Past problems with hydraulic elevators include underground electrolytic destruction of the cylinder and bulkhead, pipe failures, and control failures. Single bulkhead cylinders, typically built prior to a 1972 ASME A17.1 Elevator Safety Code change requiring a second dished bulkhead, were subject to possible catastrophic failure. The code previously permitted only single-bottom hydraulic cylinders. In the event of a cylinder breach, the fluid loss results in uncontrolled down movement of the elevator. This creates two significant hazards: being subject to an impact at the bottom when the elevator stops suddenly and being in the entrance for a potential shear if the rider is partly in the elevator. Because it is impossible to verify the system at all times, the code requires periodic testing of the pressure capability. Another solution to protect against a cylinder blowout is to install a plunger gripping device. One commercially available is known by the marketing name "LifeJacket". This is a device which, in the event of an uncontrolled downward acceleration, nondestructively grips the plunger and stops the car. A device known as an overspeed or rupture valve is attached to the hydraulic inlet/outlet of the cylinder and is adjusted for a maximum flow rate. If a pipe or hose were to break (rupture), the flow rate of the rupture valve will surpass a set limit and mechanically stop the outlet flow of hydraulic fluid, thus stopping the plunger and the car in the down direction.
What Elevator Safety Code change required a second dished bulkhead? 
1972 ASME A17.1