I believe thats why certain molten salt reactors do away with any complexity in the reaction chambers - some designs are planned to operate with fuel dissolved in the salt. Criticality comes from the shape of the reaction chamber vessel. Worst kind of failure mode - fuel cell rupture/core meltdown are not really possible - simply because those are the normal operating procedure. Should anything go really wrong the molten salt/fuel mix should melt emergency reliefs and drain into non-criticality vessel.
I do not remember the nitty-gritty details and can't find it now, sorry.
Now imagine the emergency drain failure, due to a quake seismic shift, massive explosion nearby or a construction worker forgetting his helmet in. What's the plan B?
Rely on gravity and put the non-critical tank underneath the critical tank. Make sure to make the critical tank a much lower melting point than the non-critical tank. Burst diaphragms (well, low melting point plugs, like steam boilers have used for a few centuries now).
Possibly you're confusing "inherently safe" with "it can't break or become uneconomical". Also talking about inherently safe plants, usually they're talking physics, an inattentive enough electrician could probably find a way to put his hand across the output of an alternator, there's just nothing "nuclear" about those kind of accidents other than the worksite happening to be a plant.
Inherently safe just means you can't have a Chernobyl because water doesn't burn as well as charcoal. Its inherently very difficult to set PWR moderator on fire (water) compared to the Chernobyl experience (graphite, more or less purified coal). Although its against the spirit of the linked article, the PWR "near" my house inherently can't have a sodium leak because it doesn't use sodium as a coolant.
