Reference accidents are selected to envelope possible accident sequenc
es to confirm the adequacy of ITER's safety design. Analyses of ITER r
eference accidents were carried out starting from postulated initiatin
g events (PIE) to all consequential failures including environmental r
eleases, if any. In case of plasma control malfunctioning, up to 3.3 G
W of fusion power can be reached transiently, however, no radiological
consequence is expected from those transients. Assuming multiple firs
t wall pipe failures, the pressure suppression system limits the maxim
um pressure within the vacuum vessel to below 0.5 MPa. Long-term decay
heat removal is assured by the vacuum vessel cooling system operating
in natural circulation. In case of ex-vessel coolant loss with contin
ued plasma burn, the plasma facing components can potentially reach la
rge temperatures. This is avoided by the fusion power shutdown system
that terminates plasma burn. A small in-vessel coolant leak with failu
re of one vacuum vessel penetration line and several confinement optio
ns are investigated to show compliance with release limits. Failures i
n the magnet system are analyzed and their impact on other systems suc
h as damage to neighboring confinement barriers are investigated by po
stulating air, water and helium ingress into the cryostat. Failures in
the tritium plant are analyzed to demonstrate the adequacy of confine
ment. Radioactive releases for all reference accidents are shown to be
well below conservatively defined design guidelines. (C) 1998 Publish
ed by Elsevier Science S.A. All rights reserved.