Several emergency plasma shutdown schemes for the International Thermonuclear Experimental Reactor (ITER) have been analyzed. The development of these procedures is critical in order to demonstrate a reliable safety system to respond to accidents resulting from failures in burn control systems, plasma facing components, and thermal conversion facilities. The schemes considered include shutting off the heating and fueling systems, triggering an H-mode to L-mode transition, injecting impurities, and disabling vertical stability control systems. Most of these methods are based on active detection and intervention primarily because the power producing element (the plasma) is not in direct communication with the media undergoing the accident condition (the coolant and blanket material). Time dependent simulations indicate that emergency shutdown time without triggering a disruption from the above schemes is only marginally acceptable.