Method and system for the automated determination of the train integrity of a train

Abstract

The invention relates to a method for the automated determination of the train integrity of a train (1), comprising the steps of: - determining the rear car (S) of the train (1), - transmitting data (D) of the rear car (S) to a first central control unit (3a) of the train (1) during the journey of the train (1), said data (D) being transmitted continuously over the entire journey, and the data (D) being transmitted in such a way that said data can be associated with the rear car (S), - generating status information (St) on the basis of the data (D) of the rear car (S), wherein, if correct data (D) of the rear car (S) are received by the first central control unit (3a), status information (St) indicating correct train integrity is generated and, if correct data (D) of the rear car (S) are not received by the first central control unit (3a) within a predefined period of time, status information (St) indicating disrupted train integrity is generated, - outputting the status information (St). The invention also relates to a corresponding system and to a train.

Description

[0001] Procedure and system for the automated determination of

[0002] Train integrity of a train set

[0003] The invention relates to a method and a system for the automated determination of the train integrity of a train set, in particular for the activation of track sections, e.g. within the framework of ETCS Level 3.

[0004] With the planned operation with ETCS Level 3, train integrity monitoring (TIM) is prescribed by standard. An automatic train safety system (ATP system) expects train integrity information (Train Integrity Information) about the vehicle at the interface to the vehicle. The Train Integrity Information indicates the current status of the train integrity. The Train Integrity Information must be secured with a specific safety integrity level, "S IL 2".

[0005] SILs are the measure of the performance or reliability of safety functions and are defined in the standards IEC61508 and EC61511 on "Functional Safety of Electrical / Electronic / Programmable Electronic (E / E / PE) Systems". There are a total of four SIL levels, with the required protection increasing with each level.

[0006] The most important aspect that must be considered here for S IL 2 is the uninterrupted control of train integrity by a safety controller, which should have redundant CPUs and power supplies, redundant network communication infrastructures and processing units, so that in the event of a device failure, further control of train integrity is possible.

[0007] Since operation with ETCS Level 3 has not yet been implemented, automated control of train integrity has not been relevant in practice.

[0008] It is an object of the present invention to provide an alternative, more convenient method and a corresponding system for the automated determination of train integrity, with which the disadvantages described above are avoided and in particular enables safe train operation within the framework of ETCS Level 3.

[0009] This object is achieved by a method according to patent claim 1, a system according to patent claim 10 and a train assembly according to patent claim 11.

[0010] The method according to the invention for the automated determination of the train integrity of a train set comprises the following steps:

[0011] - Optional: Providing assembly data for the construction of the train set, comprising at least information on the wagons from which the train set is composed, to a first central control unit of the train set,

[0012] - Determine the last car of the train,

[0013] - Sending data from the tail car to the first central control unit of the train set while the train set is traveling, wherein this data is sent continuously throughout the entire journey and the sending of the data is designed in such a way that it can be assigned to the tail car, - Generating status information based on the data from the tail car, wherein if correct data from the tail car is received by the first central control unit, status information is generated which indicates correct train integrity, and if no correct data from the tail car is received by the first central control unit within a predetermined period of time, status information is generated which indicates disturbed train integrity,

[0014] - Output of status information.

[0015] During automated determination of the train integrity of a train formation, a check is carried out to determine whether the train formation is still complete, i.e., whether it has not lost any wagons. During operation within the framework of ETCS Level 3, track vacancy detection and train integrity checks are no longer carried out by a signal box, but by the trains. Track-side track vacancy detection, for example, by axle counters or track circuits, is no longer necessarily available. In order to run in ETCS Level 3, trains must therefore have a train integrity check system, which the method according to the invention enables.

[0016] The optionally provided composition data provides information on the structure of the train, i.e. on its wagons and, if applicable, also the wagon sequence (which is not absolutely necessary, but can simplify the determination of the end wagon). Information on the length of the train set can also be available. It is important to note that the method can certainly produce useful results even without composition data, but this data is very advantageous because it can be used to check whether the determination of the end wagon was correct. It therefore represents redundancy which serves safety. For example, if a wagon was mistakenly identified as the end wagon due to faulty sensors in its coupling, this error can be cleared up using information on the wagon sequence.

[0017] As previously indicated, the end car can be determined using a predetermined car sequence. However, it is preferably determined independently, particularly preferably using components that are available to a car for ferry operation. These are, for example, sensors on a coupling that measure whether this coupling is coupled to another car. In a train set, all but two cars are normally coupled with their two couplers. Only the two cars at the front and at the end of the train are coupled with only a single coupler. As the driver is in the car at the front of the train, the car at the end of the train (without the driver) can be identified as the end car based on this and its coupling state. The information "car only coupled at one coupler" and "car not occupied by the driver" could therefore be used to automatically determine the end car.In train sets consisting of two or more multiple units, it may be sufficient to check the status of the end cars of the multiple units to determine which is the last car. In such a multiple unit train set, a central control unit (CCU) in the multiple units can, for example, use the "cab occupied" and "coupled" signals to automatically determine whether an end car is at the front, in the middle, or at the end of the train. In practice, the CCU in each multiple unit in the train set can then determine the status of its two end cars and forward this status to the first (or "leading") central train control unit in the train set. A train set can have a single central control unit, but this is rare. More often, a train set will have several CCUs, particularly in a train set consisting of several multiple units.It may also happen that several central control units are present in a multiple unit, for example, in each of the two end cars of the multiple unit. In this case, a "first" central control unit should be selected. This is currently usually done automatically, with the central control unit selected as the first (leading) central control unit located in the multiple unit (or the end car) occupied by the driver.

[0018] A crucial aspect of the process is that the end car continuously sends data to the first central control unit throughout the entire train journey. This can be done directly, but in practice, it is often necessary to cross boundaries between different hierarchies when sending data. For example, the data from the end car can be collected at one car level, sent to the central control unit of a multiple unit (the central control unit), and from there sent to the first central control unit (the train set level).

[0019] Protocols such as "Flexicom", "Profisafe" or "SPCSsafe" already exist for data transmission, which can be used for secure data transmission.

[0020] It is important that data is sent continuously, i.e. that a data set from the tail carriage arrives at the first ZSG again and again. These data sets can certainly be separated by time intervals, although these should preferably be shorter than one second. In practice, it is quite possible for the data from the tail carriage to arrive at the first ZSG after 0.1 s. The data must be sent in such a way that it can be assigned to the tail carriage. This means that the data itself contains information, e.g. an address or identification information, that makes this assignment possible and / or the data channel on which the transmission takes place enables this assignment, e.g. because the data is sent via a special cable or a special frequency that can be assigned to the tail carriage. Basically, the only important thing here is that the first ZSG can reliably determine that the received data set actually originates from the tail carriage.

[0021] From the knowledge of whether the data from the tail car has been received or not, the status information can now be generated, which essentially only needs to reflect two states: one state (e.g. "OK") that indicates correct train integrity and one state (e.g. "Lost") that indicates incorrect train integrity. A third state (e.g. "Unknown") is advantageous. This state can preferably only be reached when the train is at a standstill and indicates that the architecture of the train has changed, e.g. by coupling or uncoupling train components.

[0022] The status information is generated based on the data from the final car. For example, if correct data is received, a status message with the status "OK" is generated. If no correct data is received within a specified time period, a status message with the status "Lost" is generated.

[0023] It should be noted that "correct data" refers to data that is normally sent by the tail carriage or contains predetermined information. The expression "no correct data" here means that no data set reached the first central control unit, or that this data set was incomplete or incorrect in some other way, arrived on the wrong data channel, or its transmission was corrupted or disturbed in some other way. Any data set from the tail carriage whose transmission (which also means its content) was different from that specified is regarded as incorrect. This means that in this case no correct data from the tail carriage was received by the first central control unit. In this regard, it is preferred that the tail carriage, in the event of an error being detected, e.g.if something has been lost from the car, whose connection to the rest of the train is impaired, or another (serious) error condition exists, no longer sends data or sends a data set that deviates from the norm and can be interpreted by the first ZSG as "not correct data".

[0024] The status information can be output to another control unit, e.g. to a so-called "European Vital Computer" (EVC), which can take over control tasks for the operational process or pass on related information as part of ETCS Level 3. The status information is therefore preferably made available to the EVC. The EVC reads in the status and forwards the status to a control center via the radio-land connection. If the status "Unknown" or "Lost" is reported, the section of track last traversed by the train set is no longer released for subsequent trains.

[0025] A system according to the invention for the automated determination of the train integrity of a train set, in particular uses a method according to the invention and comprises the following

[0026] Components: - Optional: a data interface designed to receive assembly data for the construction of the train set, comprising at least information on the wagons from which the train set is composed,

[0027] - a detection unit designed to determine the tail car of the train,

[0028] - a data transmission unit designed to transmit data from the tail carriage to a first central control unit of the train set during the train set's journey, whereby these data are transmitted continuously throughout the entire journey and the transmission of the data is designed in such a way that they can be assigned to the tail carriage,

[0029] - a first central control unit (the one to which the data is sent) designed to generate status information based on the data of the tail car, wherein in the event that correct data from the tail car is received by the first central control unit, status information is generated which indicates correct train integrity and in the event that no correct data from the tail car is received by the first central control unit, status information is generated which indicates disturbed train integrity,

[0030] - a data interface designed to output status information.

[0031] A train set according to the invention comprises a number of multiple units and a system according to the invention.

[0032] The invention can be implemented in particular in the form of a computer unit, in particular in a control device, with suitable software. The computer unit can, for example, have one or more cooperating microprocessors or the like. In particular, it can be implemented in the form of suitable software program components in the computer unit. A largely software-based implementation has the advantage that even computer units already used in multiple units or train sets or in their carriages can be easily retrofitted by means of a software or firmware update in order to operate in the manner according to the invention.In this respect, the object is also achieved by a corresponding computer program product with a computer program that can be loaded directly into a memory device of a computer unit, with program sections for carrying out all steps of the method according to the invention when the program is executed in the computer unit. Such a computer program product can, in addition to the computer program, optionally comprise additional components such as, for example, documentation and / or additional components, including hardware components such as, for example, hardware keys (dongles, etc.) for using the software.A computer-readable medium, for example a memory stick, a hard disk or another portable or permanently installed data storage device, on which the program sections of the computer program that can be read in and executed by a computer unit are stored, can be used for transport to the computer unit and / or for storage on or in the computer unit. Further, particularly advantageous embodiments and developments of the invention emerge from the dependent claims and the following description, wherein the claims of one claim category can also be developed analogously to the claims and description parts to form another claim category and, in particular, individual features of different embodiments or variants can be combined to form new embodiments or variants.

[0033] According to a preferred method, the

[0034] The end car determines which car in the train is not coupled at one of its two couplers (or is only coupled at one coupler) and whether this car is occupied by a driver. In the event that one of its two couplers is not coupled, i.e. it is running at the front or end of the train and is not occupied (by the said driver), this car is designated as the end car. The usual coupler signals and "driver's cab occupied" signals can be used for this purpose, which are present anyway during train operation. The end car can therefore be determined automatically and no additional equipment is required; instead, signals that are normally present during a train run can be used.Compared to determining the end car from a predefined car sequence, this automatic determination has the safety advantage that the current train is actually considered. This eliminates the possibility of incorrectly assuming that a car is the end car due to an incorrect car sequence. However, the car sequence information can provide a useful check by checking whether the automatically determined end car matches the predefined end car in the car sequence. Only the end cars of a multiple unit can be considered "cars" within the meaning of this embodiment, since these complete the multiple unit at its ends.

[0035] According to a preferred method, the data sent by the tail carriage are sent via a communication channel that can be assigned to the tail carriage, e.g. via a specific cable, a specific radio frequency or another specific data channel. Alternatively or additionally, the data of the tail carriage have a

[0036] Identification information, e.g. an address or a

[0037] Identification number that can be assigned to the end car. Theoretically, the mere presence of data could already constitute an assignment, if only data is sent from the end car. In practice, however, it is often the case that at least the end cars of a trainset send data. In this case, it should be clear which data originates from the end car.

[0038] According to a preferred method, after a coupling process in which a number of wagons have been uncoupled from the train or a number of wagons have been coupled to the train, an end wagon and a first central control unit are first determined (again). It should be noted here that after a coupling process, e.g. if a train has been separated or multiple units have been added to a train, the end wagon or the first central control unit usually changes, at least if the driver has changed the end wagon.

[0039] The method can preferably also be reinitialized by providing (new) composition data for the construction of the train set.

[0040] According to a preferred method, the train is formed from a plurality of multiple units. Each multiple unit preferably comprises at least one central control unit. The first (leading) central control unit is then preferably the central control unit of the multiple unit or of the end car which has an occupied driver's cab during the journey. It is preferred that the data of the end car are sent from a central control unit of the multiple unit comprising this end car to the first central control unit of another multiple unit, since the driver is normally in the frontmost multiple unit and the end car is at the rear. According to a preferred method, at least the data of the end car are transmitted from a car hierarchy, preferably via a multiple unit hierarchy, to a train set hierarchy by means of a data transmission protocol.Alternatively or additionally, the status information is output using a data transmission protocol from a train set hierarchy, preferably via a multiple unit hierarchy, to a car hierarchy. It is preferred that the data of the end car and / or the status information be secured using checksums and preferably transmitted using architectural patterns defined for SIL 2. This guarantees sufficiently secure data transmission.

[0041] According to a preferred method, the generation of the status information and the output of the status information are designed so that this entire process takes less than one second. Normally a data transfer only takes a fraction of a second. However, if several hierarchies are crossed and special security protocols are applied, a transfer from one hierarchy to another can take up to 200 ms. Transfer times between hierarchies of more than 10 ms or more than 50 ms are preferred and can typically be assumed to be 100 ms. In addition, there can be time intervals between the transmission of data records and between the transmission of successive sets of data from the last carriage. These time intervals should be shorter than 1 s since a rapid response to the loss of a carriage is required.

[0042] It is particularly preferred that the predetermined time period after which status information is generated indicating a disrupted train integrity when no data from the end car is received by the first central control unit is longer than the time it takes to send successive sets of data from the end car, in particular longer than double this time. This ensures that a "Lost" status is not set prematurely in the event of a brief disruption to transmission. After all, in such a case the line would be completely closed and only reopened once it has been fully traveled and inspected. This means that a "Lost" status should only be generated in the event of a genuine emergency situation and not in the event of a brief disruption to data transmission. For example, in Germany the time in which a "Lost" status must be assumed after a car is lost should be less than one second.It would therefore be advantageous if the tail carriage could send its data at least twice within one second, so that in the event that a data set does not reach the first ZSG due to a brief disruption, the second data set can still reach the first ZSG within the second and no "Lost" status is set.

[0043] According to a preferred method, the status information is output to an EVC control unit (EVC: European Vital Computer).

[0044] According to a preferred method, when the status information is generated, an emergency braking loop (SBS) assigned to the end car is also checked. Preferably, if the emergency braking loop is open or faulty, status information is generated indicating a disturbed train integrity, and if the emergency braking loop is intact, a predetermined period of time is waited for data from the end car. The SBS therefore represents a second instance so that a status can be determined more reliably (after all, an incorrectly determined "lost" signal has considerable consequences for operations). If the SBS is open, a car break is very likely (however, the information from the SBS alone is not reliable enough). In conjunction with the method according to the invention, checking the SBS represents a very advantageous means of increasing the reliability of the statement.If the SBS is not open, a car may still have been torn down. However, as a precaution, the train waits for data from the last car. If this is correct, the SBS information was faulty, and the train can continue with the status "OK." If the data from the last car is missing (or is incorrect), the status should be set to "Lost."

[0045] According to a preferred train set, each multiple unit comprises a central control unit designed to generate status information based on the data from the end car. Preferably, if data from the end car is received by the first central control unit, status information is generated indicating existing train integrity, and if no data from the end car is received by the first central control unit, status information is generated indicating disturbed train integrity.

[0046] According to a preferred train formation, each end car of a multiple unit is designed to determine the status of its couplings and the occupancy status of a driver's cab and to send data to a central control unit.

[0047] A major advantage of this invention is that it can be implemented using existing communication means. No additional hardware is required. It can be implemented immediately in any train in a simple manner. The invention is explained in more detail below with reference to the attached figures using exemplary embodiments. In the various figures, identical components are provided with identical reference numerals. The figures are generally not to scale. They show:

[0048] Figure 1 shows an example of a train set according to the invention with two multiple units,

[0049] Figure 2 shows an example of a system according to the invention,

[0050] Figure 3 is a block diagram of an example of a method according to the invention,

[0051] Figure 4 is a flow chart for an implementation of a preferred method.

[0052] Figure 1 shows an example of a train set 1 according to the invention with two multiple units 2. The train set 1 travels from left to right, which is indicated by the sketched driver F in the right end car E of the right multiple unit 2. The train set 1 has a system 4 according to the invention, as is shown in more detail in Figure 2, for example. Figure 1 shows the central control units 3 in the end cars E, of which the central control unit in the end car E with the driver F is regarded as the first central control unit 3a. Each end car E of a multiple unit 2 is designed here to determine the state of its couplings and the occupancy state of a driver's cab and to send data to a central control unit 3. Figure 2 shows an example of a system 4 according to the invention for the automated determination of the train integrity of a train set 1, as is shown in Figure 1, for example. System 4 includes the following components:

[0053] A determination unit 6 is designed to determine the end car S of train set 1. In this example, the determination unit sends an identification number of the determined end car S to the first central control unit 3a, which is indicated by an arrow. A determination unit 6 can certainly be a central control unit 3 of an end car E or all central control units 3 of the end cars E, as shown in Figure 1.

[0054] A data transmission unit 7 designed to transmit (arrow) data D of the end car S to the first central control unit 3a of the train set 1 during the journey of the train set 1, wherein these data D are transmitted continuously over the entire journey and the transmission of the data D is designed in such a way that they can be assigned to the end car S.

[0055] Said first central control unit 3a is designed to generate status information St based on the data D of the tail carriage S, wherein in the event that correct data D from the tail carriage S are received by the first central control unit 3a, status information St is generated which indicates correct train integrity, and in the event that no correct data D from the tail carriage S is received by the first central control unit 3a within a predetermined period of time, status information St is generated which indicates disturbed train integrity. A data interface 5 is designed to output the

[0056] Status information St .

[0057] Figure 3 shows a block diagram for an example of a method according to the invention for the automated determination of the train integrity of a train set 1 .

[0058] In step 1, assembly data for the train formation is provided, which includes at least information on the wagons that make up the train formation. This data is provided to the train formation's first central control unit (see, for example, Figure 2). Although this step is essentially optional, it is nevertheless very advantageous.

[0059] In step II, the end car S of train set 1 is determined. To do this, it is preferably determined which car of train set 1 is not coupled at one of its two couplings and whether this car is occupied by a driver F. If one of the two couplers of a car is not coupled and this car is not occupied, this car is designated as the end car S. In Figure 1, for example, the end car E on the far right is the end car S, as indicated.

[0060] It is preferred that, after a coupling process in which a number of wagons have been uncoupled from the train set 1 or a number of wagons have been coupled to the train set 1, the end wagon S and the first central control unit 3a are determined again. It is also preferred to provide or update the assembly data again.

[0061] In step III, data D of the end car S are sent to the first central control unit 3a of the train set 1 during the journey of the train set 1. These data D are sent continuously throughout the entire journey, and the transmission of the data D is designed in such a way that they can be assigned to the end car S.

[0062] The data D sent by the tail car S can be sent via a communication channel that can be assigned to the tail car S and / or can include identification information that can be assigned to the tail car S.

[0063] In step IV, status information St is generated based on the data D of the tail car S. If correct data D is received from the tail car S by the first central control unit 3a, status information St is generated that indicates correct train integrity. If no correct data D is received from the tail car S by the first central control unit 3a within a predetermined period of time, status information St is generated that indicates disturbed train integrity.

[0064] The thick arrow on the symbol of the status information St is intended to indicate that the status information St will be output afterwards.

[0065] Figure 4 shows a flow chart for an implementation of a preferred method. Considering a train set 1 which, as shown in Figure 1, is formed from a plurality of multiple units 2, each multiple unit 2 generally comprises at least one central control unit 3a (in Figure 1, each multiple unit 2 comprises two). Data originating from carriages is often sent through several hierarchies until it arrives at the first central control unit 3a. A table is shown whose columns, from right to left, symbolize different hierarchies (referred to below as "levels"). The right-hand hierarchy is that of the European Vital Computer EVC, which here is positioned in an end car and is contacted from the car level. To the left of the EVC level is the car level, followed by the drive level and the level of the first central control unit 3a, which can also be the train set level.On the far left and far right, the origins of signals are shown which are not assigned to a specific level here, but which could well originate from the individual levels.

[0066] The process begins on the far right with two signals, one of which indicates the occupied status of an end car E with a driver F (above) and one of which indicates the coupling status. The dashed coupling is intended to indicate that the search is for the case in which an end car E is only coupled with one coupler and the other coupler is free. It should be noted that in addition to the status of the coupling, the status of the coupling status contactor is often also measured. This indicates whether a coupler should be coupled as intended or not. The process of detecting the end car takes e.g. 8 ms.

[0067] At the wagon level, it is then determined which wagon is the tail wagon S. This wagon then sends its data D via the drive input to the first central control unit 3a, e.g., via "Flexicom" and / or using the "SPCSsafe" protocol. This process can take between 10 ms and 200 ms, and in this case, for example, takes 100 ms.

[0068] The first central control unit 3a evaluates all signals from the end cars and detects the signal from the final car S. Furthermore, as indicated on the left, information about a coupling process (above) and the emergency braking loop (SBS, below) can also be made available to the first central control unit 3a.

[0069] The first central control unit 3a now generates status information St from the data D of the end car S and here also with data on coupling processes and data from the SBS. For example, the status information St is "OK" if the end car S sends correct data D and "Lost" if no or incorrect data D arrives at the first central control unit 3a. Here it can also be additionally determined whether the SBS of the multiple unit 2 with the end car is still intact. If it is broken, the status "Lost" is set in any case; if it is intact, data D from the end car S is waited for again to be on the safe side. In the event of a coupling process, the status can be set to "Unknown" and another end car S and a first central control unit 3a can be determined.

[0070] In this example, the status information St is then sent from the first central control unit 3a via the traction control and carriage levels to the European Vital Computer (EVC), where it is used to drive the train. Secure data transmission takes between 10 ms and 200 ms per level (e.g., 100 ms here) and can be achieved using "Flexicom" and the "Profisafe" protocol. As an additional safeguard, a function could be used to check whether the EVC is in contact with the first central control unit 3a. If contact is lost, the EVC automatically sets the status to "Lost."

[0071] Finally, it should be noted once again that the methods described in detail above, as well as the system presented, are merely exemplary embodiments that can be modified in a variety of ways by those skilled in the art without departing from the scope of the invention. Furthermore, the use of the indefinite articles "a" or "an" does not exclude the possibility that the respective features may be present in multiple instances. Likewise, the terms "unit" and "device" do not exclude the possibility that the respective components consist of several interacting subcomponents, which may also be spatially distributed. The expression "a number" is to be understood as "at least one."

Claims

Patent claims 1. Method for the automated determination of the train integrity of a train consist (1) comprising the steps: - Determining the last car (S) of the train consist (1) , - Sending data (D) from the rear car (S) to a first central control unit (3a) of the train set (1) during the journey of the train set (1), wherein this data (D) is sent continuously throughout the entire journey and the sending of the data (D) is designed in such a way that it can be assigned to the rear car (S), - Generating status information (St) based on the data (D) of the last car (S), wherein, in the case that correct data (D) from the last car (S) is received by the first central control unit (3a), status information (St) is generated indicating correct train integrity, and in the case that no correct data (D) from the last car (S) is received by the first central control unit (3a) within a specified time period, status information (St) is generated indicating disturbed train integrity. - Output of status information (St) .

2. Method according to claim 1, wherein to determine the final car (S) it is determined which car of the train consist (1) is not coupled to one of its two couplings and whether this car is occupied by a driver (F) and in the case that one of its two couplings is not coupled to a car and this car is not occupied, this car is determined as the final car (S).

3. Method according to any of the preceding claims, wherein the data (D) sent by the tail car (S) are transmitted via a communication channel that can be assigned to the tail car (S) and / or include identification information that can be assigned to the tail car (S).

4. Method according to one of the preceding claims, wherein after a coupling process in which a number of cars have been uncoupled from the train consist (1) or a number of cars have been coupled to the train consist (1), a final car (S) and a first central control unit (3a) are first determined.

5. Method according to one of the preceding claims, wherein the train set (1) is formed from a plurality of multiple units (2), wherein each multiple unit (2) comprises at least one central control unit (3a) and the first central control unit (3a) is selected to be the central control unit (3) of the multiple unit (2) or of the end car (E) which has an occupied driver's cab during travel, preferably wherein the data (D) of the end car (S) are sent from a central control unit (3) of the multiple unit (2) comprising this end car (S) to the first central control unit (3a) of another multiple unit (2).

6. Method according to one of the preceding claims, wherein at least the data (D) of the rear car (S) are transmitted from a car hierarchy, preferably via a multiple unit hierarchy, to a trainset hierarchy by means of a data transmission protocol and / or the output of the status information (St) is transmitted from a trainset hierarchy by means of a data transmission protocol, preferably via a train hierarchy to a car hierarchy, preferably wherein the data (D) of the last car (S) and / or the status information (St) are secured by means of checksums and preferably transmitted with architectural patterns that have been defined for SIL 2.

7. Method according to one of the preceding claims, wherein the generation of the status information (St) and the output of the status information (St) are designed such that this entire process takes less than one second, preferably wherein time intervals separating the transmission of successive sets of data (D) from the rear car (S) are shorter than 1 s, preferably wherein the predetermined time interval after which status information (St) is generated indicating a disturbed train integrity when no data from the rear car (S) is received by the first central control unit (3a) is longer than the time of transmission of successive sets of data (D) from the rear car (S).

8. Method according to one of the preceding claims, wherein the output of the status information (St) is to an EVC control unit.

9. Method according to one of the preceding claims, wherein, in the generation of the status information (St), an additional rapid braking loop assigned to the rear car (S) is checked, in particular wherein, in the case that the rapid braking loop is open or faulty, status information (St) is generated which indicates a disturbed train integrity, and in the case that the rapid braking loop is intact, a predetermined time period is waited for data (D) from the rear car (S).

10. System (4) for the automated determination of the train integrity of a train consist (1), in particular using a method according to one of the preceding claims, comprising: - an investigation unit (6) designed to identify the last car (S) of the train consist (1) , - a data transmission unit (7) designed for transmitting data (D) from the rear car (S) to a first central control unit (3a) of the train consist (1) during the journey of the train consist (1), wherein this data (D) is transmitted continuously over the entire journey and the transmission of the data (D) is designed in such a way that it can be assigned to the rear car (S), - a first central control unit (3a) designed to generate status information (St) based on the data (D) of the last car (S), wherein, in the case that correct data (D) from the last car (S) is received by the first central control unit (3a), status information (St) is generated indicating correct train integrity, and in the case that no correct data (D) from the last car (S) is received by the first central control unit (3a) within a specified time period, status information (St) is generated indicating disturbed train integrity. - a data interface (5) designed for outputting the status information (St) .

11. Train formation (1) comprising a number of train sets (2) , wherein the train formation (1) comprises a system (4) according to claim 10 .

12. Trainset according to claim 11, wherein each trainset (2) comprises a central control unit (3, 3a) designed to is to generate status information (St) based on the data (D) of the tail car (S), wherein, in the case that data (D) from the tail car (S) are received by the first central control unit (3a), status information (St) is generated, indicating an existing train integrity, and in the event that no data (D) is received from the last car (S) by the first central control unit (3a), a status information (St) is generated, indicating a disturbed train integrity.

13. Train formation according to claim 11 or 12, wherein each end car (E) of a train set (2) is designed to determine the state of its couplings and the occupancy state of a driver's cab and to send data (D) to a central control unit (3, 3a).

14. Computer program product comprising instructions which, when the program is executed by a computer, cause it to perform the steps of the method according to claims 1 to 9.

15. Computer-readable storage medium comprising instructions which, when executed by a computer, cause it to perform the steps of the method according to claims 1 to 9.

Images