The first treatment control system that explicitly and automatically balances the efficacy and safety goals of noninvasive thermal therapies is described, and its performance is evaluated in phantoms and in vivo using ultrasound heating with a fixed, focused transducer. The treatment efficacy is quantified in terms of thermal dose delivered to the target. The developed feedback thermal dose controller has a cascade structure with the main nonlinear dose controller continuously generating the reference temperature trajectory for the secondary, constrained, model predictive temperature controller. The control system ensures thermal safety of the normal tissue by automatically complying with user-specified constraints on the maximum allowable normal tissue temperatures. To reflect hardware limitations and to prevent cavitation, constraints on the maximum transducer power can also be imposed. It is shown that the developed controller can be used to achieve the minimum-time delivery of the desired thermal dose to the target without violating safety constraints, which is a novel and clinically desirable feature. The developed controller is model based, and requires patient- and site-specific models for its operation. These models were obtained during pre-treatment identification experiments. In our implementation, predictive models, internally used by the automatic treatment controller, are dynamically updated each time new temperature measurements become available. The adaptability of internal models safeguards against adverse effects of modelling errors, and ensures robust performance of the control system in the presence of a priori unknown treatment disturbances. The successful validation with two experimental models of considerably different thermal and ultrasound properties suggests the applicability of the developed treatment control system to different anatomical sites.