7 PDF

This manual:
Front cover
WESTRACE
Application Manual
for WESTRACE MkI
WRTOAPPM
Issue 11.0
Contacting Invensys Rail
CONTACTING INVENSYS RAIL
W http://www.invensysrail.com
Asia Pacific - Mainline

ABN 78 000 102 483
380 Docklands Drive Docklands Victoria 3008 Australia
T +61 1300 724 518
F +61 3 9616 9001
E [email protected]
Asia Pacific - Metro

Invensys Building Level 3 15 Changi Business Park Central 1 Singapore 486057
T +65 6829 8783
F +65 6829 8302
E [email protected]
India
No. 112–114 Raheja Chambers 12 Museum Road Bangalore 560001 Karnataka India
T +91 80 3058 8763/64
F +91 80 3058 8765
North America
2400 Nelson Miller Parkway Louisville Kentucky 40223 USA
T +1 502 618 8800
F +1 502 618 8810
E [email protected]
Spain, Portugal and Latin America

Avda. de Castilla Apartado de Correos 6 Parque Empresarial (Edif Grecia)
28830 San Fernando de Henares Madrid Spain
T +34 9 1675 4212
F +34 9 1656 9840
E [email protected]
UK and Northern Europe

PO Box 79 Pew Hill Chippenham Wiltshire SN15 1JD UK
T +44 1249 44 1441
F +44 1249 65 2322
E [email protected]
WESTRACE
Application Manual
for WESTRACE MkI
Document CI: WRTOAPPM
Issue: 11.0
Date of Issue: 12 December 2011
Change History:
Issue Date Comment Changed Checked Approved
1.0 18/11/94 Draft. Subject to change without
notice.
2.0 8/10/96 CR318, 328, 329, 331
3.0 15/10/98 CR253, 266, 267, 268, 269, 342, 379, DC
388, 402, 408, 424, 439, 448, 464, 467
4.0 25/9/00 CR488, 508, 513, 514, 515, 626, 726, PGB
746,764
5.0 10/9/02 CR783, 790 PGB
6.0 20/2/03 CR284 PGB
7.0 24/6/03 CR820 PGB SR, WMcD WMcD
8.0 12/9/05 CR325, 339, 353, 372, 340, 344, 345, ML SR WMcD
378
9.0 7/2/06 CR406 ML SR WMcD
10.0 29/1/07 CR423, 426, 428, 429, 430, 431, 433 ML SR WMcD
11.0 12/12/11 Fixes and improvements throughout; ML WMcD WMcD
updated branding
Copyright
This document is protected by Copyright and all information contained therein is confidential. The contents of
this document must not be copied and the information therein must not be used, or disclosed except with the
written permission of and in the manner permitted by Invensys Rail.
Copyright © 2011 Invensys Rail Pty Ltd ABN 78 000 102 483
Invensys Rail
Preface
Safety Warning
Responsibility
PREFACE
This is the Application Manual for WESTRACE Vital Signalling Equipment.
WESTRACE equipment is designed to be used for railway signalling

purposes and, as such, safety is of paramount importance.
Safety Warning
WESTRACE MkI equipment is designed to be used for railway signalling
purposes and, as such, safety is of paramount importance.
SAFETY WESTRACE MkI is a safety-critical system.

WESTRACE MkI equipment must be configured, installed and
maintained in accordance with the rules and guidelines provided in this
WARNING manual and the manuals to which it refers.
Responsibility
Note: The Railway Operating Authority is responsible for ensuring a safe

maintenance environment and a safe manual operating environment in
the event of a failed interlocking.
WESTRACE MkI Application Manual Issue 11.0 v

Invensys Rail
Table of Contents
TABLE OF CONTENTS
CHAPTER PAGE
1 Introduction
1.1 New in This Issue . . . . . . . . . . . . . . . . . . . . . . . 1-1
1.2 Purpose of Manual . . . . . . . . . . . . . . . . . . . . . . . 1-1
1.3 Scope . . . . . . . . . . . . . . . . . . . . . . . . . . . 1-1
1.4 References . . . . . . . . . . . . . . . . . . . . . . . . . 1-2
1.5 Relationship with Other Manuals . . . . . . . . . . . . . . . . . . 1-3
1.6 Conventions . . . . . . . . . . . . . . . . . . . . . . . . . 1-3
1.7 Organisation of this Manual . . . . . . . . . . . . . . . . . . . 1-4
1.8 Terminology . . . . . . . . . . . . . . . . . . . . . . . . . 1-5
2 System Design
2.1 Introduction . . . . . . . . . . . . . . . . . . . . . . . . . 2-1
2.2 Design Process . . . . . . . . . . . . . . . . . . . . . . . . 2-1
2.2.1 Determine Suitability . . . . . . . . . . . . . . . . . . . 2-3
2.2.2 Design the Architecture . . . . . . . . . . . . . . . . . . 2-4
2.2.3 Determine System Requirements . . . . . . . . . . . . . . . 2-5
2.2.3.1 Vital Logic Module . . . . . . . . . . . . . . . . . 2-5
2.2.3.2 Diagnostic Module . . . . . . . . . . . . . . . . 2-6
2.2.3.3 Non-Vital Communications . . . . . . . . . . . . . . 2-7
2.2.3.4 Vital Communications—Serial . . . . . . . . . . . . . 2-7
2.2.3.5 Vital Communications—Network . . . . . . . . . . . . 2-7
2.2.3.6 Vital Parallel I/O . . . . . . . . . . . . . . . . . . 2-7
2.2.3.7 WESTECT Communications Module . . . . . . . . . . 2-8
2.2.3.8 Slot Usage . . . . . . . . . . . . . . . . . . . 2-8
2.2.3.9 Module Communication Time . . . . . . . . . . . . . 2-8
2.2.3.10 Estimate Power Supply . . . . . . . . . . . . . . . 2-8
2.2.4 Design the External Interfaces . . . . . . . . . . . . . . . . 2-9
2.2.5 Specify Logic Standards . . . . . . . . . . . . . . . . . . 2-9
2.2.6 Design & Check Application Logic, Inputs and Outputs . . . . . . . 2-9
2.2.6.1 Vital Logic . . . . . . . . . . . . . . . . . . . . 2-9
2.2.6.2 Non-Vital Logic . . . . . . . . . . . . . . . . . . 2-10
2.2.6.3 Inputs and Outputs . . . . . . . . . . . . . . . . 2-10
2.2.7 Approve the Design . . . . . . . . . . . . . . . . . . . 2-10
2.2.8 Test the Logic . . . . . . . . . . . . . . . . . . . . . . 2-10
2.2.9 Assemble and Configure Modules . . . . . . . . . . . . . . 2-11
2.2.10 Install Vital PROM Data or Non-Vital Configuration and Verify . . . . . 2-12
2.2.11 Check and Commission . . . . . . . . . . . . . . . . . . 2-12
2.3 Typical System Block Diagrams . . . . . . . . . . . . . . . . . . 2-13
3 System Application
3.1 WESTRACE Components . . . . . . . . . . . . . . . . . . . . 3-1
3.2 Allocating Modules . . . . . . . . . . . . . . . . . . . . . . 3-6
3.2.1 System Capacity . . . . . . . . . . . . . . . . . . . . . 3-6
3.2.1.1 Logic Processing . . . . . . . . . . . . . . . . . 3-6
3.2.1.2 Limits on Number of Modules . . . . . . . . . . . . . 3-6
3.2.1.3 Communication Time Limits . . . . . . . . . . . . . 3-7
3.2.1.4 Housings System Conventions . . . . . . . . . . . . 3-8
3.2.1.5 Slot Availability . . . . . . . . . . . . . . . . . . 3-9
3.3 Power Supply . . . . . . . . . . . . . . . . . . . . . . . . 3-10
3.3.1 Calculating Power Requirements . . . . . . . . . . . . . . . 3-11
3.3.1.1 Determine the Number of PSUs . . . . . . . . . . . . 3-11
3.3.1.2 Determine Power Consumption . . . . . . . . . . . . 3-11
3.4 Fusing . . . . . . . . . . . . . . . . . . . . . . . . . . . 3-13
3.5 Network Communication . . . . . . . . . . . . . . . . . . . . 3-14
WESTRACE MkI Application Manual Issue 11.0 vii

Contents
3.6 Vital Communication Over a Network . . . . . . . . . . . . . . . 3-15

3.6.1 Data Integrity . . . . . . . . . . . . . . . . . . . . . 3-15
3.6.2 Compatibility . . . . . . . . . . . . . . . . . . . . . 3-15
3.6.3 Time and Sequence Integrity . . . . . . . . . . . . . . . . 3-16
3.6.4 Loss of Communication (LOC) . . . . . . . . . . . . . . . 3-17
3.6.4.1 Session Failures . . . . . . . . . . . . . . . . . 3-17
3.6.4.2 LOC Time-out Period . . . . . . . . . . . . . . . 3-17
3.6.5 Communication Media . . . . . . . . . . . . . . . . . . 3-19
3.6.5.1 Hacking . . . . . . . . . . . . . . . . . . . . 3-19
3.6.5.2 Excessive Network Traffic . . . . . . . . . . . . . . 3-19
3.7 Non-Vital Communication Over a Network . . . . . . . . . . . . . 3-20
3.7.1 Data Integrity . . . . . . . . . . . . . . . . . . . . . 3-20
3.7.2 Time and Sequence Integrity . . . . . . . . . . . . . . . . 3-20
3.7.3 Loss of Communication (LOC) . . . . . . . . . . . . . . . 3-21
3.7.3.1 Session Failure . . . . . . . . . . . . . . . . . 3-21
3.7.3.2 LOC Timeout Period . . . . . . . . . . . . . . . 3-21
3.8 Vital Serial Interfaces to WESTRACE . . . . . . . . . . . . . . . . 3-22
3.8.1 Data Integrity . . . . . . . . . . . . . . . . . . . . . 3-22
3.8.2 Compatibility . . . . . . . . . . . . . . . . . . . . . 3-22
3.8.3 Timing . . . . . . . . . . . . . . . . . . . . . . . . 3-23
3.8.4 Link Failures . . . . . . . . . . . . . . . . . . . . . . 3-23
3.8.5.1 Storage and Re-transmission . . . . . . . . . . . . 3-24
3.8.5.2 Link Cross Talk . . . . . . . . . . . . . . . . . 3-24
3.8.5.3 Hacking . . . . . . . . . . . . . . . . . . . . 3-24
3.8.5.4 Messages Routed to Wrong Destination . . . . . . . . 3-25
3.9 Hot Standby . . . . . . . . . . . . . . . . . . . . . . . . 3-26
3.9.1 Order of Power-Up . . . . . . . . . . . . . . . . . . . 3-26
3.9.2 Changeover . . . . . . . . . . . . . . . . . . . . . . 3-27
3.9.3 General Application Information . . . . . . . . . . . . . . 3-27
3.9.3.1 Loss of Communication Extension During Changeover . . . 3-27
3.9.3.2 NCDM Reserved States—Online . . . . . . . . . . . 3-28
3.9.3.3 NCDM Reserved States—Standby . . . . . . . . . . . 3-28
3.9.3.4 VLM6 Reserved States . . . . . . . . . . . . . . . 3-28
3.9.4 Hot Standby Configuration using WNCM . . . . . . . . . . . 3-29
3.9.5 Hot Standby Configuration Using VLM5 . . . . . . . . . . . . 3-31
3.9.6 Hot Standby Configuration Using HVLM128 . . . . . . . . . . 3-32
3.10 Installation Performance Times . . . . . . . . . . . . . . . . . . 3-33
3.10.1 System Response Times . . . . . . . . . . . . . . . . . 3-33
3.11 Installation Reversion Times . . . . . . . . . . . . . . . . . . . 3-36
3.12 Reactive Fail Safety . . . . . . . . . . . . . . . . . . . . . . 3-38
3.12.1 Fleeting Output Duration . . . . . . . . . . . . . . . . . 3-38
3.12.2 Application Rules . . . . . . . . . . . . . . . . . . . . 3-39
3.12.2.1 Overall Wrong Side Failure . . . . . . . . . . . . . 3-39
3.12.2.2 Insufficient Response Time . . . . . . . . . . . . . 3-39
3.12.2.3 Prevent False Energising . . . . . . . . . . . . . . 3-39
3.12.2.4 Illegal Signal Aspects . . . . . . . . . . . . . . . 3-39
3.12.3 Reliability and Availability . . . . . . . . . . . . . . . . . 3-39
3.12.4 Application Guidance . . . . . . . . . . . . . . . . . . 3-40
3.12.4.1 General . . . . . . . . . . . . . . . . . . . . 3-40
3.12.4.2 Output Loads Driven by VROM . . . . . . . . . . . . 3-40
3.12.4.3 Output Loads Driven by VLOM . . . . . . . . . . . . 3-40
viii Invensys Rail

Contents
4 Module Application
4.1 Vital Logic Module . . . . . . . . . . . . . . . . . . . . . . . 4-1
4.1.1 Module Components . . . . . . . . . . . . . . . . . . . 4-1
4.1.2 External Connections—VLM6, VLM5 and HVLM . . . . . . . . . . 4-2
4.1.3 External Connections—VLM1 . . . . . . . . . . . . . . . . 4-4
4.1.4 Restart Circuit . . . . . . . . . . . . . . . . . . . . . . 4-5
4.1.5 WESTRACE Address . . . . . . . . . . . . . . . . . . . 4-8
4.1.6 Setting WESTRACE Operational Mode . . . . . . . . . . . . . 4-8
4.1.7 Setting Version Number of the Application Data . . . . . . . . . 4-8
4.1.8 Output Power Control Relay (OPCR) . . . . . . . . . . . . . . 4-9
4.1.8.1 Type of Relay for Use as the OPCR . . . . . . . . . . . 4-9
4.1.8.2 OPCR Contact Rating . . . . . . . . . . . . . . . . 4-10
4.1.8.3 OPCR Repeater Relays . . . . . . . . . . . . . . . 4-10
4.1.8.4 Providing Energised Outputs . . . . . . . . . . . . . 4-11
4.1.8.5 Control of Multiple Equipment . . . . . . . . . . . . 4-11
4.1.8.6 Exercising the OPCR . . . . . . . . . . . . . . . . 4-11
4.1.9 Vital Serial Enable Voltage (VSEV) . . . . . . . . . . . . . . . 4-12
4.2 Vital Lamp Output Modules (VLOM) . . . . . . . . . . . . . . . . 4-14
4.2.2 External Connections . . . . . . . . . . . . . . . . . . . 4-14
4.2.3 Specific Application Rules . . . . . . . . . . . . . . . . . 4-16
4.2.3.1 Output Capability . . . . . . . . . . . . . . . . . 4-16
4.2.3.2 Limitation of Lamp Types . . . . . . . . . . . . . . 4-16
4.2.3.3 Internal Fusing . . . . . . . . . . . . . . . . . . 4-16
4.2.3.4 External Fusing of Outputs . . . . . . . . . . . . . . 4-16
4.2.3.5 Fusing of VLOM Signalling Supply . . . . . . . . . . . 4-16
4.2.3.6 Return Sense Cabling . . . . . . . . . . . . . . . . 4-17
4.2.3.7 Cold Filament Detection . . . . . . . . . . . . . . 4-17
4.2.3.8 Filament Proving . . . . . . . . . . . . . . . . . 4-17
4.2.3.9 Failure of Single Red Lamp Driver Output . . . . . . . . 4-18
4.2.3.10 Lamp Voltage . . . . . . . . . . . . . . . . . . 4-18
4.2.3.11 Use of Signalling Multicore Cable . . . . . . . . . . . 4-18
4.2.3.12 Backfeeds into Outputs . . . . . . . . . . . . . . . 4-18
4.2.3.13 VLOM Hot Standby . . . . . . . . . . . . . . . . 4-19
4.2.3.14 Driving LED Signals . . . . . . . . . . . . . . . . 4-20
4.2.3.15 Earth Leakage . . . . . . . . . . . . . . . . . . 4-21
4.3 Vital Relay Output Module (VROM) . . . . . . . . . . . . . . . . . 4-22
4.3.2.1 Commoned Outputs . . . . . . . . . . . . . . . . 4-22
4.3.2.2 Earthing . . . . . . . . . . . . . . . . . . . . 4-23
4.3.3.1 Internal Fusing . . . . . . . . . . . . . . . . . . 4-23
4.3.3.2 External Fusing of Outputs . . . . . . . . . . . . . . 4-23
4.3.3.3 Fusing of VROM Signalling Supply . . . . . . . . . . . 4-23
4.3.3.4 Maximum Load and Bipolar Operation . . . . . . . . . 4-23
4.3.3.5 Vital Relay Output . . . . . . . . . . . . . . . . . 4-23
4.3.3.6 External Signalling Supply . . . . . . . . . . . . . . 4-24
4.3.3.7 Use of Signalling Multicore Cable . . . . . . . . . . . 4-24
4.3.3.8 Backfeeds into Outputs . . . . . . . . . . . . . . . 4-24
4.3.3.9 VROM Hot Standby . . . . . . . . . . . . . . . . 4-24
4.4 Vital Parallel Input Module (VPIM) . . . . . . . . . . . . . . . . . 4-26
4.4.3.1 VPIM Input Limits, ac Immunity and Internal Fusing . . . . . 4-27
4.4.3.2 DC Immunity of VPIM Inputs . . . . . . . . . . . . . 4-27
4.4.3.3 Fleeting or Intermittent Inputs . . . . . . . . . . . . . 4-27
4.4.3.4 Inputs Driven from Outputs . . . . . . . . . . . . . 4-28
4.4.3.5 Bipolar Inputs . . . . . . . . . . . . . . . . . . 4-28
4.4.3.6 Wiring to Inputs . . . . . . . . . . . . . . . . . . 4-28
WESTRACE MkI Application Manual Issue 11.0 ix

Contents
4.5 WESTECT Communication Module (WCM) . . . . . . . . . . . . . 4-29

4.5.1 Module Components . . . . . . . . . . . . . . . . . . 4-29
4.5.2 External Connections . . . . . . . . . . . . . . . . . . 4-29
4.5.3.1 Communication Medium . . . . . . . . . . . . . . 4-30
4.5.3.2 Earthing of Signal Ground Line . . . . . . . . . . . . 4-30
4.6 EVTC and VTC . . . . . . . . . . . . . . . . . . . . . . . . 4-31
4.6.3.1 Communication Medium . . . . . . . . . . . . . . 4-32
4.6.3.2 Reversion . . . . . . . . . . . . . . . . . . . 4-32
4.6.3.3 Implications of Failure of EVTC (or VTC) Links . . . . . . 4-32
4.6.3.4 Connection to Other Communication Systems . . . . . . 4-33
4.6.3.6 Inter-System Communications . . . . . . . . . . . . 4-33
4.7 Network Communication Diagnostic Module (NCDM) . . . . . . . . . 4-36
4.7.2.1 Serial Power Connection (Con3) . . . . . . . . . . . 4-39
4.7.2.2 Installation Status Connection (Con4) . . . . . . . . . 4-40
4.7.2.3 Network Connection . . . . . . . . . . . . . . . 4-40
4.7.2.4 Serial Connections . . . . . . . . . . . . . . . . 4-41
4.7.2.5 Production Port . . . . . . . . . . . . . . . . . 4-45
4.7.3 Redundant Serial Port Interface for Control Systems . . . . . . . . 4-46
4.7.3.1 WSA/S2 Slave . . . . . . . . . . . . . . . . . . 4-46
4.7.3.2 WSL/S2 Slave . . . . . . . . . . . . . . . . . . 4-46
4.7.4 Hardware Settings . . . . . . . . . . . . . . . . . . . 4-47
4.7.5 Non-Vital Configuration Settings . . . . . . . . . . . . . . 4-47
4.7.6 Specific Network Port Application Rules . . . . . . . . . . . . 4-48
4.7.6.1 Operating Distance Restrictions . . . . . . . . . . . 4-48
4.7.6.2 Timeout . . . . . . . . . . . . . . . . . . . . 4-48
4.7.6.3 Network Storm Limitation . . . . . . . . . . . . . . 4-48
4.7.7 Specific Serial Port Application Rules . . . . . . . . . . . . . 4-50
4.7.7.3 Timeout . . . . . . . . . . . . . . . . . . . . 4-51
4.7.7.4 Recommended Modem . . . . . . . . . . . . . . 4-51
4.8 Non-Vital Communications and Diagnostic Module (NVC/DM) . . . . . . 4-52
4.8.2.1 Serial Power Connection . . . . . . . . . . . . . . 4-55
4.8.2.2 Diagnostic and Telemetry Serial Connections . . . . . . 4-55
4.8.2.3 Production Port . . . . . . . . . . . . . . . . . 4-59
4.8.3 Redundant Telemetry . . . . . . . . . . . . . . . . . . 4-60
4.8.3.1 WSA/S2 Slave . . . . . . . . . . . . . . . . . . 4-60
4.8.3.2 WSL/S2 Slave . . . . . . . . . . . . . . . . . . 4-60
4.8.4 Hardware Settings . . . . . . . . . . . . . . . . . . . 4-61
4.8.5 Non-Vital Configuration Settings . . . . . . . . . . . . . . 4-61
4.8.6.3 Timeout . . . . . . . . . . . . . . . . . . . . 4-63
4.9 Non-Vital Communications Module (NVC) . . . . . . . . . . . . . . 4-64
4.9.2.1 RS232C Connections . . . . . . . . . . . . . . . 4-67
4.9.2.2 RS422 Connections . . . . . . . . . . . . . . . . 4-68
4.9.3 NVC Configuration . . . . . . . . . . . . . . . . . . . 4-71
x Invensys Rail
Contents

4.9.4.1 Two NVCs Used as a Pair . . . . . . . . . . . . . . 4-71
4.9.4.2 NVC Used for Vital Serial Channels . . . . . . . . . . . 4-71
4.9.4.3 NVC Used for Non-Vital Serial Channels . . . . . . . . . 4-71
4.10 DM and DM128 . . . . . . . . . . . . . . . . . . . . . . . . 4-72
4.10.3 Event Recorder Interface (ERI) . . . . . . . . . . . . . . . . 4-73
4.10.3.1 Signal . . . . . . . . . . . . . . . . . . . . . 4-73
4.10.3.2 Electrical . . . . . . . . . . . . . . . . . . . . 4-73
4.10.3.3 Functional . . . . . . . . . . . . . . . . . . . . 4-73
4.10.3.4 Procedural . . . . . . . . . . . . . . . . . . . 4-73
4.10.4 Diagnostic Interface (DI) . . . . . . . . . . . . . . . . . . 4-74
4.10.4.1 Signal . . . . . . . . . . . . . . . . . . . . . 4-74
4.10.4.2 Electrical . . . . . . . . . . . . . . . . . . . . 4-74
4.10.4.3 Functional . . . . . . . . . . . . . . . . . . . . 4-74
4.10.4.4 Procedural . . . . . . . . . . . . . . . . . . . 4-74
4.10.5 Setting Data Transfer Rate, Language, Echo . . . . . . . . . . . 4-74
4.11 Power Supply Unit (PSU) . . . . . . . . . . . . . . . . . . . . . 4-75
4.11.3 External 24 Vdc Supply . . . . . . . . . . . . . . . . . . 4-75
4.11.4.1 Earthing of External Supply . . . . . . . . . . . . . . 4-75
4.11.4.2 Internal Logic Supplies . . . . . . . . . . . . . . . 4-75
4.12 Vital Logic Equipment Backplane (BPLANE) . . . . . . . . . . . . . . 4-76
4.12.1 Backplane Addressing . . . . . . . . . . . . . . . . . . . 4-76
4.12.2 Connection of !RESET . . . . . . . . . . . . . . . . . . . 4-76
4.12.3 Backplane Continuity . . . . . . . . . . . . . . . . . . . 4-76
4.12.4 Multiple Card Housing Systems . . . . . . . . . . . . . . . 4-77
4.12.4.1 Maximum Link Lengths . . . . . . . . . . . . . . . 4-77
4.12.4.2 PSU Rails . . . . . . . . . . . . . . . . . . . . 4-77
4.12.4.3 Physical Connections . . . . . . . . . . . . . . . . 4-78
4.13 Surge Arresters . . . . . . . . . . . . . . . . . . . . . . . . 4-81
5 Installing WESTRACE
5.1 Earthing and Bonding Practice . . . . . . . . . . . . . . . . . . 5-1
5.1.1 Definitions . . . . . . . . . . . . . . . . . . . . . . . 5-1
5.1.2 General . . . . . . . . . . . . . . . . . . . . . . . . 5-1
5.1.3 Provision of Earth Points . . . . . . . . . . . . . . . . . . 5-2
5.1.3.1 Connection to Earth . . . . . . . . . . . . . . . . 5-2
5.1.3.2 Earth Point . . . . . . . . . . . . . . . . . . . 5-2
5.1.4 Equipment Earthing . . . . . . . . . . . . . . . . . . . 5-3
5.1.5 Earth Wiring . . . . . . . . . . . . . . . . . . . . . . 5-3
5.2 Wiring and Connections . . . . . . . . . . . . . . . . . . . . . 5-5
5.2.1 Interference from Electrical Noise . . . . . . . . . . . . . . . 5-5
5.2.2 Security of Input and Output Wiring . . . . . . . . . . . . . . 5-6
5.2.3 Screened Cable . . . . . . . . . . . . . . . . . . . . . 5-7
5.3 Surge Protection . . . . . . . . . . . . . . . . . . . . . . . 5-8
5.3.1 Selection of Primary Surge Protection . . . . . . . . . . . . . 5-8
5.3.2 Location of Surge Arresters . . . . . . . . . . . . . . . . . 5-9
5.3.3 Earthing of Surge Arresters . . . . . . . . . . . . . . . . . 5-10
5.3.4 PSU Protection . . . . . . . . . . . . . . . . . . . . . 5-10
5.4 Lightning and Surge Protection . . . . . . . . . . . . . . . . . . 5-11
5.5 Environmental Precautions . . . . . . . . . . . . . . . . . . . . 5-12
5.5.1 Electrostatic Sensitive Devices (ESSD) . . . . . . . . . . . . . 5-12
5.5.2 Mobile Phones and Portable Transceivers . . . . . . . . . . . . 5-13
5.5.3 Lithium Batteries . . . . . . . . . . . . . . . . . . . . . 5-13
WESTRACE MkI Application Manual Issue 11.0 xi

Contents
6 Testing and Commissioning

6.1 Testing Precautions . . . . . . . . . . . . . . . . . . . . . . 6-1
6.2 Test Records . . . . . . . . . . . . . . . . . . . . . . . . 6-1
6.3 Simulation . . . . . . . . . . . . . . . . . . . . . . . . . 6-2
6.3.1 GSIM . . . . . . . . . . . . . . . . . . . . . . . . 6-2
6.3.2 ISIM . . . . . . . . . . . . . . . . . . . . . . . . 6-2
6.4 Pre-Test Checks . . . . . . . . . . . . . . . . . . . . . . . 6-3
6.4.1 Earthing and Bonding . . . . . . . . . . . . . . . . . . 6-3
6.4.2 External Wiring . . . . . . . . . . . . . . . . . . . . . 6-3
6.4.3 Power Supplies . . . . . . . . . . . . . . . . . . . . 6-3
6.4.4 External Loads . . . . . . . . . . . . . . . . . . . . . 6-3
6.4.5 Module Checks . . . . . . . . . . . . . . . . . . . . 6-3
6.4.6 System Address . . . . . . . . . . . . . . . . . . . . 6-3
6.4.7 Application Data Version . . . . . . . . . . . . . . . . . 6-3
6.4.8 Module Configuration . . . . . . . . . . . . . . . . . . 6-4
6.5 System Testing . . . . . . . . . . . . . . . . . . . . . . . 6-5
6.5.1 General . . . . . . . . . . . . . . . . . . . . . . . 6-5
6.5.2 Application Logic . . . . . . . . . . . . . . . . . . . . 6-5
6.5.3 Tests . . . . . . . . . . . . . . . . . . . . . . . . 6-5
6.6 Functional and Factory Testing . . . . . . . . . . . . . . . . . . 6-6
6.7 Site Testing . . . . . . . . . . . . . . . . . . . . . . . . . 6-7
6.7.1 Purpose . . . . . . . . . . . . . . . . . . . . . . . 6-7
6.7.2 Records . . . . . . . . . . . . . . . . . . . . . . . 6-7
6.8 Commissioning . . . . . . . . . . . . . . . . . . . . . . . 6-8
6.9 Stageworks . . . . . . . . . . . . . . . . . . . . . . . . . 6-8
Appendix A: Module Descriptions

A.1 Vital Logic Module (VLM6) . . . . . . . . . . . . . . . . . . . A-2
A.1.1 VLM6 Description . . . . . . . . . . . . . . . . . . . . A-2
A.1.1.1 VLM6 Vital Logic Card (VLC6) Description . . . . . . . . A-2
A.1.1.2 VLM6 Output Power Card (OPC) Description . . . . . . . A-3
A.1.1.3 VLM6 Universal Hot Standby Vital Backplane Card (UHVBC)
Description . . . . . . . . . . . . . . . . . . . A-3
A.1.2 VLM6 Configuration . . . . . . . . . . . . . . . . . . . A-5
A.1.2.1 VLM6 Vital Logic Card (VLC6) Configuration . . . . . . . A-5
A.1.2.2 VLM6 Output Power Card (OPC) Configuration . . . . . . A-7
Configuration . . . . . . . . . . . . . . . . . . A-7
A.1.3 VLM6 Indications . . . . . . . . . . . . . . . . . . . . A-7
A.1.3.1 VLM6 Vital Logic Card (VLC6) Indications . . . . . . . . A-7
A.1.3.1.1 Start Up Indications . . . . . . . . . . . . A-7
A.1.3.1.2 Operation Indications . . . . . . . . . . . . A-7
A.1.3.1.3 Fault Codes . . . . . . . . . . . . . . . A-8
A.1.3.2 VLM6 Output Power Card (OPC) Indications . . . . . . . A-15
Indications . . . . . . . . . . . . . . . . . . . A-15
A.1.4 VLM6 External Connections . . . . . . . . . . . . . . . . A-15
A.2.1 VLM5 Description . . . . . . . . . . . . . . . . . . . . A-16
A.2.1.1 VLM5 Vital Logic Card (VLC5) Description . . . . . . . . A-16
A.2.1.2 VLM5 Output Power Card (OPC) Description . . . . . . . A-17
A.2.1.3 VLM5 Hot Standby Vital Backplane Card (HVBC) Description . A-17
A.2.2 VLM5 Configuration . . . . . . . . . . . . . . . . . . . A-19
A.2.2.1 VLM5 Vital Logic Card (VLC5) Configuration . . . . . . . A-19
A.2.2.3 VLM5 Hot Standby Vital Backplane Card (HVBC) Configuration A-21
xii Invensys Rail

Contents
A.2.3 VLM5 Indications . . . . . . . . . . . . . . . . . . . A-21

A.2.3.1 VLM5 Vital Logic Card (VLC5) Indications . . . . . . . . A-21
A.2.3.1.1 Start Up Indications . . . . . . . . . . . . . A-21
A.2.3.1.3 Fault Codes . . . . . . . . . . . . . . . . A-21
A.2.3.3 VLM5 Hot Standby Vital Backplane Card (HVBC) Configuration A-31
A.2.4 VLM5 External Connections . . . . . . . . . . . . . . . . A-31
A.3 Hot Standby Vital Logic Module (HVLM128) . . . . . . . . . . . . . A-33
A.3.1 Description . . . . . . . . . . . . . . . . . . . . . A-33
A.3.1.1 Hot Standby Vital Logic Card (HVLC) . . . . . . . . . A-33
A.3.1.2 Output Power Card (OPC) . . . . . . . . . . . . . A-34
A.3.1.3 Hot Standby Vital Backplane Card (HVBC) . . . . . . . . A-34
A.3.2 Configuration . . . . . . . . . . . . . . . . . . . . . A-36
A.3.3 Indications . . . . . . . . . . . . . . . . . . . . . . A-39
A.3.3.1.3 Fault Codes . . . . . . . . . . . . . . . . A-39
A.3.4 External Connections . . . . . . . . . . . . . . . . . . A-50
A.4.1 Description . . . . . . . . . . . . . . . . . . . . . A-51
A.4.1.1 Vital Logic Card (VLC) . . . . . . . . . . . . . . . A-51
A.4.1.2 Configuration Element Card (CEC) . . . . . . . . . . A-51
A.4.1.4 Vital Backplane Card (VBC) . . . . . . . . . . . . . A-52
A.4.3 Indications . . . . . . . . . . . . . . . . . . . . . . A-53
A.4.3.1.3 Fault Codes . . . . . . . . . . . . . . . . A-54
A.5 Vital Lamp Output Modules (VLOM) . . . . . . . . . . . . . . . A-61
A.5.1 Description . . . . . . . . . . . . . . . . . . . . . A-61
A.5.2 Particulars . . . . . . . . . . . . . . . . . . . . . . A-61
A.5.3 Characteristics of VLOM 110 . . . . . . . . . . . . . . . A-61
A.5.4 Function . . . . . . . . . . . . . . . . . . . . . . . A-61
A.5.6 Indications . . . . . . . . . . . . . . . . . . . . . . A-62
A.5.6.1 Start Up . . . . . . . . . . . . . . . . . . . . A-62
A.5.6.2 Operation . . . . . . . . . . . . . . . . . . . A-62
A.5.6.3 Fault Codes . . . . . . . . . . . . . . . . . . A-62
WESTRACE MkI Application Manual Issue 11.0 xiii

Contents
A.6 Vital Relay Output Modules (VROM) . . . . . . . . . . . . . . . . A-67

A.6.1 Description . . . . . . . . . . . . . . . . . . . . . . A-67
A.6.2 Particulars . . . . . . . . . . . . . . . . . . . . . . A-67
A.6.3 Characteristics of VROM 50 . . . . . . . . . . . . . . . . A-67
A.6.4 Function . . . . . . . . . . . . . . . . . . . . . . . A-67
A.6.6 Indications . . . . . . . . . . . . . . . . . . . . . . A-68
A.6.6.1 Start Up . . . . . . . . . . . . . . . . . . . . A-68
A.6.6.2 Operation . . . . . . . . . . . . . . . . . . . A-68
A.6.6.3 Fault Codes . . . . . . . . . . . . . . . . . . . A-68
A.7 Vital Parallel Input Modules (VPIM) . . . . . . . . . . . . . . . . A-72
A.7.1 Description . . . . . . . . . . . . . . . . . . . . . . A-72
A.7.2 Particulars . . . . . . . . . . . . . . . . . . . . . . A-72
A.7.3 Characteristics of VPIM 50 . . . . . . . . . . . . . . . . . A-72
A.7.4 Function . . . . . . . . . . . . . . . . . . . . . . . A-72
A.7.6 Indications . . . . . . . . . . . . . . . . . . . . . . A-73
A.7.6.1 Start Up . . . . . . . . . . . . . . . . . . . . A-73
A.7.6.2 Operation . . . . . . . . . . . . . . . . . . . A-73
A.7.6.3 Fault Codes . . . . . . . . . . . . . . . . . . . A-73
A.8 Vital Telemetry Continuous Module (VTC) . . . . . . . . . . . . . . A-76
A.8.1 Description . . . . . . . . . . . . . . . . . . . . . . A-76
A.8.2 Particulars . . . . . . . . . . . . . . . . . . . . . . A-76
A.8.3 Function . . . . . . . . . . . . . . . . . . . . . . . A-76
A.8.5 Indications . . . . . . . . . . . . . . . . . . . . . . A-77
A.8.5.1 Start Up . . . . . . . . . . . . . . . . . . . . A-77
A.8.5.2 Operation . . . . . . . . . . . . . . . . . . . A-77
A.8.5.3 Fault Codes . . . . . . . . . . . . . . . . . . . A-77
A.9 Enhanced Vital Telemetry Continuous Module (EVTC) . . . . . . . . . A-80
A.9.1 Description . . . . . . . . . . . . . . . . . . . . . . A-80
A.9.2 Particulars . . . . . . . . . . . . . . . . . . . . . . A-80
A.9.3 Function . . . . . . . . . . . . . . . . . . . . . . . A-80
A.9.5 Indications . . . . . . . . . . . . . . . . . . . . . . A-81
A.9.5.1 Start Up . . . . . . . . . . . . . . . . . . . . A-81
A.9.5.2 Operation . . . . . . . . . . . . . . . . . . . A-81
A.9.5.3 Fault Codes . . . . . . . . . . . . . . . . . . . A-82
A.10 WESTECT Communications Module (WCM) . . . . . . . . . . . . . A-85
A.10.1 Description . . . . . . . . . . . . . . . . . . . . . . A-85
A.10.2 Particulars . . . . . . . . . . . . . . . . . . . . . . A-85
A.10.3 Function . . . . . . . . . . . . . . . . . . . . . . . A-85
A.10.5 Indications . . . . . . . . . . . . . . . . . . . . . . A-85
A.10.5.1Start Up . . . . . . . . . . . . . . . . . . . . A-85
A.10.5.2Operation . . . . . . . . . . . . . . . . . . . A-86
A.10.5.3Fault Codes . . . . . . . . . . . . . . . . . . . A-86
A.11 Network Communication Diagnostic Module (NCDM) . . . . . . . . . A-89
A.11.1 Description . . . . . . . . . . . . . . . . . . . . . . A-89
A.11.2 Particulars . . . . . . . . . . . . . . . . . . . . . . A-90
A.11.2.1Circuit Boards . . . . . . . . . . . . . . . . . . A-90
A.11.2.2External Ports . . . . . . . . . . . . . . . . . . A-90
A.11.2.3Serial Control System Ports or Network Control System Sessions A-91
A.11.2.4Serial Diagnostic Ports or Network Diagnostic Sessions . . . A-92
A.11.2.5Production Port . . . . . . . . . . . . . . . . . A-93
A.11.2.6Serial Power Supply . . . . . . . . . . . . . . . . A-93
A.11.2.7Installation Status . . . . . . . . . . . . . . . . . A-93
xiv Invensys Rail

Contents
A.11.3 Function . . . . . . . . . . . . . . . . . . . . . . . A-94

A.11.4 Operation . . . . . . . . . . . . . . . . . . . . . . A-95
A.11.4.1Selecting Maintenance Mode . . . . . . . . . . . . A-95
A.11.4.2Selecting Production Mode . . . . . . . . . . . . . A-95
A.11.5.1Hardware Settings . . . . . . . . . . . . . . . . A-96
A.11.5.2Non-Vital Configuration . . . . . . . . . . . . . . A-98
A.11.5.3Replacing the NCDM . . . . . . . . . . . . . . . A-98
A.11.5.4Battery Installation . . . . . . . . . . . . . . . . A-102
A.11.6 Indications . . . . . . . . . . . . . . . . . . . . . . A-104
A.11.6.1Network Communication Diagnostic Card LEDs . . . . . A-104
A.11.6.2NCD PFM LEDs . . . . . . . . . . . . . . . . . A-105
A.11.6.3Alphanumeric Display . . . . . . . . . . . . . . . A-105
A.11.6.4Start Up . . . . . . . . . . . . . . . . . . . . A-106
A.11.6.5Operation . . . . . . . . . . . . . . . . . . . A-107
A.11.6.6Fault Detection . . . . . . . . . . . . . . . . . A-107
A.11.6.6.1WESTRACE Module Faults . . . . . . . . . . A-107
A.11.6.6.2NCDM Faults . . . . . . . . . . . . . . . A-108
A.11.6.7Fault Codes . . . . . . . . . . . . . . . . . . A-108
A.11.6.7.1Port Faults . . . . . . . . . . . . . . . . A-109
A.11.6.7.2Module or Session Faults . . . . . . . . . . . A-110
A.11.6.7.3Internal faults . . . . . . . . . . . . . . . A-111
A.11.7.1Serial Power Connector . . . . . . . . . . . . . . A-115
A.11.7.2Installation Status Connector . . . . . . . . . . . . A-116
A.11.7.3Serial Connectors . . . . . . . . . . . . . . . . A-116
A.11.7.4Network Connector . . . . . . . . . . . . . . . A-117
A.11.7.5INCL Connector . . . . . . . . . . . . . . . . . A-117
A.11.7.7Cabling Details . . . . . . . . . . . . . . . . . A-118
A.11.7.8Connecting a Diagnostic System . . . . . . . . . . . A-118
A.12 Non-vital Communications and Diagnostic Module (NVC/DM) . . . . . . A-121
A.12.1 Description . . . . . . . . . . . . . . . . . . . . . A-121
A.12.2 Particulars . . . . . . . . . . . . . . . . . . . . . . A-122
A.12.2.1Circuit Boards . . . . . . . . . . . . . . . . . A-122
A.12.2.2External Ports . . . . . . . . . . . . . . . . . . A-122
A.12.2.4Serial Power Supply . . . . . . . . . . . . . . . A-123
A.12.3 Function . . . . . . . . . . . . . . . . . . . . . . . A-124
A.12.4 Operation . . . . . . . . . . . . . . . . . . . . . . A-125
A.12.4.1Selecting Maintenance Mode . . . . . . . . . . . . A-125
A.12.4.2Selecting Production Mode . . . . . . . . . . . . . A-125
A.12.5.1Hardware Settings . . . . . . . . . . . . . . . . A-125
A.12.5.2Non-Vital Configuration . . . . . . . . . . . . . . A-127
A.12.5.3Replacing the NVC/DM . . . . . . . . . . . . . . A-127
A.12.6 Indications . . . . . . . . . . . . . . . . . . . . . . A-133
A.12.6.1Logic Evaluation Card LEDs . . . . . . . . . . . . . A-133
A.12.6.2Communications Interface Module LEDs . . . . . . . . A-134
A.12.6.3Alphanumeric Display . . . . . . . . . . . . . . . A-134
A.12.6.4Start Up . . . . . . . . . . . . . . . . . . . . A-135
A.12.6.5Operation . . . . . . . . . . . . . . . . . . . A-135
A.12.6.6Fault Detection . . . . . . . . . . . . . . . . . A-136
A.12.6.6.1WESTRACE Module Faults . . . . . . . . . . A-136
A.12.6.6.2NVC/DM Faults . . . . . . . . . . . . . . A-136
A.12.6.7Fault Codes . . . . . . . . . . . . . . . . . . A-137
A.12.6.7.1Port faults . . . . . . . . . . . . . . . . A-137
A.12.6.7.2Telemetry Address Faults . . . . . . . . . . . A-138
A.12.6.7.3Internal faults . . . . . . . . . . . . . . . A-139
WESTRACE MkI Application Manual Issue 11.0 xv

Contents

A.12.7.1Serial Power Connector . . . . . . . . . . . . . . A-142
A.12.7.2Diagnostic and Telemetry Serial Connectors . . . . . . . A-142
A.12.7.5Connecting a Diagnostic System . . . . . . . . . . . A-145
A.13 Non-vital Communications Module (NVC) . . . . . . . . . . . . . . A-147
A.13.1 Description . . . . . . . . . . . . . . . . . . . . . . A-147
A.13.2 Particulars . . . . . . . . . . . . . . . . . . . . . . A-147
A.13.3 Function . . . . . . . . . . . . . . . . . . . . . . . A-147
A.13.4.1Slave Address . . . . . . . . . . . . . . . . . . A-148
A.13.4.2System Bit . . . . . . . . . . . . . . . . . . . A-148
A.13.4.3Telfail . . . . . . . . . . . . . . . . . . . . . A-148
A.13.4.4Data Transfer Rate . . . . . . . . . . . . . . . . A-149
A.13.4.5Data Word Length . . . . . . . . . . . . . . . . A-150
A.13.4.6Modem . . . . . . . . . . . . . . . . . . . . A-150
A.13.4.7Transmit Data Clock . . . . . . . . . . . . . . . . A-150
A.13.4.8Unused . . . . . . . . . . . . . . . . . . . . A-150
A.13.5 Indications . . . . . . . . . . . . . . . . . . . . . . A-151
A.13.5.1Start Up . . . . . . . . . . . . . . . . . . . . A-151
A.13.5.2Operation . . . . . . . . . . . . . . . . . . . A-151
A.13.5.3Fault Codes . . . . . . . . . . . . . . . . . . . A-151
A.13.6.1RS232-C Connections . . . . . . . . . . . . . . . A-153
A.13.6.2RS422 Connections . . . . . . . . . . . . . . . . A-153
A.14 Diagnostic Module (DM) . . . . . . . . . . . . . . . . . . . . A-155
A.14.1 Description . . . . . . . . . . . . . . . . . . . . . . A-155
A.14.2 Particulars . . . . . . . . . . . . . . . . . . . . . . A-155
A.14.3 Function . . . . . . . . . . . . . . . . . . . . . . . A-155
A.14.4 Operation . . . . . . . . . . . . . . . . . . . . . . A-155
A.14.6 Indications . . . . . . . . . . . . . . . . . . . . . . A-157
A.14.6.1Start Up . . . . . . . . . . . . . . . . . . . . A-157
A.14.6.2Operation . . . . . . . . . . . . . . . . . . . A-157
A.14.6.3Fault Codes . . . . . . . . . . . . . . . . . . . A-157
A.14.7.1Event Recorder Interface . . . . . . . . . . . . . . A-157
A.14.7.2Technician Interface . . . . . . . . . . . . . . . . A-158
A.15 Diagnostic Module 128 (DM128) . . . . . . . . . . . . . . . . . A-160
A.15.1 Description . . . . . . . . . . . . . . . . . . . . . . A-160
A.15.2 Particulars . . . . . . . . . . . . . . . . . . . . . . A-160
A.15.3 Function . . . . . . . . . . . . . . . . . . . . . . . A-160
A.15.4 Operation . . . . . . . . . . . . . . . . . . . . . . A-160
A.15.5.2Mnemonic Selection Default . . . . . . . . . . . . . A-162
A.15.5.3Command Echo Default . . . . . . . . . . . . . . A-162
A.15.6 Indications . . . . . . . . . . . . . . . . . . . . . . A-163
A.15.6.1Start Up . . . . . . . . . . . . . . . . . . . . A-163
A.15.6.2Operation . . . . . . . . . . . . . . . . . . . A-163
A.15.6.3Fault Codes . . . . . . . . . . . . . . . . . . . A-163
A.15.7.1Event Recorder Interface . . . . . . . . . . . . . . A-163
A.15.7.2Technician Interface . . . . . . . . . . . . . . . . A-164
xvi Invensys Rail

Contents
A.16 Power Supply Unit (PSU) . . . . . . . . . . . . . . . . . . . . A-166

A.16.1 Description . . . . . . . . . . . . . . . . . . . . . A-166
A.16.2 Particulars . . . . . . . . . . . . . . . . . . . . . . A-166
A.16.3 Characteristics of PSU 24 . . . . . . . . . . . . . . . . . A-166
A.16.4 Function . . . . . . . . . . . . . . . . . . . . . . . A-166
A.16.6 Indications . . . . . . . . . . . . . . . . . . . . . . A-167
A.17 Protection and Filter Modules (PFMs) . . . . . . . . . . . . . . . A-168
A.17.1 Description . . . . . . . . . . . . . . . . . . . . . A-168
A.17.3 Indications . . . . . . . . . . . . . . . . . . . . . . A-168
A.18 VLE Backplane . . . . . . . . . . . . . . . . . . . . . . . A-169
A.18.1 Description . . . . . . . . . . . . . . . . . . . . . A-169
A.18.3 Indications . . . . . . . . . . . . . . . . . . . . . . A-169
A.19 S2/MBD51 Single Modem Motherboard . . . . . . . . . . . . . . A-170
A.19.1 Description . . . . . . . . . . . . . . . . . . . . . A-170
A.19.2 Particulars . . . . . . . . . . . . . . . . . . . . . . A-170
A.19.3 Function . . . . . . . . . . . . . . . . . . . . . . . A-170
A.19.5 Indications . . . . . . . . . . . . . . . . . . . . . . A-173
Appendix B: Module Operation

B.1 Vital Logic Module (VLM1) . . . . . . . . . . . . . . . . . . . B-1
B.1.1 Description . . . . . . . . . . . . . . . . . . . . . B-1
B.1.1.1 Vital Logic Card (VLC) . . . . . . . . . . . . . . . B-1
B.1.1.2 Configuration Element Card (CEC) . . . . . . . . . . B-1
B.1.1.3 Output Power Card (OPC) . . . . . . . . . . . . . B-2
B.1.1.4 VLM Backplane Card (VBC) . . . . . . . . . . . . . B-2
B.1.2 Operation . . . . . . . . . . . . . . . . . . . . . . B-2
B.1.2.1 Power-Up . . . . . . . . . . . . . . . . . . . B-2
B.1.2.2 Normal Operations . . . . . . . . . . . . . . . . B-3
B.1.2.3 Additional Operations . . . . . . . . . . . . . . . B-3
B.1.3 Module Safety Assurance . . . . . . . . . . . . . . . . . B-3
B.2 Vital Hot Standby Logic Module (HVLM) . . . . . . . . . . . . . . B-5
B.2.1 Description . . . . . . . . . . . . . . . . . . . . . B-5
B.2.1.1 Hot Standby Vital Logic Card (HVLC) . . . . . . . . . B-5
B.2.1.3 Hot Standby Vital Backplane Card (HVBC) . . . . . . . . B-6
B.2.2 Operation . . . . . . . . . . . . . . . . . . . . . . B-7
B.2.2.1 Cycle Time . . . . . . . . . . . . . . . . . . . B-7
B.2.2.2 Hot Standby Configuration . . . . . . . . . . . . . B-7
B.2.2.3 Changeover . . . . . . . . . . . . . . . . . . B-7
B.2.3.1 System Safety Principles and Methods . . . . . . . . . B-9
B.2.3.2 HVLE Safety Principles and Methods . . . . . . . . . . B-9
B.2.3.2.1 Installation Negation . . . . . . . . . . . . . B-9
B.2.3.2.2 Safety During Changeover . . . . . . . . . . B-9
B.2.3.2.3 Self-Tests . . . . . . . . . . . . . . . . . B-9
B.3 Vital Standby Logic Module (VLM5) . . . . . . . . . . . . . . . . B-10
B.3.1 Description . . . . . . . . . . . . . . . . . . . . . B-10
B.3.1.1 Vital Logic Card 5 (VLC5) . . . . . . . . . . . . . . B-10
B.3.1.3 Hot Standby Vital Backplane Card (HVBC) . . . . . . . . B-10
B.3.2 Operation . . . . . . . . . . . . . . . . . . . . . . B-11
B.3.2.1 Cycle Time . . . . . . . . . . . . . . . . . . . B-11
B.3.2.3 Changeover . . . . . . . . . . . . . . . . . . B-11
WESTRACE MkI Application Manual Issue 11.0 xvii

Contents
B.4 Vital Logic Module (VLM6) . . . . . . . . . . . . . . . . . . . B-12

B.4.1 Description . . . . . . . . . . . . . . . . . . . . . . B-12
B.4.1.1 Vital Logic Card 6 (VLC6) . . . . . . . . . . . . . . B-12
B.4.1.2 Output Power Card (OPC) . . . . . . . . . . . . . . B-12
B.4.1.3 Universal Hot Standby Vital Backplane Card (UHVBC) . . . . B-12
B.4.2 Operation . . . . . . . . . . . . . . . . . . . . . . B-13
B.4.2.1 Cycle Time . . . . . . . . . . . . . . . . . . . B-13
B.4.2.3 Changeover . . . . . . . . . . . . . . . . . . B-14
B.5 Vital Lamp Output Module (VLOM) . . . . . . . . . . . . . . . . B-15
B.5.1 Description . . . . . . . . . . . . . . . . . . . . . . B-15
B.5.2 Operation . . . . . . . . . . . . . . . . . . . . . . B-15
B.6 Vital Relay Output Module (VROM) . . . . . . . . . . . . . . . . B-17
B.6.1 Description . . . . . . . . . . . . . . . . . . . . . . B-17
B.6.2 Operation . . . . . . . . . . . . . . . . . . . . . . B-17
B.7 Vital Parallel Input Module (VPIM) . . . . . . . . . . . . . . . . . B-19
B.7.1 Description . . . . . . . . . . . . . . . . . . . . . . B-19
B.7.2 Operation . . . . . . . . . . . . . . . . . . . . . . B-19
B.8 Vital Telemetry Continuous Module (VTC) . . . . . . . . . . . . . . B-21
B.8.1 Description . . . . . . . . . . . . . . . . . . . . . . B-21
B.8.2 Operation . . . . . . . . . . . . . . . . . . . . . . B-21
B.9 Enhanced Vital Telemetry Continuous Module (EVTC) . . . . . . . . . B-23
B.9.1 Description . . . . . . . . . . . . . . . . . . . . . . B-23
B.9.2 Operation . . . . . . . . . . . . . . . . . . . . . . B-23
B.10 Protection & Filter Module . . . . . . . . . . . . . . . . . . . B-25
B.10.1 Description . . . . . . . . . . . . . . . . . . . . . . B-25
B.10.2 Operation . . . . . . . . . . . . . . . . . . . . . . B-25
Appendix C: Hot Standby Operation

C.1 Introduction . . . . . . . . . . . . . . . . . . . . . . . . C-1
C.2 Modes of Operation . . . . . . . . . . . . . . . . . . . . . . C-1
C.2.1 Power-Down Mode . . . . . . . . . . . . . . . . . . . C-2
C.2.2 Initialisation . . . . . . . . . . . . . . . . . . . . . . C-2
C.2.2.1 Online Initialisation Phase . . . . . . . . . . . . . . C-4
C.2.2.2 Standby Initialisation Phase . . . . . . . . . . . . . C-4
C.2.3 Online Mode . . . . . . . . . . . . . . . . . . . . . C-4
C.2.4 Standby Mode . . . . . . . . . . . . . . . . . . . . . C-4
C.2.5 Shutdown Mode . . . . . . . . . . . . . . . . . . . . C-4
Appendix D: Non-Vital Communication Protocols
Glossary
xviii Invensys Rail

List of Figures
LIST OF FIGURES
FIGURE PAGE
1.1 WESTRACE and Related Manuals . . . . . . . . . . . . . . . . . . . 1-3

2.1 Design Process Flowchart—WESTRACE . . . . . . . . . . . . . . . . . 2-2
2.2 Simple WESTRACE Systems with Local Panel—Typical—HVLM128 or VLM5 . . . . . 2-13
2.3 Simple WESTRACE System with Local Panel—Typical—VLM6 with NCDM . . . . . 2-14
2.4 Multiple WESTRACE Systems with Local Panel and Duplicated Communications
Bearers—Typical—HVLM128 or VLM5 . . . . . . . . . . . . . . . . . . 2-15
2.5 Multiple WESTRACE Systems with Local Panel—Typical—VLM6 with NCDM . . . . . 2-16
2.6 Master–Slave WESTRACE System with Local Panel and Single Bearer—Typical—
HVLM128 or VLM5 . . . . . . . . . . . . . . . . . . . . . . . . . 2-17
2.7 Master-Slave WESTRACE System with Local Panel—Typical—VLM6 with NCDM . . . 2-18
2.8 Multiple WESTRACE System with Physical Separation Between Systems—Typical—
HLVM128 or VLM5 . . . . . . . . . . . . . . . . . . . . . . . . . 2-19
2.9 Multiple WESTRACE System with Physical Separation Between Systems—Typical—
VLM6 with NCDM . . . . . . . . . . . . . . . . . . . . . . . . . 2-20
2.10 Multiple Address WESTRACE System with Physical Separation Between Systems—
Typical—Older Configuration . . . . . . . . . . . . . . . . . . . . . 2-21
2.11 Hot standby WESTRACE System (simplified)—Typical—HVLM128 or VLM5 . . . . . 2-22
2.12 Hot standby WESTRACE System (simplified)—Typical—VLM6 with NCDM . . . . . 2-23
3.1 WESTRACE Housing & Slot Nomenclature—VLM6 & NCDM Configuration . . . . . 3-8
3.2 WESTRACE Housing & Slot Nomenclature—HVLM128 or VLM5 & NVC/DM
Configuration . . . . . . . . . . . . . . . . . . . . . . . . . . 3-8
3.3 WESTRACE Housing & Slot Nomenclature—Older Configuration . . . . . . . . 3-9
3.4 LOC Extension During Change-over . . . . . . . . . . . . . . . . . . 3-27
3.5 Hot Standby Configuration—VLM6 and NCDM . . . . . . . . . . . . . . . 3-29
3.6 Connections—INCL and IHCL . . . . . . . . . . . . . . . . . . . . . 3-30
3.7 Hot Standby Configuration—VLM5 . . . . . . . . . . . . . . . . . . . 3-31
3.8 Hot Standby Configuration—HVLM128 . . . . . . . . . . . . . . . . . . 3-32
3.9 Response Time—WESTRACE Installation . . . . . . . . . . . . . . . . . 3-33
3.10 Reversion Time—Normal WESTRACE Installation Operation . . . . . . . . . . 3-36
3.11 Reversion Time—WESTRACE Installation Operation Including a Fleeting Output . . . 3-36
3.12 Reversion Time—WESTRACE Systems—Vital Serial Link Including a Fleeting Output . . 3-36
3.13 Reversion Time—WESTRACE System Network Input to Parallel Output . . . . . . 3-37
3.14 Reversion Time—WESTRACE System Network Input to Network Output . . . . . . 3-37
3.15 Vital Parallel Output Module Block Diagram . . . . . . . . . . . . . . . . 3-38
4.1 External Connections—HOPC PFM—VLM6, VLM5 & HVLM . . . . . . . . . . . 4-2
4.2 Changeover Switches—HOPC PFM . . . . . . . . . . . . . . . . . . . 4-3
4.3 External Connections—OPC PFM—VLM1 . . . . . . . . . . . . . . . . . 4-4
4.4 One-Shot Restart—Timing Diagram . . . . . . . . . . . . . . . . . . . 4-5
4.5 One-Shot Restart Circuit—Typical—Single WESTRACE . . . . . . . . . . . . 4-6
4.6 One-Shot Restart Circuit—Typical—Multiple WESTRACE . . . . . . . . . . . 4-7
4.7 Repeater relays controlled by primary OPCR . . . . . . . . . . . . . . . 4-10
4.8 Universal Hot Standby Vital Backplane Card (UHVBC)—Links 25 & 26 . . . . . . . 4-13
4.9 External Connections—VLOM PFM . . . . . . . . . . . . . . . . . . . 4-14
4.10 Typical Wiring to VLOM (Showing Application of OPCR for Red Retaining) . . . . . 4-15
4.11 Example VLOM Hot-Standby Circuit (three of six outputs shown) . . . . . . . . 4-19
4.12 Example VLOM Hot-Standby Circuit with Red Retaining (one of six outputs shown) . . 4-19
4.13 Resistor used in LED Signal . . . . . . . . . . . . . . . . . . . . . . 4-20
4.14 External Connections—VROM PFM . . . . . . . . . . . . . . . . . . . 4-22
4.15 VROM Hot-Standby Circuit—option 1 (three of eight outputs shown) . . . . . . . 4-24
4.16 Example VROM Hot-Standby Circuit—option 2 (three of eight outputs shown) . . . . 4-25
WESTRACE MkI Application Manual Issue 11.0 xix

List of Figures
4.17 External Connections—VPIM PFM . . . . . . . . . . . . . . . . . . . 4-26

4.18 External Connections—SIO232 PFM—WCM . . . . . . . . . . . . . . . 4-29
4.19 WCM Typical Wiring . . . . . . . . . . . . . . . . . . . . . . . 4-30
4.20 External Connections—SIO232 PFM—EVTC or VTC . . . . . . . . . . . . . 4-31
4.21 Module Outputs and Inputs—EVTC or VTC . . . . . . . . . . . . . . . . 4-34
4.22 Ladder Logic for EVTC (or VTC) Communications . . . . . . . . . . . . . 4-34
4.23 Connection Details—Directly-Connected EVTC (or VTC) Modules . . . . . . . . 4-35
4.24 View from Component Side—NCDM (Mod D Rev 7 NCDC shown) . . . . . . . 4-38
4.25 External Connectors on the Two Styles of NCD PFM—NCDM . . . . . . . . . 4-39
4.26 Serial Master-Slave Examples—NCDM . . . . . . . . . . . . . . . . . 4-44
4.27 Serial Master-Slave Examples—Hot-Standby NCDMs . . . . . . . . . . . . 4-45
4.28 LEC—NVC/DM Module—Component Side View . . . . . . . . . . . . . . 4-53
4.29 Component Side View—CIMFIM—NVC/DM . . . . . . . . . . . . . . . 4-54
4.30 Assembly—LEC, CIMFIM and CIMPM—NVC/DM . . . . . . . . . . . . . . 4-54
4.31 Serial and Power Connectors—CIMPM—NVC/DM . . . . . . . . . . . . . 4-55
4.32 Serial Master-Slave Examples—NVC/DM . . . . . . . . . . . . . . . . 4-58
4.33 Serial Master-Slave Examples—Hot-Standby NVC/DMs . . . . . . . . . . . 4-59
4.34 View from Component Side—NVC . . . . . . . . . . . . . . . . . . . 4-64
4.35 Communicating via Modem—Single NVC . . . . . . . . . . . . . . . . 4-64
4.36 Communicating via Modem—Multiple NVC . . . . . . . . . . . . . . . 4-65
4.37 Communicating without a Modem—Single NVC . . . . . . . . . . . . . . 4-65
4.38 Communicating without a Modem—Multiple NVC . . . . . . . . . . . . . 4-66
4.39 Connection Details for Multiple Modules without Modem—NVC . . . . . . . . 4-66
4.40 External Connections—SIO232 PFM—NVC232 . . . . . . . . . . . . . . 4-67
4.41 External Connections—SIO422 PFM—NVC422 . . . . . . . . . . . . . . 4-68
4.42 RS422 Connector Pin Numbering—SIO422 PFM—NVC422 . . . . . . . . . . 4-69
4.43 Layout—DM128 . . . . . . . . . . . . . . . . . . . . . . . . . 4-72
4.44 External Connections—SIO232 PFM—DM Module . . . . . . . . . . . . . 4-72
4.45 External Connections—PSU PFM—PSU . . . . . . . . . . . . . . . . . 4-75
4.46 Internal Power Linking—PSU to PSU . . . . . . . . . . . . . . . . . . 4-77
4.47 Single Housing System . . . . . . . . . . . . . . . . . . . . . . . 4-78
4.48 Two Housing System . . . . . . . . . . . . . . . . . . . . . . . 4-78
4.49 Three Housing System . . . . . . . . . . . . . . . . . . . . . . . 4-79
4.50 Four Housing System . . . . . . . . . . . . . . . . . . . . . . . 4-80
4.51 Surge Arrester—Weidmuller . . . . . . . . . . . . . . . . . . . . . 4-81
4.52 Surge Arresters (Left and Right Side Entry) . . . . . . . . . . . . . . . . 4-82
4.53 Surge Arrester—Elsafe . . . . . . . . . . . . . . . . . . . . . . . 4-82
5.1 Star Earth Connection . . . . . . . . . . . . . . . . . . . . . . . 5-2
5.2 Daisy Chained Earth . . . . . . . . . . . . . . . . . . . . . . . 5-2
5.3 Earthing on WESTRACE Housings . . . . . . . . . . . . . . . . . . . 5-3
5.4 A—Shielded Cable Earthed a One End . . . . . . . . . . . . . . . . . 5-7
5.5 B—Shielded Cable Earthed at Both Ends . . . . . . . . . . . . . . . . 5-7
5.6 Surge Arresters—Correct Connection of . . . . . . . . . . . . . . . . 5-9
5.7 Surge Arresters—Wiring to . . . . . . . . . . . . . . . . . . . . . 5-9
5.8 Surge Arresters—Cable Runs to . . . . . . . . . . . . . . . . . . . . 5-10
5.9 High Lightning Areas—Recommended Isolating Transformer and Surge Arrester . . 5-11
A.1 VLC6—Layout—VLM6 . . . . . . . . . . . . . . . . . . . . . . . A-3
A.2 UHVBC—Rear Side View—VLM6 . . . . . . . . . . . . . . . . . . . A-4
0.1 VLM6 PROM Configurations . . . . . . . . . . . . . . . . . . . . . A-5
A.3 Typical GCSS Installation Reports and SW1 Settings—VLM6 . . . . . . . . . . A-6
A.4 External Connections—HOPC PFM—VLM6 . . . . . . . . . . . . . . . . A-15
xx Invensys Rail
List of Figures
A.5 Layout—VLC5—VLM5 . . . . . . . . . . . . . . . . . . . . . . . . A-17

A.6 HVBC—Rear Side View—VLM5 . . . . . . . . . . . . . . . . . . . . . A-18
A.7 Typical GCSS Installation Reports and SW1 Settings—VLM5 . . . . . . . . . . A-20
A.8 External Connections—HOPC PFM—VLM5 . . . . . . . . . . . . . . . . A-32
A.9 Layout—HVLC—HVLM . . . . . . . . . . . . . . . . . . . . . . . . A-34
A.10 Rear Side View—HVBC—HVLM . . . . . . . . . . . . . . . . . . . . A-35
A.11 Typical GCSS Installation Reports and SW1 Settings—HVLM128 . . . . . . . . . A-37
A.12 External Connections—HOPC PFM—HVLM . . . . . . . . . . . . . . . . A-50
A.13 Layout—CEC—VLM1 . . . . . . . . . . . . . . . . . . . . . . . . A-51
A.14 General Arrangement from Rear—VBC—VLM1 . . . . . . . . . . . . . . . A-52
A.15 Example SW1 Settings—CEC—VLM1 . . . . . . . . . . . . . . . . . . A-53
A.16 External Connections—OPC PFM—VLM1 . . . . . . . . . . . . . . . . . A-60
A.17 External Connections—VLOM PFM—VLOM . . . . . . . . . . . . . . . . A-66
A.18 External Connections—VROM PFM—VROM . . . . . . . . . . . . . . . . A-71
A.19 External Connections—VPIM PFM—VPIM . . . . . . . . . . . . . . . . . A-75
A.20 External Connections—SIO232 PFM—VTC . . . . . . . . . . . . . . . . A-79
A.21 External Connections—SIO232 PFM—EVTC . . . . . . . . . . . . . . . . A-84
A.22 External Connections—SIO232 PFM—WCM . . . . . . . . . . . . . . . . A-88
A.23 External Ports on the Two Styles of NCD PFM—NCDM . . . . . . . . . . . . A-91
A.24 Configuration Switches and Jumpers—Mod D Rev 7 NCDC . . . . . . . . . . A-96
A.25 Separating the NCDC and VLC6 . . . . . . . . . . . . . . . . . . . . A-99
A.26 Setting Non-Vital Configuration—Version 1 Example (Mod D Rev 7 NCDC shown) . . A-100
A.27 Production Port—Connecting—NCDM . . . . . . . . . . . . . . . . . . A-101
A.28 Lithium Battery—Two Connector Types—NCDM . . . . . . . . . . . . . . A-103
A.29 User Interface—NCDC and VLM6—NCDM . . . . . . . . . . . . . . . . A-104
A.30 User Interface—NCD PFM—NCDM . . . . . . . . . . . . . . . . . . . A-105
A.31 Four Digit Alphanumeric Display—NCDM . . . . . . . . . . . . . . . . . A-108
A.32 Alphanumeric Display—Port Fault—NCDM . . . . . . . . . . . . . . . . A-109
A.33 Alphanumeric Display—Module or Session Fault—NCDM . . . . . . . . . . . A-110
A.34 Alphanumeric Display—Internal Fault—NCDM . . . . . . . . . . . . . . . A-111
A.35 External Connectors on the Two Styles of NCD PFM—NCDM . . . . . . . . . . A-115
A.36 Cable Configuration Details—NCDM . . . . . . . . . . . . . . . . . . A-118
A.37 Configuration Switches and Jumpers—NVC/DM . . . . . . . . . . . . . . A-126
A.38 Removing a Card From the WESTRACE Housing . . . . . . . . . . . . . . A-128
A.39 CIMFIM With Four Daughter Boards—NVC/DM . . . . . . . . . . . . . . . A-128
A.40 Separating the LEC and CIMFIM—NVC/DM . . . . . . . . . . . . . . . . A-129
A.41 Non-Vital Configuration—Setting Version 1—NVC/DM . . . . . . . . . . . . A-130
A.42 Production Port—Connecting—NVC/DM . . . . . . . . . . . . . . . . . A-131
A.43 Lithium Battery—NVC/DM . . . . . . . . . . . . . . . . . . . . . . A-132
A.44 User Interface—NVC/DM . . . . . . . . . . . . . . . . . . . . . . . A-133
A.45 Four Digit Alphanumeric Display—NVC/DM . . . . . . . . . . . . . . . . A-137
A.46 Alphanumeric Display—Port Fault—NVC/DM . . . . . . . . . . . . . . . A-137
A.47 Alphanumeric Display—S2 Address Fault—NVC/DM . . . . . . . . . . . . . A-139
A.48 Alphanumeric Display—Internal Fault—NVC/DM . . . . . . . . . . . . . . A-139
A.49 External Connectors—CIMPM Card—NVC/DM . . . . . . . . . . . . . . . A-142
A.50 Production Port—NVC/DM . . . . . . . . . . . . . . . . . . . . . . A-144
A.51 Cable Configuration Details—NVC/DM . . . . . . . . . . . . . . . . . A-145
A.52 Configuration Switches—NVC . . . . . . . . . . . . . . . . . . . . . A-148
A.53 Slave Address—Setting—NVC . . . . . . . . . . . . . . . . . . . . . A-148
A.54 Clock Reconstruction Daughter Board—NVC . . . . . . . . . . . . . . . A-149
A.55 External Connections—SIO232 PFM—NVC . . . . . . . . . . . . . . . . A-153
WESTRACE MkI Application Manual Issue 11.0 xxi

List of Figures
A.56 External Connections—SIO422 PFM—NVC . . . . . . . . . . . . . . . . A-154

A.57 RS422 Connector Pin Numbering—SIO422 PFM—NVC . . . . . . . . . . . A-154
A.58 Layout—DM Module . . . . . . . . . . . . . . . . . . . . . . . A-156
A.59 Configuration Switch—DM Module . . . . . . . . . . . . . . . . . . A-156
A.60 External Connections—SIO232 PFM—DM Module . . . . . . . . . . . . . A-158
A.61 Interface Cable Configuration—DM Module . . . . . . . . . . . . . . . A-159
A.62 Layout—DM 128 . . . . . . . . . . . . . . . . . . . . . . . . . A-161
A.63 Links or SW1 Switches—Default Settings—DM128 . . . . . . . . . . . . . A-161
A.64 External Connections—SIO232 PFM—DM128 . . . . . . . . . . . . . . . A-163
A.65 Interface Cable Configuration—DM128 . . . . . . . . . . . . . . . . . A-165
A.66 Power Indicator LEDs—PSU . . . . . . . . . . . . . . . . . . . . . A-167
A.67 S2/VFC42/45/46 Modem Configuration J13—S2/MBD51 Motherboard . . . . . A-171
A.68 S2/VFC42/45 Line Impedance Configuration J14 (4 WIRE LINE) . . . . . . . . A-172
A.69 S2/VFC42 Line Impedance Configuration J14 (2 WIRE LINE) . . . . . . . . . A-172
A.70 S2/VFC46 Line Impedance Configuration J14 (all line impedances) . . . . . . . A-173
A.71 S2/VFC42/45 Line Wire Configuration J12 . . . . . . . . . . . . . . . . A-173
A.72 S2/VFC46 Line Wire Configuration J12 . . . . . . . . . . . . . . . . . A-173
C.1 Initialisation Phase Transition Diagram . . . . . . . . . . . . . . . . . C-1
C.2 Start-up Decision Tree—Online or Standby . . . . . . . . . . . . . . . . C-3
xxii Invensys Rail

List of Tables
LIST OF TABLES
TABLE PAGE
2.1 Influence of VLM type on selection of other Modules . . . . . . . . . . . . . 2-6

2.2 Module Configuration . . . . . . . . . . . . . . . . . . . . . . . 2-11
2.3 Module Compatibility Index—Values . . . . . . . . . . . . . . . . . . 2-11
3.1 WESTRACE Modules . . . . . . . . . . . . . . . . . . . . . . . . 3-1
3.2 WESTRACE System Capacity Specifications . . . . . . . . . . . . . . . . 3-6
3.3 Module Number Limits . . . . . . . . . . . . . . . . . . . . . . . 3-7
3.4 Module Communication Times . . . . . . . . . . . . . . . . . . . . 3-7
3.5 Output Power . . . . . . . . . . . . . . . . . . . . . . . . . . 3-10
3.6 Power Consumption of WESTRACE Modules . . . . . . . . . . . . . . . 3-10
3.7 LOC Timeout Values—Recommended—Two WNC Installations with Vital Comms
Over a Network . . . . . . . . . . . . . . . . . . . . . . . . . . 3-18
3.8 Response Times—Worst Case—Individual Items . . . . . . . . . . . . . . 3-33
3.9 WESTRACE System Response Times—Worst Case—for a HVLM128-Based System . . 3-34
3.10 WESTRACE System Response Times—Worst Case—for a VLM5-Based System . . . . 3-34
3.11 WESTRACE System Response Times—Worst Case—for a VLM6-Based System . . . . 3-35
3.12 Reversion Times—General . . . . . . . . . . . . . . . . . . . . . . 3-36
3.13 Fleeting Outputs for the VLE and OPCR . . . . . . . . . . . . . . . . . 3-38
4.1 DB25 Pinout—SIO232 PFM—WCM . . . . . . . . . . . . . . . . . . . 4-29
4.2 DB25 Pinout—SIO232 PFM—EVTC & VTC . . . . . . . . . . . . . . . . . 4-32
4.3 Serial Power Connector Pinout—NCD PFM—NCDM . . . . . . . . . . . . . 4-40
4.4 Installation Status Connector Pinout—NCD PFM—NCDM . . . . . . . . . . . 4-40
4.5 RJ45 Pinout—Network Connection—NCD(C) PFM—NCDM . . . . . . . . . . . 4-40
4.6 DB9 Pinout—RS232C Connection—NCD PFM—NCDM . . . . . . . . . . . . 4-41
4.7 DB9 Pinout—RS484 Connection—NCD PFM—NCDM . . . . . . . . . . . . . 4-42
4.8 Serial Power Pinout—CIMPM—NVC/DM . . . . . . . . . . . . . . . . . 4-55
4.9 DB25 Pinout—SIO232 PFM—NVC232 . . . . . . . . . . . . . . . . . . 4-67
4.10 DB25 Pinout—SIO232 PFM to S2/MBD51 Modem or S2/SCN4x Scanners (no modem) . 4-68
4.11 14-Way Ribbon Header Pinout—SIO422 PFM—NVC422 . . . . . . . . . . . . 4-69
4.12 RS422 Pinout—SIO422 PFM to S2/MBD51 Modem Motherboards
or S2/SCN4x Scanners (no modem) . . . . . . . . . . . . . . . . . . . 4-70
4.13 DB25 Pinout—Event Recorder Interface—DM Module . . . . . . . . . . . . 4-73
4.14 CCITT V.24 Circuit Subsets—Event Recorder Interface—DM Module . . . . . . . 4-73
4.15 DB25 Pinout—Diagnostic Interface—DM Module . . . . . . . . . . . . . . 4-74
4.16 CCITT V.24 Circuit Subsets—Diagnostic Interface—DM Module . . . . . . . . . 4-74
4.17 Link Settings for Backplane Addressing . . . . . . . . . . . . . . . . . 4-76
4.18 Link Setting for !RESET to the Backplane . . . . . . . . . . . . . . . . . 4-76
A.1 CONF1, CONF2, LK25, LK26—Link Settings . . . . . . . . . . . . . . . . A-7
A.2 Fault Codes—Block—VLM6 . . . . . . . . . . . . . . . . . . . . . . A-8
A.3 Fault Codes—Specific Initialisation—VLM6 . . . . . . . . . . . . . . . . A-12
A.4 CONF1, CONF2—Link Settings . . . . . . . . . . . . . . . . . . . . A-21
A.5 Fault Codes—Block—VLM5 . . . . . . . . . . . . . . . . . . . . . . A-22
A.6 Fault Codes—Specific Initialisation—VLM5 . . . . . . . . . . . . . . . . A-25
A.7 Fault Codes—Specific Standby Mode—VLM5 . . . . . . . . . . . . . . . A-27
A.8 Fault Codes—Specific On-line—VLM5 . . . . . . . . . . . . . . . . . . A-29
A.9 CONF1, CONF2—Link Settings . . . . . . . . . . . . . . . . . . . . A-38
A.10 Fault Codes—Block—HVLM . . . . . . . . . . . . . . . . . . . . . . A-39
A.11 Fault Codes—Specific Initialisation—HVLM . . . . . . . . . . . . . . . . A-43
A.12 Fault Code—Specific Standby Mode—HVLM . . . . . . . . . . . . . . . . A-45
A.13 Fault Codes—Specific On-line Mode—HVLM . . . . . . . . . . . . . . . . A-47
WESTRACE MkI Application Manual Issue 11.0 xxiii

List of Tables
A.14 Fault Codes—VLM1 . . . . . . . . . . . . . . . . . . . . . . . . A-54

A.15 Characteristics—VLOM 110 . . . . . . . . . . . . . . . . . . . . . A-61
A.16 Fault Codes—VLOM . . . . . . . . . . . . . . . . . . . . . . . . A-62
A.17 Characteristics—VROM 50 . . . . . . . . . . . . . . . . . . . . . A-67
A.18 Fault Codes—VROM . . . . . . . . . . . . . . . . . . . . . . . A-68
A.19 Characteristics—VPIM 50 . . . . . . . . . . . . . . . . . . . . . . A-72
A.20 Fault Codes—VPIM . . . . . . . . . . . . . . . . . . . . . . . . A-73
A.21 Fault Codes—VTC . . . . . . . . . . . . . . . . . . . . . . . . A-77
A.22 DB25 Pinout—SIO232 PFM—VTC . . . . . . . . . . . . . . . . . . . A-79
A.23 Fault Codes—EVTC . . . . . . . . . . . . . . . . . . . . . . . . A-82
A.24 DB25 Pinout—SIO232 PFM—EVTC . . . . . . . . . . . . . . . . . . . A-84
A.25 Fault Codes—WCM . . . . . . . . . . . . . . . . . . . . . . . . A-86
A.26 DB25 Pinout—SIO232 PFM—WCM . . . . . . . . . . . . . . . . . . A-88
A.27 Port number allocation—NCDM . . . . . . . . . . . . . . . . . . . A-90
A.28 Operating Modes—NCDM . . . . . . . . . . . . . . . . . . . . . A-95
A.29 Switch Bank 2—Valid Settings—NCDM . . . . . . . . . . . . . . . . . A-97
A.30 Start-up Display Sequence—NCDM . . . . . . . . . . . . . . . . . . A-106
A.31 Operation Indicators—Normal—NCDM . . . . . . . . . . . . . . . . . A-107
A.32 Fault Codes—Port Codes in General—NCDM . . . . . . . . . . . . . . . A-109
A.33 Fault Codes—Ext. Port—Module and Session—NCDM . . . . . . . . . . . . A-110
A.34 Fault Codes—Internal Port—NCDM . . . . . . . . . . . . . . . . . . A-110
A.35 Fault Codes—Module or Session—NCDM . . . . . . . . . . . . . . . . A-111
A.36 Fault Codes—Other—Module or Session—NCDM . . . . . . . . . . . . . A-111
A.37 Fault Codes—Fatal—NCDM . . . . . . . . . . . . . . . . . . . . . A-112
A.38 Fault Codes—Non-Fatal—NCDM . . . . . . . . . . . . . . . . . . . A-113
A.39 Fault Codes—Other (Not Displayed)—NCDM . . . . . . . . . . . . . . . A-114
A.40 Serial Power Connector Pinout—NCD PFM—NCDM . . . . . . . . . . . . A-115
A.41 Installation Status Connector Pinout—NCD PFM—NCDM . . . . . . . . . . . A-116
A.42 DB9 Pinout—RS232 Connection—NCD PFM—NCDM . . . . . . . . . . . . A-116
A.43 DB9 Pinout—RS485 Connection—NCD PFM—NCDM . . . . . . . . . . . . A-116
A.44 RJ45 Pinout—Network Connection—NCD PFM—NCDM . . . . . . . . . . . A-117
A.45 DB9 Pinout—Production Port—NCDM . . . . . . . . . . . . . . . . . A-117
A.46 Allocation of Port Numbers—NVCD/DM . . . . . . . . . . . . . . . . . A-122
A.47 Operating Modes—NVC/DM . . . . . . . . . . . . . . . . . . . . A-125
A.48 Switch Bank S2—Valid Settings—NVC/DM . . . . . . . . . . . . . . . . A-127
A.49 Start-up Display Sequence—NVC/DM . . . . . . . . . . . . . . . . . A-135
A.50 Normal Operation Indicators—NVC/DM . . . . . . . . . . . . . . . . . A-135
A.51 Fault Codes—Port Codes in General—NVC/DM . . . . . . . . . . . . . . A-138
A.52 Fault Codes—Port Codes—Other—NVC/DM . . . . . . . . . . . . . . . A-138
A.53 Fault Codes—S2 Address—NVC/DM . . . . . . . . . . . . . . . . . . A-139
A.54 Fault Codes—Telemetry—Other—NVC/DM . . . . . . . . . . . . . . . . A-139
A.55 Fault Codes—Fatal—NVC/DM . . . . . . . . . . . . . . . . . . . . A-140
A.56 Fault Codes—Non-fatal—NVC/DM . . . . . . . . . . . . . . . . . . . A-141
A.57 Fault Codes—Other—NVC/DM . . . . . . . . . . . . . . . . . . . . A-141
A.58 Serial Power Pinout—NVC/DM . . . . . . . . . . . . . . . . . . . . A-142
A.59 DB9 Pinout—RS232 Connection—NVC/DM . . . . . . . . . . . . . . . . A-143
A.60 DB9 Pinout—RS485 Connection—NVC/DM . . . . . . . . . . . . . . . . A-143
A.61 DB9 Pinout—Production Port—NVC/DM . . . . . . . . . . . . . . . . . A-144
A.62 Data Transfer Rate—Setting—NVC . . . . . . . . . . . . . . . . . . . A-149
A.63 Data Word Length—Setting—NVC . . . . . . . . . . . . . . . . . . . A-150
A.64 Fault Codes—NVC . . . . . . . . . . . . . . . . . . . . . . . . A-151
xxiv Invensys Rail

List of Tables
A.65 DB25 Pinout—SIO232 PFM—NVC . . . . . . . . . . . . . . . . . . . A-153

A.66 14-Way Ribbon Header Pinout—SIO422 PFM—NVC . . . . . . . . . . . . . A-154
A.67 DB25 Pinout—Event Recorder Interface—SIO232 PFM—DM Module . . . . . . . A-158
A.68 DB25 Pinout—Technician Interface—DM Module . . . . . . . . . . . . . . A-158
A.69 Data Transfer Rate—Setting—DM128 . . . . . . . . . . . . . . . . . . A-162
A.70 Mnemonic Language—Setting—DM128 . . . . . . . . . . . . . . . . . A-162
A.71 Echo Command—Setting—DM128 . . . . . . . . . . . . . . . . . . . A-162
A.72 DB25 Pinout — Event Recorder Interface — SIO232 PFM—DM128 . . . . . . . . . A-164
A.73 DB25 Pinout—Technician Interface—DM128 . . . . . . . . . . . . . . . . A-164
A.74 Link Description—S2/MBD51 Motherboard . . . . . . . . . . . . . . . . A-171
WESTRACE MkI Application Manual Issue 11.0 xxv

Invensys Rail
Chapter 1: Introduction
1.1 New in This Issue
1. INTRODUCTION 1
This manual defines how to apply WESTRACE safely and correctly for railway
signalling applications.
1.1 New in This Issue

This issue of the WESTRACE Application Manual (Issue 11.0) contains the
following changes:
• additions to section 4.1.4 “Restart Circuit”
• addition of section 4.2.3.13 “VLOM Hot Standby”
• addition of section 4.3.3.9 “VROM Hot Standby”
• minor fixes and improvements throughout
1.2 Purpose of Manual

This manual enables experienced Signal Engineers to determine their
WESTRACE hardware requirements and to safely and correctly apply the
hardware.
1.3 Scope
This manual applies to all static (fixed) installations of WESTRACE equipment
and not to mobile applications such as the WESTECT OBC.
WESTRACE MkI Application Manual Issue 11.0 1-1

1.4 References
1.4 References
This manual refers to the following WESTRACE manuals. All are available
from Invensys Rail.
[SOM] WESTRACE System Overview Manual, WRTOOVER: describes

the WESTRACE system, what it is used for and what it consists of.
[FLM] WESTRACE First-Line Maintenance Manual, WRTFLMM:

describes maintenance procedures to quickly and accurately
diagnose system problems so that correct operation is restored
(including WESTECT trackside equipment).
[CS] WESTRACE Configuration System User Manual, WRTOCS:

describes the use and application of the Configuration Sub
System (CSS) and Configuration Check Sub System (CCSS).
[CSS] WESTRACE Configuration Sub-System User Manual, WRTOCSS:

describes how to use the configuration tools for the
programming and checking of VLM-based WESTRACE systems.
This includes the configuration of the WESTECT
Communications Module which may be installed in a
WESTRACE system.
[CCSS] WESTRACE Configuration Check Sub-System User Manual,

WRTOCCSS: describes the use and application of the CCSS
which is a DOS-based tool. CCSS is used to check that the correct
application logic is installed in a VLM-based WESTRACE system.
[GCSS] WESTRACE Graphical Configuration Sub-System User Manual,

WRTOGCSS: describes how to use the configuration tools for the
programming and checking of HVLM (and later) based
WESTRACE systems. This includes the configuration of the
WESTECT Communications Module which may be installed in a
WESTRACE system.
[GSIM] WESTRACE Graphical Simulator User Manual, WRTOGSIM:

describes how to configure GSIM to test WESTRACE installation
logic. GSIM is a Windows® application that simulates the
operation of WESTRACE logic and trackside equipment. Railway
Signal Engineers use GSIM to validate configuration data before
it is applied in the field, and for principles testing.
[MOV] MoviolaW User Manual, WRTOMOLA: describes how to set up

and use MoviolaW to display and record the state of a
WESTRACE system. MoviolaW is a suite of Windows®-based
diagnostic and recording tools for WESTRACE Vital Signalling
Systems and other railway systems.
[ICS] WESTRACE Installation Check System User Manual, WRTO_ICS:

describes the use and application of the ICS to check that the
application logic is installed correctly in an HVLM (and later)
based WESTRACE system.
[ISIM] WESTRACE Interlocking Simulator User Manual, WRTOISIM:

describes how to set up the Interlocking Simulator to test
WESTRACE application data and optionally non-vital control
(Interlogic data) for railway signal interlockings.
[PCGE] PC Graphic Editor (PCGE) User Manual, WRTOPCGE: describes

how to set up and use PCGE to create graphical screen layouts
and the underlying logic associated with an interlocking’s
mnemonics; for use with GSIM and MoviolaW.
1-2 Invensys Rail

1.5 Relationship with Other Manuals
1.5 Relationship with Other Manuals 1

Nine manuals describe and support the WESTRACE system. Each manual has
a specific purpose and is available from Invensys Rail. Figure 1.1 shows the
relationship between the WESTRACE manuals and other related manuals.
These manuals are described in the WESTRACE System Overview Manual
[SOM].
Figure 1.1 WESTRACE and Related Manuals
1.6 Conventions
This manual highlights important information as follows:
‘Action Point’—identifies a task or a requirement for performing a task.
Note: ‘Note’—highlights important information.
Caution: ‘Caution’—highlights the possibility of damage to equipment, but not

necessarily danger to personnel when handling, operating or
maintaining equipment.
SAFETY
‘Safety Warning’—highlights information relating to safety hazards.
Failure to follow these warnings may lead directly or indirectly to serious
equipment damage, or serious injury or death of personnel.
WARNING

1.7 Organisation of this Manual
1.7 Organisation of this Manual

This manual includes:
Chapter 1 Introduction—describes how this manual relates to the

WESTRACE system.
Chapter 2 System Design—defines the top-level design of a

WESTRACE system.
Chapter 3 System Application—describes how to determine the

requirements for selecting, powering, and communicating
with WESTRACE Modules.
Chapter 4 Module Application—provides a brief description of

WESTRACE modules, their external connection, and other
application-specific information.
Chapter 5 Installing WESTRACE—describes the practices required to

ensure safety integrity and reliability of WESTRACE.
Chapter 6 Testing and Commissioning—describes the tests required

to ensure safe operation of fully assembled WESTRACE
systems.
Appendix A Module Descriptions—describes the fundamental features

of each WESTRACE module.
Appendix B Module Operation—describes the structure, operation and

the safety assurance for WESTRACE modules.
Appendix C Hot Standby Operation—describes hot standby

configuration of WESTRACE interlockings.
Appendix D Non-Vital Communication Protocols—describes non-vital

communication protocols supported by WESTRACE.
Glossary Defines special terms that may be found in this manual.
1-4 Invensys Rail

1.8 Terminology
1.8 Terminology 1
The term VLM is used in a generic sense when referring to Vital Logic
Modules. If the information is specific to a particular vital logic module, then
the particular module will be mentioned.
At present, the following types of Vital Logic Module are in service:

• VLM1 (this module was previously known as VLM)
• HVLM128
• VLM5
• VLM6.
The term ‘Diagnostic Module’ is used in a generic sense. If the information is

specific to a particular diagnostic module, then the particular module will be
mentioned.
At present, the following types of Diagnostic Module are in service:

• NCDM (for VLM6);
• NVC/DM (for HVLM128 or VLM5);
• DM128 (for HVLM128);
• DM64 (for VLM1).
The term ‘Non-Vital Configuration’ is used when discussing non-vital data that
is downloaded to NCDM or NVC/DM modules. It equates to ‘CED’ when
discussing older WESTRACE technology.
The term ‘Vital PROM Data’ is used when discussing vital data that is
downloaded to EPROMs fitted to vital logic modules.

1.8 Terminology
1-6 Invensys Rail

Chapter 2: System Design
2.1 Introduction
2. SYSTEM DESIGN
This chapter defines the top level design of a WESTRACE system.
2
2.1 Introduction
WESTRACE uses relay equivalent logic that provides Railway Signal
Engineers with familiar conventions, standards, and flexibility of design.
The WESTRACE design process involves:

• many of the skills that Railway Signal Engineers already have, plus;
• additional tasks defined in this chapter.
The application of processor based interlockings in areas traditionally

controlled by relay based interlockings must be carefully considered,
especially in regard to the impact on operating procedures and rules under
failure conditions.
WESTRACE’s modular design and features make it suitable for controlling a

large range of signalling installations—from the smallest junction with one set
of points and three signals to complex layouts with many points and signals.
It may be necessary, for larger interlockings, to divide the interlocking into

two or more areas each controlled by its own WESTRACE; each WESTRACE
communicating with its neighbour via vital telemetry links.
SAFETY
WESTRACE is a safety system. To achieve and maintain the intended level
of protection, the equipment must be designed, maintained, and
operated in accordance with the instructions in this manual.
WARNING
2.2 Design Process

This section describes the WESTRACE design process. Parts of the design
process are also described in the WESTRACE CS Manual and the WESTRACE
GCSS Manual.
Figure 2.1 depicts the WESTRACE design process based on using GCSS to
design an HVLM, VLM5 or VLM6 based system.

2.2 Design Process
Figure 2.1 Design Process Flowchart—WESTRACE
2-2 Invensys Rail

2.2 Design Process
2.2.1 Determine Suitability

Investigate, specify, design and agree on the following before deciding the
type of interlocking:
• System requirements;
• Safety requirements;
2
• External standards and requirements;
• Control tables, scheme plan, track plan and signalling plan;
• Other pertinent information as applicable.
Determine the suitability of WESTRACE:

• Does WESTRACE have appropriate capacity for the interlocking? See
section 2.2.3;
• Are the inputs and outputs located at appropriate distances for cabling?
• Is the environment (such as temperature range) suitable for WESTRACE?
• Are the operating voltages of the signalling equipment to be controlled
compatible with the voltages available in the WESTRACE equipment?
• Are the signal lamps suitable for direct control from WESTRACE lamp
driver modules?
• Is the proposed non-vital control system compatible with the WESTRACE
non-vital communications protocols?
Full details of the WESTRACE modules are provided in Chapter 4 and

Appendix A.

2.2 Design Process
2.2.2 Design the Architecture

Determine the appropriate architecture for the WESTRACE system.
System architecture considerations include:

• supporting network architecture (using Information Technology (IT)
expertise);
• single or multiple VLM system. A multi-VLM system is used when a single
VLM system has insufficient capacity or when some remote I/O is
required;
• stand-alone or standby configuration. Standby improves system
availability by duplicating all hardware;
• interfaces with adjacent interlockings;
• local and remote control facilities;
• local and remote diagnostic facilities.
See section 2.3 for examples of typical WESTRACE system block diagrams:
• Figure 2.2 Simple WESTRACE Systems with Local Panel—Typical—
HVLM128 or VLM5
• Figure 2.3 Simple WESTRACE System with Local Panel—Typical—
VLM6 with NCDM
• Figure 2.4 Multiple WESTRACE Systems with Local Panel and
Duplicated Communications Bearers—Typical—HVLM128
or VLM5
• Figure 2.5 Multiple WESTRACE Systems with Local Panel—Typical—
VLM6 with NCDM
• Figure 2.6 Master–Slave WESTRACE System with Local Panel and
Single Bearer—Typical—HVLM128 or VLM5
• Figure 2.7 Master-Slave WESTRACE System with Local Panel—
Typical—VLM6 with NCDM
• Figures 2.8 Multiple WESTRACE System with Physical Separation
Between Systems—Typical—HLVM128 or VLM5
• Figure 2.9 Multiple WESTRACE System with Physical Separation
Between Systems—Typical—VLM6 with NCDM
• Figure 2.10 Multiple Address WESTRACE System with Physical
Separation Between Systems—Typical—Older
Configuration
• Figure 2.11 Hot standby WESTRACE System (simplified)—Typical—
HVLM128 or VLM5
• Figure 2.12 Hot standby WESTRACE System (simplified)—Typical—
VLM6 with NCDM
Assemble all information from sources such as control tables, scheme plan,
and track plan.
2-4 Invensys Rail

2.2 Design Process
2.2.3 Determine System Requirements

Details of these items are in subsequent subsections.
• Determine the VLM, diagnostic and non-vital communications modules.
See sections 2.2.3.1 to 2.2.3.3. 2
• Determine the number of vital communications connections over a
network.
• Determine type and number of vital serial communications modules —
depends on whether the interlocking is a single or multi-WESTRACE
system, and on any required inter-interlocking connections. See section
2.2.3.4.
• Determine type and number of vital parallel I/O modules—depends on
the nature of the railway signalling equipment being controlled. See
section 2.2.3.6.
• Determine whether a WESTECT Communications Module is required—
only applicable when the WESTRACE system is functioning as a WESTECT
ATP Encoder.
• Check that there are sufficient slots to accommodate the required
modules. If not, the interlocking will need to be split into a multi-
WESTRACE system. See section 2.2.3.8.
• Calculate the total module communication time and check that it is within
the specified limits. If not, the interlocking will need to be split into a multi-
WESTRACE system. See section 2.2.3.9.
• Determine the power supply requirements for each WESTRACE. See
section 2.2.3.10.
2.2.3.1 Vital Logic Module

Each WESTRACE system requires one VLM.
Four types of VLM are available, with these capacities:

• VLM6—4000 mnemonics, approximately 1800 rungs;
• VLM5—4000 mnemonics, approximately 1800 rungs;
• HVLM128—2500 mnemonics, approximately 750 rungs;
• VLM1—1000 mnemonics, approximately 300 rungs.
For more details, see section 3.2.1.1.
The type of VLM chosen influences the types of other modules which may be
used. Table 2.1 summaries the possible combinations.

2.2 Design Process
Table 2.1 Influence of VLM type on selection of other Modules
Vital
Comms
Diagnostic Over
VLM Module NVC VTC Network
VLM6 NCDM NCDM or EVTC232 Yes
NVC232 or or VTC232
NVC422
VLM5 NVC/DM NVC/DM or EVTC232 No

NVC232 or or VTC232
NVC422
HVLM128 NVC/DM or NVC232 or EVTC232 No

DM128 NVC422 or VTC232
VLM1 DM NVC232 or VTC232 No

NVC422
The VLM6 is the preferred module. It uses the latest technology, has greater
capacity, is suitable for stand-alone or hot standby systems and when used
with NCDM it supports vital communication over a network.
VLM5 is similar to the VLM6, however the VLM5 does not support vital
communication over a network. The VLM5 safety case was incomplete at the
publication date of this manual. Please ensure it is suitable before use.
The HVLM128 is similar to the VLM6 but has less capacity does not support
vital communication over a network.
The older VLM1 module is now only used in situations where VLM1
compatibility is a requirement.
2.2.3.2 Diagnostic Module

Each WESTRACE system requires one Diagnostic Module.
At present, the following types of Diagnostic Module are in service:

• NCDM (for VLM6);
• NVC/DM (for HVLM128 or VLM5);
• DM128 (for HVLM128);
• DM64 (for VLM1).
The NCDM is the preferred diagnostic module. It is suitable for stand-alone

or hot standby systems, supports the Diagnostic Protocol over both network
and serial interfaces, and can be connected to a PC running MoviolaW,
Getlog or NGetlog (see [FLM]).
The NVC/DM provides up to three Diagnostic Protocol serial interfaces, and

can be connected to a PC running MoviolaW or Getlog (see [FLM]).
The DM64 and DM128 provide two different text-based serial interfaces, and
may be connected to a PC running MoviolaW, a terminal emulator, or the
Diagnostic Logging Package (see [FLM]).
2-6 Invensys Rail

2.2 Design Process
2.2.3.3 Non-Vital Communications

Four types of non-vital communication modules are available:
• NCDM—provides one Ethernet compliant network interface and up to two
RS232 or RS485 interfaces;
The network interface supports up to 16 network sessions using the
2
WSA/S2 or WSL/S2 protocol and supports the transfer of at least 256
inputs and outputs per protocol session at 10 Mbits/sec;
• Each serial interface supports up to 62 WSA/S2 or WSL/S2 housing
addresses and supports the transfer of at least 256 inputs and outputs
per housing address at up to 64000 bps;
• NVC/DM—provides up to six RS232 or RS485 interfaces and transfers up
to 4096 inputs and outputs using the WSA/S2 or WSL/S2 protocol at up to
64000 bps;
• NVC232—provides a single RS232 interface and transfers up to 48 inputs
and 64 outputs using the WSA/S2 protocol at up to 4800 bps;
• NVC422—provides a single RS422 interface and transfers up to 48 inputs
and 64 outputs using the WSA/S2 protocol at up to 4800 bps.
A WESTRACE system may contain either one NCDM module or one NVC/DM
module and up to ten NVC232 or NVC422 modules. The NCDM is the
preferred option.
2.2.3.4 Vital Communications—Serial

Two types of VTC module are available:
• EVTC232—provides a single RS232 interface and transfers up to 66 inputs
and outputs;
• VTC232—provides a single RS232 interface and transfers up to 17 inputs
and outputs.
Each WESTRACE system may contain up to eight VTC modules. The EVTC232
is the preferred option.
2.2.3.5 Vital Communications—Network

A VLM6 used in conjunction with an NCDM supports vital communication
over a network for up to 16 connections to one or more connected
WESTRACE systems. Each vital communication connection over a network
transfers up to 182 inputs and outputs (26 bytes with 7 data bits and 1 parity
bit).
2.2.3.6 Vital Parallel I/O

Three types of vital parallel I/O modules are available:
• VROM50—provides 8 relay outputs;
• VPIM50—provides 12 relay inputs;
• VLOMFT110—provides 12 steady or flashing 110V lamp outputs.

2.2 Design Process
2.2.3.7 WESTECT Communications Module

A WESTECT ATP Encoder system must include a WCM.
2.2.3.8 Slot Usage

A four-housing WESTRACE system contains 60 slots.
Determine whether the required modules will fit into a single WESTRACE
system by adding up the slots required by each module. Refer to Chapter 3.
Note: All VLM modules require three slots when used in Invensys Rail applications.
An NCDM occupies one slot when used in conjunction with a VLM6.
Divide the system into multiple housings if there are insufficient slots. Use vital
communication over the network to connect the systems, alternatively add EVTC
modules to connect the systems. This may require a relocation of modules.
Use GCSS (or CSS) to place all modules in housings.
2.2.3.9 Module Communication Time

Each VLM imposes a maximum communication time limit for transferring data
to input and output modules. Section 3.2.1.3 specifies the time required by
each module.
Determine whether the VLM can support the required number of modules by
adding up the communication times for each module.
Divide the system into multiple housings if the maximum communication

time is exceeded. Use vital communication over the network to connect the
systems, alternatively add EVTC modules to connect the systems. This may
require a relocation of modules.
2.2.3.10 Estimate Power Supply

Ensure there are enough power supplies to power all modules.
The simple solution is to fit a Power Supply Module (PSU) in each housing.
However if the system is small or there is some restriction, fewer PSUs might
be adequate.
Calculate the total requirements of each WESTRACE system using the values
and formulas provided in section 3.3. The number of PSUs required can be
determined as well as the total WESTRACE 24 Vdc power consumption.
The power consumption of the different serial and parallel I/O modules varies
for each of the voltage rails.
The 24 Vdc power for a WESTRACE system should be sourced from a no-
break supply; generally this will be a battery and float charger.
Estimate the power supply requirements for relays and lamps controlled by
the WESTRACE system separately.
2-8 Invensys Rail

2.2 Design Process
2.2.4 Design the External Interfaces

Design the external interfaces including, as required:
• connections to power supply;
• restart circuit (see section 4.1.4); 2
• OPCRs (see section 4.1.8);
• vital communication over a network;
• vital serial communications (see section 3.8);
• non-vital network communications;
• non-vital serial communications;
• parallel inputs and outputs;
• in-line surge suppressors (see section 4.13);
• earthing and bonding (see section 5.1);
• lightning and surge protection (see section 5.4).
Note: Additional protection is required for WESTRACE equipment in lightning-

prone locations (see section 5.4) or generally electrically noisy areas.
2.2.5 Specify Logic Standards

Determine any standards and prototype circuits that should be used in the
design.
2.2.6 Design & Check Application Logic, Inputs and Outputs

The logical relationship between inputs, outputs, internal states and timers is
defined using GCSS for VLM6, VLM5 or HVLM based systems:
• GCSS v6.0 or later if the system includes a VLM6 or NCDM;
• GCSS v5.2 or later if the system includes an NVC/DM;
• GCSS v5.0 or later if the system includes a VLM5.
Use CSS for VLM1 based systems.
Use the control table and track plan data for the signalling system to develop
a GCSS or CSS installation file.
The GCSS or CSS will generate print-outs or files for checking and approval
of the system design. The system design must be checked and approved
before the system is tested and commissioned.
See [GCSS] or [CSS], as appropriate for further details.
2.2.6.1 Vital Logic

Prepare the vital logic for the VLM. Add this data to the GCSS or CSS
installation file.

2.2 Design Process
2.2.6.2 Non-Vital Logic

Prepare the non-vital logic for the NCDM or NVC/DM (if used) and determine
the required network or non-vital serial port configuration. Add this data to
the GCSS installation file.
2.2.6.3 Inputs and Outputs

Prepare the inputs from and outputs to equipment external to the
WESTRACE application. Add this data to the GCSS installation file.
2.2.7 Approve the Design

Before the design is principles tested, the complete design must be:
• checked by a Signal Engineer;
• independently approved by a different Signal Engineer.
2.2.8 Test the Logic

Invensys Rail recommends that both the vital and non-vital logic be tested
prior to installing equipment in the field to:
• ensure the logic works;
• save time;
• avoid interrupting rail operations.
CSS has a simulation function to test the logic of the systems designed in CSS.
GCSS does not provide a simulation facility. Invensys Rail recommends
testing systems designed in GCSS with GSIM or ISIM.
WESTRACE GSIM (Graphic Simulator) is a PC application that enables

Railway Signal Engineers to validate the railway signal logic and perform
principle testing before programming PROMs and using them on the target
hardware (or in WESTRACE ISIM for further testing). GSIM3 or later is also
able to simulate the NVC/DM non-vital logic.
WESTRACE ISIM (Interlocking Simulator) is a WESTRACE and S2 based tool

that enables Railway Signal Engineers to test railway signalling logic and
optionally non-vital control (Interlogic data) for railway signal interlockings in
the office prior to commissioning a system.
2-10 Invensys Rail

2.2 Design Process
2.2.9 Assemble and Configure Modules

Assemble the WESTRACE system hardware according to the requirements
determined in this section and the GCSS or CSS reports that depict the
placement of modules in the WESTRACE housing(s).
2
Configure the WESTRACE modules for site specific conditions as indicated in
table 2.2.
Table 2.2 Module Configuration
Module Details
VLM Set CED Version switches (refer GCSS Installation Assembly
Details report)
Set installation address on Vital Backplane Card (refer GCSS
Installation Assembly Details report)
NCDM Set Non-Vital Configuration Version switches
NVC/DM Set Non-Vital Configuration Version switches
NVC Set switches to select data transfer rate, address etc
DM Set switches to select data transfer rates and other options
See Appendix A for full details.
Compatibility
WESTRACE modules and application data have a compatibility index. It

ensures the installation works correctly.
Table 2.3 shows the range of compatibility index values that may be used by
each company in the Invensys Rail group.
Table 2.3 Module Compatibility Index—Values
Company Compatibility Index Range

WSA 3–31
DIMETRONIC 32–63
WSL 64–95
Safetran 96–127
All modules within an installation must have the same compatibility index.
An installation will not start up when it is fitted with modules that have
different compatibility indices.
Ensure:
• Compatible WESTRACE modules are used (see section 2.2.3);
• Communicating WESTRACE systems have acceptable compatibility
indices, see above.

2.2 Design Process
2.2.10 Install Vital PROM Data or Non-Vital Configuration and Verify

a) Load the approved Vital PROM Data into PROMs and install in the
sockets on the VLC card.
b) Load the approved Non-Vital Configuration into the NCDM or NVC/DM.
c) Use ICS (or CCSS) to check that the correct application data is installed
in a system. See [ICS] or [CCSS] as appropriate.
2.2.11 Check and Commission

The installation should be checked for correspondence. It may not be
necessary to repeat functional checks performed in simulation.
Check the system to verify:

• correspondence between the system and its inputs and outputs;
• that field equipment such as signals and points operate to plan;
• that no significant changes have occurred during the design process.
Commission the system.
2-12 Invensys Rail

2.3 Typical System Block Diagrams
Figure 2.2 Simple WESTRACE Systems with Local Panel—Typical—HVLM128 or

VLM5

Figure 2.3 Simple WESTRACE System with Local Panel—Typical—VLM6 with NCDM
2-14 Invensys Rail

Figure 2.4 Multiple WESTRACE Systems with Local Panel and Duplicated
Communications Bearers—Typical—HVLM128 or VLM5

Figure 2.5 Multiple WESTRACE Systems with Local Panel—Typical—VLM6 with

NCDM
2-16 Invensys Rail

Figure 2.6 Master–Slave WESTRACE System with Local Panel and Single Bearer—
Typical—HVLM128 or VLM5
The master system is normally used to process the majority of the logic.
The slave WESTRACE can be used for local processing, if required.

Figure 2.7 Master-Slave WESTRACE System with Local Panel—Typical—VLM6 with

NCDM
The master system is normally used to process the majority of the logic.
The slave WESTRACE can be used for local processing, if required.
2-18 Invensys Rail

Figure 2.8 Multiple WESTRACE System with Physical Separation Between Systems—
Typical—HLVM128 or VLM5

Figure 2.9 Multiple WESTRACE System with Physical Separation Between Systems—
Typical—VLM6 with NCDM
2-20 Invensys Rail

Figure 2.10 Multiple Address WESTRACE System with Physical Separation Between
Systems—Typical—Older Configuration

Figure 2.11 Hot standby WESTRACE System (simplified)—Typical—HVLM128 or

VLM5
2-22 Invensys Rail

S2 System—only if required
Figure 2.12 Hot standby WESTRACE System (simplified)—Typical—VLM6 with NCDM

2-24 Invensys Rail

Chapter 3: System Application
3.1 WESTRACE Components
3. SYSTEM APPLICATION
This chapter describes how to determine the system requirements for:
• allocating WESTRACE modules;
• power supplies;
• communications.
3
Table 3.1 is a list of WESTRACE components and their variations at the
release time of this manual.
Refer to the Invensys Rail web site

(http://www.invensysrail.com) for the latest product information.
You can download a listing of our complete product range or a Short-Form

Catalogue that contains a pictorial and descriptive summary of our major
product groups, with references to our data sheets.
These can be found under ‘Product’ on the web page menu bar.
Table 3.1 WESTRACE Modules
Name Description Slot Part No.

110V ARR LEFT 110V Surge Arrester External Cables from Left - 2650 1103 02
110V ARR RIGHT 110V Surge Arrester External Cables from Right - 2650 1103 12
50V ARR LEFT 50V Surge Arrester External Cables from Left - 2650 1103 01
50V ARR RIGHT 50V Surge Arrester External Cables from Right - 2650 1103 11
Backplane VLE System Backplane - 2650 1126 01
Battery Lithium Battery for DM and DM128 - 4496/3-18
Battery Lithium Battery for NVC/DM - 6104 5004 9
Blanker System Continuity Card 1 4650 1057 01
CEC Configuration Element Card (part of VLM1) 1 3650 1101 01
CIMFIM Communications Interface Module, Filter & Interface 1 2650 1231 01

Module (part of NVC/DM)
CIMPM Communications Interface Module, Protection Module - 2690 1064 01

(for CIMFIM)
DM Diagnostic Module (used with VLM1) 1 3650 1099 11
DM128 Diagnostic Module (used with HVLM128) 1 3650 1099 12
EC1 Expansion Cable 1 - 3650 1144 01
EPROM CED EPROM for VLM1 - 4985/369
EPROM CED EPROM for HVLM128 - 2680 0004 35

Table 3.1 WESTRACE Modules (Continued)

EEPROM (DIL) CED EEPROM for VLM5 - TBA
EEPROM (PLCC) CED EEPROM for VLM6 (AMD AM29F010B) - 612450626
EEPROM adapter PLCC to DIL adapter (Aries 32-653000-11-RC) 616580141
EVTC232 Enhanced Vital Telemetry Continuous RS232 1 3650 1129 13

(used with HVLM128 and VLM5)
HOPC50PFM HVLM OPC50 Protection Filter Module - 2650 1140 01

(for OPC50 when part of VLM5 and HVLM128)
HSYS1HSG HVLM Single Card cage complete with Backplane, HVBC + - 1690 1056 01
EC1
HSYS2HSG HVLM Double Card cage complete with Backplane, HVBC - 1690 1057 01
+ ECs (for single PSU24)
HSYS2HSG HVLM Double Card cage complete with Backplane, HVBC - 1690 1057 02
+ ECs (for dual PSU24)
HSYS3HSG HVLM Triple Card cage complete with Backplane, HVBC + - 1690 1058 01
ECs (for single PSU24)
ECs (for dual PSU24)
ECs (for triple PSU24)
HSYS4HSG HVLM Quadruple Card cage complete with Backplane, - 1690 1059 01
HVBC (for single PSU24)
HVBC (for dual PSU24)
HVBC (for triple PSU24)
HVBC
HVBC Hot Standby Vital Backplane Card (used with VLM5 and - 4663/222
HVLM128)
HVLC128 Hot Standby Vital Logic Card (part of HVLM128) 1 3650 1141 11
HVLM128 Hot Standby Vital Logic Module 1 –
LEC Logic Evaluation Card (part of NVC/DM) 1 2650 1230 01
NCDM Network Communication Diagnostic Module—style 1: 1 –

comprises NCDC and NCD PFM
NCD PFM Network Communication Diagnostic Protection Filter - 4663/271

Module—Style 1 (obsolete)
NCDC PFM Network Communication Diagnostic Protection Filter - B47000/138E

Module—Style 2 A
NCDC Network Communication Diagnostic Card—Style 1 1 4663/270

(Mod D Rev 7)
NCDC Network Communication Diagnostic Card—Style 2 1 TBA

(Mod E Rev 8)
3-2 Invensys Rail


NVC/DM Complete Non-Vital and Communications Module. 2 2690 1065 01
Includes LEC, CIMFIM and software
NVC232 Non-Vital Telemetry RS232 1 3650 1139 14
NVC232CT Non-Vital Telemetry RS232, clock reconstruction, 1 3650 1139 13
NVC232T
tri-state
Non-Vital Telemetry RS232, tri-state 1 3650 1139 12

3
NVC422-M Non-Vital Telemetry RS422, tri-state 1 3650 1139 10
NVC422-NM Non-Vital Telemetry RS422, clock reconstruction, 1 3650 1139 11

tri-state
OPC50 Output Power Card 50 V 1 3650 1102 04

(part of VLM1, VLM5, VLM6, HVLM128)
OPC50PFM OPC50 Protection Filter Module (for OPC50) - 3650 1136 04
PSU EXP1 PSU Expansion Cable for Double Card cage - 3650 1147 01
PSU EXP2 PSU Expansion Cable for Triple Card cage - 3650 1148 01
PSU EXP3 PSU Expansion Cable for Quadruple Card cage - 3650 1149 01
PSU24 Power Supply Unit 24V - 3650 1131 01
PSU24PFM PSU24 Protection Filter Module (for PSU24) - 3650 1104 01
SDB232 Serial Daughter Board 232 (for CIMFIM) - 2650 1232 01
SDB485 Serial Daughter Board 485 (for CIMFIM) - 2650 1233 01
SIO232PFM Serial Interface Protection Filter Module RS232 - 3650 1123 01

(used with VTC232, EVTC232, WCM, NVC232, DM,
DM128)
SIO422PFM Serial Interface Protection Filter Module RS422 - 2650 1138 01

(for NVC422)
SYS1HSG Single card cage complete with Backplane, VBC + EC1 - 1690 1027 01
SYS2HSG Double card cage complete with Backplanes, VBC + ECs - 1690 1028 01
SYS3HSG Triple card cage complete with Backplanes, VBC + ECs - 1690 1029 01
SYS4HSG Quadruple card cage complete with Backplanes, - 1690 1030 01

VBC + ECs
UHSYS1HSG Single Card cage complete with Backplane, UHVBC + EC1 - 1690 1067 01
UHSYS2HSG Double Card cage complete with Backplane, UHVBC + - 1690 1068 01
ECs (for single PSU24)
UHSYS2HSG Double Card cage complete with Backplane, UHVBC + - 1690 1068 02
ECs (for dual PSU24)
UHSYS3HSG Triple Card cage complete with Backplane, UHVBC + ECs - 1690 1069 01
(for single PSU24)
(for dual PSU24)
(for triple PSU24)


UHSYS4HSG Quadruple Card cage complete with Backplane, UHVBC - 1690 1070 01
(for single PSU24)
(for dual PSU24)
(for triple PSU24)
UHVBC Universal Hot standby Vital Backplane Card (Used by - 4663/268

HVLM128, VLM5 or VLM6)
VBC VLM Backplane (used by VLM1) - 3650 1105 01
VLC Vital Logic Card (part of VLM1) 1 3650 1100 10
VLC5 Vital Logic Card 5 (part of VLM5) 1 4663/269
VLC6 Vital Logic Card 6 (part of VLM6) 1 3650 1141 12
VLM See VLM1, HVLM128, VLM5 or VLM6 – –
VLM1 Vital Logic Module 1 1 –
VLOM110PFM VLOM Protection Filter Module 110 V - 3650 1135 04

(used with VLOMFT110)
VLOMAB Vital Lamp Output Module Analogue Board 2

(2 form part of VLOMFT110)
VLOMFS110 Vital Lamp Output Module 12 x Steady/Flash 110 V, 3 1690 1018 01

(6 Lamps)
VLOMFT110 Vital Lamp Output Module 12 x Steady/Flash 110 V, 3 1690 1020 01

(12 Lamps)
VLOMSS110 Vital Lamp Output Module 12 x Steady/Flash 110 V, 3 1690 1017 01

(6 Lamps)
VPIM50 Vital Parallel Input Module 50 V (12 inputs) 2 1690 1007 01
VPIM50PFM VPIM50 Protection Filter Module (for VPIM50) - 3650 1112 01
VPIMAB Vital Parallel Input Module Analogue Board (part of

VPIM50)
VPIODB VPIO Digital Board 1

(part of VLOMFT110, VROM50, VPIM50)
VROM50 Vital Relay Output Module 50 V (8 Outputs) 2 1690 1023 01
VROM50PFM VROM50 Protection Filter Module (for VROM50) - 3650 1137 04
VROMAB Vital Relay Output Module Analogue Board (part of 1

VROM50)
VTC232 Vital Telemetry Continuous RS232 1 3650 1129 10
WCM WESTECT Communication Module (RS232) 1 3650 1129 12
WNCM WESTRACE Network Communication Module (VLC6 and 2 3650 1141 13

NCDC mated together)
3-4 Invensys Rail

Note: A 12-lamp VLOM requires two VLOM PFMs.

3.2 Allocating Modules
Note: The VLM is allocated to housing number one.

Each WESTRACE System must contain a single VLM.
Each WESTRACE System must contain at least two vital modules in
addition to the VLM.
The NCDM is allocated to housing 1, adjacent to the VLM6.
Only one diagnostic module (NCDM, NVC/DM, DM128 or DM) may be
used per installation.
3.2.1 System Capacity

Ensure the system requirements are met by the WESTRACE system.
3.2.1.1 Logic Processing

The maximum system capacity is listed in table 3.2.
Table 3.2 WESTRACE System Capacity Specifications
FUNCTION VLM1 HVLM128 VLM5 VLM6 NCDM NVC/DM

Mnemonics 1000 2500 4000 4000 40000 40000
Internal Latches 384 2057 3357 3357 15000 15000
SR Latches – – – – 2000 2000
Timers 96 200 300 300 3000 3000
Time-of-day Timers – – – – 10 10
1 1 2 1 2 1 2 1
Approximate limit to 300 750 1800 1800 15000 150001
number of logic rungs
1. Capacity depends on the complexity of the rungs.
2. Reduce by 30% for hot standby.
Note: An internal latch is any mnemonic that is not declared to be an input, an

output, a timer start, or timer expired.
3.2.1.2 Limits on Number of Modules

The number of modules is limited by the GCSS (or CS) to the maximum that
can be fitted into a four-housing system and table 3.3.
3-6 Invensys Rail

Table 3.3 Module Number Limits
Module Maximum Number Slots per Module

VPIM50 26 2
VROM50 26 2
VLOMFT110 18 3
VTC232, EVTC232 8 1
WCM 1 1 3
DM, DM128 1 1
NCDM 1 1
NVC/DM 1 2
NVC232, NVC422 10 1
3.2.1.3 Communication Time Limits

A finite amount of time is required for the VLM to communicate with each
module in the System. Different modules require different times.
The limits for total communications time are:

• 333 ms for VLM6;
• 333 ms for VLM5;
• 200 ms for HVLM;
• 100 ms for VLM1.
This restriction is enforced by CS (but not GCSS). The communication time

required by each module is listed in table 3.4.
Table 3.4 Module Communication Times
Module Communication Time (ms)

VPIM 1.8
VROM 2.3
VLOMFS 2.8
VLOMFT 4.8
VTC 7.8
EVTC 13.6
WCM 13.8
NVC 3.5
NVC/DM 25 when used with HVLM128

33 when used with VLM5
NCDM 15 when used with VLM6
DM 15.0
DM128 15.0

3.2.1.4 Housings System Conventions

Figures 3.1 to 3.3 shows the numbering convention and number of slots
available for interface modules on each housing. Figures 3.1 to 3.3 also
shows the recommended positions of the DM, NVC/DM and NCDM modules.
By convention, the housings are numbered from top to bottom, 1 to 4, and
the slots from right to left, 1 to 15. The diagram depicts the housings viewed
from front.
Figure 3.1 WESTRACE Housing & Slot Nomenclature—VLM6 & NCDM

Configuration
Figure 3.2 WESTRACE Housing & Slot Nomenclature—HVLM128 or VLM5 &

NVC/DM Configuration
3-8 Invensys Rail

Figure 3.3 WESTRACE Housing & Slot Nomenclature—Older Configuration
3.2.1.5 Slot Availability

Some slots are automatically allocated by the configuration system and are
not available for interface modules (see figures 3.1 to 3.3):
• a VLM6, VLM5 or HVLM occupies slots 2 and 3 and a blanker fills slot 1 of
housing number 1 although GCSS and ICS will show the VLM6, VLM5 or
HVLM in slots 1 and 2;
• an NCDM occupies slot 4;
• a VLM1 occupies slots 1, 2 and 3.
Invensys Rail recommends:

• an NCDM occupies slot 4;
• an NVC/DM occupies slots 4 and 5;
• a DM or DM128 occupies slot 15.
Although the diagram shows one PSU per housing, the actual number of
PSUs required in a multi housing system, and the total power taken from the
external +24 V source, depends on the configuration of the installation (see
section 3.3).
The types of modules available and the number of slots occupied by each
module are listed in section 3.1.

3.3 Power Supply
3.3 Power Supply

Ensure that sufficient power is provided for the WESTRACE system.
The external power supply to any WESTRACE equipment (B24) must be from
a guaranteed no-break supply. This will normally be a float charged battery.
The required supply voltage is 24 V nominal (20 to 30 V instantaneous).
Table 3.5 shows power outputs generated by PSU and OPC from the B24.
Table 3.5 Output Power
Output Power Capabilities (Watts)
+12V
MODULE +5V +12V -12V (power) VSEV
PSU 25 6 6 30 -
OPC - - - - 8
Table 3.6 shows the maximum power consumption or each WESTRACE

module.
Table 3.6 Power Consumption of WESTRACE Modules
Module Maximum Power Consumption (Watts)
+12V
MODULE +5V +12V -12V (power) VSEV B24
VLC6 3.3 - - - - -
VLC5 2.0 - - - - -
HVLC 1.8 - - - - -
VLC 0.9 - - - - -
CEC 0.1 - - - - -
OPC 0.2 - - - - 15.0
VPIM 1.1 0.2 0.3 - - -
VROM 1.25 0.6 0.1 1.3 - -
VLOM 1.25 0.6 0.6 5.0 - -

12 Outputs
VLOM 1.25 0.6 0.6 3.0 - -

6 Outputs
WCM 1.2 - - - 1.0 -
EVTC or 1.2 - - - 1.0 -

VTC
NVC 0.8 - - - - 1.0
NVC/DM 7.0 - - - 1.0 8.0
NCDM 4.2 - - - 1.0 2.5
DM or 2.0 - - 0.6 - -
DM128
3-10 Invensys Rail

3.3 Power Supply
3.3.1 Calculating Power Requirements
Note: Power consumption quoted for VROM +5 V is the maximum power at

start-up.
Never connect more than one NVC module to the VSEV.
3.3.1.1 Determine the Number of PSUs 3

Invensys Rail recommends using one PSU per housing (although a single PSU
can supply multiple housings).
Tally the wattage taken from the +5 V by each module. If the total is greater
than or equal to the output of a single PSU, use up to three additional PSUs.
Repeat the calculation for the +12 V, -12 V and +12 V (power) supplies.
A limit of four PSUs cannot be exceeded.
For example, a typical installation may contain:

Module Type Qty
(VLC6 + OPC) 1
VPIM 5
VROM 8
VLOM 4
NCDM 1
The power consumption totals taken from the internal supplies by the
modules from the PSU(s) are:
+5 V = 28.2 W = 2 PSU
+12 V = 8.2 W = 2 PSU
-12 V = 4.7 W = 2 PSU
+12 V (power) = 30 W = 2 PSU
Thus two PSUs are required.
3.3.1.2 Determine Power Consumption

Determine the power required from the external 24 V supply.
The PSU has an efficiency of approximately 66%. Thus the power taken from
the external 24 V supply by the PSU to supply the internal power for a module
will be 1.5 times the sum of the total power drawn from the internal supplies.
The power drawn from the external 24 V supply will be:

Total Internal Power × 1.5 + OPC + NCDM
= ((28.2+ 8.2 + 4.7 + 30) × 1.5) + 15 + 2.5
= (71.1 × 1.5) + 15 + 2.5
= 106.65 + 15 + 2.5
= 124.15 W

3.3 Power Supply
This figure for power taken from the external 24 V supply does not include
provision for the signalling loads themselves (such as relays and lamps).
Note: Use the correct power source for NVC and NVC/DM B24 supply:
• a single NVC may be supplied from VSEV;
• multiple NVCs should be supplied from B24 (can be via an OPC
repeat contact to prevent communications when WESTRACE is
not running);
• NCDM and NVC/DM should be supplied from B24 directly
(an OPC repeat contact will prevent using diagnostics after
shutdown).
3-12 Invensys Rail

3.4 Fusing
3.4 Fusing
Ensure that all signalling supplies to the WESTRACE installation are suitably
fused or protected against overcurrent.
Fuse values depend on the local configuration. We recommend a fuse value

of 1.5 times the maximum expected current.
Choose fuses and circuit breaker ratings to provide adequate discrimination.
The 24 V supply to housings can be provided either through a single fuse, or

3
through individual fuses. If individual fuses are used, always insert the fuse for
the top housing last when powering the system.
NCDC PFM Fusing
Note: We recommend that you power the NCDC PFM through the same fuse as
the top WESTRACE housing.
Failure to power the NCDC PFM in this way on a hot-standby system can lock up
serial communications if individual housing fuses are used and one blows.

3.5 Network Communication
3.5 Network Communication

A WESTRACE system configured with a NCDM provides a single 10 baseT,
Ethernet compliant network interface. The interface uses the UDP/IP protocol
suite as the underlying protocol.
The NCDM Non-Vital Configuration allows the configuration of:

• Default gateway address;
• Five additional gateway addresses;
• Subnet mask.
The network interface supports a total of 48 configurable network sessions.

These sessions can be configured as either:
• Vital Communication sessions (only available when the NCDM is used in
conjunction with a VLM6);
• Non-Vital Communication sessions (for connection to external control
systems and external diagnostic systems).
Note: When ‘store and forward’ communication equipment is used as part of

the network infrastructure, the transmission of stored data following re-
establishment of the communication link after a loss of communication
should be disabled otherwise excessive network traffic may cause the
NCDM to shutdown.
3-14 Invensys Rail

3.6 Vital Communication Over a Network

Vital communication over a network allows the transfer of logic states
between WESTRACE systems. A WESTRACE system may be connected to up
to 16 other systems using vital communications over a network.
Each WESTRACE system may be arranged as a hot standby or stand-alone

installation.
Each vital communication session can transfer up to 182 inputs and up to 182 3
outputs (26 bytes with 7 data bits and 1 parity bit).
3.6.1 Data Integrity

The vital communication protocol used by WESTRACE has the following
features to assure the integrity of transferred data:
• Parity bits and ‘true’ and ‘complement’ representation are used to protect
the data in vital communication messages in the same way as
communications between the VLM6 and other modules within a
WESTRACE system are protected.
A message is discarded when the ‘true’ and ‘complement’ representations
are not coherent or a parity error is detected;
• A CRC error detection code is included in the ‘true’ and ‘complement’
representations of each vital communication message so that any
corruption which occurs during transmission can be detected.
This is checked by the receiver and corrupted messages are discarded;
• Unique installation addresses for both the transmitting and receiving
WESTRACE, and the vital port number (8-23) for each WESTRACE are
included in every vital message.
The receiver checks these and discards incorrectly addressed messages.
Ensure:
• Only vital data is transferred over vital communication sessions;
• Communicating WESTRACEs are compatible (see section 3.6.2).
3.6.2 Compatibility
The vital communication protocol used by WESTRACE protects against
incompatible vital messaging:
• Module compatibility index—communication can only occur between
modules with acceptable (normally identical) compatibility indices;
• The application data version of the remote WESTRACE must match the
data version contained in the local interface file;
• Source and destination network addresses;
• Vital port numbers.
These message fields are checked by the receiver and incompatible

messages are discarded.

Ensure:
• Compatible WESTRACE modules are used when WESTRACEs are
required to communicate vitally;
• The interface file for each WESTRACE reference the correct application
data version in the other WESTRACE;
It may be necessary to update the application data (vital CED) in both
WESTRACEs of a communicating pair when the application data of one
WESTRACE is changed;
• Source address, destination address and vital port numbers are correct
and compatible in both WESTRACEs;
Source and destination address and vital port numbers are set up when
configuring the WESTRACE installation interface file using the WESTRACE
Graphical Configuration Sub-system. See reference [GCSS].
3.6.3 Time and Sequence Integrity

The vital communication protocol used by WESTRACE has the following
features to assure time and sequence integrity:
• A Receive Timestamp (time when the last message was sent to the remote
system) to enable the round trip time of a message to be determined.
The receiver assumes a message to be delayed and discards it when the
Receive Timestamp in the message differs from the current installation
time by more than a pre-defined value;
• A Transmit Timestamp to enable the sequence of the message to be
determined;
The receiver discards the message when the Transmit Timestamp in the
current message is found to be the same as or earlier than the last valid
Transmit Timestamp received.
Ensure that the communications network is designed to minimise

unacceptable delays to messages as this can lead to session failure. See
section 3.6.4.1.
3-16 Invensys Rail

3.6.4 Loss of Communication (LOC)
3.6.4.1 Session Failures

The vital communication session will be considered ‘timed out’ if no valid vital
communication message is received within the configurable Loss Of
Communication (LOC) period (see section 3.6.4.2).
This causes the VLM6 to:

• De-energise the #LOC (Loss Of Communication #) reserved mnemonic;
3
• Assume that all input states associated with the failed session are de-
energised.
Apart from the above, both WESTRACE systems will continue operating
normally (ie not shutdown) in the event of a vital communication session
failure.
Ensure that de-energised vital communication inputs are always a safe state.
3.6.4.2 LOC Time-out Period

The VLM6 uses the Loss of Communication (LOC) timeout period for each
vital communication over a network to determine:
• When de-energised states are assumed for inputs associated with a vital
communication session;
• The acceptable limit for round trip time of a vital message.
Table 3.7 identifies the recommended LOC timeout values for two
WESTRACE installations communicating vitally over a network. It includes:
• Combinations of installations with the minimum, maximum and practical
cycle times;
• Stand-alone and hot standby configurations.
The practical cycle time is the anticipated maximum cycle expected for
applications of main WESTRACE (interlocking function only) and WESTRACE
Object Controller (vital I/O function only).

Table 3.7 LOC Timeout Values—Recommended—Two WNC Installations with Vital

Comms Over a Network
Remote Installation
Stand-alone Hot Standby

Local
Installation WNC WNC
Minimum Maximum Minimum Maximum
Practical Practical
Cycle Time Cycle Time Cycle Time Cycle Time
Cycle Time Cycle Time
Minimum
Cycle 1.8 s 3.3 s 2.7 s 2.4 s 3.5 s 2.9 s
Time
Stand-alone
Maximum
Cycle 2.5 s 4.0 s 3.4 s 3.1 s 4.2 s 3.6 s
Time
WNC
Practical 2.2 s 3.7 s 3.1 s 2.8 s 3.9 s 3.3 s
Cycle
Time
Minimum
Cycle 2.2 s 3.7 s 3.1 s 2.8 s 3.9 s 3.3 s
Time
Hot Standby
Maximum
Cycle 2.7 s 4.2 s 3.6 s 3.3 s 4.4 s 3.8 s
Time
WNC
Practical 2.4 s 3.9 s 3.3 s 3.0 s 4.1 s 3.5 s
Cycle
Time
Note: The LOC timeout value may be configured with values less than those
shown above, however this may result in some messages being
discarded as delayed due to the asynchronous cycle times of the
connected systems.
When the LOC time out value is set to the same value as the VLM6 cycle
time, any loss of message will cause the VLM6 to revert to de-energised
states.
Use the GCSS to configure practical LOC values.
Note: See Appendix A in reference [GCSS] to confirm the correct units to use
when configuring LOC through the GCSS.
3-18 Invensys Rail

3.6.5 Communication Media

The vital communication protocol used by WESTRACE is designed for use on
transmission systems where unauthorised access can be excluded.
Vital communication over a network could be exposed to the following

threats:
• Hacking (deliberate unauthorised interference);
• Excessive network traffic (unauthorised use of the network).
3
Sections 3.6.5.1 and 3.6.5.2 define the rules and guidance which must be
applied to the communication media as protection against these threats.
SAFETY
Observe the following restrictions.
WARNING
3.6.5.1 Hacking
Hacking is defined as the unauthorised access to communication bearers.
The hacker may be able to corrupt, re-transmit, or introduce illegal messages
into the system.
The defences against hacking are:

• No public access to the communication media;
• A complex message format.
Reduce the risk of hacking by ensuring:

• A dedicated railway network is used to render the communication media
less susceptible to outside disturbances;
• Networks used for administration purposes are not connected to
networks used for vital communication, unless the network used for vital
communication is protected by a firewall of an equivalent safety integrity;
• Third party communication media (hired or otherwise) are not used;
• Access to the network is physically restricted to authorised persons.
3.6.5.2 Excessive Network Traffic

Excessive network traffic or network flooding may occur as a result of
unauthorised use of the network. Network flooding can cause unacceptable
delays in the delivery of vital or non-vital messages which may result in the
loss of control of the railway.
Protect against network flooding by:

• Use of a sub-netting addressing scheme to minimise unnecessary
transmission of messages;
• Restricting the use of the network to vital and non-vital communications
for controlling the railway.

3.7 Non-Vital Communication Over a Network

Non-Vital communication over a network allows the WESTRACE system to
interface with other WESTRACE systems, external control systems and
external diagnostic systems.
WESTRACE supports the non-vital communication protocols described in

Appendix D.

The non-vital communication protocols used by WESTRACE have the
following features to assure integrity of transferred data:
• The data message is protected by:
A Block Check Sum Character (BCC) or Cyclic Redundancy Code
(CRC);
• A Block Check Sum Character (BCC) provided by the underlying
UDP/IP protocol suite.
• The data message includes:
A unique session ID;
• A housing or diagnostic address;
• Read and Read/Write passwords;
• Network (IP) addresses.
Ensure:
• Only non-vital data is transferred over non-vital communication sessions;
• Identifying IDs, addresses and passwords are correctly set when using the
WESTRACE Graphical Configuration Sub-system. See reference [GCSS].
3.7.2 Time and Sequence Integrity

The non-vital communication protocols used by WESTRACE have the
following features to assure time and sequence integrity of the transferred
data:
• A Receive Timestamp to enable the round trip time of the message to be
determined;
The receiver assumes a message to be delayed and discards it when the
Receive Timestamp in the message differs from the current installation
time by more than a pre-defined value;
• A Transmit Timestamp to enable the sequence of the message to be
determined;
The receiver discards the message when the Transmit Timestamp in the
current message is found to be the same or earlier than the last valid
Transmit Timestamp received.
Ensure that the communications network is designed to minimise

unacceptable delays to messages as this can lead to session failure. See
section 3.7.3.2.
3-20 Invensys Rail

3.7.3 Loss of Communication (LOC)
3.7.3.1 Session Failure

The session will be considered ‘timed out’ if no valid communication
message is received within the configurable Loss Of Communication (LOC)
period (see section 3.7.3.2).
The NCDM will then:

• De-energise the configurable ‘session OK’ state;
3
• Assume that all input states associated with the failed session are de-
energised;
• Assume logout for diagnostic sessions;
• Assume WSL S2 server is unconfigured.
3.7.3.2 LOC Timeout Period

The NCDM uses the Loss of Communication (LOC) timeout period for each
non-vital network communication session to determine:
• When de-energised states are assumed for inputs associated with the
non-vital network communication session;
• The acceptable limit for round trip time.
The LOC timeout value is configurable through the GCSS. All non-vital
network communication sessions—5 seconds.
Use the GCSS to configure the LOC value.
Note: See Appendix A in reference [GCSS] to confirm the correct units to use
when configuring LOC through the GCSS.

The communication media requirements for vital communication over a
network (see section 3.6.5) should also be applied to non-vital
communication over a network.

3.8 Vital Serial Interfaces to WESTRACE

Vital serial communications modules transfer logic states between
WESTRACE systems. A WESTRACE system may be connected to up to eight
other systems using these serial links.
A VTC module can transfer up to 17 inputs and outputs, an EVTC can transfer
up to 66 inputs and outputs.

The vital serial protocols used by WESTRACE have the following features to
assure the integrity of transferred data:
• Parity bits and ‘true’ and ‘complement’ representation are used to protect
the data in each serial message in the same way as are communications
between the VLM and other modules within a WESTRACE system
protected;
A message is discarded when the ‘true’ and ‘complement’ representations
are not coherent or a parity error is detected;
• The unique installation address of the receiving WESTRACE, and the vital
serial port number (0-7) are included in each message;
The receiver checks these and discards incorrectly addressed messages;
• A CRC error detection code is included in each message so that any
corruption which occurs during transmission can be detected;
This is checked by the receiver and corrupted messages are discarded.
Ensure:
• Only vital data is transferred over the vital communication sessions;
• Communicating WESTRACEs are compatible (see section 3.8.2).
3.8.2 Compatibility
Every vital WESTRACE module has a compatibility index. Communication can
only occur between modules having acceptable (normally identical) indices.
A VLM will not complete start-up with incompatible modules.
Vital modules will discard messages from an incompatible module.
All modules supplied by Invensys Rail are compatible with each other but are
incompatible with modules supplied by WRSL.
Ensure:
• Compatible modules are used in a WESTRACE system;
• All port numbers are correctly allocated.
3-22 Invensys Rail

3.8.3 Timing
Vital serial links introduce delays which the application engineer must
accommodate when designing application logic otherwise it is possible for
the interlocking logic to oscillate or lock up.
Ensure that delays in the vital serial links do not cause:

• Logic ‘races’;
• Logic oscillations;
• Unsafe operation due to delayed inputs or inputs arriving out of order.
3
3.8.4 Link Failures
The link will be considered ‘failed’ if no valid vital serial message is received
for a period of two seconds.
This causes the VLM to:

• De-energise the #LOIC (Loss Of Input Channel #) reserved mnemonic;
• Assume that all input states associated with the failed link are de-
energised;
• Set a bit in subsequent outgoing messages to inform the VLM at the other
end that messages are not being received; which in turn will cause the
other VLM to set its #LOOC (Loss of Output Channel #) reserved
mnemonic.
Apart from the above, both WESTRACE systems will continue operating
normally (ie not shutdown) in the event of a vital serial link failure.
Ensure that de-energised vital serial inputs are always a safe state.

Dedicated wire pairs are the preferred communication medium when using
WESTRACE equipment to transfer vital serial information to other WESTRACE
equipment or other systems.
SAFETY
Observe the following restrictions applying to serial data.
WARNING
It is possible to use WESTRACE with radio or other non-dedicated wire links,
however the communication could be exposed to the following threats:
• Storage and re-transmission;
• Link cross talk;
• Hacking (deliberate unauthorised interference);
• Messages routed to the wrong destination.
Sections 3.8.5.1 to 3.8.5.4 define the rules and guidance that must be applied
to the communication media as protection against these threats.

3.8.5.1 Storage and Re-transmission

The threat of storage and re-transmission is posed by any medium that is
capable of storing a message and re-transmitting it at a later time. The
message may be sent either as a solicited action, or at any time. Examples are
intelligent modems and intelligent repeater systems.
When choosing the transmission media:

• Do not use intelligent modems or intelligent radio equipment;
• Ensure the link is under local control and no local buffers exist;
• Do not use service links (hired or otherwise) because it is unlikely that a
link from a third party can be guaranteed to have no means of storage or
re-transmission.
3.8.5.2 Link Cross Talk

Link cross talk is the receipt of information by a receiver from a
communication path that the receiver is not connected to, but may be in close
physical proximity.
This includes the threat of inadvertent connection between two circuits

resulting from a fault in the communication system, and cross talk between
systems which are not necessarily in physical proximity. For example, via
anomalous radio propagation.
Reduce the risk of cross talk by ensuring:

• Each WESTRACE system has a unique address;
• The communications link is not shared with other users;
• The communication frequency is not repeated in different locations;
• The most selective receiver possible is chosen (the bandwidth of the
receiver should match the bandwidth of the received signal);
• That frequencies which are susceptible to anomalous modes of
propagation are not used.
3.8.5.3 Hacking
Hacking is defined as the unauthorised access to communication bearers.
The hacker may be able to corrupt, re-transmit, or introduce illegal messages
into the system.
The defences against hacking are:

• No public access to the communication channel;
• A complex message format.
3-24 Invensys Rail

Reduce the risk of hacking by ensuring:

• Point to point links are used to render the links less susceptible to outside
disturbances;
• Directional antennae are used for radio communication systems;
• Transmitting power is maximised and receiver sensitivity is minimised;
• Frequencies which are commonly available to the general public are not
used;
• To modulate the data or convert to radio frequencies as close as possible
3
to the source (modulated data is more difficult to hack);
• Third party links (hired or otherwise) are not used;
• Directly modulated radio is used.
3.8.5.4 Messages Routed to Wrong Destination

The use of high quality communications equipment will reduce the risk of
incorrect routing of messages because of equipment failures.

3.9 Hot Standby
3.9 Hot Standby

Applications requiring high system availability can use the hot standby
configuration of the WESTRACE interlocking, and optionally of WESTRACE
object controllers. Two identical WESTRACE installations are used; one
installation controls the railway while the other is maintained in an identical
state via high-speed data links between the two.
The CONF1 and CONF2 links on the WESTRACE’s VLM determine whether
the WESTRACE is primarily intended (‘biased’) to operate as the online unit
or the standby unit. (See section 4.1.6, Setting WESTRACE Operational
Mode.)
Both WESTRACEs in a hot-standby pair must have the same installation

address.
Either WESTRACE automatically takes control of the railway (operates stand-

alone) if:
• one unit fails or is switched off during normal operation;
• only one unit is powered at startup.
See also:
• section 4.2.3.13 “VLOM Hot Standby”;
• section 4.3.3.9 “VROM Hot Standby”;
• figure 4.27 for master-slave usage of hot-standby NCDMs;
• figure 4.33 for master-slave usage of hot-standby NVC/DMs;
• Appendix C, Hot Standby Operation.
Note: Hot standby only becomes available at completion of the WESTRACE

Application Delay (see [GCSS]), which is typically several minutes after
power-up.
3.9.1 Order of Power-Up

Do one of the following to ensure that the online-biased unit takes control:
• Power both units at the same time.
• Power the online-biased unit first, then the standby-biased unit any time
after.
Caution: Neither unit takes control if the online-biased unit is powered between
10 seconds after the standby unit is powered and before the standby unit
completes its online initialisation phase (typically takes several minutes).
A ‘sync period expired’ message is issued and both units shut down if this
occurs.
The standby unit takes control if the online unit is powered-up after the
standby unit completes its online initialisation phase (typically takes several
minutes). See also figure C.2.
3-26 Invensys Rail

3.9 Hot Standby
3.9.2 Changeover
The standby-biased WESTRACE immediately takes over if the online-biased
unit fails. You can then power-off the online unit, repair or replace it, and
power it up again. The online unit then synchronises with the other one and
takes over standby operation (regardless of its online bias link).
If the online-biased WESTRACE fails and you power-off both units, re-apply
power to the standby unit. It automatically operates as the online unit even
though it is biased for standby operation. 3
3.9.3 General Application Information
Take the following information into account when designing a hot standby
system.
3.9.3.1 Loss of Communication Extension During Changeover

A Hot Standby system configured with either vital serial communication or
vital communication over a network may extend the Loss Of Communication
period under the following circumstances:
• The Online System is about to declare Loss Of Communication for a vital
communication connection (ie LOC timeout should occur in less than one
VLM cycle time);
• A change-over occurs.
Under the circumstances described above, the LOC period is extended by

one VLM cycle. Figure 3.4 illustrates the signal aspects that may be observed
as a result.
State before Fail safe

State from
Installation 1
Green Red before LOC
State after LOC
Green Red
Installation 1 Change Installation 2 Installation 2

Online (1
Figure 3.4 LOC Extension During Change-over
Note: The Application Engineer should be aware of the scenario illustrated by

figure 3.4.
Ensure the scenario illustrated in this section is taken into consideration when
designing the system.

3.9 Hot Standby
3.9.3.2 NCDM Reserved States—Online

The NCDM in the online installation maintains the reserved state mnemonics
associated with itself. These mnemonics may indicate a fault with the NCDM
and may require attention. See [GCSS] for details.
3.9.3.3 NCDM Reserved States—Standby

The NCDM in the online installation maintains the reserved state mnemonics
associated with the other NCDM in the hot standby system. See [GCSS] for
details.
3.9.3.4 VLM6 Reserved States

The VLM6 in the online installation maintains the reserved state mnemonic
‘CONFLT’. See [GCSS] for details.
3-28 Invensys Rail

3.9 Hot Standby
3.9.4 Hot Standby Configuration using WNCM

A hot standby system can use a WESTRACE Network Communication Module
(ie VLC6 and NCDC). Figure 3.5 shows the minimum configuration.
Note: The NCDM is specifically designed for Hot Standby operation. Network
sessions and serial ports configured with control system protocols do not
transmit when the NCDM is in a Standby installation, so external switching
of the NCDM transmit circuits is not necessary. Only the WESTRACE in 3
Online Mode transmits vital application data over the network.
Installation 1 Status +24V +24V Installation 2 Status

OPCR2 OPCR1
+24V I/P1 +24V I/P2
OPCR1 OPCR2
1 B24 (+24V) 1
P v v N V V N v v P
S I I C L 2 N24 (0V) 2 L C I I S
U T T D M M D T T U
3 3
A A M 6 6 M A A
L L 4 XFLASH1IN 4 L L
5 N24 (0V) 5
S S S S
Request Inhibit
A A 7 N24 (0V) Change Change 7 A A
Over Over
V V Normal V V
E E 8 !Request I/P 8 E E
9 N24 (0V) 9
10 !Inhibit I/P 10
11 N24 (0V) 11
12 I OUT OPCR1 OPCR2 12
13 I IN 13
14 OPCR+ OPCR1 OPCR2 14
15 OPCR- OPCR2 OPCR1 15
16 VSEV+ VSEV Sensing 16
17 VSEV- 17
18 VSEV+in 18
19 VSEV-in 19
Inter VLM Comms Link (IHCL)
Inter NCDM Comms Link (INCL)
Non-vital Serial I/O 10 Mbit/s Ethernet Non-vital Serial I/O

RS232C or RS485 NETWORK RS232C or RS485
Figure 3.5 Hot Standby Configuration—VLM6 and NCDM
Wire the transmit circuits of:

• vital serial links (VTC or EVTC), and;
• non-vital serial links (NVC);
through OPCR contacts to ensure that only the vital serial modules and non-
vital serial modules associated with the online installation are connected to
the communications circuit.

3.9 Hot Standby
Vital parallel inputs are normally commoned but may be connected by OPC
repeat relays.
Vital parallel outputs must be powered from an OPC relay-switched power

supply, however the outputs may be commoned or switched by OPC repeat
relays.
For hot-standby WESTRACEs, fit fibre-optic links between:

• the IHCL1 Tx connector of each main and standby VLM;
• the IHCL Rx connector of each main and standby VLM;
• the INCL2 Tx connector of each main and standby NCDM;
• the INCL Rx connector of each main and standby NCDM.
See figures 3.6–3.8.
IHCL Tx and Rx INCL Tx and Rx

optical connections optical connections
Figure 3.6 Connections—INCL and IHCL
Note: Take extreme care not to damage the IHCL and INCL fibre-optic cables
used to link hot-standby VLM6s and NCDMs. The fibre-optic cables are
fragile, and sharp bends can stress or fracture them, causing high losses
or intermittent communications.
1
IHCL: Inter-HVLM Communications Link
2
INCL: Inter NCDM Communications Link
3-30 Invensys Rail

3.9 Hot Standby
3.9.5 Hot Standby Configuration Using VLM5

A hot standby system can use a VLM5 vital processor. Figure 3.7 shows the
minimum configuration.
Note: The NVC/DM has been validated for Hot Standby operation, but only as
a diagnostic module (emulating a DM128 or DM5).
Installation 1 Status
OPCR2
+24V +24V Installation 2 Status
OPCR1
3
+24V I/P1 +24V I/P2
OPCR1 OPCR2
1 B24 (+24V) 1
P v v N V V N v v P
S I I V L 2 N24 (0V) 2 L V I I S
U T T C M M C T T U
3 3
A A D 5 5 D A A
L L M 4 XFLASH1IN 4 M L L
5 N24 (0V) 5
S S S S
Request Inhibit
Over Over
V V Normal V V
9 N24 (0V) 9
10 !Inhibit I/P 10
11 N24 (0V) 11
13 I IN 13
17 VSEV- 17
18 VSEV+in 18
19 VSEV-in 19
Inter NCDM Comms Link (INCL)
Figure 3.7 Hot Standby Configuration—VLM5

• non-vital serial links used for external control systems (NVC or NVC/DM);
repeat relays.
Power vital parallel outputs from an OPC relay-switched power supply;
however, you may common the outputs or switch them by OPC repeat relays.
Note: Take extreme care not to damage the IHCL and INCL fibre-optic cables
used to link hot-standby VLM5s and NVCDMs. The fibre-optic cables are
fragile, and sharp bends can stress or fracture them, causing high losses
or intermittent communications.

3.9 Hot Standby
3.9.6 Hot Standby Configuration Using HVLM128

A hot standby system can use a HVLM128 vital processor. Figure 3.8 shows
the minimum configuration.
+24V I/P1 +24V I/P2
1 B24 (+24V) 1
P D v v H H v v D P
S M I I V 2 N24 (0V) 2 V I I M S
U 1 T T L L T T 1 U
3 3
2 A A M M A A 2
8 L L 1 4 XFLASH1IN 4 1 L L 8
2 5 N24 (0V) 5 2
S S 8 8 S S
Request Inhibit
Over Over
V V Normal V V
9 N24 (0V) 9
10 !Inhibit I/P 10
11 N24 (0V) 11
13 I IN 13
17 VSEV- 17
18 VSEV+in 18
19 VSEV-in 19
Figure 3.8 Hot Standby Configuration—HVLM128

• non-vital serial links used for external control systems (NVC);
repeat relays.
Vital parallel outputs must be powered from an OPC relay switched power
supply, however the outputs may be commoned or switched by OPC repeat
relays.
Note: Take extreme care not to damage the IHCL fibre-optic cables used to link
hot-standby HVLM128s. The fibre-optic cables are fragile, and sharp
bends can stress or fracture them, causing high losses or intermittent
communications.
3-32 Invensys Rail

3.10 Installation Performance Times
3.10.1 System Response Times

The response time for each type of system is such that the actual minimum
and maximum WESTRACE system response times can be calculated for a
particular system configuration. The response times are in the form of
component times, that can be combined for particular system configurations
to produce an overall system response time.
3
The response time comprises an input time, two vital logic module cycles to
process the information, and an output time.
Input VLMx VLMx Output

Figure 3.9 Response Time—WESTRACE Installation
The response time for an installation is calculated as shown in figure 3.9.
An input can be either a parallel input (VPIM) or a serial input (EVTC).
An output can be either a parallel output (VROM) or a serial output (EVTC). All
serial transmissions are assumed to be successful.
Table 3.8 shows the worst case times to be used when calculating system
response times.
Table 3.8 Response Times—Worst Case—Individual Items
Time
Item (Seconds)
Parallel Input (de-energised) 0.5
Parallel Output 0.3
Serial Input 0.225
Serial Output 0.675
Network Input 0.05
Network Output 0.05
HVLM128 (Minimum Stand Alone) 0.5
HVLM128 (Minimum Hot Standby) 0.75
HVLM128 (Maximum) 1.0
VLM5 (Minimum Stand Alone) 0.5
VLM5 (Minimum Hot Standby) 0.75
VLM5 (Maximum) 1.3
VLM6 (Minimum Stand Alone) 0.55
VLM6 (Minimum Hot Standby) 0.75
VLM6 (Maximum) 1.3

Note: Add an extra 0.4 seconds for an energised parallel input.
The WESTRACE System Response times for an HVLM128 based system will
not be greater than those shown in table 3.9.
Table 3.9 WESTRACE System Response Times—Worst Case—for a HVLM128-Based

System
Worst Case for

Worst Case for Worst Case for Maximum Stand
Minimum Stand Minimum Hot Alone or Hot
Alone Cycle Standby Cycle Standby Cycle
WESTRACE Installation type (Seconds) (Seconds) (Seconds)
Parallel Input to Parallel Output 1.8 2.3 2.8
Parallel Input to Serial Output 2.175 2.675 3.175
Serial Input to Parallel Output 1.525 2.025 2.525
Serial Input to Serial Output 1.9 2.4 2.9
The WESTRACE System Response times for a VLM5 based system will not be
greater than those shown in table 3.10.
Table 3.10 WESTRACE System Response Times—Worst Case—for a VLM5-Based

System
Worst Case for

Parallel Input to Serial Output 2.175 2.675 3.775
The WESTRACE System Response times for a VLM6 based system will not be
greater than those shown in 3.11.
3-34 Invensys Rail

Table 3.11 WESTRACE System Response Times—Worst Case—for a VLM6-Based

System
Worst Case for

Parallel Input to Serial Output 2.275 2.675 3.775 3

Network Input to Parallel 1.45 1.85 2.95

Output
Network Input to Serial Output 1.825 2.225 3.325
Serial Input to Network Output 1.375 1.775 2.875
Parallel Input to Network 1.65 2.05 3.15

Output
Network Input to Network 1.2 1.6 2.7

Output

3.11 Installation Reversion Times

The reversion time for a particular system configuration can be calculated in
the same way as installation Performance Times using the response times in
table 3.8 plus the times in table 3.12.
Table 3.12 Reversion Times—General
Time
Item (Seconds)
Fleeting Output time 1.0
Serial Communications 0.9
Loss of channel time-out, VTC or EVTC 2
Vital Communications over Network See table 3.7
Figure 3.10 shows the Reversion Time for normal operation of a WESTRACE
installation.
Parallel Input VLMx VLMx Parallel Output
Reversion Time
Figure 3.10 Reversion Time—Normal WESTRACE Installation Operation
Figure 3.11 shows the Reversion Time for a WESTRACE installation including
a fleeting output.
Parallel Input VLMx VLMx Parallel Output Fleeting Output
Maximum Reversion Time
Figure 3.11 Reversion Time—WESTRACE Installation Operation Including a Fleeting

Output
Figure 3.12 shows the Reversion Time for WESTRACE Systems connected by
a Vital Serial link and including a fleeting output.
Parallel VLMx Serial Loss of Channel VLMx VLMx Parallel Fleeting

Input Comms Timeout Output Output
Figure 3.12 Reversion Time—WESTRACE Systems—Vital Serial Link Including a

Fleeting Output
3-36 Invensys Rail

Figure 3.13 shows the Reversion Time for WESTRACE System network input
to parallel output.
Vital Communication over VLM6 VROM

a network LOC Timeout
Figure 3.13 Reversion Time—WESTRACE System Network Input to Parallel Output
3
Figure 3.14 shows the Reversion Time for WESTRACE System network input
to network output.
Vital Communication over VLM6 NCDM (Network Output)

a network LOC Timeout
Figure 3.14 Reversion Time—WESTRACE System Network Input to Network Output

3.12 Reactive Fail Safety

Vital parallel output modules (VROMs and VLOMs) conform to the general
functional block diagram (figure 3.15).
Fuse Switch A Detector
Switch B Microprocessor
Figure 3.15 Vital Parallel Output Module Block Diagram
Switch A, controlled by the microprocessor, is closed to provide the output.

Failure of switch A or the circuitry controlling it, can lead to a falsely energised
output. This output will be detected and action taken to de-energise the
output within a finite time. A falsely energised output which persists for less
than a given time is referred to as a fleeting output. (If it was to persist for
longer than this, it would be classified as a wrong side failure).
The sequence of operation of the Vital Parallel Output Module software

under these conditions is summarised as follows:
a) detect incorrect output;
b) attempt to blow fuse;
c) check for incorrect output;
d) if output is now correct then continue normal operation;
e) if output is still incorrect, instigate System Negation.
3.12.1 Fleeting Output Duration

The time for which the fleeting output exists is dependent on whether step d)
or e) above is reached. If step e) is reached, the term ‘Long Fleeting Output’
is used; if step d) is reached, the term ‘Short Fleeting Output’ is used.
The Vital Parallel Output Module and the VLE cannot guarantee that the fuse
will blow. The only fail safe time is that which results if step e) is reached, the
Long Fleeting Output Time.
The times for the two types of fleeting output are given in the table below,
together with the probability of their occurrence per individual vital parallel
output circuit. These times are based on HRD-4 Standard (British Telecom).
Table 3.13 Fleeting Outputs for the VLE and OPCR
Mean Time Between Occurrence

VLOM (ms) VROM (ms) per Output Circuit
Short 300 200 1.75 x 106 hrs
Long 950 950 1.75 x 108 hrs
3-38 Invensys Rail

The times for fleeting outputs quoted above are based on the following
conditions:
a) Short Fleeting Outputs;

The time quoted is for the Vital Parallel Output Module to successfully
blow the fuse. That is, it does not include any allowance for the response
time of the device being driven by that output;
b) Long Fleeting Outputs;

The time quoted includes an allowance of 150 milliseconds for the 3
OPCR total drop away time. The actual release time depends on the
characteristics of the relay used for the OPCR. The time quoted does not
include any allowance for the response time of equipment driven by
WESTRACE outputs other than the OPCR as previously described.
3.12.2 Application Rules

SAFETY
Observe the application rules detailed in this section.
WARNING
3.12.2.1 Overall Wrong Side Failure

Both long and short fleeting outputs are classified as right side failures of the
VLE.
Ensure that the signalling system design is safety tolerant of fleeting outputs
(including the issues of sections 3.12.2.2 to 3.12.2.4) and cannot result in an
overall wrong side failure.
3.12.2.2 Insufficient Response Time

Analyse the response time of the equipment to be driven by WESTRACE
outputs to determine if a fleeting output will result in an unsafe condition.
Provide a suitable defence against WESTRACE allowing an unsafe action

before the end of the fleeting output duration.
3.12.2.3 Prevent False Energising

Use a WESTRACE timer set to greater than 300 ms on any input driven
directly from a WESTRACE output. This ensures that a fleeting output cannot
be recognised as a valid input.
3.12.2.4 Illegal Signal Aspects

Consider possible adverse reactions by a train driver on seeing an illegal
aspect (where a signal is controlled by a VLOM).
3.12.3 Reliability and Availability

The Application Engineer must consider the effect of a shutdown on a railway
from a safety perspective.

3.12.4 Application Guidance

SAFETY
Minimise the duration of a fleeting output or eliminate the possibility of
one producing an unsafe output by following the guidelines in this
section.
WARNING
3.12.4.1 General
Select a relay for the OPCR with the fastest possible drop-away time.
Vitally AND (Boolean) two of the parallel outputs from separate modules to
generate one output for fast operating safety critical equipment. This will
produce a composite defence against wrong side failure.
Using two outputs from the same module would reduce, but not eliminate,
the possibility of a fleeting output causing a wrong side failure so AND
outputs must come from different modules.
Examples of this can be found in [GCSS].
3.12.4.2 Output Loads Driven by VROM

Use vital slow-to-pick relays or fail safe delay-pick-up timers driving relays on
the VROM outputs to allow time for system negation before a fleeting output
can produce an unsafe condition.
Individually disabling relay outputs with front contacts of the OPCR will result
in the relay dropping away faster than if the power feed to the VROM is
disabled. This is due to the VROM having an input filter whose stored energy
will continue to supply power to the VROM for a finite time after the power
source is removed, plus the slugging effect of the VROM output circuit. The
resultant worst case is an additional delay of 21 milliseconds.
3.12.4.3 Output Loads Driven by VLOM

The input filter stored energy problem, identified above for the VROM, does
not exist with the VLOM because the VLOM input filter energy storage
capacity is not significant.
Avoid backfeed when disabling the power to the VLOM (see section 4.1.8.4).
In particular, you must isolate hot standby outputs with OPCR contacts.
3-40 Invensys Rail

Chapter 4: Module Application
4.1 Vital Logic Module
4. MODULE APPLICATION
This chapter provides a brief description of WESTRACE modules, their
external connection, and other application-specific information.
More detailed information is provided in:

• Appendix A—Module Descriptions;
• Appendix B—Module Operation.
4.1 Vital Logic Module 4

This section describes the:
• Vital Logic Module-6 (VLM6);
• Vital Logic Module-5 (VLM5);
• Hot Standby Vital Logic Module (HVLM);
• Vital Logic Module (VLM1).
The VLM6, VLM5 and HVLM are processor based sub-systems that will
operate in an installation that is either in a Hot Standby configuration or a
stand-alone system configuration.
• Configured as Hot Standby, they will operate in Online Mode or Standby
Mode.
• Configured as stand-alone, they will operate in Online Mode only.
A VLM6, VLM5 or an HVLM that is in Online Mode will be in control of the

railway.
A VLM1 cannot be configured as Hot Standby.
4.1.1 Module Components

The VLM6 comprises three separate printed circuit boards.
• VLC6—Vital Logic Card 6.
• OPC—Output Power Card.
• UHVBC—Universal Hot Standby Vital backplane card.
The VLM5 comprises three separate printed circuit boards.

• VLC5—Vital Logic Card 5.
• HVBC—Hot Standby Vital Backplane Card. The UHVBC may also be used.
The HVLM comprises three separate printed circuit boards.

• HVLC—Hot Standby Vital Logic Card.
• HVBC—Hot Standby Vital Backplane Card. The UHVBC may also be used.

The VLM1 comprises four separate printed circuit boards.

• VLC—Vital logic card.
• CEC—Configuration element card.
• VBC—VLM backplane.
4.1.2 External Connections—VLM6, VLM5 and HVLM

All external connections to the:
• VLM6 are made via the HOPC PFM which plugs directly into the UHVBC
• HVLM or VLM5 are made via the HOPC PFM which plugs directly into the
HVBC or UHVBC.
The HOPC PFM External Connector is a 19 way Weidmueller SLA socket that
accepts a Weidmueller BLA plug (supplied with the module).
The VLM6, VLM5 and HVLM are pin compatible with the OPC backplane.
Figure 4.1 depicts the external connection details of the HOPC PFM.
Figure 4.1 External Connections—HOPC PFM—VLM6, VLM5 & HVLM
B24 & N24
Maximum current 4A
4-2 Invensys Rail

OPCR relay Connections
Relay coil (OPCT+ and OPCT-) and proving connections (I Out and I In):
• Keep short (less than 2 metres);
• Use twisted pair;
• Avoid proximity to noisy circuits (eg. other relays).
XFLASH1IN & XFLASH2IN
Normally left open.
Used to synchronise VLOM flashing output on adjacent WESTRACEs.

Connect XFLASH1IN or XFLASH2INto an external source.
Frequency 0.5 Hz min. 4
1.33 Hz max.
Mark (high) Space (low) Ratio 1:1 or
670:330
VSEV+ and VSEV-
Outputs for communications power to Vital Serial (EVTC and VTC) and
optionally non-vital serial (NVC) modules.
Maximum current 1.0 A
Maximum NVC 1 (high start up load prevents more).
!Inhibit and !Request
Connect to individual switches as shown in figure 4.2.

Off Automatic Change over Mode.
!Inhibit Online VLM will not attempt changeover.
!Request Online VLM requests standby VLM to take
control.
B24 B24
!Request !Request
!Inhibit !Inhibit
Figure 4.2 Changeover Switches—HOPC PFM
The switch should provide:

• momentary action for the !Request selector input;
• latched action for the !Inhibit selector input, and;
• a latched centre off position.

Note: VLMs will ignore change over requests before the OPCR drive is present.
VLMs ignore change over requests during an OPCR exercise.
Do not operate both inputs simultaneously (!Inhibit prevails).
A request for change over must not be present for more than one cycle to
avoid the possibility of the Hot Standby system toggling.
4.1.3 External Connections—VLM1

All external connections to the VLM1 are made via the OPC PFM which has
tails with plugs attached to plug into connectors 4 and 5 on the VBC.
The OPC PFM External Connector is a 15 way Weidmueller SLA socket that
Figure 4.3 depicts the external connection details of the OPC PFM.
Figure 4.3 External Connections—OPC PFM—VLM1
Connections to terminals 10 through 15 should be kept as short as possible

(not more than 2 metres) and should not be run near sources of electrical
noise (for example, avoid running wires to or from relays other than the OPCR
in the same conduit).
The maximum continuous current that passes in each of the connections is:
24 V supply 4A
OPCR Drive 0.8 A
VSEV 1A
OPCR Back Contact 20 mA
4-4 Invensys Rail

4.1.4 Restart Circuit

Fit a ‘one-shot restart circuit’ to WESTRACE installations to provide automatic
controlled restart:
• after a shutdown;
• after short power disruptions (power down for at least 40 s).
Figure 4.5 shows a power supply with a typical one-shot restart circuit for a
single-WESTRACE system, and figure 4.6 shows a typical circuit for a
multiple-WESTRACE system. In both circuits, the OPCR dropping (due to the
shutdown or power disruption) starts a sequence (figure 4.4) that results in
the power being automatically restored.
Customers may require different restart delays from those shown below.
4
These are determined by the time-delay relays RESTART J1R and
RESTART J2R in figures 4.5 and 4.6.
The three RESTART relays need not be vital relays unless required by the
Railway Authority.
OPCR
figures 4.5 and 4.6
RESTART J1R
Refer to
(5–7.5 s)
RESTART J2R
(60–90 s)
RESTART
Resets Restarts OPCR picks

WESTRACE WESTRACE
Figure 4.4 One-Shot Restart—Timing Diagram

Figure 4.5 One-Shot Restart Circuit—Typical—Single WESTRACE
4-6 Invensys Rail

Figure 4.6 One-Shot Restart Circuit—Typical—Multiple WESTRACE

4.1.5 WESTRACE Address

Each WESTRACE installation must have a unique address. This address is
contained in the CED (Vital PROM Data) EPROMs (or Non-Vital
Configuration)and must also be set on links on the UHVBC, HVBC or VBC.
Set the links on the UHVBC or HVBC in accordance with the Installation
Report (see figure A.11) produced by the GCSS (or CSS).
If the address in the Vital PROM Data (or Non-Vital Configuration) differs from
that on the UHVBC, HVBC or VBC, the installation will not operate. This
address is also used to identify vital serial messages between installations. To
ensure that addresses are not re-used, a range of addresses have been
allocated to Invensys Rail.
SAFETY
Invensys Rail allocates addresses and maintains records of all address
allocations.
WARNING
4.1.6 Setting WESTRACE Operational Mode

The VLM6, VLM5 and HVLM can operate in hot standby or stand-alone
configuration. In a pair of installations intended to operate in hot standby
configuration, one installation is biased online and the other is non-biased.
The CONF1 and CONF2 links on the UHVBC or HVBC set the configuration.
Refer to:
• section A.1.2.3 for details about the UHVBC;
• section A.2.2.3 or section A.3.2.3 for details about the HVBC;
• section A.4.2.4 for details about the VBC.
4.1.7 Setting Version Number of the Application Data

The VLC6, VLC5 or HVLC (or CEC) incorporates an 8-way DIL switch that is
used to set the version number of the application data.
Set the switches in accordance with the GCSS Installation Report

(figure A.11).
See:
• section A.1.2.1 for details of the VLC6 (VLM6);
• section A.2.2.1 for details of the VLC5 (VLM5);
• section A.3.2.1 for details of the HVLC (HVLM).
• section A.4.2.2 for details of the CEC (VLM1).
4-8 Invensys Rail

4.1.8 Output Power Control Relay (OPCR)

The OPCR is the final arbiter of system safety for all parallel outputs. The
failure of any part of the system which, once detected, cannot be isolated by
graceful degradation will cause the OPCR to be de-energised.
Use the OPCR to disable all vital parallel outputs (VROM and VLOM) by using:
• a front contact of the OPCR in series with each vital parallel output, or;
• a front contact in series with the external signalling supply to each vital
parallel output module (see section 4.1.8.2).
The application of OPCR contacts for VLOM outputs is further described in
SAFETY
section 4.2.
4
OPCR contacts must NOT be inserted in the common return for two or
more outputs.
WARNING
Locate the OPCR as close as possible to the VLE. The coil must only be
connected to the OPC, using industry approved wire, such that the OPCR
cannot be energised by any source other than the VLE.
The OPCRs of a hot standby WESTRACE must be connected to ensure that

two systems cannot be online simultaneously.
There is no need to provide an OPCR when a WESTRACE System does not

have any parallel outputs and is not operating in hot standby.
4.1.8.1 Type of Relay for Use as the OPCR

The output to the OPCR is derived from the VLM and the voltage is 50 V.
SAFETY
The relay used for the OPCR must be a vital signalling relay to BRB
Spec 930 (such as Invensys Rail Style QN1).
WARNING
The minimum coil resistance of the OPCR must be 833 ohms.
Select an OPCR that has the fastest possible release time, and highest
possible percentage release to minimise the overall shutdown time.
To ensure the correct and reliable operation of OPCR exercising, the OPCR
together with any repeater OPCR relays must be:
• fully released in less than 140 milliseconds, and;
• fully picked-up in not more than 440 milliseconds.

4.1.8.2 OPCR Contact Rating

The OPCR contacts will have a maximum current rating of 3 A (BRB Spec)
unless relays with heavy duty contacts are used.
Carefully consider the load that each contact of the OPCR will be required to
switch, and whether it is appropriate for the contacts to be used in series with
the supply to the module or in series with the individual outputs.
4.1.8.3 OPCR Repeater Relays
SAFETY
If repeater relays are required to provide sufficient OPCR contacts, then
the additional time for the repeats to open their front contacts will extend
the system’s potential fleeting output time.
WARNING
All repeats should be controlled by the primary OPCR and should be fed
from the same fuse. For example, see figure 4.7.
Figure 4.7 Repeater relays controlled by primary OPCR
Back contacts of the OPCR and all repeats must be wired in series in the back
contact proving circuit (see section 4.1.8.6).
4-10 Invensys Rail

4.1.8.4 Providing Energised Outputs

The OPCR may be used to provide energised outputs when the OPCR is de-
energised.
Use the back contacts of the OPCR to provide energised outputs while the
OPCR is de-energised, for example, to provide signal Red Retaining.
Note: When this feature is used, each of the outputs that is powered in this way
must also be disabled by an OPCR front contact, placed in series with the
normal system output, to prevent backfeeds.
4
4.1.8.5 Control of Multiple Equipment
SAFETY
Using an OPCR contact to disable multiple items of safety equipment
may affect system negation.
WARNING
The shut-down time for one piece of equipment may be effectively increased
if the equipment is being powered by residual stored energy in wiring or
another piece of equipment controlled by the same OPCR contact even
though the OPCR has de-energised.
Ensure the energy stored in the equipment and wiring is not be of sufficient
magnitude to significantly delay the negation of a safety critical piece of
equipment.
4.1.8.6 Exercising the OPCR

SAFETY
Exercise the OPCR periodically (period not to exceed one month).
WARNING
Invensys Rail strongly recommends the OPCR be exercised automatically to
protect against the possibility of it failing to de-energise when required due
to it being continuously energised for long periods.
Note: The VLM cannot detect that the OPCR is stuck until it is exercised.
The OPCR output may be configured to periodically exercise the OPCR—this

comprises de-energising and re-energising the output to the OPCR within 1
second. The 1 second time period is not sufficient to cause alarms in the
system, lamp failure alarms for example.
Use application logic to automatically exercise the OPCR by controlling the

EXOPCR mnemonic and monitoring a back contact of each OPCR and any
repeat relays (see figure 4.7).
The VLM sets the OPCRFLT mnemonic when it detects an OPCR failure (such
as a failure during exercising of the OPCR).

SAFETY
An OPCRFLT may indicate that the OPCR cannot isolate outputs should a
potential wrong side failure occur. It must be resolved urgently.
Ensure that the system is shut down (using NOPCR) or appropriate alarms
WARNING
are generated when OPCRFLT becomes logic 0.
Configure WESTRACE to automatically test the OPCR as described below or

implement procedures to do it manually. Typical application logic can be
found in reference [GCSS].
a) Select an appropriate time to exercise the OPCR to prevent interference

to traffic. Typically, use WESTRACE timers to set minimum and
maximum delays (up to 2.5 days) since the last exercise;
b) Wait until all read signals are set and wait until the appropriate track
circuits are clear if flicker of these aspects could a problem.
All VLMs (master, slave, object controllers etc) should exercise their OPCR in
a similar manner. Exercise slave or object controller WESTRACEs at the same
time as the master to prevent auto signal flashing.
When OPCR exercising fails (OPCRFLT becomes logic 0), the fault could be:
• The OPCR was not energised when exercising was requested.
• The OPCR failed to de-energise during exercising.
• The OPCR failed to re-energise on completion of exercising.
4.1.9 Vital Serial Enable Voltage (VSEV)

The Vital Serial Enable Voltage (VSEV) output from the OPC is used to enable:
• transmission of messages from the vital serial modules;
• transfer of the data between the VLM6 and NCDM.
The VSEV is only present when the OPCR is energised (it is not disabled
during automatic exercising of the OPCR). The VSEV is the final arbiter of
safety for vital serial messages in the same manner as the OPCR for vital
parallel outputs and will disable vital serial outputs at the same time as the
OPCR disables vital parallel outputs.
a) Install links 25 and 26 on the UHVBC to enable vital data transfer

between VLM6 and NCDM. See figure 4.8;
b) Wire the VSEV output to the VSEV inputs of each VTC, EVTC, and WCM
modules in a system.
The VSEV may not have sufficient capacity to drive all modules. Instead,
connect the B24 supply through a front contact of the OPCR so the supply is
interrupted when the OPCR is exercised.
4-12 Invensys Rail

Figure 4.8 Universal Hot Standby Vital Backplane Card (UHVBC)—Links 25 & 26
Note: Lk25 and Lk26 MUST be open when the UHVBC is used with VLM5 or
HVLM modules.

4.2 Vital Lamp Output Modules (VLOM)

Any application of the VLOM must be in accordance with the information
provided in section 3.12.

Twelve-output modules comprise:
• a single Digital Board;
• two Analogue Boards (one on each side).
4.2.2 External Connections

External connections to the VLOM are made via the VLOM PFM.
The VLOM PFM External Connector is a 19 way Weidmueller SLA socket that
Figure 4.9 shows the external connection details of the VLOM PFM.
Figure 4.9 External Connections—VLOM PFM
4-14 Invensys Rail

Typical Wiring to VLOM (including Red Retaining)

Bx110
OPCR VLOM DGE
16 PFM 1
17
HGE
18 3
OPCR RGE
5
OPCR
Twisted
Nx110 pair
DGE
7
12 HGE
13 9
14
OPCR
4
15 RGE
19 11
Return OPCR
sense
Figure 4.10 Typical Wiring to VLOM (Showing Application of OPCR for Red Retaining)
See also:
• figure 4.11—alternative VLOM hot-standby circuit
• figure 4.12—alternative VLOM hot-standby circuit with red retaining
SAFETY
The Specific Application Rules (section 4.2.3) must be followed to
maintain the intended level of protection provided by WESTRACE.
WARNING
VLOM Connection Rules

• For Safety reasons and the operation of graceful degradation, the return
sense terminal (19):
• must be connected to a separate terminal on the bus bar to those
from the module supply return, and;
• not be looped back to the return at the connector.
• For Safety reasons and to provide sufficient current carrying capacity to
allow the VLOM to function under maximum load conditions:
• connection must be made to all Module Supply Feed terminals (16,
17, & 18) with cable of sufficient size for the maximum load, and;
• connection must be made to all Module Supply Return terminals (12,
13, 14 & 15) with cable of sufficient size for the maximum load.
• The VLOM outputs must not be connected to any other power supply
busbar.
• Lamps driven by the VLOM must have individual returns to the supply
return bus-bar, to prevent backfeeds through other outputs.
• For safety and performance reasons, VLOM external connections
must not be earthed.

4.2.3 Specific Application Rules

SAFETY
These Specific Application Rules must be followed to maintain the
intended level of protection provided by WESTRACE.
WARNING
4.2.3.1 Output Capability

VLOMs are designed for driving lamps, and must not be used to drive any
other device without reference to Invensys Rail.
VLOM outputs must not be connected to VPIM inputs because the cold
filament test pulses may defeat the VPIM sampling.
4.2.3.2 Limitation of Lamp Types

VLOMs have been designed to operate within the quoted range of 18–24
watts:
• 2 pole single filament lamps;
• 3 pole double filament lamps, with separate external filament change-
over;
• Invensys Rail LED signals.
Any lamps which do not fall into this category may not be suitable for use with
VLOM modules (for example, 2 pole double filament lamps with a low
wattage second filament).
The cold filament detection current pulses may be sufficient to illuminate the
3.5 W filament of a 2 pole twin filament 18+3.5 W lamp. If any doubt exists
about the suitability of the VLOM reference should be made to Invensys Rail.
4.2.3.3 Internal Fusing

The internal fuse provided for protection and graceful degradation is rated at
1.5 A. This fuse is not a field replaceable item.
4.2.3.4 External Fusing of Outputs

Any external fusing of outputs should provide sufficient discrimination to
ensure that the external fuse is the one that is blown under overload
conditions (maximum 1 A).
4.2.3.5 Fusing of VLOM Signalling Supply

If external fusing is employed, the fuse rating must be large enough to allow
graceful degradation to take place. For the VLOM, this rating should about
two times the current drawn by the number of lamps which may be normally
lit. The minimum rating that should be used is three amps.
4-16 Invensys Rail

4.2.3.6 Return Sense Cabling

Protect against spurious noise affecting the Ground Sense detection by:
• Minimising the length of the return sense cable;
• Twist the return sense cable with the NX110 cable to the VLOM.
4.2.3.7 Cold Filament Detection

Although cold filament detection is defined as non-vital, it is an essential
requirement in the total system safety. It provides a diverse check on the
correct operation of the output detector within the VLOM, and must be used
at all times.
If the facility of filament checking and failure reporting is not used in a

4
particular system, by driving a Maintenance Technicians Alarm Panel for
example, it is still essential that a ‘filament failure’ is reported to the
Technician because this may in fact be a VLOM failure which requires
investigation by the Technician.
Caution: High capacitance cables may result in the cold filament detection test
passing even when the bulb is not present.
Ensure the total capacitive load of the cable with the bulb removed is less
than:
• 1 μF for ac power;
• 10 μF for dc power.
4.2.3.8 Filament Proving

The hot filament proving current is 130 mA ± 30 mA, which is not sufficient to
fully illuminate a 12 V SL35 lamp. Thus the filament proving confirms that the
filament is intact and drawing current, but does not confirm that the lamp is
adequately bright.
Many LED signals, including those supplied by Invensys Rail, draw

significantly less than the current proving level. You may need to connect a
load in parallel with the signal module (that must not be able to hold the
current proving on its own) or use a variant of the signal with a dummy load
incorporated. Please refer to our website (http://www.invensysrail.com) data
sheets section for latest information on current proving LED signals.

4.2.3.9 Failure of Single Red Lamp Driver Output

If a lamp output is sensed to be wrongly energised, the VLOM will attempt to
blow the fuse of the output to the lamp. This could result in a signal being
unable to display a red aspect due to the shutting down of a single output.
Invensys Rail recommends that Railways which do not use lamp changeover,
and instead use high-reliability twin-filament or LED lamps, consider using
the following additional logic to cater for the above:
A B C NOPCR
Where:
• A is the red lamp output mnemonic;
• B is the red lamp filament proving mnemonic;
• C is the module fault mnemonic.
NOPCR will result in system shutdown with all red lamps illuminated over
back contacts of the OPCR.
4.2.3.10 Lamp Voltage

The voltage of a lamp driven by the VLOM is dependent upon the
interconnecting cable impedance, the external signalling supply and the
tolerances within the VLOM. All new installations, or changes to VLOM, or
changes to interconnecting cables, must have the associated lamp voltages
checked.
4.2.3.11 Use of Signalling Multicore Cable

Where VLOM outputs are connected to Signalling Multicore Cable, physically
adjacent cores in the same layer of the cable should be used where possible.
4.2.3.12 Backfeeds into Outputs

You must configure external wiring to ensure that backfeeds cannot be
applied to VLOM outputs.
Note: Never feed an external voltage to a VLOM output.

This includes hot-standby VLOM pairs, whose outputs must never be
directly connected together (paralleled).
Any potential external feed must be isolated for modules in hot standby,
typically by using a front contact of the WESTRACE’s OPCR (figure 4.11).
See also section 4.2.3.13 “VLOM Hot Standby”.
4-18 Invensys Rail

4.2.3.13 VLOM Hot Standby

Figure 4.11 shows a pair of VLOMs wired for hot standby.
OPCR1 OPCR1
Bx110 Bx 1
OPCR1
VLOM 3
PFM
OPCR1
5
Nx110
OPCR2 OPCR2
Bx 1
OPCR2
4
Hot-Standby 3
VLOM
PFM
OPCR2
5
Figure 4.11 Example VLOM Hot-Standby Circuit (three of six outputs shown)
Note: Be sure to include an OPCR front contact in the Bx110 supply and in each
output of the two hot-standby VLOMs. (The OPCR contacts in the Bx110
feeds are necessary to prevent the standby VLOM from shutting down.)
Figure 4.12 shows a pair of VLOMs wired for hot standby and red retaining.
(See also figure 4.10, which shows a red retaining circuit for a standalone
VLOM.)
OPCR1 OPCR1
Bx110 Bx 1
OPCR1
VLOM 3
PFM
OPCR1 RGE
5
Nx110
OPCR1 OPCR2 Red-retained
lamp
OPCR2 OPCR2
Bx 1
OPCR2
Hot-Standby 3
VLOM
PFM
OPCR2
5
Figure 4.12 Example VLOM Hot-Standby Circuit with Red Retaining (one of six outputs
shown)

4.2.3.14 Driving LED Signals

VLOMs are capable of directly driving some LED signals.
There are large variations in signal types and constructions and in the power
supplies that interface to the LEDs. It is therefore not possible to provide a
blanket statement of the suitability for any signal type.
The Invensys Rail series of mainline LED signals can be driven directly—
provided the guidelines below are followed. General issues for other signals
are explained below and users must ensure that arrangements are adequate.
Also see the latest application notes on the Invensys Rail web site:
http://www.invensysrail.com
The current drawn by Invensys Rail mainline signals is below the proving
current for the VLOM.
Connect a resistor3 (Rint) in parallel with the 110 Vac signal element in the
signal head as shown in figure 4.13.
OPCR
VLOM PFM
LED
Module
Rint
Nx
Signal Head
Figure 4.13 Resistor used in LED Signal
The lamp proving and cold filament checking will function but will have a
slightly different meaning. The current drawn by these signal elements is
substantially constant with voltage and with failed LEDs. LEDs are arranged in
parallel strings and any failures will be obvious and should be reported by
train drivers. The proving circuit will verify that current flows through the
wiring and power supply and this will generally be adequate assurance given
the high reliability of LEDs and the redundancy of the connection.
The LED elements are fitted with secondary surge suppression. Additional
primary protection at the signal head may be required in lightning-prone areas.
Other LED Signals
Ensure the suitability of other signals, including:

• Will the lamp proving operate correctly?
• Will the cold filament checking operate correctly?
• Will the test pulses with the lamp on be visible?
• Will cold filament checking test pulses be visible?
• Is the VLOM output rating exceeded?
• Is transient protection adequate?
3
The Invensys Rail application note “Proving Operation of LED Signals” (available from
http://www.invensysrail.com) provides guidance in selecting this resistor value.
4-20 Invensys Rail

4.2.3.15 Earth Leakage

Maximum allowable earth leakage currents may be exceeded where there
are multiple lamps driven from a single supply. This happens when outputs
are not double cut and the cable to ground capacitance is great enough to
enable excessive current.
Select a defence against excessive earth leakage currents such as:

• an isolating transformer or separate supply for each VLOM;
• a 1:1 isolating transformer on selected VLOM outputs.

4.3 Vital Relay Output Module (VROM)

It is important that any application of the VROM be in accordance with the
information provided in section 3.12.

VROM Modules comprise a digital board and an analogue board.

The VROM PFM External Connector is a 19 way Weidmueller SLA socket that
Figure 4.14 shows the external connection details of the VROM PFM.
19 way plug and Printed Circuit Board

socket
1 Supply + Feed
2 Supply - Return
3 Not used
4 Relay 1 +
5 Relay 1 -
6 Relay 2 +
7 Relay 2 -
8 Relay 3 +
9 Relay 3 -
10 Relay 4 +
11 Relay 4 - IFeed
Relay 5 + IRtn
12
13 Relay 5 -
14 Relay 6 +
15 Relay 6 -
16 Relay 7 +
17 Relay 7 -
18 Relay 8 +
19 Relay 8 -
Figure 4.14 External Connections—VROM PFM
SAFETY
The following specifications for connecting outputs from the system
must be met to maintain the intended level of protection provided by
WESTRACE.
WARNING
4.3.2.1 Commoned Outputs

The VROM outputs are designed as fully floating outputs. If loads with
common returns are used, the Application Engineer must take into account
that there are possible failure modes in the VROM due to backfeeds which
could cause more loads to be energised than those selected. Either common
returns should not be used or any common return must be proven in a fail
safe manner.
4-22 Invensys Rail

4.3.2.2 Earthing
VROM external connections must not be earthed.

SAFETY
The Specific Application Rules must be followed to maintain the
WARNING
4.3.3.1 Internal Fusing

The internal fuse provided for protection and graceful degradation is rated at
4
0.5 A. This fuse is not a field replaceable item.
4.3.3.2 External Fusing of Outputs

Any external fusing should provide sufficient discrimination to ensure that the
external fuse is the one that is blown in an overload situation.
The maximum value of any external fuse on an output should be 0.25 A.
4.3.3.3 Fusing of VROM Signalling Supply

Use a fuse large enough (ie greater than 2.5 A) to allow graceful degradation
to take place when external fusing is employed.
4.3.3.4 Maximum Load and Bipolar Operation

When a pair of VROM outputs are used to drive a bipolar load, the continuous
load must be within the specification for the output. A transient overload is
permitted, when driving a bipolar load, of up to twice the rated load for one
output for up to 250 milliseconds.
When two uni-polar outputs are configured back to back to produce a

polarised line circuit, cross check the two outputs in the Application Logic to
prevent both outputs from being energised at the same time.
For example:
1NWR 1RWR NOPCR
4.3.3.5 Vital Relay Output

All relay outputs are isolated from each other and from ground and may
provide the equivalent of double-cut line circuits. However, it should be
noted that a dormant failure of the VROM PFM could result in output returns
being connected to earth.
Include earth testing of VROM outputs in periodic maintenance schedules.

4.3.3.6 External Signalling Supply

The external signalling supply (nominal = 50 V) must be smoothed such that
any ac component does not exceed the following thresholds:
• minimum = 42 V
• maximum = 60 V
The module will not operate with full wave rectified, unsmoothed dc,
however no damage will be caused to the module.
4.3.3.7 Use of Signalling Multicore Cable

Use (where possible) physically adjacent cores in the same layer of the cable
when VROM outputs are connected to Signalling Multicore Cable.
4.3.3.8 Backfeeds into Outputs
Caution: Under no circumstances is external wiring to be configured so that

backfeeds are able to be applied to VROM outputs, other than when two
outputs are configured in a bipolar arrangement or when hot-standby
outputs are connected together.
See also section 4.3.3.9 “VROM Hot Standby”.
4.3.3.9 VROM Hot Standby

Figures 4.15 and 4.16 show two methods of wiring a pair of VROMs for hot
standby.
OPCR1
Bx Relay 1 +
Nx Relay 1 —
Output 1
VROM Relay 2 +
PFM Relay 2 —
Output 2
Relay 3 +
Relay 3 —
Output 3
OPCR2
Bx Relay 1 +
Nx Relay 1 —
Hot-Standby Relay 2 +
VROM
Relay 2 —
PFM
Relay 3 +
Relay 3 —
Figure 4.15 VROM Hot-Standby Circuit—option 1 (three of eight outputs shown)
4-24 Invensys Rail

OPCR1
Bx Relay 1 +
Nx Relay 1 —
Output 1
OPCR1
VROM Relay 2 +
PFM Relay 2 —
Output 2
OPCR1
Relay 3 +
Relay 3 —
Output 3
OPCR2
Bx Relay 1 +
Nx Relay 1 —
OPCR2
Hot-Standby Relay 2 +
VROM
PFM Relay 2 —
Relay 3 +
OPCR2 4
Relay 3 —
Figure 4.16 Example VROM Hot-Standby Circuit—option 2 (three of eight outputs

shown)

4.4 Vital Parallel Input Module (VPIM)

VPIM Modules comprise a digital board and an analogue board.

External connections to the VPIM are made via the VPIM PFM.
The VPIM PFM External Connector is a double stacked 24 way Weidmueller

SLA socket that accepts a Weidmueller BLA plug (supplied with the module).
Figure 4.17 depicts the external connection details of the VPIM PFM.
Figure 4.17 External Connections—VPIM PFM
SAFETY
The following specifications for connecting input signals to the system
must be met to maintain the intended level of protection provided by
WESTRACE.
WARNING
The VPIM is designed to accept signalling inputs to the following

specifications:
• all inputs are double cut, that is relay contacts in series with both the
positive and negative connections to each input;
• all inputs are fully independent, that is there is no commoning between
inputs, with the exception of the facility to configure inputs back-to-back
as described in the VPIM Specific Application Rules in the following
section;
• all inputs are earth free.
4-26 Invensys Rail

The Application Engineer may need to implement a system that requires

inputs to be configured differently from that previously described. For
example, to accommodate conditions such as:
• commoned input negatives;
• inputs earthed on one side.
Ensure that the proposed configuration is safe.
This safety assurance must take into account the possible effect of
unintended circumstances, such as:
• bent pins in connectors;
• dormant earth faults in the PFM;
• broken return conductors;
4
• back feeds;
• sneak paths.

SAFETY
The Specific Application Rules must be followed to maintain the
WARNING
4.4.3.1 VPIM Input Limits, ac Immunity and Internal Fusing

The VPIM will respond to voltages on its inputs in the following manner:
De-energised 10.5 Vdc max, -100 Vdc min

Energised 100 Vdc max, 30 Vdc min
Input Impedance 4 kΩ ± 800 Ω
ac Immunity (normal operation) 40 Vac, 45 Hz to 11 kHz
An input overload protection fuse will blow when the voltage applied across
the input to the VPIM reaches a maximum of 120 Vdc or peak ac.
The VPIM is not specified for fail-safe operation below 45 Hz or over 11 kHz.
4.4.3.2 DC Immunity of VPIM Inputs

The VPIM has a relatively high input impedance and could interpret a leakage
voltage as an energised input.
Assess the risk of such dc leakage and take appropriate precautions to keep
it well below the vital dc threshold voltage.
4.4.3.3 Fleeting or Intermittent Inputs

The VPIM incorporates both filtering and sampling techniques, which are
described in detail in section B.7.2 of this manual. These techniques are
employed to prevent intermittent inputs being accepted by, and possibly
confusing, the logic in the system.

Carefully consider the effects of the filtering and sampling of the VPIM when
designing a WESTRACE System for a particular application.
4.4.3.4 Inputs Driven from Outputs

If an input is driven from a processor based interlocking output, such as from
a VROM, the input filtering may not be sufficient to reject a fleeting output,
and thus filtering must be provided in the Application Logic by the use of a
time delay.
Do not connect VLOM outputs to VPIM inputs because the cold filament test
pulses may adversely affect the input sampling by the VPIM.
Inputs may not be able to be driven directly by electronic track circuit outputs
or the like; this is entirely dependant on the output stage of the electronic
device.
Advice on compatibility should be sought from Invensys Rail: Level 7,

380 Docklands Drive, Docklands, Victoria 3008, Australia
http://www.invensysrail.com
4.4.3.5 Bipolar Inputs

All inputs are polarity sensitive and may be configured back-to-back to
provide the equivalent of a pair of biased relays at the end of a two wire
polarised line circuit.
Cross check the two inputs in the application logic to ensure that they are not
both energised at the same time.
4.4.3.6 Wiring to Inputs

Use physically adjacent cores in the same layer of the cable for each input
where VPIM inputs are connected to Signalling Multicore Cable.
Wiring to the positive and negative input terminals should be run in the same
route and be approximately of the same length to minimise differential
interference.
4-28 Invensys Rail

4.5 WESTECT Communication Module (WCM)

WCM modules comprise a single printed circuit board.

External Connections to the WCM are made via the SIO232 PFM.
The SIO232 PFM External Connectors are a DB25 plug and socket for an
RS232C interface, and a 2 way Weidmueller SLA socket that accepts a
Weidmueller BLA plug for power (supplied with the module).
4
Figure 4.18 depicts the external connection details of the SIO232 PFM.
Figure 4.18 External Connections—SIO232 PFM—WCM
Table 4.1 DB25 Pinout—SIO232 PFM—WCM
Pin Function
1 Chassis Ground
2 Transmit Data (TxD)
3 Receive Data (RxD)
4 Request to Send (RTS)
5 Clear to Send (CTS)
7 Signal Ground (GND)
8 Data Carrier Detect (DCD)
17 Receive Clock (RXC)
20 Data Terminal Ready (DTR)
24 Transmit Clock (TXC)

This module communicates using RS232C and is configured as a DTE.
4.5.3.1 Communication Medium

The WCM is designed to transmit data over a dedicated link to the Radio
Control Module (RCM) as part of the WESTECT ATP system.
Any other proposed application should be referred to Invensys Rail.
4.5.3.2 Earthing of Signal Ground Line

Do not connect the signal ground line to earth because this may result in an
unsafe situation if there is an undetected earth fault(s) in the PFM.
Earth the cable screen, if fitted, in accordance with section 5.2.3.
Figure 4.19 WCM Typical Wiring
4-30 Invensys Rail

4.6 EVTC and VTC
4.6 EVTC and VTC

This section describes the Enhanced Vital Telemetry Continuous Module
(EVTC) and the Vital Telemetry Continuous Module (VTC).
EVTC modules cannot be used with the VLM1.

EVTC (or VTC) modules comprise a single printed circuit board.
4.6.2 External Connections 4

External Connections to the EVTC (or VTC) are made via the SIO232 PFM.
Figure 4.20 External Connections—SIO232 PFM—EVTC or VTC

4.6 EVTC and VTC
Table 4.2 DB25 Pinout—SIO232 PFM—EVTC & VTC
Pin Function
1 Chassis Ground
17 Receive Clock (RXC) (in)
24 Transmit Clock (TXC) (out)
For communication purposes, interface cabling and interface parameters

must satisfy the guidelines of SCI V.24 for the signal elements shown. The
characteristics of the signal are 1200 bit/s, duplex synchronous, 8 data bits
and no parity (CRC checksum is used, which is a much more powerful method
for error detection).

SAFETY
The Specific Application Rules defined in this section must be complied
with.
WARNING
4.6.3.1 Communication Medium

The communication medium must be carefully chosen and the guidance
defined in section 3.8.5 complied with.
4.6.3.2 Reversion
The VLE will set all EVTC (or VTC) input logic states to de-energised if
communication is lost for more than 2 seconds. This is the time allowed for
perturbations on the line in order to achieve a high degree of robustness and
reliability.
4.6.3.3 Implications of Failure of EVTC (or VTC) Links

It is possible for the link to fail in one or both directions, resulting in the VLE
Loss of Input Channel (LOIC) and VLE Loss of Output Channel (LOOC)
indications as appropriate. These are reserved logic states (refer
Configuration System Manual).
4-32 Invensys Rail

4.6 EVTC and VTC
In the event of a failure, it must not be assumed that any action required at the
far end of the link, as a result of logic states sent via the EVTC (or VTC) link,
has been carried out. If confirmation is required, a proving input must be
provided and its logic state sent back to the near end via the EVTC (or VTC)
link.
The reason for this requirement is that the EVTC (or VTC) link could fail in one
direction only and there is no hand shaking between ends.
4.6.3.4 Connection to Other Communication Systems

The EVTC (or VTC) may be connected to systems other than other EVTCs (or
VTCs), provided such systems comply with appropriate standards for
communications and safety. Reference should be made to Invensys Rail to
4
ensure compatibility.

4.6.3.6 Inter-System Communications

Figure 4.21 illustrates the relationship between inputs and outputs of a
connected pair of EVTC (or VTC) modules. Figure 4.23 illustrates the
connection details for a pair of EVTC (or VTC) modules.
The EVTC (or VTC) outputs are controlled as latches in the ladder logic. There
is a one-to-one relationship between the outputs of one EVTC (or VTC) and
the inputs on the corresponding EVTC (or VTC). The inputs are used as
‘contacts’ in the ladder of the second system. This is illustrated in figure 4.22.
Users may wish to apply the same mnemonic for the input as for the
corresponding output.

4.6 EVTC and VTC
Figure 4.21 Module Outputs and Inputs—EVTC or VTC
Figure 4.22 Ladder Logic for EVTC (or VTC) Communications
4-34 Invensys Rail

4.6 EVTC and VTC
4
Figure 4.23 Connection Details—Directly-Connected EVTC (or VTC) Modules

4.7 Network Communication Diagnostic Module (NCDM)

The NCDM replaces older NVC and DM modules and works with the VLM6
vital processing module. It can also operate as a stand-alone non-vital logic
processor (without the VLM6).
Note: The NCDM is currently validated for use with the VLM6 only. The GCSS
6.0 does not support a configuration of NCDM with a VLM5 or HVLM vital
processor.
Functions
The main functions of the NCDM are to:

• Evaluate non-vital application logic;
• Exchange of vital application data between WESTRACE systems (when
used in conjunction with a VLM6);
• Exchange of non-vital application data between WESTRACE systems
using the WSA/S2 protocol (serial or network);
• Exchange configured logic states with control centres and control
computers, using various serial and network protocols;
• Exchange of configured logic states with external non-vital parallel I/O
modules using the WSA/S2 protocol (serial only);
• Exchange of configured logic states with the associated vital processor;
• Receive all logic states from the vital processor, for logging purposes;
• Regularly scan all WESTRACE modules for detected faults;
• Log all changes to vital and non-vital logic states, all detected faults and
other significant occurrences, and store them in the non-volatile memory;
• Allow an external diagnostic system (such as MoviolaW) to extract logged
data and other diagnostic information, via a serial or network interface;
• Allow an external system to download or upload the Non-Vital
Configuration;
• Allow the external system to upload the Vital PROM Data.
Non-Vital Timers
The NCDM internal timers are designed to not ‘under’ time, however they
may ‘overtime’ by up to 15 seconds per 24 hours.
Take the accuracy of the NCDM timers into consideration when configuring
timers with a duration greater than 45 minutes.
NCDM Real Time Clock
A real time clock (RTC) is used for internal timestamping of faults, events and
operations logged for diagnostic purposes. The accuracy of the RTC is stated
as ‘better than ± 2 minutes per month @ 25ºC’ which is approximately ± 4.3
4-36 Invensys Rail

seconds per day. The module should have its time synchronised with the
connected external diagnostic system or control system when greater
accuracy of time stamping is required.
SAFETY
The NCDM must not be used for processing:
• safety critical logic;
• vital communications.
WARNING
Note: All of the NCDM’s internal states are returned to their default settings
whenever it is re-powered. This occurs during normal WESTRACE startup,
and if the NCDM self-restarts to overcome an error condition. 4
An NCDM comprises:
• a Network Communication Diagnostic Card NCDC, which performs the
following functions:
• Non-vital logic evaluation;
• Communications processing;
• Diagnostic logging;
• Fault detection and logging.
• a Network Communication Diagnostic Protection and Filter Module
NCD PFM (two styles—see figure 4.25).
Table 3.1 lists these components along with their functions and part
numbers.
The NCD(C) PFM is fitted with the following external communication ports:
• One network port for a 10 baseT Ethernet compliant network.
• Two serial ports (configurable as RS232 or RS485) for the serial interface;
Network Interface
The external network cable terminates at an RJ45 connector on the back of

the NCD PFM.
The NCD PFM:

• Provides transient protection and filtering of the Ethernet signal lines;
• Converts the signal between a 10 baseT Ethernet signal and CMOS levels.
Serial Interface
The external serial cables terminate at DB9 connectors on the back of the
NCD PFM.

The NCD PFM:

• Provides transient protection and filtering to remove high frequency noise
for the serial signal lines;
• Converts the signal between RS232 or RS485 levels and CMOS levels.
NCDC-PFM Interface
The CMOS-level Ethernet and serial signals pass between the NCDC and the
NCD PFM via a 96-pin connector at the rear of the NCDC. The NCD PFM is
responsible for communications, signal level processing, protection filtering
and isolation functions.
Figure 4.24 View from Component Side—NCDM (Mod D Rev 7 NCDC shown)

Non-Vital Configuration and system software upgrades are made through
the Production port on the front edge of the NCDC. See section 4.7.2.5.
The following external connections are made through the NCD PFM:
• Serial ports;
• Network port;
• Inter NCDM Communications Link (INCL);
• Serial power;
• Installation status.
4-38 Invensys Rail

Style 1: NCD PFM
Network Connector (RJ45)
Tx Inter NCDM Comms Link (INCL) (Optical)
Rx Inter NCDM Comms Link (INCL) (Optical)
Serial Ports, 2 off (DB9 Connectors)
Serial Power Connector

Installation Status Connector
Serial Port 2 Serial Port 3
4
Serial Power Installation Status
Connector Connector
+22 to +30 V) Pin 1 Pin 2 (0 V)
Installation Status
Style 2:
Network
Tx
Rx
Serial Port 2
Serial Port 3
Serial
Power
Figure 4.25 External Connectors on the Two Styles of NCD PFM—NCDM
Note: The NCDM serial ports 2 and 3 should be labelled on the WESTRACE
housing and the external serial cables should also be labelled to ensure
the correct connections are made.
4.7.2.1 Serial Power Connection (Con3)

Serial power should come from a permanent B24 supply so that serial
communication can be maintained after system shutdown. Table 4.3 and
figure 4.25 show the serial power terminals for a Style 1 NCD PFM. For Style 2
(NCDC PFM), these terminals are brought to the board’s connector panel and
labelled PWR.
See also “NCDC PFM Fusing” on page 3-13.

Table 4.3 Serial Power Connector Pinout—NCD PFM—NCDM
NCD PFM Pin Number

(see figure 4.25, Style 1) Signal
1 +22 to +30 V
2 Common (0V)
4.7.2.2 Installation Status Connection (Con4)

Installation status power should come from a permanent B24 supply via
OPCR contacts, so that the status of the installation within a hot standby
system can be determined by the NCDM. Table 4.3 and figure 4.25 show the
installation status terminals for a Style 1 NCD PFM. For Style 2 (NCDC PFM),
these terminals are brought to the board’s connector panel and labelled STA.
Table 4.4 Installation Status Connector Pinout—NCD PFM—NCDM
NCD PFM Pin Number

(see figure 4.25, Style 1) Signal
1 +22 to +30 V
2 Common (0V)
4.7.2.3 Network Connection

A network port is provided for connection to external network infrastructure.
This connection is made via a female RJ45 connector on the rear of the
NCD(C) PFM as shown in figure 4.25.
Use the GCSS to configure the network port and session configurations (eg
protocol, session ID etc).
The configuration is stored in the NCDM Non-Vital Configuration.
Available Port Signals
Table 4.5 lists the set of signals provided by the network port.
Table 4.5 RJ45 Pinout—Network Connection—NCD(C) PFM—NCDM
Pin Number Signal Name Signal Source

1 Tx+ NCDM
2 Tx- NCDM
3 Rx+ External Equipment
4 Not used -
5 Not used -
6 Rx- External Equipment
7 Not used -
8 Not used -
4-40 Invensys Rail

4.7.2.4 Serial Connections

Two configurable serial ports are provided for connection to external control
and diagnostic systems. These connections are made via male DB9
connectors on the rear of the NCD(C) PFM, as shown in figure 4.25.
The two ports are numbered Port 2 and Port 3. Port 2 is the connector on the
left and Port 3 is the connector on the right (closest to the PCB).
Use the GCSS to configure each port as part of the Non-Vital Configuration
for RS232C or RS485 signal levels. RS232C is used for point-to-point links
only, and RS485 may be used for point-to-point or multi-drop links.
All serial port configuration (eg protocol, data transfer rate, clock
reconstruction etc) is stored in the NCDM Non-Vital Configuration.
4
RS422 equipment may be connected to an NCDM port configured for RS485
as a point-to-point link. Some RS422 equipment may be suitable for multi-
drop operation. Check with the supplier.
Both serial port interfaces are powered by the Serial Power Connector (see
section 4.7.2.1).
The set of signals provided by each port vary depending on the interface
type.
RS232C Connection
Table 4.6 DB9 Pinout—RS232C Connection—NCD PFM—NCDM

1 DCD External equipment
2 RxD External equipment
3 TxD NCDM
4 DTR NCDM
5 ISOGND (Common)
6 CLKOUT NCDM
7 RTS NCDM
8 CTS External equipment
9 CLKIN External equipment
Data transfer pins—RxD and TxD.

The NCDM is wired as a DTE (Data Terminal Equipment) device, so:
• RxD is an input;
• TxD is an output.
Clock signals—CLKIN and CLKOUT.
For use with synchronous protocols, ie WSA/S2. See Clock Signals on page
4-42.

Modem handshaking signals:

• generated by the modem:
• DCD (Data Carrier Detect);
• CTS (Clear To Send).
The NCDM can be configured to use or ignore either or both of these
signals. If the NCDM uses them, it will not transmit unless both signals are
asserted.
• generated by the NCDM
• DTR (Data Terminal Ready), continuously asserted;
• RTS (Request To Send):
- asserted on control system ports when NCDM has data to transmit;
- continuously asserted on diagnostic ports.
RS485 Connection
Table 4.7 DB9 Pinout—RS484 Connection—NCD PFM—NCDM

1 RxD– External equipment
2 RxD+ External equipment
3 TxD+ NCDM
4 TxD– NCDM
5 ISOGND (Common)
6 CLKOUT+ NCDM
7 CLKOUT– NCDM
8 CLKIN– External equipment
9 CLKIN+ External equipment
RS485 uses a subset of the RS232C signals. Modem handshaking signals

(RTS, CTS, DTR and DCD) are not available.
Serial ports configured as RS485 may be connected through Invensys Rail

modems (eg S2/VFC45) but may not be suitable for commercial modems
because of the absence of handshaking signals.
Clock Signals
This section is only applicable for the WSA/S2 protocol.
The NCDM serial interfaces do not provide ‘transmit clock’ and ‘receive clock’
pins. Instead, they provide ‘clock output’ (CLKOUT) and ‘clock input’ (CLKIN)
pins.
The transmit clock signal can be configured (in the GCSS Non-Vital
Configuration) to be either:
• generated by the NCDM and appearing on the CLKOUT pin, or;
• generated as a copy of the CLKIN (CLKOUT will also be a copy of CLKIN).
The receive clock signal can be:

• generated by the NCDM and appearing on the CLKOUT pin;
• generated as a copy of CLKIN on the NCDM;
• reconstructed from the incoming data signal (it is then not necessary to
connect anything to the CLKIN pin).
4-42 Invensys Rail

Note: NCDM modules must use clock reconstruction if a clock signal is not
provided.
Note: When clock reconstruction is enabled, that interface’s clock output

(CLKOUT) runs at 16 times the data rate and therefore cannot be used as
an external clock for another device.
Application issues
• There is only one clock input (CLKIN) for each interface and this can be
used for Transmit, Receive or both. The latter case also requires that the
4
external equipment uses a single clock—this can be supplied from either
the external Transmit or Receive.
• Clock reconstruction requires that:
• the external data rate generator has a frequency error of less than
0.3%;
• the maximum data rate is 38400 bps.
• Figures 4.26 and 4.27 show the clock, transmit and receive connections
recommended when using the NCDM in serial master-slave applications.
Use the NCDM’s CLKOUT and CLKIN (rather than clock reconstruction) to
synchronise both transmit and receive data whenever possible.

NCDM as Master (Client)

CLKOUT
TxD
NCDM RxD
Internal
clock TxD RxD CLKIN TxD RxD CLKIN
Master
(client)
Use internal clock
In GCSS set PEN Signal Output field
to Always Active (see GCSS) External External
clock clock
Slaves (servers)
eg NVC/DM, NVC232 or NVC422
Use external clock
NCDM as Slave (Server)

CLKOUT
TxD
RxD
TxD RxD CLKIN TxD RxD CLKIN
Master
(client)
NCDM NCDM
External External
clock clock
Slaves (servers)
Use external clock
to Transmit Only
NCDM as Slave (Server)—No Master Clock Available
TxD
RxD
TxD RxD TxD RxD
Master
(client)
NCDM NCDM
Reconstructed Reconstructed
clock clock
Slaves (servers)
Use clock reconstruction
In GCSS set PEN Signal Output field to Transmit Only
Figure 4.26 Serial Master-Slave Examples—NCDM
4-44 Invensys Rail

Hot-Standby NCDMs
CLKOUT
CLKIN
NCDM TxD
RxD
Online-biased
CLKOUT
CLKOUT
CLKOUT
CLKIN
CLKIN
RxD
RxD
TxD
TxD
CLKIN
NCDM TxD
RxD
Standby-biased
Masters
(clients)
4
In GCSS set:
• PEN Signal Output field to Transmit Only Slaves (servers)
• Tx Clock field to From Port eg NVC/DM, NVC232 or NVC422
• Rx Clock field to External Use external clock
Figure 4.27 Serial Master-Slave Examples—Hot-Standby NCDMs
4.7.2.5 Production Port

This port is a male DB9 connector on the front edge of the NCDC. Signal
levels are RS232C and the connector pinouts are shown in table A.45 in
Appendix A.
The port supports a 3-wire (RxD, TxD & COMMON) connection to a PC

running GCSS or ICS and operates at either 9600 bps or 115200 bps.
Use the GCSS to upgrade the NCDM Non-Vital Configuration through the
Production port.
System software upgrades are also made through this port using the
Zmodem protocol configured for 38400 bps.
Note: No protection or filtering is provided on this port so it must only be used

for temporary connections, while the interlocking is not controlling the
railway.

4.7.3 Redundant Serial Port Interface for Control Systems

The system availability can be improved by using redundant control system
communication circuits (usually between the control centre and the field).
Configure both ports as a duplicated pair and use two diverse bearers to
connect the NCDM with the remote location.
Ports configured as a duplicated pair must use the same protocol, but other
parameters (eg data transfer rate) can be different.
Change over from one port to the other is controlled by the office. The office
will normally force a change over to the standby bearer if it fails to receive a
reply from the NCDM on the online bearer. The actual mechanism depends
on the protocol being used.
4.7.3.1 WSA/S2 Slave

The office transmits each message on both links; one of which is the
designated online link.
The NCDM primary port is set online at power-up. The NCDM will only use
data from the online port and will only reply using the online port. All
messages received on the offline port will be echoed back to the office
without change.
The office can force a port change over by setting the Port bit (bit 6 of the
control byte).
The offline port will become active when the active port times out with a Loss
of Communication (LOC).
The NCDM will set the Port bit in the reply to 0 for the port that is online or 1
for the port that is offline.
4.7.3.2 WSL/S2 Slave

There are currently two different schemes for handling WSL/S2 duplicated
links:
• The WRSL method uses the Inhibit bit. The NCDM will ignore a received
message with the Inhibit bit set, although it will still reply to the message
in the normal way. The port is considered to be in Standby Mode.
• The Dimetronic method does not use the Inhibit bit (it is always clear);
instead, only one of the ports is ‘configured’ at any one time. On receipt of
a ‘card fit data’ message (which causes the port to become configured, ie
online), the NCDM will change the state of the other port to
‘unconfigured’.
4-46 Invensys Rail

4.7.4 Hardware Settings

Signal level—set for each serial port by configuring the correct signal type in
the Non-Vital Configuration.
Non-Vital Configuration Version number—set using a switch bank and must

match the value stored in the Non-Vital Configuration.
Diagnostic protocol passwords—can be changed during operation through

MoviolaW (see [GCSS]). Reset by a hardware link to the default passwords
specified in the Non-Vital Configuration.
IP Address selection—set using switch 3 of switch bank 2. This setting is only

applicable when the NCDM is used in a hot standby system. 4
Offline modes—set using links and switches:
• Maintenance Mode allows the Non-Vital Configuration to be downloaded
or uploaded using GCSS or ICS;
• Production Mode allows the NCDM system software to be upgraded.
See section A.11 on page A-89 for more details.
4.7.5 Non-Vital Configuration Settings

NCDM Non-Vital Configuration:
• is entered using the GCSS, compiled, then downloaded to the NCDM;
• can be downloaded by ICS to the NCDM from an image file created by
GCSS (GCSS and ICS version 6.2 and above).
The Non-Vital Configuration contains configuration parameters and non-vital

application logic.
Refer to [GCSS] for more information.
NAPPDEL Precaution
Although the NCDM has a non-vital application delay timer NAPPDEL, we

recommend that you instead use the APPDEL timer to manage startup delays.
Using NAPPDEL on hot-standby systems will result in the non-vital application

delay timer running the first time there is a changeover from the online to the
standby WESTRACE, and this is normally highly undesirable.
Caution: We recommend that hot-standby systems do not use NAPPDEL in the

logic, and that you set the NAPPDEL value to zero.

4.7.6 Specific Network Port Application Rules

The NCDM can be configured to interface with multiple systems through the
network.
For example:
• Control systems (local control panel or centralised train control);
• Diagnostic systems;
• Other WESTRACE systems.
The control inputs may be received from multiple sources, such as:
• Main CTC;
• Zone CTC;
• Local Control Panel.
Design the system to eliminate any unwanted effects of multiple control

inputs.
This could include:

• Ensuring the control systems select which is in control independent of the
NCDM;
• Selecting the source via the NCDM application data.
4.7.6.1 Operating Distance Restrictions

The network port is 10 baseT Ethernet compliant and can support data
transfer over twisted pair cable up to 50 metres in length.
The use of external network infra-structure is required for data transfer over
longer distances.
A shielded 10 baseT Ethernet cable is highly recommended to improve

reliability.
4.7.6.2 Timeout
The timeout values for the network port and network sessions are configurable
in the range 1–20 seconds. The recommended value is 5 seconds for all
network sessions.
Note: The NCDM does not use the network port timeout value. It detects loss of
network connection based on hardware signal level detection.
4.7.6.3 Network Storm Limitation

A network storm can be caused if network equipment such as switches,
routers and hubs are inadvertently connected in a loop. This results in
excessive network traffic arriving at the NCDM, which exhausts its processing
capability.
4-48 Invensys Rail

The NCDM detects this situation and automatically restricts the number of
incoming network packets. However, the algorithm it uses may cause
intermittent loss of inputs, resulting in unintended but safe operation. This is
a known and unavoidable limitation.

4.7.7 Specific Serial Port Application Rules

The NCDM may be configured to receive control inputs from multiple
sources. For example:
• Main bearer;
• Standby bearer;
• Local control system.

inputs.
This could include:

• Ensuring the remote control system selects the transmit bearer;
• Selecting the source via the application data.
RS232C
Use RS232C for data transfer rates up to 20 kbps over cables up to 15m in
length.
Operation at higher data transfer rates (eg 57600 bps) is possible over
shorter cable lengths.
Shielded cable is highly recommended for improved reliability.
For longer cable lengths and higher data transfer rates, RS485 is preferred.
RS485
The RS485 specification allows for long cable runs at high data rates (eg
1200 m at 64000 bps). Such distances are only practical where all nodes are
solidly referenced to the same potential. Rail environments are subject to
high earth potential differences caused by lightning strikes and traction faults
that have historically caused failures in drivers and receivers.
Practical rail environment recommendations are:

• Do not run RS485 outside of buildings (unless you can positively
guarantee the fault potential difference with respect to signal ground will
never exceed 5V). Consider use of fibre optic modems and optical fibres
instead.
• Connect the signal ground on all nodes. Ensure this does not induce earth
loops.
• Fit 120 Ω 0.25 W termination resistors at the ends of cables. Do not fit
resistors at intermediate nodes.
Refer to the public domain specifications for further details.
4-50 Invensys Rail


4.7.7.3 Timeout
The control system port timeout is configurable in the range 1 - 60 seconds.
The recommended value is 10 seconds. In this case, the office must ensure
that it sends a message to the NCDM at least once every 10 seconds.
To help detect configuration errors, the NCDM has an ‘address timeout’

which is the maximum permissible time between messages sent to or
4
received from a particular S2 address.
The address timeout is the port timeout multiplied by the number of

addresses handled by the port. Thus if a port has to handle four S2 addresses,
the maximum time between messages to a particular address is 40 seconds.
As an example, suppose port 2 on the NCDM is configured for addresses 1,

2, 7 and 12 but the office is (incorrectly) configured for addresses 1, 2, 8 and
12. The NCDM will ignore messages sent to address 8, and will not receive
messages for address 7. After 40 seconds it will flag a ‘port 2, address 7
timeout’ fault code (2079h) See Appendix A, page A-105.
The diagnostic port timeout is configurable in the range 1 - 60 seconds. The

recommended value is 30 seconds. If no message is received from the master
within this time, the NCDM will terminate the session and hang up the
modem (if used).
4.7.7.4 Recommended Modem

To minimise line errors on a remote connection to a WESTRACE that uses an
NCDM, be sure to use an industry-recognised brand of modem.
We recommend the VFC/45 modem(Invensys Rail part number 2650108210).
Note: If the NCDM uses the WSL/S2 protocol, the modem must support WSL/S2
frames: 1 start bit, 8 data bits, 2 stop bits and even parity.

4.8 Non-Vital Communications and Diagnostic Module (NVC/DM)
4.8 Non-Vital Communications and Diagnostic Module

(NVC/DM)
The NVC/DM replaces older NVC and DM modules and works with the HVLM
and the VLM5 vital processing modules. It can also operate as a stand-alone
non-vital logic processor.
Functions
The main functions of the NVC/DM are to:

• Evaluate non-vital application logic;
• Exchange configured logic states with control centres, control computers,
external non-vital parallel I/O modules and the vital processor, using
various serial protocols;
• Receive all logic states from the vital processor, for logging purposes;
• Regularly scan all WESTRACE modules for detected faults;
• Log all changes to vital and non-vital logic states, all detected faults and
other significant occurrences;
• Allow an external diagnostic system (such as MoviolaW) to extract logged
data and other diagnostic information, via a serial interface;
• Allow an external system to download or upload the Non-Vital
Configuration.
Note: The NVC/DM has been validated for Hot Standby operation but only as a
diagnostic module (emulating a DM128 or DM5).
NVC/DM Real Time Clock
A real time clock (RTC) is used for internal timestamping of faults, events and
operations logged for diagnostic purposes. The accuracy of the RTC is stated
as ‘better than ± 2 minutes per month @ 25ºC’ which is approximately ± 4.3
seconds per day. The module should have its time synchronised with the
connected external diagnostic system or control system when greater
accuracy of time stamping is required.
SAFETY
The NVC/DM must not be used for processing:
• safety critical logic;
• vital communications.
WARNING
4-52 Invensys Rail


An NVC/DM comprises the following components:
• Logic Evaluation Card (LEC).
• Communications Interface Module Filter & Interface Module (CIMFIM).
A CIM Protection Module (CIMPM) is plugged into the rear of the CIMFIM.
See figure 4.30.
The CIMFIM is fitted with one or more daughter boards of the following types
(one for each of the six external ports):
• Serial Daughter Board 232 (SDB232), for RS232C level ports
• Serial Daughter Board 485 (SDB485), for RS485 level ports 4
The CIMFIM connects to the CIM Protection Module (CIMPM).
The external serial cables terminate at DB9 connectors on the back of the
CIMPM. The CIMPM card provides transient protection for the serial signal
lines, that pass to the CIMFIM via the lower backplane connector on the
CIMFIM.
The CIMFIM provides filtering to remove high frequency noise, then routes
the signals to the serial interface daughter boards. The daughter boards
convert the signals between RS232C or RS485 levels and CMOS levels.
The CMOS-level serial signals pass between the LEC and the CIMFIM via a 96-
pin connector near the front of the board. The LEC is responsible for all logic
and communications processing functions.
Table 3.1 lists these components along with their functions and part
numbers.
Figure 4.28 LEC—NVC/DM Module—Component Side View

Figure 4.29 Component Side View—CIMFIM—NVC/DM
Figure 4.30 Assembly—LEC, CIMFIM and CIMPM—NVC/DM
4-54 Invensys Rail


Non-Vital Configuration and system firmware upgrades are made through
the Production port on the front edge of the LEC. See section 4.8.2.3.
Diagnostic, telemetry and serial power connections to the NVC/DM are

through connectors on the CIMPM. See figure 4.31.
Diagnostic or telemetry connection

RS232C or RS485 signal levels
4
Telemetry connection only

RS232C or RS485 signal levels
Not used
Serial power connector
Figure 4.31 Serial and Power Connectors—CIMPM—NVC/DM
4.8.2.1 Serial Power Connection

Serial power should come from a permanent B24 supply so that diagnostics
can be accessed after system shutdown.
Table 4.8 Serial Power Pinout—CIMPM—NVC/DM
Pin Number Signal

1 +24 ±6 Vdc
2 Common (0V)
3 Not used
4.8.2.2 Diagnostic and Telemetry Serial Connections

Six configurable serial ports are provided for connection to external control
and diagnostic systems. These connections are made via male DB9
connectors on the rear of the CIMPM, as shown in figure 4.31.
The six ports are numbered Port 2 to Port 7. The Port 1 connector is not
currently used.

Each port may be configured for RS232C or RS485 signal levels by installing
the appropriate daughter board. RS232C is used for point-to-point links only,
RS485 may be used for point-to-point or multi-drop links.
All other port configuration (eg. data transfer rate, clock reconstruction etc) is
done using GCSS and stored in the NVC/DM Non-Vital Configuration.
RS422 equipment may be connected to an NVC/DM port configured for

RS485 as a point-to-point link. Some RS422 equipment may be suitable for
multi-drop operation. Check with the supplier.
All six serial port interfaces are powered by the Serial Power Connector (see
section 4.8.2.1).
The set of signals provided by each port vary depending on the interface
type.
RS232C Connection
See table A.59, Appendix A, page A-143.
Data transfer pins—RxD and TxD.

The NVC/DM is wired as a DTE (Data Terminal Equipment) device, so:
RxD is an input;
• TxD is an output.
Clock signals—CLKIN and CLKOUT.
For use with synchronous protocols, ie WSA/S2. See Clock Signals on page
4-57.
Modem handshaking signals:

• generated by the modem:
DCD (Data Carrier Detect);
• CTS (Clear To Send).
The NVC/DM can be configured to use or ignore either or both of these
signals. If it uses them, it will not transmit unless both signals are asserted.
• generated by the NVC/DM
DTR (Data Terminal Ready), continuously asserted;
• RTS (Request To Send):
- asserted on telemetry ports when NVC/DM has data to transmit;
- continuously asserted on diagnostic ports.
RS485 Connection
See table A.60, Appendix A, page A-143.
RS485 uses a subset of the RS232C signals. Modem handshaking signals

(RTS, CTS, DTR and DCD) are not available.
These ports can be connected through Invensys Rail modems (eg S2/VFC45)
but may not be suitable for commercial modems because of the absence of
handshaking signals.
4-56 Invensys Rail

Clock Signals
This section is only applicable for the WSA/S2 protocol.
The NVC/DM serial interfaces do not provide ‘transmit clock’ and ‘receive
clock’ pins. Instead, they provide ‘clock output’ (CLKOUT) and ‘clock input’
(CLKIN) pins.
The transmit clock can be configured (in the GCSS Non-Vital Configuration)
to be either:
• generated by the NVC/DM and appearing on the CLKOUT pin, or;
• generated by the external receiver connected to the CLKIN pin on the
NVC/DM.
The receive clock can be:

4
• generated by the NVC/DM and appearing on the CLKOUT pin;
• generated by the external transmitter connected to the CLKIN pin on the
NVC/DM;
• reconstructed from the incoming data signal (it is then not necessary to
connect anything to the CLKIN pin).
Note: NVC/DM modules must use clock reconstruction if a clock signal is not
provided.
Note: When clock reconstruction is enabled, that interface’s clock output

(CLKOUT) runs at 16 times the data rate and therefore cannot be used as
an external clock for another device.
Application issues
• There is only one clock input (CLKIN) for each interface and this can be
used for Transmit, Receive or both. The latter case also requires that the
external equipment uses a single clock—this can be supplied from either
the external Transmit or Receive.
• Clock reconstruction requires that:
• the external data rate generator has a frequency error of less than
0.3%;
• the maximum data rate is 38400 bps.
• Figures 4.32 and 4.33 show the clock, transmit and receive connections
recommended when using the NVC/DM in serial master-slave
applications.
Use the NVC/DM’s CLKOUT and CLKIN (rather than clock reconstruction)
to synchronise both transmit and receive data whenever possible.

NVC/DM as Master (Client)

CLKOUT
TxD
NVC/DM RxD
Internal
clock TxD RxD CLKIN TxD RxD CLKIN
Master
(client)
Use internal clock
to Always Active External External
(see GCSS) clock clock
Slaves (servers)
eg NCDM, NVC232 or NVC422
Use external clock
NVC/DM as Slave (Server)

CLKOUT
TxD
RxD
TxD RxD CLKIN TxD RxD CLKIN
Master
(client)
NVC/DM NVC/DM
External External
clock clock
Slaves (servers)
Use external clock
to Transmit Only
NVC/DM as Slave (Server)—No Master Clock Available
TxD
RxD
TxD RxD TxD RxD
Master
(client)
NVC/DM NVC/DM
Reconstructed Reconstructed
clock clock
Slaves (servers)
Use clock reconstruction
In GCSS set PEN Signal Output field to Transmit Only
Figure 4.32 Serial Master-Slave Examples—NVC/DM
4-58 Invensys Rail

Hot-Standby NVC/DMs
CLKOUT
CLKIN
NVC/DM TxD
RxD
Online-biased
CLKOUT
CLKOUT
CLKOUT
CLKIN
CLKIN
RxD
RxD
TxD
TxD
CLKIN
NVC/DM TxD
RxD
Standby-biased
Masters
(clients)
4
In GCSS set:
• PEN Signal Output field to Transmit Only Slaves (servers)
• Tx Clock field to From Port eg NCDM, NVC232 or NVC422
• Rx Clock field to External Use external clock
Figure 4.33 Serial Master-Slave Examples—Hot-Standby NVC/DMs
4.8.2.3 Production Port

This port is a male DB9 connector on the front edge of the card. Signal levels
are RS232C and the connector pinouts are shown in table A.61, Appendix A,
page A-144.
The port supports a 3-wire (RxD, TxD & COMMON) connection to a PC

running GCSS or ICS and operates at either 9600 bps or 115200 bps. Non-
Vital Configuration and system firmware upgrades to the NVC/DM are made
through this port from the configuration system (GCSS).
Note: No protection or filtering is provided on this port so it must only be used

for temporary connections, while the interlocking is not controlling the
railway.

4.8.3 Redundant Telemetry

The system availability can be improved by using redundant telemetry
(usually between the control centre and the field). Configure two ports as a
duplicated pair and use two diverse bearers to connect the NVC/DM with the
remote location.
Ports configured as a duplicated pair must use the same protocol, but other
parameters (eg data transfer rate) can be different.
Change over from one port to the other is controlled by the office. If the office
fails to receive a reply from the NVC/DM on the online bearer, it will normally
force a change over to the standby bearer. The actual mechanism depends
on the protocol being used.
4.8.3.1 WSA/S2 Slave

The office transmits each message on both links; one of which is the
designated online link.
The NVC/DM primary port is set online at power-up. The NVC/DM will only
use data from the online port and will only reply using the online port. All
messages received on the offline port will be echoed back to the office
without change.
The office can force a port change over by setting the Port bit (bit 6 of the
control byte).
The NVC/DM will set the Port bit in the reply to 0 for primary or 1 for
secondary on line.
4.8.3.2 WSL/S2 Slave

There are currently two different schemes for handling WSL/S2 duplicated
links:
• The WSL method uses the Inhibit bit. The NVC/DM will ignore a received
message with the Inhibit bit set, although it will still reply to the message
in the normal way. The port is considered to be in Standby Mode.
• The Dimetronic method does not use the Inhibit bit (it is always clear);
instead, only one of the ports is ‘configured’ at any one time. On receipt of
a ‘card fit data’ message (which causes the port to become configured, ie
online), the NVC/DM will change the configuration of the other port.
4-60 Invensys Rail

4.8.4 Hardware Settings

Signal level — set for each serial port by installing the correct type of serial
daughter board on the CIMFIM (SDB232 for RS232C, or SDB485 for RS485).
Non-Vital Configuration Version number — set using a switch bank and must
match the value stored in the Non-Vital Configuration.
Diagnostic protocol passwords — can be changed during operation through

MoviolaW (see [GCSS]). Reset by a hardware link the default passwords
specified in the Non-Vital Configuration.
Offline modes — set using links and switches:

• Maintenance Mode allows the Non-Vital Configuration to be downloaded 4
or uploaded using GCSS or ICS;
• Production Mode allows the NVC/DM system software to be upgraded.
See section A.12 on page A-121 for more details.
4.8.5 Non-Vital Configuration Settings

NVC/DM Non-Vital Configuration:
• is entered using the GCSS, compiled, then downloaded to the NVC/DM;
• can be downloaded by ICS to the NVC/DM from an image file created by
GCSS (GCSS and ICS version 6.2 and above).
The Non-Vital Configuration contains:

• Non-vital application logic;
• Configuration parameters.
Refer to [GCSS] for more information.


The NVC/DM may be able to receive control inputs from multiple sources, for
example:
• Main bearer;
• Standby bearer;
• Local control system.

inputs.
This could include:

• Ensuring the remote control system selects the transmit bearer;
• Selecting the source via the application data.
RS232C
Use RS232C for data transfer rates up to 20 kbps over cables up to 15m in
length.
Operation at higher data transfer rates (eg 57600 bps) is possible over
shorter cable lengths.
Shielded cable is highly recommended for improved reliability.
For longer cable lengths and higher data transfer rates, RS485 is preferred.
RS485
The RS485 specification allows for long cable runs at high data rates (eg
1200 m at 64000 bps). Such distances are only practical where all nodes are
solidly referenced to the same potential. Rail environments are subject to
high earth potential differences caused by lightning strikes and traction faults
that have historically caused failures in drivers and receivers.
Practical rail environment recommendations are:

• Do not run RS485 outside of buildings (unless you can positively
guarantee the fault potential difference with respect to signal ground will
never exceed 5V). Consider use of fibre optic modems and optical fibres
instead.
• Connect the signal ground on all nodes. Ensure this does not induce earth
loops.
• Fit 120 Ω 0.25 W termination resistors at the ends of long cable runs (eg
100 m at 9600 bps or 10 m at 64000 bps). Do not fit resistors at
intermediate nodes.
Refer to the public domain specifications for further details.
4-62 Invensys Rail


The signal ground line should not be connected to earth because this may
result in an unsafe situation if there is an undetected earth fault(s) in the PFM.
The cable screen, if fitted should be earthed in accordance with section 5.2.3.
4.8.6.3 Timeout
The telemetry port timeout is fixed at 10 seconds. The office must ensure that
it sends a message to the NVC/DM at least once every 10 seconds.
To help detect configuration errors, the NVC/DM has an ‘address timeout’

which is the maximum permissible time between messages sent to or
received from a particular S2 address. 4
The address timeout is the port timeout multiplied by the number of
addresses handled by the port. Thus if a port has to handle four S2 addresses,
the maximum time between messages to a particular address is 40 seconds.
As an example, suppose port 5 on the NVC/DM is configured for addresses

1, 2, 7 and 12 but the office is (incorrectly) configured for addresses 1, 2, 8
and 12. The NVC/DM will ignore messages sent to address 8, and will not
receive messages for address 7. After 40 seconds it will flag a ‘port 5, address
7 timeout’ fault code (5079h) See Appendix A, page A-136.
The timeout is 30 seconds for a diagnostic port. If no message is received

from the master within this time, the NVC/DM will terminate the session and
hang up the modem (if used).

4.9 Non-Vital Communications Module (NVC)

NVC modules comprise an NVC card fitted with an S2/SDB4x daughter
board.
The particular daughter board depends on the application (whether RS232C-

or RS422-level outputs, clock reconstruction, or tri-state circuits are required).
Table 3.1 lists the range of NVC modules, along with their functions and part
numbers.
Figure 4.34 View from Component Side—NVC

See section A.13 for details about NVC modules.
NVC modules are connected using either RS232C or RS422 level outputs
(RS422 is recommended for multiple NVC modules). Figures 4.35, 4.36 and
4.37 illustrate some typical WESTRACE NVC module configurations.
Figure 4.35 illustrates a single NVC module communicating via a modem.
Figure 4.35 Communicating via Modem—Single NVC
4-64 Invensys Rail

Figure 4.36 illustrates multiple NVC modules communicating via a single

modem. The use of NVC422 is recommended for multiple NVC modules
because parallel configurations of NVC modules use tri-state output.
Figure 4.36 Communicating via Modem—Multiple NVC
Figure 4.37 illustrates a single NVC module communicating without a

modem. NVC modules require clock reconstruction where there is no
external clock connection from the S2/SCN4x.
Figure 4.37 Communicating without a Modem—Single NVC
Figure 4.38 illustrates multiple NVC modules communicating without a

modem. NVC modules require clock reconstruction where there is no
external clock connection from the S2/SCN4x. Tri-state communications from
either an NVC422 or NVC232 would be suitable in this example.

Figure 4.38 Communicating without a Modem—Multiple NVC
In the case of either NVC422 or NVC232, the external connections are one to
one. The particular application determines which connections are made.
Tables are provided in sections 4.9.2.1 and 4.9.2.2 as general guides for
connecting each connector pin to S2 devices. Other types of modems would
be connected according to their requirements.
Figure 4.39 illustrates an example of a typical multiple NVC422 to S2/SCN4x

configuration. In this illustration, clock reconstruction is not provided by the
NVC422 modules and the following inputs and outputs are not carried
through to the S2/SCN4x:
• Pin 4—Transmit Clock +
• Pin 5—Transmit Clock –
• Pin 6—Data Carrier Detect
• Pin 7—unused
• Pin 12—Clear to Send
• Pin 13—Request to Send
Similarly for RS232C connections, pins pertaining to modems (or unused)

would not be connected.
Figure 4.39 Connection Details for Multiple Modules without Modem—NVC
4-66 Invensys Rail

4.9.2.1 RS232C Connections

External Connections to the NVC232 are made via the SIO232PFM.
The SIO232 PFM External Connectors are a DB25 plug and socket for RS232C
interface, and a 2 way Weidmueller SLA socket that accepts a Weidmueller
BLA plug for power (supplied with the module).
Figure 4.40 External Connections—SIO232 PFM—NVC232
Table 4.9 DB25 Pinout—SIO232 PFM—NVC232
Pin Function
1 Chassis Ground
The following table is a general guide for connecting each SIO232 PFM
connector pin to either an S2/MBD51 Modem Motherboard or an S2/SCN4x
Scanner. In a typical application, a connection would be carried through for
columns marked ‘ ’.
Other types of modems would be connected according to their requirements.

Note: Ensure that all modem motherboard jumpers are correctly set for the
operational environment.
Table 4.10 DB25 Pinout—SIO232 PFM to S2/MBD51 Modem or S2/SCN4x Scanners

(no modem)
S2/MBD51 S2MBD51 S2/SCN41 or

Pin Function VFC45 VFC46 42
2 TxD
3 RxD
4 RTS
5 CTS
7 GND
8 DCD
17 RXC
20 DTR
24 TXC
Note: NVC232 modules must have clock reconstruction if a clock is not

provided (for example, if a modem is not used).
4.9.2.2 RS422 Connections

The SIO422 PFM External Connectors are a 14 way ribbon header for an
RS422 interface, and a 2 Way Weidmueller SLA socket that accepts a
Figure 4.41 External Connections—SIO422 PFM—NVC422
4-68 Invensys Rail

Figure 4.42 illustrates the RS422 connector pins and pin numbering.
Figure 4.42 RS422 Connector Pin Numbering—SIO422 PFM—NVC422
Table 4.11 14-Way Ribbon Header Pinout—SIO422 PFM—NVC422

4
Pin Function
1 0 Volts (O V)
2 Received Clock + (RXC +)
3 Received Clock - (RXC -)
4 Transmit Clock + (TXC +)
5 Transmit Clock - (TXC -)
7 Not Used
8 Transmit Data + (TxD+)
9 Transmit Data - (TxD-)
10 Receive Data + (RxD+)
11 Receive Data - (RxD-)
14 0 Volts (O V)
The SIO422PFM permits direct ribbon cabling from either a S2/SCN

motherboard or a MBD51 (S2VFC modem motherboard) for direct insertion
into a telemetry system using S2 HDLC protocol.
Where multiple NVCs are in use either in a single WESTRACE system or in

multiple WESTRACE systems (larger interlockings), the NVC ribbon
connections can be multi-dropped.
The following table is a general guide for connecting each SIO422PFM

connector pin to either an S2/MBD51 Modem Motherboard or an S2/SCN4x
Scanner. In a typical application, a connection would be carried through for
columns marked ‘ ’.
Other types of modems would be connected according to their requirements.

Note: Ensure that all modem motherboard jumpers are correctly set for the
operational environment.
Table 4.12 RS422 Pinout—SIO422 PFM to S2/MBD51 Modem Motherboards

or S2/SCN4x Scanners (no modem)
S2/MBD S2/MBD S2/MBD

Signal 51 51 51 S2/SCN4
Pin Function Name Level VFC42 VFC45 VFC46 1 or 42
1 0 Volt Line 0V RS422
2 Receive Clock + RXC + RS422

3 Receive Clock - RXC - RS422
1
4 Transmit Clock + TXC + RS422
1
5 Transmit Clock - TXC - RS422
6 Data Carrier Detect DCD O/C
8 Transmit Data + TxD + RS422
9 Transmit Data - TxD - RS422
10 Receive Data + RxD + RS422
11 Receive Data - RxD - RS422
12 Clear to Send CTS O/C
13 Request to Send RTS O/C
14 0 Volt Line 0V RS422

1. The S2/VFC42 Modem will operate without a synchronising clock from the transmit data signal to the modem. The
modem will synchronise to the data signal, given appropriate links on the S2/MBD51 Motherboard.
Note: NVC422 modules must have clock reconstruction if a clock is not

provided.
The 0 V line at the PFM must be connected to the 0 V line at every device
sharing the RS422 interface.
When directly connecting the S2/MBD51 modem motherboard and the
S2/MBD54 scanner motherboard, the connections for Receive Data and
Transmit Data must be crossed.
4-70 Invensys Rail

4.9.3 NVC Configuration

The following are switch selectable on the NVC:
Slave Address (Telemetry System Address): 0–63

Data Transfer Rate: 600, 1200, 2400, 4800
Data Word Length: 32, 48, 64, 128
System Bit: 0 or 1
Telfail On or Off
Modem Handshaking: On or Off
NVC232 and NVC422 modules which offer clock reconstruction are fitted
with daughter boards which also must be configured for data transfer rate. 4
Full details are provided in section A.13.

4.9.4.1 Two NVCs Used as a Pair
Two NVCs can be configured as a pair in the main and Standby Mode. Both
NVCs are provided with output information from the VLE, but only one is used
to input controls to the VLE (the online or primary one).
The online NVC is selected by using the Application Logic to modify the
reserved mnemonic NVCSEL.
When NVCSEL is set (logic 1) the primary NVC is online. When NVCSEL is
reset (logic 0) the secondary NVC is online. The default value of NVCSEL is
logic 1 (primary NVC selected).
NVCSEL may be controlled using Vital inputs or Non-Vital inputs. If a Non-

Vital input from the NVC pair is used, care should be taken to ensure that the
state of NVCSEL does not oscillate.
4.9.4.2 NVC Used for Vital Serial Channels

The NVC is, by definition, non-vital and must not be used for any vital serial
channel.
4.9.4.3 NVC Used for Non-Vital Serial Channels

A WESTRACE system can be connected to non-vital control systems via
non-vital serial communication modules (NVCs).
Two of the possible ten non-vital serial modules may be configured as a pair,
for example, in an on-line and standby configuration. If a pair of non-vital
serial modules is configured as a pair, then both may be used for output at all
times, but only one shall be used for input at any one time. The active NVC is
selected within the application logic (Refer to the CS or GCSS Manual).

The signal ground line should not be connected to earth because this may
result in an unsafe situation if there is an undetected earth fault(s) in the PFM.
The cable screen, if fitted should be earthed in accordance with section 5.2.3.

4.10 DM and DM128
4.10 DM and DM128

This section describes the Diagnostic Module (DM) and the Diagnostic
Module 128 (DM128).

DM modules comprise a single printed circuit card.
Figure 4.43 Layout—DM128

External Connections to the DM are made via the SIO232PFM for the Event
Recorder and via the front of the module for the Diagnostic Interface.
Weidmueller BLA plug/SLA (not used).
Figure 4.44 External Connections—SIO232 PFM—DM Module
See section 4.9.2.1 for SIO232 PFM DB25 connection details.
4-72 Invensys Rail

4.10 DM and DM128
4.10.3 Event Recorder Interface (ERI)

Table 4.13 DB25 Pinout—Event Recorder Interface—DM Module
Pin Function
4.10.3.1 Signal
The Signal is simplex asynchronous, data output only, and is selectable from
1200 bits/s or 4800 bits/s. It comprises 1 start bit, 7 data bits, 1 parity bit, 4
even, and 1 stop bit.
4.10.3.2 Electrical
The Electrical characteristics of the interface circuits conform to CCITT V.24
(EIA RS232C).
4.10.3.3 Functional
The subset of CCITT V.24 circuits provided by the ERI are:
Table 4.14 CCITT V.24 Circuit Subsets—Event Recorder Interface—DM Module
CCITT Circuit Name Direction of Signal

103 Transmitted Data Output
102 Signal Ground -
106 Clear To Send (CTS) Input
4.10.3.4 Procedural
The ERI transmits serial data via Transmitted Data Circuit 103 if the CTS is not
turned OFF via Circuit 106.

4.10 DM and DM128
4.10.4 Diagnostic Interface (DI)

Table 4.15 DB25 Pinout—Diagnostic Interface—DM Module
Pin Function
4.10.4.1 Signal
The Signal is Duplex Asynchronous, selectable from 1200 bits/s or 4800 bits/s
and comprises 1 start bit, 7 data bits, 1 parity bit, even, and 1 stop bit.
4.10.4.2 Electrical
The Electrical characteristics of the interface circuits conform to V.24 (EIA
RS232C).
4.10.4.3 Functional
The subset of CCITT V.24 circuits provided by the ERI are:
Table 4.16 CCITT V.24 Circuit Subsets—Diagnostic Interface—DM Module
CCITT Circuit Name Direction with Reference to DI

103 Transmitted Data Output
104 Received Data Input
102 Signal Ground -
4.10.4.4 Procedural
The DI receives serial data via Received Data Circuit 104 and transmits data
via Transmitted Data, Circuit 103.
4.10.5 Setting Data Transfer Rate, Language, Echo

The DM is equipped with switches to set interface data transfer rates.
The DM128 has links for setting:

• interface data transfer rates;
• mnemonic language default;
• command echo default.
See section A.14 for details about the DM, and section A.15 for details about
the DM128.

Only one DM module may be installed in a system. Its position is allocated by
the GCSS (or CS) to slot 15 in housing 1.
4-74 Invensys Rail

4.11 Power Supply Unit (PSU)
4.11 Power Supply Unit (PSU)

PSU Modules comprise a single printed circuit board.

External connections to the PSU are made via the PSU PFM.
The PSU PFM External Connector is a 6 way Weidmueller SLA socket that
4
Figure 4.45 External Connections—PSU PFM—PSU
4.11.3 External 24 Vdc Supply

The absolute limits of the input voltage, including ripple and noise are:
• Maximum Instantaneous Voltage 30 V
• Minimum Instantaneous Voltage 20 V
The WESTRACE System is designed to operate from a nominal 24 Vdc

supply. Typically this will be a battery and float charger that ensures continuity
of supply during mains outages.
4.11.4.1 Earthing of External Supply

For the PSU PFM protection to be assured the external supply connections
must not be earthed. An internal PFM failure could result in the negative side
of the signalling supply being earthed.
4.11.4.2 Internal Logic Supplies

Under no circumstances should the internal logic supplies be connected to
earth or the external signalling supply.

4.12 Vital Logic Equipment Backplane (BPLANE)
4.12.1 Backplane Addressing

Each system may comprise up to 4 backplanes, each backplane having its
address links set as illustrated in figure 4.50 and as described in the following
table.
Three 2 way links are provided on the backplane to allow the backplane
number to be set. For each link, the centre pin is linked to the top pin to
represent a “1” and to the bottom pin to form a “0”.
The link settings to allow the setting of the number of the backplane are:
Table 4.17 Link Settings for Backplane Addressing
Backplane No. LK3 LK2 LK1

1 0 0 1
2 0 1 0
3 1 0 0
4 1 1 1
4.12.2 Connection of !RESET

The !RESET is the reset line from the PSU to processor based modules. It
should only be connected on the first backplane regardless of the number of
PSU modules in use.
The link setting to allow connection of !RESET to the backplane is:

Table 4.18 Link Setting for !RESET to the Backplane
Backplane LK4
1 1
2 0
3 0
4 0
A ‘1’ indicates the link should be made and a ‘0’ indicates that the link should
not be made.
The backplane with LK4 made must contain a PSU.
4.12.3 Backplane Continuity

Unused slots on the backplane (where modules are not fitted) should be
fitted with Blanker cards to maintain continuity of Health Monitoring, Second
Negation Signals and Fault Diagnostics.
If Blanker cards are not fitted the system will not operate.
4-76 Invensys Rail

4.12.4 Multiple Card Housing Systems

To expand the capability of the equipment from a single card housing up to
four card housings, it is necessary to expand the interconnections between
modules. On a single backplane, signals between modules are either co-
ordinated on a bus system, or chained together in a daisy chain. An example
of the former is the “IMB”, an example of the latter is the “Second Negation
signal”.
To expand the signals, the bussed signals are transferred to other backplanes
by an impedance controlled bus extension. The daisy chained signals within
the backplane loop are treated differently—in this case the loop is broken,
and continued to other backplanes where the daisy chain is continued. The
loop is eventually restored by a link from the last backplane. In all cases, the
4
links are carefully impedance controlled.
Interconnections between backplanes are made by multicore cable, the

cable is made up of cores carrying individual bus signals, each bus signal also
having a protective 0 V core.
4.12.4.1 Maximum Link Lengths

The length of links is as per cable assembly drawings. It is not permissible to
alter the length of links, as this is determined by the impedance controlling
termination circuit. Housings are supplied with all cables.
4.12.4.2 PSU Rails

A housing may have an internal PSU, or it may be powered from another
housing having an internal PSU.
Figure 4.46 Internal Power Linking—PSU to PSU
Where only one PSU is fitted in a multicard frame system it must be fitted in
Housing 1.
Power rail linking is performed by looping between the 6 pin Molex plugs
(Con17) on each backplane.
The power linking requires all 6 pins connected as described in the following
sections.

4.12.4.3 Physical Connections

The VLE Backplane is fitted with three pairs of 37-way D type sockets and a 6-
way connector to facilitate the interconnections between racks. Two pairs of
37-way sockets are used for connecting bussed signals between backplanes.
Each connector of a pair being connected in parallel with the other connector
of the same pair (Con19 is in parallel with Con21, and Con18 is in parallel with
Con20).
The remaining two 37-way sockets are used for connecting daisy chained
signals between racks for Health Monitoring, Second Negation and Fault
Diagnostics signals. The following diagrams show how three different types
of Expansion Cable (EC1 to EC3) are used on the backplane for 1, 2, 3 and 4
rack systems.
Figure 4.47 Single Housing System
Figure 4.48 Two Housing System
4-78 Invensys Rail

Figure 4.49 Three Housing System

Figure 4.50 Four Housing System
4-80 Invensys Rail

4.13 Surge Arresters

Surge Arresters are used external to the parallel input modules (VPIM) and
output modules (VLOM & VROM) when there in a danger of damage from
voltages induced in the cable runs. Typically, surge arresters are used
whenever cable leaves the signalling equipment room or location case.
The surge arresters have been designed to prevent the possibility of cross
SAFETY
feeds between similar functions in the event of failure to short circuit of
multiple components. Commercial arresters such as three terminal gas
discharge tubes are unsuitable and their use could lead to a wrong side
WARNING
failure.
4
The surge arresters provide two levels of primary protection from external
transient voltages using gas discharge tubes and MOVs.
Surge arresters are available in voltage ranges to suit the standard input and
output voltages (see figure 4.51). Versions are available for left and right
cable entry (see figure 4.52).
Figure 4.51 Surge Arrester—Weidmuller

Figure 4.52 Surge Arresters (Left and Right Side Entry)
Cassette style surge arrestors by Elsafe Australia:

• Type 555175 (50 Vdc), and;
• Type 216660 (110 Vac);
are suitable alternatives. See figure 4.53.
Figure 4.53 Surge Arrester—Elsafe
4-82 Invensys Rail

Chapter 5: Installing WESTRACE
5.1 Earthing and Bonding Practice
5. INSTALLING WESTRACE
The safety integrity and reliability of WESTRACE requires good installation
practice.
WESTRACE uses high technology electronic components that, when the

equipment is unprotected, are more susceptible to interference from
external electrical noise and extremes of temperature than conventional relay
interlockings. The WESTRACE system, including its conductive, shielded card
housings and PFM modules, have been carefully designed to protect against
the adverse effects of the harsh, railway signalling environment. Adherence
to the practice detailed in this section, and maintenance of a clean
environment, will ensure that these are fully effective and that the equipment
will operate safely and reliably.
5
5.1.1 Definitions
See the Glossary for meanings of special terms.
5.1.2 General
SAFETY
The earthing and bonding guidelines described in this section must be
followed to ensure that metalwork potentials are kept within safe levels
in both electrified and non electrified territory.
WARNING
This section defines the practice to be applied in the installation of earthing

and bonding of WESTRACE and other associated equipment that is
connected to it. This practice will maximise the reliability of a working system
and simultaneously ensure that metalwork potentials are kept within safe
levels in both electrified and non electrified territory.
Inspect all installations for compliance with earthing and bonding practice as
part of the commissioning procedure.
WESTRACE housings are constructed from aluminium that has been treated
with a conductive finish. The combination of the panels, the ventilated top
and bottom covers and the PFMs with the screen part way along, form a
Faraday cage that will effectively prevent interference from entering or
leaving properly earthed housings. The protective cage must be earthed to
be fully effective.

5.1.3 Provision of Earth Points
5.1.3.1 Connection to Earth

Earth connections points should comply with the Rail Authority's practice and
the requirements detailed in this section.
The actual form of earth connection will depend on the local conditions. A
single buried earth for a location case may be effective in some areas while a
comprehensive earth mat may be necessary for poorly conductive soils or in
electrified territory. The earth impedance must be less than 15 Ω and should
ideally be below 5 Ω as measured by an ac earth impedance meter. The earth
impedance should be maintained for all soil and climatic conditions.
5.1.3.2 Earth Point

Provide a star earth point (see figure 5.1) or earth bus bar for each equipment
location. It must be solidly connected to the earth connection as detailed in
section 5.1.5. This point shall have sufficient capacity for all earth connections
and should allow removal of individual earths for fault finding. The earth point
should be located as near as practical to the cable entry.
a) All metal work including location case panels, relay frames, doors and
hatches shall be bonded directly to this earth point;
b) All transformer chassis and earth screens shall be bonded directly to this
earth point;
c) All electronic equipment earths, including the WESTRACE earth, shall

be bonded directly to this point;
d) Surge arresters should be located as near as practical to the earth point

and the arrester earths should be solidly bonded to the earth point.
Figure 5.1 Star Earth Connection
Figure 5.2 Daisy Chained Earth
5-2 Invensys Rail

5.1.4 Equipment Earthing

All WESTRACE equipment and all associated metal work, such as power
supplies, S2 telemetry and relay panels within a rack should electrically
bonded with 4 mm² braid as shown in figure 5.3. Each equipment rack should
then be connected to a common, star earth point as shown in figure 5.1. Daisy
chained earth wiring, as shown in figure 5.2 is not as effective and should not
be used even when low earth currents from electronic equipment are
involved.
Figure 5.3 Earthing on WESTRACE Housings
5.1.5 Earth Wiring

SAFETY
The guidelines for Earth wiring detailed in this section must be followed.
WARNING
a) All earth conductors shall be kept as short as possible so as to minimise
their resistance and inductance;
b) Earth conductors shall be routed so as to be free of sharp bends and

kinks so as to minimise their inductance. The minimum radius of any
bend shall be 150 mm;
c) Earth conductors and other location wiring shall be routed so as to

minimise the amount of other wiring parallel to and in close proximity to
earth conductors;
d) Earth conductors:
from arresters to an arrester earth terminal;
• from an arrester earth terminal of a slave location case to a master
location case;
• shall not run parallel to or in close proximity to any other conductor.

e) Earths shall be wired separately, and not ‘daisy chained’;
f) For connecting earth terminals to buried earths, or traction bonds, and

for interconnecting earth terminals in a multi case location, the earth
conductor shall have a cross sectional area of 10 mm2;
g) Where the distance from an earth terminal to the buried earth exceeds
10m, two parallel conductors shall be used;
h) The distance from an earth terminal to a buried earth should not exceed
20m;
i) Between surge arresters and an earth terminal, or bus bar, the earth
conductor shall have a cross sectional area of 10 mm2;
j) For bonding between metalwork, the earth conductor shall have a cross
sectional area of 10 mm2.
The aim of Star Earth is to ensure that noise superimposed on an equipment

earth lead is not passed to other equipment due to earth sharing.
5-4 Invensys Rail

5.2 Wiring and Connections
5.2.1 Interference from Electrical Noise

SAFETY
The guidelines for prevention of interference from electrical noise
detailed in this section must be followed.
WARNING
A major threat to the safety and reliability of any electronic based equipment
is it susceptibility to interference from electrical noise. This noise may either
enter the equipment by radiation (through the air) or conduction (through
attached cables).
The WESTRACE housings provide protection against radiated interference

and the WESTRACE PFMs provide protection against conducted
interference. This protection will be maximised when: 5
a) The earthing and bonding practices defined in the previous section are
fully applied;
b) All wiring into and out of WESTRACE is kept as short as possible;
c) All input and output wiring is run in symmetrical pairs. For example,
communications bearers should be run as one pair of a quad and
parallel inputs and outputs should be run as adjacent conductors in
signalling cables. These pairs should also be kept in the same ducting
in any case wiring;
d) Primary surge protection (see section 5.3.1) should be used on cables

that are run outside any location or building;
e) All wiring should be run to minimise the possibility of pickup of noise

from adjacent cables. This requires the separation of those cable that
may be particularly noisy from cables connected to WESTRACE. In
particular, earths from surge arresters should be taken directly to the
earth star point both incoming cables and the earth cable should not be
run parallel to the WESTRACE side of the arresters.

5.2.2 Security of Input and Output Wiring

SAFETY
The guidelines for security of input and output wiring detailed in this
section must be followed.
WARNING
All vital wiring to WESTRACE must be performed and maintained according

to the Rail Authority requirements applicable to interlockings. This includes
the grade of insulation, the installation, checking, testing and inspection
procedures.
System Design should minimise the possibility of connection of an incorrect

wiring loom to a WESTRACE PFM connector. The following rules must be
applied:
a) All wiring for each PFM connector must be loomed into an individual
cable. The set of looms to any equipment housing should prevent or
restrict connection to an incorrect PFM;
b) Each wiring loom must be clearly labelled to identify the PFM that it
connects to;
c) All stranded cables should be crimped so that conductors and

insulation are securely gripped. Klippon bootlace Ferrules are
recommended;
d) Each cable plug must be clearly labelled to identify polarity (can be

keyed) and its matching socket on the PFM;
e) Each PFM socket must be clearly labelled to identify polarity and its
matching plug on the cable loom;
f) The cable loom to a particular PFM socket must be suitably attached to

the housing rail above the socket or formed through its own discrete
opening in a cable duct.
5-6 Invensys Rail

5.2.3 Screened Cable

Use of screened cable is recommended for RS232-C level signals. The
screening extends the WESTRACE shield to the whole of the cable and
reduces radiated interference from noise in adjacent conductors. Cable
screening should be terminated at the WESTRACE housing earth.
Cable screens are normally only earthed at the WESTRACE end (as shown in
figure 5.4) as it is possible to induce currents between different earth
potentials that can be coupled into the conductors. This method should be
used unless problems are found.
However, in some instances where common earth points are used, improved
shielding can be obtained by earthing the screen at both ends (as shown in
figure 5.5). It should only be used where problems are associated with single
point earthing of the screen.
Figure 5.4 A—Shielded Cable Earthed a One End
Figure 5.5 B—Shielded Cable Earthed at Both Ends

5.3 Surge Protection

External primary surge protection may be necessary on WESTRACE inputs
and outputs that extend beyond the location case or relay room.
Each WESTRACE system uses PFM modules on all inputs and outputs. These
modules perform the dual functions of protection of the input circuitry from
low energy transient voltages and filtering high frequency electrical
interference.
The PFM modules use a Tranzorb rated at 1.5 J maximum energy dissipation.
These turn on very rapidly (within 1.5 ps) to shunt voltages that exceed their
clamping level, thereby protecting the WESTRACE modules.
An attempt to clamp a high energy electrical transients that exceeds the

power rating of the Tranzorbs may cause them to a short circuit. A continued
application of fault current could later lead to an open circuit in the Tranzorb
or PCB tracks. This could allow subsequent damage to the WESTRACE
modules and put the equipment out of service.
Primary protection should be used where there is possibility of exceeding the

energy rating of these devices. A guideline is that any cable runs more than
200m outside the location case or relay room should be fitted with primary
surge protection. The cable runs, inductive nature of the load, likelihood of
lightening strikes, electrification, and performance history should all be
considered when assessing the need. It is always safer to fit a surge arrester
where there is any doubt.
Primary protection is normally slower to start operating than the Tranzorbs on

the PFMs. It should be designed so that the clamp voltage, once fired, limits
the power dissipation within PFMs to acceptable levels.
5.3.1 Selection of Primary Surge Protection

Invensys Rail can supply primary surge protection matched to the WESTRACE
inputs and outputs. For details of these devices refer to section 4.13.
It is important that no dormant fault can lead to lines being shorted together
with the resultant, unintended energisation of inputs or outputs. This requires
an unbalanced approach as shown in figure 5.6.
Balance surge protection, with protection devices to earth on both lines must
not be used.
5-8 Invensys Rail

Figure 5.6 Surge Arresters—Correct Connection of
The Surge Arrester is comprised of a single printed circuit board which is

used to produce the four variations. There are two voltage versions, each with
a left and right hand variant (see section 4.13):
• 50 Vdc Left & Right Side Entry Versions for VPIM50 and VROM50;
• 110 Vac Left & Right Side Versions for VLOM110. 5
The configuration of the Surge Arrester involves the correct wiring of the unit
depending on the choice of left or right side application. The installation of
the left and right Side Entry variations are shown in figure 5.7.
Figure 5.7 Surge Arresters—Wiring to
5.3.2 Location of Surge Arresters

Any surge arresters shall be mounted as close as is practical to the earth
terminal, or bus bar, such as to minimise the length of earth conductor.
Equipment and cabling shall be arranged such as to minimise the distance

between the point of entry into a location of a circuit requiring the use of an
arrester, and the arrester.
Where it is impractical to mount arresters close to the point of entry of a cable,

the cable shall be routed within a location such that it does not run parallel
and in close proximity to any cable not requiring the use of an arrester. Also
the incoming cable shall be routed such that it does not run parallel to, or in
close proximity to, its continuation after the connection to the arrester.
Correct and incorrect cable runs are illustrated in figure 5.8.

Figure 5.8 Surge Arresters—Cable Runs to
5.3.3 Earthing of Surge Arresters

SAFETY
The guidelines for earthing of surge arresters detailed in this section must
be followed.
WARNING
Surge arresters must be solidly earthed to the system star earth point. A
separate cable must be run from the arresters to the earth point. The earth
cable should not be run adjacent to any post protected inputs or outputs.
5.3.4 PSU Protection

Use an appropriate filter before the WESTRACE PSU for further protection. (A
typical installation would require a Shaffner filter FN685-16/03, however,
power supplies and system requirements vary.)
5-10 Invensys Rail

5.4 Lightning and Surge Protection
5.4 Lightning and Surge Protection

Additional protection is required for WESTRACE equipment in lightning-
prone locations. For high-lightning areas, provide:
• an isolating transformer fitted with earth screens;
• CRITEC MT-U (or equivalent) surge arrester between the incoming supply
and power distribution rack (see figure 5.9).
Figure 5.9 High Lightning Areas—Recommended Isolating Transformer and Surge

Arrester

5.5 Environmental Precautions
5.5.1 Electrostatic Sensitive Devices (ESSD)

SAFETY
The guidelines for handling of electrostatic sensitive devices detailed in
this section must be followed.
WARNING
WESTRACE Modules contain devices which are sensitive to static electricity—

ESSD.
An electrostatic sensitive device (ESSD) is an electronic component which

may be damaged, or degraded by exposure to static electricity. All
components are static sensitive to some extent; MOS and CMOS devices are
particularly susceptible, because of their high input impedance.
Damage may occur at voltages of as little as 70 V. Static electricity voltages of

10 kV and greater are typical. While we associate static transfer with an
observable and painful arc, this only occurs at high voltages. Most of the time
we are completely unaware of static and its transfer and are unaware that we
may be causing damage to ESSDs.
Static electricity is generated by normal movement, for instance by walking

across a synthetic carpet, or by sitting on a chair.
Damage caused by static usually degrades a component, leading to partial

operation or reduced life expectancy. Sometimes static will cause an
apparently temporary malfunction and in extreme cases, total irreversible
failure. However, it is the ‘hidden’ effect, the latent degradation, which is most
serious.
The possibility of failures due to static damage must be eliminated, because

degradation of system reliability reduces system safety.
The minimum precautions to protect WESTRACE equipment against damage

from static electricity are:
a) Turn off the 24 V WESTRACE supply before any work is performed on

the system;
b) Use a conductive wrist strap that is connected to the housing earth

point;
c) Store or transport modules in an antistatic bag (if they are not inserted
in a card housing);
d) Use a conductive wrist strap to replace Vital PROM Data or Non-Vital

Configuration PROMs and place the module on a grounded earth mat.
5-12 Invensys Rail

5.5.2 Mobile Phones and Portable Transceivers

Mobile phones and portable transceivers emit an RF signal that may interfere
with electronic equipment.
SAFETY
Mobile phones and portable transceivers must not be operated within 5
metres of WESTRACE equipment.
WARNING
5.5.3 Lithium Batteries

The following modules have lithium batteries installed:
• Diagnostic Modules DM and DM128;
• Network Communication Diagnostic Module (NCDM);
• Non-vital Communications and Diagnostic Module (NVC/DM);
• Diagnostic Logging Module (DLM);
5
• Train Protection Modules (TPMA and TPMB).
Handling Lithium Batteries
Under normal operating conditions, lithium batteries are safe. However the
following should always be observed.
Packaging
Package all modules with batteries in a non-conductive anti-static bag. An
electrically conductive bag may short the battery terminals causing
premature discharge of the battery.
Transport
The carriage of lithium batteries by air is subject to the latest edition of the
International Civil Aviation Organisation (I.C.A.O.) document ‘Technical
Instructions For The Safe Transport of Dangerous Goods by Air’ 9248-
AN/905.
Damage
The electrolyte lithium batteries contain is highly corrosive. If a battery is
damaged:
• ensure unnecessary personnel do not enter the affected area
• ventilate the immediate area
• avoid contact with any liquid or internal components by wearing the
appropriate safety equipment
• thoroughly wash the affected area with clean water and allow to dry.

Any electronic modules that may have been in contact with the electrolyte
should be packaged with an appropriate safety warning and be returned to
Invensys Rail Systems for inspection.
Disposal
Dispose of the battery according to any local regulations.
Do not:
• short the terminals together
• attempt to recharge
• crush
• disassemble
• incinerate or heat above 100°C (212°F)
• attempt to solder the cell.
5-14 Invensys Rail

Chapter 6: Testing and Commissioning
6.1 Testing Precautions
6. TESTING AND COMMISSIONING

SAFETY The WESTRACE Vital signalling system is used to control the safe
movement of trains and any installation of which it forms a part must be
subjected to the same checks and tests as would be applied to any Vital
WARNING Signalling System.
This chapter describes the additional tests required to ensure the safe
application of WESTRACE equipment.
It assumes that the modules and housing assemblies that form the system
have previously been tested and proved. This chapter describes only the
requirements applicable to fully assembled systems.
All WESTRACE systems must be fully tested prior to being placed in service.
Tests should be performed using the actual hardware and application data
that is intended to be included in the final configuration.
6
6.1 Testing Precautions
Note: WESTRACE modules can be damaged by wrong connections or high

voltages. Switch off the power supply and verify all connections and
power supply voltages before plugging in modules.
Do not apply high voltages during testing (such as by meggering or hypot) to:
• modules;
• input and output cables to items such as signals, points, or track circuits,
when connected to WESTRACE PFMs.
WESTRACE modules contain electrostatic sensitive devices (ESSDs).
Observe antistatic precautions when handling WESTRACE modules. Refer to

section 5.5.1 for precautions to be taken.
6.2 Test Records

Keep formal records of all checks and tests performed on any WESTRACE
system and its associated equipment.
The test records should be made on any specific test documentation

supplied or in a log book.

6.3 Simulation
6.3 Simulation
Newly-designed or modified railway signal logic should be tested before it is
used in service to reduce interruptions which are costly and annoying to
customers.
Use the WESTRACE simulation tools (GSIM and ISIM) to validate railway
signal logic before installation.
6.3.1 GSIM
The WESTRACE Graphical Simulator is a PC tool used for office simulation of
WESTRACE. It enables Railway Signal Engineers to test WESTRACE
installation logic by providing a graphic on-screen computer simulation of
railway signalling systems interacting with a simulation of field equipment.
GSIM4 can simulate the non-vital logic on the NCDM and NVC/DM.
See reference [GSIM] for more information.
6.3.2 ISIM
The WESTRACE Interlocking Simulator is a PC tool for testing WESTRACE
application data for railway signal interlockings in the office in real time.
Specifically it enables a Principle Test Engineer to test WESTRACE vital logic
and Interlogic non-vital logic prior to installation in the field.
See reference [ISIM] for more information.
6-2 Invensys Rail

6.4 Pre-Test Checks
6.4 Pre-Test Checks
6.4.1 Earthing and Bonding

SAFETY
All metalwork must be bonded and earthed in accordance with section 5.1.
WARNING
6.4.2 External Wiring

Check all wiring to ensure that it is in accordance with the approved design
and also for integrity of the insulation (Bell or Megger testing).
6.4.3 Power Supplies

Check all external power supplies to ensure that the voltage is within limits
and that the polarity is correct prior to connection to the system.
6.4.4 External Loads 6

Check all external loads that are to be connected to the system ensure that
they comply with the output specifications of the particular WESTRACE
module to which they are connected.
6.4.5 Module Checks

Perform the following checks prior to the installation of modules into a card
frame. Use the appropriate System documentation as a reference:
• Each module is the correct type (such as input or output, voltage, flashing
or steady);
• Each module is the correct issue;
• Each module is correctly configured.
The module should further be checked for debris and loose components and
then be installed in the correct slot in the system card frame.
6.4.6 System Address

Check the System Address, set in the links on the UHVBC, HVBC or VBC, to
ensure that they correspond with the details provided on the approved
Installation Assembly printout.
6.4.7 Application Data Version

Check the version of the Application Data installed in the system (on EPROM)
to ensure that it corresponds with the approved Installation Data.
Also check the setting of the switches that set the version number.
Appropriate references are listed in section 6.4.8.

6.4 Pre-Test Checks
6.4.8 Module Configuration

The WESTRACE System comprises some modules which must be configured
before being plugged into the system and powered up.
The setting of switches and links to configure modules is fully described for
each module type in Appendix A.
Refer to the following for further information:
Vital Logic Module (VLM6) page A-2

Hot Standby Vital Logic Module (HVLM) page A-33
Network Communications Diagnostic Module (NCDM) page A-89
Non-vital Communications and Diagnostic Module (NVC/DM) page A-121
Non-vital Communications Module (NVC) page A-147
Diagnostic Module (DM) page A-155
Diagnostic Module 128 (DM128) page A-160
6-4 Invensys Rail

6.5 System Testing
6.5 System Testing

SAFETY
The tests detailed in this section must be carried out and the and results
recorded to provide evidence that the System meets safe installation
standards.
WARNING
6.5.1 General
Connect a computer(s) running a diagnostic tool to the Diagnostic Module
during testing to:
• record the results of tests, and;
• monitor the inputs, outputs, timers and internal latches.
MoviolaW is the recommended diagnostic tool for VLM6, VLM5 and HVLM-
based WESTRACE systems. See [MOV] for details.
6.5.2 Application Logic

It is essential that the application logic is tested sufficiently to ensure that for
6
any combination of inputs, only the intended outputs are generated.
Perform this testing in simulation by using:

• the ISIM interlocking simulator (for VLM6, VLM5 and HVLM), see [ISIM];
• the GSIM graphics simulator for VLM6, VLM5 or HVLM-based systems, see
[GSIM];
• the CSS Simulator for VLM-based systems, see [CSS].
For VLM-based systems, the application logic will have been functionally
tested, checked, and approved, as described in the Configuration System
Manual. In addition, Invensys Rail recommends that a sample test is
undertaken, particularly where external equipment timing may be a factor.
6.5.3 Tests
Perform the following:
• Check that the system initiates correctly on power-up.
• Verify that the installed Application Data is correct.
• Ensure that the OPCR energises and that VSEV is generated.
• Check voltage and polarity of VSEV on serial modules.
• Check the operation of the Diagnostic Module.
• Check the correct operation of all assigned inputs and outputs using a
meter to monitor the voltage and the computer(s) connected to the
Diagnostic Module to check the current Input/Output state.
• Check that vital serial connections are operating correctly.
• Check that non-vital serial connections are operating correctly.

6.6 Functional and Factory Testing
6.6 Functional and Factory Testing

It is preferable that as much of a system as possible is tested in the factory
before dispatch to site.
Forward all test results recorded during any off site testing to the installation
site with the equipment.
Perform the pre-test checks detailed in section 6.4 prior to factory testing.
Perform the tests detailed in section 6.5 during Factory Testing.
Use simulators to test the application data [GSIM], [ISIM], [CSS].
6-6 Invensys Rail

6.7 Site Testing
6.7 Site Testing

SAFETY
It is essential that the system is fully tested before being placed in
service. Any testing which could not be performed off site must be
carried out on the installed equipment on site.
WARNING
As an example, site testing will include:

• through testing;
• proving of parallel inputs;
• testing interfaces to existing equipment;
• check of filament proving;
• verification of non-vital control and indications;
• checking that no system timing problems exist;
• checking of alarms, vital and non-vital.
Perform the pre-test checks detailed in section 6.4 prior to any Site Testing.
Test on site any application logic not tested by simulation. Functional testing
6
of the application logic can be performed using the object equipment in a
manner similar to that which would be used to test relay based interlockings.
6.7.1 Purpose
The purpose of on-site testing is to:
• verify that all on-site work has been carried out correctly and that the
complete system functions correctly;
• to obtain the ‘checksum’ for the current version of the data.
The ICS or CCSS is also used to check that the installed VLE contains the same
Application Logic as was originally designed, approved and tested.
6.7.2 Records
It is mandatory that formal records of the on-site CCSS or ICS checks are kept.

6.8 Commissioning
6.8 Commissioning
Ensure that any test equipment does not adversely affect the safe operation
of the system and all test equipment is formally removed before the system is
put to use.
Where it has not been possible to connect and test functions prior to
commissioning, then these must be tested during commissioning.
It should be noted that if deficiencies are discovered in controls or

interlocking during commissioning, then all functions affected must be
considered as defective and dealt with accordingly.
6.9 Stageworks
Where stageworks are to be implemented, it is essential that all rules
specified above for Testing and Commissioning are fully complied with.
6-8 Invensys Rail

APPENDIX A: MODULE DESCRIPTIONS
This appendix describes:

• characteristics;
• function;
• operation;
• configuration, and;
• external connections;
of each WESTRACE module.
WESTRACE MkI Application Manual Issue 11.0 A-1

A.1 Vital Logic Module (VLM6)

All WESTRACE systems have a Vital Logic Module as its processing core. The
VLM6 is one of the Vital Logic Module types in service.
A WESTRACE Hot Standby system comprises a pair of fully duplicated

installations in a symmetrical arrangement, such that one installation is in ‘on-
line’ mode (in control of the railway), whilst the other is in ‘standby’ mode.
Each installation has an VLM6 at the processing core and the service provided
by a particular installation is determined by setting links on a backplane card.
A.1.1 VLM6 Description

The VLM6 comprises two printed circuit boards:
• VLC6 (Vital Logic Card);
• OPC (Output Power Card).
The individual boards are interconnected by means of the VLE backplane,

and also by a Universal Hot Standby Vital Backplane Card (UHVBC). Links on
this card (CONF1 and CONF2) determine the service provided by the
particular WESTRACE installation as described in section A.1.2.3.
A VLM6 occupies slots 2 to 3 in housing 1 of a WESTRACE installation. The

OPC is in Slot 2 and the VLC6 is in Slot 3. Slot 1 in housing 1 must have a
Blanker card inserted.
A.1.1.1 VLM6 Vital Logic Card (VLC6) Description

The VLC6 is the system's central processing module. It controls
communications between the system modules and performs all Application
Logic processing to determine the current state of all vital and non-vital
outputs.
The VLC6 contains in PROM the Configuration Element Data (CED)

generated by the GCSS. It has configuration data version switches (SW1) that
it uses to ensure the CED in PROM is the correct version.
A-2 Invensys Rail

IC5 IC6
CED Code
High High
Byte Byte
PROM PROM VLE
Backplane
IC20 IC21
Connector
CED Code
Low Low
Byte Byte
PROM PROM
SW1
UHVBC
ON
1
ON Connector
2
ON
3
ON
4
ON
5
OFF
6
ON
7
ON
8
OFF ON
Figure A.1 VLC6—Layout—VLM6

A
A.1.1.2 VLM6 Output Power Card (OPC) Description
The OPC produces power to drive the OPCR and VSEV. The VSEV enables
outputs for the vital communications modules and the OPC isolates power
from both of these outputs when safe operation of the system cannot be
guaranteed.

Description
The UHVBC is a small, half height, printed circuit board installed directly
behind the lower connectors of the VLM.
It provides:
• a direct connection between the OPC and VLC cards (HVLC, VLC5 or
VLC6), that constitute the VLM;
• 24 links (LK 1 to LK 24, see figure A.2) that determine the unique physical
address of the WESTRACE installation. The setting of these links is
checked against the data contained in the Application Data PROMS,
thereby preventing installation and execution of an incorrect version of
application data;
• 2 links (CONF1 & CONF2, see figure A.2 and table A.2) that determine the
operation of the VLM. The setting of these links determines whether the
VLM is operating in Stand-alone or Hot Standby mode. If it is in Hot
Standby Mode they are also determine whether it is the default On Line or
Standby system;
• 2 links (LK 25 and LK 26, see figures A.2 and A.3, and table A.2) provide
VSEV voltage to the VLC when these links are made.

Caution: Links LK 25 and LK 26 must be open if the UHVBC is used with an HVLC
or VLC5, otherwise the VSEV voltage may be shorted to ground.
Figure A.2 UHVBC—Rear Side View—VLM6
Note: CONF1 and CONF2 in figure A.2 correspond to J25 and J26 on the GCSS
Installation Report (figure A.3).
A-4 Invensys Rail

A.1.2 VLM6 Configuration
A.1.2.1 VLM6 Vital Logic Card (VLC6) Configuration

The CED is contained in two PROMs, a high byte and a low byte (see
figure A.1). The low byte PROM is in socket IC20 and the high byte PROM is
in socket IC5.
The settings for switch SW1 are provided on the Installation Report
generated by GCSS from the Application Data. Figure A.3 shows an example
for Installation Reports generated in GCSS 6 and GCSS 7.
VLM6 PROMs are of the EEPROM type.
VLM6 PROM Configurations
There are three possible VLM6 PROM configurations:

• DIL (dual-in-line)—fitted to early VLM6 boards
• square PLCC (plastic leaded chip carrier)—fitted to later VLM6 boards
• VLM6 boards fitted with PLCC-to-DIL adapters, to take PLCC PROMs
Early configuration, now obsolete

(DIL PROMs)
DIL PROM A
Hybrid configuration
(PLCC PROMs in adapters)
PLCC PROM
PLCC-to-DIL adapter
Figure 0.1 VLM6 PROM Configurations

GCSS 6 Installation Report Set LK1–LK24 on card as

shown by J01–J24 on report
SW1
J25 = CONF1
J26 = CONF2 ON
1
ON
2
ON
3
ON
4
ON
5
OFF
6
ON
7
8 ON
OFF ON
GCSS 7 Installation Report
Figure A.3 Typical GCSS Installation Reports and SW1 Settings—VLM6
A-6 Invensys Rail

A.1.2.2 VLM6 Output Power Card (OPC) Configuration

None

Configuration
Links LK1 to LK24 on the card must be set to the physical address of the
system as shown on the GCSS Installation Report (figure A.3).
Links CONF1 and CONF2 must be set to the intended operation of the
system (hot standby or stand-alone) as defined in the application data for the
WESTRACE. See table A.2.
Note: On the GCSS 6 Installation Report, CONF1 and CONF2 correspond to J25
and J26 respectively.
The setting of links LK25 and LK26 must correspond to the intended VLC type
to be used in the installation:
Table A.1 CONF1, CONF2, LK25, LK26—Link Settings
Link Closed Not Closed

CONF1 Biased to On-line Biased to Off-line
CONF2 Stand-alone Hot Standby A
LK251 VLC6 VLC5 and HVLC
1
LK26 ” ”
1. LK25 and LK26 must be open or closed together.
A.1.3 VLM6 Indications
A.1.3.1 VLM6 Vital Logic Card (VLC6) Indications
A.1.3.1.1 Start Up Indications
Diagnostic LEDs display the module type code, shortly followed by a

firmware version code (reflecting the firmware version installed in the
module). Firmware version is displayed for approximately 8 seconds, after
which all diagnostic LEDs extinguish.
A.1.3.1.2 Operation Indications
A single green Watchdog LED and a single yellow Watchdog LED are
provided to indicate the module is operating correctly and to indicate the
mode of operation:
• In On-line mode, the VLC6 flashes the green LED once per cycle, and the
yellow LED to indicate IMB communications.
• In Standby mode, the VLC6 flashes the yellow LED once per cycle.

A.1.3.1.3 Fault Codes
The VLM6 fault codes written to the Fault Diagnostic Latch have the following
meaning during normal operation. Some fault codes have different meanings
during power-on initialisation and these have been explicitly declared.
The term ‘Initialisation’ refers to VLM6 Initialisation. Some VLM6 fault codes
are used only in the VLM6 Standby Mode, and some, only in the VLM6 On-
line Mode. These codes have been explicitly declared.
Module Sequence Numbers
In order for the module sequence numbers in the GCSS housing printout to
match the module sequence numbers in the VLM6 fault codes, it is necessary
for the GCSS user to assign sequence number 1 to the NCDM.
Block Fault Codes

Table A.2 Fault Codes—Block—VLM6
CODE(H) FAULT DESCRIPTION ACTION

01 Second Negation Error Indicates fault on other modules
03 PROM Checksum Error Replace VLM6
04 Stack Guard Error ”
05 RAM Error ”
06 Interrupt Errors ”
07 Termination Error ”
08 Processor Error ”
09 Stack Error ”
0A Run Time Error A ”
0B Run Time Error B ”
0C Run Time Error C ”
0D Run Time Error D ”
0E Run Time Error E ”
0F Run Time Error F ”
10 Run Time Error G ”
11 Run Time Error H ”
12 Run Time Error I ”
13 Run Time Error J ”
14 Run Time Error K ”
15 Run Time Error L ”
16 Run Time Error M ”
17 Run Time Error N ”
18 Run Time Error O ”
19 Run Time Error P ”
1A Run Time Error Q ”
A-8 Invensys Rail

Table A.2 Fault Codes—Block—VLM6 (Continued)

1B Run Time Error R ”
1C Run Time Error S ”
1D Run Time Error T ”
1E Run Time Error U ”
1F Run Time Error V ”
20 Run Time Error W ”
21 Run Time Error X ”
22 Run Time Error Y ”
23 Run Time Error Z Replace VLM6
2D Health Monitoring Time Error Indicates fault on other modules
2E Health Monitoring Health Error ”
2F Health Monitoring Scheduling Error Replace VLM6
31 Master IMB Startup Timeout ”
32 Too Few IMB Calls ”
33 Master IMB Interface Error ”

Too Many IMB Calls
34 Error code with system shutdown is the result of the

invalid number of self test calls error
STIMBTooFewSTCalls.
Replace VLM6 if shutdown occurred.
Replace diagnostic module if shutdown did not
A
occur.
Error code without system shutdown indicates IMB
timeout of the non-vital diagnostic module.
IMB Database Error
35 Master IMB Timeout Module 01 Check other modules to identify one that caused
VLM shutdown—ie reported a failure other than
IMB timeout. Replace the identified module.
36 Master IMB Timeout Module 02 ”
3A Master IMB Timeout Module 06 ”
3B Master IMB Timeout Module 07 ”
3C Master IMB Timeout Module 08 ”
3D Master IMB Timeout Module 09 ”
3E Master IMB Timeout Module 10 ”
3F Master IMB Timeout Module 11 ”


5A Master IMB Data Error Module DM Replace diagnostic module
5B Master IMB Data Error Module 01 Replace module 01
5C Master IMB Data Error Module 02 Replace module 02
5D Master IMB Data Error Module 03 Replace module 03
5E Master IMB Data Error Module 04 Replace module 04
5F Master IMB Data Error Module 05 Replace module 05
60 Master IMB Data Error Module 06 Replace module 06
6A Master IMB Data Error Module 16 Replace module 16
A-10 Invensys Rail


7B Master IMB Data Error Module 33 Replace module 33 A


Specific VLM6 Initialisation Fault Codes

Table A.3 Fault Codes—Specific Initialisation—VLM6

80 CED Checksum Error Replace CED PROM
81 CED GCSS Compatibility Index Error ”
82 CED UHVBC Link Error Check installation address and UHVBC linking
83 CED UHVBC Link Parity Error ”
84 CED Data Version Error Check data version switch settings
85 CED Data Error Replace CED PROM
86 IIHCL Data Consistency Error ”
87 CED Number Of Logic States Error ”
88 CED Module Number Error ”
89 CED Slave Kind Error ”
8A CED Module Compatibility Index Error Replace CED PROM
8B CED Module Compatibility Index Parity Error ”
8C CED Module Type Error ”
8D IHCL Message Sequence Error Replace VLM6
8E IHCL Compatibility Index Error ”
8F IHCL Timer Checksum Error ”
90 CED Timer Error Replace CED PROM
91 CED Initial Data Error ”
92 CED Global Data Error ”
93 CED Fixed Data Error ”
94 CED Variable Data Error ”
95 CED Node Type Error ”
96 CED Depth Error ”
97 CED Pointer Error ”
98 IHCL Installation Address Error Check installation address and VBC linking.
99 CED Logic Error Replace CED PROM
9A CED Number of Logic States Error ”
9B CED Number of Timers Error ”
9C Invalid Timer Calculation Error Replace VLM6
9D Invalid Timer Count Error ”
9E OPCR State Error ”
9F Mnemonic Error ”
A0 IMB Data Length Error Indicates fault on another module
A1 Invalid Timer Error Replace VLM6
A-12 Invensys Rail

Table A.3 Fault Codes—Specific Initialisation—VLM6 (Continued)

A2 IMB Communication Time Error Indicates fault on another module
A3 SCC Hardware Error Replace VLM6
A4 IMB Module Number Error Indicates fault on another module
A5 IMB Parity Error ”
A6 CED Initial State Error Replace CED PROM
A7 Sequence Error Replace VLM6
A8 IMB Port Address Range Error Indicates fault on another module
A9 SCC Hardware Error Replace VLM6
AB Sync Period Expired with no IHCL Message Error ”
AC CED Message Byte Number Error Replace CED PROM
AD CED Message Bit Number Error ”
AE IMB Input Message Length Error Indicates fault on another module
AF Invalid System Configuration Data Error Replace VLM6
B0 Consistency Error ”
B1 IHCL GCSS Version Number Error Check data version switch settings
B5 Parameter Error Replace VLM6 A

B6 Output Message Length Error ”
B8 Semaphore Error Indicates fault on DPRAM
BD DPRAM Initialisation Error Replace VLM6
C0 Non-vital Message Error Indicates fault on DPRAM
C1 IMB Number I/O Bits Error Indicates fault on another module
C4 IMB Timeout Error ”
C5 IMB Scheduler Error ”
C6 CED Invalid Data Error Replace CED PROM
C7 CED System Configuration Error ”
C8 CED Layout Error ”
C9 Timer Difference Error Replace VLM6
CA Timer Expiry Difference Error ”
D2 Logic Sequence Error ”
D3 Depth Check Error ”
D4 Sequence Error ”
D5 Sequence Error ”
D6 Progress Error ”
D7 Invalid Data Error ”
D9 IHCL Number of Logic States Error Replace CED ROM


DA Too Many Invalid IHCL Messages Received Error Replace VLM6
DB Last Pointer Error Replace CED ROM
DC OPCR Initialise Error Check supply to OPC. Power off system and restart
after 40 seconds. Replace the OPC or OPC PFM
when the fault persists.
DD NOPCR Error Replace VLM6
DF Initial Maximum Time Error Reduce the number of timers, the logic, or the I/O
capacity of the VLM6. Replace the VLM6 if the
problem persists.
E0 Initial Minimum Time Error Increase the number of timers, the logic, or the I/O
capacity of the VLM6. Replace the VLM6 if the
problem persists.
E1 Initial Sequence Error Replace VLM6
E2 Maximum Time Error ”
E3 Minimum Time Error ”
E4 Sequence Error ”
E6 CED Checksum Error Replace CED PROM
E7 Comp Read Data Error Replace VLM6
E8 Comp Read Pointer Error ”
E9 Comp Write Pointer Error ”
EF CED DRAM Fixed Data Error Replace CED PROM
F0 Number of Timers Error ”
F1 Number of Comp Timers Error ”
F2 Cycle Time > 1.3 sec Error Too much logic and too many modules. Check
installation design.
F3 Delay 150 ms Error Replace VLM6
F4 APPDEL Value Error ”
F6 Time Stamp Error ”
F8 Time Stamp Error ”
FA Time Stamp Error ”
FC CED DPRAM Variable Data Error Replace CED PROM
FD Time Stamp Error Replace VLM6
FE Mode State Error ”
FF PIT Access Error ”
A-14 Invensys Rail

A.1.3.2 VLM6 Output Power Card (OPC) Indications

None

Indications
None.
A.1.4 VLM6 External Connections

All external connections to the VLM6 are made via the HOPC PFM which
plugs directly into the UHVBC. The HOPC PFM External Connector is a 19 way
plug and socket Klippon type BLA/SLA. Figure A.4 shows the external
connection details of the HOPC PFM.
Figure A.4 External Connections—HOPC PFM—VLM6
24 V supply 4A
OPCR Drive 0.8 A
VSEV 1A
See figure 3.6 for IHCL (Inter-HVLM Communications Link) and INCL (Inter-
NCDM Communications Link) fibre-optic connections between hot-standby
WESTRACEs.


VLM5 is one of the Vital Logic Module types in service.

Each installation has an VLM5 at the processing core and the service provided
by a particular installation is determined by setting links on a backplane card.
A.2.1 VLM5 Description

The VLM5 comprises two printed circuit boards:
• VLC5 (Vital Logic Card);

and also by a Hot Standby Vital Backplane Card (HVBC). Links on this card
(CONF1 and CONF2) determine the service provided by the particular
WESTRACE installation.
A VLM5 occupies slots 2 to 3 in housing 1 of a WESTRACE installation. The

OPC is in Slot 2 and the VLC5 is in Slot 3. Slot 1 in housing 1 must have a
A.2.1.1 VLM5 Vital Logic Card (VLC5) Description

The VLC5 is the system's central processing module. It controls
outputs.
The VLC5 contains in PROM the Configuration Element Data (CED)

generated by the GCSS. It has configuration data version switches (SW1) that
it uses to ensure the CED in PROM is the correct version.
A-16 Invensys Rail

IC2 IC3
CED Code
High High
Byte Byte
PROM PROM VLE
Backplane
IC19 IC20
Connector
CED Code
Low Low
Byte Byte
PROM PROM
SW1
HVBC
ON
1
ON Connector
2
ON
3
ON
4
ON
5
OFF
6
ON
7
ON
8
OFF ON
Figure A.5 Layout—VLC5—VLM5

A
A.2.1.2 VLM5 Output Power Card (OPC) Description
guaranteed.
A.2.1.3 VLM5 Hot Standby Vital Backplane Card (HVBC) Description
Note: A UHVBC can also be used provided LK25 and LK26 are not closed. See
sections A.1.1.3 and A.1.2.3 for details.
The HVBC is a small (half height) printed circuit board installed directly
behind the lower connectors of the VLM5.

It provides:
• a direct connection between the OPC and VLC5 cards, that constitute the
VLM5;
• 24 links (LK1 to LK24, see figure A.6) that determine the unique physical
address of the WESTRACE installation. The setting of these links is
checked against the data contained in the Application Data PROMS,
thereby preventing installation and execution of an incorrect version of
application data;
• 2 links (CONF1 and CONF2, see figures A.6 and A.7, and table A.2) that
determine the operation of the VLM5. The setting of these links
determines whether the VLM5 is operating in Stand-alone or Hot Standby
mode. If it is in Hot Standby Mode they are also determine whether it is the
default On Line or Standby system.
Figure A.6 HVBC—Rear Side View—VLM5
Note: CONF1 and CONF2 in figure A.6 correspond to J25 and J26 on the GCSS
Installation Report. See figure A.7.
A-18 Invensys Rail

A.2.2 VLM5 Configuration
A.2.2.1 VLM5 Vital Logic Card (VLC5) Configuration

The CED is contained in two PROMs, a high byte and a low byte (see
figure A.5). The low byte PROM is in socket IC19 and the high byte PROM is
in socket IC2.
generated by GCSS from the Application Data. Figure A.7 shows an example
for installation reports generated in GCSS 6 and GCSS 7.


SW1
J25 = CONF1
J26 = CONF2 ON
1
ON
2
ON
3
ON
4
ON
5
OFF
6
ON
7
8 ON
OFF ON
Figure A.7 Typical GCSS Installation Reports and SW1 Settings—VLM5
A-20 Invensys Rail


None
A.2.2.3 VLM5 Hot Standby Vital Backplane Card (HVBC) Configuration

Links LK1 to LK24 on the card must be set to the physical address of the
system as shown on the GCSS Installation Report (figure A.7).
Links CONF1 and CONF2 must be set to the intended operation of the
system (hot standby or stand-alone) as defined in the application data for the
Table A.4 CONF1, CONF2—Link Settings

CONF2 Stand-alone Hot Standby
A.2.3 VLM5 Indications

A
A.2.3.1 VLM5 Vital Logic Card (VLC5) Indications

A single green Watchdog LED and a single Yellow Watchdog LED are
provided to indicate the module is operating correctly and to indicate the
mode of operation.
In On-line mode, the VLC5 flashes the green LED once per cycle and the
yellow LED around the IMB communications.
In Standby mode, the VLC5 flashes the yellow LED once per cycle.
The VLM5 fault codes written to the Fault Diagnostic Latch have the following
The term ‘Initialisation’ refers to VLM5 Initialisation. Some VLM5 fault codes
are used only in the VLM5 Standby Mode, and some, only in the VLM5 On-

match the module sequence numbers in the VLM5 fault codes, it is necessary
for the GCSS user to assign the highest sequence number to the NVC/DM.
Block Fault Codes

Table A.5 Fault Codes—Block—VLM5

05 RAM Error ”
09 Stack Error ”
23 Run Time Error Z Replace VLM5
A-22 Invensys Rail


2F Health Monitoring Scheduling Error Replace VLM5

Too Many IMB Calls
34 Error code with system shutdown is the result of the Replace VLM5 if shutdown occurred.
invalid number of self test calls error Replace diagnostic module if shutdown did not
STIMBTooFewSTCalls. occur.
Error code without system shutdown indicates IMB
IMB Database Error
3A Master IMB Timeout Module 06 ” A



A-24 Invensys Rail


Specific VLM5 Initialisation Fault Codes

Table A.6 Fault Codes—Specific Initialisation—VLM5

82 CED VBC Link Error Check installation address and VBC linking
83 CED VBC Link Parity Error ”
85
86
CED Data Error
CED Data Error

Replace CED PROM
”
A
87 CED Number Of Logic States Error ”
8A CED Module Compatibility Index Error Replace CED PROM
8D CED Module Compatibility Index Error ”
8E CED Module Compatibility Index Parity Error ”
8F CED Module Type Error ”
90 CED Timer Error ”
99 CED Logic Error ”
9A CED Global Data Error ”
9B CED Fixed Data Error ”


9C CED Variable Data Error ”
9D CED Logic Error ”
9E CED Slave Kind Error ”
A1 IMB Slave Kind Error ”
A2 IMB Communication Time Error ”

IMB Communication Type Error
A4 IMB Module Number Error ”
B8 IMB Module Number Error ”
B9 IMB Module Type Error ”
BA IMB Data Error ”
BB IMB Module Number Error ”
BC IMB Module Type Error ”
BD IMB Message Byte Number Error ”
BE IMB Message Bit Number Error ”
BF IMB Output Message Length Error Indicates fault on another module
C0 IMB Last Pointer Error ”
C1 IMB Number I/O Bits Error ”
C2 IMB Module Number Error ”
C3 IMB Slave Kind Error ”
C6 Invalid Result Replace VLM5
C7 CED System Configuration Error Replace CED PROM
C8 CED Layout Error ”
CF CED System Configuration Error ”
D0 Invalid Result ”
D6 Progress Error Replace VLM5
D9 Module Number Error Replace CED PROM
DA Module Number Error ”
DB Last Pointer Error ”
DF Initial Maximum Time Error Replace VLM5
E0 Initial Minimum Time Error ”
E1 Initial Sequence Error ”
E6 CED Layout Error ”
A-26 Invensys Rail


EA Comp Number Logic States Data Error ”
EB CED Compatibility Index Error Replace CED PROM
EC CED VBC Link Error Check installation address and VBC linking
ED CED Parity Error Replace CED PROM
EE CED Version Error Check data version settings
EF Module Number Error Replace CED PROM
F0 Number of Timers Error Replace VLM5
F3 Delay 150 ms Error ”
F5 CED Slave Kind Error Replace CED PROM
F8 CED Module Type Error Replace CED PROM
F9 CED Module Number Error ”
FA CED Module Type Error ”
FB CED Last Module Pointer Error ”
FC CED Output Message Length Error ”
FD Invalid System Configuration Data Error Replace VLM5
A
Specific VLM5 Standby Mode Fault Codes

Table A.7 Fault Codes—Specific Standby Mode—VLM5

80 IHCL CED Checksum Error Replace CED PROM
81 IHCL Installation Address Error Check installation address and VBC linking
82 IHCL GCSS Version Number Error Check data version switch settings
86 IHCL Data Consistency Error Replace CED PROM
87 IHCL Data Consistency Error ”
88 CED Number of Logic States Error ”
89 CED Initial State Error ”
8A CED Initial State Error ”
8B Sync Period Expired With No IHCL Message Error Replace VLM5
8C Too Many Invalid IHCL Messages Received Error ”
8D Invalid IHCL Message Error ”
8E Compatibility Index Error ”
8F Timer Checksum Error ”
90 Invalid IHCL Message Error ”
91 Compatibility Index Error ”

Table A.7 Fault Codes—Specific Standby Mode—VLM5 (Continued)

92 Timer Checksum Error ”
93 CED Number of Logic States Error Replace CED PROM
94 SCC Hardware Error Replace VLM5
95 SCC Hardware Error Replace VLM5
96 SCC Hardware Error ”
98 Invalid Data Error ”
9F OPCR State Error ”

A7 IMB Module Type Error ”
A8 IMB Port Address Range Error ”
AA IMB Module Number Error ”
AB IMB Module Type Error ”
AC IMB Message Byte Number Error ”
AD IMB Message Bit Number Error ”
AE IMB Input Message Length Error ”
AF IMB Last Pointer Error ”
D2 Logic Sequence Error Replace VLM5
E7 Logic Sequence Error Replace VLM5
E8 Logic Sequence Error ”
F0 Number of Timers Error ”
F1 Number of Comp Timers Error Replace VLM5
A-28 Invensys Rail

Table A.7 Fault Codes—Specific Standby Mode—VLM5 (Continued)

installation design
FE Mode State Error Replace VLM5
Specific VLM5 On-Line Mode Fault Codes

Table A.8 Fault Codes—Specific On-line—VLM5

9A CED Number of Logic States Error Replace CED PROM
9C Invalid Timer Calculation Error Replace VLM5
9D Invalid Timer Count Error ” A


IMB Communications Type Error
AC IMB Message Byte Number Error Indicates fault on another module

Table A.8 Fault Codes—Specific On-line—VLM5 (Continued)

B4 IMB Message Byte Number Error ”
B5 IMB Message Bit Number Error ”
B6 IMB Output Message Length Error ”
B7 IMB Last Pointer Error ”
BF IMB Output Message Length Error ”
C6 Invalid Timer Calculation Error Replace VLM5
C7 Invalid Timer Count Error ”
C8 Invalid Timer Error ”
C9 Timer Difference Error ”
CB Invalid Timer Error ”
CC Timer Difference Error ”
CD Timer Expiry Difference Error ”
CE Timer Data Error Replace VLM5
D6 Progress Error ”
after 40 seconds. Replace OPC or OPC PFM when
fault persists.
DE NOPCR Error ”
A-30 Invensys Rail

Table A.8 Fault Codes—Specific On-line—VLM5 (Continued)

EF CED Module Number Error Replace CED PROM
F0 Number Of Timers Error ”
F1 Number Of Comp Timers Error ”
installation design

None
A
A.2.3.3 VLM5 Hot Standby Vital Backplane Card (HVBC) Configuration
None.
A.2.4 VLM5 External Connections

All external connections to the VLM5 are made via the HOPC PFM which
plugs directly into the HVBC.
The HOPC PFM External Connector is a 19 way plug and socket Klippon type
BLA/SLA.
Figure A.8 depicts the external connection details of the HOPC PFM.

Figure A.8 External Connections—HOPC PFM—VLM5
24 V supply 4A
OPCR Drive 0.8 A
VSEV 1A
A-32 Invensys Rail

A.3 Hot Standby Vital Logic Module (HVLM128)

HVLM128 is one the Vital Logic Module types in service. This section covers
the HVLM128 variant of the module although there are other variants.

Each installation has an HVLM at the processing core and the service
provided by a particular installation is determined by setting links on a
backplane card.
A.3.1 Description
The HVLM comprises two (2) printed circuit boards:
• HVLC (Hot Standby Vital Logic Card);

and also by a Hot Standby Vital Backplane Card (HVBC). Links on this card
(CONF1 and CONF2) determine the service provided by the particular
WESTRACE installation.
An HVLM occupies slots 2 to 3 in housing 1 of a WESTRACE installation. The

A
OPC is in Slot 2 and the HVLC is in Slot 3. Slot 1 in housing 1 must have a
A.3.1.1 Hot Standby Vital Logic Card (HVLC)

The HVLC is the system's central processing module. It controls
outputs.
The HVLC contains in PROMs the Configuration Element Data (CED)

generated by the GCSS. The card has data version configuration switches
(SW1) that it uses to confirm the CED in PROM is the correct version.

VLE
Backplane
Connector
CED CED
Low High
IC26
IC27
Byte Byte
PROM PROM
SW1 HVBC
ON Connector
1
ON
2
ON
3
ON
4
ON
5
6 OFF
ON
7
ON
8
OFF ON
Figure A.9 Layout—HVLC—HVLM
A.3.1.2 Output Power Card (OPC)

guaranteed.
A.3.1.3 Hot Standby Vital Backplane Card (HVBC)
Note: A UHVBC can also be used provided LK25 and LK26 are not closed. See
sections A.1.1.3 and A.1.2.3 for details.
The HVBC is a small, half height, printed circuit board installed directly
behind the lower connectors of the HVLM.
A-34 Invensys Rail

It provides:
• a direct connection between the OPC and HVLC cards, that constitute the
HVLM;
• 24 links (LK1 to LK24) that determine the unique physical address of the
WESTRACE installation. The setting of these links is checked against the
data contained in the Application Data PROMS, thereby preventing
installation and execution of an incorrect version of application data;
• 2 links (CONF1 andCONF2, see figures A.10 and A.11, and table A.12)
that determine the operation of the HVLM. The setting of these links
determines whether the HVLM is operating in Stand-alone or Hot Standby
mode. If it is in Hot Standby Mode they are also determine whether it is the
default On Line or Standby system.
Figure A.10 Rear Side View—HVBC—HVLM
Note: CONF1 and CONF2 in figure A.10 correspond to J25 and J26 on the
GCSS Installation Report (figure A.11).

A.3.2 Configuration

The CED is contained in two PROMs, high byte and low byte (see figure A.9).
The low byte PROM is in socket IC26 and the high byte PROM is in socket
IC27.
generated by GCSS from the Application Data. Figure A.11 shows an
example for Installation Reports generated in GCSS 6 and GCSS 7.
A-36 Invensys Rail


SW1
J25 = CONF1
J26 = CONF2 ON
1
ON
2
ON
3
ON
A
4
ON
5
OFF
6
ON
7
ON
OFF ON 8
Figure A.11 Typical GCSS Installation Reports and SW1 Settings—HVLM128


None

The links LK1 to LK24 must be set to the physical address of the system shown
by J01 to J24 on the GCSS Installation Report. See figure A.11.
Links CONF1 and CONF2 must be set to the intended operation of the system
(hot standby or stand-alone) as defined in the application data for the
Table A.9 CONF1, CONF2—Link Settings

CONF2 Stand-alone Hot Standby
A-38 Invensys Rail

A.3.3 Indications

The module commences flashing the green watchdog LED to indicate the
module is operational and working correctly.
The module flashes the yellow On-Line LED to indicate when it starts
executing application logic.
The HVLM fault codes written to the Fault Diagnostic Latch have the following
The term ‘Initialisation’ refers to HVLM Initialisation. Some HVLM fault codes
are used only in the HLVM Standby Mode, and some, only in the HVLM On-
A
match the module sequence numbers in the HVLM fault codes it is necessary
for the GCSS user to assign the highest sequence number to the NVC/DM.
Block Fault Codes

Table A.10 Fault Codes—Block—HVLM

03 PROM Checksum Error Replace HVLM
05 RAM Error Replace HVLM
09 Stack Error ”

Table A.10 Fault Codes—Block—HVLM (Continued)

23 Run Time Error Z ”
2F Health Monitoring Scheduling Error Replace HVLM
31 Master IMB Startup Timeout Replace HVLM

Too Many IMB Calls
2F Health Monitoring Scheduling Error Replace HVLM

Too Many IMB Calls
34 Error code with system shutdown is the result of the Replace HVLM if shutdown occurred.
invalid number of selftest calls error
STIMBTooFewSTCalls. Replace diagnostic module if shutdown did not
Error code without system shutdown indicates IMB occur.
IMB Database Error
A-40 Invensys Rail


44
45
Master IMB Timeout Module 16

”
”
A


A-42 Invensys Rail

Specific HVLM Initialisation Fault Codes

Table A.11 Fault Codes—Specific Initialisation—HVLM
CODE FAULT DESCRIPTION ACTION

(H)
83 CED VBC Link Parity Error Check installation address and VBC linking
86 CED Data Error ”
87 CED Number Of Logic States Error Replace CED PROM
8A CED Module Compatibility Index Error ”
8F CED Module Type Error ” A

9E CED Slave Kind Error ”

B8 IMB Module Number Error Indicates fault on another module

Table A.11 Fault Codes—Specific Initialisation—HVLM (Continued)

(H)
BC IMB Module Type Error Indicates fault on another module
C6 CED Invalid Data Error Replace CED PROM
C7 CED System Configuration Error ”
CF CED System Configuration Error ”
D0 Invalid Result ”
D6 Progress Error Replace HVLM
D9 Module Number Error
DA Module Number Error
DB Last Pointer Error
DF Initial Maximum Time Error Replace HVLM
E1 Initial Sequence Error ”
E7 Comp Read Data Error Replace HVLM
EB CED Compatibility Index Error Replace CED PROM
EC CED VBC Link Error Check installation address and VBC linking
ED CED Parity Error Replace CED PROM
EE CED Version Error Check data version settings
EF Module Number Error
F0 Number of Timers Error Replace HVLM
F3 Delay 150 ms Error ”
F5 CED Slave Kind Error Replace CED PROM

Initial Progress Error Replace HVLM
A-44 Invensys Rail

Table A.11 Fault Codes—Specific Initialisation—HVLM (Continued)

(H)
FD Invalid System Configuration Data Error Replace HVLM
Specific HVLM Standby Mode Fault Codes

Table A.12 Fault Code—Specific Standby Mode—HVLM

85 IHCL GCSS Version Number Error Check data version switch settings A
86 IHCL Data Consistency Error Replace CED PROM
87 IHCL Data Consistency Error ”
88 CED Number of Logic States Error ”
89 CED Initial State Error ”
8A CED Initial State Error ”
8B Sync Period Expired With No IHCL Message Error Replace HVLM
8C Too Many Invalid IHCL Messages Received Error ”
8D Invalid IHCL Message Error ”
8E Compatibility Index Error ”
8F Timer Checksum Error ”
90 Invalid IHCL Message Error Replace HVLM
91 Compatibility Index Error ”
92 Timer Checksum Error ”
93 CED Number of Logic States Error Replace CED PROM
94 SCC Hardware Error Replace HVLM

Table A.12 Fault Code—Specific Standby Mode—HVLM (Continued)


D2 Logic Sequence Error Replace HVLM
E4 Sequence Error Replace HVLM
E7 Logic Sequence Error Replace HVLM
E8 Logic Sequence Error ”
F0 Number of Timers Error Replace HVLM
F2 Cycle Time > 1 sec Error Too much logic and too many modules—check
installation design
F3 Delay 150 ms Error Replace HVLM
FE Mode State Error Replace HVLM
A-46 Invensys Rail

Specific HVLM On-Line Mode Fault Codes

Table A.13 Fault Codes—Specific On-line Mode—HVLM

9A CED Number of Logic States Error Replace CED PROM
9C Invalid Timer Calculation Error Replace HVLM
9D Invalid Timer Count Error ”

IMB Communications Type Error
A7 IMB Module Type Error Indicates fault on another module
A9 IMB Parity Error ” A

AB IMB Module Type Error Indicates fault on another module
B5 IMB Message Bit Number Error ”
B6 IMB Input Message Length Error ”

Table A.13 Fault Codes—Specific On-line Mode—HVLM (Continued)

C6 Invalid Timer Calculation Error Replace HVLM
C7 Invalid Timer Count Error ”
C8 Invalid Timer Error ”
C9 Timer Difference Error Replace HVLM
CD Timer Expiry Difference Error Replace HVLM
CE Timer Data Error ”
D6 CED Invalid Data Error Replace CED PROM

Progress Error Replace HVLM
D8 Invalid Data Error Replace HVLM
after 40 seconds. If fault persists replace OPC or
OPC PFM
DD NOPCR Error Replace HVLM
DF NOPCR Error ”
E7 Comp Read Data Error Replace HVLM
EF CED Module Number Error Replace CED PROM
F1 Number Of Comp Timers Error ”
F2 Cycle Time > 1 sec Error Too much logic and too many modules—check
installation design
A-48 Invensys Rail

Table A.13 Fault Codes—Specific On-line Mode—HVLM (Continued)

F3 Delay 150 ms Error Replace HVLM
F6 APPDEL Progress Error ”
F7 Normal Progress Error ”
FE Mode State Error Replace HVLM

None

None.

A.3.4 External Connections

All external connections to the HVLM are made via the HOPC PFM which
plugs directly into the HVBC.
The HOPC PFM External Connector is a 19 way plug and socket Klippon type
BLA/SLA.
Figure A.12 depicts the external connection details of the HOPC PFM.
Figure A.12 External Connections—HOPC PFM—HVLM
24 V supply 4A
OPCR Drive 0.8 A
VSEV 1A
A-50 Invensys Rail


VLM1 is one the Vital Logic Module types in service.
A.4.1 Description
The VLM1 comprises three (3) printed circuit boards:
• VLC (Vital Logic Card);
• CEC (Configuration Element Card);
These boards are interconnected by means of the VLE backplane, and also
by a Vital Backplane Card (VBC).
A VLM1 occupies slots 1 to 3 in housing 1 of a WESTRACE system. The OPC

is in Slot 1, the CEC is in Slot 2 and the VLC is in Slot 3.
A.4.1.1 Vital Logic Card (VLC)

The VLC is the system's central processing module. It controls
outputs. A
A.4.1.2 Configuration Element Card (CEC)
The CEC contains in PROMs the Application Data generated by the CS. It has
configuration version switches (SW1) which the VLC uses to ensure
Configuration Application Data in PROM is the correct version.
VLE
Backplane
Connector
CED CED
High Low
U1
U2
Byte Byte
PROM PROM
SW1
ON VBC
1
ON
Connector
2
ON
3
ON
4
ON
5
OFF
6
ON
7
ON
8
OFF ON
Figure A.13 Layout—CEC—VLM1


guaranteed.
A.4.1.4 Vital Backplane Card (VBC)

The VBC is a small, half height printed circuit board installed directly behind
the lower connectors of the VLM1.
The VBC provides:

• a direct connection between the OPC, CEC and VLC cards, which
constitute the VLM1;
• 24 links (LK1 to LK24) which determine the unique physical address of the
WESTRACE installation. The setting of these links is checked against the
data contained in the Application Data PROMS, thereby preventing
installation and execution of the wrong Application Data.
Figure A.14 General Arrangement from Rear—VBC—VLM1
A-52 Invensys Rail

A.4.2 Configuration

None

The CED is contained in two PROMs, high byte and low byte (see figure A.13).
The high byte PROM is in socket U1 HIGH. The low byte PROM is in socket U2
LOW.
The settings for switch SW1 (figure A.15) are provided on the Installation
Assembly Details Printout generated by the CS from the Application Data.
SW1
ON
1
ON
2
ON
3
ON
4
ON
5
OFF
6
ON
7
ON
A
8
OFF ON
Figure A.15 Example SW1 Settings—CEC—VLM1

None

Details of the setting of the links LK1 to LK24 (see figure A.14) must
correspond to the physical address of the system in the Application Data
printout.
A.4.3 Indications

The module commences flashing the green watchdog LED to indicate the


Table A.14 Fault Codes—VLM1

00 No Fault Not a fault
05 RAM Error ”
06 Interrupt Error ”
09 Stack Error ”
22 Run Time Error Y Replace VLM1
2F Health Monitoring Scheduling Error ”
A-54 Invensys Rail

Table A.14 Fault Codes—VLM1 (Continued)

34 Master IMB Timeout Module DM Replace the DM module
42
43

”
”
A


5A Master IMB Data Error Module DM Replace DM module
5B Master IMB Data Error Module 01 Replace Module 01
5C Master IMB Data Error Module 02 Replace Module 02
5D Master IMB Data Error Module 03 Replace Module 03
5E Master IMB Data Error Module 04 Replace Module 04
5F Master IMB Data Error Module 05 Replace Module 05
60 Master IMB Data Error Module 06 Replace Module 06
6A Master IMB Data Error Module 16 Replace Module 16
7A Master IMB Data Error Module 32 Replace Module 32
81 CED CSS Compatibility Index Error ”
A-56 Invensys Rail


83 CED Parity Error ”
86 CED Data Error ”
87 CED No Logic States Error ”
8A CED Module Compatibility Index Error ”
8F CED Module Type Error ”
A
93 CED Fixed Data Error Replace CED PROM
9E CED Backplane Address Error ”
9F CED Mnemonic Error ”
A0 IMB Data Length Error Indicates fault on other modules.


B5 IMB Message Bit Number Error Indicates fault on other modules.
B6 IMB Input Message Length Error ”
C8 Invalid Timer Error Replace VLM1
C9 Timer Difference Error ”
CD Timer Expiry Difference Error ”
CE Timer Data Error ”
A-58 Invensys Rail


after 40 seconds. If fault persists replace OPC or
OPC PFM
DE NOPCR Error ”
DF Initial Maximum Time Error ”
E1 Initial Sequence Error Replace VLM1
E9 Comp Write Data Error ”
EA Comp No. Logic States Data Error ”
F1
F2
Number Of Comp Timers Error
Cycle Time > 1 sec Error

”
Too much logic and too many modules—check

A
installation design.
None

None

None.


All external connections to the VLM1 are made via the OPC PFM which has
tails with plugs attached to plug into connectors 4 and 5 on the VBC.
The OPC PFM External Connector is a 15 way plug and socket Klippon type
BLA/SLA.
Figure A.16 depicts the external connection details of the OPC PFM.
Figure A.16 External Connections—OPC PFM—VLM1

24 V supply 4A
OPCR Drive 0.8 A
VSEV 1A
A-60 Invensys Rail

A.5 Vital Lamp Output Modules (VLOM)
A.5.1 Description
The VLOM is the interface between WESTRACE and signalling lamps. VLOM
outputs directly drive signal lamps and other nominated equipment. The
output may be steady, flashing or off.
The VLOM modules with 12 lamp outputs comprise three printed circuit
boards:
• VPIO Digital Board (VPIODB);
• two VLOM Analogue Boards (VLOMAB).
A.5.2 Particulars
The VLOM is available with an ac lamp output voltage of 110V. VLOM
modules have a flashing output (signified with ‘F’) and they are available with
twelve lamp outputs (signified with ‘T’); VLOMFT110.
A.5.3 Characteristics of VLOM 110

Table A.15 Characteristics—VLOM 110
Nominal Signalling Voltage (Vsig Input) 110 Vac A

External Fuse Protection 3.0 A
Vsig Input (min.) 100 Vac
Vsig Input (max) 130 Vac
Lamp proving current levels < 100 mA, lamp off
> 160 mA, lamp on
A maximum of 26 VLOM modules may be installed in any one system. Refer

to the WESTRACE Application Manual for further details.
A.5.4 Function
The VLOM requires an external signalling supply that is switched to source six (or
twelve) voltages to drive up to six (or twelve) signalling lamps simultaneously.
The VPIODB is processor based and is responsible for interfacing with both the
VLM and the VLOMAB(s). It performs the module's self-tests, housekeeping,
monitoring of the analogue card's integrity and Health Monitoring functions.
Lamp Outputs are not isolated from the signalling supply, and use a common
return. The VLOM provides Vital Hot filament proving and non-vital cold
filament detection.
The VLOM will attempt to isolate an incorrectly energised output by

attempting to blow an on-board fuse. If this action is unsuccessful, the VLOM
will initiate second negation (shutdown) without delay.
The fuse blowing process is known as graceful degradation.

A.5.5 Configuration
None
A.5.6 Indications
A.5.6.1 Start Up
Diagnostic LEDs display module type code, shortly followed by a firmware
version code (reflecting the firmware version installed in the module).
Firmware version is displayed for approximately 8 seconds, after which all
diagnostic LEDs will extinguish.
A.5.6.2 Operation
The module will commence flashing the green watchdog LED to indicate the
A.5.6.3 Fault Codes

Table A.16 Fault Codes—VLOM

00 No Fault Not a fault.
01 Second Negation Error Indicates a fault on other modules.
02 Module Type Error Replace VLOM
03 EPROM Checksum Error ”
05 RAM Error ”
09 Stack Error ”
13 Run Time Error J Replace VLOM
A-62 Invensys Rail

Table A.16 Fault Codes—VLOM (Continued)

24 IMB Timeout Error ”
25 IMB Address Error ”
26 IMB Address Parity Error ”
27 IMB CI Transfer Error ”
A
28 IMB Transfer Type Error ”
29 IMB Message Length Error ”
2A IMB True Byte Error ”
2B IMB Check Message Error ”
2C IMB Inconsistency Error ”
2D Health Monitoring Time Error Indicates a fault on other modules
2F Health Monitoring Scheduling Error Replace VLOM
30 Module Type and Fault Code Error ”
31 ST IMB Start Up Timeout ”
32 ST IMB Too Few IMB Calls ”
33 ST IMB Too Many IMB Calls ”
34 ST IMB Too Few ST Calls ”
80 Negation Fail Error Replace VLOM
81 Initialise Program Check Error ”
82 Progress Check Error ”
83 Cycle Time Error ”
84 CPU Speed Error ”
85 Variable Corruption Error ”
8C Gain Check Offset Base Error ”
8D Gain Check Offset Ch 1 Error ”
8E Gain Check Offset Ch 2 Error ”
8F Gain Check Offset Ch 3 Error ”
90 Gain Check Offset Ch 4 Error ”


99 Gain Check Detect Base Error ”
9A Gain Check Detect Ch 1 Error ”
9B Gain Check Detect Ch 2 Error ”
9C Gain Check Detect Ch 3 Error ”
9D Gain Check Detect Ch 4 Error ”
9E Gain Check Detect Ch 5 Error ”
9F Gain Check Detect Ch 6 Error ”
A0 Gain Check Detect Ch 7 Error ”
AA ADC Target Error ”
AB ADC Reference Error ”
BD Diverse Gain Filter Hi Base Error Replace VLOM
BE Diverse Gain Filter Hi Ch 1 Error ”
BF Diverse Gain Filter Hi Ch 2 Error ”
C0 Diverse Gain Filter Hi Ch 3 Error ”
C1H Diverse Gain Filter Hi Ch 4 Error ”
D7 Ground Test Filter Det Base Error ”
D8 Ground Test Filter Det Brd 1 Error Check PFM mating with this module, else Replace
VLOM or PFM
D9 Ground Test Filter Det Brd 2 Error Check PFM mating with this module, else Replace
VLOM or PFM
A-64 Invensys Rail


DA Ground Test Filter Line Base Error Replace VLOM
DB Ground Test Filter Line Brd 1 Error Check PFM mating with this module, else Replace
VLOM or PFM
DC Ground Test Filter Line Brd 2 Error Check PFM mating with this module, else Replace
VLOM or PFM
EA True Decode Parity Error Replace VLOM
EB Comp Decode Parity Error ”
F0 Gain Check Invalid Data ”
FA Ground Test Invalid Data ”
FC Cold Proving Filter Error ”
FD Cold Proving Lamp Error ”


External connections to the VLOM are made via the VLOM PFM.
The VLOM PFM External Connector is a 19 way plug and socket Klippon type
BLA/SLA.
Figure A.17 depicts the external connection details of the VLOM PFM.
Figure A.17 External Connections—VLOM PFM—VLOM
The Return Sense must be connected to the Supply Return Bus Bar. We
recommend that the return sense and supply return be run as a twisted pair.
A-66 Invensys Rail

A.6 Vital Relay Output Modules (VROM)
A.6.1 Description
The VROM directly drives the coils of signalling relays. It is comprised of two
printed circuit boards:
• VPIO Digital Board (VPIODB);
• VROM Analogue Board (VROMAB).
A.6.2 Particulars
The VROM is available with a relay output voltage of 50 Vdc.
A.6.3 Characteristics of VROM 50

Table A.17 Characteristics—VROM 50
Nominal Signalling Supply Voltage1 50 Vdc

Signalling Supply Input (minimum, trough Voltage) 42 Vdc
Signalling Supply Input (maximum, peak Voltage) 60 Vdc
External Fuse Protection 2.5 A
Output Load 3 W nominal per output
18 W max. continuous A
output per module
1. Signalling Supply Voltage Ripple must be semi smooth and within the input load
minimum and maximum shown.
A.6.4 Function
The VROM requires an external signalling supply from which it generates
eight isolated voltage sources to drive up to eight signalling relays
simultaneously.
The VPIODB is processor based and it interfaces with the VLM and the
VROMAB. It performs self-testing, housekeeping, monitoring of the analogue
card's integrity and Health Monitoring functions for the module.
Whenever the VROM detects an incorrectly energised output (according to

the internal state), the module will attempt to isolate the particular output by
blowing an in-line fuse. If this action is unsuccessful, the VROM will initiate
system negation (shutdown) without delay.
The process of fuse blowing is known as graceful degradation.
A.6.5 Configuration
None

A.6.6 Indications
A.6.6.1 Start Up
module). The firmware version is displayed for approximately eight seconds,
after which all diagnostic LEDs will extinguish.
A.6.6.2 Operation
A.6.6.3 Fault Codes

Table A.18 Fault Codes—VROM

01 Second Negation Error Indicates fault on other modules.
02 Module Type Error Replace VROM
05 RAM Error ”
09 Stack Error ”
17 Run Time Error N Replace VROM
A-68 Invensys Rail

Table A.18 Fault Codes—VROM (Continued)

2D Health Monitoring Time Error Indicates a fault on other modules
A
2F Health Monitoring Scheduling Error Replace VROM
8C True IMB Parity Error ”
8D Comp IMB Parity Error ”
8E True Channel Status Base Error ”
8F True Channel Status Ch 1 Error ”
90 True Channel Status Ch 2 Error ”
94 True Channel Status Ch 6 Error Replace VROM
97 Comp Channel Status Base Error ”
98 Comp Channel Status Ch 1 Error ”
99 Comp Channel Status Ch 2 Error ”
9A Comp Channel Status Ch 3 Error ”
9B Comp Channel Status Ch 4 Error ”
9C Comp Channel Status Ch 5 Error ”
9D Comp Channel Status Ch 6 Error ”


9E Comp Channel Status Ch 7 Error ”
9F Comp Channel Status Ch 8 Error ”
A0 ADC Voltage Reference Error ”
A1 ADC Target Failure ”
A2 True Relay Test Base Error ”
A3 True Relay Test Ch 1 Error ”
AA True Relay Test Ch 8 Error ”
AB Comp Relay Test Base Error ”
AC Comp Relay Test Ch 1 Error ”
AD Comp Relay Test Ch 2 Error ”
AE Comp Relay Test Ch 3 Error ”
AF Comp Relay Test Ch 4 Error ”
B0 Comp Relay Test Ch 5 Error ”
B4 U Woggle Test Base Error ”
B5 U Woggle Test Ch 1 Error ”
B6 U Woggle Test Ch 2 Error Replace VROM
BA U Woggle Test Ch 6 Error ”
BB U Woggle Test Ch 7 Error ”
BC U Woggle Test Ch 8 Error ”
BD V Woggle Test Bad Result Error ”
BE V Woggle Test Base Error ”
BF V Woggle Test Ch 1 Error ”
C0 V Woggle Test Ch 2 Error ”
A-70 Invensys Rail


C7 Invalid Comp Sample ”
C8 Invalid Comp Relay State ”
C9 Cycle Time Error ”
CA Invalid Comp Relay State ”
CB Invalid Comp Relay State ”
CC Invalid Comp Relay State ”
CD CPU Speed Error ”
CE Variable Corruption Error ”
CF Init Program Check Error ”
D0 Life Program Check Error ”

The VROM PFM External Connector is a 19 way plug and socket Klippon type
BLA/SLA.
Figure A.18 depicts the external connection details of the VROM PFM.
19 way plug and

socket
Printed Circuit Board A
1 Supply + Feed
2 Supply - Return
3 Not used
4 Relay 1 +
5 Relay 1 -
6 Relay 2 +
7 Relay 2 -
8 Relay 3 +
9 Relay 3 -
10 Relay 4 +
11 Relay 4 - IFeed
Relay 5 + IRtn
12
13 Relay 5 -
14 Relay 6 +
15 Relay 6 -
16 Relay 7 +
17 Relay 7 -
18 Relay 8 +
19 Relay 8 -
Figure A.18 External Connections—VROM PFM—VROM

A.7 Vital Parallel Input Modules (VPIM)
A.7.1 Description
The VPIM is the interface between WESTRACE and signalling inputs such as
point detection and track circuits. VPIM inputs connect directly to external
signalling equipment.
The VPIM module is comprised of two printed circuit boards:

• VPIO Digital Board (VPIODB), and;
• VPIM Analogue Board (VPIMAB).
A.7.2 Particulars
The VPIM is available with an input voltage of 50 Vdc.
A.7.3 Characteristics of VPIM 50

Table A.19 Characteristics—VPIM 50
Nominal Voltage 50 Vdc

De-energised Input Voltage range −100 V to +10.5 V
Energised Input Voltage range 30 V to 100 V
A.7.4 Function
The VPIODB is processor based and it interfaces with the VLM and the
VPIMAB. It performs self-testing, housekeeping, monitoring of the analogue
card's integrity and Health Monitoring functions for the module.
All VPIM inputs have a non-vital filter to permit operation with inputs with high
levels of ac. The VPIM samples the input channels, and rejects any input that
is changing at a rate between 45Hz and 11kHz. All inputs to the VPIM are
filtered to reject fleeting inputs.
Each VPIM input is individually fused to protect the module from over
voltage.
A.7.5 Configuration
None.
A-72 Invensys Rail

A.7.6 Indications
A.7.6.1 Start Up
module). The firmware version is displayed for approximately 8 seconds,
A.7.6.2 Operation
A.7.6.3 Fault Codes

Table A.20 Fault Codes—VPIM

01 Second Negation Error Indicates fault in another module
02 Module Type Error Replace VPIM
04
05
Stack Guard Error
RAM Error
”
”
A
09 Stack Error ”
11 Run Time Error H: ”

Table A.20 Fault Codes—VPIM (Continued)

1B Run Time Error R Replace VPIM
2D Health Monitoring Time Error Indicates fault in another module
2F Health Monitoring Scheduling Error Replace VPIM
B4 Progress Check Error ”
BE Sampler Spacing Test Error ”
C8 Self Test Error ”
D2 ADC Test Pattern Error ”
DC ADC Voltage Reference Error ”
A-74 Invensys Rail


External connections to the VPIM are made via the VPIM PFM.
The VPIM PFM External Connector is a double stacked 24 way plug and
socket Klippon type BLA/SLA.
Figure A.19 depicts the external connection details of the VPIM PFM.
A
Figure A.19 External Connections—VPIM PFM—VPIM

A.8 Vital Telemetry Continuous Module (VTC)
A.8.1 Description
The VTC module enables vital data communication between two WESTRACE
installations by providing continuous data transfer.
A.8.2 Particulars
The VTC is comprised of a single printed circuit board.
It communicates using RS232-C and is configured as a DTE.
The address of the module is defined in the Application Data for the system,
held in PROMs on the VLM or CEC where it is used.
A.8.3 Function
The VTC continuously transmits data over a dedicated serial channel to
another VTC.
Two forms of the data are transmitted; the True and Complement
representations of the data. These messages are formed into code words,
and the two code words are transmitted separately over the serial channel.
If in any two second period either VTC fails to receive a correct ‘pair of code
words’ from the serial channel, it will indicate a ‘Loss of Input Channel’ (LOIC)
status to the VLM by setting LOIC to logic state 0. This status will remain until
the VTC receives a correct pair of code words.
When LOIC is set to logic state 0, the VLM ensures that all inputs derived from
the VTC message are set to logic state 0 to ensure safety. All data received
from the VTC during this period is ignored, and will remain so until the LOIC
status is set to logic state 1 by the receipt of valid code words.
The VTC derives power for its communication circuits from an external 24 Vdc
supply, generated by the OPC (as part of the VLM). This supply is known as
the Vital Serial Enable Voltage (VSEV). Removal of this voltage positively
prevents the VTC from transmitting and receiving data. This is done when the
VLM cannot assure the integrity of the data and hence the safety of the system
under failure conditions. Removal of the VSEV occurs simultaneously with de-
energising of the OPCR.
The VTC is processor based and it interfaces with the VLM. It performs self-
testing, housekeeping and Health Monitoring functions for the module.
Note: Do not connect the signal ground line to earth, as this may result in an
unsafe condition though the introduction of earth loops and induced
earth potentials.
A-76 Invensys Rail

A.8.4 Configuration
None.
A.8.5 Indications
A.8.5.1 Start Up
A.8.5.2 Operation
A.8.5.3 Fault Codes

Table A.21 Fault Codes—VTC

01
02
Second Negation Error
Module Type Error
Indicates a fault on other modules.
Replace VTC
A
05 RAM Error ”
09 Stack Error ”
14 Run Time Error K Replace VTC

Table A.21 Fault Codes—VTC (Continued)

2D Health Monitoring Time Error Indicates a fault in another module
2F Health Monitoring Scheduling Error Replace VTC
80 True IMB Parity Error ”
81 Comp IMB Parity Error Replace VTC
97 Hardware Timer Error ”
98 Corrupt Data or Operating Error ”
99 Corrupt Data Input ”
9A Primary Loc Error ”
9B Corrupt Data or Transmit Error ”
9C Insufficient Time Lapse ”
9D True Output Parity Check Error ”
9E Comp Output Parity Check Error ”
A-78 Invensys Rail


External Connections to the VTC are made via the SIO232 PFM.
The SIO232 PFM External Connectors are a DB25 plug and socket for RS232
interface, and a 2 way plug and socket Klippon type BLA/SLA for power.
Figure A.20 depicts the external connection details of the SIO232 PFM.
Figure A.20 External Connections—SIO232 PFM—VTC
Table A.22 DB25 Pinout—SIO232 PFM—VTC

A
Pin Function
1 Chassis Ground
This module communicates using RS232-C and is configured as a DTE.

A.9 Enhanced Vital Telemetry Continuous Module (EVTC)
A.9.1 Description
The EVTC enables vital data communication between two WESTRACE
installations by providing continuous data transfer between the installations.
Note: The EVTC does not work with VLM1.
A.9.2 Particulars
The EVTC comprises a single printed circuit board.
The address of the module is defined in the Application Data for the system,
held in PROMs on the VLM.
A.9.3 Function
The EVTC continuously transmits data over a dedicated serial channel to
another EVTC.
Two forms of the data are transmitted; the True and Complement
representations of the data. These messages are formed into code words,
and the two code words are transmitted separately over the serial channel.
If in any two second period either EVTC fails to receive a correct “pair of code
words” from the serial channel, it will indicate a “Loss of Input Channel” (LOIC)
status to the HVLM by setting LOIC to logic state 0. This status will remain until
the EVTC receives a correct pair of code words.
When LOIC is set to logic state 0, the VLM ensures that all inputs derived from
the EVTC message are set to logic state 0 to ensure safety. All data received
from the EVTC during this period is ignored, and will remain so until the LOIC
status is set to logic state 1 by the receipt of valid code words.
The EVTC derives power for its communication circuits from an external
24 Vdc supply, generated by the OPC (as part of the VLM). This supply is
known as the Vital Serial Enable Voltage (VSEV). Removal of this voltage
positively prevents the EVTC from transmitting and receiving data. This is
done when the VLM cannot assure the integrity of the data and hence the
safety of the system under failure conditions. Removal of the VSEV occurs
simultaneously with de-energising of the OPCR.
The EVTC is processor based and it interfaces with the VLM. The processor
performs self-testing, housekeeping and Health Monitoring functions for the
module.
A-80 Invensys Rail

earth potentials.
A.9.4 Configuration
Transmit Clock
Many PCM systems require Tx and Rx data to be synchronised with the PCM’s
own transmit clock.
Set the Transmit Clock switch thus:

Switch Position 1 = OFF Internal clock—used when EVTC is connected a
modem.
Switch Position 1 = ON External clock—used when interfacing to carrier

communication systems that require
synchronised clocks for both transmitted and
received data.
The EVTC takes an external receive data clock

and generates both the transmit data clock and
the transmit data from it.
A
Applies to EVTC module (3650 1129 13) Issue
2.0 or later.
A.9.5 Indications
A.9.5.1 Start Up
A.9.5.2 Operation

A.9.5.3 Fault Codes

Table A.23 Fault Codes—EVTC

02 Module Type Error Replace EVTC
05 RAM Error ”
09 Stack Error ”
21 Run Time Error X Replace EVTC
A-82 Invensys Rail

Table A.23 Fault Codes—EVTC (Continued)

2F Health Monitoring Scheduling Error Replace EVTC
80 True IMB Parity Error ”
A
81 Comp IMB Parity Error ”
97 Hardware Timer Error ”
98 Corrupt Data or Operating Error ”
99 Corrupt Data Input ”
9A Primary Loc Error ”
9B Corrupt Data or Transmit Error ”
9C Insufficient Time Lapse ”
9D True Output Parity Check Error ”
9E Comp Output Parity Check Error ”


External Connections to the EVTC are made via the SIO232 PFM.
Figure A.21 External Connections—SIO232 PFM—EVTC
Table A.24 DB25 Pinout—SIO232 PFM—EVTC
Pin Function
1 Chassis Ground
This module communicates using RS232-C and is configured as DTE.
A-84 Invensys Rail

A.10 WESTECT Communications Module (WCM)
A.10.1 Description
The WCM enables communication of vital signal status information from a
WESTECT encoder to WESTECT OBC equipment located on a train.
A.10.2 Particulars
The WCM comprises a single printed circuit board.
A.10.3 Function
The WCM continuously transmits data over a dedicated serial link to track
side radio communications equipment as used in the WESTECT ATP system.
Two forms of data are transmitted; the True and Complement

representations of the data. These messages are formed into one packet of
code words, and the packet is transmitted over the serial channel.
The WCM derives power for its communication circuits from an external 24
Vdc supply, generated by the OPC (as part of the VLM). This supply is known
as the Vital Serial Enable Voltage (VSEV). Removal of this voltage positively
A
prevents the WCM from transmitting data. This is done when the VLM cannot
assure the integrity of the data and hence the safety of the system under
failure conditions. Removal of the VSEV occurs simultaneously with de-
energising of the OPCR.
The WCM is processor based and it interfaces with the VLM. It performs the
self-testing, housekeeping and Health Monitoring functions for the module.
earth potentials.
A.10.4 Configuration
None.
A.10.5 Indications
A.10.5.1 Start Up

A.10.5.2 Operation
A.10.5.3 Fault Codes

Table A.25 Fault Codes—WCM

02 Module Type Error Replace WCM
05 RAM Error ”
09 Stack Error ”
17 Run Time Error N Replace WCM
A-86 Invensys Rail

Table A.25 Fault Codes—WCM (Continued)

2F Health Monitoring Scheduling Error Replace WCM
A
81 Codeword True Order Error ”
82 Codeword Complement Order Error ”
83 Codeword Pair Time Error ”
84 Complement Data Parity Error ”
85 True Data Parity Error Replace WCM
86 Codeword Count Error ”


External Connections to the WCM are made via the SIO232 PFM.
Figure A.22 External Connections—SIO232 PFM—WCM
Table A.26 DB25 Pinout—SIO232 PFM—WCM
Pin Function
1 Chassis Ground
This module communicates using RS232-C and is configured as DTE.
A-88 Invensys Rail

A.11 Network Communication Diagnostic Module (NCDM)
A.11 Network Communication Diagnostic Module

(NCDM)
A.11.1 Description
The NCDM module provides network and serial interfaces, non-vital logic
processing and data logging of time stamped vital and non-vital logic
changes and WESTRACE system faults. It may be used as part of a
WESTRACE system or as a stand-alone communication and logic processing
module.
It has one network port and two external serial ports. The network port and
external serial ports are configured for function and communication protocol
by the Non-Vital Configuration that is downloaded into non-volatile memory
on the module. The physical interface for each external serial port (RS232 or
RS485) is configured as part of the communication protocol in the Non-Vital
Configuration.
The network can be used for a diagnostic interface. This uses the Diagnostic
Protocol and is connected to MoviolaW or NGETLOG.
The serial ports can be used for a diagnostic interface. These use the
Diagnostic Protocol and are connected directly or through a modem to
MoviolaW or GetLOG. Software packages designed for earlier WESTRACE A
diagnostic modules (eg DM or DM128) will not work with NCDM.
A maximum of five Diagnostic Protocol (network or serial) Communication

Sessions are supported by the NCDM.
The network port can be used for a control system interface. This uses the S2
protocols (WSL or WSA). The WSA/S2 protocol can be configured to operate
as a master (client) or slave (server). The NCDM can support up to 16 network
sessions for control systems.
The network port can route vital communication between VLM6 modules.
The NCDM can support up to 16 vital communication sessions.
The external serial ports can be used for a control system interface. These use
the S2 protocols (WSL or WSA) and may be configured to emulate a WSA or
WSL S2 field station or a WSA S2 office. Typically, these ports are connected
to a local control system (eg WESTCAD), a remote CTC system or an S2 based
local panel. The external serial ports can be configured for connection to
redundant bearers for external communications availability.
The NCDM has one internal serial port (Production port) available for
commissioning purposes to configure the NCDM and upload vital and non-
vital configuration data.
Only one NCDM module may be installed in a WESTRACE system. It occupies

the slot adjacent to the VLM in housing 1.

Note: GCSS v6.0 supports the configuration of NCDM with VLM6 only.
The term ‘Non-Vital Configuration’ equates to ‘CED’ in older WESTRACE
technology.
A.11.2 Particulars
A.11.2.1 Circuit Boards

The NCDM comprises:
• the main circuit board (NCDC);
• the Network Communication Diagnostic Protection and Filter Module
(NCD PFM4), which is the PFM for the NCDM.
The NCD PFM supports:

• one 10baseT Ethernet interface, type RJ45;
• two configurable serial ports, RS232-C or RS485 signal level (DB9);
• INCL.
A.11.2.2 External Ports

Table A.27 shows how port numbers are allocated. Figure A.23 illustrates the
physical port connectors at the rear of the NCD PFM.
Table A.27 Port number allocation—NCDM
Configuration
Port No: Type Used For
2 Serial 2 Diagnostic or control system connection
3 Serial 3 ”
8 IMB The IMB interface to the VLM (internal)
9 INCL Inter NCDM Communication Link (Hot Standby)
A VLM6 Dedicated interface to the VLM6 (internal)
B Network Diagnostic, control system or vital
communications
4
There are two styles of NCD PFM—see figure A.23.
A-90 Invensys Rail

Style 1: NCD PFM
RJ45 Network connection
Tx
Rx
Tx
Rx
Optical cable connections

for Inter NCDM Communications Link (INCL)
Serial Port 2 and Serial Port 3 (DB9)
Style 2:
NCDC PFM A
RJ45 Network connection
Tx
Optical cable connections
Rx
Serial Port 2
Serial Port 3
Figure A.23 External Ports on the Two Styles of NCD PFM—NCDM
A.11.2.3 Serial Control System Ports or Network Control System Sessions

Each serial control system port or network control system session can be
connected to:
• a control centre;
• a control computer;
• S2 field stations (serial port only);
• WESTRACE Installations (for WESTRACE to WESTRACE non-vital
communication).
Network control system sessions are made over a 10 BaseT Ethernet

compliant network.

Serial control system connections can be direct through a permanently

connected modem or as a duplicated communication pair.
Network Control System Session
Each network control system can be configured as either:

• a slave (server) where the NCDM may be configured with the WSA/S2 or
WSL/S2;
• a master (client) where the NCDM may be configured with the WSA/S2.
Individual network control sessions are configured with an individual session

ID and an individual S2 address within the S2 address range. At least 16
network control system sessions are supported.
Serial Control System Port
Each Serial Control System port can be configured as either:

• a slave, where the NCDM operates as a WSA/S2 or WSL/S2 field station;
• a master, where the NCDM operates as a WSA/S2 office.
Serial control ports can appear in a range of S2 addresses.
A.11.2.4 Serial Diagnostic Ports or Network Diagnostic Sessions

Up to five diagnostic communication sessions can be supported by NCDM.
These may be a combination of serial diagnostic or network diagnostic
sessions.
Network Diagnostic Sessions
Each network diagnostic session operates as an intermittent network

connection, where the session is connected to the external diagnostic
equipment (eg MoviolaW) only when required.
No fault is logged if the session is logged off, however a fault will be logged
if this connection fails while the session is logged on.
Serial Diagnostic Ports
Each serial diagnostic port can be configured as:
a) a permanent direct connection, where the port is connected directly to

the external diagnostic equipment (eg MoviolaW).
A fault will be logged if this connection fails.
b) an intermittent connection, where the port is connected to the external

diagnostic equipment only when required.
No fault will be logged.
c) a dial-in connection, where the port is connected to a Hayes compatible

modem. Remote external diagnostic equipment can dial in and
interrogate the NCDM.
d) a dial-out connection, where dial-in is not possible, but the NCDM will
initiate a dial-out to remote external diagnostic equipment in the event
of a fault.
A-92 Invensys Rail

e) a dial-in/out connection which allows both dial-in and dial-out.
For options c), d), and e), a fault will not be logged if the external diagnostic
equipment hangs up, but will be logged if the NCDM cannot communicate
with the modem.
A.11.2.5 Production Port

The Production port is on the front of the module. This port is used for
downloading the Non-Vital Configuration from the GCSS and uploading the
Non-Vital Configuration and Vital PROM Data to the ICS.
A.11.2.6 Serial Power Supply

The NCDM derives operational power for its serial communication ports from
a separate isolated power supply. The isolated power supply input is
connected to the installation 24V power supply by the connector CON3. The
ports are disabled when this power is not present.
A.11.2.7 Installation Status

The NCDM derives an indication of the status of the installation from an OPCR
switched 24 V input.
The installation status input is connected to the installations switched 24V

signal by CON4. A
The installation status is only used by the NCDM when configured to operate
in a hot standby system.

A.11.3 Function
The main functions of the NCDM are:
• Evaluate non-vital logic;
• Route vital communication messages from the associated VLM6 to other
WESTRACE installations and from other WESTRACE installations to the
associated VLM6;
• Exchange configured non-vital logic states with control centres, control
computers, other WESTRACE installations, external WSA/S2 field stations
and the vital processor (HVLM128, VLM5 or VLM6);
• Log all changes to vital and non-vital logic states, all detected WESTRACE
system faults and other significant operational occurrences (known as
‘operations’);
The NCDM can store up to 250,000 change of state events, 200 system
faults and 100 operations in non-volatile RAM (NVRAM);
The logging capacity is 3 days for a small interlocking without an external
diagnostic system connected, or 6 hours for a large interlocking without
an external diagnostic system connected;
The NCDM has its own Real Time Clock for time and date stamping of
logged events, WESTRACE system faults and operations. The time and
date can be set from a control centre or through a diagnostic port;
• Allow an external diagnostic system such as MoviolaW to extract logged
data and view current logic states;
• Allow an external system to upload the Non-Vital Configuration data or
Vital PROM Data.
Timestamp Synchronisation
Where a system consists of more than one WESTRACE installation, it is

important that the time of day in each installation is the same so that their
events can be correlated by time.
A typical real time clock will drift by 2 seconds a day, so two installations may
drift apart by 4 seconds a day (24 minutes over 12 months).
To ensure time synchronisation of a system consisting of more than one

WESTRACE installation, an external diagnostic system should be used to
synchronise the installation’s clocks by sending regular ‘set time’ commands.
A-94 Invensys Rail

A.11.4 Operation
The NCDM has four operating modes:
Table A.28 Operating Modes—NCDM
Mode Description Indications

Normal Normal operation. Watchdog LED flashes:
• green for stand-alone or
on-line operation;
• orange for standby
operation.
Maintenance Used for downloading a new Watchdog LED flashes red.
Non-Vital Configuration. Display shows ‘Mnt ’
Production Used for downloading new Watchdog LED Off. Display
software. shows ‘Prd ’.
Shutdown NCDM has shutdown because Watchdog LED not flashing.
of a fatal internal fault. Display shows a 3-digit fault
code.
Unless otherwise specified, the functionality described here relates to

Normal mode only.
A.11.4.1 Selecting Maintenance Mode

Maintenance mode is manually selected by either:
• connecting a special ‘Maintenance’ cable to the Production port and then A
restarting the NCDM. See section A.11.7.7 for details, or;
• setting one of the on-board switches, then restarting the NCDM (see “SW2
Switch Bank” on page A-97.)
A.11.4.2 Selecting Production Mode

Production mode is selected either:
• automatically, if the NCDM software is detected as being invalid, or;
• manually, using the on-board jumpers on a Mod D Rev 7 NCDC or a
pushbutton on a Mod E Rev 8 NCDC, then restarting the NCDM (see
“PROD” on page A-96).

The NCDC is the NCDM’s main circuit board. The current style is the
Mod D Rev 7 NCDC (figure A.24), on which you set modes using jumper pins.
A.11.5.1 Hardware Settings

Figure A.24 shows the switch banks and jumpers used to configure the
Mod D Rev 7 NCDC. Number 1 switch or jumper pin is indicated by a small
triangle symbol.
1 8 1 8
OFF OFF
CEDVER SW2
Non-Vital Maintenance
Configuration switch bank
Version (SW2)
switch bank
(CEDVER)
Production
jumper (PROD)
3
PROD
2
1
3
Password 2
1
jumper
PSWD
(PSWD) 3
2
1
2
1
Figure A.24 Configuration Switches and Jumpers—Mod D Rev 7 NCDC
Jumpers and Pushbuttons
PROD
To enter Production mode, short pins 1 & 2 of the PROD jumper together
while restarting the NCDM.
PSWD
You can change the Diagnostic Mode passwords during operation of the
NCDM. To reset them to the values stored in the Non-Vital Configuration,
short pins 1 & 2 of the PSWD jumper together while restarting the NCDM.
A-96 Invensys Rail

Note: Store the PROD and PSWD jumpers on pins 2 and 3 when the modes are
not set.
Switches
CEDVER Switch Bank
The NCDM uses the version number set by the CEDVER switch bank to
ensure that the correct Non-Vital Configuration is stored in PROM. Switch 1 is
the least significant bit and switch ON is zero.
Note: CED version is hex coded on the switch bank.
SW2 Switch Bank
This switch bank is used for the following purposes:

• putting the NCDM into Maintenance mode;
• setting the data transfer rate for the Production port;
• setting the IP Address used in a hot standby system.
Set the switches according to table A.29 and restart the NCDM to activate the
desired configuration.
Table A.29 Switch Bank 2—Valid Settings—NCDM
A
Switch Setting
1 OFF for Normal mode
ON to select Maintenance Mode
2 OFF for 9600 bits per second
ON for 115200 bits per second
3 OFF for Secondary IP address
ON for Primary IP Address (hot standby system only)
4–8 Not used. Normally left in the Off position.
The NCDM will stay in Maintenance mode until switch 1 is returned to OFF
and the system is rebooted.

A.11.5.2 Non-Vital Configuration

The majority of the NCDM configuration is done using the GCSS and is stored
in the Non-Vital Configuration data.
The Non-Vital Configuration includes:

• default passwords;
• initial values for non-vital logic states;
• non-vital application logic and timer details;
• Configuration details for each serial port, such as:
protocol;
• basic serial parameters (eg data transfer rate, handshaking, RS 232c
or RS 485 signal level);
• clock signal usage (input, output or reconstructed from data);
• protocol parameters (eg data word length, addresses, inter-scan
delay);
• default dial-out telephone numbers (diagnostic ports only);
• I/O bit mappings (control system ports only);
• Configuration details for each network session, such as:
session ID;
• protocol;
• protocol parameters;
• I/O bit mappings (control system sessions only).
A.11.5.3 Replacing the NCDM

A replacement NCDM must be configured to suit the particular location.
Usually this means the replacement must be configured to exactly match the
NCDM being replaced.
Before beginning, you must:
a) Obtain permission from the Signaller and adhere to the Railway

Authority’s safety requirements
b) Power down the WESTRACE installation.
Remove the NCDM from the WESTRACE Housing

a) Remove the front panel of the WESTRACE housing.
b) Observe the anti-static procedures.
c) Remove the NCDM from the housing using the built in card ejectors.
Where the NCDM is used in a WESTRACE system that includes a VLM6,
both the NCDM and VLM6 must be removed.
d) Separate the NCDC from the VLC6.
A-98 Invensys Rail

NCDC VLC6 VLC6

(Mod D Rev 7 shown) (inside view) (outside view)
1 3 2
Remove nuts (5) from
stand-offs Pins (1) engage connector (2) through holes (3)
Figure A.25 Separating the NCDC and VLC6
Install the Non-Vital Configuration
There are five parts to this task:

A
a) Ensuring you have the right equipment;
b) Setting the Non-Vital Configuration version switches on the NCDC;
c) Switching the NCDM to Maintenance Mode;
d) Installing the NCDM into the housing;
e) Down loading the new Non-Vital Configuration to the NCDM.
SAFETY WESTRACE must not be controlling an interlocking while downloading a

Non-Vital Configuration.
Disconnect the network cable from the NCD PFM prior to power-up of a
WARNING newly-installed NCDM. Otherwise an unintended IP Address in the
NCDM Non-Vital Configuration may cause a shutdown of an adjacent
NCDM on the network due to detection of a duplicated IP Address.
Equipment Required
• A personal computer (PC) loaded with:
• the Graphical Configuration Subsystem (GCSS version 6 or later);
• the correct Non-Vital Configuration for the NCDM;
• the Installation Check System (ICS).
• A ‘standard’ cable as described in figure A.36 to connect the serial port on
the PC to the Production port on the NCDC.
Alternatively, a ‘maintenance’ cable (figure A.36) may be used. The
‘maintenance’ cable configuration causes the NCDM to automatically start

in ‘Maintenance’ mode. See “Setting the Maintenance Mode”

(page A-100) and “When the maintenance cable was used to set
Maintenance Mode” (page A-101).
• A copy of the WESTRACE Graphical Configuration Subsystem Manual.
Setting Non-Vital Configuration version switches
The NCDM requires that the Non-Vital Configuration version must be that set
by the CEDVER switches. This protects against loading an incorrect version.
See figure A.26.
Note: CED version is hex coded on the CEDVER switch bank.
Set the switches on the NCDC to define the Non-Vital Configuration version
specified on the GCSS printout for the Non-Vital Configuration.
Switch 1 is the least significant bit. Switch ON is zero.
For example, to set Non-Vital Configuration version 1, you set switch 1 OFF
and switches 2-8 ON (figure A.26). To set Non-Vital Configuration version 5,
switches 1 and 3 are OFF, all others are ON.
Switch 1 OFF (1) Switches 2-8 ON (zero)
Figure A.26 Setting Non-Vital Configuration—Version 1 Example (Mod D Rev 7 NCDC

shown)
Setting the Maintenance Mode
Select ‘Maintenance mode’ either by connecting a maintenance cable to the

Production port, or by setting switch 1 of switch bank SW2 to ON. See section
A.11.4.1 for details.
Refitting the NCDM
Refit the NCDM into the housing. Insertion is the reverse of removal
described in “Remove the NCDM from the WESTRACE Housing” (page A-98)
with the exception of not replacing the front panel.
A-100 Invensys Rail

Downloading the Non-Vital Configuration

a) Connect the cable of choice between the Production port and the PC;
see figure A.27.
b) Power up WESTRACE.
Ensure that the NCDM has entered Maintenance mode (the watchdog
LED should be flashing red and the fault display should show ‘MNT ’).
c) Download the Non-Vital Configuration according to the instructions in

the WESTRACE Graphical Configuration Subsystem Manual.
Maintenance Cable
See figure A.36
A
Figure A.27 Production Port—Connecting—NCDM
Verify the Data
The Non-Vital Configuration must be verified before the system is returned to

service.
a) Ensure the NCDM is in maintenance mode and the PC is connected to

the NCDM Production port;
b) Run ICS according to the instructions in the WESTRACE Installation

Check System Manual;
c) Complete procedural checking and sign off as per the WESTRACE

Installation Check System Manual.
Restore the System
When the maintenance cable was used to set Maintenance Mode

a) Power down WESTRACE;
b) Remove the cable from the Production port;
c) Refit the front panel to the housing(s);
d) Power up WESTRACE;

e) Allow WESTRACE to run for several minutes; ensure that no fault codes
are displayed;
f) Advise the Signaller of completion.
When Switch Bank SW2 was used to set Maintenance Mode

a) Power down WESTRACE.
b) Remove the NCDM from the housing.
c) Set switch 1 of switch bank SW2 to OFF (Maintenance Mode OFF). See
figure A.24.
d) Refit the NCDM into the housing. Replacement of the NCDM is the
reverse of the procedure described in “Remove the NCDM from the
WESTRACE Housing” (page A-98).
e) Refit the front panel to the housing(s).
f) Power up WESTRACE.
g) Allow WESTRACE to run for several minutes; ensure that no fault codes
are displayed.
h) Advise the Signaller of completion
A.11.5.4 Battery Installation

A lithium battery is used to maintain logged data in non-volatile memory and
the real-time clock when the NCDM is powered down. The battery has a very
long life and in normal circumstances it is unlikely to require replacement.
The NCDM is usually shipped with the battery connected.
To replace the battery:
a) Have a replacement battery of the same type as the original plus cable
ties readily at hand. See figure A.28.
b) Snip the cable ties holding the old battery to the printed circuit board.
c) Remove the battery lead from the pins.

For a standing battery connector (figure A.28), first separate the two
circuit boards by removing the five stand-off screws then releasing the
connector near the centre of the boards (figure A.25).
d) Connect the replacement battery to the pins. You have a short period to
do this before data is lost.
e) Fix the replacement battery to the circuit board using the new cable ties.
f) Snip off the excess length of cable ties.
A-102 Invensys Rail

Standing battery connector
Lying battery connector A

Figure A.28 Lithium Battery—Two Connector Types—NCDM
Observe the instructions elsewhere in this manual.

A.11.6 Indications
The ‘user interface’ of the NCDM comprises LEDs and a four digit
alphanumeric display.
Internal Fault LED

D1
D2 VLM6 Status LED
Alphanumeric Fault display D3
D4
NCDC Watchdog LED
Production port VLM6 Watchdog LED
NCDC VLM6
(Mod D Rev 7
shown)
Figure A.29 User Interface—NCDC and VLM6—NCDM
A.11.6.1 Network Communication Diagnostic Card LEDs

The NCDC has two front panel LEDs:
• Internal fault LED (red)—illuminated whenever there is a non-fatal internal
NCDM fault. These faults require attention, but are not serious enough to
cause the NCDM to shutdown;
• Watch dog LED (normally green)—flashes at a regular interval if all is well
with the NCDM. During the first minute or so of operation, the LED may
flash at a faster than normal rate. It should then flash at a similar rate as the
watchdog LED on the VLM;
This LED flashes:
orange when the NCDM is in the Standby Installation of a Hot Standby
System;
• red when the NCDM is in Maintenance mode.
A-104 Invensys Rail

A.11.6.2 NCD PFM LEDs

Installation status (D8)
5 V power supply from NCDC (D9)

Ethernet Tx/Rx (D5)
Serial Port 3 power (D10)
Serial Port 2
power (D11)
Serial Port 2 Tx/Rx (D6) Serial Port 3 Tx/Rx (D7)
Figure A.30 User Interface—NCD PFM—NCDM
The NCD PFM has 7 LEDs:

• Serial LED (D6 & D7)—for each of the 2 serial ports. Flashes red when data
is transmitted and flashes green when data is received;
• Network LED (D5)—for the network port. Flashes red when data is received
A
and flashes green when data is transmitted;
• Power Indicator LED (D10 & D11) (green)—for each of the serial ports.
Indicates the +24 V comms power supply is present;
• Power Indicator LED (D9) (green)—indicates the +5 V power supply is
present;
• Installation Status LED (D8) (green)—indicates the NCDM is in the on-line
installation.
See section A.11.6.5 for further information about these indicators.
A.11.6.3 Alphanumeric Display

The alphanumeric display can only show one fault at any time. However, all
fault codes which occur are logged by the NCDM and can be examined using
external diagnostic equipment.
Shutdown Mode
The alphanumeric display will show the applicable fault code if the NCDM
shuts down because of an internal fault. See table A.37.
Normal Mode
Within the first 12 seconds of the NCDM operating in this mode, the
alphanumeric display will show start-up information (see section A.11.6.4)
and then it will be blank unless a fault is detected.

During operation, a ‘non-fatal’ fault may occur which will cause the NCDM to
display a fault code but continue to operate. In the event of multiple faults
being present simultaneously, the NCDM will display the code for the first of
the following that applies:
a) ‘TIME’ if the NCDM real time clock has not been set;
b) a non-fatal NCDM fault code, see table A.38;
c) ‘FLT ’when more than one non-fatal faults have occurred;
d) ‘DIAG’ when one or more WESTRACE system faults have not been
uploaded by the external diagnostic equipment;
e) ‘BAT ’ if the NCDM battery voltage is low.
Maintenance Mode
The alphanumeric display will show the following when the NCDM is in this
mode:
• ‘MNT ’ when ready to download a new Non-Vital Configuration;
• progress messages during and after a Non-Vital Configuration download.
A.11.6.4 Start Up
The alphanumeric display shows a sequence of information (in hexadecimal)
during start-up.
Table A.30 Start-up Display Sequence—NCDM
Time After
Start-up Information Details
0–4 secs Display shows various states followed by
‘RUN’ to indicate the application software is
running.
4–6 secs– Lamp test All segments/dots illuminate to verify they
are functional.
6–9 secs Backplane address Display shows ‘A hh’ where ‘hh’ is the
backplane address of the slot holding the
Network Diagnostic Card (NCDC).
9–12 secs Software version Display shows ‘V hh’ where ‘hh’ is the
version number of the NCDM software.
The NCDM will indicate incompatible application and bootloader software

by displaying ‘Err ’.
A-106 Invensys Rail

A.11.6.5 Operation
A correctly operating NCDM will show the following:
Table A.31 Operation Indicators—Normal—NCDM
Indicator Condition
Internal Fault LED Off
Alphanumeric display Blank
Watchdog LED Regularly flashing green when in an on-line

installation.
Regularly flashing orange when in a stand-by
installation.
Serial LED(s) Flashes green when the NCDM is receiving messages

though the associated serial port.
These LEDs will flash irrespective of whether the
message is addressed to the NCDM.
Flashes red when the NCDM is transmitting messages
through the associated serial port.
Network LED(s) Flashes green when the NCDM is receiving messages

though the associated network port.
message is addressed to the NCDM.
Flashes red when the NCDM is transmitting messages
Power Indicators
through the associated network port.
Steady green
A
Installation status Steady green for on-line installation in stand-by
system.
Note: The watchdog LED flashes red when the NCDM is in Maintenance mode.
The Serial and Network LEDs may appear to be ON rather than flashing
when the data rate is high.
A.11.6.6 Fault Detection
A.11.6.6.1 WESTRACE Module Faults
During the first 16 seconds after power up, all WESTRACE modules display in
sequence via their diagnostic LEDs:
• backplane address;
• software version;
• the value 00 (all LEDs off) to indicate ‘no fault’.
During operation, each module will generate a non-zero fault code if a fault
is detected.
The NCDM polls each module in turn to read this information, and will record
any changes. These changes are stored in the order that they are polled by
NCDM, which may not necessarily be the order in which they occurred.

A.11.6.6.2 NCDM Faults
In the event of an internal NCDM fault, the NCDM will either:

• display a code on the alphanumeric display, log a fault, and continue
operating. This action is taken for ‘non-fatal’ faults (such as a comms port
failure, low battery, or date/time not set), which do not compromise safe
operation of the NCDM;
• shutdown the NCDM and display a code on the alphanumeric display.
This action is taken for a ‘fatal’ fault (such as software or hardware
malfunctioning). A fault will be logged when the system is restarted.
When an internal fault is the cause of an NCDM shutdown:
a) the NCDM will lose communications with the VLM;
b) the VLM will display a fault code (typically 34h) because of the
communications loss but the VLM will keep running because the NCDM
is a non-vital module;
The only way to clear the VLM fault code is to restart the WESTRACE
system.
At this point, all NCDM communications ports are disabled and will stay that
way until WESTRACE is restarted.

The alphanumeric display comprises four digits; D1, D2, D3 and D4 reading
from top to bottom on the display (figure A.31). Figures A.32 to A.34 show
the alphanumeric display being read left to right where the left position
corresponds with the top position in figure A.29.
D1 D2 D3 D4
Figure A.31 Four Digit Alphanumeric Display—NCDM
The hexadecimal numbers shown by this display identify the following:

• the class of fault (internal NCDM fault, port fault, or module network
session fault);
• the port number and module address or network session, if appropriate;
• a code identifying the fault.
Digit D1 identifies the port. The other three digits (D2–D4) display:
• the fault code;
• module address, or;
• network session number.
The following nomenclature is used in the diagrams and tables below:

p port number (hex)
mm module or session (hex)
f fault code (hex)
A-108 Invensys Rail

A.11.6.7.1 Port Faults
Digit D1 identifies the faulty port. Digits D2 and D3 are set to zero and digit
D4 is the fault code.
p 0 0 f
Port number (2-B hex) Fault code (0,1 hex)
Figure A.32 Alphanumeric Display—Port Fault—NCDM
The port number used are:

2 = Serial port 2;
3 = Serial port 3;
8 = IMB port;
9 = INCL port;
A = VLM6 port;
B = Network port.
For example, A001 indicates a fault code 1 on port A (the VLM6 port).
Port Codes in General
Table A.32 shows valid port fault codes.
Table A.32 Fault Codes—Port Codes in General—NCDM

A
p000 Port OK None.
p001 Port time out or fail: Serial or network LED flashing green:
• check the port configuration in Non-Vital
a. Timeout when waiting for an incoming message
Configuration;
(serial server port). • replace the NCDM if the configuration is
b. Failure to get a response from any external correct.
server (serial client port). Serial or network LED off:
• check the comms link cabling and connections;
c. Detected failure of Ethernet link (network port) • replace the protection module or the NCDC.

External Port, Module and Session Codes

Table A.33 Fault Codes—Ext. Port—Module and Session—NCDM

A001 VLM6 port time-out. This code is displayed if the VLM shuts down for
8001 IMB port time-out. any reason.
Try the following if this code is on display and the
VLM is still running:
a. Restart WESTRACE.
b. Check to ensure the VLM and NCDM Non-Vital
Configurations are consistent with respect to
transfer states passed between them. Normally
GCSS ensures that this is the case.
c. Check to ensure that only one NCDM and no
DM is installed.
d. Replace the NCDM.
9001 INCL port time-out. An NCDM in an On-line installation displays this

code if it does not receive an INCL
acknowledgment message from the NCDM in the
Stand-by installation.
Try the following if this code is on display:
a. Check the INCL Rx link to the NCDM in the
On-line installation;
b. Check the INCL Tx link on the NCDM in the
Stand-by installation;
c. Replace the NCD PFM in the On-line installation.
d. Check the INCL Rx link to the NCDM in the
Stand-by installation;
e. Check the INCL Tx link on the NCDM in the
On-line installation;
f. Replace the NCD PFM in the Stand-by
installation.
Internal Port Codes
The following code is not displayed. It is reported in the fault log only.
Table A.34 Fault Codes—Internal Port—NCDM
CODE DESCRIPTION
p000 The port p has recovered and is now operational.
A.11.6.7.2 Module or Session Faults
Digit D1 identifies the port to which the module-network session is

connected. Digits D2 and D3 identify the module address or session number,
and digit D4 is the fault code.
p m m f
}
Port number (2-B hex) Fault code (8,9 hex)

Module address or
session number (00-FF hex)
Figure A.33 Alphanumeric Display—Module or Session Fault—NCDM
A-110 Invensys Rail

The NCDM reports on faults for connected module addresses or session

numbers. The fault code is interpreted from the alphanumeric display as
described here. Module or session faults in the range:
00-7F are reported by the NCDM in an on-line WESTRACE,
80-FF are reported by the NCDM in a standby WESTRACE.
In all cases, a fault code of zero means ‘no fault’.
For example, a fault code of ‘21B8’ on an NCDM indicates a fault code 8 on

the module with address 0x1B (serial port 2).
Table A.35 shows valid fault codes.
Table A.35 Fault Codes—Module or Session—NCDM

pmm9 Communication to an address has timed out. Slave port
Slave port—timeout when waiting for a valid a. Check that the control system master is sending
message addressed to address or session ID mm
data to this address or session ID.
(hex) on port p (hex).
Master port—timeout waiting for a valid response b. Check the addresses or session IDs stored in the
from the S2 field address or session ID mm (hex) on Non-Vital Configuration to see if they match the
port p (hex). addresses or session IDs sent by the office.
Master port
a. Check that the slave at this address or session ID
is functioning correctly.
b. Check that the addresses or session IDs stored
in the Non-Vital Configuration match those of
the connected slave. A
Other Module or Session Codes
The following code is not displayed. It is reported in the fault log only.
Table A.36 Fault Codes—Other—Module or Session—NCDM
CODE(H) DESCRIPTION
pmm8 Address or session ID mm (hex) on port p (hex) has recovered from a fault and is now
operational.
A.11.6.7.3 Internal faults
Digit D1 is blank and Digits D2 to D4 display the fault code (000-FFF).
0 f f f
}
Fault code (000-FFF hex)
Figure A.34 Alphanumeric Display—Internal Fault—NCDM
The first action should be to restart WESTRACE. Next, find the displayed fault
code in the tables below and take the recommended action. All of these fault
codes, plus any read from the fault latches of other WESTRACE modules are
logged to the NCDM fault buffer in the order they are detected by the NCDM.

Fatal NCDM Fault Codes
These faults cause the NCDM to shut down.
Table A.37 Fault Codes—Fatal—NCDM

003 Application Checksum Error Replace NCDM
004 Stack Guard Band Error ”
005 RAM Error ”
009 Stack Error ”
080 Non-Vital Configuration checksum error Download new Non-Vital Configuration
084 Non-Vital Configuration version number error Confirm that the version switches are correctly set.
Download new Non-Vital Configuration if the
switches are correctly set.
100 Build error a. Check the NCDM configuration parameters for

their range and correct any that are out of range.
b. Ensure that all WSA/S2 protocol sessions over
the network port have unique housing
addresses for client and server sessions.
c. Ensure that parameters for the vital
communication ports (configured for the VLM6)
are matched by the NCDM configuration.
d. Re-build the NCDM configuration and load it
onto an NCDM.
101 Out of memory Replace NCDM
102 Operating system error ”
103 Internal error ”
104 Task suspended Replace NCDM
105 NVRAM error ”
107 Comms buffer error ”
108 Non-Vital Configuration format version error Download new Non-Vital Configuration
109 Watchdog restart Replace NCDM
10A No VLM Non-Vital Configuration copy Restart WESTRACE
10B Wrong VLM Non-Vital Configuration copy ”
10C VLM interface versions mismatch Check the NCDM and VLM Non-Vital
Configuration versions.
10D VLM address mismatch Check the NCDM Non-Vital Configuration and
WESTRACE installation details
10F Wrong IMB slot Move NCDM to the correct backplane slot
112 Duplicate IP Address a. Check the NCDM Non-Vital Configuration for

correct IP address.
b. Check other equipment connected to the
network for a duplicate IP address.
In a Stand-by system:
Ensure the secondary IP address configuration
switch is set correctly.
A-112 Invensys Rail

Table A.37 Fault Codes—Fatal—NCDM (Continued)

113 Duplicate Session Id a. Ensure that the Application Session Id is unique
for all sessions over the network port.
b. Ensure that each diagnostic port address is
unique and different from any Application
Session Id.
c. Correct the NCDM configuration where
necessary, then re-build it and load it onto an
NCDM.
Non-Fatal NCDM Fault Codes
These faults are logged and displayed by the NCDM. The NCDM continues
operating.
Table A.38 Fault Codes—Non-Fatal—NCDM

10E IMB data error No action required.
111 Timing error ”
800 NVRAM is invalid. Could be due to an old or faulty battery.

Replace the battery when the error occurs on start-
up, otherwise replace the NCDC.
Note: NVRAM is always cleared when the NCDM is
configured or re-configured; such an error is
logged upon first start-up. A
801 Event log store was invalid, therefore reset. ”
802 Fault log store was invalid, therefore reset. ”
803 Operations log store was invalid, therefore reset. ”
804 SR Latch output states in NVRAM are invalid. ”
805 Phone numbers in the NVRAM are invalid. Could be due to an old or faulty battery.
Replace the battery when the error occurs on start-
up, otherwise replace the NCDC.
Note: NVRAM is always cleared when the NCDM is
configured or re-configured; such an error is
logged upon first start-up.
806 Passwords in the NVRAM are invalid ”
810 Error reading from fault bus or reading from a Check that all cards are in place and if the error is
backplane address. (FDet read error). still persistent, replace the NCDM.
900 Vital message length or small channel port number Check configuration of vital sessions on the
out of range for messages to VLM6. network port.
901 Invalid BCC on non-vital message from VLM6. Check configuration of the VLM6 interface.
902 Big channel message length out of range on ”

message from VLM6.
903 NCDM could not obtain DPRAM semaphore. Check the VLM6-NCDM interface; replace one or
other of the modules.
904 Error in Hot Stand-by INCL. Check INCL hardware. Ensure that both NCDMs
have the same configuration.
90C Invalid session number. Ensure the same Session ID is used for connecting
installations.
90D Message delayed. Check network hardware.
90E Message repeated or earlier. ”

Table A.38 Fault Codes—Non-Fatal—NCDM (Continued)

90F Session occupied. Check for unexpected equipment on the network.
Ensure that only one remote installation is
connected at any time (for same Port ID).
910 Session or IP changed. No action required.
911 Invalid Rx timestamp. Check network hardware.
BAT Low battery Replace battery
F11 Main cycle not synchronized Check the NCDM and VLM Non-Vital
(NCDM cannot keep up with VLM.) Configurations.
F21 Software version number lost Replace NCDM
F22 Module information error ”
F23 Fault bus error ”
F24 Fault detection NVRAM error ”
TIME Time has not been set Set correct time through MoviolaW, CTC or
Getlog. It is possible to set the time via the S2
protocols.
DIAG There are faults stored in the Fault Buffer. Connect or check and restart an external
diagnostic system and request the fault codes
from the Fault Buffer.
Other NCDM Codes
The following codes are not displayed. They are reported in the fault log only.
Table A.39 Fault Codes—Other (Not Displayed)—NCDM
CODE(H) DESCRIPTION
F00 Recovered from low battery condition
F01 Low battery (corresponds to ‘BAT’ display)
F10 Recovered from VLM out-of-sync error
F30 Time has been set, i.e. an invalid time/date error has been corrected
F31 Date/time not set (corresponds to ‘TIME’ display)
F40 Network port re-enabled
F41 Network port disabled
F50 Vital link up
F51 Vital link down
A-114 Invensys Rail

Style 1: NCD PFM
Network Connector (RJ45)
Tx Inter NCDM Comms Link (INCL) (Optical)
Rx Inter NCDM Comms Link (INCL) (Optical)
Serial Ports, 2 off (DB9 Connectors)
Serial Power Connector

Installation Status Connector
Serial Port 2 Serial Port 3
Serial Power Installation Status
Connector Connector
(+22 to +30 V) Pin 1 Pin 2 (0 V)
(0V) Pin 2 Pin 1 (+22 to +30 V)
Installation Status
Style 2:
Network
A
Tx
Rx
Serial Port 2
Serial Port 3
Serial
Power
Figure A.35 External Connectors on the Two Styles of NCD PFM—NCDM
A.11.7.1 Serial Power Connector

Table A.40 and figure A.35 show the serial power terminals for a Style 1
NCD PFM (via a Klippon removable screw terminal plug). For Style 2
labelled PWR.
Table A.40 Serial Power Connector Pinout—NCD PFM—NCDM
NCD PFM Pin Number

(see figure A.35, Style 1) Signal
1 +22 to +30 V
2 Common (0V)
See also “NCDC PFM Fusing” on page 3-13.

A.11.7.2 Installation Status Connector

Table A.41 and figure A.35 show the installation status terminals for a Style 1
NCD PFM (via a Klippon removable screw terminal plug). For Style 2
labelled STA.
Table A.41 Installation Status Connector Pinout—NCD PFM—NCDM
NCD PFM Pin Number

(see figure A.35, Style 1) Signal
1 +22 to +30 V
2 Common (0V)
A.11.7.3 Serial Connectors

The serial interface is a pair of male DB9 connectors configured as either
RS232 or RS485 (figure A.35). The DB9 on the left is serial port 2, and the DB9
on the right (closest to the PCB) is serial port 3.
RS232-C Connection
Table A.42 DB9 Pinout—RS232 Connection—NCD PFM—NCDM

3 TxD NCDM
4 DTR NCDM
5 ISOGND (Common)
6 CLKOUT NCDM
7 RTS NCDM
RS485 Connection
Table A.43 DB9 Pinout—RS485 Connection—NCD PFM—NCDM

3 TxD+ NCDM
4 TxD– NCDM
5 ISOGND (Common)
6 CLKOUT+ NCDM
7 CLKOUT– NCDM
A-116 Invensys Rail

A.11.7.4 Network Connector

The network interface is an RJ45 connector with the following configuration:
Table A.44 RJ45 Pinout—Network Connection—NCD PFM—NCDM

1 Tx+ NCDM
2 Tx- NCDM
3 Rx+ External Equipment
4 Not used -
5 Not used -
6 Rx- External Equipment
7 Not used -
8 Not used -
A.11.7.5 INCL Connector

The INCL interface comprises a transmit (White) and receive (Black) fibre
optic connectors. Figure A.35 shows these connectors. The INCL interface is
designed for a 2.2 mm outside diameter fibre with a 1 mm polymer fibre
core. The transmitter and receiver connections are designed such that no
special tooling is required to achieve optical termination.
Note: Take extreme care not to damage the INCL fibre-optic cables. These
cables are fragile, and sharp bends can stress or fracture them, causing
A
high losses or intermittent communications.

This port is a male DB9 connector on the front edge of the card (see
figure A.27). Signal levels are to RS232-C standard and the connector pinout
is shown in table A.45. This port is only enabled when the NCDM is in
Maintenance mode.
Table A.45 DB9 Pinout—Production Port—NCDM
Pin Number Signal Comments

1 N/C
2 RxD input
3 TxD output
4 N/C
5 Common
6 N/C
7 RTS output Always active
8 MAINT input Selects maintenance mode
9 SPEED input Selects maintenance mode
data transfer rate

A.11.7.7 Cabling Details

A cable with any of the configurations in figure A.36 will allow a personal
computer to connect to the:
• Production port (a DB9 connector on the front edge of the NCDC);
• Serial diagnostic port, if configured (a DB9 connector at the rear of the
housing).
Either a standard serial cable or a maintenance cable can be connected to the

diagnostic port. The interconnection of pins 7, 8 and 9 on the maintenance
cable has no effect when connected to a serial diagnostic port.
Plugging a maintenance cable into the Production port and restarting the
WESTRACE installation will cause the NCDM to switch to its Maintenance
Mode of operation. The wiring of the cable determines the data transfer rate
as follows:
• A maintenance cable with interconnection of pins 7, 8 and 9 will cause the
NCDM to select the 115 kbps data transfer rate;
• A maintenance cable without pin 9 connected to pins 7 and 8 will cause
the NCDM to select the 9.6 kbps data transfer rate.
Production or Diagnostic Port Personal Computer

DB9 Female DB9 Female
Pin Pin
2 3
3 2
5 5
Standard
Cable Production or Diagnostic Port Personal Computer
Pin Pin
2 2
3 3
{
5 7
Production Port
DB9 Female
Pin
}
Maintenance 2 Connections
Cable 3 as above
5
{
Pins 7 and 8 7
interconnected 8
at this end Interconnect pin 7, 8 & 9 for
9
115 kbps transfer rate
Figure A.36 Cable Configuration Details—NCDM
A.11.7.8 Connecting a Diagnostic System

Most WESTRACE installations will have a permanently connected MoviolaW.
An installation can be configured to allow remote access via Hayes
compatible modem or through the network.
Types of Diagnostic System
Two diagnostic systems are available:

• MoviolaW—Windows based logging and display utility;
A-118 Invensys Rail

Provides the following services:

Real time graphical display of the state of the interlocking;
• Records for later playback, events (logic state changes) which occur
after MoviolaW commences running;
• Extraction of historical fault information from an NCDM (although not
historical event or operation information);
• Basic maintenance functions such as setting the time and displaying
communication statistics;
• GETLOG—a command line utility for serial communications,
NGETLOG—a command line utility for network communications;
Provide the following services:
Extraction of historical and real time event, fault and operation
information which is displayed and stored in text form;
communication statistics;
• Simpler to install and configure than MoviolaW;
• Can support larger systems than MoviolaW.
Requirements
You will need:

• A personal computer (PC) loaded with MoviolaW or GETLOG or
NGETLOG;
• The MoviolaW display files for the particular installation, plus the following
A
configuration files:
• *.ins (for vital installation);
• *.ncd (for non-vital (NCDM) installation);
• *.wip (for both vital and non-vital installations);
• *.imp (for vital installation).
• For GETLOG and NGETLOG, it is useful to have the Vital and Non-Vital
Configuration image (.img) files for the installation;
• The passwords for accessing the particular NCDM;
For MoviolaW, the passwords for a particular NCDM are stored in the
MoviolaW .ini file, and are configured using the MoviolaW NCDM driver
software;
For GETLOG and NGETLOG, the password must be specified on the
command line;
• A cable to connect between:
• the serial port(s) on the PC and the serial Diagnostic port (figure A.36),
or;
• the network port on the PC and a network hub associated with the
WESTRACE installation;
• The user manual for the chosen diagnostic system.

Procedure
a) Connect the PC to a configured diagnostic port or network session at
the rear of the housing. See figure A.35 and refer to the local
documentation;
b) Start up the chosen diagnostic system;
c) Follow the guidelines for fault finding.
A-120 Invensys Rail

A.12 Non-vital Communications and Diagnostic Module (NVC/DM)
A.12 Non-vital Communications and Diagnostic Module

(NVC/DM)
A.12.1 Description
The NVC/DM module provides multiple serial interfaces, non-vital logic
processing and data logging of time stamped vital and non-vital logic
changes and WESTRACE system faults. It may be used as part of a
WESTRACE system or as a stand-alone communication and logic processing
module.
It has one configuration communication port and up to six external I/O ports.
Each port is configured for function and communication protocol by the Non-
Vital Configuration that is downloaded into non-volatile memory on the
module. The physical interface for each port is configured by a separate plug-
on daughter board.
Up to three of the ports can be used for a diagnostic interface. These use the
Diagnostic protocol and are connected directly or through a modem to
MoviolaW or GETLOG. Software packages designed for earlier WESTRACE
diagnostic modules (eg DM and DM128) will not work with NVC/DM.
The remaining ports use either S2 protocol (WSL or WSA) and may be
configured to emulate a WESTRONIC S2 field station or a WSA S2 office. A
Typically, these ports are connected to a local control system (eg WESTCAD),
a remote CTC system or an S2 based local panel. The ports may be
configured for connection to redundant bearers for external communications
availability.
Only one NVC/DM module may be installed in a WESTRACE system.

Normally it occupies the two slots (4 and 5) adjacent to the VLM in housing 1.
Note: The NVC/DM only works with the HVLM128 and VLM5.
The NVC/DM has been validated for Hot Standby operation but only as a
diagnostic module (emulating a DM128 or DM5).
The term ‘Non-Vital Configuration’ equates to ‘CED’ for older WESTRACE
technology.

A.12.2 Particulars
A.12.2.1 Circuit Boards

The NVC/DM comprises:
• two main circuit boards:
Logic Evaluation Card (LEC);
• Communications Interface Module Filter and Interface Module
(CIMFIM);
• up to six I/O daughter boards;
• the Communications Interface Module Protection Module (CIMPM) which
is the PFM for the NVC/DM.
Each daughter board:

• provides the physical interface for either a diagnostic or telemetry serial
port;
• provides either of RS232-C or RS485 signal levels, type SDB232 and
SDB485 respectively.
A.12.2.2 External Ports

Table A.46 shows how port numbers are allocated. Figure A.49 illustrates the
physical port connectors at the rear of the CIMPM.
Table A.46 Allocation of Port Numbers—NVCD/DM
Port No:1 Type Used For

1 - Do not use
2 Serial Diagnostic or non-vital telemetry connection
3 ” ”
4 ” ”
5 ” Non-vital telemetry connection only
6 ” ”
7 ” ”
8 IMB The IMB interface to the VLM (internal)
1. See figure A.49.
Telemetry Ports
Each telemetry port can be connected to:

• a control centre;
• a control computer;
• S2 field stations.
Telemetry connections can be direct through a permanently connected

modem.
Each telemetry port may be configured as either:

• a slave port, where the NVC/DM operates as a WSA/S2 or WSL/S2 field
station;
• a master port, where the NVC/DM operates as a WSA/S2 office.
A-122 Invensys Rail

NVC/DM telemetry ports can appear as a range of S2 addresses.
Diagnostic Ports
Each diagnostic port can be configured as:
a) a permanent direct connection, where the port is connected directly to

the external diagnostic equipment (eg MoviolaW);
A fault will be logged if this connection fails;
b) an intermittent connection, where the port is connected to the external

diagnostic equipment only when required;
No fault will be logged;
c) a dial-in connection, where the port is connected to a Hayes compatible

modem. Remote external diagnostic equipment can dial in and
interrogate the NVC/DM;
d) a dial-out connection, where dial-in is not possible, but the NVC/DM will
initiate a dial-out to remote external diagnostic equipment in the event
of a fault;
e) a dial-in/out connection which allows both dial-in and dial-out.
For options c), d), and e), a fault will not be logged if the external diagnostic
equipment hangs up, but will be logged if the NVC/DM cannot communicate
with the modem.
A
The Production Port is on the front of the module. This port is used for
downloading the Non-Vital Configuration from the GCSS and uploading the
Non-Vital Configuration and Vital PROM Data to the ICS.
A.12.2.4 Serial Power Supply

The NVC/DM derives operational power for its communication ports from a
separate isolated power supply. The ports are disabled when this power is
not present.

A.12.3 Function
The main functions of the NVC/DM are:
• Evaluate non-vital logic;
• Exchange configured logic states with control centres, control computers,
external WSA/S2 field stations and the vital processor (HVLM128 or
VLM5);
• Log all changes to vital and non-vital logic states, all detected WESTRACE
system faults and other significant operational occurrences (known as
‘operations’);
The NVC/DM can store up to 250,000 change of state events, 200 system
faults and 100 operations in non-volatile RAM (NVRAM);
The logging capacity is 3 days for a small interlocking without an external
diagnostic system connected, or 6 hours for a large interlocking without
an external diagnostic system connected;
The NVC/DM has its own Real Time Clock for time and date stamping of
logged events, WESTRACE system faults and operations. The time and
date can be set from a control centre or through a diagnostic port;
• Allow an external diagnostic system such as MoviolaW to extract logged
data and view current logic states;
• Allow an external system to upload the Non-Vital Configuration and Vital
PROM Data.
Timestamp Synchronisation
Where a system consists of more than one WESTRACE installation, it is

important that the time of day in each installation is the same so that their
events can be correlated by time.
A typical real time clock will drift by 2 seconds a day, so two installations may
drift apart by 4 seconds a day (24 minutes over 12 months).
To ensure time synchronisation of a system consisting of more than one

WESTRACE installation, an external diagnostic system should be used to
synchronise the installation’s clocks by sending regular ‘set time’ commands.
A-124 Invensys Rail

A.12.4 Operation
The NVC/DM has four operating modes:
Table A.47 Operating Modes—NVC/DM
Mode Description Indications

Normal Normal operation. Watchdog LED flashes green.
Maintenance Used for downloading a new Watchdog LED flashes red.
Production Used for downloading new Watchdog LED off. Display
firmware. shows Prd.
Shutdown NVC/DM has shutdown Watchdog LED not flashing.
because of a fatal internal Display shows a 3-digit fault
fault. code.
Unless otherwise specified, the functionality described here relates to

Normal mode only.
A.12.4.1 Selecting Maintenance Mode

Maintenance mode is manually selected by either:
a) connecting a special ‘Maintenance’ cable to the Production Port and

then restarting the NVC/DM. See section A.12.7.4 for details;
b) setting one of the on-board switches and then restarting the NVC/DM.
See figure A.37, and “S2 Switch Bank” on page A-127.
A
A.12.4.2 Selecting Production Mode
Production mode is selected either:
• automatically, if the NVC/DM firmware is detected as being invalid, or;
• manually, by setting one of the on-board jumpers and then restarting the
NVC/DM. See “PROD Jumper” (page A-126).
A.12.5.1 Hardware Settings

Figure A.37 illustrates the switch banks and jumpers used to configure the
NVC/DM. Number 1 switch or jumper pin is indicated by a small triangle
symbol in each case.

PROD
2
1
3
2
1
PSWD
3
1 8 1 8 2
OFF OFF 1
CEDVER S2
Non-Vital Maintenance Production Password

Configuration switch bank jumper jumper
Version (S2) (PROD) (PSWD)
switch bank
(CEDVER)
Figure A.37 Configuration Switches and Jumpers—NVC/DM
Jumpers
PROD Jumper
Production mode is entered by shorting pins 1 & 2 of the PROD jumper and
then restarting the NVC/DM.
PSWD Jumper
The Diagnostic Mode passwords can be changed during operation of the

NVC/DM. They can be reset to the values stored in the Non-Vital
Configuration by shorting pins 1 & 2 of the PSWD jumper and then restarting
the NVC/DM.
Note: Store the PROD and PSWD jumpers on pins 2 and 3 when the modes are
not set.
Switches
CEDVER Switch Bank
The NVC/DM uses the version number set by the CEDVER switch bank to
ensure the correct Non-Vital Configuration is stored in PROM. Switch 1 is the
least significant bit and switch ON is zero.
A-126 Invensys Rail

S2 Switch Bank
This switch bank is used for two purposes:

• putting the NVC/DM into Maintenance mode;
• setting the data transfer rate for the Production Port.
Set the switches according to table A.48 and restart the NVC/DM to activate
the desired configuration.
Table A.48 Switch Bank S2—Valid Settings—NVC/DM
Switch Setting
1 OFF for Normal mode
ON to select Maintenance Mode
2 OFF for 9600 bits per second
ON for 115200 bits per second
3–8 Not used; normally left in the OFF position
The NVC/DM will stay in Maintenance mode until switch 1 is returned to OFF
and the system is rebooted.
A.12.5.2 Non-Vital Configuration

The majority of the NVC/DM configuration is done using the GCSS and is
stored in the Non-Vital Configuration.
The Non-Vital Configuration includes:

A
• default passwords;
• initial states of non-vital logic states;
• non-vital application logic and timer details;
• Configuration details for each port, such as:
protocol;
• basic serial parameters (eg data transfer rate, handshaking);
• clock signal usage (input, output or reconstructed from data);
• protocol parameters (eg data word length, addresses, inter-scan
delay);
• default dial-out telephone numbers (diagnostic ports only);
• I/O bit mappings (telemetry ports only).
A.12.5.3 Replacing the NVC/DM

A replacement NVC/DM must be configured to suit the particular location.
Usually this means the replacement must be configured to exactly match the
NVC/DM being replaced.
Before beginning, you must:
a) Obtain permission from the Signaller and adhere to the Railway

Authority’s safety requirements;
b) Power down the WESTRACE installation.

Remove the NVC/DM from the WESTRACE Housing

a) Remove the front panel of the WESTRACE housing;
b) Observe the anti-static procedures;
c) Remove the NVC/DM from the housing using the WESTRACE card
extraction tool. See figure A.38.
Pin of extraction tool

engages hole in card
Heel of extraction tool

bears on frame
Figure A.38 Removing a Card From the WESTRACE Housing
Fit Daughter Boards
There is one daughter board for each active serial port (except the
Production port). The replacement NVC/DM must use daughter boards of
identical type and in the same locations as the removed NVC/DM. This is
defined in the local documentation.
Reverse side of
daughter board
Figure A.39 CIMFIM With Four Daughter Boards—NVC/DM
A-128 Invensys Rail

There are two types of daughter board:

• SDB232 for RS232-C communications;
• SDB485 for RS485 communications.
Working daughter boards may be swapped from the removed NVC/DM to

the replacement NVC/DM if required.
a) Separate the CIMFIM from the LEC; see figure A.40;
b) Remove and insert daughter boards as required;

Each daughter board is attached to the CIMFIM by two connectors;
Ensure that all plug pins properly mate with the sockets. It is possible to
connect the daughter boards with only half the pins actually plugged
into the socket;
c) Re-connect the CIMFIM to the LEC.
Note: Ensure that the PROD and PSWD jumpers on the LEC board are absent or
stored on pins 2 and 3.
Remove screws from

stand-offs (4) A
Disengage connector (1)
Figure A.40 Separating the LEC and CIMFIM—NVC/DM
Install the Non-Vital Configuration
There are five parts to this task:
a) Ensuring you have the right equipment;
b) Setting the Non-Vital Configuration version switches on the NVC/DM

LEC;
c) Switching the NVC/DM to Maintenance Mode;
d) Installing the NVC/DM into the housing;
e) Down loading the new Non-Vital Configuration to the NVC/DM.
SAFETY
WESTRACE must not be controlling an interlocking while downloading a
WARNING

Equipment Required
• A personal computer (PC) loaded with:
• the Graphical Configuration Subsystem (GCSS version 6 or later);
• the correct Non-Vital Configuration for the NVC/DM;
• the Installation Check System (ICS).
• A ‘standard’ cable as described in figure A.51 to connect the serial port on
the PC to the Production port on the NVC/DM LEC module.
Alternatively, a ‘maintenance’ cable as described in figure A.51 may be
used. The ‘maintenance’ cable configuration causes the NVC/DM to
automatically start in ‘Maintenance’ mode. See “Setting the Maintenance
Mode” on page A-130.
• A copy of the WESTRACE Graphical Configuration Subsystem Manual.
Setting Non-Vital Configuration version switches
The NVC/DM requires that the Non-Vital Configuration version must be that
set by the CEDVER switches. This protects against loading an incorrect
version. See figure A.41.
Set the switches on the LEC to define the Non-Vital Configuration version
specified on the GCSS printout for the Non-Vital Configuration.
Switch 1 is the least significant bit. Switch ON is zero.
For example, to set Non-Vital Configuration version 1, you set switch 1 OFF
and switches 2-8 ON. This is illustrated by figure A.41. To set Non-Vital
Configuration version 5, switches 1 and 3 are OFF, all others are ON.
Switches 2-8 ON (zero)
Switch 1 OFF (1)
Figure A.41 Non-Vital Configuration—Setting Version 1—NVC/DM
Setting the Maintenance Mode
Select ‘Maintenance mode’ either by connecting a Maintenance Cable to the

Product Port, or by setting switches 1 and 2 of switch bank S2 to ON. See
section A.12.4.1 for details.
A-130 Invensys Rail

Refitting the NVC/DM
Refit the NVC/DM into the housing. Insertion is the reverse of removal
described in “Remove the NVC/DM from the WESTRACE Housing”
(page A-128) with the exception of not replacing the front panel.
Downloading the Non-Vital Configuration

a) Connect the cable of choice between the Production Port and the PC;
see figure A.42;
b) Power up WESTRACE;
Ensure that the NVC/DM has entered Maintenance mode (the
watchdog LED should be flashing red);
c) Download the Non-Vital Configuration according to the instructions in

the WESTRACE Graphical Configuration Subsystem Manual.
Figure A.42 Production Port—Connecting—NVC/DM
Verify the Data
The Non-Vital Configuration must be verified before the system is returned to

service.
a) Ensure the NVC/DM is in maintenance mode and the PC is connected

to the NVC/DM Production Port;
b) Run ICS according to the instructions in the WESTRACE Installation

Check System Manual;
c) Complete procedural checking and sign off as per the WESTRACE

Installation Check System Manual.
Restore the System
When the Maintenance Cable was used to set Maintenance Mode

b) Remove the cable from the Production Port;
c) Refit the front panel to the housing(s);
d) Power up WESTRACE;

e) Allow WESTRACE to run for several minutes; ensure that no fault codes
are displayed;
f) Advise the Signaller of completion.
When Switch Bank S2 was used to set Maintenance Mode

b) Remove the NVC/DM from the housing;
c) Set switch 1 of switch S2 to OFF (Maintenance Mode OFF). See

figure A.37;
d) Refit the NVC/DM into the housing. Replacement of the NVC/DM is the
reverse of the procedure described in “Remove the NVC/DM from the
WESTRACE Housing” on page A-128;
e) Refit the front panel to the housing(s);
f) Power up WESTRACE;
g) Allow WESTRACE to run for several minutes; ensure that no fault codes
are displayed;
h) Advise the Signaller of completion.

A lithium battery is used to maintain logged data in non-volatile memory and
the real-time clock when the NVC/DM is powered down. The battery has a
very long life and in normal circumstances it is unlikely to require
replacement. The NVC/DM is usually shipped with the battery connected.
To replace the battery:
a) Have a replacement battery of the same type as the original plus cable
ties readily at hand. See figure A.43;
b) Snip the cable ties holding the old battery to the printed circuit board;
c) Remove the battery lead from the pins;
d) Connect the replacement battery to the pins. You have a short period to
do this before data is lost;
e) Fix the replacement battery to the circuit board using the new cable ties;
f) Snip off the excess length of cable ties.
Figure A.43 Lithium Battery—NVC/DM
A-132 Invensys Rail

A.12.6 Indications
The ‘user interface’ of the NVC/DM comprises LEDs and a four digit
Internal Fault LED

2{
3{
D1 D2 D3 D4
Tx & Rx LEDs
4{ Alphanumeric Fault display
for serial ports
2–7 5{
6{
7{ Watchdog LED
Not used {
Power indicator Production port
A
Communications
Interface Module
Filter & Interface Module Logic Evaluation Card (LEC)
(CIMFIM)
Figure A.44 User Interface—NVC/DM
A.12.6.1 Logic Evaluation Card LEDs

The LEC has two front panel LEDs:
• Internal fault LED (red)—illuminated whenever there is a non-fatal internal
NVC/DM fault. These faults require attention, but are not serious enough
to cause the NVC/DM to shutdown;
• Watch dog LED (normally green)—flashes at a regular interval if all is well
with the NVC/DM. During the first minute or so of operation, the LED may
flash at a faster than normal rate. It should then flash at the same rate as
the green watchdog LED on the VLM.
This LED flashes red when the NVC/DM is in Maintenance mode.

A.12.6.2 Communications Interface Module LEDs

The CIMFIM has 13 front panel LEDs:
• Transmit LED (yellow)—for each of the 6 serial ports. Flashes when data is
transmitted;
• Receive LED (green)—for each of the 6 serial ports. Flashes when data is
received;
• Power Indicator LED (green)—indicates the +24 V comms power supply is
present.
See section A.12.6.5 for further information about these indicators.
A.12.6.3 Alphanumeric Display

The alphanumeric display can only show one fault at any time. However, all
fault codes which occur are logged by the NVC/DM and can be examined
using external diagnostic equipment.
Shutdown Mode
The alphanumeric display will show the applicable fault code if the NVC/DM
shuts down because of a fatal internal fault. See table A.55.
Normal Mode
Within the first 12 seconds of the NVC/DM operating in this mode, the
alphanumeric display will show start-up information (see section A.12.6.4)
and then it will be blank unless a fault is detected.
During operation, a ‘non-fatal’ fault may occur which will cause the NVC/DM
to display a fault code but continue to operate. In the event of multiple faults
being present simultaneously, the NVC/DM will display the code for the first
of the following that applies:
a) ‘TIME’ if the NVC/DM real time clock has not been set;
b) a non-fatal NVC/DM internal fault code, see table A.56;
c) a port fault code (lowest numbered port take precedence), see table
A.51;
d) an S2 address fault code (lowest numbered S2 address takes

precedence), see section A.12.6.7.2);
e) ‘FLT ’ where one or more WESTRACE system faults have not been
uploaded by the external diagnostic equipment;
f) ‘BAT ’ if the NVC/DM battery voltage is low.
Maintenance Mode
The alphanumeric display will show the following when the NVC/DM is in this
mode:
• blank display when ready to download a new Non-Vital Configuration;
• progress messages during and after a Non-Vital Configuration download.
A-134 Invensys Rail

Production Mode
The alphanumeric display will show the following when the NVC/DM is in this
mode:
• ‘Prd ’ when ready to download new firmware;
• progress messages during and after a firmware download.
A.12.6.4 Start Up
The alphanumeric display shows a sequence of information (in hexadecimal)
during start-up:
Table A.49 Start-up Display Sequence—NVC/DM
Time after
Start-up Information Details
0–4 secs Ignore.
4–6 secs. Lamp test All segments/dots illuminate to verify they
are functional.
6–9 secs. Backplane address Display shows ‘A hh’ where ‘hh’ is the
backplane address of the slot holding the
Logic Evaluation Card (LEC).
9–12 secs. Software version Display shows ‘V hh’ where ‘hh’ is the
version number of the NVC/DM software.
A.12.6.5 Operation
A
A correctly operating NVC/DM will show the following:
Table A.50 Normal Operation Indicators—NVC/DM
Indicator Condition
Internal Fault LED Off
Alphanumeric display Blank
Watchdog LED Regularly flashing green
Serial Rx LED(s) Flashes green when the NVC/DM is receiving
messages though the associated serial port.
message is addressed to the NVC/DM.
Serial Tx LED(s) Flashes yellow after the NVC/DM has transmitted a
message through the associated serial port.
Power Indicator Steady green
Note: The watchdog LED flashes red when the NVC/DM is in Maintenance
mode.
The Rx and Tx LEDs may appear to be ON rather than flashing for high
data rates.

A.12.6.6 Fault Detection
A.12.6.6.1 WESTRACE Module Faults
During the first 16 seconds after power up, all WESTRACE modules display in
sequence via their diagnostic LEDs:
• software version;
• the value 00 (all LEDs off) to indicate ‘no fault’.
During operation, each module will generate a non-zero fault code if a fault
is detected.
The NVC/DM polls each module in turn to read this information, and will
record any changes. These changes are stored in the order that they are read,
which may not necessarily be the order in which they occurred.
A.12.6.6.2 NVC/DM Faults
In the event of an internal NVC/DM fault, the NVC/DM will either:

• display a code on the alphanumeric display, log a fault, and continue
operating. This action is taken for ‘non-fatal’ faults (such as a comms port
failure, low battery, or date/time not set), which do not compromise safe
operation of the NVC/DM;
• force a reset of the NVC/DM hardware. This action is taken if the NVC/DM
software or hardware appears to be malfunctioning. A fault will be logged
when the system restarts.
In many cases, the restart will clear the fault and the NVC/DM will resume
normal operation.
When an internal fault is the cause of an NVC/DM restart:
a) the NVC/DM will temporarily lose communications with the VLM;
b) the VLM will display a fault code (typically 34h) because of the
communications loss but the VLM will keep running because the
NVC/DM is a non-vital module.
This VLM fault code will persist even after communications between the VLM
and NVC/DM are returned to normal. The only way to clear the fault code is
to restart the WESTRACE system.
If a second fault occurs within the first minute of operation after an NVC/DM
restart:
a) the NVC/DM will conclude that the fault is permanent;
b) the NVC/DM will shutdown and display a fault code on the

At this point, all NVC/DM communications ports are disabled and will stay
that way until WESTRACE is restarted.
A-136 Invensys Rail


The alphanumeric display comprises four digits; D1, D2, D3 and D4 reading
from top to bottom on the display. See figure A.44. Figures A.45 to A.48 show
the alphanumeric display being read left to right where the left position
corresponds with the top position in figure A.44.
D1 D2 D3 D4
Figure A.45 Four Digit Alphanumeric Display—NVC/DM
The hexadecimal numbers shown by this display identify the following:

• the class of fault (internal NVC/DM fault, port fault, or an S2 address fault);
• the port number or S2 address as appropriate;
• a code identifying the fault.
Digit D1 is dedicated to identifying a port. The other three (D2–D4) are

shared between identifying an S2 address and providing a fault code.
The tables below show a value for each digit but in some instances the value
can vary. In those cases, the value of the digit is represented by a mnemonic
as follows:
p
mm
port number (hex)
S2 address (hex)
A
f fault code (hex)
A.12.6.7.1 Port faults

Digit D1 identifies the faulty port. Digits D2 and D3 are set to zero and digit
D4 is the fault code.
p 0 0 f
Port number (2-7 hex) Fault code (0,1 hex)
Figure A.46 Alphanumeric Display—Port Fault—NVC/DM

For example, 8001 indicates a fault code 1 on port 8. The table below shows
valid port fault codes.

Table A.51 Fault Codes—Port Codes in General—NVC/DM
CODE (H) FAULT DESCRIPTION ACTION

p001 Port time out Serial Rx LED flashing:
Timeout (10s) when waiting for an incoming • check the serial port configuration in Non-Vital
message (slave port). Configuration;
• replace the NVC/DM if the configuration is
The range Failure to get a response (within 10s) from any
correct.
for p is 2 to external slave (master port).
7. Serial Rx LED off:
• check the comms link cabling and connections;
• replace the protection module, the related
daughter board or the NVC/DM.
8001 VLM port time-out. It is normal for this code to be displayed if the VLM
shuts down for any reason.
Try the following if this code is on display and the
VLM is still running:
a. Restart WESTRACE.
b. Check to ensure the VLM and NVC/DM CEDs
are consistent with respect to transfer states
passed between them. Normally GCSS ensures
that this is the case.
c. Check to ensure that only one NVC/DM and no
DM is installed.
d. Replace the NVC/DM.
Other Port Codes
This code is not displayed. It is reported in the fault log only.
Table A.52 Fault Codes—Port Codes—Other—NVC/DM
CODE (H) DESCRIPTION

p000 The port p has recovered and is now operational.
A.12.6.7.2 Telemetry Address Faults
NVC/DM telemetry ports can appear as a range of S2 addresses.
The NVC/DM reports on faults for connected S2 addresses. The fault code is
interpreted from the alphanumeric display as described here.
An address fault indicates:

• slave port— no messages for this particular address have been received
from the S2 office;
• office port— no response has been received from the S2 field station at this
particular address.
These should not be confused with port faults, which indicate no messages at
all are being received at a particular port.
Digit D1 identifies the port to which the S2 address is connected. Digits D2

and D3 identify the S2 address, and digit D4 is the fault code.
A-138 Invensys Rail

p m m f
}
Port number (2-7 hex) Fault code (8,9 hex)
S2 address (00-3F hex)
Figure A.47 Alphanumeric Display—S2 Address Fault—NVC/DM
For example, 21B9 indicates a fault code 9 on the S2 address 1B (33 octal)
connected to telemetry port 2.
The table below shows valid S2 address fault codes.
Table A.53 Fault Codes—S2 Address—NVC/DM

pmm9 Communication to an S2 address has timed out. Slave port
Slave port—timeout when waiting for a valid Check that the telemetry master is sending data to
message addressed to address mm (hex) on port p this address. (Use S2 test link or similar.)
(hex).
Check the addresses stored in the Non-Vital
Master port—timeout waiting for a valid response Configuration to see if they match the addresses
from the S2 field address mm (hex) on port p (hex). sent by the office.
Master port
Check that the slave at this address is functioning
correctly. (Use S2 test link or similar.)
Check that the addresses stored in the Non-Vital
Configuration match those of the field stations.
A
Other Telemetry codes
This code is not displayed. It is reported in the fault log only.
Table A.54 Fault Codes—Telemetry—Other—NVC/DM
CODE (H) FAULT DESCRIPTION

pmm8 S2 address mm (hex) on port p (hex) has recovered from a fault and is now operational.
A.12.6.7.3 Internal faults
Three digits (D2–D4) show the fault code (000–FFF) as defined by the tables
below. Digit D1 is always blank.
f f f
}
Fault code (000-FFF hex)
Figure A.48 Alphanumeric Display—Internal Fault—NVC/DM
The first action should be to restart WESTRACE. Next, find the displayed fault
code in the tables below and take the recommended action. All of these fault
codes, plus any read from the fault latches of other WESTRACE modules are
logged to the NVC/DM fault buffer in the order they are detected by the
NVC/DM.

Fatal NVC/DM Fault Codes
These faults cause the NVC/DM to restart. If the fault persists, the NVC/DM
will shut down.
Table A.55 Fault Codes—Fatal—NVC/DM

003 Application Checksum Error Replace NVC/DM
004 Stack Guard Band Error ”
005 RAM Error ”
009 Stack Error ”
080 Non-Vital Configuration checksum error Download new Non-Vital Configuration
084 Non-Vital Configuration version number error Confirm that the version switches are correctly set.
If the switches are correct, download new Non-
Vital Configuration.
100 Build error Download new Non-Vital Configuration
101 Out of memory Replace NVC/DM
102 Operating system error ”
103 Internal error ”
104 Task suspended ”
105 NVRAM error ”
107 Comms buffer error ”
108 Non-Vital Configuration format version error Download new Non-Vital Configuration
109 Watchdog restart Replace NVC/DM
10A No VLM Non-Vital Configuration copy Restart WESTRACE
10B Wrong VLM Non-Vital Configuration copy ”
10C VLM interface versions mismatch Check the NVC/DM and VLM Non-Vital
Configuration versions.
10D VLM address mismatch Check the NVC/DM Non-Vital Configuration and
WESTRACE installation details
10E IMB data error Replace NVC/DM. Could also be a faulty

backplane or VLM.
10F Wrong IMB slot Move NVC/DM to the correct backplane slot
111 Timing error Replace NVC/DM
A-140 Invensys Rail

Non-fatal NVC/DM Fault Codes

Table A.56 Fault Codes—Non-fatal—NVC/DM

BAT Low battery Replace battery
FLT There are faults in the fault buffer that have not yet Request faults from the fault buffer through
been requested by an external diagnostic system. MovioaW.
F11 Main cycle not synchronized Check the NVC/DM and VLM CEDs.
(NVC/DM cannot keep up with VLM.)
F21 Software version number lost Replace NVC/DM
F22 Module information error ”
F23 Fault bus error ”
F24 Fault detection NVRAM error ”
TIME Time has not been set Set correct time through MoviolaW, CTC or Getlog.
It is possible to set the time via the S2 protocols.
DIAG There are faults stored in the Fault Buffer. Connect or check and restart an external diagnostic
system and request the fault codes from the Fault
Buffer.
Other NVC/DM Codes
The following codes are not displayed. They are reported in the fault log only.
Table A.57 Fault Codes—Other—NVC/DM
CODE (H) FAULT DESCRIPTION

A
F00 Recovered from low battery condition.
F01 Low battery (corresponds to ‘BAT ’ display).
F10 Recovered from VLM out-of-sync error.
F30 Time has been set, i.e. an invalid time/date error has been corrected.,
F31 Date/time not set (corresponds to ‘TIME’ display).

Diagnostic or telemetry connection
Telemetry connection only
Not used
Serial (B24) Power Connector
Figure A.49 External Connectors—CIMPM Card—NVC/DM
A.12.7.1 Serial Power Connector

Connection to the serial power interface is via a Klippon removable screw
terminal plug with the following connections:
Table A.58 Serial Power Pinout—NVC/DM
Pin Number Signal

1 +24V
2 Common (0V)
3 Not used
A.12.7.2 Diagnostic and Telemetry Serial Connectors

Each serial interface is a male DB9 connector configured as either RS232 or
RS 485. Figure A.49 shows all 7 DB9 connectors. Connector 1 is not used at
present.
A-142 Invensys Rail

RS232-C Connection
Table A.59 DB9 Pinout—RS232 Connection—NVC/DM

3 TxD NVC/DM
4 DTR NVC/DM
5 ISOGND (Common)
6 CLKOUT NVC/DM
7 RTS NVC/DM
RS485 Connection
Table A.60 DB9 Pinout—RS485 Connection—NVC/DM

3
4
TxD+
TxD–
NVC/DM
NVC/DM A
5 ISOGND (Common)
6 CLKOUT+ NVC/DM
7 CLKOUT– NVC/DM


This port is a male DB9 connector on the front edge of the card (see
figure A.50). Signal levels are to RS232-C standard and the connector pinout
is shown in table A.61. This port is only enabled when the NVC/DM is in
Maintenance mode.
Figure A.50 Production Port—NVC/DM
Table A.61 DB9 Pinout—Production Port—NVC/DM
Pin Number Signal Comment

1 N/C
2 RxD input
3 TxD output
4 N/C
5 Common
6 N/C
7 RTS output Always active
8 MAINT input Selects maintenance mode
9 SPEED input Selects maintenance mode
data transfer rate

A cable with any of the configurations in figure A.51 will allow a personal
computer to connect to the:
• production port (a DB9 connector on the front edge of the LEC);
• diagnostic port (a DB9 connector at the rear of the housing).
The interconnection of pins 7, 8 and 9 on the Maintenance cable has no effect

when the cable is connected to a Diagnostic port. When the cable is plugged
into the Production port, the interconnection makes the NVC/DM switch to its
Maintenance mode of operation and selects the 115 kbps data transfer rate.
A-144 Invensys Rail

Production or Diagnostic Port Personal Computer

Pin Pin
2 3
3 2
5 5
Standard
Cable Production or Diagnostic Port Personal Computer
Pin Pin
2 2
3 3
{
5 7
Production Port
DB9 Female
Pin
}
Maintenance 2 Connections
Cable 3 as above
5
Pins 7, 8 & 9
interconnected
at this end
{ 7
8
9
Figure A.51 Cable Configuration Details—NVC/DM
A.12.7.5 Connecting a Diagnostic System

Most WESTRACE installations will have a permanently connected MoviolaW.
Some installations allow remote access via Hayes compatible modem.
A
Types of Diagnostic System
Two diagnostic systems are available:

• MoviolaW—a Microsoft Windows based user friendly utility;
• Real time graphical display of the state of the interlocking;
• Records for later playback, events (logic state changes) which occur
after MoviolaW commences running;
• Extraction of historical fault information from an NVC/DM (although
not historical event or operation information);
telemetry statistics;
• GETLOG—a command line driven utility;
• Extraction of historical and real time event, fault and operation
information which is displayed and stored in text form;
telemetry statistics;
• More straight forward to install and configure than MoviolaW;
• Can support larger systems than can MoviolaW.

Requirements
You will need:

• A personal computer (PC) loaded with MoviolaW or GETLOG;
• The MoviolaW display files for the particular installation;
For GETLOG, it is useful to have the Non-Vital Configuration image (.img)
files for the installation;
• The passwords for accessing the particular NVC/DM;
For MoviolaW, the passwords for a particular NVC/DM are stored in the
MoviolaW .ini file, and are configured using the MoviolaW NVC/DM
driver software;
For GETLOG, the password must be specified on the command line;
• A cable to connect the serial port(s) on the PC and the Diagnostic port.
See figure A.51;
• The user manual for the chosen diagnostic system.
Procedure
a) Connect the PC to a configured diagnostic port at the rear of the
housing. See figure A.49 and refer to the local documentation;
b) Start up the chosen diagnostic system;
c) Follow the guidelines for fault finding.
A-146 Invensys Rail

A.13 Non-vital Communications Module (NVC)
A.13.1 Description
The NVC module is a serial data link interface for communication with a local,
or remote non-vital control system.
The module communicates synchronous serial data using the WESTRONIC

S2 communication protocol. It is normally used to receive controls and return
indications to a remote control centre, typically a CTC system. It would either
be interfaced to a digital circuit, or to an analogue line using an appropriate
modem. It may also be used to interface to a local panel. The NVC operates
as a slave device on a master/slave communication regime. It is set with a
unique slave address and will only act on data that matches this setting. It will
then respond with indication status as defined in the application logic.
The S2 protocol allows S2 fields and WESTRACE NVC modules to

communicate on a single communication bearer. NVC modules with tri-state
communications output to the bearer using tri-state circuits, and are enabled
only when required to place signals on the bearer.
Appropriate bearer interface arrangements must be used where multiple

systems are connected to a single bearer. Appropriate tri-state NVC modules
must be used.
A
A.13.2 Particulars
The NVC is comprised of a single printed circuit board. The circuit board has
configuration DIP switches which are used to select the NVC’s slave address,
data transfer rate, data word length and other configuration parameters.
A.13.3 Function
The NVC derives power for its communication circuits from an external
24 Vdc supply. This power supply may be provided by either the OPC (as part
of the VLM) or by another source, depending upon the application. Removal
of this voltage positively prevents the NVC from transmitting and receiving
data.
The NVC is processor based and it interfaces with the VLM. It performs the
self-testing and housekeeping functions for the module.
Clock Reconstruction
NVC modules with clock reconstruction should be used when there is no

external clock signal (RxC) available. NVC modules capable of clock
reconstruction can internally generate the clock signal from received data.
The clock signal may be used for communication without using a modem.
Supplying an external clock signal, if available, to an NVC module (without

clock reconstruction) will normally provide superior performance. Also see
section A.13.4.7.

Configuration of the NVC is achieved by the setting of the two switch banks
shown below. Refer to the WESTRACE NVC module configuration in the
system schematics for the particular WESTRACE installation.
Figure A.52 Configuration Switches—NVC
A.13.4.1 Slave Address

The module’s S2 address is configured by SW1/1 to SW1/6 (WAD0–WAD5)
where WAD5 is the most significant bit of the 6 bit address, eg for an address
of 21 octal the switches are set as follows:
Where: On = 0
Off = 1
Figure A.53 Slave Address—Setting—NVC
The example shown above from WAD5–WAD0 gives 010 001 (21 octal, or 17
decimal).
A.13.4.2 System Bit

The system bit switch is used to determine in which telemetry system the NVC
is operating. This facility is configured by SW1/7 (System). The system bit is a
logical 1 when this switch is On.
A.13.4.3 Telfail
The Telfail switch is used to determine whether a telemetry failure indication
will be passed from the NVC to the VLM for processing by the Application
Data. This facility is configured by SW1/8 (Telfail). Telfail processing is
required when this switch is On.
A-148 Invensys Rail

Note: Do not use control bit 0 (zero) for an application when the Telfail switch
is set to On. The NVC automatically sets this bit in response to a failure to
transmit or receive data.
The NVC will output a frame if not correctly addressed within a 30 second
period.
A.13.4.4 Data Transfer Rate

The data transfer rate is configured by SW2/1 to SW2/3. The switches enable
selection of different data transfer rates depending upon the telemetry
system configuration. The switches are set as follows:
Table A.62 Data Transfer Rate—Setting—NVC
Data Transfer Rate BRD0 BRD1 BRD2

(bits per second) SW2/1 SW2/2 SW2/3
600 On On On
1200 Off Off Off
2400 On Off Off
4800 Off On Off
All other configurations are illegal.
NVC232 and NVC422 modules which offer clock reconstruction are fitted
A
with daughter boards which must also be configured for data transfer rate.
The daughter board links are positioned as shown by figure A.54. The data
transfer rate selection is made according to the illustration.
Figure A.54 Clock Reconstruction Daughter Board—NVC

A.13.4.5 Data Word Length

The data word length is configured by SW2/4 to SW2/5 (DWL0–DWL1). These
switches enable selection of different data word lengths depending upon the
telemetry system configuration.
The switches can be set as follows:
Table A.63 Data Word Length—Setting—NVC
DWL0 DWL1
Data Word SW2/4 SW2/5
64 Off Off
32 On Off
48 Off On
128 On On
S2 systems are typically set to 64 bit data word length.
A.13.4.6 Modem
The modem switch is used to determine whether modem handshaking is
required. This facility is configured by SW2/6 (modem). Modem handshaking
is required when this switch is On.
A.13.4.7 Transmit Data Clock

The source of the transmit clock can be selected by setting the Ext1 switch on
SW2 thus:
Switch Position 7 = OFF Internal clock—transmit data clock is internally
generated without reference to received signals.
Typically when NVC is connected to a modem.
Switch Position 7 = ON External clock—used when interfacing to carrier

communication systems that require
synchronised clocks for both transmitted and
received data.
The NVC takes an external receive data clock and

generates both the transmit data clock and the
transmit data from it.
Applies to:
• NVC 422 (modem) module (3650 1139 10)
Issue 1.3 and later;
• NVC 422 (no modem) module
(3650 1139 11) Issue 2.0 and later.
A.13.4.8 Unused
Ext2 switch on SW2 is not used by the NVC and should be set Off.
A-150 Invensys Rail

A.13.5 Indications
A.13.5.1 Start Up
Diagnostic LEDs display the module type code, followed shortly by a
There are four additional LEDs on the NVC. They are used to indicate correct
operation of the telemetry. The telemetry is connected to serial channel A;
serial channel B is not used. There is one LED for transmit and one for receive.
These LEDs are labelled on the PCB as TxDAI and RxDAI respectively.
A.13.5.2 Operation
When the NVC is receiving valid SDLC telemetry messages, the RxDAI will
flash for 20 to 30 milliseconds. This LED will flash irrespective of whether the
telemetry message is addressed to the NVC.
The NVC will transmit an indication message when it receives a valid SDLC
telemetry message with an address that matches the address set by the
switches WAD0–WAD5. A
After the message is sent, the NVC flashes the TxDAI LED for 20 to 30
milliseconds.

Table A.64 Fault Codes—NVC

02 Module Type Error Replace NVC
05 RAM Error ”
09 Stack Error ”
0D Run Time Error D Replace NVC

Table A.64 Fault Codes—NVC (Continued)

32 ST IMB Too Few IMB Calls Replace NVC
80 Illegal data transfer Rate Configuration Check data transfer rate switches
A-152 Invensys Rail

A.13.6.1 RS232-C Connections

Figure A.55 External Connections—SIO232 PFM—NVC

A
Table A.65 DB25 Pinout—SIO232 PFM—NVC
Pin Function
1 Chassis Ground
17 Receive Clock (RxC)
24 Transmit Clock (TxC)
This module communicates using RS232-C and is configured as a DTE.
A.13.6.2 RS422 Connections

The SIO422 PFM External Connectors are a 14 way ribbon header for RS422
interface, and a 2 Way plug and socket Klippon type BLA/SLA for power.

Figure A.56 External Connections—SIO422 PFM—NVC
Figure A.57 and table A.66 show the RS422 pin numbering.
Figure A.57 RS422 Connector Pin Numbering—SIO422 PFM—NVC
Table A.66 14-Way Ribbon Header Pinout—SIO422 PFM—NVC
Pin Function
1 0 Volts (O V)
2 Received Clock + (RxC +)
3 Received Clock - (RxC -)
4 Transmit Clock + (TxC +)
5 Transmit Clock - (TxC -)
7 Not Used
8 Transmit Data + (TxD+)
9 Transmit Data - (TxD-)
10 Receive Data + (RxD+)
11 Receive Data - (RxD-)
14 0 Volts (O V)
A-154 Invensys Rail

A.14 Diagnostic Module (DM)
A.14.1 Description
The is DM used with older VLM modules. It comprises a single printed circuit
board and provides two user interfaces, the Technician Interface, and the
Event Recorder Interface.
A.14.2 Particulars
Both interfaces are RS232 compatible, and may connect to a dumb terminal.
The Event Recorder interface permits the recording of all change of state
information and may optionally be connected to a serial storage device or
printer. The Technician Interface permits the user to interrogate the VLM’s
logic states, and display system data pertaining to the particular installation.
Only one DM module can be installed in a system. Its position is allocated by

the GCSS or CSS to slot 15 in housing 1.
A.14.3 Function
The DM permits the user to interrogate the WESTRACE system via the
Technician Interface. The operation of the Technician Interface is defined in
Appendix B. The Event Recorder Interface permits all change of state
A
information relating to the WESTRACE installation to be recorded.
The DM is capable of storing up to 800 prior change of state events, and the
most recent module faults in battery-backed non-volatile RAM. The DM has
its own Real Time Clock for time and date stamping of events and faults. The
time and date are set via the Technician Interface.
The DM does not require external power for communications.
The DM is processor based and it interfaces with the VLM. It performs the self-
testing and housekeeping functions for the module.
A.14.4 Operation
During the power up initialisation period following a system reset (and
provided no faults are detected), a WESTRACE module writes the following
data to its fault code latch:
• software version number;
• clear fault code values.
The DM polls each module in turn to read this information and it only stores
changes to the information. The DM stores the changes it sees first, and since
it polls each of the WESTRACE modules in turn, the stored change may not
be the first that occurred. In other words, changes recorded in one cycle are
in the order they were read, not necessarily the order in which they occurred.

For full details of the configuration applicable to this installation, refer to the
folders in the Signalling Equipment Room.
Configure the module for the installation using the configuration switch SW1.
Figure A.58 Layout—DM Module
Figure A.59 Configuration Switch—DM Module

The data transfer rates for the Event Recorder interface and the Technician
Interface are configured by SW1/1 and SW1/2. These switches are set as
follows:
Technician Interface Data Transfer Rate
1200 SW1/1 Off

4800 SW1/1 On
Event Recorder Interface Data Transfer Rate
1200 SW1/2 Off

4800 SW1/2 On
All other switches are not used by the Diagnostic Module and must be set to
Off.
A-156 Invensys Rail


A battery is used to maintain data in non-volatile memory during normal
operation. The DM is shipped with the battery disconnected so the link
adjacent to the negative terminal of the battery (Link 17) must be fitted before
the System is powered up.
To prolong battery life, Link 17 should be removed when the unit is taken out
of service and put into storage, but only after any data has been extracted.
A.14.6 Indications
A.14.6.1 Start Up
Ignore the Red LED that is near the green Watchdog LED.
A.14.6.2 Operation A
Ignore the RED LED that is close to the green Watchdog LED.

None

External Connections to the DM are made via the SIO232PFM for the Event
Recorder and via the front of the DM module for the Technician Interface.
A.14.7.1 Event Recorder Interface

interface, and a 2 way plug and socket Klippon type BLA/SLA (not used).

Figure A.60 External Connections—SIO232 PFM—DM Module
Table A.67 DB25 Pinout—Event Recorder Interface—SIO232 PFM—DM Module
Pin Function
Signal
1200 bits/s or 4800 bits/s. It comprises 1 start bit, 7 data bits, 1 parity bit,
A.14.7.2 Technician Interface

The Technician Interface is a DB25 connector on the front edge of the DM
module.
Table A.68 DB25 Pinout—Technician Interface—DM Module
Pin Function
Signal

A cable with one of the following configurations will allow the connection of
a personal computer to either the technician interface or the event recorder
interface.
A-158 Invensys Rail

Diagnostic Module Personal Computer

Pin Pin
2 3
3 2
7 7
Diagnostic Module Personal Computer

Pin Pin
2 2
3 3
7 5
Figure A.61 Interface Cable Configuration—DM Module

A.15 Diagnostic Module 128 (DM128)
A.15.1 Description
The DM128 is used with the Hot Standby Vital Logic Module (HVLM128). It
comprises a single printed circuit board and provides two user interfaces, the
Technician Interface, and the Event Recorder Interface.
A.15.2 Particulars
Both interfaces are RS232 compatible, and may connect to a dumb terminal
or a personal computer running MoviolaW. The Event Recorder interface
permits the recording of all change of state information and may optionally
be connected to a serial printer or other RS232 device. The Technician
Interface permits the user to interrogate the HVLM128’s logic states, and
display system data pertaining to the particular installation.
Only one DM128 module may be installed in a system. Its position is pre-
allocated to slot 15 in housing 1.
A.15.3 Function
The DM128 permits the user to interrogate the WESTRACE system via the
Technician Interface. The operation of the Technician Interface is defined in
Appendix B. The Event Recorder interface permits all change of state
information relating to the WESTRACE installation to be recorded.
The DM128 is capable of storing up to 8030 previous change of state events,

and the most recent module faults in battery-backed non-volatile RAM. The
DM128 contains its own Real Time Clock for time and date stamping of
events and faults. The time and date are set via the Technician Interface.
The DM128 does not require external power for communications.
The DM128 is processor based and it interfaces with the HVLM128. It

performs self-testing and housekeeping functions for the module.
A.15.4 Operation
During the power up initialisation period following a system reset (and
provided no faults are detected), a WESTRACE module writes the following
data to its fault code latch:
• software version number;
• clear fault code values.
The DM128 polls each module in turn to read this information and it only
stores changes to the information. The DM128 stores the changes it sees first,
and since it polls each of the WESTRACE modules in turn, the stored change
A-160 Invensys Rail

may not be the first that occurred. In other words, changes recorded in one
cycle are in the order they were read, not necessarily the order in which they
occurred.
The DM128 is fitted with links or switches as depicted in figure A.62 (later
modules have only soldered links preset to 4800 bps).
Configure the module for the installation using:

• links — if switch SW1 is not fitted;
• switches — if switch SW1 is fitted.
Figure A.62 Layout—DM 128
SW1 LINK (Resistor)
ON 14 In
1
Equivalent
ON 15 In
2
connections
OFF and 16 Not in
3
settings
OFF 17 Not in
4
OFF ON
Figure A.63 Links or SW1 Switches—Default Settings—DM128
The SW1 switches 1, 2, 3, and 4 are connected in parallel with the links LK14,
LK15, LK16 and LK17, respectively. If a module is fitted with SW1 switches,
always use the switches in preference to the links. A switch ‘On’ corresponds
to a link ‘In’.
For full detail of the configuration applicable to an installation, refer to the

folders in the Signalling Equipment Room. The default settings for the links
LK14, LK15, LK16 and LK17 parallel to the power supply are described in the
sections that follow. Although links are described, use the equivalent
switches (see figure A.63) if SW1 is present.


The data transfer rates for the event recorder interface and the technician
interface are configured by LK14 and LK15. The links are set as follows:
Table A.69 Data Transfer Rate—Setting—DM128
Data Transfer Rate LK14 LK15

1200 bps Out Out
2400 bps In Out
9600 bps Out In
4800 bps (default) In In
A.15.5.2 Mnemonic Selection Default

The language used by the DM128 is configured by LK16. The link is set as
follows:
Table A.70 Mnemonic Language—Setting—DM128
Printed / Displayed LK16

Mnemonic Names (default) Out
Mnemonic Numbers In
A.15.5.3 Command Echo Default

The echoing of commands by the DM128 is configured by LK17. The link is
set as follows:
Table A.71 Echo Command—Setting—DM128
Commands LK17
Echo Commands (default) Out
Commands Not Echoed In

A battery is used to maintain data in non-volatile memory during normal
operation. The DM128 is shipped with the battery disconnected so LK18
(operate/ship jumper) must be moved to the ‘operate’ position before the
system is powered up.
To prolong battery life, LK18 should be moved to the ‘ship’ position if the
module is to be taken out of service and put into storage, but only after any
data has been extracted.
Dual battery plugs are provided so that the data in non-volatile memory is
maintained while changing the battery. The replacement battery should be
fitted to the second battery plug before removing the original (flat) battery.
This will ensure power is always available to the non-volatile memory.
Caution: Do not leave both batteries connected for any longer than necessary to
affect the change or you might reduce the life of the new battery.
A-162 Invensys Rail

A.15.6 Indications
A.15.6.1 Start Up
None.
A.15.6.2 Operation
Ignore the red LED that is close to the green Watchdog LED.

None

External Connections to the DM128 are made via the SIO232PFM for the
Event Recorder and via the front of the DM module for the Technician
Interface.
A
A.15.7.1 Event Recorder Interface
interface, and a 2 way plug and socket Klippon type BLA/SLA (not used).
Figure A.64 External Connections—SIO232 PFM—DM128

Table A.72 DB25 Pinout — Event Recorder Interface — SIO232 PFM—DM128
Pin Function
Signal
1200 bits/s or 4800 bits/s. It comprises 1 start bit, 7 data bits, 1 parity bit,
A.15.7.2 Technician Interface

The Technician Interface is a DB25 connector on the front edge of the DM
module.
Table A.73 DB25 Pinout—Technician Interface—DM128
Pin Function
Signal

A cable with one of the following configurations will allow the connection of
a personal computer to either the technician interface or the event recorder
interface.
A-164 Invensys Rail

A
Figure A.65 Interface Cable Configuration—DM128

A.16 Power Supply Unit (PSU)
A.16.1 Description
The PSU converts the incoming 24 V supply to the voltage levels required for
by all WESTRACE modules.
A.16.2 Particulars
The PSU comprises a single printed circuit board.
A.16.3 Characteristics of PSU 24

Input Voltage Range 20–30 Vdc
Output Voltages as shown:
+ 5 Vdc @ 5 A max
+12 Vdc @ 0.5 A max
−12 Vdc @ 0.5 A max
+12 V Power @ 2.5 A max
Only one PSU can be installed per system housing, however additional PSUs
may (optionally) be installed in other housings in multiple housing
installations.
The PSU has a pre-assigned position on the VLE backplane. All other
positions are occupied by other modules or blanker cards.
A.16.4 Function
The PSU generates the internal power supply voltages, and contains the
System Reset line for other VLE modules.
The PSU is not processor based and therefore does not perform self-tests and
does not participate in Health Monitoring functions.
The absence of any voltage, or a departure from the voltage specification will
lead to the system reset line becoming active which will force a system reset.
None
A-166 Invensys Rail

A.16.6 Indications
The PSU contains five red LEDs, which indicate the presence of the input and
output voltages. All LEDs should be illuminated when power is applied to the
system.
Figure A.66 Power Indicator LEDs—PSU

A.17 Protection and Filter Modules (PFMs)
A.17 Protection and Filter Modules (PFMs)
A.17.1 Description
PFMs are used to isolate the clean internal WESTRACE environment from the
‘dirty’ external electrical environment by providing screening, filtering and
overvoltage protection.
The WESTRACE housing must be fully enclosed and earthed to protect the
internal environment from external EMI. Inputs to the system, and outputs
from the system have to pass through this barrier so an input/output module
specific PFM is used to isolate WESTRACE from external interference. By
screening incoming and outgoing signals in this way, the effects of
conducted EMI are considerably reduced.
As the PFM is a vital module. PCB tracks are arranged so that short circuits
between adjacent tracks will not cause a wrong side failure.
None.
A.17.3 Indications
None.
A-168 Invensys Rail

A.18 VLE Backplane
A.18 VLE Backplane
A.18.1 Description
The VLE Backplane is used to interconnect all system modules in the VLE. It
comprises a single printed circuit board with parallel tracks and female DIN
connectors which straddle those tracks. WESTRACE modules plug into the
DIN connectors.
There may be up to four housings and VLE backplanes in a single WESTRACE

installation. Each backplane is fitted with DB37 connectors for connection to
other VLE backplanes. Special cabling is used for interconnecting backplanes
where more than one system backplane is required.
Refer to the circuit book in the Signal Equipment Room for information
regarding the link settings on the backplane.
A.18.3 Indications
None.
Blanker Card A
Description
Blanker cards are used to maintain continuity of vital signals across the VLE
backplane. A blanker card and a PFM blanker plate must be fitted in any
unused input/output module slot.
Configuration
None.
Indications
None.

A.19 S2/MBD51 Single Modem Motherboard
A.19.1 Description
The S2/MBD51 is a stand-alone motherboard which will enable an interface
between S2/VFC42/45/46 modems and any installation requiring
communications at RS422, or RS232 levels and a transmission media such as
PCM, cable, or open wire at voice frequencies.
A.19.2 Particulars
The S2/MBD51 is comprised of a single printed circuit board and various
connectors. There are configuration shunt links to select RS232/422
answer/originate, data transfer rate, constant carrier (RTS), modem outputs
stage enable (PTX), 4 wire/2 wire, impedance of modem output/input and
constant transmit clock to the S2/VFC42/45/46.
Connectors on the board allow:

• either a S2/VFC42/45/46 to be installed;
• interface communications at RS422, or RS232 levels;
• the connection of a protocol analyser at RS422, or RS232 levels;
• the connection to a line with 4 wires or 2 wires depending upon the type
of modem installed;
• the transmit and receive attenuation to be adjusted (by means of a plug
on the attenuator board);
• the connection and daisy chaining of the 12V and 0V supply for multiple
S2/MBD51 motherboards.
A.19.3 Function
The S2/MBD51 is purely a passive device and as such does not alter the
characteristics of the signals flowing through it.
The motherboard has two banks of jumpers used for configuration. One is for
modem configuration and the other is for line impedance selection.
A-170 Invensys Rail

Figure A.67 S2/VFC42/45/46 Modem Configuration J13—S2/MBD51 Motherboard
Table A.74 Link Description—S2/MBD51 Motherboard
Link Description Link In Used with

232 Selects between RS232 or RS422 for modem Selects RS232 S2/VFC45 only
interface
ORG Selects the modulation frequency for the
modem
Selects ANS S2/VFC42 only
A
O/C RTS Enables modem constant carrier, used for Enable Carrier S2/VFC45/42 only
RS422 interface only
PTX Enables modem power transmitter output Enable Power output S2/VFC45/42 only
circuit
232 RTS Enable modem constant carrier, used for Enable Carrier S2/VFC45 only
RS232 interface only
TXC SYN Selects modem transmit clock synchronised Selects clock not sync S2/VFC42 only
to data to data
INT TXC Connects transmit clock output loop back to Loop transmit clocks S2/VFC42 only
transmit clock 'IN'
1200 Selects modem clock rate at 1200 bps Selects 1200 bps S2/VFC45 only
600 Selects modem clock rate at 600 bps Selects 600 bps S2/VFC45 only
232E TXC Connects external transmit clock to modem. Selects External RS232 S2/VFC46 only
Used for RS232 interface only. Transmit Clock
422E Connects external transmit clock to modem. Selects External RS422 S2/VFC46 only
TXC+ Used for RS422 interface only. Transmit Clock
422E TXC– Connects external transmit clock to modem. Selects External RS422 S2/VFC46 only
Used for RS422 interface only. Transmit Clock

LCU Line 600 Ω Line
Figure A.68 S2/VFC42/45 Line Impedance Configuration J14 (4 WIRE LINE)
LCU Line 600 Ω Line
Figure A.69 S2/VFC42 Line Impedance Configuration J14 (2 WIRE LINE)
A-172 Invensys Rail

Figure A.70 S2/VFC46 Line Impedance Configuration J14 (all line impedances)
2 wire 4 wire
Figure A.71 S2/VFC42/45 Line Wire Configuration J12

A
2 x 2 wire
Figure A.72 S2/VFC46 Line Wire Configuration J12
A.19.5 Indications
None.

A-174 Invensys Rail

B.1 Vital Logic Module (VLM1)
APPENDIX B: MODULE OPERATION
This appendix describes the:

• structure;
• operation, and;
• module safety assurance;
for WESTRACE modules.

The VLM1 is the central processing unit for the WESTRACE Vital Logic
Equipment (VLE). It receives inputs from vital and non-vital input modules,
processes these according to the Application Logic defined by the
Application Engineer using the Configuration System (CS), and generates
outputs for vital and non-vital output modules.
The VLM1 consists of three cards connected via the VLM Backplane Card
(VBC).
The VLM1 occupies slots 1 to 3 of housing number 1.
B.1.1 Description
B.1.1.1 Vital Logic Card (VLC) B

The VLC is a double extended Eurocard. It is a digital card using a
microprocessor, program and data memory, and external interface
components.
The VLC:
• Interfaces to the input and output modules via the Internal Module Bus
(IMB);
• Generates the 1Hz flash timing reference (FLASH) for the flashing lamp
output modules and generates the dynamic Primary and Secondary
Negation signals.
B.1.1.2 Configuration Element Card (CEC)

The CEC is a double extended Eurocard. The Configuration Element Data
(CED) is programmed into EPROMs that are installed in sockets on this card.
It also has 8 switches specifying the version number of the CED (see section
A.4.2.2). These are set to correspond with the installation data version
number contained in the EPROMs.
WESTRACE MkI Application Manual Issue 11.0 B-1

B.1.1.3 Output Power Card (OPC)

The OPC is a double extended Eurocard that receives the:
• Primary Negation signal from the VLC, via the VBC;
• Secondary Negation signal that is routed through all the other vital
modules via the VLE Backplane.
The OPC uses both negation systems to generate the Vital Serial Enable
Voltage (VSEV) and the drive to the Output Power Control Relay (OPCR).
B.1.1.4 VLM Backplane Card (VBC)

The VBC is a short 3U backplane PCB that:
• Connects the VLC, CEC and OPC, and;
• Routes the external connections to the +24V Supply, the VSEV and the
OPCR.
There are 24 links (LK1–LK24) on this card that are used to factory preset the
unique installation address. See section A.4.2.4.
The VBC is located below the VLE Backplane, covering slots 1-3 in housing 1.
B.1.2 Operation
B.1.2.1 Power-Up
The VLM1 performs the following sequence of operations from power-up:
a) Performs all internal self-tests to ensure the health of the VLM1;
b) Checks the module configuration of the VLE the installation address and
the application data version against that defined in the CED. Initialises
all internal states;
c) Ensures that all other vital modules are compatible, that they have
satisfactorily completed all their safety checks and that they are
operational;
d) Send the vital output modules the default states defined in the CED and
allow sufficient time for these to be set on the outputs;
e) Allow time for the VSEV and drive to the OPCR to be generated from the
Primary Negation and Secondary Negation waveforms;
f) Repeat the following sequence until all vital input data has been
received or failures of vital serial links have been reported. Three
seconds are allowed to complete this sequence;
Read all inputs;
• Update the internal timer states;
• Evaluate and store the new internal states as defined by the
combination of inputs, internal stored states, timers and Application
Logic;
• Send the vital output modules the default states;
B-2 Invensys Rail

• During this period, the VLM1 starts to send the Configuration Element
Data to the Diagnostic Module at a rate of one block per cycle. This
process continues until all the CED has been sent.
g) Begin timing the Initialisation Delay time specified in the CED. During
this time the VLM1 will continue to operate as in step f above;
h) Indicate (APPDEL1), that normal operation by setting the Application

Delay logic state;
i) Begin normal operation.
B.1.2.2 Normal Operations

The VLM1 software cycles through the following events during normal
operation:
a) Encode Output Messages to all modules;
b) Send Output Messages to and Receive Input Messages from all

modules;
c) Decode Input Messages and set relevant internal states for all modules;
d) Evaluate Timers;
e) Evaluate Logic.
The cycle time for the normal operation is variable, dependent on the
number and type of modules installed and the quantity of application logic to
evaluate. The maximum cycle time is one second.
B.1.2.3 Additional Operations B

Additional background functions are also performed by the VLM1:
a) Internal self-tests are performed regularly throughout the VLM1

processing;
b) The Primary Negation signal is generated and the Secondary Negation

Signal is not inhibited, while all internal self tests, IMB messages from
vital modules, and Health Monitoring of adjacent vital modules are
correct;
c) The OPCR will be exercised when requested by the EXOPCR Logic

State;
d) All vital modules are checked between data transfers to ensure they
have not failed. This only happens if the time between data transfers is
too long;
e) Health Monitoring of the two adjacent vital modules is performed;
f) Logic State data is written to the Diagnostic Module each cycle.
B.1.3 Module Safety Assurance

The safe operation of the VLM1 is assured by:

a) health monitoring of VLM1 microprocessor by adjacent modules;
b) microprocessor Self-tests of RAM, ROM and CPU;
c) ensuring that other vital modules take part in the IMB transfer correctly
when requested;
d) each other vital modules ensuring that the VLM1 takes part in IMB
transfers at the correct intervals;
e) the VLM1 software generating a dynamic code sequence that is used to

produce the VSEV and drive to the OPCR on the OPC;
f) use of two representations and implementations of software for all

safety critical functions, for example logic evaluation and timers;
g) use of redundant data storage for logical variables with checks to detect
corruption of these;
h) processing of internal states is such that the energised state is always

positively identified and its absence results in the de-energised state
being assumed.
B-4 Invensys Rail

B.2 Vital Hot Standby Logic Module (HVLM)

The HVLM is an alternative central processing unit for the WESTRACE Vital
Logic Equipment (VLE). It receives inputs from vital and non-vital input
modules, processes these according to the Application Logic defined by the
The HVLM also provides facilities for interconnection with a second

WESTRACE system via a fibre optic link so the two systems can be configured
as a hot standby set.
The HVLM consists of two cards connected via a small backplane, the
Hot Standby Vital Backplane Card (HVBC). The HVLM occupies slots 2 and 3
of housing 1.
B.2.1 Description
B.2.1.1 Hot Standby Vital Logic Card (HVLC)

The HVLC is a double extended Eurocard. It is a digital card using a
microprocessor, program and data memory, and external interface
components.
The HVLC:
(IMB);
• Generates the 1 Hz flash timing reference (FLASH) for the flashing lamp B
Negation signals;
• Has a fibre optic transmitter and receiver to transfer data to a second
HVLC.

The HVLM uses that same OPC as is used by the VLM1.
The OPCRs are wired in an exclusive–or arrangement. A Standby OPCR will

remain de-energised by the online OPCR being energised and by the use of
the Exercise Switch. Either installation will shut down if detects that its own
OPCR is not in the expected state.
The HVLM software will not detect that an OPCR is stuck until it is exercised.
Exercising is only available when the installation is online. However,
exercising cannot be performed during the application delay period. An
HVLM in Standby Mode will not detect that its OPCR is stuck until it enters
Online Mode.
An installation that is configured to be stand-alone only detects the state of

its OPCR during exercising. It will not shutdown if it detects that its OPCR is
not in the expected state.

Exercising cannot be performed for at least one second after a prior request
to exercise. The EXOPCR logic state must remain at logic 0 for at least one
cycle before exercising can be performed again.
The OPCRFLT logic state will only be set to logic 0 if a fault has been detected
during the exercising of the OPCR.
The fault could be:
a) On receipt of a request to exercise the OPCR, the OPCR was not

energised;
b) The OPCR failed to de-energise during exercising;
c) The OPCR failed to energise on completion of exercising.
B.2.1.3 Hot Standby Vital Backplane Card (HVBC)

The HVBC is a short 3U backplane PCB that;
• Connects the VLC and OPC;
OPCR.
There are 24 (LK1–LK24) links on this card that are used to factory preset the
The HVBC is located below the VLE Backplane, covering slots 1-3 in housing
1.
Each HVLM has two configuration links. One link (CONF1) is used to bias one
system of a pair online and the other (CONF2) may be made for stand-alone
operation (this is not used in a hot standby pair). See also sections B.2.2.2 and
A.3.2.3.
The configurable link (CONF1) on the HVBC can be set to bias the HVBC to
operate in:
• Online Mode—link made, or;
• Offline Mode—link not made (non-biased).
In a pair of installations intended to operate in a hot standby configuration,

one installation will be biased online and the other will be non-biased
(offline). A non-biased HVLM will enter Standby Mode before entering Online
Mode when it is powered-up alone. An installation intended to operate in
Stand-Alone Mode will be biased online.
An indication is maintained of the mode of an installation. The status of the

system can be interrogated by inspecting the MYMODE and SBYSTAT logic
states, and from the LEDs on the front panel.
The HVLM will flash the:

• Green LED when in Online Mode, or;
• Orange LED when in Standby Mode.
B-6 Invensys Rail

Note: A UHVBC can also be used. See section B.4.1.3.
B.2.2 Operation
The HVLM operates in the same way as the VLM1 except as defined in this
section.
B.2.2.1 Cycle Time

The HVLM cycle time:
• Is fixed at one second when configured for hot standby;
• Varies between 0.5 and 1.0 seconds when operating standalone.
B.2.2.2 Hot Standby Configuration

The mode of operation of an installation is determined by the configurable
link CONF2 as follows:
• Link made—‘Stand-Alone’, or;
• Link not made—‘Hot Standby’.
B.2.2.3 Changeover
The system provides two voltage-free selector input contacts, ‘Inhibit’ and
‘Request’. The contacts are active low.
Condition Outcome B
Neither selector input is The system shall be able to respond to any
selected. request to changeover on failure of the
connected installation.
Both selector inputs are System changeover is inhibited.

selected simultaneously.
The ‘Inhibit’ selector input is The HVLM will not attempt to changeover.
selected.
The ‘Request’ selector input The online HVLM will determine whether a
is selected. changeover is appropriate and if so will
initiate the changeover.
If it is necessary to start-up both installations together and it is intended that

the non-biased installation is to become online and inhibit changeover, then
the application of power to the biased installation shall be delayed by a time
sufficient for the non-biased installation to enter Online Mode. Under certain
circumstances it may be possible for both installations to shutdown during
start-up.

Condition Outcome
The HVLM receives a request to It will be Ignored

changeover via the selector inputs
whilst exercising the OPCR.
The HVLM receives a request to It will be ignored. However, the

changeover before the drive to the MYMODE logic state will be set to
OPCR is provided. indicate that a changeover is
occurring. This will only remain for
the duration of the request which will
be one cycle.
A request to changeover must not be present for more than one cycle (one
second) to avoid the possibility of the Hot Standby system toggling.
The RCOVER reserved logic state shall be set by the HVLM software when
there is a request to changeover via the selector inputs. The RCOVER
reserved logic state shall be set whether the HVLM has acted upon the
request to changeover or not.
An installation will not be able to differentiate between an installation in

online initialisation, standby initialisation or standby modes.
Condition Outcome
An installation in Online Mode fails, The changeover will be

or responds to a request to unsuccessful and the system will
changeover whilst the other fail.
installation is in Online Initialisation
Mode or Standby Initialisation Mode.
The changeover time is defined as the time for which any Hot Standby
installation output state is set to its most restrictive state. The maximum
changeover time is 1.0491 seconds.
In the event of a changeover:

• Timers will be delayed by up to the changeover time;
• The maximum time a vital output will remain in its most restrictive state
shall be less than 2.5 s;
• Any vital input which remains de-energised for less than 2.5 s may be lost.
If the Online Mode OPCR does not energise after changeover, shutdown will
be invoked.
B-8 Invensys Rail


B.2.3.1 System Safety Principles and Methods
The following safety principles and methods, in addition to those for the
VLM1, apply:
a) The standby HVLM checks that both installations have the same
installation address, CED version number and CED checksums;
b) By continual monitoring of the connected installation, the HVLMs

ensure that only one installation is in Online Mode at any one time.
B.2.3.2 HVLE Safety Principles and Methods

B.2.3.2.1 Installation Negation
a) The principle of fail-safe design is provided in the HVLE by passing
control of the railway to the connected installation if any failures are
detected. This is referred to as installation negation;
b) The HVLM is designed to ensure that installation negation occurs before

any internal fault can result in incorrect output data being sent to a vital
slave module or transferred over the Inter-HVLM-Communications-Link
(IHCL);
c) The HVLM will perform installation negation within 351 ms of a vital

slave module disabling its IMB interface. The hardware takes up to 10
ms to disable the VSEV and the drive to the OPCR, so the HVLM design
is such that the software completes shutdown within 341 ms of a vital
slave module disabling its IMB interface;
d) Two defences are provided to guarantee that the VSEV and OPCR drive B
cannot be re-enabled once the system has negated until the power has
been removed and re-applied:
• The shutdown mechanism provided by the HVLM software is failsafe;
once shutdown has occurred the VSEV and the drive to the OPCR are
removed and the software stops executing. The software will not
restart execution until a system restart occurs.
• The high integrity hardware start-up circuitry also provides a diverse
defence. This is designed to be ‘one-shot’; one attempt is made to
provide the OPCR drive, there is no further attempt to provide the
OPCR drive until the power supply has been removed and re-applied.
B.2.3.2.2 Safety During Changeover

a) The standby HVLM is prevented from entering Online Mode until it has
received all the relevant information from the online HVLM. The HVLM
will not experience divergence in interlocking strategies as a result of
changeover;
b) During a changeover, the system does not transmit vital serial

communication messages, and its vital internal logic states and timers
are unaffected.
B.2.3.2.3 Self-Tests
The SelfTests software is performed after encoding the serial message and
before the start of its transmission to the Standby HVLM.

B.3 Vital Standby Logic Module (VLM5)

The VLM5 is an alternative central processing unit for the WESTRACE Vital
The VLM5 also provides facilities for interconnection with a second

The VLM5 consists of two cards connected via a small backplane, the
Hot Standby Vital Backplane Card (HVBC). The VLM5 occupies slots 2 and 3
of housing 1.
The CEC functionality of earlier VLM modules is onboard the VLM5 by means
of PROMs and switches.
B.3.1 Description
B.3.1.1 Vital Logic Card 5 (VLC5)

The VLC5 is a double extended Eurocard. It is a digital card using a
microprocessor, program and data memory, Complex Programmable Logic
Devices (CPLD) and external interface components. It can be fitted with more
program and data memory capacity than can the HVLC and the CPLDs help
deter component obsolescence.
The VLC5:
(IMB);
• Generates the 1 Hz flash timing reference (FLASH) for the flashing lamp
Negation signals;
VLC5.

The VLM5 uses the same OPC as the VLM1 and HVLM. See section B.2.1.2 for
details. Substitute VLM5 where section B.2.1.2 mentions HVLM.
B.3.1.3 Hot Standby Vital Backplane Card (HVBC)

The VLM5 uses the same HVBC as the HVLM. See section B.2.1.3 for details.
Where section B.2.1.3 mentions HVLM substitute VLM5.
Note: A UHVBC can also be used. See section B.4.1.3.
B-10 Invensys Rail

B.3.2 Operation
The VLM5 operates in the same way as the HVLM (see section B.2.2) except
as defined in this section.
B.3.2.1 Cycle Time

The VLM5 cycle is variable for both Stand-Alone Mode and Hot Standby
Mode, with a maximum of 1.3 seconds.

As for HVLM. See section B.2.2.2.
B.3.2.3 Changeover

The VLM5 follows the same safety principles and methods as the HVLM. See
section B.2.3.1.

The same HVLE safety principles and methods apply as for the HVLM. See
section B.2.3.2. B


The VLM6 is the preferred central processing unit for the WESTRACE Vital
When used in conjunction with an NCDM, the VLM6 also provides vital
communications over a network to connected WESTRACE systems.
The VLM6 also provides facilities for interconnection with a second

The VLM6 consists of two cards connected via a small backplane, the
Universal Hot Stand-by Vital Backplane Card (UHVBC). The VLM6 occupies
slots 2 and 3 of housing 1.
The CEC functionality of earlier VLM modules is onboard the VLM6 by means
of PROMs and switches.
B.4.1 Description
B.4.1.1 Vital Logic Card 6 (VLC6)

The VLC6 is a double extended Eurocard. It is a digital card using a
microprocessor, program and data memory, Complex Programmable Logic
Devices (CPLD) and external interface components. It can be fitted with more
program and data memory capacity than can the HVLC and the CPLDs help
deter component obsolescence.
The VLC6:
(IMB) and interfaces to the NCDM through the dedicated VLM6–NCDM
interface;
• Generates the 1 Hz flash timing reference (FLASH) for the flashing lamp
Negation signals;
VLC6.

The VLM6 uses the same OPC as the VLM5, HVLM and VLM1. See section
B.2.1.2 for details. Substitute VLM6 where section B.2.1.2 mentions HVLM.
B.4.1.3 Universal Hot Standby Vital Backplane Card (UHVBC)

The VLM6 uses a UHVBC.
B-12 Invensys Rail

The UHVBC is a short 3U backplane PCB that:

• Connects the VLC and OPC;
OPCR.
There are 24 links (LK1–LK24) on this card that are used to factory preset the
There are two links (LK25 and LK26) that are used to provide or withhold
VSEV voltage to the VLC when they are made or not made. These links are
made when the UHVBC is used with VLC6, and not made when it is used with
the VLC5 or HVLC. The UHVBC is located below the VLE Backplane, covering
slots 1-3 in housing 1.
Each VLM6 has two configuration links. One link (CONF1) is used to bias one
system of a pair online and the other (CONF2) may be made for stand-alone
operation (this is not used in a hot standby pair). See also sections B.4.2.2 and
A.1.2.3.
The configurable link (CONF1) on the HVBC can be set to bias the UHVBC to
operate in:
• Online Mode—link made, or;
• Offline Mode—link not made (non-biased).
In a pair of installations intended to operate in a hot standby configuration,

one installation will be biased online and the other will be non-biased
(offline). A non-biased VLM6 will enter Standby Mode before entering Online
Mode when it is powered up alone. An installation intended to operate in
Stand-Alone Mode will be biased online.
B
An indication is maintained of the mode of an installation. The status of the
system can be interrogated by inspecting the MYMODE and SBYSTAT logic
states, and from the LEDs on the front panel.
The VLM will flash the:

• Green LED when in Online Mode, or;
• Yellow LED when in Standby Mode.
B.4.2 Operation
The VLM6 operates in the same way as the HVLM (see section B.2.2) except
as defined in this section.
B.4.2.1 Cycle Time

The VLM6 cycle is variable for both stand-alone and hot standby modes, with
a maximum of 1.3 seconds.


B.4.2.3 Changeover

The VLM6 follows the same safety principles and methods as the HVLM. See
section B.2.3.1.

The same HVLE safety principles and methods apply as for the HVLM. See
section B.2.3.2.
B-14 Invensys Rail

B.5 Vital Lamp Output Module (VLOM)

The VLOM interfaces railway signalling lamps to the VLM logic. VLOMs are
available for use with 110 Volt ac or dc Lamps. The outputs provide current to
the associated lamp from an external power supply. Lamp outputs are not
isolated from the signalling supply and utilise a common return connection
point. Vital Hot filament proving and non-vital Cold filament detection are
provided by VLOMs. Both steady output and flashing or steady output
modules are available.
B.5.1 Description
A VLOM comprises a set of double extended Eurocard Printed Circuit Boards
(PCBs). PCBs are joined by spacing pillars and interconnected by DIN 41612
style connectors to form a module.
The module consists of a Vital Parallel Input Output Digital Board (VPIODB),
and one or two Vital Lamp Output Module Analogue Board(s) (VLOMAB).
Each VLOMAB has six outputs. A module with one VLOMAB has six outputs,
and a module with two VLOMABs has 12 outputs.
The digital board contains the processing, analogue to digital converter and
VLE backplane interface circuitry.
The analogue board contains the lamp current switching and isolating
circuitry, located in the Dirty Area that is electrically isolated from the Clean
Area where the control and testing circuitry resides.
The VLOMAB is produced in two styles, one for fitting to the left of the B
VPIODB and one to the right of the VPIODB when fitted in the VLE Housings.
A left side board is used for 6 output VLOMs
B.5.2 Operation
Each lamp output may be individually switched. The analogue circuitry is
designed to handle both ac and dc supply voltages. The current drawn by
each lamp is monitored by a sense circuit. This provides an input via the
multiplexer and analogue to digital converter to the processor. The
processor thus measures the currents flowing in each of the lamp circuits.
Each individual lamp circuit has a fuse in series with the output. If the
processor detects an unacceptable current passing through a lamp circuit
that should be in the de-energised state, then it may attempt to isolate the
lamp circuit by blowing the fuse. This allows individual lamp outputs to be
disabled in case of failures while allowing the other outputs to continue
operating Safely— defined as graceful degradation.
The fuse blowing circuit is not safety critical. If it is does not successfully
isolate the output, the output will be isolated by system shutdown within the
defined fleeting output time.
A separate ground fail connection to the common of the lamp supply verified
the integrity of the signalling return.

Non-vital Cold filament detection is carried out by measuring the current that
flows when each lamp output is energised for a maximum of 5 milliseconds.
The VLOM processes one de-energised lamp output per cycle.
Vital Hot filament proving is achieved by sampling the current passing when
the lamp is turned on. The module calculates the rms value of this current
based on a set of current measurements. The hot filament proving will
correctly detect the presence or absence of a filament when the output is
being flashed and will work with transformer coupled signalling lamps.

Checks are performed to ensure that the sense circuits accurately read test
inputs. These checks form the diverse check on the operation of the sense
circuit. A failed check will generate a filament proving mnemonic logic state
0. The Application logic must use this state as described in section 4.2.3.9.
Malfunction of the lamp switch circuits is detected by software checks. The

samples taken for hot filament proving are also used to detect an illegal
output, thus safe operation is achieved for ac, or ac derived supplies, with
frequencies in the range 45 Hz to 65 Hz.
The ground fail detector is used to prevent the possibility of a false

connection between lamp outputs, via failed module output protection
circuits or fuse blow components, should the signal return connection
between the VLOM and the signalling negative bus bar become
disconnected.
The fuse blow function is included for graceful degradation and not for safety
reasons.
Although on the VLOM analogue board the circuits are not an inherently fail-
safe design, these circuits are monitored so that faults are detected and
negated. The sense functions are checked by passing known currents
through them.
The safe operation of the VLOM is assured by:
a) health monitoring of VLOM microprocessor by adjacent modules;
c) the VLM checking that the VLOM takes part in the IMB transfer correctly
when requested;
d) the VLOM checking that the VLM requests IMB transfers at the correct
intervals;
e) use of two representations and implementations of software for all

safety critical functions, for example, output control;
f) use of redundant data storage for logical variables with checks to detect
corruption;
g) self checks on the hardware.
B-16 Invensys Rail

B.6 Vital Relay Output Module (VROM)

The VROM drives 50 Vdc signalling relays based on the VLM logic. There are
eight fully isolated outputs per module. The VROM module requires an
external signalling supply from which it generates 8 isolated voltage sources
to drive the relays. The circuitry is designed so that the outputs may be used
to drive a neutral or polar (biased) relay, or a bipolar relay.
B.6.1 Description
A VROM comprises a set of double extended Eurocard Printed Circuit Boards
(PCBs). PCBs are joined by spacing pillars and interconnected by DIN 41612
style connectors to form a module. The module consists of the Vital Parallel
Input Output Digital Board (VPIODB), and a Vital Relay Output Module
Analogue Board (VROMAB).
The analogue board contains the relay interface conditioning and isolating
circuitry, located in the Dirty Area, that is electrically isolated from the Clean
Area where the control and testing circuitry resides.
B.6.2 Operation
An isolated internal supply (generated from the 50 V signalling supply) is
used to drive the relay outputs via an on-board isolated dc-dc converter.
Each relay output is transformer isolated and may be individually switched.

B
The processor monitors each output voltage by dual sense circuits connected
via a multiplexer and Analogue to Digital Converter (ADC). No current
sensing is performed and so no indication of the state of the external relay is
provided. Each output has a transistor switch on the output side of the
transformer to isolate any small leakage voltage that may otherwise be
present. However, from a safety point of view, it must be assumed that this
residual voltage may be present.
Each individual relay output channel has a fuse in series with the output. The
processor will attempt to blow the fuse on any output that is incorrectly
energised. This allows individual faulty relay outputs to be disabled while
allowing other outputs to continue operating safely—defined as graceful
degradation.
The fuse blowing circuit is not safety critical. If this does not successfully
isolate the output, it will be isolated by system shutdown within the defined
fleeting output time.


Although the VROM analogue board circuits are not of inherently fail safe
design, these circuits are monitored so that faults are detected and negated.
Sense circuits are checked by applying known voltages to them. The sense
test function may be relied upon to detect failures in the relay switch circuits
by detecting unacceptable voltage output levels.
The fuse blowing circuits are included for graceful degradation and not for
safety.
The sampling of the output voltage is performed at a rate that guarantees

safe output control when working from a dc derived from an ac supply
between 45 Hz and 65 Hz.
The safe operation of the VROM is assured by:
a) health monitoring of VROM microprocessor by adjacent modules;
c) the VLM checking that the VROM takes part in the IMB transfer correctly
when requested;
d) the VROM checking that the VLM requests IMB transfers at the correct
intervals;
e) use of two representations and implementations of software for all

safety critical functions, for example, output control;
corruption;
g) self checks on the hardware.
B-18 Invensys Rail

B.7 Vital Parallel Input Module (VPIM)

The VPIM interfaces the external 50 Vdc signalling inputs to the VLM logic. An
external voltage is fed to each input, usually via double cut contacts. This
voltage must be above a threshold for the input to be guaranteed as
energised. It must be below a second threshold to be guaranteed as de-
energised. Negative voltages and excessive positive voltages are always
interpreted as de-energised. Each input is electrically isolated from each
other and the control circuit.
B.7.1 Description
A VPIM comprises of a set of two double extended Eurocard Printed Circuit
Boards (PCBs). PCBs are joined by spacing pillars and interconnected by DIN
41612 style connectors to form a module. Each VPIM has 12 inputs. The
module consists of a Vital Parallel Input Output Digital Board (VPIODB), and
a Vital Parallel Input Module Analogue Board (VPIMAB).
The analogue board contains the isolation and conditioning circuitry, located
in the Dirty Area, that is electrically isolated from the Clean Area where the
control and testing circuitry resides.
B.7.2 Operation
The VPIM has a non-vital ac front end filter to allow operation with a high ac
component on the input signal. A software filter is used to give vital rejection
B
of interfering ac signals between 45Hz and 11kHz. The VPIM takes 2 sets of
samples of inputs every cycle (with a nominal time between taking sets of
samples of 90-150 milliseconds). Each set is checked to ensure that it does
not contain excessive ac. Each set of samples is then examined. Unless
sufficient samples within a set are above the threshold, the present state of
the input is taken as de-energised. This filter may not reject low frequency ac
below 45 Hz or pulsed dc signals. It will not reject all ac signals above 11 kHz.
A history of this outcome is kept by the VPIM and used to determine the input
state to be passed on to the VLM in response to a request from the VLM.
A further level of filtering is used to discriminate against unintended short

inputs such as from a bobbing track circuit:
• Four consecutive sets of samples must indicate energised before the
input is guaranteed to be taken as energised;
• Two consecutive sets of samples must indicate that the input is de-
energised before the transition from energised to de-energised will be
recognised.

The filter time will depend on the module cycle time that is in turn dependent
on the system complexity and size. The minimum requirements are:
• The input must be present for 360ms before it is guaranteed to be taken
as energised, and;
• An input must be absent for 180ms out of a 360ms period before it is
guaranteed to be taken as a de-energised.
Each individual input is separately fused to prevent damage to the module in

the event that excessive voltages are applied to the input.
The module incorporates regular tests on the health of each input circuit. Any
input that fails two consecutive tests will be assumed de-energised for all
future reads—referred to as graceful degradation.

The VPIM is a vital module that achieves the necessary safety levels by a
combination of inherently fail-safe conditioning and isolation circuits and
proved filtering and buffering circuits.
The safe operation of the VPIM is assured by:
a) health monitoring of VPIM microprocessor by adjacent modules;
c) the VLM checking that the VPIM takes part in the IMB transfer correctly
when requested;
d) the VPIM checking that the VLM requests IMB transfers at the correct
intervals;
e) use of two representations/implementations of software for all safety

critical functions;
corruption of these;
g) all input states are passed to the VLM in the true and complement form;
h) self checks on the hardware.
B-20 Invensys Rail

B.8 Vital Telemetry Continuous Module (VTC)

The VTC (Vital Telemetry Continuous Module) can communicate between a
similar module in another WESTRACE system. The latest data is sent cyclically
to other VTC.
B.8.1 Description
Each VTC consists of a double extended Eurocard printed circuit board. The
board contains processing, serial channel interface circuits and the VLE
backplane interface circuits.
Switches SW1 and SW2 are not used when the module is configured as a
VTC.
B.8.2 Operation
Each VTC used in the system is allocated a port address by the Application
Engineer who configures the system by using the CSS or GCSS. This port
address is used with the installation address to uniquely identify each vital
serial communication link to and from the system. This is achieved by
including these two addresses in each message transferred. This function is
performed by the VLM when it produces the data to send to the VTC over the
IMB.
The data transferred between the VLM and the VTC via the IMB consists of
two copies of the same data, one is the complement of the other, these two
copies are referred to as the True Data and the Complement Data. B
Both the true and complement data received from the IMB are formed into
code words, each having its own CRC (Cyclic Redundancy Check) code. The
two code words are transmitted separately over the serial channel.
The VTC repeatedly transmits the most recent IMB data over the serial
channel:
• LOIC (Loss of Input Channel) is clear (0) when the VTC is reset at power-
up;
• The VLM will ensure that the inputs normally received from the VTC are set
to the de-energised state when LOIC is clear (0);
• The VTC will clear (0) the LOIC and indicate the LOIC state to the VLM
when it fails to receive a correct pair of code words (complementary data
packets and correct CRC for each code word) from the serial channel in
any 2-second period.
• The VLM will send the LOIC indication in the output message to the VTC
so that the installation at the other end of the link may detect the failure of
the link.
• The VTC will set (1) LOIC and make the code words available for transfer
to the VLM via the IMB upon reception of a correct pair of code words.


Self-tests form part of the general system safety assurance. These self-tests
are performed between the transfer of the true and the complement code
words, so that faults in the VTC are detected before transmitting the full
output message. The VTC will cause System Negation when it finds a fault that
threatens its safe operation.
The safety checking in the VTC requires that the complement message is
delayed from the true message to allow all self testing and any necessary
System Negation to take place. A block of Sync bytes is sent between
messages to fulfil this requirement. The receiving VTC will not accept a
message unless the timing is correct.
Negation of the VTC is achieved by removing the 24V VSEV (Vital Serial
Enable Voltage) from the serial interface circuitry. This prevents data output,
because the VSEV powers the output driver circuits.
The safe operation of the VTC is assured by the following:
a) health monitoring of VTC microprocessor by adjacent modules;
b) microprocessor self-tests of RAM, ROM and CPU;
c) the VLM checking that the VTC takes part in the IMB transfer correctly
when requested;
d) the VTC checking that the VLM requests IMB transfers at the correct
intervals;

critical functions;
f) checking for corruption and use of redundant data storage for logic
variables.
B-22 Invensys Rail

B.9 Enhanced Vital Telemetry Continuous Module (EVTC)
B.9 Enhanced Vital Telemetry Continuous Module

(EVTC)
The Enhanced Vital Telemetry Continuous Module (EVTC) can communicate
with a similar module in another WESTRACE system. The latest data is sent
cyclically by each EVTC to the other EVTC.
B.9.1 Description
Each EVTC consists of a double extended Eurocard printed circuit board. The
board contains processing, serial channel interface circuits and the VLE
backplane interface circuits.
Switches SW1 and SW2 are used as described under Transmit Clock,
Appendix A, page A-81.
B.9.2 Operation
Each EVTC used in the system is allocated a port address by the Application
Engineer who configures the system by using the GCSS. This port address is
used with the installation address to uniquely identify each vital serial
communication link to and from the system. This is achieved by including
these two addresses in each message transferred. This function is performed
by the VLM when it produces the data to send to the EVTC over the IMB.
The data transferred between the VLM and the EVTC via the IMB consists of
two copies of the same data, one is the complement of the other, these two
copies are referred to as the True Data and the Complement Data.
B
Both the True Data and the Complement Data received from the IMB are
formed into code words, each having its own CRC (Cyclic Redundancy
Check) code. The two code words are transmitted separately over the serial
channel.
The EVTC repeatedly transmits the most recent IMB data over the serial
channel as described below:
• LOIC (Loss of Input Channel) is clear (0) when the EVTC is reset at power-
up.
• The VLM will ensure that the inputs normally received from the EVTC are
set to the de-energised state when LOIC is clear (0).
• The EVTC will clear the LOIC (0) and indicate the LOIC state to the VLM
when it fails to receive a correct pair of code words (complementary data
packets and correct CRC for each code word) from the serial channel in
any 2-second period.
• The VLM will send the LOIC indication in the output message to the EVTC
so that the installation at the other end of the link can detect the failure of
the link.
• The EVTC will set (1) LOIC and make the code words available for transfer
to the VLM via the IMB upon reception of a correct pair of code words.

B.9 Enhanced Vital Telemetry Continuous Module (EVTC)

Self-tests form part of the general system safety assurance. These self-tests
are performed between the transfer of the true and the complement code
words, so that faults in the EVTC are detected before transmitting the full
output message. The EVTC will cause System Negation when finds a fault that
threatens its safe operation.
The safety checking in the EVTC requires that the complement message is
delayed from the true message to allow all self testing and any necessary
System Negation to take place. A block of Sync bytes is sent between
messages to fulfil this requirement. The receiving EVTC will not accept a
message unless the timing is correct.
Negation of the EVTC is achieved by removing the 24V VSEV (Vital Serial
Enable Voltage) from the serial interface circuitry. This prevents data output,
because the VSEV powers the output driver circuits.
The safe operation of the EVTC is assured by the following:
a) health monitoring of EVTC microprocessor by adjacent modules;
b) microprocessor self-tests of RAM, ROM and CPU;
c) the VLM checking that the EVTC takes part in the IMB transfer correctly
when requested;
d) the EVTC checking that the VLM requests IMB transfers at the correct
intervals;

critical functions;
f) checking for corruption and use of redundant data storage for logic
variables.
B-24 Invensys Rail

B.10 Protection & Filter Module

The Protection & Filter Modules (PFMs) provide secondary transient
protection and attenuate high frequency interference from entering or
leaving the housing.
B.10.1 Description
The PFM is a single height Eurocard PCB fitted with a connector to mate with
the lower Module connector on one end and a socket for external wiring on
the other. A conductive aluminium screen part way along the module fits to
the screen on the housing to complete the Faraday Cage.
B.10.2 Operation
Different PFMs are used for the different modules.
The PFMs use Pi LC filters on each input and output line to attenuate high
frequency interference that might otherwise enter or leave the housing.
Tranzorbs clamps any high voltage transients to a safe level. External

protection may also be required (see section 5.3).

The PFM, being a Vital Module, is designed to the same physical specification
as other vital modules in the system. PCB tracks are arranged such that short
circuits between adjacent tracks will not cause a wrong side failure. B
High frequency filtering is designed in such a manner as to ensure that filter
component failures do not lead to false channel indications, or false outputs
to be driven.

B-26 Invensys Rail

C.1 Introduction
APPENDIX C: HOT STANDBY OPERATION
C.1 Introduction
Applications requiring high system availability can use the hot standby
configuration of the WESTRACE interlocking and optionally of WESTRACE
object controllers. Two identical WESTRACE installations are used. One
installation drives the outputs while the second is maintained in an identical
state via high speed interconnection data links. The online unit may be
selected by inputs and change-over is initiated by online system shutdown.
C.2 Modes of Operation

Both WESTRACE installations are capable of operating in several different
modes and certain trigger events will cause them to change mode.
Figure C.1 is an installation phase transition diagram showing the main
phases for the different modes. An installation in Power-Down Mode or
Shutdown Mode is considered to be dormant.
a) Applying power (1) to an installation in Power-Down Mode will move it

to the Initialisation Mode.
b) An installation configured for:

• online operation will move first (2) to Online Initialisation Mode and
then (4) to the Online Mode;
• standby operation will move first (3) to Standby Initialisation Mode
and then (5) to the Standby Mode.
c) Imminent shutdown of the online installation will signal (7) the Standby
installation to take over (8) the Online function.
C
Online 4
Initialisation Online
2
6
1
Initialisation Power-Down Shutdown 8 7
Standby
Standby
Initialization 5
Transition
Power removed
Installation negation
Figure C.1 Initialisation Phase Transition Diagram
WESTRACE MkI Application Manual Issue 11.0 C-1

Any failure in an installation causes it to enter Shutdown Mode (installation

negation). If power is removed, it enters Power-Down Mode.
C.2.1 Power-Down Mode

The installation enters Power-Down Mode when the external supply to the
installation is switched off. The installation ensures the OPCR and VSEV are
de-energised and the IHCL is disabled.
The installation enters Initialisation Mode (see 1 in figure C.1) when the
external supply is switched on.
C.2.2 Initialisation
On power-up, the installation performs all internal self tests and then checks
the system configuration. On passing the self tests and configuration checks,
the installation enters an operating mode and phase according to the flow
diagram shown in figure C.2.
C-2 Invensys Rail

Start-Up
Enter Initialisation
Phase
Yes Is the Installation

configured for Stand-Alone
Mode?
No
Is the Installation No Enter Standby

biased for Online
Initialisation Phase
Mode?
Yes
Enter Standby
Wait Phase
No Is the other Yes

Enter Online Enter Standby
Installation in Online
Initialisation Phase Sync Phase
Mode?
Enter
Online
Enter
Standby
C
Mode Mode
Figure C.2 Start-up Decision Tree—Online or Standby
When an installation is in Online Initialisation Mode or Standby Initialisation

Mode and the other installation fails in Online Mode or responds to a request
to change-over, the changeover will be unsuccessful and the system will fail.
In a hot standby system, changeover should not be attempted until the
WESTRACE Application Delay has expired, which is typically several minutes
after power-up.
Note: Hot standby only becomes available at completion of the WESTRACE

Application Delay (see [GCSS]), which is typically several minutes after
power-up.
WESTRACE MkI Application Manual Issue 11.0 C-3

C.2.2.1 Online Initialisation Phase

The installation:
• disables the IHCL;
• ensures the VSEV and OPCR drives are de-energised until the initial
output states have been sent to output modules as defined by the initial
values of the internal states, and;
• 150 ms has been allowed for those outputs to be acted on;
• then enters Online Mode.
C.2.2.2 Standby Initialisation Phase

The standby-biased installation waits for its Application Delay to expire to
allow the online-biased installation to take control of the railway.
C.2.3 Online Mode

The installation in Online Mode is in control of the railway. It reads inputs from
slave modules that relate to external stimuli (such as point detection and
railway signalling inputs) and processes these safely to provide outputs to
slave modules. The slave modules drive the railway signalling apparatus in
accordance with the application logic (defined by an Application Engineer).
The installation in Online Mode:

• receives vital inputs and non-vital inputs;
• processes the inputs according to defined application logic (defined by
an Application Engineer using the Graphical Configuration System);
• updates the standby installation via the IHCL and INCL and produces vital
and non-vital outputs.
C.2.4 Standby Mode

The installation in Standby Mode cannot control the railway. All vital outputs
are driven to the de-energised state and its OPCR is de-energised.
The installation in Standby Mode:

• checks that it is correctly receiving vital state updates from the online
installation;
• monitors the status of the installation in Online Mode;
• performs health proving functions;
• takes over control of the railway in the event of failure of the installation in
Online Mode.
C.2.5 Shutdown Mode

The external supply to the installation is on.
The installation ensures:

• the OPCR and VSEV are de-energised, and;
• the IHCL is disabled.
C-4 Invensys Rail

APPENDIX D: NON-VITAL COMMUNICATION

PROTOCOLS
WESTRACE supports the following protocols:

• Diagnostic Protocol
A polled protocol, with the external diagnostic system as the master
(client). The external diagnostic system is typically provided by a PC
running MoviolaW, NGETLOG or the N(V)CDM diagnostic driver
software;
• WSA/S2 Slave Protocol (Server)
A polled control system protocol, with the external control system as the
master (client). A WESTRACE system, using this protocol, responds to a
polled message with a full data message. The external control system is
typically provided by a Centralised Train Control (CTC) system such as
WestCAD;
• WSL/S2 Slave Protocol (Server)
A polled control system protocol, with the external control system as the
master (client). A WESTRACE system, using this protocol, responds to a
polled message with Change of State (COS) data unless a full data
message is requested. The external control system is typically provided by
a Centralised Train Control (CTC) system such as WestCAD or Small
Control Centre (SCC);
• WSA/S2 Master Protocol (Client)
A polled control system protocol, with the WESTRACE system as the
master (client). A WESTRACE system configured with this protocol is used
to poll connected systems for a reply consisting of a full data message.
The WSA/S2 master protocol is typically used for the transfer of non-vital
application data between WESTRACE systems.
The WESTRACE system:

D
• can drive one or more S2 field stations;
• appears as just another S2 field station to the control centre.
WESTRACE MkI Application Manual Issue 11.0 D-1

D-2 Invensys Rail

Glossary
GLOSSARY GLOSSARY
2nd Negation Part of the WESTRACE Backplane. Provides a mechanism for vital WESTRACE
modules to negate the system in the event of a fault being detected. See also
Negation.
Application Logic The logic that defines how the inputs and outputs for a particular installation are
related.
APPDEL Application Delay Timer. See also NAPPDEL.
Approach Locking The locking which is applied after the signal has cleared to prevent the signal
attempting to normalise a route in front of a train.
Aspect The current state shown by a signal, eg Stop, Caution, Proceed, Reduce Speed
etc.
ATP Automatic Train Protection
AWS Automatic Warning System
Backplane Interconnects all WESTRACE modules, incorporates the Inter Module Bus, Fault
Bus, Health Monitoring, 2nd Negation and various other interfaces.
BCC Block Checksum Character. A method for validating the integrity of digital data.
Boolean Logic A method to define and evaluate the logical relationship between digital inputs
and outputs. An equation consists of terms which are combined using AND, OR
and NOT operators.
bps Bits per second
Buried Earth A connection made to earth by means of driving, or burying one, or more earth
rods or conductors.
CBI Computer Based Interlocking—a generic term applied to interlockings using

microprocessors.
CCSS Configuration Check Sub-System—a WESTRACE software package that executes

on an IBM compatible PC. It is used by Signal Engineers to verify that the CED
fitted to an interlocking is the correct version and has not changed from the
source data. Used for VLM-based systems.
CEC Configuration Element Card—the CEC is part of the VLM. The PROMs containing
the CED are fitted to the CEC on VLM1-based systems.
Gl
CED Configuration Element Data—configuration data, application logic, module
definitions and mnemonic names. The vital CED is stored in PROMs which are
installed on the VLM1 or HVLM modules. ‘Vital PROM Data’ is the equivalent term
when discussing later vital logic modules.
‘Non-Vital Configuration’ is the term used when discussing non-vital data that is
downloaded to the NVC/DM or NCDM.
CIM Communications Interface Module—part of a NVC/DM, provides the serial

interfaces.
WESTRACE MkI Application Manual Issue 11.0 Glossary-1

Glossary
CIMFIM Communications Interface Module Filter Interface Module—part of a CIM,

contains level translation and filtering electronics.
CIMPM Communications Interface Module Protection Module—part of a CIM, contains

transient protection electronics.
CNVC Configurable Non-Vital Communication Module
Coil An internal logic state which forms the output of a logic rung.
Compilation The process of creating the CED from the source file information.
Contact An internal logic state which is used as an input to a logic rung.
Control System The interface between the signaller and the railway signalling system. It may take
the form of the rail authority’s central control centre, or a local hard wired panel,
or a control computer.
Control Tables A method of representing the interlocking functions in a form which is commonly
used by Railway Industry.
CRC Cyclic Redundancy Check—a method for validating the integrity of digital data.
CS Configuration System—a set of WESTRACE software packages that executes on an

IBM compatible PC and an associated manual. The CS comprises the CSS and
CCSS. Used for VLM-based systems.
CSS Configuration Sub-System—a WESTRACE software package that executes on an

IBM compatible PC. Used by Signal Engineers to design and simulate Application
Data for WESTRACE Vital Signalling Systems. Used for VLM-based systems. Has
been superseded by GCSS.
CTSS WESTECT ATP Transponder Configuration Sub-System
Cycle [WESTRACE] WESTRACE is designed to operate cyclically. Each cycle comprises the major
phases of accepting input data, evaluating the logic once, delivering output the
data and performing health checks.
Cycle Time The time taken to execute one complete WESTRACE cycle. This will vary, unless
fixed for hot standby purposes, according to the number of I/O modules
connected and the logic evaluated.
Diagnostic Module See DM.
Diagnostic System See MoviolaW.
DIL Dual-In-Line.
DM Diagnostic Module— a WESTRACE module that monitors and records all changes
of state and fault information in the WESTRACE system. The DM has external
interface ports for interrogation the system and for transmitting data. A collective
term which includes the original DM and the DM128. To be replaced by the
NVC/DM or NCDM.
DTC Direct Traffic Control—a computer-based train control system used to

electronically manage and validate train movements in non-signalled territory.
DWL Data Word Length—specific to the WSA/S2 protocol and indicates the number of
data bits in a message.
EPROM Blowing A printed record of EPROM programming.

Form
Glossary-2 Invensys Rail

Glossary
EPROM The process of storing data in EPROMs.

Programming
EEPROM Electrically-Erasable Programmable Read-Only Memory (PROM). Compare with

EPROM. Used on the VLM5, VLM6 and NCDC.
EPROM Erasable Programmable Read-Only Memory (PROM). Compare with EEPROM.

Used on the HVLM128 and earlier.
Equipment Room Any building, fixed or transportable (other than a control centre), housing
WESTRACE equipment.
Event A transition in the state of an ILS. All events are logged by WESTRACE.
Event Log MoviolaW creates event logs of the WESTRACE operation and stores these logs
for a defined period. Events recorded in the event log can be replayed.
External Diagnostic See MoviolaW.

System
EVTC Enhanced Vital Telemetry Continuous Module—a WESTRACE module used for
vital communication (66 bit) between two WESTRACE systems. For new
installations, EVTC modules are recommended in place of VTC modules.
Fail-Safe The attribute of a process or equipment that ensures that each and every failure
or combination of failures results in the system attaining safe condition.
Modern safety engineering prefers the term ‘safety critical’ and to define safety
integrity levels.
Fatal Fault A software or hardware fault which makes the continued operation of a module
impossible. A fatal fault in a vital module will result in negation of the system
before the safe operation of the railway is compromised. See also Non-fatal Fault.
Fault Bus Part of the WESTRACE Backplane. Provides a mechanism for WESTRACE modules
to report fault codes to the DM or NVC/DM.
Fault Code An numerical code which a WESTRACE module displays on its front panel fault
display and which is logged by the DM or NVC/DM. This code indicates a self-
diagnosed fault in the module, or, in the case of the NVC/DM, an externally
connected module. Phase 1 WESTRACE modules use 8 bit fault codes, while the
NVC/DM use 16 bit codes.
GCS Graphical Configuration System—a set of Windows-based WESTRACE

applications and associated manuals. The GCS comprises the GCSS and the ICS.
Used for all WESTRACE using HVLM128 or later vital logic module based systems.
GCSS Graphical Configuration Sub-System—a Windows-based WESTRACE application

used by Signal Engineers to enter data to define the functionality of the
Gl
WESTRACE system. Used for all WESTRACE using HVLM128 or later vital logic
module based systems.
GSIM Graphic Simulator —a Windows-based WESTRACE application that provides

graphic on-screen simulation of Local Control Panels and the status of tracks and
trackside equipment of the railway under simulation.
HDLC High-level Data Link Control protocol—a commonly used computer protocol for
serial communication. The WSA/S2 and protocol is based on HDLC.
Health Monitoring Part of the WESTRACE Backplane. Provides a mechanism for vital WESTRACE
modules to check the health of each other.

Glossary
Hot Standby The arrangement where two WESTRACE installations, a main and a standby, run
in parallel. The standby system is able to automatically take over in the event of a
fault.
Housing The physical unit used to hold the WESTRACE modules in an installation. Up to
four housings may be interconnected within the one installation.
HVBC Hot Standby Vital Backplane Card—a small, half height, printed circuit board
installed directly behind the lower connectors of the HVLM128.
HVLC Hot Standby Vital Logic card—is the central processing module for an HVLM128.
HVLM128 Hot Standby Vital Logic Module—a WESTRACE that controls the operation of each
WESTRACE system. It performs all logic processing and supervises
communication between each WESTRACE module and itself. Two systems using
these modules may be operated as main and standby with automatic changeover
on most failure situations.
HVLM128a Hot Standby Vital Logic Module—same as HVLM128 but with modified capacities.
HVLM PFM Hot Standby Vital Logic Module Protection and Filter module.
I/O Input and Output
I/O Assignments The allocation of mnemonics to specify inputs and outputs.
ICS Installation Check System—WESTRACE software used by the Signal Engineer to

verify that the Configuration Data PROMs fitted to an installation are valid and are
consistent with the approved design. Used for HVLM128-based systems.
IHCL Inter-HVLM Communications Link—a fibre-optic connection used in a hot standby

system to transfer data between the main and standby VLMs.
INCL Inter-NCDM Communications Link—a fibre-optic connection used in a hot standby

system to transfer data between the main and standby NCDMs.
ILS Internal Logic State—a one-bit storage element which is associated with a
mnemonic name.
Image File A copy of an installation’s vital or non-vital CED stored on a PC for use by tools
such as MoviolaW.
IMB Inter Module Bus—part of the WESTRACE Backplane. Provides general purpose
parallel data communication between the VLM and other WESTRACE modules.
Initialisation This is a time prior to normal operation when the installation determines the
(System) current state of the external inputs.
Installation A single physical WESTRACE system, comprising up to four standard WESTRACE

housings.
A set of railway signalling application data.
Input The input to the VLE.
ISIM Interlocking Simulator—a WESTRACE tool that enables testing of railway signalling
logic in the office prior to commissioning a system.
Ladder Logic A form of boolean logic that is used to define the application data. It consists of
relay equivalent logic and is input using the GCSS or CSS.
Latches These are internal logic states within the installation logic and are shown as relay
coils in the ladder logic. They do not have a physical input or output.

Glossary
LEC Logic Evaluation Card—part of an NVC/DM. Performs all (non-vital) logic and
communications processing.
LED Light Emitting Diode
Location Case A metal cabinet housing WESTRACE equipment.
MB Megabyte
Mnemonic Abbreviated names that consists of numbers and letters to represent particular
logic states or functions.
Module Bit This is the process of allocating mnemonics to I/O bits on a module.
Allocation
MoviolaW MoviolaW is a suite of Microsoft Windows based diagnostic tools for WESTRACE
Vital Signalling Systems and other railway systems.
Multidrop A serial cable configuration where multiple slave devices are connected to a
single cable coming from a master device. The cable can be a single line or loop
configuration. See also Point-to-point.
Master
Slave Slave Slave Slave Slave
Master Slave Slave Slave
Slave Slave
NAPPDEL Non-Vital Application Delay Timer. See also APPDEL.
NCDC Network Communication Diagnostic Card—the NCDM’s main circuit board.
NCD PFM or Network Communication Diagnostic Protection and Filter Module

NCDC PFM
NCDM Network Communications Diagnostic Module—comprises an NCDC and an

NCD PFM.
Negation Shutting the system down to a safe state.
Non-fatal Fault Faults such in software, hardware or other equipment that do not compromise the
safe operation of the railway. See also Fatal Fault.
Non-Vital Telemetry The means of communicating non-vital data from the WESTRACE to an external
system such as a local control panel or control centre. Gl
NVC Non-Vital Communication Module—a WESTRACE serial data module used for
communicating serially between WESTRACE Installations and a non-vital control
system or similar.
NVC/DM Non-vital Control and Diagnostic Module
NVLM An acronym representing non-vital logic modules such as the NVC/DM or NCDM.
OPC Output Power Card—part of VLM and HVLM128. A circuit board that controls the
OPCR andVSEV.
OPC-PFM Output Power Card Protection and Filter Module.
OPCC Output Power Control Card

Glossary
OPCM Output Power Control Module—comprises an OPCC, a VBC and an OPC-PFM.
OPCPR Output Power Control RePeat Relay—an additional relay that is switched by a front
(normally open) contact on the OPCR. It is used when there are not enough
contacts on the OPCR.
OPCR Output Power Control Relay (or followed relay)—used to isolate parallel outputs
when the WESTRACE system cannot be guaranteed to be operating safely. This
relay is used as the final arbiter of system safety.
Output The output of the VLE, such as a relay or lamp output.
PC Abbreviation for Personal Computer (historically, an “IBM compatible” personal

computer).
PCGE Personal Computer Graphic Editor—a PC based application used to create

graphical display files used by MoviolaW, WESTCAD and GSIM.
PCM Pulse Code Modulation
PFM Protection and Filtering Module—used to isolate the internal WESTRACE

environment from the external electrical environment by providing screening,
filtering and over-voltage protection.
PIOFLT Parallel Input Output Fault—a vital mnemonic representing a parallel input or
output fault.
PLCC Plastic Leaded Chip Carrier
PM Protection Module
Point-to-point A cable configuration where a separate cable is used to link two systems. See also
Multidrop.
Printouts Output from a computer driven printer.
PRM Portable Radio Monitor
PROM Programmable Read-Only Memory—a computer memory device that retains its
contents without power (ie ‘non-volatile’). See also EEPROM and EPROM.
PROM Program The printed record of PROM programming having taken place.
Form
PROM The process used to store data into PROMs.

Programming
PSU Power Supply Unit
PTM Portable Transponder Module
RAM Random Access Memory
RS232-C An electrical interface standard used for serial connection of one device to
another (Point-to-point) for the purpose of data communications.
RS422 An electrical interface standard that uses differential signal levels allowing
operation over longer distances.
RS485 Electrically similar to RS422 but also supports Multidrop operation.
RSE Railway Signalling Equipment
RTC Real Time Clock

Glossary
Rung A part of Ladder Logic. A rung is the group of logic (relay equivalent contacts) that
control a latch or output (relay equivalent coil).
SDLC Synchronous Data-Link Protocol—see HDLC.
SIL Safety (or sometimes Software) Integrity Level
Simulation Testing of the WESTRACE Application Logic on a PC or other device rather than
the actual system.
Slot This is a space in a housing where WESTRACE modules can be inserted.

WESTRACE modules occupy one or more slots.
Source File A file that contains the data that has been entered into the GCSS or CSS.
Surge Arrester Any device for controlling electrical surges on circuits entering a location,
including gas discharge arresters, semiconductor arresters, or arresters
combining both types.
Telemetry Data communication system. The process of transmitting data between two
points.
Temporary The process of forcing a timed approach control on a signal to minimise entrance
Approach Control speed. The total process or applying, retaining and removing the control must
allow it to be vital.
Time-of-Day Timer A timer whose output is set at a particular time of day.
Timer A device or circuit that provides time signals at regular, specified intervals for
purposes of controlling a sequence of events or synchronising events in separate
operations. Ladder logic uses software timers.
Timestamp Indicates the date and time at which a logged event, fault or operation occurred.
Transfer States A set of logic states that will be able to be transferred from the NVC/DM to the
VLM and vice versa.
UHVBC Universal Hot Standby Vital Backplane Card—interconnects the VLC, the OPCC
and the OPC-PFM. Also contains links for setting the installation address.
VBC Vital Backplane Card—interconnects the VLC, the OPCC, the CEC (original-VLC
only) and the OPC-PFM. Also contains links for setting the installation address.
Vital Pertaining to system safety. Used an adjective to describe a process, function or

equipment that, when not operating correctly, can adversely affect the safety of a
system.
Vital Bar Generic term to refer to Vital Blocking and Temporary Approach Control. Gl
Vital Blocking Process used to prevent the Signalling System to allow sections of track being
allowed to be occupied. The total process or applying, retaining and removing
the block must allow the blocking to be vital
Vital Communication of data that required for the safe operation of the WESTRACE
Communications system. Vital communication is between WESTRACE systems.
VLC Vital Logic Card—a general term for the original VLC, the HVLC, the VLC5 and the
VLC6.
VLC5 Vital Logic Card for the VLM5.
VLC6 Vital Logic Card for the VLM6.

Glossary
VLE Vital Logic Equipment—is the physical WESTRACE equipment, both vital and non-
vital.
VLM Vital Logic Module—WESTRACE which controls the operation of each WESTRACE
system. It performs all logic processing and supervises communication between
each WESTRACE module and itself. This is a collective term for the original VLM1,
the HVLM128, the VLM5 and the VLM6.
VLM1 Vital Logic Module1—the name given in the Invensys Rail WESTRACE manuals to
the original and largely superseded vital logic module which was known as the
VLM.
VLM128 See HVLM128.
VLM128a See HVLM128a.
VLM5 Vital Logic Module—has essentially the same functionality as the HVLM128 but has
a greater capacity.
VLM6 Vital Logic Module—has essentially the same capacity as the VLM5 but can also
provide vital communications over a network to connected WESTRACE systems
when used in conjuction with an NCDM.
VLOM Vital Lamp Output Module—WESTRACE module used for driving relays or similar
loads.
VPIM Vital Parallel Input Module—WESTRACE module used for accepting vital parallel
inputs into a WESTRACE installation.
VROM Vital Relay Output Module—WESTRACE module used for driving signalling relays
or similar loads.
VSEV Vital Serial Enable Voltage—a vital control voltage used to enable vital serial
communications to and from a WESTRACE installation.
VTC Vital Telemetry Continuous Module—a WESTRACE module used for vital
communication (17 bit) between two WESTRACE systems.
WCM WESTECT Communication Module—used to communicate signalling information

from an interlocking or WESTECT Encoder to an ATP equipped train. It is used as
part of the WESTECT ATP system.
WESTECT WEStinghouse automatic train ProTECTion.

WESTECT ATP WESTECT Automatic Train Protection is an Invensys Rail proprietary system that
overlays on a WESTRACE signalling system and prevents driver error from
endangering the train.
WESTECT Encoder In its simplest form, a WESTECT Encoder comprises a WESTRACE system, a
communications rack and an antenna system.
WESTRACE WESTRACE is an acronym for WEStinghouse Train Radio Advanced Control

Equipment. It is a modular, safety critical, programmable electronic signalling
system that has been designed for safety control systems for Railway Signalling.
WESTRACE I/O General term for any module designed to be plugged into a slot in a WESTRACE
Module housing, excluding diagnostic and logic processing modules.
WNC WESTRACE Network Communications—generic name for complete WESTRACE

system using and NCDM to facilitate communications over an Ethernet network.
WNCM WESTRACE Network Communications Module—comprises the VLM6 and NCDM.

Glossary
WRSA Westinghouse Rail Systems Australia, now known as Invensys Rail.
WSA/S2 A serial telemetry protocol developed by Invensys Rail in Asia-Pacific.
WSL/S2 A serial telemetry protocol developed by Invensys Rail in Europe.
Gl

Invensys Rail
Reader’s Comments
Reader’s Comments
Invensys Rail values your thoughts as the user of this document. We would be grateful to receive your
views about this document and welcome any suggestions for improvement. Please send your
comments to:
The Manager, Technology and Training

Invensys Rail
380 Docklands Drive, Docklands, Victoria 3008, Australia
Phone +61 1300 724 518 Fax +61 3 9616 9001

E-mail [email protected]
Document Name: WESTRACE MkI Application Manual

WRTOAPPM, Issue 11.0
Document Owner:
Contact Name:
Address:
Email:
On a scale of 1 to 10, please rate this document for being suitable to your needs. A rating of 0 means
this document is of no benefit; a rating of 10 means it is completely satisfactory for the intended
purpose.
0 5 10
Rating:
no benefit very useful
Comments:
Signed: Dated:
Comments are continued on the following _______ pages.
WESTRACE MkI Application Manual Issue 11.0

Invensys Rail

7 PDF

Uploaded by

Copyright:

Available Formats

7 PDF

Uploaded by

Document Information

Original Title

Copyright

Available Formats

Share this document

Share or Embed Document

Sharing Options

Did you find this document useful?

Is this content inappropriate?

Copyright:

Available Formats

7 PDF

Uploaded by

Copyright:

Available Formats

What are the different types of WESTRACE modules mentioned?

What are the different types of WESTRACE modules mentioned?

What are the different chapters covered in this manual?

What are the different chapters covered in this manual?

This manual:

CONTACTING INVENSYS RAIL

Asia Pacific - Mainline

Asia Pacific - Metro

Spain, Portugal and Latin America

UK and Northern Europe

Document CI: WRTOAPPM

Date of Issue: 12 December 2011

This is the Application Manual for WESTRACE Vital Signalling Equipment.

WESTRACE equipment is designed to be used for railway signalling

SAFETY WESTRACE MkI is a safety-critical system.

Note: The Railway Operating Authority is responsible for ensuring a safe

WESTRACE MkI Application Manual Issue 11.0 v

WESTRACE MkI Application Manual Issue 11.0 vii

3.6 Vital Communication Over a Network . . . . . . . . . . . . . . . 3-15

viii Invensys Rail

WESTRACE MkI Application Manual Issue 11.0 ix

4.5 WESTECT Communication Module (WCM) . . . . . . . . . . . . . 4-29

4.9.4 Specific Application Rules . . . . . . . . . . . . . . . . . 4-71

WESTRACE MkI Application Manual Issue 11.0 xi

6 Testing and Commissioning

Appendix A: Module Descriptions

xii Invensys Rail

A.2.3 VLM5 Indications . . . . . . . . . . . . . . . . . . . A-21

WESTRACE MkI Application Manual Issue 11.0 xiii

A.6 Vital Relay Output Modules (VROM) . . . . . . . . . . . . . . . . A-67

xiv Invensys Rail

A.11.3 Function . . . . . . . . . . . . . . . . . . . . . . . A-94

WESTRACE MkI Application Manual Issue 11.0 xv

A.12.7 External Connections . . . . . . . . . . . . . . . . . . A-142

xvi Invensys Rail

A.16 Power Supply Unit (PSU) . . . . . . . . . . . . . . . . . . . . A-166

Appendix B: Module Operation

WESTRACE MkI Application Manual Issue 11.0 xvii

B.4 Vital Logic Module (VLM6) . . . . . . . . . . . . . . . . . . . B-12

Appendix C: Hot Standby Operation

Appendix D: Non-Vital Communication Protocols

xviii Invensys Rail

1.1 WESTRACE and Related Manuals . . . . . . . . . . . . . . . . . . . 1-3

WESTRACE MkI Application Manual Issue 11.0 xix

4.17 External Connections—VPIM PFM . . . . . . . . . . . . . . . . . . . 4-26

A.5 Layout—VLC5—VLM5 . . . . . . . . . . . . . . . . . . . . . . . . A-17

WESTRACE MkI Application Manual Issue 11.0 xxi

A.56 External Connections—SIO422 PFM—NVC . . . . . . . . . . . . . . . . A-154

xxii Invensys Rail

2.1 Influence of VLM type on selection of other Modules . . . . . . . . . . . . . 2-6

WESTRACE MkI Application Manual Issue 11.0 xxiii

A.14 Fault Codes—VLM1 . . . . . . . . . . . . . . . . . . . . . . . . A-54

xxiv Invensys Rail

A.65 DB25 Pinout—SIO232 PFM—NVC . . . . . . . . . . . . . . . . . . . A-153

WESTRACE MkI Application Manual Issue 11.0 xxv

1.1 New in This Issue

1.2 Purpose of Manual

WESTRACE MkI Application Manual Issue 11.0 1-1

[SOM] WESTRACE System Overview Manual, WRTOOVER: describes