Degrees of hazard: minor, moderate and severe

When Maya brought her completed survey to Luis, he handed it back with a red pen. "Every line needs a hazard rating," he said. "Minor, moderate or severe. That rating decides the device. Get it wrong one way and the owner pays for protection they don't need. Get it wrong the other way and somebody drinks boiler chemicals." This lesson explains how backflow hazards are rated, how the rating connects to the choice of device, and how to rate the cross-connections Maya found at Kingsway Tower.

Why hazards are rated

Backflow devices are not equally protective, and they are not equally expensive to buy, install, test and maintain. An air gap is the most protective, but it breaks the pressure and needs a tank or pump to restore it. A reduced pressure principle assembly is very protective, but it discharges water through its relief port, needs a drain, and must be tested every year. A double check valve assembly is cheaper and does not discharge, but if both checks foul at the same time it gives no warning. A vacuum breaker is simple but protects only against backsiphonage. Rating the hazard lets codes and utilities match the level of protection to the level of risk, so the most protective devices go where a failure could kill and simpler devices go where a failure would mean bad taste.

Two questions decide a rating. First, what is on the other side of the connection, and what would happen to a person who drank it? Second, how likely is backflow at this connection: can it happen by backsiphonage, backpressure or both, and how often does the equipment create the conditions? A dangerous substance behind a connection that cannot backflow by backpressure may still need a lower class of device; a mild substance behind a connection with a booster pump needs a device that holds against pressure.

The three Canadian categories

CSA B64.10 sorts cross-connections into three degrees of hazard, and Ontario's building code and municipal by-laws use the same terms. In broad terms, the categories are these.

• Minor hazard: the substance on the other side could affect the water's appearance, taste or odour but is not expected to harm health. A cold water connection to a cooling coil with only plain water in it is an example.
• Moderate hazard: the substance could be objectionable and could cause some harm, but serious illness or death is unlikely. Many apartment buildings, hotels, restaurants and schools are rated moderate hazard for premise isolation because of the range of ordinary equipment they contain.
• Severe hazard: the substance could cause serious illness or death, spread disease, or carry a high chance of doing so. Hospitals, labs, chemical plants, car washes and food processing plants are commonly rated severe for premise isolation, and so are individual connections to boilers with chemicals, sewage, medical equipment and pesticides.

Utilities in Ontario often publish tables that sort building types into these categories for premise isolation, sometimes with in-between groups such as moderate to severe. The table is a starting point; the actual rating depends on what the survey finds inside.

From rating to device

Once a cross-connection is rated, the standard and code point to the acceptable devices. For severe hazards, only an air gap or a reduced pressure principle assembly is generally acceptable where backpressure can occur, though vacuum breakers may be allowed at the fixture for backsiphonage-only conditions in some cases. For moderate hazards, a double check valve assembly is the usual device, with a reduced pressure assembly always acceptable as an upgrade. For minor hazards, a dual check valve device or a double check assembly is common. For premise isolation, Ontario's code points to the CSA selection rules for buildings rated moderate or severe, and requires dual check protection at the service for houses that have an auxiliary water supply without a direct connection.

The phrase "or better" matters. A higher-rated device is always acceptable in place of a lower one. Many designers specify reduced pressure assemblies for all premise isolation in commercial buildings, even where a double check would satisfy the code, because the relief valve gives visible warning of a failure and because tenants change over the life of a building.

# A simple hazard-and-device lookup (Canadian terms; check the code for the full rules)
RULES = {
    ("severe", True):   "air gap or RP",
    ("severe", False):  "air gap, RP, or a vacuum breaker where permitted",
    ("moderate", True): "DCVA or better",
    ("moderate", False): "vacuum breaker or better",
    ("minor", True):    "dual check, DCVA or better",
    ("minor", False):   "vacuum breaker or better",
}
connections = [("boiler plant fill", "severe", True), ("fire sprinkler", "moderate", True),
               ("terrace hose bibb", "moderate", False), ("dental clinic supply", "severe", True),
               ("cooling coil fill, plain water", "minor", True)]
for name, hazard, backpressure in connections:
    print(f"{name:30s} {hazard:8s} -> {RULES[(hazard, backpressure)]}")

boiler plant fill              severe   -> air gap or RP
fire sprinkler                 moderate -> DCVA or better
terrace hose bibb              moderate -> vacuum breaker or better
dental clinic supply           severe   -> air gap or RP
cooling coil fill, plain water minor    -> dual check, DCVA or better

A lookup like this is a study aid, not a design tool. Real selection also considers the installation rules for each device, the utility's own requirements, whether the device must be testable, and whether it is listed for the specific equipment.

Judgment calls

Some connections are hard to rate. A hose bibb is a classic example: the hose could end up in a swimming pool, a bucket of soapy water, a puddle or a pesticide sprayer. Codes resolve this by treating hose connections as a hazard that needs at least a hose connection vacuum breaker, no matter what the hose is used for today. Fire sprinkler systems are another: plain water that sits for years becomes discoloured and depleted of chlorine, and some systems contain antifreeze or corrosion inhibitors, so utilities rate them differently. A dental office can be rated in the highest hazard class because of the vacuum system and chair lines, even though most of its fixtures are ordinary sinks.

When in doubt, a plumber should ask the authority having jurisdiction, which may be the building department, the utility's cross-connection inspector or both. Rating a connection higher than needed costs money; rating it lower than needed can cost lives and the plumber's licence.

Ratings change

A rating is not permanent. A tenant change can turn a low-risk office floor into a high-risk lab. Adding glycol to a hydronic system raises its rating. Removing chemical treatment can lower it. Cross-connection programs require resurveys when buildings change use, and good programs resurvey on a schedule. Every time Maya's crew works on a system with a backflow preventer, Luis has her ask the same question: is the device still right for what is on the other side?

Worked examples of rating

Ratings become easier with practice. Raj gave Maya a list of real connections from past jobs and asked her to rate each one and explain why. The point was not to memorize a table but to think through what could get into the water and how bad it would be.

A residential lawn sprinkler system with no chemical injection was her first case. Water standing in the buried piping can pick up soil, fertilizer, animal waste and bacteria, so it is not merely unpleasant. Most programs rate it as moderate, and many require a severe rating once fertilizer or chemical injection is added. A drinking fountain fed directly from the potable supply has no hazard at all. A commercial dishwasher is moderate because it contains detergent and food soil, and a photo processor or a laboratory sink with chemical drains is severe because toxic chemicals are present.

Some ratings depend on details. A fire sprinkler system with no additives, made of approved pipe and with no connection to other water sources, is usually minor because the water in it is stale but not toxic. The same system with antifreeze, a chemical additive, or a connection to a pond or tank becomes severe. A boiler with no treatment chemicals is moderate, but a boiler with corrosion inhibitors or glycol is severe. A hose bibb is rated by what the hose might reach, which is why so many programs treat any hose connection as moderate.

Who decides

The plumber, the surveyor and the designer all propose ratings, but the authority having jurisdiction decides. For devices inside the building, that is the building official enforcing the Ontario Building Code. For containment at the service, it is the municipality's water department running its backflow program. In most cases they agree, but where they differ, the stricter requirement applies, because a device that satisfies both is the only one that will pass both inspections.

When a rating is uncertain, Raj's rule was to rate it higher and document why. The cost of a better device is small compared with the cost of contaminated water, and an inspector is far more likely to accept a conservative choice than to approve one that leaves doubt. Maya wrote that rule at the top of her notes.

Ratings are also a matter of record. When Maya rated a connection, she wrote the reason next to it in one sentence, such as "boiler treated with corrosion inhibitor, toxic" or "dish machine, detergent and food soil". If the building later changed, or an inspector questioned the rating, the reason showed exactly what had been assumed. A rating without a reason is hard to defend and easy to get wrong the next time the building is surveyed, because the next surveyor cannot tell whether the original rating was a judgment or a mistake.