official Nortel-numbering.
^ Device   ^ Revision ^ Remarks ^
| Multipay | 1.0 THT  | All components Through-Hole, only 2 IC-sockets for firmware and voiceware. | 
| Multipay | 1.5 THT  | Same PCB as 1.0 THT, but added second IC-socket below the first voiceware-socket. Nevertheless new socket seems not to be in use. Found in two Bell-Multipays, one of them refurbished and with TTY-keyboard. |
| Multipay | 2.0 SMD  | All components SMD, features 2 firmware and 2 voiceware-ICs in PLCC-packages. Phone can download additional applications to run on the phone. |
| Deskset  | Rev 1    | The two IC-sockets for firmware and voiceware are placed diagonally from each other. |
| Deskset  | Rev 2    | The two IC-sockets for firmware and voiceware are placed one below the other. Board is still marked "Rev. 1". |

====== ICs and their replacements ======
^ IC       ^ Type   ^ Description                 ^ Used for          ^ Replaceable with    ^
| M29F040B | plcc32 | 4MBit (512Kb x 8) Flash     | 2.0 SMD Firmware  | Same type           |
| M27C801  | plcc32 | 8MBit (1Mb x 8) OTP EPROM   | 2.0 SMD Voiceware | to be determined    |
| M27C2001 | DIP32  | 2MBit (256Kb x 8) OTP EPROM | 1.x THT Firmware  | SST39SF020A (Flash) |
| M27C4001 | DIP32  | 4MBit (512Kb x 8) OTP EPROM | 1.0 THT Voiceware | W27E040 (EEPROM)    |
| AT27C040 | DIP32  | 4MBit (512Kb x 8) OTP EPROM | 1.5 THT Voiceware | W27E040 (EEPROM)    |
| M27C2001 | plcc32 | 2MBit (256Kb x 8) OTP EPROM | Deskset Firmware  | SST39SF020A (Flash) |
| M27C4001 | plcc32 | 4MBit (512Kb x 8) OTP EPROM | 1.0 THT Voiceware | W27E040 (EEPROM)    |

Please realize, that the W27E040 EEPROM cannot be substituted for a SST-series Flash, as the 040 and upwards capacities are not pin-compatible (Check the top row, pin A18, etc.)
The Winbond W27E040 is available in a DIP-32 as well as a PLCC-32 packaging - but unfortunately almost exclusively only through 3rd party sellers like AliExpress and eBay.
You may save yourself the trouble and just use a regular OTP-EPROM for the voiceware, if you're not planning on changing it.

For testing purposes, on the desk series of phones (and perhaps others), an ST Microelectronics M29F040B and likely others may replace the original voiceware EPROM. While it'll work, the bank switching circuitry will only recognize the final 2 mbits of the ROM, where foreign language prompts would normally go. In order to test accurately, it's necessary to put the tone and pause samples in the same places where they'd normally be within the first mbit.