A backflow program you can defend

You know the drill. The sanitary surveyor asks to see your cross-connection control program. What you actually have is a drawer of old backflow test reports and a general sense that someone handles it.

Backflow risk is easy to underrate because it rarely announces itself. EPA's incident file includes human blood pulled into a funeral home's water lines through a faucet aspirator. It also includes a pesticide (chlordane) that backsiphoned through a garden hose and left 75 apartments without water for 27 days.

A defensible program does not mean a device on every fixture in town by tomorrow. It means you know where the risk sits, you control the worst of it first, and you keep records a surveyor can actually read.

What counts as a cross-connection?

A cross-connection is any point, actual or potential, where your distribution system touches a source of contamination or pollution. It does not have to be a mistake. Most start as a convenience: a hose left in a bucket, a chemical feed line tied straight into a supply pipe, a boiler loop sharing water with the building's tap.

Backflow is what happens when water moves the wrong direction through that connection, and there are two mechanisms behind it. Backpressure happens when pressure on the customer's side (a pump, a boiler, a compressor) rises above the pressure in your main and pushes water back into the system. Backsiphonage happens when pressure on your side drops, often during a main break or heavy fire flow, and atmospheric pressure pulls contaminated water in from the other direction.

EPA's example incidents give a sense of how ordinary the setup usually is: lawn chemicals backsiphoning through a garden hose, carbonated water backing up from a soda fountain, boiler corrosion chemicals reaching an office building's taps. None of these require an unusual building. They require an unprotected connection and the right pressure moment.

Why does the sanitary survey ask for this at all?

Because the responsibility sits with you, not the customer. Under the Safe Drinking Water Act, the water purveyor answers for water quality all the way to the customer's free-flowing outlet (40 CFR 141.2(c)), not just to the meter. AWWA's policy on the subject, adopted in 1970 and last revised in 2001, opposes any return of used water to the public system and expects purveyors to run an ongoing program sized to the hazard.

Cross-connections are numerous, varied, and hard to predict, and backflow itself can be difficult to detect once it has happened. A program is what lets you find the highest-risk connections before one of them finds you, and it costs far less than responding to an actual contamination event.

How do you survey your own system for hazards?

Start with a written survey, not a mental list. For each facility:

• Decide whether the visit will be announced or unannounced, and identify yourself to the manager or owner.
• Ask directly what processes use potable water: boiler additives, cooling-tower chemicals, a second or raw water source, anything with an etching or plating tank.
• Start at the meter and walk every outlet: hose bibbs, slop sinks, kitchens, fire protection and Siamese connections, irrigation, boiler and mechanical rooms, laundry, any production floor.
• Sketch or photograph anything that looks like a connection, and note the generic device type the location needs.
• Set a reasonable timeframe for the owner to comply.

You will not get to every account at once, so prioritize by hazard. Facilities with a real health risk (plating shops, hospitals, car washes, metal finishing, funeral homes) go first. Ordinary residential and light commercial accounts can follow on a longer cycle.

What do backflow devices actually do?

Every device on the market falls into one of two functional groups: some stop backsiphonage only, others stop both backsiphonage and backpressure. Vacuum breakers, whether the atmospheric type or the pressure-rated version used under constant supply, only handle backsiphonage. They are not backpressure protection and should not be treated as such.

Devices that handle both mechanisms are chosen by the hazard level at the connection, not just the mechanism. A pollutant that degrades water quality but is not a health risk is lower-hazard, typically covered by a double check valve. A contaminant that could cause illness or death is high hazard and calls for an air gap or a reduced pressure principle device, both built to stop backsiphonage and backpressure under worst-case conditions.

Matching a specific device to a specific connection is a site-by-site technical decision, and it is worth a second set of eyes before you install anything permanent. What your program needs at the survey stage is the hazard classification and the mechanism at play, not the model number.

How often do devices get tested, and who tracks it?

Testable devices need a certified tester and a paper trail, not a one-time install and a hope. EPA is direct that programs vary by state and municipality, so your actual testing interval comes from your state primacy program or local ordinance, not a single national number. As a reference point, EPA's model ordinance calls for reduced pressure principle devices to be tested and inspected at least twice a year, at the owner's expense, by a certified tester.

A device that fails testing gets repaired and re-tested before it goes back into service, at the owner's cost. Locations with a history of failures should be tested more often than the baseline interval, not less.

Do you need an ordinance, and who holds the authority?

Yes. A workable ordinance has three parts: authority to run and enforce the program, technical requirements (what device, where, tested how often), and a penalty structure for noncompliance. Before you write one, your state's drinking water program, plumbing or building code authority, or health department can tell you whether you need new local legal authority or already have enough to enforce what you have.

EPA's model ordinance gives a useful shape even if your numbers differ locally. New construction gets a minimum dual check valve set at plan review. Existing premises found out of compliance get a defined window to fix it, roughly 90 days in EPA's model, shorter for higher hazard.

There is an escalation path if the owner does not act, ending in service disconnection for an uncorrected serious threat. Owners pay for their own devices, testing, and repairs. Your utility, not the customer, holds right of entry to assess the hazard in the first place.

What records does a surveyor actually accept?

Two documents, kept current, cover most of what a surveyor wants to see.

• A hazard survey per facility: what was found, the degree of hazard, and the device type recommended for that connection.
• A test and maintenance report per device: make, size, model, serial number, the actual test readings, any repairs made, and the certified tester's ID.

Behind those, keep a master file of permits and applications, and whatever reports your state requires: an initial listing of low- and high-hazard cross-connections, annual updates to that list, and a yearly summary of inspections completed. A drawer of loose test slips is not a program. A binder that lets you show, connection by connection, what was found and what was done about it, is.

Once your survey and ordinance basics are in place, the water distribution cross-connection guide walks through device selection at the level of detail a technical lead needs, and the sanitary survey prep guide covers what else the surveyor will ask for beyond backflow.