High-Density Liquid Cooling Architecture & Thermal Catastrophe Dynamics

J. McKenney

This is an unnumbered WG-02-DT working paper. It provides the detailed thermodynamic derivation behind the fifteen-second thermal trip cliff that WG-02-DT-Article3 uses as its Case A scenario for a 120 kW direct-to-chip liquid-cooled rack, confirmed by the matching 94.0 degree Celsius emergency shutdown figure the two papers share, and it extends that single scenario into a comparative treatment of direct-to-chip, single-phase and two-phase immersion cooling and into the actuarial consequences of the same physics.

Licence: CC BY 4.0. 17 September 2026.

Executive Abstract#

AI accelerator racks generate more heat than air can remove, and the industry's answer, dense liquid cooling, buys that thermal headroom at a cost it has not fully priced: a liquid-cooled rack holds only a small volume of active coolant, so where an air-cooled hall rides through a chiller failure for fifteen to thirty minutes, a liquid-cooled rack reaches a destructive temperature within about fifteen seconds of losing flow.

This paper works the physics for the cooling architectures now in commercial use, direct-to-chip cold plates and single- and two-phase immersion, and maps how an attacker with unauthenticated access to a coolant distribution unit or an immersion tank controller could trigger that flow loss deliberately. It then turns the failure sequence into the numbers an underwriter needs: the loss expectancy of an unprotected facility, the return on a hardwired thermal interlock that removes the operator from the trip path, and the effect hardening has on coverage terms under a state-backed cyber-attack exclusion such as Lloyd's Market Bulletin Y5381.

The central engineering conclusion is that no amount of monitoring or operator training closes a fifteen-second gap; only a hardwired, software-independent trip acts fast enough, and the paper sets out what certifying that trip path requires.

Abstract#

Modern AI accelerators have broken the thermodynamic limits of air cooling. Legacy enterprise racks rarely exceeded 15 kW; accelerator clusters such as the NVIDIA GB200 NVL72 (approximately 120 kW) and GB300 NVL72 (up to 142 kW) dissipate 120 kW to 142 kW in one rack. At these densities liquid cooling is a physical necessity: water conducts heat over 23 times better than air and stores roughly 3,000 times more per unit volume. That transition collapses thermal buffering time. An air-cooled hall's room air gives fifteen to thirty minutes of ride-through after a chiller trip; a 120 kW liquid-cooled rack holds only tens of liters of active coolant across its two loops. If an unauthenticated network command trips a Coolant Distribution Unit (CDU) pump or closes an isolation valve, silicon reaches the throttling limit within 9 seconds and the emergency hardware shutdown (94.0 degrees Celsius) within 15 seconds; absent that protection, the package crosses the organic substrate glass transition region (150 degrees Celsius) in under 90 seconds. We compare Direct-to-Chip Liquid Cooling (DLC) against Single-Phase and Two-Phase Immersion, map the unauthenticated operational technology attack surfaces of commercial CDU and immersion controllers, model the non-linear fluid dynamics of the 15-second thermal trip cliff, and formulate the actuarial capital requirements for property catastrophe underwriting under the state-backed cyber-attack exclusion required by Lloyd's Market Bulletin Y5381.

1. The Thermodynamic Breakdown of Air Cooling#

For three decades, data center design relied on moving massive volumes of chilled air across silicon heat sinks. As accelerator thermal design power (TDP) scaled past 700 W per die and rack footprints surged past 100 kW, air cooling collapsed against immutable physical laws:

• Thermal Conductivity Deficit: Air has a thermal conductivity of $k_{\text{air}} \approx 0.026\text{ W/(m}\cdot\text{K)}$, compared to treated water-glycol coolant ($k_{\text{coolant}} \approx 0.60\text{ W/(m}\cdot\text{K)}$); a 23-fold deficit.
• Volumetric Heat Capacity Deficit: The volumetric heat capacity of air is $\rho c_p \approx 1.2\text{ kJ/(m}^3\cdot\text{K)}$, whereas water stores $\rho c_p \approx 4{,}184\text{ kJ/(m}^3\cdot\text{K)}$; a 3,486-fold deficit.
• The Acoustic and Space Boundary: Cooling a 130 kW rack with air requires a volumetric flow rate exceeding $16{,}000\text{ CFM}$ ($7.55\text{ m}^3\text{/s}$). The physical fan power required to push this volume creates acoustic sound pressure levels exceeding $95\text{ dBA}$ and consumes over $25\%$ of total rack electrical power.

The 120 kW Rack: Air Against Direct-to-Chip Liquid#

Moving between those two columns is a physical scaling transition, not a design preference. At an identical rack load, flow rate, parasitic power and ride-through time each shift by orders of magnitude.

2. Multi-BOM and DEXPI Process Hydraulic Topology#

To execute real-time thermal digital twin simulations, the hydraulic plant is mapped between the DEXPI 2.0 piping schematic, classed against the ISO 15926-4 reference data library, and the CycloneDX 1.6+ multi-BOM specification:

By binding physical pipe diameters, roughness factors, and valve flow coefficients ($C_v$) from DEXPI to CycloneDX bill of materials records, the digital twin verifies that software setpoints do not command hydraulic states that induce cavitation or thermal runaway.

3. Comparative Analysis of the Three Cooling Modalities#

Modern compute facilities implement three primary cooling modalities, each presenting distinct thermodynamic characteristics and operational technology attack surfaces:

Table 6.1#

Comparative Analysis of Cooling Modalities

3.1 The Direct-to-Chip (DLC) Dominance#

Direct-to-Chip cooling has emerged as the dominant architecture for hyperscale generative AI clusters. Fluid flows directly through microchannel cold plates clamped to the accelerator silicon package. It captures 80 percent to 85 percent of total rack heat dissipation, with residual convective heat rejected to rear-door heat exchangers or perimeter CRAH units.

3.2 The Immersion Alternative: Pros and Cons#

Immersion cooling submerses entire server chassis into dielectric fluid tanks:

• Single-Phase Immersion: Circulates synthetic hydrocarbons. Highly reliable, but fluid viscosity requires heavy-duty pumping and creates severe maintenance friction during component replacement.
• Two-Phase Immersion: Uses fluorochemical fluids that boil at $50^\circ\text{C}$, carrying heat away through latent heat of vaporization. While thermally superior, two-phase systems face severe regulatory obsolescence due to European Union and US EPA phase-outs of per- and polyfluoroalkyl substances (PFAS).

4. The 15-Second Thermal Trip Cliff: Applied Physics#

The critical vulnerability of Direct-to-Chip cooling is the total absence of physical thermal inertia:

4.1 Transient Thermal Conduction Formulation#

The silicon junction temperature $T_j(t)$ following fluid stagnation is governed by the transient energy conservation equation:

Where:

• $P_{\text{pkg}} = 1{,}200\text{ W}$ continuous heat dissipation per accelerator package, which is the configurable maximum NVIDIA publishes for a GB200-class Blackwell GPU. A compute tray carries four such packages and two Grace CPUs and draws roughly 5.4 kW; eighteen compute trays and nine NVLink switch trays make up the approximately 120 kW rack.
• $C_{\text{thermal}} = 800\text{ J/K}$ lumped thermal capacitance of the stagnant cold plate assembly: 2 J/K of silicon, 25 J/K of package substrate, lid and thermal interface material (TIM), 193 J/K of copper cold plate base and fin block (0.50 kg at 385 J/(kg K)), and 580 J/K of PG25 retained inside the channels and stubs (0.147 L at 3,950 kJ per cubic meter kelvin). The retained coolant dominates the total and has to be counted, because on pump stop it stops carrying heat away and becomes thermal mass.
• $A_{\text{pkg}} = 0.00160\text{ m}^2$ package contact area ($1{,}600\text{ mm}^2$), the footprint of a dual-die Blackwell module, roughly twice the 814 square millimeter reticle-limited single die of the preceding Hopper generation.
• Heat flux is $75\text{ W/cm}^2$.

Under nominal operating conditions, rack flow is maintained at $\dot{Q} = 122\text{ L/min}$ of PG25 coolant. At the volumetric heat capacity of 3,950 kJ per cubic meter kelvin used above, that flow carries 120 kW at a coolant temperature rise of 15 K, from a 32°C secondary supply to a 47°C return, which is inside the ASHRAE liquid cooling envelope. Each cold plate takes 1.69 L/min of it through 60 parallel rectangular microchannels of 0.13 mm by 2.0 mm, giving a hydraulic diameter $D_h = 0.244\text{ mm}$ and a channel velocity of 1.8 m/s. The resulting channel Reynolds number is approximately 380, so the flow is laminar and the turbulent Dittus-Boelter correlation, which requires a Reynolds number of at least 10,000 in a circular duct, does not apply here. The convective heat transfer coefficient is taken instead from the Nusselt number for thermally developing laminar flow in a high aspect ratio rectangular duct, $\text{Nu} \approx 7.5$:

Yielding $h_{\text{conv}} \approx 18{,}500\text{ W/(m}^2\cdot\text{K)}$. At this convective rate, junction temperature stabilizes at $T_j = T_{\text{coolant}} + P_{\text{pkg}}/(h_{\text{conv}} A_{\text{pkg}}) = 32 + 1{,}200/(18{,}500 \cdot 0.00160) = 72.5^\circ\text{C}$, comfortably below the 85°C throttle point.

When an unauthenticated network packet commands the pump VFD to stop, $\dot{Q}(t)$ collapses to zero. Convective heat removal drops to natural conduction: $h_{\text{conv}} \to 450\text{ W/(m}^2\cdot\text{K)}$. The net heat accumulation inside the silicon package becomes:

The cold plate copper block and the coolant stranded inside it are already carried in $C_{\text{thermal}}$, so $1.46^\circ\text{C/s}$ is the rate at the instant of stagnation and it decays only slightly as the temperature difference across the stagnant film grows. Within $8.6\text{ seconds}$, junction temperature reaches the thermal throttling limit ($85.0^\circ\text{C}$). By $t = 14.8\text{ seconds}$, it reaches the emergency hardware shutdown trip point ($94.0^\circ\text{C}$) and the protection logic removes power from the tray. That trip point is a protective setpoint, not a material limit: NVIDIA qualifies Hopper-class silicon to an average GPU temperature of 87°C and its high bandwidth memory to 95°C, and the hardware shutdown sits a few degrees above the qualification temperature. The material limits lie far higher. If the protection fails, the package continues to heat and crosses the organic substrate glass transition region ($150^\circ\text{C}$) at about 54 seconds, which is where irreversible package damage begins.

4.2 Darcy-Weisbach Hydraulic Pressure Surge (Water Hammer)#

Conversely, commanding a motorized isolation valve rapidly closed while circulating pumps operate at full speed ($60\text{ Hz}$) induces violent hydraulic pressure spikes governed by the Joukowsky equation:

Where:

• $\rho = 1{,}042\text{ kg/m}^3$ (PG25 coolant density).
• $c_{\text{sonic}} \approx 1{,}280\text{ m/s}$ (acoustic wave speed in stainless steel piping).
• $\Delta v = 1.85\text{ m/s}$ (initial fluid velocity).

Standard quick-disconnect fittings and flexible rack hoses are rated for an operating pressure of $6.0\text{ bar}$ and proof tested to $12.0\text{ bar}$. A pressure surge of $24.7\text{ bar}$ ruptures hose couplings instantly, spraying conductive water-glycol coolant across live 48V DC busbars and energized server electronics.

5. The Critical Vulnerability: Unauthenticated CDU Controllers#

Commercial Coolant Distribution Units manufactured by leading OEMs (CoolIT, Vertiv, Motivair, Schneider) represent the single highest-consequence attack surface in hyperscale infrastructure:

Exposure Findings: The Unprotected CDU Attack Surface#

1. Zero ISASecure / IEC 62443 certification. Not a single commercial CDU controller holds IEC 62443-4-2 component-level certification. Firmware lacks secure boot and crypto signatures.
2. Unprotected Modbus TCP register access. Modbus port 502 operates in cleartext. Any entity on the facility VLAN can issue Function Code 06 to write pump speed and valve setpoints.
3. Bidirectional telemetry spoofing. An attacker commanding a pump stop simultaneously overwrites holding registers to report nominal flow, blinding supervisory BMS operators.

6. Systems Assurance#

Engineering Remediations and Quality Gates

To eliminate the 15-second thermal trip cliff, systems assurance leads mandate three architectural quality gates:

6.1 Gate 1#

Hardwired Bi-Metallic Thermal Cutouts (SIL-3)

Software monitoring algorithms cannot be trusted to protect hardware during a 15-second thermal cliff. Facilities must install analog, bi-metallic snap-action thermal switches directly on the copper base of each cold plate. The switch is wired in series with the server power supply enable line. If die temperature breaches $88.0^\circ\text{C}$, the switch physically opens, terminating compute power in $< 100\text{ milliseconds}$ independently of the BMC, operating system, or network.

6.2 Gate 2#

Protocol-Isolated Zone Conduits and Data Diodes

CDU controllers must be removed from the general facility VLAN and assigned to an isolated IEC 62443 Zone 1. All telemetry passing to the central Building Management System must cross a hardware-enforced optical data diode. The supervisory BMS can observe flow and temperature, but cannot transmit setpoint write commands to the CDU.

6.3 Gate 3: Mechanical Pressure Relief#

Every secondary fluid manifold must incorporate a mechanical spring-loaded relief valve set to $5.5\text{ bar}$. If a motorized valve closes rapidly, the mechanical valve pops open, routing fluid through a bypass loop and preventing water hammer pressure spikes from rupturing quick-disconnect fittings.

7. Actuarial and Reinsurance Treaty Structuring#

Structuring property catastrophe and business interruption reinsurance for high-density liquid-cooled facilities requires formal underwriting invariants:

7.1 Annualized Loss Expectancy and Probable Maximum Loss#

The financial risk exposure resulting from unmitigated liquid cooling failure modes is evaluated through the Annualized Loss Expectancy ($\text{ALE}$):

Where:

• $C_{\text{replacement}}$ is the capital equipment replacement cost ($120,000 per ruined accelerator tray).
• $\dot{L}_{\text{BI}}(t) = 18{,}500\text{ USD/hour}$ SLA revenue loss rate during business interruption.
• $\Phi_{\text{regulatory}}$ is the statutory fine levied under EU CRA Article 64 or EU NIS2.

7.2 Return on Security Investment (ROSI) for Hardware Interlocks#

The capital justification for deploying hardwired SIL-3 bi-metallic cutouts and optical data diodes is quantified through the Return on Security Investment ($\text{ROSI}$):

For a 100 MW facility, deploying analog thermal switches ($C_{\text{controls}} = 180{,}000\text{ USD}$) reduces annual loss expectancy from $8,450,000 down to $125,000, delivering a modeled $\text{ROSI} = 4{,}525\%$. Modeled, not measured: the arithmetic is exact, but both loss expectancies are engineering estimates for a reference 100 MW hall chosen by the authors, and neither is drawn from claims experience at an operating site. An underwriter should substitute the loss figures for the plant in front of them and recompute before the number carries any weight. EN 50126 and IEC 62443 compliance requires that the provenance of every safety-related component be recorded and auditable, while Caliptra 2.0 silicon roots of trust, DICE identities, and OpenSIL initializers eliminate common-cause firmware exploitation.

8. Summary of Engineering Principles#

High-density liquid cooling demands five immutable engineering principles:

1. Fluid Density Eliminates Time: Transitioning to liquid cooling shrinks operational decision windows from thirty minutes to forty-five seconds. Human response is physically impossible.
2. Software Must Not Hold Exclusive Safety Authority: Non-certified PLCs connected to unauthenticated networks must never be the sole defense against catastrophic thermal runaway.
3. Hardware Always Trumps Software: Snap-action bi-metallic switches and mechanical pressure relief valves operate outside software networks, guaranteeing physical survival.
4. Isolate the Control Plane: CDU controllers must operate in dedicated, protocol-isolated zones with unidirectional optical data diodes preventing remote write execution.
5. Thermodynamic Rigor Unlocks Capital: Quantifying fluid dynamics and thermal failure velocities transforms catastrophic liquid cooling risks into an underwritten, insurable asset class.

9. References#

• [1] Lloyd's (2022): Market Bulletin Y5381: Cyber-attack exclusions. Corporation of Lloyd's, 16 August 2022. Cited for the state-backed cyber-attack exclusion discussed in section 7.
• [2] DEXPI e.V. (2025): DEXPI 2.0 Specification. Released 10 October 2025, gitlab.com/dexpi/Specification, CC BY 4.0. Cited for the process hydraulic topology model discussed in section 2.
• [3] International Electrotechnical Commission (2019): IEC 62443-4-2: Security for industrial automation and control systems, Part 4-2: Technical security requirements for IACS components. Cited for the component-level certification discussed in sections 3 and 6.
• [4] NVIDIA Corporation: Datasheet for NVIDIA Blackwell Architecture. Product datasheet. Cited for the per-GPU power figure discussed in section 4.
• [5] NVIDIA Corporation: NVIDIA Mission Control Systems Administration Guide, FAQ. docs.nvidia.com/mission-control/docs/systems-administration-guide/2.0.0/prs/faq.html. Cited for the four-GPU, two-Grace-CPU compute tray composition discussed in section 4.
• [6] NVIDIA Corporation: DGX GB Rack Scale Systems User Guide, hardware chapter. docs.nvidia.com/dgx/dgxgb200-user-guide/hardware.html. Cited for the approximately 120 kW rack power figure discussed in section 4.