Abstract: Safety assessment on the dual-functional lithium lead test blanket module (DFLL-TBM) was performed with a modified version of RELAP5/MOD3 code in which the LiPb eutectic thermal-hydraulic sub-module was inserted. The DFLL-TBM and its ancillary cooling systems were modeled to conduct the computation and analysis for steady-state operation, anticipated operational incidents and relevant accidents. Computational results indicate that the maximum surface temperature of the first wall (FW) structural material is lower than the allowable value of 550 ℃. For the accident analyses, none of the pressure increases in ITER vacuum vessel (VV), port cell and TCWS vault induced by helium leaking is beyond the ITER safety limit of 0.2 MPa. No melting of the TBM box is found and the decay heat can be removed efficiently by the radiation heat transfer. With the current design, DFLL-TBM can meet the thermal hydraulic safety requirements from ITER.