Safety System Through Cooperative On-Board And Off-Board Runtime Monitoring For A Reliable, Highly Automated Shuttle