The 27 s and 28 s are completely different models.
The 28C and 28S
are physically similar but the S has more memory.
The 28C and 28S have the same case, and take the same cells, but the
logic boards are very different (i.e. a 28S is _not_ a 28C with
extra/different RAM chips added). The 28C has 3 direct-on-board chips
under the display (CPU in the middle, 2 RAM/display drivers), and 2
saturn-bus ROMs on the back side. The 28S is more like a 19B -- it has 2
TAB chips under the display (which I think are CPU/ROM/display drivers,
with the CPU disabled on one of them) and a 32K JEDEC-pinout RAM on the
back side.
Actually, the 28C is the more expandable one. You have access to the
Saturn bus (which can address 512K bytes), and the machine _will_
recognise extra RAM (e.g. taken from an HP71). There are no extra address
lines available on the 28S CPU AFAIK, so you're pretty much stuck with
the 32K.
I've often wondered if it would be possible to get a 28C to talk to an
HP71 HPIL module (the hardware interface should be trivial). Of course
writing the necessary software could prove 'interesting'...
-tony