AbstractThe self-limiting nature of the fusion reaction, modest mobilizable radioactive inventories, multiple confinement layers, and passive decay heat removal, suggest that ITER will be ‘safe’ with little dependence on engineered ‘safety systems’ for public protection. To assess ITER’s ultimate safety margins, key safety input parameters are varied to study the impact of safety function degradation beyond those explicitly considered in the design process. Typically, the safety consequences from safety function degradation are linear or less than linear, and thus the functions degrade gradually. There are no fusion nuclear process or plasma transients that give safety-related growing non-linearities. Removal of fusion decay heat is robust with multiple processes available: the ultimate being passive natural circulation of the vacuum vessel coolant and gas convection in the cryostat. Using the IAEA dose criterion, the no-evacuation objective is met.