Method and system for managing the operation of a motor vehicle in mixed driving modes

Abstract

The invention relates to a method for managing the operation of a motor vehicle by means of a computer system embedded in it. The vehicle may operate in both manual and autonomous driving modes. The invention also relates to a computer system (100) implementing such a method. Figure for the abstract: 1

Description

Title of the invention: Method and system for managing the operation of a motor vehicle in mixed driving modes Technical field of the invention

[0001] The present invention relates to the field of autonomous vehicles. The invention relates in particular to a method for managing the operation of a motor vehicle by means of a computer system embedded in the vehicle, the vehicle being capable of operating in both manual and autonomous driving modes. The invention also relates to a computer system implementing such a method. The invention is applicable to any type of motor vehicle, including cars, robots, or other autonomous vehicles. Prior art

[0002] In recent years, autonomous vehicles have received increasing attention, with the development of high-level autonomy (L3+) vehicles, particularly for vehicles operating in controlled environments, such as logistics. Following this trend, the vast majority of developments in the field of autonomous vehicles focus on improving vehicle capabilities in terms of positioning, perception, and vehicle control. However, one of the main limitations to the deployment of autonomous vehicles remains the ability to design a safe platform that guarantees, in particular, consistent vehicle performance under all circumstances. Thus, autonomous driving goes hand in hand with the need for redundant safety capabilities to maintain safety in the event of potential autonomous driving failures.

[0003] In this regard, some approaches focus on implementing redundant braking capabilities. However, these approaches remain superficial insofar as they do not offer a complete dual system that monitors and manages all other critical aspects and functionalities of the vehicle. Furthermore, they generally do not monitor autonomous driving controls and do not react in case of inconsistency. Summary of the invention

[0004] The invention aims to overcome these drawbacks. The object of the invention is to provide a solution that enables the safe operation of a vehicle in the event of a failure of the autonomous driving system. To this end, the invention aims to provide a method and a system that provide a redundant vehicle operation control capability that allows for the detection of and response to any failure of any of the components that control the vehicle's operation. In this way, the invention aims to improve the safety of autonomous vehicles.

[0005] In order to achieve these objectives, the invention relates, according to a first aspect, to a method of managing, by means of a computer system embedded on board a motor vehicle, the operation of the vehicle, said vehicle being able to operate in a manual driving mode and an autonomous driving mode, said vehicle comprising a primary electronic control unit and several auxiliary electronic control units, including a chassis control unit having a primary braking control module and a primary steering control module, a powertrain control unit, a driver assistance control unit comprising a driver assistance control module and an autonomous driving control unit, said system comprising at least one information processing unit, with one or more processors, and a data storage medium,which are configured to jointly run at least one autonomous driving interface and one safety module, said method comprising the steps of: i. receiving, by a gateway module of said autonomous driving interface, data characterizing a set of driver assistance commands corresponding to a set of driver assistance functionalities; , ii. determine, by a processing module of said gateway module, a first driver assistance functionality which must remain active and data characterizing a first driver assistance command corresponding to this first driver assistance functionality; iii. determine, by a first data management module of said autonomous driving interface, data characterizing a first set of information including said data characterizing a first driving assistance command, data characterizing a first autonomous driving control command, received from said autonomous driving control unit, and data characterizing a state of said safety module, said first autonomous driving control command corresponding to said first driving assistance functionality, said first driving assistance command and said first autonomous driving control command corresponding to a first driving operation; iv. determine, by a second data management module of said safety module, data characterizing a second set of information, said second set of information including driver assistance commands and data characterizing a state of said autonomous driving interface; v. to determine, by said second data management module, data characterizing a level of consistency between said first driver assistance command and said first autonomous driving control command; and vi. transmit, via said first data management module, said data characterizing a first driving assistance command or said data characterizing a first autonomous driving control command to said primary electronic control unit according to the level of consistency.

[0006] According to one variant, the process may further comprise the steps of: • activate, via said first data management module, secondary electronic control modules of said vehicle if said safety module is in a non-operational state, said secondary electronic control modules comprising a secondary brake control module and a secondary steering control module; and • to cause, by the said secondary electronic control modules, the stopping of said vehicle by holding the steering wheel in a normal position and applying maximum braking power.

[0007] According to another variant, the process may further comprise the steps of: • transmit, via an emergency management module of said safety module, data characterizing a non-operational state of said autonomous driving interface to a power management module of said safety module; and • deactivate, by said power management module, said autonomous driving interface using a switch controlled by said power management module.

[0008] According to yet another variant, step iv) may comprise the steps of: • to determine, by said second data management module, data characterizing an emergency control command, if said autonomous driving interface is in a non-operational state; and • to cause, by said second data management module, the stopping of said vehicle by activating said primary brake control module and said primary steering control module in order to perform a stopping maneuver on the basis of said emergency control command.

[0009] According to yet another variant, step iii) may include the steps of: • receive, using a first operating conditions detection module for said autonomous driving interface, data characterizing a current operating state of said safety module; and • determine, using said first operating condition detection module, said state of said safety module on the basis of said operating condition current operation of said security module.

[0010] According to yet another variant, step iv) may include the steps of: • receiving, using a second operating condition detection module of said safety module, data characterizing a current operating state of said autonomous driving interface; and • determine, using said second operating condition detection module, said state of said autonomous driving interface on the basis of the current operating state of said autonomous driving interface.

[0011] According to yet another variant, step i) may comprise the steps of: • receive, using said driver assistance control module, data characterizing a first set of sensor information, said first set of sensor information being obtained from a plurality of first sensors with which said vehicle is equipped to facilitate driver assistance functionalities; and • determine, using said driver assistance control module, said set of driver assistance controls corresponding to said set of driver assistance functionalities on the basis of said first set of sensor information.

[0012] According to yet another variant, step iii) may comprise the steps of: • receive, using the autonomous driving control unit, data characterizing a second set of sensor information, said second set of sensor information being obtained from a plurality of second sensors facilitating autonomous driving functionalities and the plurality of first sensors; and • determine, using the autonomous driving control unit, the first autonomous driving control command based on the second set of sensor information.

[0013] According to yet another variant, step iii) may include a step consisting of shaping, using a control logic module of said autonomous driving interface, said first autonomous driving control command before transmission to said first data management module.

[0014] According to a second aspect, the invention relates to a computer system for managing the operation of a motor vehicle, said vehicle being able to operate in a manual driving mode and an autonomous driving mode, said vehicle comprising a primary electronic control unit and several auxiliary electronic control units, among which a chassis control unit having a primary brake control module and a primary steering control module, a powertrain control unit, a unit of driver assistance control comprising a driver assistance control module and an autonomous driving control unit, the system comprising an information processing unit, with one or more processors, and a data storage medium, which are configured to jointly run an autonomous driving interface and a safety module implementing a process as described above.

[0015] According to a third aspect, the invention relates to a motor vehicle capable of operating in a manual driving mode and an autonomous driving mode, said vehicle comprising a primary electronic control unit and several auxiliary electronic control units, including a chassis control unit comprising a primary brake control module and a primary steering control module, a powertrain control unit, a driver assistance control unit comprising a driver assistance control module and an autonomous driving control unit, the vehicle comprising a system as described above. Brief description of the drawings

[0016] Other features and advantages of the invention will become apparent from an examination of the detailed description below and the accompanying figures, in which:

[0017] [Fig-1] is a functional diagram of a system according to the invention;

[0018] [Fig.2] is a functional diagram of a vehicle according to the invention;

[0019] [Fig.3] is a functional diagram of an autonomous driving interface of a system according to the invention;

[0020] [Fig.4] is a functional diagram of a security module of a system according to the invention; and

[0021] [Fig.5] is a flowchart of the steps of a process according to the invention. Detailed description of the invention

[0022] Figure 1 illustrates a system 100 according to the invention for managing the operation of a motor vehicle capable of operating in both manual and autonomous driving modes. It is a computer system comprising an information processing unit, with one or more processors, and a data storage medium, which are configured to jointly execute at least one autonomous driving interface 102 and a safety module 104, as described below.

[0023] Figure 2 illustrates the architecture of a vehicle 200 according to the invention. This conventionally comprises a primary electronic control unit 202 and a plurality of auxiliary electronic control units. The primary electronic control unit 202 interconnects and transfers data between the units of auxiliary electronic controls to operate the vehicle. The auxiliary electronic control units include a chassis control unit 204, a driver assistance control unit 206, a powertrain control unit 208, a multimedia and communication equipment control unit 210 and a body control unit 212. The vehicle further includes an autonomous driving control unit 302, illustrated in [Fig.3].

[0024] The chassis control unit 204 includes a primary brake control module 204A, a primary steering control module 204B, a dynamic control module 204C, and a brake assist control module 204D. The chassis control unit 204 manages vehicle dynamics. The driver assistance control unit 206 includes a driver assistance control module 206A, which is connected to a plurality of primary sensors 206B. The powertrain control unit 208 includes an electric machine management module 208A, an inverter management module 208B, and a battery management module 208C. The multimedia and communication equipment control unit 210 includes a multimedia management module 210A, a communication module 210B and an audio control module 210C.The body control unit 212 comprises a body control module 212A, an instrument cluster management module 212B, and a power management module 212C. The body control unit 212 manages the vehicle's electrical components.

[0025] Figure 3 illustrates in more detail the components of the autonomous driving interface 102 of the system 100 according to the invention. It comprises a gateway module 304 which integrates a processing module 306, a logic control module 308, a detection data reception module 310, a first operating condition detection module 312 and a first data management module 314.

[0026] Figure 4 illustrates in more detail the components of the safety module 104 of the system 100 according to the invention. The safety module 104 comprises a second operating condition detection module 402, an emergency management module 404, a power management module 406, and a second data management module 408. The safety module 104 is located between the chassis control unit 204 and the driver assistance control unit 206, as shown in Figure 2. This allows it to monitor and control all data passing between the chassis control unit 204 and the driver assistance control unit 206. In addition, it can bypass a nominal path to the primary electronic control unit 202 in order to bring the vehicle to a halt depending on a condition or situation. It also provides redundant braking capacity in case of failure.The autonomous driving interface 102 is connected to the safety module 104 via a . first 324A communication interface, for example an Ethernet type interface.

[0027] According to the invention, all the elements described above contribute to enabling the implementation of a method for managing the operation of a vehicle that can operate in a manual driving mode and an autonomous driving mode, as described below in relation to Figures 2-5.

[0028] Figure 5 illustrates a flowchart of the steps in the method according to the invention. According to a first step 502 of the method, the gateway module 304 receives data characterizing a set of driver assistance commands, corresponding to a set of driver assistance functionalities, which are transmitted to it by the driver assistance control module 206A. The autonomous driving interface 102 is connected to the driver assistance control module 206A via a second communication interface 324B, for example, a CAN FD type interface. The driver assistance functionalities may include parking assistance, lane keeping assist, adaptive cruise control, etc. The driver assistance commands include driving instructions for operating the vehicle according to the driver assistance functionalities.The 206A driver assistance control module determines the set of driver assistance commands based on an initial set of sensor information. This initial sensor information is obtained from a plurality of 206B sensors installed in the vehicle to facilitate the implementation of driver assistance features. Examples of 206B sensors include an ultrasonic sensor, a camera, radar, lidar, a GPS sensor, motion sensors, steering angle sensors, and so on. For instance, information from an ultrasonic sensor can be used to determine a driver assistance command corresponding to a parking assist feature. Similarly, information from a front camera or radar can be used to determine a driver assistance command corresponding to an emergency braking assist feature.

[0029] According to a second step 504 of the method, the processing module 306 determines a first driver assistance feature that must remain active and, correspondingly, data characterizing a first driver assistance command. After determining which driver assistance feature must remain active, the processing module 306 sends data characterizing a deactivation command to disable one or more other driver assistance features. For example, the processing module 306 determines that an emergency braking assistance feature must remain active. Alternatively, the processing module 306 determines several driver assistance features that must remain active. In one advantageous variant, the 306 processing module obtains real-time data characterizing an input, which it uses to determine which driver assistance features should remain active. In other words, the 306 processing module can be updated or modified by a user operating an input interface connected to the vehicle.

[0030] According to a third step 506, the first data management module 314 determines data characterizing a first set of information. The first set of information includes data characterizing a first driver assistance command, data characterizing a first autonomous driving control command, and data characterizing a state of said safety module 104. For this purpose, the first data management module 314 receives from the processing module 306 the data characterizing a first driver assistance command and it receives data characterizing a first autonomous driving control command from the autonomous driving control unit 302. The autonomous driving control unit 302 is connected to the autonomous driving interface 102 via a third communication interface 324C, for example, a CAN FD type interface.The autonomous driving control unit 302 determines the first autonomous driving control command corresponding to a first driver assistance function based on a second set of sensor information. For example, the first driver assistance function could be autonomous guidance, parking assistance, or cruise control. The autonomous driving control unit 302 communicates with the positioning systems, perception systems, and navigation system to enable autonomous driving. The second set of sensor information is obtained from the first 206B sensors and several secondary sensors integrated into the vehicle to facilitate the implementation of the autonomous driving functions.The sensing data receiver module 310 receives the first set of sensor information from the first sensors 206B and transmits it to the autonomous driving control unit 302. The first sensors 206B transmit data via a fourth communication interface 324D, for example, an Ethernet interface, to the sensing data receiver module 310. The first set of sensor information includes, for example, information relating to the vehicle's odometer reading or a steering angle value. The autonomous driving control unit 302 sends the data characterizing a first autonomous driving control command to the control logic module 308 via the third communication interface 324C. The control logic module 308 formats the data characterizing the first autonomous driving control command. to transmit them to the first data management module 314. This formatting ensures that the data characterizing the first driver assistance command transmitted by the processing module 306 and the data characterizing the first autonomous driving control command are in a similar format that allows for comparison. Thus, the first set of information is linked to the first driver assistance command, the one corresponding to the active driver assistance functionality.

[0031] Furthermore, the first data management module 314 receives data characterizing the state of the safety module 104 from the first operating condition detection module 312. The state of the safety module 104 indicates an operational state or a non-operational state. The first operating condition detection module 312 receives data characterizing the current operating state of the safety module 104 and determines the state of the safety module 104 based on its current operating state.

[0032] According to a fourth step 508 of the method, the second data management module 408 determines the data characterizing a second set of information, which includes driver assistance commands and data characterizing a state of the autonomous driving interface 102. The second data management module 408 is connected to the driver assistance control module 206A via a fifth communication interface 410A, for example of the CAN FD type, which allows it to receive driver assistance commands transmitted by the driver assistance control module 206A. The second data management module 408 receives data characterizing a state of the autonomous driving interface 102 from the second operating condition detection module 402.The second operating condition detection module 402 receives data characterizing the current operating state of the autonomous driving interface 102 and determines the state of the autonomous driving interface 102 based on the current operating state of the autonomous driving interface 102. The state of the autonomous driving interface 102 is preferably an operational state or a non-operational state.

[0033] According to a fifth step 510 of the process, the second data management module 408 determines data characterizing a level of consistency between the first driver assistance command and the first autonomous driving control command. The first driver assistance command and the first autonomous driving control command correspond to a first driving operation. The first driving operation corresponds, for example, to a steering or braking operation. To determine the level of consistency, the second data management module 408 receives the first driver assistance command. The driver assistance control module 206A receives commands via the fifth communication interface 41 OA and the first autonomous driving command from the autonomous driving interface 102 via a sixth communication interface 410B, which is, for example, a CAN FD type interface. The second data management module 408 establishes the consistency level by determining whether the data received from the driver assistance interface 102 differs from that received from the driver assistance control module 206A. The second data management module 408 transmits the consistency level thus determined to the first data management module 314.In addition, if it determines that the coherence level is low, the second data management module 408 causes the vehicle to stop by controlling the primary brake control module 204A, the primary steering control module 204B and / or the powertrain control unit 208 via a seventh communication interface 410C, an eighth communication interface 410D and a ninth communication interface 410E, which are, for example, CAN FD type interfaces.

[0034] According to a sixth step 512 of the method, the first data management module 314 transmits the data characterizing a first driver assistance command or the data characterizing a first autonomous driving control command to the primary electronic control unit 202 according to the level of consistency determined by the second data management module 408 in the previous step. If the first driver assistance command and the first autonomous driving control command include the same driving instruction corresponding to a first driving operation, the level of consistency is high. This is the case, for example, when the first driver assistance command and the first autonomous driving control command include a braking instruction.Conversely, if the first driver assistance command and the first autonomous driving control command contain different driving instructions for the same driving operation, the level of consistency is low. For example, the first driver assistance command includes a braking instruction because the first 206B sensors detected an obstacle in the vehicle's path, while the first autonomous driving control command does not include a braking instruction because the second sensors did not detect the obstacle. In this case, the level of consistency between the driver assistance command and the autonomous driving control command is low.

[0035] If the coherence level is high, the first management module 314 transmits the data characterizing a first autonomous driving control command to the primary electronic control unit 202 via a tenth communication interface 324E. The tenth communication interface 324E is, for example, a CAN FD type interface. Next, the primary electronic control unit 202 transmits the first autonomous driving control command to the auxiliary electronic control units, which, in turn, transmit the first autonomous driving control command to the primary braking control module 204A, the primary steering control module 204B, and the powertrain control unit 208. These modules then control the vehicle's operation by executing the first driving operation based on the first autonomous driving control command. For example, they steer or brake the vehicle according to the first autonomous driving command.

[0036] If the coherence level is low, the first data management module 314 bypasses the nominal path to the primary electronic control unit 202 by replacing the first autonomous driving control command with the first driver assistance command. Thus, in this case, it is the data characterizing a first driver assistance command that is transmitted to the primary braking control module 204A, the primary steering control module 204B, and / or the powertrain control unit 208. The corresponding control modules of the auxiliary electronic control units then control the vehicle's operation by executing the first driving operation based on the first driver assistance command. For example, they steer or brake the vehicle according to the first driver assistance command.

[0037] From a safety and redundancy standpoint, the first data management module 314 activates secondary electronic control modules of the vehicle if the safety module 104 is not operational. This is a safety measure designed to stop the vehicle when redundancy is no longer available. The secondary electronic control modules include a secondary brake control module 320 and a secondary steering control module 322. The autonomous driving interface 102 is connected to the secondary brake control module 320 via an eleventh communication interface 324F, and it is connected to the secondary steering control module 322 via a twelfth communication interface 324G. The eleventh communication interface 324F and the twelfth communication interface 324G are, for example, of the CAN FD type.The secondary electronic control modules stop the vehicle by holding the steering wheel in a current position and applying maximum braking power according to a vehicle stop command transmitted by the first data management module 314.

[0038] Furthermore, the safety module 104 deactivates the autonomous driving interface 102 as soon as it is in a non-operational state. For this purpose, the second module of Operating condition detection 402 transmits data characterizing a non-operational state of the autonomous driving interface 102 to the emergency management module 404, which, in turn, informs the power management module 406 of the non-operational state of the autonomous driving interface 102. The power management module 406 controls a switch 316 that allows the autonomous driving interface 102 to be deactivated. Indeed, the autonomous driving interface 102 is powered by a power supply 318, and the switch 316 allows the power supply to the autonomous driving interface 102 to be cut off in response to a command from the power management module 406.

[0039] In addition, the second data management module 408 determines data characterizing an emergency control command if the autonomous driving interface 102 is in a non-operational state. This is a safety measure designed to provide dual control to ensure safety. The second data management module 408 stops the vehicle's movement by activating the primary brake control module 204A and the primary steering control module 204B, which implement a stopping maneuver based on the emergency control command. The primary brake control module 204A applies the brakes to stop the vehicle. The primary steering control module 204B locks the steering wheel in its current position. Furthermore, the powertrain torque is reduced according to the emergency command to prevent the vehicle from accelerating when a safety stopping maneuver is initiated.The second data management module 408 sends the emergency control command via the communication interfaces 410C, 410D and 410E.

[0040] Thus, the autonomous driving interface 102 and the safety module 104 monitor each other to improve the safety of autonomous driving. In nominal operation, the system 100 according to the invention selects the autonomous driving mode, and the vehicle's operation is determined based on the commands from the autonomous driving interface 102. However, in the event of a failure of the autonomous driving interface 102, or if the level of consistency between a driver assistance command and a corresponding autonomous driving control command is low, the safety module 104 short-circuits the nominal path to the primary electronic control unit 202 in order to bring the vehicle to a stop.

[0041] Thus, the method and system 100 according to the invention provide a solution for enabling the safe operation of a vehicle in the event of an autonomous driving failure. In particular, the method and system according to the invention allow a vehicle to operate in response to any inconsistencies in commands that occur when the autonomous driving mode is activated. The invention also provides a redundant vehicle operation control capability that detects and reacts to any hardware failure. In this way, the invention improves the safety of autonomous vehicles.

Claims

1. Demands Method for managing, by means of a computer system (100) embedded on board a motor vehicle (200), the operation of the vehicle, said vehicle being able to operate in a manual driving mode and an autonomous driving mode, said vehicle comprising a primary electronic control unit (202) and several auxiliary electronic control units, including a chassis control unit (204) having a primary brake control module (204A) and a primary steering control module (204B), a powertrain control unit (208), a driver assistance control unit (206) comprising a driver assistance control module (206A) and an autonomous driving control unit (302), said system (100) comprising at least one information processing unit, with one or more processors, and a data storage medium,which are configured to jointly execute at least one autonomous driving interface (102) and one safety module (104), characterized in that said method comprises the steps of:, i. receive, via a gateway module (304) of said autonomous driving interface (102), data characterizing a set of driving assistance commands corresponding to a set of driving assistance functionalities; ii. determine, by a processing module (306) of said gateway module (304), a first driver assistance functionality which must remain active and data characterizing a first driver assistance command corresponding to this first driver assistance functionality; iii. determine, by a first data management module (314) of said autonomous driving interface (102), data characterizing a first set of information comprising said data characterizing a first driving assistance command, data characterizing a first autonomous driving control command, received from said autonomous driving control unit (302), and data characterizing a state of said safety module (104), said first autonomous driving control command corresponding to said first driving assistance functionality

2.

3. driving, said first driving assistance command and said first autonomous driving control command corresponding to a first driving operation; iv. determine, by a second data management module (408) of said safety module (104), data characterizing a second set of information, said second set of information including driver assistance commands and data characterizing a state of said autonomous driving interface (102); v. determine, by said second data management module (408), data characterizing a level of consistency between said first driver assistance command and said first autonomous driving control command; and vi. transmit, by said first data management module (314), said data characterizing a first driver assistance command or said data characterizing a first autonomous driving control command to said primary electronic control unit (202) according to the level of consistency. A process according to claim 1, characterized in that the process further comprises the steps of: • activate, by means of said first data management module (314), secondary electronic control modules of said vehicle if said safety module (104) is in a non-operational state, said secondary electronic control modules comprising a secondary brake control module (320) and a secondary steering control module (322); and • to cause, by the said secondary electronic control modules, the stopping of said vehicle by holding the steering wheel in a normal position and applying maximum braking power. A process according to any one of the preceding claims, characterized in that the process further comprises the steps of: transmit, via an emergency management module (404) of said safety module (104), data characterizing a non-operational state of said autonomous driving interface (102) to a power management module (406) of said safety module (104); and deactivate, by said power management module (406), said autonomous driving interface (102) using a switch (316) controlled by said power management module (406).

4. A method according to claim 3, characterized in that step iv) comprises the steps of: • determining, by said second data management module (408), data characterizing an emergency control command, if said autonomous driving interface (102) is in a non-operational state; and • causing, by said second data management module (408), the stopping of said vehicle by activating said primary brake control module (204A) and said primary steering control module (204B) in order to perform a stopping maneuver on the basis of said emergency control command.

5. A method according to any one of the preceding claims, characterized in that step iii) comprises the steps of: • receiving, using a first operating condition detection module (312) of said autonomous driving interface (102), data characterizing a current operating state of said safety module (104); and • determining, using said first operating condition detection module (312), said state of said safety module (104) on the basis of said current operating state of said safety module (104).

6. A method according to any one of the preceding claims, characterized in that step iv) comprises the steps of: receive, using a second operating condition detection module (402) of said safety module (104), data characterizing a current operating state of said autonomous driving interface (102); and determine, using said second operating condition detection module (402), said state of said autonomous driving interface (102) on the basis of the current operating state of said autonomous driving interface (102).

7.

8. A method according to any one of the preceding claims, characterized in that step i) comprises the steps of: receive, using said driver assistance control module (206A), data characterizing a first set of sensor information, said first set of sensor information being obtained from a plurality of first sensors (206B) with which said vehicle is equipped to facilitate driver assistance functionalities; and determine, using said driver assistance control module (206A), said set of driver assistance commands corresponding to said set of driver assistance functionalities on the basis of said first set of sensor information. A method according to claim 7, characterized in that step iii) comprises the steps of: receive, using the autonomous driving control unit (302), data characterizing a second set of sensor information, said second set of sensor information being obtained from a plurality of second sensors facilitating autonomous driving functionalities and the plurality of first sensors (206B); and determine, using the autonomous driving control unit (302), the first autonomous driving control command based on the second set sensor information.

9. Method according to claim 8, characterized in that step iii) comprises a step of shaping, using a control logic module (308) of said autonomous driving interface (102), said first autonomous driving control command before transmission to said first data management module (314).

10. A computer system (100) for managing the operation of a motor vehicle (200), said vehicle being able to operate in a manual driving mode and an autonomous driving mode, said vehicle comprising a primary electronic control unit (202) and several auxiliary electronic control units, including a chassis control unit (204) having a primary brake control module (204A) and a primary steering control module (204B), a powertrain control unit (208), a driver assistance control unit (206) comprising a driver assistance control module (206A) and an autonomous driving control unit (302), characterized in that said system (100) comprises an information processing unit, with one or more processors, and a data storage medium,which are configured to jointly execute at least one autonomous driving interface (102) and a safety module (104) implementing a method according to one of the preceding claims.

11. Motor vehicle (200) capable of operating in a manual driving mode and an autonomous driving mode, said vehicle comprising a primary electronic control unit (202) and several auxiliary electronic control units, including a chassis control unit (204) comprising a primary brake control module (204A) and a primary steering control module (204B), a powertrain control unit (208), a driver assistance control unit (206) comprising a driver assistance control module (206A) and an autonomous driving control unit (302), characterized in that said vehicle comprises a system (100) according to claim 10.

Images