  To enable highly automated vehicles where the driver is no longer a safety
backup, the vehicle must deal with various Functional Insufficiencies (FIs).
Thus-far, there is no widely accepted functional architecture that maximizes
the availability of autonomy and ensures safety in complex vehicle operational
design domains. In this paper, we present a survey of existing methods that
strive to prevent or handle FIs. We observe that current design-time methods of
preventing FIs lack completeness guarantees. Complementary solutions for
on-line handling cannot suitably increase safety without seriously impacting
availability of journey continuing autonomous functionality. To fill this gap,
we propose the Safety Shell, a scalable multi-channel architecture and
arbitration design, built upon preexisting functional safety redundant channel
architectures. We compare this novel approach to existing architectures using
numerical case studies. The results show that the Safety Shell architecture
allows the automated vehicle to be as safe or safer compared to alternatives,
while simultaneously improving availability of vehicle autonomy, thereby
increasing the possible coverage of on-line functional insufficiency handling.
