Contents

Smartlock 400 (SML 400) 3

Central Interlocking (CIXL) 4-7

Trackside Interface Communications Cubicle 8-9

Support System 10 - 14

Trackside Functional Modules (TFM) 15

Emergency Signal On Control (ESOC) 15

Smartlock 400

Smartlock 400 System (SML400)

is a computer-based interlocking
(CBI) system designed specifically
as a successor to Solid State
Interlocking (SSI) for all signalling
applications in the United Kingdom.
Compared with SSI, SML400 offers:

• Reduction in number of cross-boundry

communications required due to increase in
potential size of interlocking coverage;
• A reduction in the physical size of central
interlocking equipment;
• Compatibility with current communications
technology;
• Updated facilities for the maintainer: graphical
interface, improved fault analysis;
• Improved application engineering tools for test
and incident analysis.

Initially, Smartlock 400, retains the Trackside Functional Control Systems, such as the Integrated Electronic Control
Modules (TFM) and trackside communications link that are Centre (IECC), being able to provide the required
used with SSI. connections to the IECC or equivalent network.

It can interface with a conventional signaller’s entrance/ The main elements of a typical Smartlock 400 scheme are
exit (NX) panel and is also compatible with VDU-based shown in Figure 1.

Figure 1
Main elements of a typical
Smartlock 400 Scheme.

3
Smartlock 400
There are three key elements to the SML400:
1 The Central Interlocking (CIXL) is the heart of the
SML400. It consists of a 2 out of 3 (2oo3)
platform loaded with the specific application data
and the interlocking software.
2 The Trackside Interface Communications Cubicle
(TICC) is responsible for managing the external
trackside communications networks and the
protocol for communication with TFMs.
3 The Support System is composed of a Support
System Cubicle (SSC), one or more user interface
PCs (client PCs) and printers. It provides all the
necessary information and controls required by
the maintainer and signalling technician for
maintaining and controlling the signalling system.
In addition to the local clients, a remote
maintainer facility is available with connection via
a secured Wide Area Network (WAN).
Functional Description
The CIXL contains interlocking memory that records the
current state of the railway under its control; this includes
functions such as signal lamp proving, point detection and
track section occupancy. It also stores internal interlocking
variables such as approach locking and timing functions.
The interlocking memory states are referenced by the
signalling logic to determine when and which controls may
be sent to the trackside devices: point movements and
signal aspects etc. as determined by changes of input
states from the trackside, or requests made by the signaller.
SML400 allows the CIXL to be partitioned into a number of
“virtual interlockings” (VIXLs) that are independent of each
other functionally and communicate by means of a
dedicated internal message mechanism. The interlocking
memory is partitioned among the VIXLs, with any given
signalling function belonging to one - and only one - VIXL.
Each VIXL has its own links to the Signaller’s control and
display system.
Two or more VIXLs can process requests at the same time,
independently of each other, such that the CIXL is able to
work with more than one signaller at any one time. The
maximum number of VIXLs in a CIXL is 8; each is size-
limited by its trackside address space and controls a
specific group of up to 63 TFMs over its own external
communication network. When replacing an SSI scheme,
each VIXL is equivalent to one of the SSI scheme’s central
interlockings and the internal messages between VIXLs are
equivalent to the SSI’s Internal Data Links (IDLs).
4
The TICC houses the equipment responsible for interfacing
the CIXL to the TFM network. It receives input regarding the
state of the trackside interfaces from the TFMs and
forwards these indications to the CIXL. Based on its image
of the railway, the CIXL then evaluates the interlocking logic
for an individual VIXL and determines the controls to be
output through the TICC to all TFMs for that VIXL.
The Support System provides diagnostic functionalities
such as monitoring, alarm management, event log
management, user access management and configuration
facilities. It also provides signalling technician’s control
functionality to start/stop (put off-line) VIXLs and apply /
remove restrictions to prevent signals clearing, points
moving, routes setting etc. (mimicking those provided for
an SSI).
Central Interlocking (CIXL)
Overview
The CIXL is at the heart of the SML400 and is based on
Alstom’s “2oo3 Platform”, which is a general-purpose safety
computer for railway signalling and control applications. The
interlocking software within the CIXL is general-purpose and
is configured for:
• Network Rail’s Generic Requirements, and
• The specific requirements of each signalling
scheme, via the application data (this is prepared
in accordance with the scheme plan, control
tables and other relevant input information using
the Smartlock 400 application engineering system).
The CIXL manages the interface with either type of Traffic
Control System (TCS) used in the UK; that is, the CIXL
provides direct interfaces to Panel Multiplexers (PMUXs)
which are required by an NX panel, and/or direct interfaces
to an IECC – or similar systems supporting the same
interface e.g. Modular Control System (MCS).
The CIXL is configured with three memory cards (PCMCIA
cards) loaded with the specific application data and the
interlocking software. Additionally, each computing channel
has its own identity device. The information (scheme name,
CIXL identity and VIXL data version) loaded from the identity
devices is checked against the memory cards content.

In the event of internal failure the CIXL can change

seamlessly, and without any required intervention by
operators, to 2 out of 2 (2oo2) operation (whilst at the same
time isolating the failed module).

The CIXL contains the following components:

1 I/O subsystem 4 Fan Unit

2 Computing subsystem 5 Switches/Fuses Panel

This includes three redundant channels which 6 I/O Panel

implement the 2oo3 architecture.
7 Main Inlet Panel
3 Maintenance Panel
8 Main Power Supply Unit

5
Smartlock 400

Front Side

2003 PLATFORM

Blanking Panel

I/O SUBSYSTEM

I/O Group A I/O Group B

Subrack for I/O Cabling
I/O A PSU

I/O
I/O B, SAU card #1
I/O B, SAU card #2
I/O B, SAU card #3
I/O B, SAU card #4
I/O A, SAU card #1
I/O A, SAU card #2
I/O A, SAU card #3
I/O A, SAU card #4

I/O B, EAU card #1

I/O B, EAU card #2
I/O A, EAU card #1
I/O A, EAU card #2
Debug connectors

Debug connectors
Blanking Panel

Blanking Panel

Subsystem
I/O B PSU

Bonding
ESD
I/O SUBSYSTEM
Serial
Stud
Bus
Computing Computing Computing
Channel A Channel B Channel C Subrack for
Computing
Main Processor

Main Processor

Main Processor
Blanking Panel

Blanking Panel

Blanking Panel

Subsystem
REDMAN

REDMAN

REDMAN
HSCU

HSCU

HSCU
PSU

PSU

PSU

Channel A Channel B Channel C

MPU Serial ID Plug MPU Serial ID Plug MPU Serial ID Plug
Port Port Port

Maintenance Panel
Subrack for
FAN UNIT
Fan
FAN UNIT Switch

Blanking Panel

SWITCHES / FUSES

I/O Ch Ch Ch I/O
Panel for
A A B C B Switches &
Fuses I/O Termination
Panel
Power
Main PSU Supply Unit Main PSU Power Supply
#1 Subrack #2 Unit Subrack IEC Mains
Sockets
Mains & Circuit
Isolating Breakers &
VENTILATION GRILLE
Transformers Primary
Earth Stud
Not to scale

External
Figure 2 Cubicle layout. Cable Entry

Cubicle Layout

The CIXL is implemented in a standard (19-inch the LRUs are labelled to avoid the insertion of
series) rack with an internal height measurement that incorrect equipment. Provision is made, via the front
is 37U-high, the Cubicle layout is shown in Figure 2. panel switches, for the Maintainer to actively change
the LRUs within the platform whilst it is running. The
All Line Replaceable Units (LRUs) and indicators are LRU must be powered off before any manipulation.
accessed from the front of the Cubicle; apertures for

6
Environment I/O Subsystem Design

The cubicle is designed for operation in the following The I/O Subsystem is based on a Dual Modular
environmental conditions: Redundant 1 out of 2 (1oo2) architecture.

• Ambient temperature variations, in the range The maintainer, is able to power on and off each I/O
from 0 to +45oC. Group.

• Non-condensing relative humidity, in the range

from 5% to 95%.

Computing Subsystem

The computing subsystem is based on a Triplicated

Modular Redundancy (TMR) architecture and each
computing channel contains 4 LRUs (see Figure 2).

The maintainer, is able to power on and off each

computing channel. This facility provides seamless
operation when carrying out maintenance.

7
Smartlock 400

Trackside Interface Communications Cubicle layout

Cubicle (TICC) The TICC Cubicle is contained in a standard (19-inch
series) rack with an internal height measurement that
Overview
is 37U-high. The Cubicle layout is shown in Figure 3.
The TICC houses the equipment responsible for:

• Managing the external trackside communications

networks
• The protocol for communication with TFMs.
There will generally be 1 or 2 TICCs per CIXL,
depending on the number of Trackside Data Links
(TDLs) required; however, this can vary depending on
the overall size of any given system. A TICC can
support 2 or 4 data link pairs, depending on the
model used.
All LRUs and indicators are accessed either from the
front of the Cubicle (for FE, GW and Main PS) or from
the rear of the Cubicle (for LDT and DLM); apertures
for the LRUs are labelled to avoid the insertion of
incorrect equipment. Provision is made, via the front
panel switches and the rear power distribution rail, for
the Maintainer to actively change the LRUs within the
TICC whilst it is running. The LRU must be powered
off before any manipulation.

The TICC contains pairs of Gateways (GWs) and their

associated Front Ends (FEs) (with 2 FE cassettes per
FE rack), together forming what are referred to as
Trackside Functional Module Gateways (TFMGWs).
The FEs handle the interface between the CIXL
cubicle and the GWs and conduct the polling as the
bus master, whilst the GWs act as protocol
converters. The FEs are fully duplicated internally with
normal and reserve cassettes.

The TICC also contains a pair of SSI communications

modules (either Data Link Modules (DLMs) or Long
Distance Terminals (LDTs)) for each pair of GWs,
which provide the communications with the TFMs at
trackside (where the signals are received by further
DLMs and LDTs respectively, which then relay the
data to and from the TFMs). The TFMs will be either
Signal Modules (SMs) or Points Modules (PMs),
dependent on what equipment is required to be
operated.

Also contained within the TICC is a power rack

providing duplicate 48V d.c. supply to the GWs. The
incoming 110V a.c. supply is also duplicated; one for
all the equipment associated with the ‘A’ channels
and “normal” front end cassettes and one for all the
equipment associated with the ‘B’ channels and
“reserve” front end cassettes.

8
 Rear View Side View Front View
(Door removed) (Panel Removed) (Door removed)

Front End
Rack

TFM Gateway
Rack
DLM or
LDT
DLM DLM LDT LDT

Power
Distribution Front End
Rack

TFM Gateway
Rack
LDT

LDT LDT LDT LDT

I/O
Sockets

110V Power
Sockets & 110V ac /
Switches 48V ac
Power Tray

Not to Scale

Figure 3 TICC Type SM4020 mechanical configuration.

Environment The TFMGWs, formed by the combination of the

The TICC is designed for use in buildings without
climatic control (Class T1 according to EN 50125-3),
with an operating temperature range of 0 to 35°C
with relative humidity up to 85 %. The storage
temperature range is 0 to 55°C. It meets the
environmental requirements of British Railways
specification BR967, Category B.
Trackside Functional Module Gateways
(TFMGWs)
The Trackside Functional Module Gateway (TFMGW)
Subsystem provides the functional interface between
the CIXL and the TFM through the TFM Network.
Front Ends (FEs) and Gateways (GWs), therefore
provide the interface between the Central Interlocking
(CIXL) and the communications modules (DLMs or
LDTs) providing the Trackside Data Links (TDLs). They
are responsible for managing communication, via the
TDLs, with the TFMs on their networks (including
setting the cycle time and dealing with any reply
messages that might be missing because of a TFM
failure). Separate GWs are provided for the ‘A’ and ‘B’
TDLs. Normally, both links are in operation but a TFM
will respond if it receives a telegram on one link only.
The TFM sends its reply messages simultaneously on
both ‘A’ and ‘B’ networks.

9
Smartlock 400

Support System To ensure the communication between these

Overview
The support system is mainly composed of a Support
System Cubicle (SSC) and one or more client PCs. It
provides all the necessary information and controls
required (by the Maintainer and Signalling Technician)
for monitoring and managing the signalling system
during maintenance activities. In addition to local
client PCs, a Remote Maintainer facility is available,
with connection via a secured Wide Area Network
(WAN).
elements and the CIXL, a redundant network called
Internal Maintenance Network (IMNet) is used.
The Support System employs a dual redundant
configuration of the Support System’s servers –
(SSer’s) – as shown in Figure 4. In common with
other parts of the SML400 system, this dual-
redundant configuration provides a system tolerant to
first failures.

Architecture

The support system is based on a client/server

architecture, shown in Figure 4. The main elements of
the support system are as follows:-

• Redundant support system servers (support

server A and B)
• Local support system client
• Time source
• Printer
• Remote client

IMnet

Monitor Link
(RS-422)

CIXL
Remote Time Signalling
Maintenance/ Source Technicians
Diagnostic Terminal (client)
Terminal
(client) Server (B) Server (A)
Printer

Dual/Redundant

SUPPORT SYSTEM

Figure 4 Architecture of the Support System.

10
The Support System includes at least one dedicated
workstation for the Maintainer and Signalling
Technician with a screen, keyboard, mouse and
printer for one or more CIXLs. More than one local
terminal with full functionality is used for operational
UK schemes within the signalling control centre. The
current configuration of the support system cubicle
provides one rack-mounted PC as the Maintainer’s
workstation. Other workstation PCs may be
distributed around the signalling control centre as
required.
Each support server logs all system activity on a pair
of logging devices, one of which may be removed for
analysis offline in case of incident/accident
investigation. Data logs may also be transferred to
offline facilities for analysis via removable media,
including USB flash drives and recordable DVD discs,
for less critical events.
The support system’s servers are linked to the CIXLs
by the IMNet, which is compatible with open
communications. The IMNet is a pair of redundant
networks that link:
• the CIXL to the support servers
• the clients, printers and the NTP time source to
the servers.
The redundant networks are linked together at the
central switches to allow the redundant support
servers to communicate. WAN links may be provided
to allow clients at remote locations to access the
system but with restricted functionality. A separate
network may be used to link remote clients to a
“local” client (nominated as a client gateway) using
WindowsTM terminal services software. A version of
the SSC also includes connection to the IDNet
enabling sensing and logging of communications
(read only) between CIXLs and to another
interlocking.
In addition to the diagnostic information received via
the IMNet, each CIXL Extended Adaptation Unit (XAU)
is connected to the support system servers via a
synchronous serial RS-422 Monitor Link. This link
enables ‘snooping’ to be performed by the support
system on the trackside communication data passing
between the CIXL and TFMGW. This information is
logged and incorporated into the live databases on
the support servers.
Functionality
The support system provides both diagnostic and
signalling technician functionality as follows:
Diagnostic Functionality
A. Monitoring: Provides text and graphical
information on the state of different elements of the
interlocking such as the CIXL, trackside objects,
communications equipment and links.
B. Alarm Management: Performs fault diagnosis and
provides text and graphical information on faults and
important events (including information on the
health/state of the elements concerned) detected by
the system.
C. Event Log Management: Logs and stores all
events in the exact order of their detection and
provides access to historical data.
D. User Access Management: Controls user access
to the different functions of the support system.
E. Configuration Facility: Provides configuration of
the support system where an individual application is
described through a set of configurable application
data.
Signalling Technician Functionality
A. Interlocking mode control: Allows the technician to
change the operating mode of the CIXL and individual
VIXLs including starting/stopping.
B. Temporary controls: The support system provides
commands to the technician to impose or remove
temporary controls on the operation of the
interlocking. Owing to potentially serious
consequences of the setting and, in particular, the
clearance of controls, the mechanism by which the
commands are issued (i.e. controls are set and
cleared) is Safety Integrity Level (SIL) 1.
In addition to the local clients, a remote maintainer
facility is also available with connection via a secured
WAN. The remote terminal will have the same
operator interface as a local version, but with
restricted functionality.
11
Smartlock 400
Cubicle Layout
The cubicle itself is a standard industrial type,
dimensions 1.2m (h) x 0.6m (w) x 1.0m (d). The
mechanical configuration of a typical SSC is shown
in Figure 5.
Environmental
The SSC is designed for use in buildings without
climatic control, class T1 according to EN 50125-3,
with limited operating temperature range of 0 to 35°C
with relative humidity up to 85%. The storage
temperature range is 0 to 55°C. It meets the
environmental requirements of British Railways
specification BR967, Category B.
Figure 5 Support System Cubicle.
12
Support Servers
Two rack-mounted industrial servers host the
software that monitors the state of the overall
Smartlock 400 system and the equipment under its
control. These provide a central service for individual
client PCs.
Each support server maintains a database that
records system events (including alarms and system
status). The users may query the database on-line to
see the sequence of events surrounding any alleged
incident or failure. Files that record the full set of
events, in sequential order, and further files that
permit a graphical replay, are also held on these
servers for a period of 14 days. Copies of these files
may be taken on a removable USB drive. The log
files are held on mirrored “solid state” drives, a
pair of which is provided on each server.
The mirroring provides “1 out of 2”
redundancy on each server in the event
of drive failure, which also permits,
Support in extreme circumstances, one
Server A Solid State Drive from each
server to be taken away by
the investigating authority,
KVM Switch
whilst leaving the system
fully operational.
Support
Server B
(Redundant
Server)
Client PC
Time Server
Patch Panel
LAN Switch
LAN Switch
Local Support System Client/Client Gateway

A Local Client PC, mounted in the SSC, provides a

user interface for the maintainer/technician to
graphically view the state of the system and the
equipment under its control. It is also the point of
entry for the application and removal of technician
controls. It communicates via a LAN connection to
one of the support servers, but automatically
switches to the other if this connection is lost.

Where remote client terminals

are provided to allow distant
maintainers to view the system
via a WAN link, the remote
users log into the client
gateway via WindowsTM
terminal services.

The local client is a

Commercial Off The Shelf
(COTS) rack-mounted
industrial computer. It is
contained in a 2U high rack
mount chassis. If remote
maintainer access is provided,
then this is replaced by the
externally similar client
gateway.

Time Server - MSF Clock

An external clock is provided to allow synchronisation

of time across the various servers and clients within
the Support System, such that time stamps applied
to logged events are against a consistent time frame
linked to a common source that is synchronised to
national time.

The Galleon NTP Time Server is a 2U height rack KVM Switch

mounted unit. It connects directly to an Ethernet LAN
via the switches and incorporates a Galleon MSF A Keyboard Video & Mouse (KVM) switch is provided
radio atomic clock with remote antenna that can be to permit a single technician’s work position to be
positioned up to 200 m (600ft) away. It includes a switched as a control/display for a local client PC, or
LCD signal strength display for easy installation, an either of the support servers.
integral time display and 2 x LAN connections. A
software driver is included for uni-cast, broadcast or
multi-cast time synchronisation. The unit conforms to
Network Time Protocol Version 4 (NTP V4).

13
Smartlock 400
Desk Top Clients
Further local client PCs may be provided to permit
technicians within range of the locally switched part of
the IMNet LAN to access the system, ie. without
involving transmission over the WAN. A desk top
client PC is provided for such purposes. Copies of
saved logs may be transferred to removable USB
storage devices.
Remote Clients
remote users may access the system via WAN links
through “thin client” terminals. These may be used to
log into the client gateway PC using WindowsTM
terminal services. These devices have limited
functionality, but transmit key strokes and mouse
movements/clicks to, and receive screen updates
from, the client gateway, over the WAN link. These
terminals connect via a remote router which provides
secure communication, via the WAN link, with a
central router.
14
Printers
At least two printers from the approved equipment list
will be provided at the SCC to ensure technician
control states can be printed, signed and centrally
saved. The printers may also be used to print screen
shots of current system states or historical events to
assist with investigation and analysis. A screen shot
of the “states” mimic is advised to support any screen
shots that might rely on colour. Printers may also be
provided at remote locations if required.
Trackside Data Links (TDL)
Each TDL communicates with up to 63 TFMs and
can employ Data Link Modules (DLM) to provide
baseband links between the interlocking and the
trackside part of the link, or they can use a Long Line
Link (LLL) as provided by LDTs over a
telecommunications interface. They are the same
data links provided by an SSI system and afford the
same (accepted) level of Safety Integrity for carrying
safety information between the CIXL and the TFMs.
Two levels of coding protect the information sent on
them. They are fully duplicated for high availability
with separate ‘A’ and ‘B’ links.
The baseband link uses a dedicated twisted pair
cable over which data is transmitted in half-duplex
mode at a rate of 20 kbits/s by the DLMs. Separate
cables are provided for the ‘A’ and ‘B’ links and they
can, if required, be run over different physical routes
in order to increase availability.
The maximum length of the baseband link, including
any spur up to 1 km in length, is 10 km (but it can be
extended to 40 km by using repeaters at intervals of
up to 8 km).
Trackside Functional Modules (TFM)
Trackside Functional Modules (TFMs) are the local
interface with vital signalling equipment at the trackside.
These are the same modules that are employed by
SSI. Two types are currently in use in the UK as follows:
In the absence of controls from the Central
Interlocking, all TFMs will assume the “red retained”
state, and display their “most restrictive” aspects.
Points will remain locked in their current positions.
The subsystems in the TICC take approximately 10
seconds to recover once power is restored, but the
CIXL takes between 2 and 3 minutes to restart, but
then enters a 4 minute timeout to ensure that all
trains that may have previously observed clear signal
aspects have come to a stand. During this timeout
period, signals will be sent controls for their most
restrictive aspects and points will not be controlled by
the Central Interlocking, hence remain locked in their
current positions.

Signal Module (SM)

The Signal Module is designed to provide the power

interface with coloured-light signals, and is sufficiently
flexible to handle other signalling loads as well. It
provides inputs for current proving and for general
purpose signalling inputs such as track circuits.

Points Module (PM)

The Points Module forms the power interface for

direct drive of clamplock type point motors. Other
types of point machine such as the Alstom Type HW
are driven via interface relays. The PM provides inputs
for point detection and general purpose signalling
inputs such as track circuits.

Emergency Signal On Control (ESOC)

An “Emergency Signals on Control” feature is
provided by a circuit that, when the signaller presses
a button dedicated to a specific area of control,
removes power (both A and B supplies) from the CIXL
and all TICCs used to control the data links in that
area.

As with an SSI ESOC circuit, a timer relay ensures

that, once pressed, the power is removed for a
minimum of 15 seconds, regardless of how quickly
the button is released. This ensures that the affected
CIXL and sub-systems within the TICCs are all
subject to a restart.

15
 Designed & produced by Anderson Lambert +44 (0) 1582 754000 www.andersonlambert.com

Signalling Solutions Limited

Borehamwood Industrial Park
Rowley Lane Borehamwood
Hertfordshire
WD6 5PZ

Telephone: +44 (0) 20 8953 9922

Facsimile: +44 (0) 20 8207 5905

www.signallingsolutions.com
For product information: www.signallingsolutions.info

Prices are correct at the time of publication. Signalling Solutions Limited reserve the right to change specifications and prices.

Issue 2 April 2009