UL 1998 2022-11 PDF

Full title and description

UL 1998 — Standard for Software in Programmable Components. Requirements and guidance for the development, verification, validation, change control, documentation and maintenance of embedded (non‑networked) software that resides in programmable components and performs safety‑related functions where software failure could create risk of fire, electric shock, or injury to persons.

Abstract

UL 1998 establishes a reference framework of engineering and management practices to reduce hazards introduced by application‑specific software in programmable components used in safety‑related product functions. It defines a software safety life cycle, risk analysis and allocation, requirements conversion, design and coding practices, verification and validation activities, configuration and change control, and the required content of a product safety file. The standard is intended to be applied alongside product or component safety standards and explicitly does not address network‑based cybersecurity (which is covered by separate UL cybersecurity standards).

General information

• Status: Active (ANSI‑approved; last revision/redline issued November 16, 2022)
• Publication date: Edition 3 published December 18, 2013; last revised November 16, 2022.
• Publisher: Underwriters Laboratories (UL) — UL Standards & Engagement.
• ICS / categories: 13.110 (Safety of machinery) — software safety / functional safety reference standard.
• Edition / version: Edition 3 (2013); Revision / redline 2022‑11 (November 16, 2022).
• Number of pages: Approximately 40–50 pages (commonly published as a 43‑page document in available distributions).

Scope

The standard applies to application‑specific, non‑networked embedded software residing in programmable components that perform safety‑related functions whose failure could result in fire, electric shock or personal injury. UL 1998 is a reference standard intended to be invoked by product or component standards; it supplements hardware safety requirements by addressing risks unique to software and software development processes (requirements conversion, design, coding, timing faults, memory faults, induced hardware faults, latent faults, and maintenance/change management).

Key topics and requirements

• Software safety life cycle and development process requirements (planning, requirements, design, implementation).
• Risk analysis and allocation of software safety requirements from product hazard analysis.
• Requirements conversion, traceability and mitigation of software design faults.
• Coding practices and control of coding errors; handling of timing and memory faults.
• Verification, validation and testing (unit, integration, and system level; fault injection where applicable).
• Configuration management, version control, and documentation of changes.
• Change control and management of modifications, including classification of changes and regression testing.
• Maintenance of a safety file / technical documentation supporting certification and product safety claims.
• Statement that network cybersecurity is out of scope and is addressed by standards such as UL 2900 (cybersecurity) and UL 5500 (remote software updates) when applicable.

Typical use and users

Used by product manufacturers, design and software engineers, compliance and safety managers, testing laboratories and certification bodies when embedded software in programmable components contributes to safety‑related functions. Common product areas include household appliances, industrial controls, medical devices (where referenced), energy systems (inverters, battery systems, EVSE), and any electromechanical product where software failure could create a hazard. The standard also guides technical reviewers and auditors assessing software evidence during conformity assessment.

Related standards

Standards commonly used alongside or referenced by UL 1998 include: UL 991 (safety tests for safety‑related controls), IEC 61508 (functional safety of E/E/PE systems), IEC/UL 60730‑1 Annex H (automatic electrical controls), UL 2900 (software cybersecurity for network‑connectable products), UL 5500 (remote software updates), IEC 62304 (medical device software) and various product‑specific UL and IEC standards that invoke UL 1998 as a software reference.

Keywords

software safety; programmable component; embedded software; functional safety; risk analysis; verification and validation; configuration management; change control; safety file; UL 1998; software standard; revision November 16, 2022.

FAQ

Q: What is this standard?

A: UL 1998 is a UL reference standard titled "Standard for Software in Programmable Components" that sets requirements for the safe development, verification, documentation and maintenance of embedded, non‑networked software in programmable components used for safety‑related functions.

Q: What does it cover?

A: It covers the software safety life cycle, risk analysis, requirements conversion, design and coding practices, verification and validation, configuration and change control, and the technical documentation (safety file) needed to demonstrate that software‑related hazards have been addressed. It does not cover network cybersecurity.

Q: Who typically uses it?

A: Product manufacturers, software and firmware engineers, safety and compliance teams, test houses and certification bodies use UL 1998 when software in a programmable component could cause harm if it fails. It is applied across consumer, industrial, medical and energy sectors where referenced by product standards.

Q: Is it current or superseded?

A: The active edition is Edition 3 (published December 18, 2013). The standard received a revision/redline on November 16, 2022 (ANSI approval noted November 16, 2022). Check UL Standards & Engagement or the publisher for the absolute latest status and any subsequent revisions after November 16, 2022.

Q: Is it part of a series?

A: UL 1998 is a standalone reference standard for software safety but is often used together with other UL and IEC standards addressing device‑level functional safety, hardware requirements and cybersecurity (for example UL 991, IEC 61508, IEC/UL 60730‑1 Annex H, UL 2900 and UL 5500).

Q: What are the key keywords?

A: Software safety, programmable components, embedded firmware, verification and validation, safety life cycle, risk analysis, change control, safety file, UL 1998, edition 3, revision 2022‑11.