Method and system for managing the operation of a motor vehicle in mixed driving modes

Abstract

The invention relates to a method for managing, by way of an embedded computer system (100) located on board a motor vehicle (200), the operation of the vehicle, the vehicle being able to operate in a manual driving mode and an autonomous driving mode, the vehicle comprising a primary electronic control unit (202) and a plurality of auxiliary electronic control units, including a chassis control unit (204) having a primary braking control module (204A) and a primary steering control module (204B), a powertrain control unit (208), a driving assistance control unit (206) comprising a driving assistance control module (206A) and an autonomous driving control unit (302), the system (100) comprising at least one information processing unit, with one or more processors, and a data storage medium, which are configured to jointly execute at least one autonomous driving interface (102) and a safety module (104), the method comprising the following steps: i) receiving, by way of a gateway module (304) of the autonomous driving interface (102), data characterizing a set of driving assistance commands corresponding to a set of driving assistance functionalities; ii) determining, by way of a processing module (306) of the gateway module (304), a first driving assistance functionality that must remain active and data characterizing a first driving assistance command corresponding to this first driving assistance functionality; iii) determining, by way of a first data management module (314) of the autonomous driving interface (102), data characterizing a first set of information comprising the data characterizing a first driving assistance command, data characterizing a first autonomous driving control command, received from the autonomous driving control unit (302), and data characterizing a state of the safety module (104), the first autonomous driving control command corresponding to the first driving assistance functionality, the first driving assistance command and the first autonomous driving control command corresponding to a first driving operation; iv) determining, by way of a second data management module (408) of the safety module (104), data characterizing a second set of information, the second set of information including driving assistance commands and data characterizing a state of the autonomous driving interface (102); v) determining, by way of the second data management module (408), data characterizing a level of consistency between the first driving assistance command and the first autonomous driving control command; and vi) transmitting, by way of the first data management module (314), the data characterizing a first driving assistance command or the data characterizing a first autonomous driving control command to the primary electronic control unit (202), depending on the level of consistency.

Description

DESCRIPTION TITLE: Method and system for managing the operation of a motor vehicle in mixed driving modes Technical field of the invention

[0001] The present invention relates to the field of autonomous motor vehicles. The invention relates in particular to a method for managing, by a computer system on board a motor vehicle, the operation of the vehicle, the vehicle being capable of operating in a manual driving mode and an autonomous driving mode. The invention also relates to a computer system implementing such a method. The invention is applicable to any type of motor vehicle, including cars, robots or other autonomous shuttles. State of the prior art

[0002] In recent years, autonomous vehicles have received increasing attention, with the development of high-level autonomy vehicles (L3+), particularly for vehicles operating in controlled environments, such as logistics. Following this trend, the vast majority of developments in the field of autonomous vehicles concern the improvement of vehicle capabilities in terms of positioning, perception or vehicle control. However, one of the main limitations to the deployment of autonomous vehicles remains the ability to design a safe platform, which notably guarantees consistent vehicle performance under all circumstances. Thus, autonomous driving goes hand in hand with the need for redundant safety capacity to maintain safety during possible failures of autonomous driving.

[0003] In this regard, some approaches focus on implementing redundant braking capabilities. However, these approaches remain superficial in that they do not offer a complete dual system, which monitors and manages all other critical aspects and functions of the vehicle. Furthermore, they generally do not monitor autonomous driving commands and do not react in case of inconsistency. Summary of the invention

[0004] The invention aims to overcome these drawbacks. The object of the invention is to provide a solution that allows the safe operation of a vehicle in the event of a failure of autonomous driving. To achieve this, the invention aims to provide a method and a system that provide a redundant vehicle operation control capability that makes it possible to detect and react to any failure of any of the components that control the operation of the vehicle. In this way, the invention aims to improve the safety of autonomous vehicles.

[0005] In order to achieve these objectives, the invention relates, according to a first aspect, to a method for managing, by a computer system on board a motor vehicle, the operation of the vehicle, said vehicle being able to operate according to a manual driving mode and an autonomous driving mode, said vehicle comprising a primary electronic control unit and several auxiliary electronic control units, including a chassis control unit having a primary braking control module and a primary steering control module, a powertrain control unit, a driving assistance control unit comprising a driving assistance control module and an autonomous driving control unit, said system comprising at least one information processing unit, with one or more processors, and a data storage medium,which are configured to jointly execute at least one autonomous driving interface and a safety module, said method comprising the steps of:, i) receiving, by a gateway module of said autonomous driving interface, data characterizing a set of driving assistance commands corresponding to a set of driving assistance functionalities; ii) determining, by a processing module of said gateway module, a first driving assistance functionality which must remain active and data characterizing a first driving assistance command corresponding to this first driving assistance functionality;iii) determining, by a first data management module of said autonomous driving interface, data characterizing a first set of information comprising said data characterizing a first driving assistance command, data characterizing a first autonomous driving control command, received from said autonomous driving control unit, and data characterizing a state of said safety module, said first autonomous driving control command corresponding to said first driving assistance functionality, said first driving assistance command and said first autonomous driving control command corresponding to a first driving operation;iv) determining, by a second data management module of said security module, data characterizing a second set of information, said second set of information including driving assistance commands and data characterizing a state of said autonomous driving interface; v) determining, by said second data management module, data characterizing a level of consistency between said first driving assistance command and said first autonomous driving control command; and vi) transmitting, by said first data management module, said data characterizing a first driving assistance command or said data characterizing a first autonomous driving control command to said primary electronic control unit as a function of the level of consistency.;

[0006] According to a variant, the method may further comprise the steps of: • activating, by said first data management module, secondary electronic control modules of said vehicle if said safety module is in a non-operational state, said secondary electronic control modules comprising a secondary braking control module and a secondary steering control module; and • cause, by said secondary electronic control modules, the stopping of said vehicle by keeping the steering wheel in a current position and applying maximum braking power.

[0007] According to another variant, the method may further comprise the steps of: • transmit, by an emergency management module of said security module, data characterizing a non-operational state of said autonomous driving interface to a power management module of said security module; and • deactivating, by said power management module, said autonomous driving interface using a switch controlled by said power management module.

[0008] According to yet another variant, step iv) may comprise the steps of: • determine, by said second data management module, data characterizing an emergency control command, if said autonomous driving interface is in a non-operational state; and • causing, by said second data management module, the stopping of said vehicle by activating said primary braking control module and said primary steering control module in order to carry out a stopping maneuver on the basis of said emergency control command.

[0009] According to yet another variant, step iii) may comprise the steps of: • receive, using a first operating condition detection module of said autonomous driving interface, data characterizing a current operating state of said safety module; and • determining, using said first operating condition detection module, said state of said security module on the basis of said current operating state of said security module.

[0010] According to yet another variant, step iv) may comprise the steps of: • receive, using a second operating condition detection module of said safety module, data characterizing a current operating state of said autonomous driving interface; and • determining, using said second operating condition detection module, said state of said autonomous driving interface on the basis of the current operating state of said autonomous driving interface.

[0011] According to yet another variant, step i) may comprise the steps of: • receive, using said driving assistance control module, data characterizing a first set of sensor information, said first set of sensor information being obtained from a plurality of first sensors with which said vehicle is equipped to facilitate the driving assistance functionalities; and • determining, using said driving assistance control module, said set of driving assistance commands corresponding to said set of driving assistance functionalities on the basis of said first set of sensor information.

[0012] According to yet another variant, step iii) may comprise the steps of: • receiving, using the autonomous driving control unit, data characterizing a second set of sensor information, said second set of sensor information being obtained from a plurality of second sensors facilitating the autonomous driving functionalities and from the plurality of first sensors; and • determining, using the autonomous driving control unit, the first autonomous driving control command based on the second set of sensor information.

[0013] According to yet another variant, step iii) may comprise a step consisting of formatting, using a control logic control module of said autonomous driving interface, said first autonomous driving control command before transmission to said first data management module.

[0014] According to a second aspect, the invention relates to a computer system for managing the operation of a motor vehicle, said vehicle being able to operate according to a manual driving mode and an autonomous driving mode, said vehicle comprising a primary electronic control unit and several auxiliary electronic control units, among which a chassis control unit having a primary braking control module and a primary steering control module, a powertrain control unit, a driver assistance control unit comprising a driver assistance control module and an autonomous driving control unit, the system comprising an information processing unit, with one or more processors, and a data storage medium, which are configured to jointly execute an autonomous driving interface and a safety module implementing a method as described above.

[0015] According to a third aspect, the invention relates to a motor vehicle capable of operating in a manual driving mode and an autonomous driving mode, said vehicle comprising a primary electronic control unit and several auxiliary electronic control units, including a chassis control unit comprising a primary braking control module and a primary steering control module, a powertrain control unit, a driver assistance control unit comprising a driver assistance control module and an autonomous driving control unit, the vehicle comprising a system as described above. Brief description of the drawings

[0016] Other characteristics and advantages of the invention will appear on examining the detailed description below and the appended figures, in which:

[0017] [Fig- 1] is a functional diagram of a system according to the invention;

[0018] [Fig. 2] is a functional diagram of a vehicle according to the invention;

[0019] [Fig. 3] is a functional diagram of an autonomous driving interface of a system according to the invention;

[0020] [Fig. 4] is a functional diagram of a security module of a system according to the invention; and

[0021] [Fig. 5] is a flowchart of the steps of a method according to the invention. Detailed description of the invention

[0022] Figure 1 illustrates a system 100 according to the invention for managing the operation of a motor vehicle capable of operating in a manual driving mode and an autonomous driving mode. It is a computer system which comprises an information processing unit, with one or more processors, and a data storage medium, which are configured to jointly execute at least one autonomous driving interface 102 and one safety module 104, as described below.

[0023] Figure 2 illustrates an architecture of a vehicle 200 according to the invention. This vehicle typically comprises a primary electronic control unit 202 and a plurality of auxiliary electronic control units. The primary electronic control unit 202 interconnects and transfers data between the auxiliary electronic control units in order to operate the vehicle. The auxiliary electronic control units include a chassis control unit 204, a driver assistance control unit 206, a powertrain control unit 208, a multimedia and communication equipment control unit 210 and a body control unit 212. The vehicle further comprises an autonomous driving control unit 302, illustrated in Figure 3.

[0024] The chassis control unit 204 comprises a primary brake control module 204A, a primary steering control module 204B, a dynamic control module 204C and a brake assist control module 204D. The chassis control unit 204 assumes the management of the vehicle dynamics. The driving assistance control unit 206 comprises a driving assistance control module 206A, which is connected to a plurality of first sensors 206B. The powertrain control unit 208 comprises an electric machine management module 208A, an inverter management module 208B and a battery management module 208C. The multimedia and communication equipment control unit 210 comprises a multimedia management module 210A, a communication module 210B and an audio control module 210C.The body control unit 212 includes a body control module 212A, an instrument cluster management module 212B, and a power management module 212C. The body control unit 212 manages the electrical components of the vehicle.

[0025] Figure 3 illustrates in more detail the components of the autonomous driving interface 102 of the system 100 according to the invention. It comprises a gateway module 304 which integrates a processing module 306, a logic control module 308, a detection data reception module 310, a first operating condition detection module 312 and a first data management module 314.

[0026] Figure 4 illustrates in more detail the components of the safety module 104 of the system 100 according to the invention. The safety module 104 includes a second operating condition detection module 402, an emergency management module 404, a power management module 406 and a second data management module 408. The safety module 104 is placed between the chassis control unit 204 and the driver assistance control unit 206, as seen in Figure 2. This allows it to monitor and control all data that passes between the chassis control unit 204 and the driver assistance control unit 206. In addition, it can short-circuit a nominal path to the primary electronic control unit 202 in order to cause the vehicle to stop depending on a condition or situation. It further provides redundant braking capability in the event of a failure.The autonomous driving interface 102 is connected to the safety module 104 via a first communication interface 324A, for example an Ethernet type interface.

[0027] According to the invention, all the elements described above contribute to enabling the implementation of a method for managing the operation of a vehicle capable of operating in a manual driving mode and an autonomous driving mode, as described below in relation to Figures 2-5.

[0028] Figure 5 illustrates a flowchart of the steps of the method according to the invention. According to a first step 502 of the method, the gateway module 304 receives data characterizing a set of driving assistance commands, corresponding to a set of driving assistance functionalities, which are transmitted to it by the driving assistance control module 206A. The autonomous driving interface 102 is connected to the driving assistance control module 206A via a second communication interface 324B, for example an interface of the CAN FD type. The driving assistance functionalities may include parking assistance, lane keeping assistance, adaptive cruise control, etc. The driving assistance commands include driving instructions for operating the vehicle according to the driving assistance functionalities. The driving assistance control module 206A determines the set of driving assistance commands based on a first set of sensor information.The first set of sensor information is obtained from a plurality of first sensors 206B that are installed in the vehicle to facilitate the implementation of driver assistance features. The first sensors 206B include, for example, an ultrasonic sensor, a camera, a radar, a lidar, a GPS sensor, motion sensors, steering angle sensors, etc. For example, information from an ultrasonic sensor may be used to determine a driver assistance command corresponding to a parking assistance feature. Similarly, information from a front-facing camera or a radar may be used to determine a driver assistance command corresponding to an emergency braking assistance feature.

[0029] According to a second step 504 of the method, the processing module 306 determines a first driving assistance functionality that must remain active and, correspondingly, data characterizing a first driving assistance command. After determining which driving assistance functionality must remain active, the processing module 306 sends data characterizing a deactivation command to deactivate one or more other driving assistance functionalities. For example, the processing module 306 determines that an emergency braking assistance functionality must remain active. Alternatively, the processing module 306 determines several functionalities driving assistance features that must remain active. According to an advantageous variant, the processing module 306 obtains in real time data characterizing an input that it uses to determine the driving assistance feature(s) that must remain active. In other words, the processing module 306 can be updated or modified by a user operating an input interface connected to the vehicle.

[0030] According to a third step 506, the first data management module 314 determines data characterizing a first set of information. The first set of information comprises the data characterizing a first driving assistance command, data characterizing a first autonomous driving control command and data characterizing a state of said safety module 104. For this, the first data management module 314 receives from the processing module 306 the data characterizing a first driving assistance command and it receives data characterizing a first autonomous driving control command from the autonomous driving control unit 302. The autonomous driving control unit 302 is connected to the autonomous driving interface 102 via a third communication interface 324C, for example a CAN FD type interface.The autonomous driving control unit 302 determines the first autonomous driving control command corresponding to a first driving assistance functionality based on a second set of sensor information. For example, the first driving assistance functionality is an autonomous guidance functionality, a parking assistance functionality, or a cruise control functionality. The autonomous driving control unit 302 is in communication with the positioning systems, the perception systems, and the navigation system to provide autonomous driving. The second set of sensor information is obtained from the first sensors 206B and several second sensors integrated with the vehicle to facilitate implementation of the autonomous driving functionalities. The sensing data receiving module 310 receives the first set of sensor information. from the first sensors 206B and transmits them to the autonomous driving control unit 302. The first sensors 206B transmit data via a fourth communication interface 324D, for example an Ethernet type interface, to the detection data receiving module 310. The first set of sensor information comprises, for example, information relating to the odometry of the vehicle or a steering angle value. The autonomous driving control unit 302 sends the data characterizing a first autonomous driving control command to the control logic control module 308 via the third communication interface 324C. The control logic control module 308 formats the data characterizing the first autonomous driving control command before transmitting them to the first data management module 314.This formatting ensures that the data characterizing the first driving assistance command transmitted by the processing module 306 and the data characterizing the first autonomous driving control command are in a similar format which allows their comparison. Thus, the first set of information is linked to the first driving assistance command, the one which corresponds to the active driving assistance functionality.

[0031] Furthermore, the first data management module 314 receives data characterizing a state of the security module 104 from the first operating condition detection module 312. The state of the security module 104 stipulates an operational state or a non-operational state. The first operating condition detection module 312 receives the data characterizing a current operating state of the security module 104 and determines the state of the security module 104 based on the current operating state of the security module 104.

[0032] According to a fourth step 508 of the method, the second data management module 408 determines the data characterizing a second set of information, which includes driving assistance commands and data characterizing a state of the autonomous driving interface 102. The second data management module 408 is connected to the driving assistance control module 206A via a fifth communication interface 410A, for example of the CAN FD type, which allows it to receive driving assistance commands which are transmitted by the driving assistance control module 206A. The second data management module 408 receives data characterizing a state of the autonomous driving interface 102 from the second operating condition detection module 402. The second operating condition detection module 402 receives data characterizing the current operating state of the autonomous driving interface 102 and determines the state of the autonomous driving interface 102 based on the current operating state of the autonomous driving interface 102.The state of the autonomous driving interface 102 is preferably an operational state or a non-operational state.

[0033] According to a fifth step 510 of the method, the second data management module 408 determines data characterizing a level of consistency between the first driving assistance command and the first autonomous driving control command. The first driving assistance command and the first autonomous driving control command correspond to a first driving operation. The first driving operation corresponds, for example, to a steering or braking operation. To determine the level of consistency, the second data management module 408 receives the first driving assistance command from the driving assistance control module 206A via the fifth communication interface 410A and it receives the first autonomous driving command from the autonomous driving interface 102 via a sixth communication interface 410B, which is, for example, a CAN FD type interface.The second data management module 408 establishes the consistency level by establishing whether the data received from the driver assistance interface 102 differs from that received from the driver assistance control module 206A. The second data management module 408 transmits the consistency level thus determined to the first data management module 314. furthermore, if it establishes that the consistency level is low, the second data management module 408 causes the vehicle to stop by controlling the primary brake control module 204A, the primary steering control module 204B and / or the powertrain control unit 208 via a seventh communication interface 410C, an eighth communication interface 410D and a ninth communication interface 410E, which are, for example, CAN FD type interfaces.

[0034] According to a sixth step 512 of the method, the first data management module 314 transmits the data characterizing a first driving assistance command or the data characterizing a first autonomous driving control command to the primary electronic control unit 202 according to the level of consistency determined by the second data management module 408 in the previous step. If the first driving assistance command and the first autonomous driving control command comprise the same driving instruction corresponding to a first driving operation, the level of consistency is high. This is the case, for example, when the first driving assistance command and the first autonomous driving control command comprise a braking instruction.On the contrary, if the first driving assistance command and the first autonomous driving control command comprise different driving instructions with respect to the same driving operation, the level of consistency is low. For example, the first driving assistance command comprises a braking instruction because the first sensors 206B have detected an obstacle on the trajectory of the vehicle, while the first autonomous driving control command does not comprise any braking instruction because the second sensors have not detected the obstacle on the trajectory. In this case, the level of consistency between the driving assistance command and the autonomous driving control command is low.

[0035] If the consistency level is high, the first management module 314 transmits the data characterizing a first control command of autonomous driving to the primary electronic control unit 202 via a tenth communication interface 324E. The tenth communication interface 324E is, for example, a CAN FD type interface. Then, the primary electronic control unit 202 transmits the first autonomous driving control command to the auxiliary electronic control units which, in turn, transmit the first autonomous driving control command to the primary braking control module 204A, the primary steering control module 204B and the powertrain control unit 208. These modules then control the operation of the vehicle by performing the first driving operation based on the first autonomous driving control command. For example, they steer or brake the vehicle based on the first autonomous driving command.

[0036] If the consistency level is low, the first data management module 314 short-circuits the nominal path to the primary electronic control unit 202 by replacing the first autonomous driving control command with the first driving assistance command. Thus, in this case, it is the data characterizing a first driving assistance command that is transmitted to the primary braking control module 204A, the primary steering control module 204B and / or the powertrain control unit 208. The corresponding control modules of the auxiliary electronic control units then control the operation of the vehicle by executing the first driving operation on the basis of the first driving assistance command. For example, they steer or brake the vehicle according to the first driving assistance command.

[0037] From a safety and redundancy perspective, the first data management module 314 activates secondary electronic control modules of the vehicle if the safety module 104 is not operational. This is a safety measure to shut down the vehicle since redundancy is no longer available. The secondary electronic control modules include a secondary brake control module 320 and a secondary steering control module 322. The autonomous driving interface 102 is connected to the secondary brake control module 320 via an eleventh communication interface 324F, and it is connected to the secondary steering control module 322 via a twelfth communication interface 324G. The eleventh communication interface 324F and the twelfth communication interface 324G are, for example, of the CAN FD type. The secondary electronic control modules stop the vehicle by holding the steering wheel in a current position and applying maximum braking power according to a vehicle stop command transmitted by the first data management module 314.

[0038] In addition, the safety module 104 deactivates the autonomous driving interface 102 as soon as the latter is in a non-operational state. For this, the second operating condition detection module 402 transmits the data characterizing a non-operational state of the autonomous driving interface 102 to the emergency management module 404 which, in turn, informs the power management module 406 of the non-operational state of the autonomous driving interface 102. The power management module 406 controls a switch 316 which makes it possible to deactivate the autonomous driving interface 102. Indeed, the autonomous driving interface 102 is powered by a power supply unit 318, and the switch 316 makes it possible to cut off the power supply to the autonomous driving interface 102 in response to a command from the power management module 406.

[0039] Further, the second data management module 408 determines data characterizing an emergency control command if the autonomous driving interface 102 is in a non-operational state. This is a safety measure to provide dual control to ensure safety. The second data management module 408 stops the movement of the vehicle by activating the primary brake control module 204A and the primary steering control 204B that implement a stopping maneuver based on the emergency control command. The primary brake control module 204A actuates the brakes to stop the vehicle. The primary steering control module 204B freezes the steering wheel in its current position. In addition, the powertrain torque is reduced based on the emergency command to prevent acceleration of the vehicle when a safety stopping maneuver is initiated. The second data management module 408 sends the emergency control command via the communication interfaces 410C, 410D and 410E.

[0040] Thus, the autonomous driving interface 102 and the safety module 104 monitor each other to improve the safety of autonomous driving. In nominal operation, the system 100 according to the invention selects the autonomous driving mode and the operation of the vehicle is determined on the basis of the commands of the autonomous driving interface 102. However, in the event of a failure of the autonomous driving interface 102 or if the level of coherence between a driving assistance command and a corresponding autonomous driving control command is low, the safety module 104 short-circuits the nominal path to the primary electronic control unit 202 in order to cause the vehicle to stop.

[0041] Thus, the method and system 100 according to the invention provide a solution for enabling the safe operation of a vehicle in the event of a failure of autonomous driving. The method and system according to the invention notably enable the operation of a vehicle based on possible control inconsistencies that occur when the autonomous driving mode is activated. The invention further provides a redundant vehicle operation control capability that detects and reacts to any hardware failure. In this way, the invention improves the safety of autonomous vehicles.

Claims

CLAIMS:

1. Method for managing, by a computer system (100) on board a motor vehicle (200), the operation of the vehicle, said vehicle being able to operate according to a manual driving mode and an autonomous driving mode, said vehicle comprising a primary electronic control unit (202) and several auxiliary electronic control units, including a chassis control unit (204) having a primary braking control module (204A) and a primary steering control module (204B), a powertrain control unit (208), a driving assistance control unit (206) comprising a driving assistance control module (206A) and an autonomous driving control unit (302), said system (100) comprising at least one information processing unit, with one or more processors, and a data storage medium,which are configured to jointly execute at least one autonomous driving interface (102) and a safety module (104), characterized in that said method comprises the steps of: i) receiving, by a gateway module (304) of said autonomous driving interface (102), data characterizing a set of driving assistance commands corresponding to a set of driving assistance functionalities; ii) determining, by a processing module (306) of said gateway module (304), a first driving assistance functionality which must remain active and data characterizing a first driving assistance command corresponding to this first driving assistance functionality; iii) determining, by a first data management module (314) of said autonomous driving interface (102), data characterizing a first set of information comprising said data characterizing a first driving assistance command,data characterizing a first autonomous driving control command, received from said autonomous driving control unit (302), and data characterizing a state of said safety module (104), said first command, autonomous driving control corresponding to said first driving assistance functionality, said first driving assistance command and said first autonomous driving control command corresponding to a first driving operation; iv) determining, by a second data management module (408) of said security module (104), data characterizing a second set of information, said second set of information including driving assistance commands and data characterizing a state of said autonomous driving interface (102); v) determining, by said second data management module (408), data characterizing a level of consistency between said first driving assistance command and said first autonomous driving control command;and vi) transmitting, by said first data management module (314), said data characterizing a first driving assistance command or said data characterizing a first autonomous driving control command to said primary electronic control unit (202) depending on the level of consistency.; 2. Method according to claim 1, characterized in that the method further comprises the steps of: • activating, by said first data management module (314), secondary electronic control modules of said vehicle if said safety module (104) is in a non-operational state, said secondary electronic control modules comprising a secondary braking control module (320) and a secondary steering control module (322); and • cause, by said secondary electronic control modules, the stopping of said vehicle by keeping the steering wheel in a current position and applying maximum braking power.

3. Method according to one of the preceding claims, characterized in that the method further comprises the steps of: • transmit, by an emergency management module (404) of said security module (104), data characterizing a non-operational state of said autonomous driving interface (102) to a power management module (406) of said security module (104); and • deactivating, by said power management module (406), said autonomous driving interface (102) using a switch (316) controlled by said power management module (406).

4. Method according to claim 3, characterized in that step iv) comprises the steps of: • determining, by said second data management module (408), data characterizing an emergency control command, if said autonomous driving interface (102) is in a non-operational state; and • causing, by said second data management module (408), said vehicle to stop by activating said primary braking control module (204A) and said primary steering control module (204B) in order to perform a stopping maneuver on the basis of said emergency control command.

5. Method according to one of the preceding claims, characterized in that step iii) comprises the steps of: • receive, using a first operating condition detection module (312) of said autonomous driving interface (102), data characterizing a current operating state of said safety module (104); and • determining, using said first operating condition detection module (312), said state of said security module (104) on the basis of said current operating state of said security module (104).

6. Method according to one of the preceding claims, characterized in that step iv) comprises the steps of: • receive, using a second operating condition detection module (402) of said safety module (104), data characterizing a current operating state of said autonomous driving interface (102); and • determining, using said second operating condition detection module (402), said state of said autonomous driving interface (102) on the basis of the current operating state of said autonomous driving interface (102).

7. Method according to one of the preceding claims, characterized in that step i) comprises the steps of: • receiving, using said driving assistance control module (206A), data characterizing a first set of sensor information, said first set of sensor information being obtained from a plurality of first sensors (206B) with which said vehicle is equipped to facilitate the driving assistance functionalities; and • determining, using said driving assistance control module (206A), said set of driving assistance commands corresponding to said set of driving assistance functionalities on the basis of said first set of sensor information.

8. Method according to claim 7, characterized in that step iii) comprises the steps of: • receiving, using the autonomous driving control unit (302), data characterizing a second set of sensor information, said second set of sensor information being obtained from a plurality of second sensors facilitating the autonomous driving functionalities and from the plurality of first sensors (206B); and determining, using the autonomous driving control unit (302), the first autonomous driving control command based on the second set of sensor information.

9. Method according to claim 8, characterized in that step iii) comprises a step consisting of formatting, using a control logic control module (308) of said autonomous driving interface (102), said first autonomous driving control command before transmission to said first data management module (314).

10. Computer system (100) for managing the operation of a motor vehicle (200), said vehicle being able to operate in a manual driving mode and an autonomous driving mode, said vehicle comprising a primary electronic control unit (202) and several auxiliary electronic control units, among which a chassis control unit (204) having a primary braking control module (204A) and a primary steering control module (204B), a powertrain control unit (208), a driver assistance control unit (206) comprising a driver assistance control module (206A) and an autonomous driving control unit (302), characterized in that said system (100) comprises an information processing unit, with one or more processors, and a data storage medium,which are configured to jointly execute at least one autonomous driving interface (102) and a safety module (104) implementing a method according to one of the preceding claims., 11. A motor vehicle (200) capable of operating in a manual driving mode and an autonomous driving mode, said vehicle comprising a primary electronic control unit (202) and several auxiliary electronic control units, including a chassis control unit (204) comprising a primary braking control module (204A) and a primary steering control module (204B), a powertrain control unit (208), a driving assistance control unit (206) comprising a driving assistance control module (206A) and an autonomous driving control unit (302), characterized in that said vehicle comprises a system (100) according to claim 10.

Images