Backflow preventer testing: the devices nobody checks

“We test our backflow preventer every year, so we’re compliant.” Property managers across Greater Montreal say it, and they’re right — about one device. The one at the water service entrance. What that sentence misses is that a commercial building rarely has one: five, eight, sometimes a dozen. Backflow preventer testing at the service entrance protects the city main from your building. It does nothing to protect your building’s own drinking water from its mechanical room. The highest-hazard connections aren’t at the meter. They’re on a boiler make-up line, at the base of a cooling tower, behind a ceiling tile nobody has lifted since commissioning.

What is a backflow preventer, and who has to install one?

A backflow preventer is a mechanical assembly built around two check valves that stops water from a contaminated circuit from flowing back into the drinking water system. In Quebec, owners of institutional, commercial and industrial buildings — and residential buildings over 8 units and over 2 storeys — must install them and have them tested every year.

Two details matter more than the rule itself. First, a plain check valve is not a backflow preventer: it isn’t approved as one, it can’t be tested in place, and verifying it belongs to an entirely different program — sump pit and pump maintenance. Second, the obligation doesn’t stop at “the water entrance” — it covers every connection that presents a contamination hazard. The Safety Code requires the owner to protect each cross-connection between the drinking water system and a non-potable source, and the Régie du bâtiment exempts only residential buildings with fewer than 9 units or fewer than 3 storeys, which it treats as low risk. The technical installation requirements themselves sit in the Plumbing chapter of the Construction Code, which switched editions in early 2025.

Premises, area and zone protection are not interchangeable

CAN/CSA-B64.10 governs how devices are selected and installed; CAN/CSA-B64.10.1 governs how they are maintained and field-tested. The first one sets a hierarchy of protection levels, and that hierarchy is what most building files get wrong.

The area-versus-zone distinction is the expensive one. The CMMTQ states it plainly: area protection covers a section of piping that still has drinking water connections, while zone protection covers a section with no drinking water connection downstream. Everything past a zone device must therefore be treated as non-potable — which rules out a water cooler, a kitchenette sink or an ice machine added three years later during a tenant fit-up.

The levels also stack. Zone protection doesn’t excuse individual devices downstream, and individual devices don’t excuse the zone device.

Why the mechanical room holds the high-hazard connections

The standard sorts cross-connections into three hazard levels, and its list of covered applications reads like an inventory of a commercial mechanical room: boilers with water treatment, heating coils, cooling towers. Wherever potable water fills a closed circuit that contains something other than water, the hazard is high — and a reduced-pressure principle assembly is the only device type accepted at that level. A double check valve assembly covers moderate hazard; it does not cover this.

Four connections show up again and again in Montreal-area buildings:

• Make-up on a treated hydronic loop. As soon as the circuit carries corrosion inhibitors or glycol, the fill line is a high-hazard connection. It’s the same logic as boiler water treatment: whatever goes into the loop must never be able to come back out of a tap.
• Cooling tower make-up. Open basin, biocides, roof dust — maximum hazard, and the feed is far too often a garden-hose connection.
• Hose bibbs in the boiler room. A hose left sitting in a pail of chemical or a blowdown basin creates a cross-connection in three seconds.
• Chemical injection. A metering pump tied into the make-up line is a non-potable source permanently connected to the drinking water system.

All four fall under routine mechanical plumbing work, and none of them appear on the service-entrance test report.

What backflow preventer testing actually measures

The annual test is not a visual inspection. The tester closes the shutoff valves, connects a differential test kit to the device’s test cocks, and measures the tightness of each check valve along with the differential relief valve where there is one. Three device families are tested this way: the pressure vacuum breaker, the double check valve assembly and the reduced-pressure principle assembly.

That tester has to be certified and listed in the provincial VDAr registry run by Réseau Environnement. Certification means a 40-hour CMMTQ course, a written exam, a hands-on exam on three of the four device types, professional liability insurance and a test kit calibrated annually; it is valid for five years. A manager can confirm that status in the online registry in about thirty seconds — a good habit before approving a test invoice.

The report goes to the owner or occupant, and the owner must keep proof of those tests on file. A complete file carries, for each device: its exact location, its type, its serial number, the measured values, the verdict, the date and the tester’s certification number.

Field case: a Saint-Laurent cooling tower and three cross-connections

Six-storey office building in the Saint-Laurent industrial sector, cooling tower on the roof, glycol chilled-water loop. The manager’s file looked clean: an annual test report on the service-entrance device, signed, dated, passing for four years straight.

A mechanical plumbing walk-through found three more connections, none of them properly protected. The tower make-up came off a hose bibb fitted with an ordinary check valve — not a backflow preventer, so no protection in the regulatory sense. The glycol loop fill was tied straight into domestic cold water through a concealed lockshield valve, with no device at all. And an existing reduced-pressure assembly, mounted above a suspended ceiling in the basement, had its relief port hard-piped to a drain with no air gap: when it discharged during the test, water backed up into the ceiling.

Three corrections, all scheduled in the same work week: a reduced-pressure assembly on the tower make-up, another on the glycol fill, and relocation of the ceiling device to a mechanical room wall at test height, over a floor drain with the required air gap. The total came in well under the cost of a non-compliance notice — and, more usefully, the three new devices were folded into the preventive maintenance calendar on the same test date as the entrance device, so one annual visit now covers the whole building.

What the owner is actually exposed to

The regulatory penalty is real: failing to meet the obligation exposes an owner to penal prosecution. It isn’t the expensive outcome, though. A building owner is also held liable for the consequences of contaminating the drinking water system, decontamination costs included — and contamination doesn’t stop at the property line. Glycol or biocide pushed back into a municipal main means a boil-water advisory, a shut-down sector, and an investigation whose first request will be the test records.

It is also what an insurer looks at afterward. A complete annual file, device by device, changes the nature of that conversation: it turns an incident into a documented failure rather than negligence.

The inventory to run before your next maintenance visit

One task, and it doesn’t need a technician: open your most recent test report and count the devices listed on it. If there’s only one, your building is probably not compliant — not because the entrance device is bad, but because the others were never written down anywhere.

Then have a full inventory taken at the next maintenance visit: every connection between drinking water and a closed loop, a tower, a basin or a metering pump, with its device type and condition. That’s a half-day of work in a mid-size building, and it isn’t repeated every year — once the inventory exists, the annual test becomes just another calendar line. Fall is the right window: cooling circuits are coming out of season, winter make-up hasn’t started, and corrections can ride along with work already budgeted.