No, I know the basic idea how the 3167/4167 works (actually, these processors are likely the primary reason why 386/486 chipsets supported "local bus devices" before there were any local bus slots).
I doubt the 1167 is a chip, it's likely just the name for the module carrying the 1163/1164/1165. I furthermore doubt that this module was ever meant to interface the 286 or 386SX (even though Wikipedia says so). There is little information on the 2167 (if it exists at all). The 3167 may be the integration of the 116x chips into a single chip. The 1167 architecture chart floating around shows that it taps 17 address lines...
... This indicates clearly it is not an 387 replacement. The 387 has just 2 or 3 address lines. The Weitek Abacus protocol on the other hand uses around that many address lines. My guess is thus that the 116x chip combination is much more similar to the 3167 than the 387.
On the other hand, the claim that Weitek saw a chance to push the 1167 into the market because the 387 was late is likely true. The conjecture that it was a binary compatible replacement is likely false.
We know that the newer Weitek processors use the C000'0000 to DFFF'FFFF area of the 4G address space of the 386DX. IIRC, there is a protocol for older Weitek processors that mapped them into C'0000 to D'FFFF within the first megabyte, and the WEITEK option on EMM386 sets up a mapping to forward the 1M range to the 4G range. If it is true that older Weitek processors did in fact reside in the 1M range (and that's not just a convention invented with EMM386 in mind),
it is likely that the 1067 used that convention.
As you likely know, the basic idea of the Weitek 3167 protocol is transfer the opcode on the address lines (~14 of them is enough) and 32 bit of data on the data lines in the same bus cycle. This can be used to perform arithmetic with 32-bit floats that are not in a Weitek register. I have no idea how they did that for the 286 coprocessor, as you can't transfer a whole 32-bit float at once.
