A method of controlling a vehicle, the method comprising: generating, by a primary computing system, a nominal trajectory from a location for a vehicle in order to achieve a mission goal, the nominal trajectory being generated based on information received by the primary computing system from a perception system of the vehicle configured to detect objects in the vehicle's external environment; generating, by the primary computing system, a fall back trajectory from the location for the vehicle in order to safely stop the vehicle, the fall back trajectory being generated based on the information received by the primary computing system from the perception system of the vehicle, wherein the nominal trajectory and the fall back trajectory are identical between the location and a divergent point and where the nominal trajectory and the fall back trajectory diverge after the divergent point; sending, by the primary computing system, the fall back trajectory to a secondary computing system; receiving, by the secondary computing system, the fall back trajectory; controlling, by the secondary computing system, the vehicle according to the fall back trajectory; waiting, by the secondary computing system, for an updated trajectory from the primary computing system while controlling the vehicle according to the fall back trajectory; and when the vehicle reaches a threshold point on the fall back trajectory and an updated trajectory has not yet been received by the secondary computing system, continuing to control the vehicle, by the secondary computing system, according to the fall back trajectory in order to safely stop the vehicle. generating, by a primary computing system, a nominal trajectory from a location for a vehicle in order to achieve a mission goal, the nominal trajectory being generated based on information received by the primary computing system from a perception system of the vehicle configured to detect objects in the vehicle's external environment; generating, by the primary computing system, a fall back trajectory from the location for the vehicle in order to safely stop the vehicle, the fall back trajectory being generated based on the information received by the primary computing system from the perception system of the vehicle, wherein the nominal trajectory and the fall back trajectory are identical between the location and a divergent point and where the nominal trajectory and the fall back trajectory diverge after the divergent point; sending, by the primary computing system, the fall back trajectory to a secondary computing system; receiving, by the secondary computing system, the fall back trajectory; controlling, by the secondary computing system, the vehicle according to the fall back trajectory; waiting, by the secondary computing system, for an updated trajectory from the primary computing system while controlling the vehicle according to the fall back trajectory; and when the vehicle reaches a threshold point on the fall back trajectory and an updated trajectory has not yet been received by the secondary computing system, continuing to control the vehicle, by the secondary computing system, according to the fall back trajectory in order to safely stop the vehicle. <EOS>