AECO Certification as Applied to a Wind-Turbine Tower Elevator

A real-world example of the process, methodology and ASME A17.7/CSA B44.7: Performance-Based Safety Code for Elevators and Escalators’ ability to ensure superior safety

Much has been written about ASME A17.7/CSA B44.7: Performance-Based Safety Code for Elevators and Escalators, but little written about its practical use with real-world examples of the process, methodology and its ability to ensure practical superior or equivalent safety. This article will first remind the reader of the intent of a performance-based code (PBC), then detail the methodology used during the certification process for an Avanti Wind Systems wind-turbine tower elevator (WTE) using examples from the process (ELEVATOR WORLD, April and May 2012). Finally, Avanti, an Accredited Elevator/Escalator Certification Organization (AECO), and risk-assessment methods bring new technologies into the market that ensure superior or equivalent safety to A17.1/B44 will be examined.

Learning Objectives

After reading this article, you should have learned:
♦ What GESRs are
♦ The replacement criteria for wind-tower elevator hoist ropes
♦ How the A17.7 performance-based code was used to evaluate a WTE suspension system
♦ How the risk analysis process is implemented by an AECO
♦ Which organizations are AECOs in North America
♦ How the required A17.7 documentation is developed by an AECO for equipment not in compliance with the prescriptive requirements in the A17.1 code

It is first important to understand that the AECO process certifies a design similar to a listing organization certifying elevator hoistway entrances after a UL10B heat and fire endurance test. The process could be used in house to assist in designing a product or to modify a design, but the AECO process does not merely take a design and find a way to make it appear to comply. It has proven to be true to the concept of safety, the AECO’s motivation is to ensure that the design meets the safety objectives detailed in A17.7/B44.7.

The certification process begins with a manufacturer identifying the product deviations from the latest relevant code in force, which defines the subject of the review. The subject could be any one or several systems, subsystems, components or functions of the elevator. The process is implicitly for new technology as opposed to requesting a variance for a particular installation.

The next step is to select the relevant Global Essential Safety Requirements (GESRs) applicable to the subject deviations. Part 3 of A17.7/B44.7 defines the GESRs: “Global” because they have been harmonized in the global elevator community, balloted, agreed upon, and finally published, and “Essential” because they represent the safety functions that must be achieved. The global harmonization effort has been ongoing for more than a decade, culminating in the development and publication of ISO 22559-1 by the International Organization for Standardization (ISO) Technical Committee 178. Coordinated efforts by the ASME A17 International Standards Committee resulted in GESRs’ harmonization with A17.7/ B44.7. This was a milestone in global safety, as for once, the world-wide elevator industry established the framework to ensure that elevators around the world will have a minimum standard for design, manufacture, inspection and maintenance.

Risks are nearly the same around the world; the differences in the prescriptive solutions that various regional standards employ are based on local experience and the societal level of risk aversion. Prescriptive codes and standards detail specific materials that have characteristics to ensure the essential safety elements are achieved. Performance codes describe the safety to be achieved and require proof of a material’s ability to ensure an equivalent safety outcome. Prescriptive requirements define the parameters of safety by mandating forces, masses, elongations, resistances, factors of safety, heights, etc. These are the safety parameters (SPs) when considering equivalency of a performance-based solution.

The SPs, specified in A17.7/B44.7 Nonmandatory Appendix B, are prescriptive-code parameters sorted by GESRs.

In Avanti’s WTE design, each of the system’s deviations were identified and evaluated relative to the relevant SPs. For example, the commonly used traction climbing driving machine in a WTE is required to conform to A17.1/B44, Requirement 2.24: safety factor for the sheave shaft. However, the elevator manufacturer did not know if the motor drive shaft conformed to the minimum factor of safety, and the supplier had never been asked.

If the elevator company manufactures the component, it is simply a review of the design and proof documentation to determine conformance. Some proofs may require witnessed in-house engineering testing or testing at an approved laboratory. Avanti performed two such witnessed in-house tests to prove its landing-enclosure design and driving-machine shaft. Other B44.1/A17.5 and EN 12016 tests were performed at testing laboratories, which were required to be done because A17.7/B44.7 cannot be used to deviate from these requirements or consider other risk mitigations for controllers. A17.7/B44.7 can only be used to evaluate equivalency to A17.1/B44 requirements — no other codes or standards.

With the list of deviated items, the WTE manufacturer had to choose either to change the product to conform to code or design the necessary risk mitigations into the product. Ultimately, the manufacturer compared the costs to comply with code or all the reasons for using the new technology, considering application, production costs, tooling, use of raw materials, personnel training, machining, purchasing, delivery and any retrofit costs an AHJ may impose. Many of the changes were easy to make, others were very complicated and expensive to implement. Using a single suspension rope in WTEs was one of those complicated issues.

One SP for the suspension system is the requirement for a minimum of two ropes. Many people have asked (and many more in the future will ask) why that SP is being violated on a WTE. To understand these types of issues, it is critical to understand the concept of GESRs. The suspension system must not fail, but if it does, the car must remain suspended. If another equally safe means is found that meets this criteria and that means is tested, reviewed and proven, the essential elements of safety are achieved.

The considerations for the single suspension means were as follows. Many SPs for suspension systems are included in A17.1/B44, Requirement 2.19. These requirements specify the exact characteristics of the suspension members and their fastenings, and many other parameters are included by reference. For instance, the requirement that the ropes be made of steel prescribes all the characteristics of steel such as resistance to heat, minimum breaking strength, etc. The requirement does not list all inherent characteristics of steel wire ropes, however when evaluating the use of an alternative suspension means these additional characteristics must also be considered. Therefore, when reviewing the A17.7/B44.7 SPs, the equipment designers and reviewers must also consider all of the inherent characteristics of the alternative design materials, in addition to the specified parameters when assessing alternative materials.

Further considerations that factor into the AECO evaluation of suspension means include their use, replacement criteria, whether or not they will be monitored and the environment in which they will be used. Also considered are the ropes’ degradation rates, their initial and final safety factors, the loading and bending that they will experience and which can lead to their failure, their anticipated degree of crown wear due to abrasion and the ability for the ropes to be inspected. Components can be over or under engineered, therefore having a third party evaluate the design ensures that all of the relevant design criteria have been met and verified.

The evaluation process is known as the risk assessment. When considering the case of the use of a single suspension rope on a WTE, it was noted that the SPs require a minimum of two ropes. However the allowance of one rope was based on the analysis of the risk mitigations in conjunction with the actual stress that the rope will experience during its lifecycle. One large diameter rope of sufficient size would never part in a design where there is minimal rope bending or minimal operating cycles. Consider the Golden Gate Bridge and its suspension ropes. These are never replaced, because they never bend. If an 8-mm-diameter steel wire rope is bent over a sheave only 10,000 times and the loads that it supports are limited to one-tenth of the ropes rated strength, it is not likely to fail or experience crown wear. However the same rope being bent one million times would be a different matter. Such a situation would clearly cause significant rope wear and fatigue.

Additionally a steel wire rope 1 mm in diameter would be inadequate as a suspension means, because it would part if almost any load were to be applied to it. Finding the proper balance between these two extremes of maximum and minimum possible rope size is the designer’s goal. The evaluation of the code’s essential safety requirements requires that the rope be large and robust enough so as to never part, given its proper use as well as its potential abuse.

In the case of WTEs, one properly selected suspension rope can meet the required GESRs with the implementation of risk mitigations, including the use of a steel wire rope of a minimum size with a minimum safety factor and mandatory replacement criteria based on the number of the elevator’s cycles or actual time in service. WTE ropes are replaced prior to 5,000 cycles, which based on their actual usage is less than 20 years of expected service. By contrast, most commercial electric elevators perform 2,500 cycles in a month. The rate of rope bending in WTEs ensures the ropes will not part before they must be replaced. But to be even more conservative (because there is no way to limit the number of WTE cycles), the risk mitigations further include requirements for mandatory rope replacement after only five years of service. The single rope was certified as an acceptable design for WTEs by the AECO following verifiable measurements of operating cycles and service time, the results of rope design testing, the inclusion of an additional safety rope in the WTE system, the history of WTE design and use in the marketplace and requirements for periodic visual rope inspection.

The final WTE risk mitigations exceed current requirements for the use of steel wire ropes in several additional areas. Currently steel wire ropes are required to be replaced after they contain an excessive number of wire breaks, are damaged or if they have experienced excessive diameter reductions. In WTEs, the ropes must be replaced after 250 hr. of use or after five years of operation, whichever comes first. This is significant risk mitigation and provides superior or equivalent safety to that which is required by the current code (the essence of the requirement for a minimum of two hoist ropes). In addition, WTEs are provided with a safety system comprised of a steel wire rope and a rope-gripping safety that will stop the car if it exceeds its rated speed or if suspension is lost. This safety rope is not in tension and the only time it experiences stress is when the safety applies. Additionally, the safety rope must be replaced every five years when the suspension rope is replaced.

These risk mitigations were also codified in A17.1/B44, Requirement 5.11 for WTEs, which has been approved for publication in the 2013 edition of A17.1/B44 Code. In addition to the system’s AECO certification, the single-rope solution, with the same risk mitigations underwent industry review, as well, and while comments to the initial proposal questioned its allowance, once the risk mitigations were included in the proposed code, the concerns were satisfactorily resolved.

The risk-assessment process is how risk mitigations are developed for a proposed design or, for that matter, any alternative action we may engage in. As an analogy let’s consider something we all routinely do when we are driving a car. When driving on a bright and sunny day on the highway, the risks of an accident are minimal. Therefore the speed at which one drives is relative only to the risk of getting a speeding ticket, more than the risk of crashing. However, if it begins to rain, a driver will ordinarily think of oils on the road surface and drive slower based on the changing weather condition. Slowing down is a risk mitigation, and this is done almost unconsciously. Then, if it begins to pour, creating a new condition that now affects the driver’s visibility, the driver would slow down even more, until a comfort level of potential risk is achieved, based on an estimate of how quickly the vehicle could be stopped if necessary. And then, if it began to snow, the prudent driver would likely slow down even further, illustrating additional risk mitigation in response to the continually changing weather conditions. Ultimately the driver might stop the vehicle and sit out the weather as the road ices up.

In the previous example, each environmental change would demand the implementation of additional risk mitigations by the driver and each additional risk-mitigation would further reduce the risk of crashing. Such risk mitigations are made almost unconsciously, even though the speed limit remains the same. If asked, the driver could write his/her thinking down, citing the hazards encountered and the anticipated potential of crashing at various speeds during the various weather conditions as well as the severity of a potential accident if it had occurred. At each step during this event, a series of risk mitigations were made until the final decision to get out of the weather eliminated all potential risks.

The risk analysis process that is performed by an AECO is conducted with documentation in a similar manner as in the previous example. As independent agencies, AECOs evaluate the risk mitigations, and their final judgment is the final word. A risk assessment team must be used. If a 21-year-old person, an experienced head of finance for an elevator company and I were to develop a risk assessment for an elevator system, there would be differences amongst each of our assessments. One due to lack of experience, another weighted toward financial considerations and the third due to my experience with the installation, maintenance and design of elevator equipment. That is why the A17.7/B44.7 requires a team of elevator experts with experience in various aspects of elevator systems to be used to judge the risk mitigations being evaluated. This diversity of the team members provides a balanced assessment that weighs all considerations. As the final arbiter and issuer of the certificate, the AECO will continue to require appropriate risk mitigations when in their opinion the ones offered do not suffice. Companies cannot coerce or cajole the AECOs into certifying anything; in fact, it is the opposite. AECOs treasure their certification authority and will not act imprudently for fear of risking their reputation and ability to continue to perform their duties. An example often cited is that AECOs are like colleges; they get paid whether the student graduates or not. This is an apt and concise way to think of them.

The facilitator of the risk assessment must be very knowledgeable of the A17.1/B44 Code and the A17.7/B44.7 analysis process, and cognizant of the possibility of being influenced by peer pressure that can lead to inadequate risk mitigations. The facilitator must not be intimidated by upper-management’s demands to reduce a design’s cost. A team of engineers and elevator experts from various disciplines also form the AECO side of the assessment team.

The three AECOs in North America are Underwriters Laboratories Inc.; TÜV SÜD America, Inc.; and Liftinstituut, all of which are well-known certification organizations worldwide. These companies enjoy equal reputations. They each evaluate and certify consumer products that we all use every day. The elevator industry equipment review that these companies perform is a very small segment of their business – akin to a drop in the sea. Therefore, there is too much at risk for AECOs to compromise the A17.7/B44.7 process; it is in the AECOs’ best interest to ensure elevator equipment safety.

All the substantiating documents of the risk assessment process are collectively known as a Code Compliance Document (CCD). Once the CCD is completed and reviewed by the AECO, the AECO will issue a gap analysis document itemizing its findings. This could be commentary on the risk mitigations, a request for more or different documentation, a request to consider more risk cases, or a myriad of things. This is where the second stage of work begins. Each item in the gap analysis must be addressed and agreed to before the certificate is issued. It requires written responses and may also require product changes, further testing and/or other certifications until agreement is reached on the risk mitigations. Some tasks may reveal further gaps; it is not a one-shot list. The final certificate of compliance is only issued when all parties complete the gap analysis.

The risk mitigations are now a required list of product design changes that the manufacturer must incorporate into the final product design. Supporting product documentation, the maintenance control program (MCP), inspection procedures, etc. must be provided by the manufacturer to verify conformance to the AECO certificate requirements. In addition, product surveillance begins where the AECO will routinely and randomly visit the factories of the product manufacturers and confirm that the production is still in accordance with the CCD. It is not enough to simply tell the AECO the product will have these risk mitigations; samples or drawings must be provided as applicable. This closes one of the largest loopholes in A17.1/B44, Section 1.2, Allowances, where well-intended promises sometimes result in lack of documentation and, later, product compliance.

The AECO process is based on achieving a closed loop evaluation that is thorough, transparent and independent of financial considerations. It safely introduces new technology into the marketplace. Absent A17.7/B44.7, changing the prescriptive code and obtaining variances in various jurisdictions does not guarantee superior or equivalent safety to that which is prescribed in the A17.1/B44 Code with equal surety and requires extensive review by the consensus process. The only alternative to codification is to ask the AHJ to independently review technical information, which, in many cases, is not possible.

Being competitive in a global marketplace with ever-advancing technologies requires prudent and thoughtful review of new technologies. The A17.7/B44.7 Performance Based Code is the vehicle that will provide an assurance of safety and a reasonable, competitive marketplace.

Learning-Reinforcement Questions

Use the below learning-reinforcement questions to study for the Continuing Education Assessment Exam available online at www.elevatorbooks.com or on page 91 of this issue.
♦ What is the intent of the A17.7 performance-based code?
♦ What was the methodology used during the certification process for an Avanti WTE?
♦ What is the difference between the A17.1-2010/B44-10 code and A17.7-2007/B44.7-07 codes?
♦ What are examples of risk assessment and risk mitigation that we perform in everyday life?
♦ In which section of the ASME A17.1-2013 code will requirements for WTEs be included?