  The complexity of automated driving poses challenges for providing safety
assurance. Focusing on the architecting of an Autonomous Driving Intelligence
(ADI), i.e. the computational intelligence, sensors and communication needed
for high levels of automated driving, we investigate so called safety
supervisors that complement the nominal functionality. We present a problem
formulation and a functional architecture of a fault-tolerant ADI that
encompasses a nominal and a safety supervisor channel. We then discuss the
sources of hazardous events, the division of responsibilities among the
channels, and when the supervisor should take over. We conclude with identified
directions for further work.
