The receiver system is an essential part of the solar tower power plant and it is important for stable power generation. This paper introduces a molten salt receiver system model and discusses structure selection of the cold surge tank under this model. It seems the structure of cold surge tank has little effect on system performance. A system simulation is used to create emergency conditions in order to directly demonstrate the function of the cold and hot surge tanks. The results show the necessity of both tanks. Cold surge tank can effectively improve the safety of receiver during pump failure while hot surge tank can greatly increase the operation time during downcomer blockage. The outlet temperature and level control failure are also analyzed. The results demonstrate the possible consequences of a control system failure. (C) 2017 Elsevier Ltd. All rights reserved.