Programming Languages for High-Assurance Autonomous Vehicles (Ivory)