in the circuit. Since there is no draw-off point below the top of the cylinder, even if the cold supply fails the cylinder will remain full, and the failure will be discovered long before there is any danger of the water in it boiling away.
Boiler explosions are