Correct. I filled the system with ordinary car antifreeze in a ratio 1:3, which should give adequate protection in a UK winter. The whole system is done with 10mm pipe, which I have insulated with Armaflex, the same black tube that you see on air conditioners. With the pipework being so small there is only about 5 litres in the pipes so it whizzes around pretty fast with little opportunity to lose heat, only slowing down when it meets the 22mm manifold in the collector and the coil. It's pumped by a tiny pump running off the differential controller, which itself is powered by a 12v DC cellphone charger plugged into the mains.
The panel is 20 tubes, relatively small for my 160 litre tank, so it's unlikely that the panel will ever boil. If we did go on holiday in flaming June and it got close to boiling, the differential controller is pretty sophisticated; when the cylinder reaches the target temperature I have set it can operate a standard motorised valve and dump the flow to our main house cylinder, which is downstairs in tandem with the 160 litre storage cylinder. Some people like to set up an old radiator in the attic as a heat dump but we are getting a bigger twin coil cylinder installed in spring, which will run partly off the gas boiler. If the controller failed to dump heat, the header tank is rated at 100C for 500 hours as long as it is adequately supported so we shouldn't get meltdown. Even if that happened there is only a total of 20 litres of liquid in the system and the header tank, so not much damage could occur.
The panel itself is fairly "transparent" to wind; air can pass between the tubes and there are two reflectors behind them with gaps so that wind can pass through. So far in the westerly gales we've had, we haven't heard the panel lifting off the roof.