On a Formal Model of Safe and Scalable Self-driving Cars