Abstract: A vehicle with autonomous navigation abilities ensures that the vehicle will remain within a safe driving region, such as the current lane, even in the case of a system failure. The vehicle's autonomous control subsystem computes driving parameters used to follow a path of the vehicle toward the current destination. These driving parameters are used to compute a safety envelope describing a region that the vehicle could reach from the present position in case of system failure before coming to a stop. The safety envelope is compared to a current safe driving region, and if the safety envelope violates the boundaries of the safe driving region, the driving parameters and corresponding safety envelopes are recomputed until the currently-computed safety envelope no longer violates the boundaries of the safe driving region.