I can vouch for Yaskawa: 40 axis off a single controller - no problem at all; it can do up to 256 axes as a matter of fact. BTW, you won't find any information about this PLC (MP2200) on Yaskawa web site - they do have strange marketing habits. Just call and ask for a demo, they'll be happy to oblige. Their trademark "pencil-lead" application is sure to impress (6 axis in sychronous motion keep a thin and fragile pencil lead intact).
There are several ways to program motion: from pure ladder logic (set registers so and so to values so and so) to IEC-like motion blocks to text-based motion programs which run apart from ladder. Fully functional online editing is supported; the only nuisance is the need to save everything to flash when done (it can be done without stopping the controller though).
Average scan time is usually between 2 and 5 ms; it depends on how much code one puts into the high-priority task. Communications between the controller and the servo drives can be done at either 1 ms or 2 ms scan time; the difference is how many communications modules to put into the PLC rack (for 1 ms scan there could be no more than 8 servos on the network drop; for 2 ms - up to 20). Networking hardware is a snap - literally: the cables look very much like USB cables, no need to cut and terminate - just plug'em in.
The software... well, how should I put it? It is very Japanese: powerful yet not quite intuitive. The learning curve may be steep, but then it just grows on you. Yes, it is all address-based, no symbol programming; each axis does use a fixed memory area and all addressing is actually in hex. If you used to work with symbolic programming, this is not for faint-hearted.
The latest release of Pro-face touchscreens (GP3000 series) now finally supports Yaskawa communications via Ethernet, so your bases regarding HMI would be covered. There is also a KEPware driver available, if you prefer to go that way.
BTW, we now use Yaskawa I/O in the PLC rack just for few time-critical inputs; everything elese works just fine off Beckhoff Devicenet I/O - Yaskawa has a Devicenet master module and 5 to 7 ms scan times are fast enough for us. It actually makes a pretty nice match (Yaskawa has network I/O modules that work on the same bus as the servos, but they are only 64in/64 outs - not flexible enough...) They also have a Profibus module, but can only be a slave. Ethernet is available but not for real-time I/O operations (although Modbus TCP/IP is supported - great for Cognex cameras if you use those).
The support has always been good, although their manuals may sometimes be hard to read (Jenglish, you know). Unfortunately, ther PLC guru in their Illinois US headquarters just left home for Japan upon having completed his US stint; I don't know yet how good is the new guy is.
This is a serious controller for serious, short of true CNC, business - it is being used by Fuji chip placers, for example (if you ever seen one, you know what is involved).