flowchart TD
H[Identify hazard] --> R{Risk graph<br/>S / F / P}
R --> PLR[Required PL a-e]
PLR --> D[Design: category, reliability,<br/>diagnostics, CCF]
D --> V[Validate against 1502/13849-2]
V --> Y{Achieved PL >= required?}
Y -- no --> D
Y -- yes --> DOC[Document the file]
Machine Safety for Software Engineers: What AS 4024 Actually Requires
A standards series that is not law, two incompatible design methodologies shipping side by side, and a safety-distance formula you will actually have to calculate.
If you write software that moves something physical, at some point somebody asks whether the machine is safe, and means something specific and legal by it. This is the shape of that answer in Australia.
AS/NZS 4024 is the Australian and New Zealand Safety of machinery series: not one document but a family of 26 parts, each an adoption, usually modified, of an ISO or EN standard. If you already know ISO 13849, ISO 12100 and IEC 60204-1, this is the same content under local numbering.
It is not law, and that is the interesting part
Standards Australia is not a regulator. Standards are voluntary. They become effectively mandatory only when legislation references them, and AS 4024 is largely not called up directly in the WHS Regulations.
What actually binds a machine builder in Queensland:
| Instrument | What it does |
|---|---|
| WHS Act 2011 (Qld) ss. 22-26 | Upstream duties on designers, manufacturers, importers, suppliers and installers of plant. This is the clause that catches you as a builder or integrator |
| WHS Regulation 2011 (Qld) Ch. 5 Pt 3 | Plant: guarding, emergency stops, controls, isolation, maintenance |
| Code of Practice: Managing the risks of plant | Admissible in proceedings as evidence of what was known and reasonably practicable |
So the relationship is this: AS 4024 is how you demonstrate you met the “reasonably practicable” test. Conform to it and you have a defensible position. Ignore it and the prosecution’s expert cites it against you. That is the whole of it.
Jurisdiction matters if you sell interstate: Victoria is still under the OHS Act 2004 rather than the model WHS laws, and WA harmonised only in 2022. The duty applies in each jurisdiction of supply, not just where you built the thing.
The trap: two methodologies in the same series
This is the part that catches people, because both are current documents with current numbers and they encode incompatible ways of designing a safety function.
| Part | Approach | Status |
|---|---|---|
| 1501/1502 (2006, reconfirmed 2014) | The old EN 954-1 method. Purely architectural: pick Category B, 1, 2, 3 or 4 from a risk graph. No reliability data, no probability | Withdrawn internationally in 2011 |
| 1503:2014 | ISO 13849-1:2006. Performance Level PLa-PLe, combining architecture plus component reliability and diagnostic coverage | What you should use |
Category-only design was dropped internationally for a concrete reason: it lets you build a Category 3 circuit out of unreliable components and call it safe, because the method never asks how often the parts fail.
Practical tell: if a supplier quotes you “Category 3” with no Performance Level attached, they are working from a twenty-year-old mental model. Push back before it is designed in.
How Performance Levels actually work
Step 1: determine the required PL for each safety function, from a risk graph with three inputs.
| Input | Options |
|---|---|
| S severity | S1 slight and reversible, S2 serious, irreversible or fatal |
| F frequency and duration of exposure | F1 seldom, F2 frequent or continuous |
| P possibility of avoidance | P1 possible under specific conditions, P2 scarcely possible |
S2 + F2 + P2 lands on PLe. A guarded pinch point with occasional access is typically PLd. Clearing a jam on a hydraulic press is PLe every time, because all three inputs are at their worst.
Step 2: design to hit it. PL is a function of the architecture (Category B through 4), the component reliability, the diagnostic coverage, and the resistance to common-cause failure. It is not a label you assert; it is an outcome you calculate and then validate.
Note the direction of the work: the required PL comes from the hazard, before you have chosen any components. Choosing a relay and then reverse-engineering a justification is the wrong order and reads as such in an incident investigation.
The calculation you will actually do
Most of the series is read once. The safety-distance parts get used repeatedly, because the question “how far away does the guard have to be” comes up on every job.
- 1801:2014 (from ISO 13857): safety distances to prevent upper and lower limbs reaching hazard zones.
- 1803:2019 (from ISO 13854): minimum gaps to avoid crushing parts of the body.
The logic is that a guard is only as good as the time it buys. If the machine takes 200 ms to stop and a hand moves at 1.6 m/s, the guard has to sit far enough back that the hand cannot arrive before the motion ends. Reach-through, reach-over and reach-around are separate cases with separate tables.
This is the part software people underestimate, because it is the part where the answer is a number in millimetres rather than an architecture.
The series, roughly grouped
| Range | Subject |
|---|---|
| 1100, 1201, 1303 | Application guide, general design principles, risk assessment (ISO 12100, ISO/TR 14121-2) |
| 1204 | Electrical equipment of machines (IEC 60204-1) |
| 1501/1502/1503 | Safety-related parts of control systems: the old categories, validation, and the modern PL method |
| 1601-1604 | Guards, interlocking devices, prevention of unexpected start-up, emergency stop |
| 1701-1704, 1801, 1803 | Human body measurements, access openings, safety distances, crush gaps |
| 1901-1907 | Displays, controls, actuators, markings, auditory and visual warnings |
| 3xxx | Machine-specific: presses, milling and boring, conveyors |
What catches control engineers
- Designing to a Category instead of a PL. Covered above; it is the big one.
- Treating the e-stop as the safety function. An emergency stop is a complementary protective measure, not a substitute for guarding. It requires someone to already be reacting.
- Forgetting unexpected start-up. 1603 exists because the hazard is often not the running machine but the one that restarts while somebody is inside it.
- Skipping validation. The design half (1503) and the validation half (1502 / ISO 13849-2) are separate documents for a reason. An unvalidated calculated PL is a claim, not a result.
Takeaway
The mental shift for a software engineer is that “safe” here is not a property you argue for after the fact. It is a required Performance Level derived from the hazard, a design that demonstrably achieves it, and a validation file that says so.
Start at 1100 for the map and 1201 for risk assessment, use 1503 and never 1501, and expect to spend real time in 1801. Full notes, including the series table and the jurisdiction detail, are in Hardware Tools, alongside the PLC and SCADA material this sits next to.
Warning
These are engineering notes, not legal advice, and the legislation differs by state. For a machine going into service, get the safety file reviewed by someone who does this professionally.