What prevents air from flowing backward from the primary tank to the supply tank if there is a failure?