Safety analysis of the DONES primary heat removal system