I did some prodding of the interfaces over the weekend. This machine has two auxilliary I/O boards called the "AUF" (auxilliary functions) and the "LCTCAUF" (Low Cost Tool Change AUF), both of which are connected over serial. The maint manual describes the interface to these but there are already some discrepancies. The manual said they were 9600 bps and used RS485 in a multidrop config. They clearly use 38400bps and are RS422 with independent TX/RX pairs to either board. The boards appear to support RS485 but this machine doesn't use that configuration. If more than two are required maybe it was supported.
In any case the protocol was not as obvious as I was hoping. In both cases the units send packets to each other that start with a unique packet magic byte (0x23 or 0x29 for the AUF and 0x26 for the LCTLAUF), payload bytes that all appear to be 0x3_ or 0x6_ and some sort of checksum byte that is always 0x4_. The packets are firing at about 50Hz. The 4 bit "checksum" appears to be additive in some way but I have not been able to discern the algorithm used. Turning the coolant on off caused a single bit to flip on the outbound packet to the AUF as well as a change in the checksum byte. The LCTLAUF has a fairly small outbound packet but also has a counter in the packets for some reason. Decoding all the error states in particular might be a challenge. An AUF packets at startup for the curious:
Although elegant to reverse engineer these and have a "wiring free" conversion I'm sure it would be easier to replace or modify these boards with Mesa Smart Serial I/O endpoints. It is quite nice to be able to switch back and force between controls though easily especially if the conversion takes a while. Something to ponder.