Cincinnati Sabre with Heidenhain 426/430 control parameters.

[jmp49]

Bit of a longshot but as per the "things you fixed today" I almost got my Sabre 750 cnc machining centre up and running but the hard disk failed on boot. Its bad electrically, I can hear the heads tracking while its trying to sync and it never even answers the ide identify query. So its firmly a case of its dead jim, electrically. The broken disk drive is going off to a lab in Prague to see if any of its readable after parts replacement, but in the past results of that have been a bit hit and miss with such a old oddball drive.

I've since replaced the hard disk and formatted the replacement in the machine, and installed the matching version heidenhain software again via tncremo, but this installed default safe heidenhain parameters and while it boots and is on the network now, it has no concept of what sort of machine it is in. The part of the configurtion that tells the machine how the heidenhain control is connected and how many axis/travels/limits/spindles etc and where its connected is supplied by the machine manufacturer not Heidenhain themselves, and Cincinnati Milacron milling machine division went defunct in 2008. Out of curiosity I read the replacement drive in a linux machine and its all normal fat16 partitions with regular fat file tables etc.

So the long shot... Does anyone have acces to a backup of a sabre with heidenhain 426/430 control, and could they share it with me? I can extract the machine definition file from it and adjust it for travel etc if I have a starting basis to edit. I think the whole image produced is about 750M in size, so not huge to put on dropbox/google drive or mail etc.
If you have just the machine definition file for sabre with heidenhain 430 tnc/control, that would also be perfect. I understand the screw compensations and drive fine tuning will have to be redone for my individual machine regardless but for now, I want to get it moving and prove the spindle drive is ok.

I posted on facebook sabre group, cnczone and Practical machinist already, but outside of europe the vast majority of Sabre's had Acramatic or Fanuc controls and its all done differently so radio silence apart from some scammers in pakistan trying to sell me a backup for $500 that's probably just the default heidenhain install if it even materializes once payment is sent.

 

[jmp49]

To update this, I'm going to document the woes that involve old cnc's with a bit of a deep dive.
Probably useful as much as a cautionary tale to anyone else who buys a machine that cant be tested under power. And maybe @awemawson might give me some pointers because I think he has some past dealings in this sort of thing...

The original IDE disk drive came back from the specialist lab as completely ruined, the read/write heads had hit the surface of the platter and scooped large chunks of it out. 3% came back as recoverable and they were unused sectors. The company has honored their guarantee of zero data recovery zero charge though, so its cost me nothing but time.
There was some question over if parts to rebuild the drive could be found because it had to be from the exact same drive from within a few months of the production date of the original because it had to match the existing parts exactly. Needle in a haystack...
Somehow I found a replacement drive of exactly the same type and revision and production date "guaranteed tested and working" for donor parts in the US on ebay, and when it arrived, it was suspiciously missing all the jumpers and just sat there quietly with the led lit and no activity. As soon as I terminated it correctly with the missing jumpers, it started making the same sick drive noises but by then the recovery company had found the parts themselves anyway, so it went back for a full refund. So much for hitting the jackpot.

I purchased a backup archive for my machine from a UK Cincinnati Milacron specialist (150 quid for some text files, but that's a really really reasonable fee considering the pakistani sellers wanted $500...). I've not been able to upload it the machine to test it and its a weird heidenhain only .bck format with zero documentation on how to unpack it outside of their tnc control software, that will only unpack it to a machine control. So I cant unpack the archive then drop the files right on the machine's replacement hard disk directly to fix it.

So onto the next stage, get the TNC to communicate with a laptop to reflash it...
After much testing of different serial adaptors and making up leads and finally reinstalling my toughbook with win7 that has a proper rs232 port on it, both the RS411 RS232 port appears to be electrically dead.
If I put a clip between pins 2 & 3 of the RS232 connector to the TNC itself, I get my own char's echoed back, but nothing else.
And on my revision of the machine system software, the optional ethernet card that it has which is working and networked to remote nfs servers does not allow you to restore the system software, which has to be done by the LSV2 proprietory protocol, which only operates on serial connectors on my system software revisions.
So four options here, none of them great.
1) rip off the heidenhain TNC and logic unit and totally replace it with a linuxcnc pc based control and MESA fpga io cards, I've done this before on my bridgeport but I wanted to keep this a industry standard control if I could... There's a bit of me saying I should have just done this anyway before starting this journey. And I dont understand fully how the control tells the spindle to operate, since the spindle has its own control computer, with modbus and plc onboard.

2) Fit later eproms with the newer LE-426CB software version that supports LVS2 over the ethernet (280 476 xx onwards, I have 280 472 12...) Only heidenhain wont even deal with me or tell me how much the upgrade eproms cost as I dont have a service account with them. Also I've seen things online that suggest the upgraded software doesnt run on my hardware revision, but you need a heidenhain service account to verify compatibility...
I probably have the hardware to blow the eproms (27C4002's) myself with a newer software version, but I'd have to actually have the software to put on them so that's probably a no go. I'm not sure the eproms are actually official ones anyway. A sticky paper label with the version handwritten doesnt seem factory but it explains why its running a different version to the official heidenhain barcode version on the outside anyway.


3) Pay 2k upwards for a replacement Logic Unit without blown ports (maybe) and hope its hardware revision & the archive works together, or I just flushed 2150+vat quid down the toilet.
4) Send the board with the comms ports on out of my logic unit to someone for specialist repair, I've been quoted that it would start at about 1000 quid + vat + postage when I enquired.
5) Fix the electrical issues with the port myself.

5 it is then. I cant make the machine any more unusuable as currently its 4t of humming scrap that just stops a significant part of my barn from floating away. And I'm nearly at that "rip all the commercial stuff and install linuxcnc instead" stage so if it goes wrong it will force my hand.
I've got no circuit diagrams and the pcb is multi layered, so traces can be a bit difficult to follow, but what do I have to loose...

On inspection, the rs232 has zero protection against issues and voltage spikes on the port, its just a few passive components and straight into a a RS232 driver ic. There's no optocouplers or other standard protections.
I've been told later revisions of the same TNC had optocouplers, and worst case they blow instead of the IC's or worse, which would be nice as it'd be a easy job to test & replace them.
Its also telling that heidenhain revised the design to add them, like they were needed to protect that fragile rs232 driver IC in a dirty emf environment like a CNC machine cabinet...
Here's the serial port drivers circuitry area of the main pcb. Its all surface mount, but I have a little bit of experience with smd soldering and board rework to fall back on.
The two IC at the bottom left above the port are Transil protection diodes. They all test as good with a meter so the problem is probably the RS411 driver IC's above them, or further in, or my sole RS411 Usb dongle is crap, I have done a loopback test on the pairs on it, and it loops back fine, but who knows if the line voltages are enough. As far as I understand it one driver IC is for outgoing signals and the next for incoming. Being RS-411, the signals both have two wires, +rx and -rx, and +tx and -tx, and the 1's and 0's correspond to the difference in voltage between the two conductors. In theory the usb 411 adapter shoudln't have any voltage issues because of this.
I dont know exactly what the 8 pin DIP IC's are above them labeled 631 715, and 601 648, they have no branding and I cant find a datasheet for those numbers specifically.
I'm assuming some sort of generic conditioning or line level adjustment circuitry before they go into the RS411 or RS232 driver IC's. If you know, please enlighten me.
I should probably scope the pins right at the port in case any of those SMD capacitors are bad too but you can only do anything but passive checks without the machine booted up.

 

[jmp49]

I'm going to focus for now on just the RS232 because its simpler just being signals reference to signal gnd rather than a differential signal pair, I dont know if my RS411 usb adaptor is any good to know if I've still got a port issue or the dongle isnt behaving, but I have known good rs232 port hardware to hand.
Here's the suspect in macro. Those smd resistors and caps are half the size of a grain of rice, no mug that small to give perspective sorry.

There's no transil diodes protecting the RS232, the port below just goes via the smd resistors up into the RS232 driver IC which is a Sipex SP206CT. You can see them below the chip on the right hand side. The resistors all measure as correct resistance to their markings.
After studying the datasheet the port pin -> transmit and recieve legs of the ic paths check out fine, the pcb is also scratched around near the legs which correspond to transmit/recieve down to the port, so I guess I'm not the first to try to diagnose this.
The problem is I cant fire this up on my bench to see signals and trace them on my bench oscilloscope for stupid reasons.
Firstly because the replacement hard drive has not yet had factory software fully restored (that process too involves a working serial port, a disk image or zip file set of the files would make life too easy I guess), the initial bios stops at a prompt that the stored parameters are bad, and to press the END key to continue before loading the software thats starts everything so its my assumption that the port isnt alive until this has happened as the restore functions say to press end & then start the restore at the next prompt. The END key is on the operator console which is located at the front of the machine away from the machine cabinet, with multiple cables embedded in ducting and would be a nightmare to remove and bring into my office to work on.
Secondly it runs off two 110v lines on different phases. I've been told it can be fed normal 230v across the two lines, but I've also seen people asking for replacement psu's so some caution is happening here.

To play it safe I have to do it in the machine, but that involves crouching in the machine cabinet next to a 30KVA 3 phase transformer, touching pads in inaccessible places with probes which is what someone did when they scratched the pcb.
So current plan is to solder on some fly leads to the legs that correspond to RX/TX & signal gnd, and terminate them with tails I can probe outside the case in situ with a handheld DSO.

I suspect (and hope) its just that RS232 IC blown but the only source for a exact replacement is ali express. So one (well 3, in case I mess up the first one, and one for insurance) is making its way from china.
3 of the chips cost 12 quid. I will be overjoyed if this gets the rs232 port going again and fixes the machine. I'll know once I've traced the signals in the machine alive if its the chip at fault prior to them arriving.

I also have to mention that I've been absolutely plagued by messages from scammers trying to scam me with replacement parts, or software, only to not know the version of the tnc software on their software or even the major revision or anything about what they were supposed to have when probed. Much worse than anything else I've tried to research.
And honorable mention must go to the individual with a profile picture of a drawing of trump's head, who tried to sell me a whole logic unit that the main boards are in, with the guarantee's that it all worked perfectly. And he provided pictures of the hardware itself and the main cpu was missing from its socket, and when I asked him if he was SURE it worked, he doubled down until I sent him back his picture of the empty socket circled in red, and a photo of my board in comparison. Having the orange gibbon as a profile picture should have been enough of a warning I know.
So if you do find yourself having to toe dip in cnczone or various specialist groups for your hardware, I would be very very cautious about buying anything where they wont list it on ebay to give you some protection.

 

[awemawson]

Sorry old chap, not a machine or control that I'm familiar with.
If it's any consolation I'm still ironing out bugs on the Siemens servo system on my Beaver TC20S lathe - been scratching away at it since 2018!

I have to say that recently I've found ChatGPT very useful for finding obscure documents and facts about it

 

[jmp49]

No problem.

Ive been mulling today if I want to solder fly leads on to give me probe points, or 3d print some kind of pogo pin based clip on jig for the chip instead. A proper 24 pin SOIC chip clip so it can be tested in situ without soldering is 50 quid which for a single use is a bit harsh.
Then mid day a jiffybag with the replacement SP206CT arrived, so I've just replaced the IC with the new one instead of spending a day faffing about trying to test the original, since I think its the most likely candidate for the issue. I'll test it tomorrow after I've reassembled it back in the machine and I can always revist 3dp a test clip with some pogo pins if that doesnt fix it.

 

[GaryS65]

Have you considered retrofitting a modern control and drives?

 

[jmp49]

The short version, Yes, but that's a magnitude of order more expensive and complicated than fixing this even if I had to buy a new logic controller.
I wanted to keep it on a commercial control because I want to gain a bit of experience on a "normal" cnc, and its a good chance to prove the machine's mechanical hardware and spindle/drives etc are still good if I do retrofit.

If I cant fix the logic unit so it can communicate with a laptop, I'll go straight to retrofitting with with a pc based control running linuxcnc and a Mesa 7i97T fpga setup. I have a bit of experience with linuxcnc and mesa hardware having done a bare metal retrofit on a bridgeport interact1, but driving 5 axis steppers. This is a analog servo drive machine and I'll leave the servo drive side alone as no drive fault leds are currently lit, but its not moving under its own power yet.
There's centroid retrofits, or even a newer variant control from fanuc or heidenhain, but the centroid seems to be a expensive linuxcnc style control where you pay handsomly for someone elses choices and software licenses then have to diy install it anyway, and heidenhain or fanuc etc are very nice new car territory costs for the hardware and if you have problems, you wont get support unless you have a support contract with the control maker. Heidenhain is pretty good about not having their user documentation behind a paywall so they have that at least, although the service guides and more detailed stuff is not available to customers, but its leaked all over the net now anyway.

Anyway, I've been all day off and on faffing about with this again, kept getting called away to walk the dog or other stuff breaking my concentration at the worst moment. I'm not working on my day job stuff so I'm fair game, normally my office door shut would mean do not disturb...
Before I lifted the IC I couldnt trace a few of the pins to test points, once I could probe from the pad itself after cleanup I found the test points, it did look reworked so maybe a few of the pins weren't making contact.


Then I soldered in the replacement with liquid flux & the hot air gun and it looked really nice, but a couple of pins were bad when I traced them through after so I had to resort to using the soldering iron and resoldering a few pads by hand.

Ive got it recased after putting in about 30 port screws and remounting all the daughter boards & I'll get it in the machine this evening for a test. I'm now even more hopeful that someone just made a mess of putting in a new rs232 ic before abandoing fixing it.

And correction to one of my earlier posts in this thread if anyone starts digging through to debug their own machine, there IS transil protection diodes for the rs232, under the blue part of the pen. Hidden via's connect it inline between the rs232 IC and the port. They all tested ok or I'd have spotted this earlier...

 

[jmp49]

Well I hurt my back thurs doing some wood splitting as we're running short of split logs and had a couple of days to recover as I didnt fancy folding myself into the machine cabinet. But the end result is that's fixed sod all anyway. However I've managed to eliminate the "press a key to proceed" warning at first start, so now the main Logic Unit boots unattended to at least the main gui with the language error screen and at the point the ethernet, rs-232 and rs-422 interfaces are at the point to respond too.

I've also looked at the circuit diagrams and decided its ok to feed the Logic Unit 230v across the two 110v phase inputs, as it says in the hardware service manual its a autoranging psu :
"For LE 426CB an NC power supply of 140 V∼ to 450 V∼ at the terminals U1 and U2 is required."

I've done that, and its sat on my electronics bench currently with no display but answering a ping on its ethernet and no magic smoke has fell out. It doesnt matter if I cant see the display at this stage as its the ideal state to diagnose further the rs-232 and rs422 interface issues, since I can now use my bench oscilloscope and other stuff instead of crouching with some mini dso balanced in a machine cabinet with a 30KW 3 phase supply humming next to me and various live rails.

 

[jmp49]

I sniffed the LVS2 protocol init packet that the heidenhain windows software tncremo was trying to send to communicate with the tnc/logic unit, and it sends hex char 05 to wake it up, so I wrote a bash script on my desktop linux box to send \x05 to a usb serial port dongle every 0.1 second and probed for the rs-232 activity going out the port and across the circuit board of the logic unit on my trusty scope.

After a day of watching wiggly pictures on the oscilloscope and hunting traces and pads to probe then seeing where they stop wiggling and stopping and starting the script to make sure the signal I was seeing was actually the rs-232 transaction then testing + resoldering the legs of that particular component, I got some garbage back from the tnc in reply and I plugged it into the windows laptop instead and I finally have the control talking to a laptop and tncremo connects and can see all the files on the tnc etc. With a usb rs-232 dongle that plenty of people have told me wont work with a older cnc like this.

The tnc is still missing its operating system but Heidenhain have tnc images on their site archives for download but its a binary that only runs under dos or 32 bit windows. So let the 1990's dos based fun begin. Currently twiddling my thumbs while it reinstalls the complete hard disk system of the logic unit from their weird dos based backup program over rs-232 serial.
You forget how slow 9600 baud is, but I dont want to push all that newly soldered electronics harder at 115200 baud.

Feels like positive progress.

 

[awemawson]

I feel your pain! It all sounds so familiar, I ended up getting a Panasonic Toughbook with a genuine hardware implemented serial port running Windows XP in order to talk to and poke around in the PLC (written in Step5) in my Siemens Sinumerik 820T controller on my Beaver TC20S cnc lathe.

 

[jmp49]

Now I have a complete full install on the TNC itself done by usb->serial dongle on windows7 and it boots with no errors about missing files. But still no machine specific configuration which are in the parameter .MP and plc files, which are supposed to be in that backup set I purchased.

I still cant restore that machine specific backup via tncremo because it says the .bck file is corrupt or doesnt match the .lst file, but reading about, some of the early versions of the backups only supported the binary .exe they came packed with, so to test that I had to use the supplied setup binary at a cmd prompt. It wont run under win7 32bit, the cmd line version just gives some control not ack'ing a update block error.
I have a older toughbook CF-30 running XP too because it runs some automotive diagnostic software that has to be on that hardware + os. Its the only version of windows and dos that the heidenhain command line backup system exe packaged with the backup would work on with no errors. And I tried it, and its the same error as tncremo, the .bck file in the package doesnt match the contents of the .sys and the named files are missing from the compressed .bck file.

I found a backup in the same .bck format for a le426 on a union boring machine and ran through extracting it with tncremo, and then the cmd line tool to make sure I knew how it should work, and that was fine. Also I could take a backup of the fresh install on my tnc with it. So its the backup file I was supplied corrupt/not matching its .lst file which details its contents.
This whole issue comes about because half the machine configs are in ascii text, and half in binary blobs. So the backup program does some kind of proprietory ascii conversion on the binaries and packs the ascii converted files into a single ascii archive file and writes the contents into a ascii .lst text file saying whats in it, so the two files can be transferred over rs232 as normal text, then restoring it is a reverse of that. I've had a look round for a tool that understands the format outside of their tools, but nothing so far and we're not quite at the desperation stage of firing up IDA and spending a week reversing the heidenhain command line tool to see if I can fix the problem manually.

I hope the compressed backup has just got messed with while people were copying it out of some archive and sending it me via email, so I've contacted the company and asked them for a password protected zip of the files instead. The password protection means that any antivirus etc won't open the zip archive and mess with the contents in any way.They've promised me a zip file later today.

So yes, very familiar probably, old cnc's are as much about windows/dos archeology as motors and bearings it seems.
And it still hasnt fired up that modbus controlled spindle yet...

 

[jmp49]

Oh yay, I got the zip archive, but its still crap.
So I picked through decompling tncback.exe to understand it a little better and looked at the .BCK file, and compared it to one I found for a Union jig borer with the same control. The union one behaves perfectly in TNCremo and with tncback.exe, whereas the one I paid for has none of the files recognized.

The paid for one has got a valid header prefixed:
54 4e 43 20 50 41 43 4b 45 44 20 42 41 43 4b 55 |TNC PACKED BACKU|
50 20 46 69 6c 65 20 2d 20 56 31 2e 30 c2 34 01 |P File - V1.0.4.|

then some binary data that needs unpacking by the software, then halfway through it switches to masses of hex AA's, then part of a lotus notes template at the end.
The good one from the union machine has binary until towards the end, where there's a list of filenames and the offsets in the file to extract them in a sort of filesystem table.

So the paid for one is definitely corrupted. I've gone back to the company that sold me it and asked him to check with his upstream supplier if they have a version thats not corrupt.
I might still yet be going linuxcnc at this rate, but at least I can sell the tnc off as working now.

 

[jmp49]

YES! the company came through with a fresh backup set today, only 4 serial numbers away from my machine. And fantastic news its not corrupt and is the same machine type in the configs.
I opened it in a hex editor expecting it to be also butchered by lotus notes, but it was not corrupt so I loaded it into the laptop and TNCremo.

I uploaded it my logic unit, and because the compensation files were also attached in plain text to the original backup, after comparing contents I could use them in place of the ones in the new machines set.

The compensation files alter the behaviour of the drives for the X,Y & Z axis drive motors, to compensate for tiny tolerance variation in manufacturing of the leadscrews themselves, they were measured with lasers during manufacturer to hit stated precision targets so its pretty nice to be able to restore the actual ones.

Now to screw the logic unit back in the machine and see what's next.

 

[jmp49]

Ah! more progress!
It looks totally different with the new software on. And the alarm about air pressure in the top left corner is also exciting, because it means the plc is running, and checking safety switches and levels.
It wont run with low air pressure because it runs the toolchanger & the dropsa oiling unit. So no air pressure, no lubrication, so it stays in e-stop until it see's pressure.

I spent a age running airline out to it, and when I came back the display was blank white. I power cycled it and the display didnt come back on, just stayed black.
However I can take a screenshot via TNCreno software on the laptop, so its still alive, just the display itself has gone blank.
It did this a couple of times when power cycling it but always seemed to come back on when power cycled a few times, but this is the longest its been switched on operating for.
I'm hoping it will be back on in the am when its cooled overnight. If it just goes off when it gets hot it could be a component overheating hopefully in the panel psu & another diy fix.



Via the magic of remote screenshot downloads to the laptop, I cleared the air pressure warning, and then got one of "Y axis on hard limit switch". Probably the table shifted when we were moving it or someone ran it into the endstops at max velocity putting it past the soft limit area.
On my bridgeport cnc I just turn off the DC psu so the steppers arent active and reach down and rotate the pulley that moves the leadscrew, so I have to research how to do the equivalent on this tonight.

Its also doing something related to the toolchanger when I press the button that turns on the computer. With air pressure I hear a thunk when I press it but nothing really happens and I cant see the screen for any messages. Maybe its the manual tool release button.I'm imaginging that the tool in the spindle nose might be stuck and air wasnt high enough to release it, seeing as it was in there when I first bought it years ago.

 

[awemawson]

Excellent!

 

[Woody.v8]

Ah! more progress!
It looks totally different with the new software on. And the alarm about air pressure in the top left corner is also exciting, because it means the plc is running, and checking safety switches and levels.
It wont run with low air pressure because it runs the toolchanger & the dropsa oiling unit. So no air pressure, no lubrication, so it stays in e-stop until it see's pressure.

I spent a age running airline out to it, and when I came back the display was blank white. I power cycled it and the display didnt come back on, just stayed black.
However I can take a screenshot via TNCreno software on the laptop, so its still alive, just the display itself has gone blank.
It did this a couple of times when power cycling it but always seemed to come back on when power cycled a few times, but this is the longest its been switched on operating for.
I'm hoping it will be back on in the am when its cooled overnight. If it just goes off when it gets hot it could be a component overheating hopefully in the panel psu & another diy fix.

View attachment 529684

Via the magic of remote screenshot downloads to the laptop, I cleared the air pressure warning, and then got one of "Y axis on hard limit switch". Probably the table shifted when we were moving it or someone ran it into the endstops at max velocity putting it past the soft limit area.
On my bridgeport cnc I just turn off the DC psu so the steppers arent active and reach down and rotate the pulley that moves the leadscrew, so I have to research how to do the equivalent on this tonight.

Its also doing something related to the toolchanger when I press the button that turns on the computer. With air pressure I hear a thunk when I press it but nothing really happens and I cant see the screen for any messages. Maybe its the manual tool release button.I'm imaginging that the tool in the spindle nose might be stuck and air wasnt high enough to release it, seeing as it was in there when I first bought it years ago.

You have the patience of a Saint, many would have given up much earlier, I like it! Keep up the good work

 

[jmp49]

Not so much patience, as dogged stubborness and not knowing when to give up if you ask people that really know me.

Today the control monitor didnt work even after cooling overnight, it just came back on white again, but we have the download screenshot option in tncremo to see what's actually going on still.
I took the monitor panel off, after removing one stubborn allen bolt that had been stripped out previous with the method of slot cutting the head and knocking it round, but nothing obvious was wrong, so parked it until a later date.I think (hope) its probably the panel driver gone bad. I have some thread out on a heidenhain forum about how to diagnose it deeper, and its apparently a vga connected monitor, although the guy saying it has answered other questions wrongly, so it could just be a answers guy using chatgpt. I'll have a look at the signals with the scope, I think it probably will need a rare 15khz capable vga monitor to work since its so old, but hey, I fix vintage computers for fun and have one to hand. TSubis make a aftermarket display panel that does the same, modern tft, more efficient psu, and over a grand + tax, but they helpfully list the specs it covers and they too specify a low of 15KHz for horizontal frequency. Also found a 10.4" industrial display complete on ali express for very reasonable money, I've fired off a message asking them if its capable of 15khz horizontal frequency, and if it is, I'll probably just graft that in place of it.
I went through the same on my sodick edm. I seem to have a habit of buying very broken cnc machines for bargain prices and fixing them!

But I can fix some of the other issues I know about and use the remote screenshot method to check status's. Which in hindsight after a afternoon of it is a painful way to work.

Tackling the Y axis limit error meant taking off all the machine slideway covers for a poke about, and lots of the allen fasteners were stripped out, I had to slot and punch round 7 of the "naughty things", not a fun job crouching inside the machine cabinet for hours, but that's what I signed up for buying a "untested" project. I wound the table back to the middle manually rotating the y axis screw by hand once it was exposed (same as I do on my bridgeport) and powered on the machine and took a screenshot and the error was still there, oh deary me (family friendly version), its actually broken somehow rather than just wound too far forward...
Fortunately after some meter probing, it turned out to be just the physical limit switch itself stuck in the triggered position, and some spray lube and careful wiggling with a finger restored it to operating state. It'll probably stick the same way again but it'll do for now.

Onward, more excitement, the control finally loaded fully with no red critical errors, and told me to home the axis before proceeding. So I tried, and it said "align tool drum before homing axis".
The toolchanger doesnt seem to want to work or at more accurately I havent figured out HOW it works properly yet despite recourse to the heidenhain user manual because that bits added by Cincinnati Milacron and I dont have a user manual for that side, but I made the drum move towards and away from the spindle simulating a tool change by pushing the test button on its axis motor relays, and by some miracle jogged it into the correct position to proceed. I am guessing its limit switch had stuck too and I just got lucky on position but far from scientific.

Then, anticipating movement at last, I got "axis 6 - Drive error", oh... I'd been waiting for this one to bite but had silently hoped that putting the right config on the machine would address it though I knew deep down it wouldnt, but cut a big complex mess into bitesized chunks and fix them one by one until you stop fixing and everything works right?
The X, Y and Z axis servo motors use Vickers/Kollmorgen/Milacron BDS4 servo amps, and the Y & Z are fine, but the X was showing a overspeed error led on its front. This is almost always down to a encoder error, usually a cable or the encoder itself full of coolant or similar. They have 3 pairs for different wire pairs they use to derive position/speed from then the driver adjust the motor speed to match what you ask it turn at & uses feedback from what the encoder tells it its spinning at to make sure its actually at that speed, if you dont know servos. I think anyway, I'm no servo expert but I added a encoder to my bridgeport on the spindle for rigid tapping so I know the rough basics of why.
You can diagnose a broken wire or shorted encoder with a multimeter set on resistance, so pull the pinouts for the drive from the kollmorgen service literature to identify the wire pairs, and measure the sin/cos/tan pairs of wires with a multimeter, and compare the ohm readings for the X encoder wiring plug at the drive end to the ones on Y & Z. All withn a ohm, oh dear again, no simple broken wire to fix here...
I swapped the X and Z encoders between driver packs, and the error stayed with the drive pack. The X encoder and wiring on the Z pack had no fault lights, meaning the X motor encoder and wiring is good.

Note the word "almost" in that previous statement that its almost always the encoder or wiring...
So today is to try and check the molex socket on the drive itself then if deox-it doesnt fix it magically, remove the drive pack itself, and into the office and decase it and start to look at components on the encoder circuitry on the servo driver itself with the hope its just blown something obvious. A servo pack seems to be about $500 on ebay for a secondhand one, but I fixed the servo pack on my sodick myself so maybe I can get lucky twice. Hopefully there's just some bulged cap or vapourised component to greet me if so. I've primed my wife that we might be spending $500 on a magic box and she didnt overreact or try to knife me with the kitchen knife, so if it looks too involved I might just get it and save masses of awkward work repairing it.

Also on reflection I'm not certain axis 6 is actually that X drive error, it could be the toolchanger axis motor or anything really. I might disconnect the x drive completely and just put a jumper in the fault indicator pins of the plug up to the logic unit so the machine thinks it has a working x axis connected just to get past it, and if it doesnt, I can look elsewhere while gathering info for the bds4 repair at my lesuire...

 

[jmp49]

Well the logic engine's rs-232 has poo'd the bed again and wont communicate to do screenshots, I guess that it did have a dry joint that I missed thats now manifesting itself once its in the cold workshop overnight, so I once again took the logic engine out the machine cabinet ready to poke round with a scope. I've got the two other spare rs-232 chips as I ordered 3 so I had spares if I mucked it up. Given they were sourced from ali express its possible the ic was dodgy to start with.
I woudnt need to do this if the monitor was working as its got ethernet for dnc, rs-232 would just be a nice to have now its installed. The tnc and logic unit is still alive and its lighting status leds on the pendant and doing "things", I just have no way of seeing what the screen message is to progress.

Down the monitor rabbit hole proper too, Its not vga at all, its a 4 bit differential pair transmitted pixel value for rgb and you can see a bunch of DS90C032's next to the port, which are quad differential serial handlers, so effectively bespoke rs422 channels carrying video signal data in 4 bit binary form and the service guide pin names correlates with that too.If I'd hooked that to a vga monitor there'd be this fatooom noise and magic smoke escaping from sensitive electronics. I wish people wouldnt paste some nonsense without knowing the subject.

There's also test points for 5v, and some status leds. The "Res" and "5v" leds light, but the "Disp" led is not lit. Poking about one of the 5v test points is not showing 5v either, and that traces back to the 74HCT132D 14 pin ic at the top right of the photo, which is a quad gate nand smit trigger, & I think is triggered from the pixel clock being present. The same ic also triggers the DISP light to be lit, or not in this case.
I think whats happening is the pixel clock isnt working to trigger the circuit, I took time out to pull the "monitor" cable out the machine cabinet runway along with the tnc and panel so I'll rig it up on the test bench next and check signals with the oscilloscope. I have no idea what those optocoupler's next to the circled 5v test point are doing, they dont trace to the test point despite being right next to it, and this bothers me slightly...
It could still be the logic unit (which probably also has some differential signal network chips, and given the rs232 and rs422 ports have blown the same chips...), the cable (which is about 6m long) or the display (potentially one of its differential driver IC's has gone poorly), but at least I'm starting to understand it now instead of blindly throwing parts at it till it works.

Ive taken out the bds4 drive amplifier completely, and put a jumper in between pins 20 and 10 on connector C1, which in theory is the drive up signal contact that tells the control everything is happy. It's going to lie to the machine that the X axis is tickety boo enough to test more I hope, if I can find a way to actually see the output I could get it to the next stage without fixing the amplifier itself (although I couldnt move in X obviously...) I have found and downloaded the kollmorgen bds4 drive service manual, and its very comprehensive with circuit diagrams and logic tables etc how it works.
I'll tackle the bds4 amplifier repair itself tomorrow, the encoder circuitry is all on a small daughter board away from the main power side, and it has more of those differential signal IC's that popped in the rs422 interface, and potentially in the video link too. Apparently they go soft with age and fail. I should probably bulk buy them at this rate.

Also worked out its in E-Stop, there's a din rail mount cisse "safety relay", which cuts about 4 circuits and is wired to masses of places that can put it in e-stop, so panel stop button, the main & swarf cleanout side doors not being detected closed, the pendant, a wiring issue or various other places. The wiring schematics of it are a bit incomprehensible to me, it keeps jumping between pages in the wiring diagram book and I keep coming across jumpers somoenes put in the wiring panels bypassing things so there probably was issues in the estop circuits. So I did the sensible thing and said to myself "hold my beer and watch this" and jumpered the whole estop mechanism.
At that point pressing the master start on the panel for a few seconds generates a THUNK as the dc rail comes online and the main power bus for the drives is energised, only for it to kick out about 4 seconds later & a fault light to be lit on the spindle drive. I think this is all correct behaviour and I've read online about it being for basic diagnosis and cutting power before it damages something so can be used during fault diagnosis, and maddeningly its probably telling me what the issue with the spindle drive is on the screen that I have no way of seeing. I suspect (really hope...) low oil pressure at a sensor. Or it could be my janky jumper across connector pins to pretend X drive is ok isnt enough, and it needs a actual drive connected and answering to work.

Also the spindle oiler computer is now online (yes it has its own basic control computer running on a pic chip...), its reporting low air pressure and faulting. I've just got a little portable compressor hooked up for testing and I think air pressure is too low for the machine's oiler requirement but I cant see how to adjust the cutout pressure on the compressor itself for higher tank pressures. I'll run a airline from the main workshop compressor that has a physical nema valve I can tweak high enough.

If your reading this lot thinking "what a weird load of over complex proprietory crap", we're in accord... But at least I'll have tested nearly everything on the machine when I finally get it up and running on this control, and I'll understand how its all wired and works. Which will make the job of converting it to linuxcnc a lot easier, and will eliminate the real underlying problem of 20 year old circuitry dying randomly.