Wood-Mizer LT70 sawmill - Accuset (1) control panel

[shakalnokturn]

I'm trying to repair this for a friend, apparently they're known to be unreliable.

The LT70 is a mobile band sawmill the cutting is taken care of by a diesel motor, the cutting height and log feed are handled by 12V electric motors.

The Accuset control panel is a PID motion controller that allows for user configurable semi-automatic division of the log cutting.

Accuset gets cutting height position from a Balluff BTL5-M1-0914-Z-SU191-S135 linear absolute position magnetostrictive displacement transducer (MDT) using interrogate and start / stop differential signalling over shielded RS-422.

The problem:
About 2-3 seconds after being powered the Accuset throws an "1111 interrupt" message that stays there. All controls are unresponsive.

The Accuset hardware:
Top to bottom, left to right...

MDT connector
U16 - ADM488AR transceiver 5V to RS-422.
U17 - CY37064P44 CPLD receives MDT timing pulses and 100MHz master clock as timing reference for MDT position, outputs 20MHz clock for CPU.
OSC1 - 100MHz oscillator enters U17.
U18 - CY37128P160 CPLD (No f'ing clue why they needed something so large...)
U8 - IDT71256SA25P 32k x8bit fast SRAM
U9 - MT28F400B5 Flash memory for CPU firmware.
U10 - MC68376BACAB20 CPU.
Further right 74HC4066 not quite sure what that's used for, then 3x onboard SMPS for MDT 14V, IC supply 5V, LCD supply.
The group of  LED's are for basic diagnostics to show if the Accuset is outputting the gate signals to the MOSFET H-bridges that control the height and feed motors. These no longer toggle.

Things that have been checked:

On top left 6 pin connector in photos the MDT is supplied by a steady 14V, datasheet states 24V supply for that model but the Accuset is designed to supply 14V (checked with feedback resistor values at the SMPS) and more recent versions of the transducer are specified for 10 to 30V supply so I'd call that a datasheet omission.

The MDT responds to the interrogation pulse and the output at pin2 of ADM488 is good.

At power-up the Accuset query's the MDT position, the popping-up of "1111 interrupt" message coincides with the point where the RS-422 bus goes silent.

Oscillator is running, there's bus activity on the RAM and Flash. Logic levels look good on most lines but on both devices the /OE lines are only 3.5V logic high.

The /OE lines come from U18 the larger CPLD, both Vcc and Vcco are 5V powered so I don't really see why some outputs should reach 5V and others not and I've checked #OE are not shared with CPU so the output must be from U18.

Probing around U18 many pins seem to float around 3.5V, of course not knowing how it is configured they could be open inputs. All the same other pins have 0-5V levels...
CPLD doesn't seem abnormally hot.
Does anyone know if Vcco are all internally linked or if they power independent groups of output drivers on the CPLD die which could indicate that CPLD has been damaged?
CPLD damage is quite possible as it links to the H-bridge drive connector...
Something that seems a little nutty to me is that these CPLD height control outputs are loaded with 510 Ohms parallel with 10µF tantalums, this seems very harsh on the outputs unless they are internally current limited.

At this point any idea is welcome.

[shakalnokturn]

I knew I wouldn't get much input on this.

Would anyone know of a PLC or motion controller that may fit the job with minimum sawmill modification, mainly something that would work with th original start / stop type MDT ?

[Ground_Loop]

Would you be interested in a small form factor Siemens PLC 1500 with 16 point 24vdc IO modules?  It comes with one input module and one output module. It’s been sitting on my shelf for about 5 years doing nothing.

[shakalnokturn]

Would you be interested in a small form factor Siemens PLC 1500 with 16 point 24vdc IO modules?  It comes with one input module and one output module. It’s been sitting on my shelf for about 5 years doing nothing.

Thanks for the offer. 5 years!  Things tend to collect dust forever here too, sometimes even get lost under dust.
I'm rather uneducated regarding PLC's
I'd have to look into the documentation a little, do you think it's capable of <15µs time resolution on inputs? Then there's the problem of learning to use and program the PLC, I'm not sure my friend will be that patient 

[shakalnokturn]

By now I've close to no hope in repairing this.

Adding a picture for those who may need to rewire after ripping the sensor cable away by dropping a tree on it.

A few waveforms captured on the top 3 pins of the largest connector, they look like serial data. Anyone poke me if this looks like a known bus / data format.
I was looking for a serial port that may output more detailed information to help in troubleshooting, "Interrupt 1111" is somewhat enigmatic.

[fzabkar]

Would it make sense to create non-destructive faults and observe how the errors change? For example, you could disconnect something and see how the firmware reacts. This might reveal some pattern in the error codes.

You could also play with IC Enable pins.