Reactor cooling system for safe removal of residual heat in the case of an interruption of the heat transfer between reactor and heat sink. The emergency cooling systems are designed so that even in the case of reactor coolant loss – e.g. when both ends of a live-steam pipe are broken – the reactor is cooled and the decay heat can be removed over weeks. By means of redundant design a very high degree of functional safety is achieved. Thus, emergency cooling is guaranteed even if a subsystem fails.