Tank system and method for testing an isolating valve in a tank system

The method and system for testing isolation valves in tank systems by detecting pressure profiles and applying increased opening forces address the challenge of unreliable valve opening, ensuring reliable operation and even tank emptying.

EP4619676B1Active Publication Date: 2026-07-01ROBERT BOSCH GMBH

Patent Information

Authority / Receiving Office
EP · EP
Patent Type
Patents
Current Assignee / Owner
ROBERT BOSCH GMBH
Filing Date
2023-10-16
Publication Date
2026-07-01

AI Technical Summary

Technical Problem

Existing systems face challenges in reliably opening isolation valves in tank systems, particularly when multiple tanks are connected, leading to potential operational failures and uneven tank emptying due to non-switching valves.

Method used

A method and system for testing isolation valves by detecting pressure profiles before and after actuation, using a pressure sensor to verify if the valve has opened correctly, and employing increased opening forces if necessary to ensure valve functionality.

Benefits of technology

Ensures reliable operation of isolation valves by detecting and addressing non-opening valves, preventing system failures and ensuring even tank emptying, thereby maintaining system functionality.

✦ Generated by Eureka AI based on patent content.

Smart Images

  • Figure IMGF0001
    Figure IMGF0001
  • Figure IMGF0002
    Figure IMGF0002
Patent Text Reader

Abstract

Disclosed is a method for testing a switchable isolating valve of a valve device that connects a tank vessel to a pipe system, wherein a gas is stored at a first pressure in the tank vessel, and a second pressure that is lower than the first pressure prevails in the pipe system. The method comprises: actuating the isolating valve in order to switch it from a closed position, in which the isolating valve closes an extraction path of the valve device, which extraction path connects the pipe system and the tank vessel, into an open position, in which the isolating valve opens the extraction path; detecting a pressure profile in a tank-side portion of the extraction path which extends between the tank vessel and the isolating valve; determining whether the pressure profile detected after the actuation of the isolating valve includes a pressure drop; and outputting a fault signal if it is determined that the pressure profile detected after the actuation of the isolating valve does not include a pressure drop.
Need to check novelty before this filing date? Find Prior Art

Description

Technical field

[0001] The present invention relates to a tank system, in particular a tank system for storing a gaseous fuel, such as hydrogen, and for supplying a consumer system with the gaseous fuel, as well as a method for testing a separating valve in a tank system. State of the art

[0002] Hydrogen and other gaseous fuels can be used in mobile applications, particularly in road vehicles, to power drive systems. This includes the operation of fuel cells as well as internal combustion engines or other heat engines. Gaseous fuels can also be advantageously used for energy generation in stationary applications. Typically, the gas is stored in a tank system with one or more storage tanks and supplied to the consumer system, e.g., a fuel cell or an internal combustion engine, via a piping system connected to the storage tank(s).

[0003] US Patent 7,367,349 B2 describes a fuel cell supply system in which multiple tanks are connected in parallel to a fuel cell supply line via individual extraction lines. Each extraction line contains a switchable isolation valve to connect or disconnect the respective tank from the supply system. When the system is started, only one isolation valve is opened initially to increase the pressure in the supply system, and subsequently the remaining valves are opened. This reduces valve wear by decreasing the pressure differential between the tanks and the high-pressure supply system at the time the remaining valves open.

[0004] DE 10 2014 019419 A1 discloses a method for testing a plurality of solenoid valves in a high-pressure tank system of a motor vehicle.

[0005] In DE 10 2006 025125 A1 a method for detecting leaks in a fuel cell system is disclosed, which includes a hydrogen storage tank, a main shut-off valve and a secondary shut-off valve in the supply line.

[0006] In EP 1 286 104 A1, a gas supply device for detecting faults in a gas pressure sensor, which is mounted on the gas supply device, is shown.

[0007] EP 2 287 458 A2 discloses a method for detecting at least one faulty high-pressure gas tank, a high-pressure gas tank system, within a vehicle.

[0008] US Patent 8,675,334 B2 discloses a method for operating a refueling device of a motor vehicle, wherein the refueling device, including the tank and valve, is adjustable so that it is connected to a power source via a driver stage.

[0009] Generally, it is desirable for the isolation valves to open reliably when the system starts up in order to increase operational reliability. This applies to systems with only one tank as well as systems with multiple tanks. Disclosure of the invention

[0010] Against this background, the present invention provides a method with the features of claim 1 and a tank system with the features of claim 8.

[0011] According to a first aspect of the invention, a method for testing a switchable isolation valve of a valve device is provided, which connects a tank container to a piping system, wherein a gas with a first pressure is stored in the tank container, and a second pressure is present in the piping system which is lower than the first pressure.The method comprises actuating the isolating valve to switch it from a closed position, in which the isolating valve closes off a withdrawal path of the valve assembly connecting the piping system and the tank, to an open position, in which the isolating valve opens the withdrawal path; detecting a pressure profile in a tank-side section of the withdrawal path extending between the tank and the isolating valve; determining whether the detected pressure profile contains a pressure drop after actuating the isolating valve; and outputting an error signal if it is determined that the detected pressure profile does not contain a pressure drop after actuating the isolating valve.

[0012] According to a second aspect of the invention, a tank system comprises at least one tank container for storing gas, in particular hydrogen, a piping system for supplying a consumer system, such asa fuel cell or a heat engine, a valve assembly with a withdrawal path connecting the tank and the piping system, and a switchable isolating valve arranged in the withdrawal path, which can be switched between a closed position in which it closes the withdrawal path and an open position in which it opens the withdrawal path, a pressure sensor which is connected to a tank-side section of the withdrawal path extending between the tank and the isolating valve and is configured to detect the pressure in the tank-side section of the withdrawal path, and a control device which is signal-connected to the valve assembly and the pressure sensor and is configured to cause the tank system to carry out the steps of a method according to one of the preceding claims.

[0013] One of the underlying ideas of the invention is to detect the pressure profile on the tank side of the isolation valve and to evaluate it after the valve has been actuated. Since the pressure in the piping system is lower before the isolation valve opens than in the tank and thus on the tank side of the isolation valve, opening the isolation valve leads to a brief pressure drop on the tank side.

[0014] This means that in a tank-side section of a valve assembly's extraction path, a pressure dip occurs when the isolation valve switches from its closed to its open position. This brief pressure drop can be detected by a control device in the pressure signal supplied by the pressure sensor. If such a pressure drop is detected, it can be concluded that the respective isolation valve has opened correctly. If no pressure drop is detected, it can be concluded that the isolation valve did not switch from the closed to the open position as a result of the control signal.

[0015] One advantage of the invention is that a non-switching isolation valve can be reliably detected.

[0016] Advantageous designs and further developments result from the further sub-claims as well as from the description with reference to the figures in the drawing.

[0017] According to some embodiments, actuating the isolation valve may include generating a first opening force to open the isolation valve. If it is determined that the detected pressure curve after actuating the isolation valve does not contain a pressure drop, the isolation valve is actuated again with a second opening force greater than the first, with the steps of detecting the pressure curve and determining the pressure drop being repeated. Thus, if it is found that the isolation valve does not open during the first actuating, it can be actuated again with an increased opening force. This can further increase operational reliability, as the tank system can remain fully functional if the isolation valve opens with the increased opening force.

[0018] According to some embodiments, the error signal may only be output if it is determined that the detected pressure curve does not contain a pressure drop after the isolation valve has been actuated again with the second opening force. Optionally, a first error signal may be output if no pressure drop is detected in the detected pressure curve after the first actuation of the isolation valve, and a second error signal may be output if it is determined again that the detected pressure curve does not contain a pressure drop after the isolation valve has been actuated again with the second opening force.

[0019] According to some embodiments, the isolating valve may be designed as an electrically controllable, normally closed solenoid valve, wherein generating the first opening force includes supplying the isolating valve with a first control current, and wherein generating the second opening force includes supplying the isolating valve with a second control current that is greater than the first control current.

[0020] According to some embodiments, a release signal may be output when a pressure drop is detected in the measured pressure profile after the isolation valve has been actuated. For example, outputting the release signal may include generating a release message and writing the release message to a data memory.

[0021] According to some embodiments, several tanks may be connected to the piping system via several valve assemblies, each of which has a switchable isolation valve. Each isolation valve is actuated to switch it from the closed position to the open position. A pressure profile in the tank-side section of the extraction path is detected by each isolation valve after the respective isolation valve is actuated. For each isolation valve, it is determined whether the detected pressure profile after actuating the isolation valve contains a pressure drop. An error signal is output for each isolation valve for which it is determined that the detected pressure profile after actuating the respective isolation valve does not contain a pressure drop. Particularly with multiple tanks, undesirable effects can occur if one of the isolation valves fails to open.On the one hand, the gas stored in the tank whose shut-off valve fails to open is unavailable to the consumer system. On the other hand, this leads to uneven emptying of the tanks. If the shut-off valve fails to open at a later time, for example during a system restart, this results in pressure equalization and / or refilling of the other tanks. Such situations can be reliably avoided using this method.

[0022] According to some embodiments, it may be provided that the isolation valves are controlled one after the other or simultaneously.

[0023] According to some embodiments, determining whether the detected pressure curve after actuation of the isolation valve contains a pressure drop includes determining a pressure gradient of the detected pressure curve, and a pressure drop is determined if the pressure gradient assumes values ​​less than zero within a predetermined period after actuation.

[0024] According to some embodiments, outputting the error signal may include generating an error message and writing the error message to a data memory. Alternatively or additionally, outputting the error signal may include outputting a warning signal to a user interface. For example, an optical signal may be output on a display device or a warning light of the user interface, or an acoustic or haptic signal may be output.

[0025] According to some embodiments, the isolating valve may be designed as an electrically controllable, normally closed solenoid valve.

[0026] According to some embodiments, the tank system may have several tank containers which are connected to the piping system via several valve devices, each of which has a switchable isolation valve.

[0027] The features and advantages disclosed herein in connection with one aspect of the invention are also disclosed for the other aspect.

[0028] The invention will now be explained with reference to the figures in the drawings. The figures show: Fig. 1 a schematic view of a hydraulic circuit diagram of a tank system according to an embodiment of the invention; Fig. 2 a detailed view of a valve assembly of a tank system according to an embodiment of the invention; and Fig. 3 the sequence of a method according to an embodiment of the invention.

[0029] In the figures, the same reference symbols denote identical or functionally equivalent components, unless otherwise stated.

[0030] Fig. 1 Figure 1 schematically shows a tank system 100 for supplying a consumer system 200 with a gaseous fuel, e.g., hydrogen. The consumer system 200 can be, for example, a fuel cell or a heat engine. The tank system 100 can be used, for example, in a mobile application, such as a vehicle. However, the invention is not limited to this.

[0031] As in Fig. 1 As shown by way of example, the tank system 100 comprises several tank containers 1, a piping system 2, several valve devices 3, and a control device 5. Optionally, a user interface 6 can also be provided. Fig. 1 A tank system 100 with three tank containers 1 is shown as a purely exemplary example. It is also conceivable that the tank system 100 has only one tank container 1 or a different number than three tank containers 1. Furthermore, in Fig. 1 It is shown by way of example that each tank container 1 is provided with a valve assembly 3, via which the respective tank container 1 is connected to the piping system 2. Alternatively, it is also conceivable that several tank containers 1 are connected to the piping system 2 via a common valve assembly 3.

[0032] The tank containers 1 generally define an internal volume and can, for example, be designed to store hydrogen at a nominal pressure of up to 700 bar.

[0033] The piping system 2 can, for example, be a high-pressure piping system 2, which connects to an optional medium-pressure piping system 7, which is in Fig. 1 is merely symbolically represented as a block, to which consumer system 2 is connected. As in Fig. 1 In schematic representation, the tanks 1 are connected to each other in parallel with the piping system 2.

[0034] The valve devices 3 are assigned to the respective tank 1 and connect it to the piping system 2. Fig. 2 This schematically and highly simplified example shows an exemplary setup of valve assembly 3. As in Fig. 2 As shown, the valve assembly 3 has a first internal connection 3A, which is connected to the internal volume of the tank 1, and an external connection 3C, which is connected to the piping system 2. A second internal connection 3B may also be provided as an option. The valve assembly 3 has, as shown in Fig. 2 The figure shows a switchable isolation valve 30 and a pressure sensor 4. Optionally, a check valve 33 can also be provided. Likewise, the valve assembly 3 can optionally include a temperature sensor 35, as shown in Fig. 2 Shown purely as an example.

[0035] The first internal port 3A and the external port 3C are connected by a withdrawal path 31, in which the isolating valve 30, e.g., in the form of an electrically switchable, normally closed solenoid valve, is arranged. The isolating valve 30 divides the withdrawal path 31 into a tank-side section 31A, which extends between the first internal port 3A and the isolating valve 30, and a line-side section 31B, which extends between the isolating valve 30 and the external port 3C. The isolating valve 30 can be switched between a closed position and an open position. Fig. 2 The separating valve 30 is shown in the closed position. In this position, it closes the extraction path, meaning it interrupts the fluidic connection between the tank-side and pipe-side sections 31A, 31B of the extraction path 31 and thus prevents gas from flowing from the tank 1 from the first internal port 3A to the external port 3C. In the open position, the separating valve 30 opens the extraction path, meaning it establishes a fluidic connection between the tank-side and pipe-side sections 31A, 31B of the extraction path 31 and allows gas to flow from the tank 1 from the first internal port 3A to the external port 3C.

[0036] As in Fig. 2 As further shown, the second internal port 3B can be connected to the external port 3C via a filling path 32. The optional check valve 33 is located in the filling path 32 and is designed to allow flow only from the external port 3C to the second internal port 3B. If the pressure in the piping system 2 is higher than in the tank 1, gas from the piping system 2 can flow from the external port 3C into the tank 1 via the second internal port 3B, even with the separating valve 30 closed.

[0037] As in Fig. 2 As further shown, the pressure sensor 4 is connected to the tank-side section 31A of the extraction path 31. The pressure in the tank-side section 31A of the extraction path 31A can thus be measured using the pressure sensor 4.

[0038] The optional temperature sensor 35 can be part of the valve assembly 3, as shown in Fig. 2 This is shown purely as an example. The temperature sensor 35 is arranged such that it is connected to the internal volume of the tank container 1. The temperature inside the tank container 1 can therefore be measured using the temperature sensor 35.

[0039] The control unit 5 is in Fig. 1 The electronic control unit 5 is represented only as a block and can, in particular, be an electronic control device 5. The control device 5 can, for example, comprise a processor 50 and a data storage device 51. The processor 50 can, for example, be implemented as a CPU, an FPGA, an ASIC, or the like. The data storage device 51 can, in particular, be a non-volatile data storage device, such as flash memory, an SD memory, a hard drive, or the like. The data storage device 51 can be read by the processor 50 and can, for example, store software that can be executed by the processor 50 and causes it to generate output signals, such as control signals, based on input signals, such as measured values. The control device 5 is signal-connected to the valve devices 3 and the respective pressure sensor 4, for example, via a wired data bus, such as a CAN bus, USB, or the like, or wirelessly, such as via WiFi, Bluetooth, or the like.

[0040] In particular, the control device 5 can be configured to cause the tank system 100 to execute a procedure M for testing the switchable isolating valve 30 of the respective valve assembly 3. The sequence of a procedure M for testing the switchable isolating valve 30 of the respective valve assembly 3 is described in Fig. 3 The process M is shown schematically. It starts with an initial situation in which a gas, e.g., hydrogen, is stored in the tank 1 at a first pressure, and a second pressure exists in the piping system 2 that is lower than the first pressure. The isolation valves 30 are closed. Such an initial situation can occur, for example, before starting up the consumer system 200 connected to the tank system 100. The process M is explained below with reference to the tank system 100 described above.

[0041] In a first step M1, the isolating valve 30 is actuated by the control device 5, e.g., by the latter sending a control signal to the isolating valve 30 to switch it from its closed position to its open position. The control signal can, in particular, cause the isolating valve 30 to be opened by generating an initial opening force. If the isolating valve 30, as in Fig. 2 As exemplified by the electrically controlled, normally closed solenoid valve, generating the first opening force can involve energizing the isolating valve 30 with a first control current. If, as shown in Fig. 1 As shown by way of example, if several tank containers 1 with several valve devices 3 are provided, the separating valves 30 of the different valve devices 3 can be controlled one after the other or simultaneously.

[0042] In step M2, the pressure in the tank-side section 31A of the extraction path 31 is recorded in time steps using the pressure sensor 4. The control unit 5 thus receives a pressure signal which represents a pressure profile.

[0043] In step M3, the control unit 5 determines whether the recorded pressure curve after actuation (step M1) of the isolation valve 30 contains a pressure drop. The control unit 5 thus evaluates the pressure signals recorded after actuation of the isolation valve 30 and checks whether the pressure signals indicate a pressure drop, at least temporarily. For example, the control unit 5 can determine a pressure gradient of the recorded pressure curve, whereby a pressure drop is determined or detected if the pressure gradient assumes values ​​less than zero within a predetermined period after actuation.

[0044] If, in step M3, it is determined that the recorded pressure curve after actuating M1 of the separating valve 30 contains a pressure drop, as is the case in Fig. 3 As indicated by the symbol "+", the procedure can proceed to step M5. The presence of a pressure drop indicates that the respective isolation valve 30 has been opened in response to the activation (step M1). Due to the pressure in the piping system 2, which is lower than the pressure in the tank 1, a pressure drop occurs after the isolation valve 30 opens, which is generally temporary. The pressure curve thus contains a kind of undershoot.

[0045] In step M5, the control unit 5 can, for example, output a release signal. This can include, for example, generating a release message and writing the release message to the data storage 51.

[0046] If, in step M3, it is determined that the recorded pressure curve after actuation (step M1) of the isolation valve 30 does not contain a pressure drop, as in Fig. 3 Represented by the symbol "-", procedure M can proceed directly to step M4, in which the control unit 5 outputs an error signal. Outputting the error signal can, for example, include generating an error message and writing the error message to the data memory 51. Alternatively or additionally, the control unit 5 can also output a warning signal to the user interface 6. For example, the user interface 6, which is located in Fig. 1 The device is represented symbolically as a block, may have a display or warning light which is triggered by the control unit 5 to output a visual signal, or an acoustic or haptic warning signal may be output at the user interface 6. The output of the fault signal can occur for each isolation valve 30 for which it is determined that the respective pressure curve recorded after activation (step M1) of the respective isolation valve 30 does not contain a pressure drop, e.g., together with an index of the respective isolation valve.

[0047] Optionally, if step M3 determines that the recorded pressure curve after actuating (step M1) the isolation valve 30 does not contain a pressure drop, the procedure M can first proceed to step M31. In step M31, the control unit 5 can increment a counter value by one, which indicates how many times the isolation valve 30 has been actuated since it was last closed, in order to switch it from the closed position to the open position. When the isolation valve 30 switches to its closed position, the counter value is reset to zero.

[0048] In step M32, the control unit 5 checks whether the counter value is less than a predetermined limit. The limit can, for example, be an integer between two and ten. If step M32 determines that the counter value is less than the limit, as in Fig. 3 Represented by the symbol "+", the procedure can return to step M1. In this case, the isolation valve 30 is actuated again by the control device 5, with the second actuation of the isolation valve 30 being carried out with a second opening force that is greater than the first opening force. For example, generating the second opening force could involve energizing the isolation valve 30 with a second control current that is greater than the first control current. Subsequently, steps M2 and M3 are repeated as described above. If, in step M3, it is determined that the detected pressure curve after the isolation valve 30 has been actuated again with the second opening force contains a pressure drop (symbol "+" in the diagram), the procedure is then repeated. Fig. 3If the count is found to be below the limit (symbol "+"), the procedure proceeds to step M5. Otherwise, i.e., if it is determined that the recorded pressure curve does not show a pressure drop after the isolation valve is actuated again with the second opening force, steps M31 and M32 follow. As long as step M32 shows that the count is less than the limit (symbol "+"), steps M1-M3 can be repeated, with the opening force optionally being increased further in each iteration. If step M32 shows that the count reaches the limit (symbol "-"), the procedure proceeds to step M4.

[0049] Optionally, the error signal is only output in step M4 if it is determined at least once again that the recorded pressure curve does not contain a pressure drop after the isolation valve has been actuated again with the second opening force.

[0050] Alternatively, step M4 can be executed each time step M3 determines that the recorded pressure curve shows no pressure drop after the isolation valve 30 is reactivated, while steps M31 and M32 are also executed. For example, a first error signal can be output in step M4 each time step M32 determines that the count value is less than the limit. If step M32 determines that the count value reaches the limit (symbol "-"), a second error signal can be output in step M4. Outputting the first error signal could, for example, simply involve generating and writing an error message to data memory 51, while outputting the second error signal could alternatively or additionally involve outputting a warning signal to the user interface.

[0051] Although the present invention has been explained above by way of example embodiments, it is not limited to these, but can be modified in many ways. In particular, combinations of the preceding embodiments are also conceivable.

Claims

1. Method (M) for testing a switchable isolation valve (30) of a valve device (3), which connects a tank vessel (1) to a pipe system (2), wherein a gas is stored at a first pressure in the tank vessel (1), and a second pressure which is lower than the first pressure is present in the pipe system (2), wherein the method (M) comprises: actuating (M1) the isolation valve (30) in order to switch it from a closed position, in which the isolation valve (30) closes an extraction path (31) of the valve device (3) connecting the pipe system (2) and the tank vessel (1), into an open position, in which the isolation valve (30) opens the extraction path (31); characterized by the following steps: capturing (M2) a pressure curve in a tank-side section (31A) of the extraction path (31) extending between the tank vessel (1) and the isolation valve (30); determining (M3) whether a pressure drop is present in the captured pressure curve after actuating (M1) the isolation valve (31); and outputting (M4) an error signal if it is determined that a pressure drop is not present in the captured pressure curve after actuating (M1) the isolation valve (31).

2. Method (M) according to Claim 1, wherein the actuation (M1) of the isolation valve (30) comprises generating a first opening force for opening the isolation valve (30), wherein, if it is determined that a pressure drop is not present in the captured pressure curve after actuating (M1) the isolation valve (31), the isolation valve (30) is actuated (M1) again with a second opening force greater than the first opening force, wherein the steps of capturing (M2) the pressure curve and determining (M3) are carried out again, and wherein the error signal is preferably output (M4) only when it is determined again that a pressure drop is not present in the captured pressure curve after the isolation valve has been actuated again with the second opening force.

3. Method (M) according to Claim 2, wherein the isolation valve (30) is in the form of an electrically actuatable, normally closed solenoid valve, wherein the generation of the first opening force comprises energizing the isolation valve (30) with a first control current, and wherein the generation of the second opening force comprises energizing the isolation valve (30) with a second control current greater than the first control current.

4. Method (M) according to one of the preceding claims, additionally comprising: outputting (M5) an enable signal if it is determined that a pressure drop is present in the captured pressure curve after actuating (M1) the isolation valve (30).

5. Method (M) according to one of the preceding claims, wherein a plurality of tank vessels (1) are connected to the pipe system (2) via a plurality of valve devices (3), each of which has a switchable isolation valve (30), wherein each isolation valve (3) is actuated in order to switch it from the closed position into the open position, wherein a pressure curve is captured in the tank-side section (31A) of the extraction path (31) from each isolation valve (30) after actuating the respective isolation valve (30), wherein the determination (M3) of whether a pressure drop is present in the captured pressure curve after actuating (M1) the isolation valve (30) is carried out for each isolation valve (30), and wherein the error signal is output (M4) for each isolation valve (30) for which it is determined that a pressure drop is not present in the respective captured pressure curve after actuating (M1) the respective isolation valve (30).

6. Method (M) according to Claim 5, wherein the isolation valves (30) are actuated successively or simultaneously.

7. Method (M) according to one of the preceding claims, wherein the outputting (M4) of the error signal comprises generating an error message and writing the error message to a data memory (51) and / or outputting a warning signal to a user interface (6).

8. Tank system (100), comprising: at least one tank vessel (1) for storing gas, in particular hydrogen; a pipe system (2) for supplying a consumer system (200); a valve device (3) having an extraction path (31), which connects the tank vessel (1) and the pipe system (2), and a switchable isolation valve (30) which is arranged in the extraction path (31) and can be switched between a closed position, in which it closes the extraction path (31), and an open position, in which it opens the extraction path (31); a pressure sensor (4) which is connected to a tank-side section (31A) of the extraction path (31) extending between the tank vessel (1) and the isolation valve (30) and is configured to capture the pressure in the tank-side section (31A) of the extraction path (31A), characterized by a control device (5) which is signal-connected to the valve device (3) and the pressure sensor (4) and is configured to cause the tank system (100) to perform the steps of a method (M) according to one of the preceding claims.

9. Tank system (100) according to Claim 8, wherein the isolation valve (30) is in the form of an electrically actuatable, normally closed solenoid valve.

10. Tank system (100) according to Claim 8 or 9, wherein the tank system (100) has a plurality of tank vessels (1) which are connected to the pipe system (2) via a plurality of valve devices (3), each of which has a switchable isolation valve (30).