[en] This paper summarizes the approach taken to reactor shutdown in the design of EFR. The reactor protection system (RPS) is designed to perform an automatic shutdown following a design basis fault. It consists of two independent and diverse subsystems each of which has a number of associated measured trip parameters. Each sub-system also has a set of diverse absorber rods suspended by electromagnets, either of which can shut down the reactor. The total reliability of the RPS is 10^-8 failures per demand. A third shutdown level concept has also been introduced into the EFR design to protect against beyond design basis faults. This comprises various options for passive safety features, which mitigate the consequences of failure of the reactor protection system. These include: Control rod driveline enhanced thermal expansion (CREED), to insert the rods into the core if the outlet temperature should rise. Absorber rod stroke limitation device (SLD) to protect against inadvertent withdrawal of an absorber from the core. The design concept and performance of each of these devices is described in the paper. (author)