Leader 3216 Signal Generator Repair help (Conclusion: was the eprom chip)

[alonsojar]

I've recently got a Leader 3216 AM and FM signal generator. It is very well conserved and in general nicely working. The signals are clean and as far as I can verify, very accurate. I intend to use it in FM stereo receivers alignments (what else!).

The only problem is that from time to time it hangs and the keyboard is frozen. In this situation the SG continues issuing the RF signal with the last setup, but a power off/on is required to recover.
This problem only happens after a random keystroke (I cannot find any pattern), and seems not related with time of use or components heating. It may happen in a minute or after an hour, but always following a keyboard hit. If not using the keyboard it can be hours and never hangs.It is not a mechanical issue.

The unit inside looks clean and never repaired. I did some preliminary homework, resetting and cleaning contacts, reviewing the power rails and filter capacitors, but everything looks under specs.

I'm focusing in the cpu board. It has basically a Hitachi CPU HD6303R + PIA HD6231P chips, an 32k eprom and a static ram to save the setups. I suspect the problem is there because even when frozen, the keyborad input signals are received in the PIA PAx and PBx lines, while the CPU Address, Data buses and control signals are in loop like crazy. Resetting only the cpu board power rail will recover the system.

I've checked the electrolytics in this board and were showing good capacity and low ESR. Anyway I replaced them, but no success.
I also tested the eprom, reading it sequentially end to end with an arduino board at least 20 times without any error and with always matching results cell by cell, so it's probably good.
By the way, the eprom has a sticker label hiding the erasing UV window indicating it's a 1.7 level. I've seen a pic of another Leader 3216  board in a japanese web, and the eprom sticker was 2.1
May this problem could be solved with a newer code? There is no information and perhaps a newer level will require a matching hw revision... I haven't been able to find any eprom dump of any level, so this is probably a dead track unless someone can extract and share it (It has been reported here that Leader support didn't provide any code either). If anyone is interested I've dumped mine to a file.

Checking the signals with the oscilloscope I've found something that I don't know if is right or not. I will appreciate your comments.
The 3.6MHz xtal signal looks clean and steady, The A0 to A14 address bus signals are looking good to me (see screenshot), but the Data bus D0 to D7 looks weird. As you can see the signal has a wide rise curve and looks dirty when in high state. The image is the same in all the 8 bits and no matter the chip leg I test (cpu, pia, sram, eprom). This signal was captured while in normal operation, but in case of loop this is not changing.
I have null experience debugging this kind of electronics, so I will appreciate any comment or advice.

I have the temptation to start changing components in the board, but the risk is to damage it removing the large chips and I don't know where to begin.
I'm also afraid this could be just a sw bug and changing all hw will do nothing.
At the end and for the light use I intend it's not really a big issue restarting it from time to time. Since the critical RF part is working ok, perhaps I should forget my curiosity and perfectionism and live with this. What do you think? 
(Sorry for the long post)

I will appreciate any advice

Alonso

[alonsojar]

After replacing the eprom chip with a ST M27C256B-10F1 (100nS instead of the 200 nS the original AMD had), things are going right and the problem seems solved. Maybe the chip was degraded or maybe the timings were tight and a faster chip solves the problem.
I attach the 32k eprom dump containing the cpu code to help anyone needing it.

Regards
J.Alonso