A controller for controlling at least one autonomous vehicle (280, 380), the controller comprising: a firmware configured to control the autonomous vehicle (280, 380) comprising: an event module configured to process safety critical components in an environmental model of the autonomous vehicle (280, 380) to generate emergency control signals to control the behavior of the autonomous vehicle (280, 380) with priority, wherein the environmental model is a digital representation of the autonomous vehicle and an environment associated with the autonomous vehicle (280, 380), and wherein the safety critical components include data from the digital representation that are critical to the safety of the environment and the autonomous vehicle (280, 380); and a transaction module configured to update the environ-mental model by transactional processing of sensor data from sensing units of the autonomous vehicle (280, 380), whereby at least one of the safety critical components and non-safety critical components of the environmental model are updated, wherein the non-safety critical components include data from the environmental model not critical to the safety of the environment and autonomous vehicle (280, 380), wherein the environmental model further comprises: an object list of objects in the autonomous vehicle (280, 380) and the environment, wherein the objects include at least one of living objects, non-living objects, animate objects and inanimate objects; and an occupancy map of the objects and associated object parameters, wherein object parameters define status of the objects at a time instance and a relationship of the objects with respect to the autonomous vehicle (280, 380), and wherein the transaction module is configured to define the updates as transactions performed on the environmental model using at least one of the sensor data and predicted updates, wherein the transactions include insertion, deletion, modification of the object parameters in the occupancy map, and wherein the transactions are executed as atomic, recoverable operations. an event module configured to process safety critical components in an environmental model of the autonomous vehicle (280, 380) to generate emergency control signals to control the behavior of the autonomous vehicle (280, 380) with priority, wherein the environmental model is a digital representation of the autonomous vehicle and an environment associated with the autonomous vehicle (280, 380), and wherein the safety critical components include data from the digital representation that are critical to the safety of the environment and the autonomous vehicle (280, 380); and a transaction module configured to update the environ-mental model by transactional processing of sensor data from sensing units of the autonomous vehicle (280, 380), whereby at least one of the safety critical components and non-safety critical components of the environmental model are updated, wherein the non-safety critical components include data from the environmental model not critical to the safety of the environment and autonomous vehicle (280, 380), wherein the environmental model further comprises: an object list of objects in the autonomous vehicle (280, 380) and the environment, wherein the objects include at least one of living objects, non-living objects, animate objects and inanimate objects; and an occupancy map of the objects and associated object parameters, wherein object parameters define status of the objects at a time instance and a relationship of the objects with respect to the autonomous vehicle (280, 380), and wherein the transaction module is configured to define the updates as transactions performed on the environmental model using at least one of the sensor data and predicted updates, wherein the transactions include insertion, deletion, modification of the object parameters in the occupancy map, and wherein the transactions are executed as atomic, recoverable operations. an object list of objects in the autonomous vehicle (280, 380) and the environment, wherein the objects include at least one of living objects, non-living objects, animate objects and inanimate objects; and an occupancy map of the objects and associated object parameters, wherein object parameters define status of the objects at a time instance and a relationship of the objects with respect to the autonomous vehicle (280, 380), and wherein the transaction module is configured to define the updates as transactions performed on the environmental model using at least one of the sensor data and predicted updates, wherein the transactions include insertion, deletion, modification of the object parameters in the occupancy map, and wherein the transactions are executed as atomic, recoverable operations.