The Safety Shell: an Architecture to Handle Functional Insufficiencies in Automated Driving