| Re: [threadx] Proposal: ThreadX Safety Certification Sustainability Model and Branding Program |
Frédéric DESBIENS
Program Manager and Evangelist — Embedded, IoT, and Edge Computing | Eclipse Foundation
Mastodon: @fdesbiens@xxxxxxxxxxxxxxxxxxxxx
Eclipse Foundation: The Community for Open Innovation and Collaboration
_______________________________________________-----Dear Mike and Experts member.
Questions about the following content.
This is about the perpetual licence for safety deliverables.
It states that there is no limit to the number of products.
The following text ” There are no restrictions on the number of products that a licensee can use the safety artifacts for.”
There is no restrictions on the type of products, right?
Best regards
Tamaki Kouno
From: threadx <threadx-bounces@xxxxxxxxxxx> On Behalf Of Mike Milinkovich via threadx
Sent: Monday, January 15, 2024 9:05 PM
To: ThreadX community discussions <threadx@xxxxxxxxxxx>
Cc: Mike Milinkovich <mike.milinkovich@xxxxxxxxxxxxxxxxxxxxxx>
Subject: [threadx] Proposal: ThreadX Safety Certification Sustainability Model and Branding Program
CAUTION: This email originated from outside of the organization. Do not click links or open attachments unless you recognize the sender and know the content is safe.
All,
This email provides a strawman proposal on how we will maintain and license the ThreadX safety artifacts. A discussion on this will be on the agenda of our next meeting. Comments are also welcome on this list.
Current
Situation
- ThreadX has multiple
- current safety and security certifications in place.
- These certifications
- have been verified by external auditing authorities such as SGS-TüV Saar and UL.
- The certificates
- for these certifications are publicly available.
- The documentation
- required to enable a downstream adopter of ThreadX to support the safety certification of their own product is currently Microsoft proprietary. Access to the safety artifacts is done under a commercial arrangement and associated fee between Microsoft and the
- licensee. For this fee, the licensee is provided a perpetual license to all of the safety artifacts produced in a 12 month period. There are no restrictions on the number of products that a licensee can use the safety artifacts for. The provided artifacts
- include the certificate, the safety manuals, and the lab results.
- ThreadX is being
- moved to open source at the Eclipse Foundation under the MIT license. This code contribution includes extensive suites of tests for each component of ThreadX.
- Ownership of the
- copyright for the ThreadX safety artifacts will be assigned by Microsoft to the Eclipse Foundation AISBL.
- Maintaining these
- safety certifications will require funding to maintain, so it is critical that the Eclipse Foundation designs programs to ensure that there is sustainable funding to support them.
Maintaining
the Safety Artifacts
The
safety manuals will be publicly maintained via an Eclipse Foundation project, but the Project License will be CC-BY-NC-SA ("Attribution-NonCommercial-ShareAlike"). Note that because this license is non-commercial, it is not an open source license. Releases
of the safety manuals will be re-licensed under terms that permit working group members to use them to certify their products.
The
safety manuals will be maintained as copyright Eclipse Foundation AISBL. To allow for the copyright of contributions to the safety artifacts by members to be held by Eclipse Foundation, the ThreadX Working Group Participation Agreement will add a non-standard
section which adds an exclusive contributor copyright license directly from the Participant to the Eclipse Foundation for any contributions made to the safety artifacts. This will permit the Eclipse Foundation to retain sole ownership of the copyrights in
these documents, and will also permit the Eclipse Foundation the ability to enforce its copyright against any infringing third parties.
Access
to the Safety Artifacts
Participant
Members of ThreadX may license the safety artifacts for use in certifying their own products. Strategic Members of ThreadX may license the safety artifacts for use in certifying their own products and in addition may also sublicense the safety artifacts to
customers of their hardware devices. The license to the safety artifacts will be a formal and separate commercial license between the Eclipse Foundation and each member of the working group who wishes to use the ThreadX safety artifacts in support of certifying
their products.
Additional
Branding Program
Eclipse
is also proposing to explore developing a branding program, where the rights of members to use the ThreadX brand would be based on passing established verification tests. To achieve this, the extensive verification tests that already exist for ThreadX could
be utilized, at least as a starting point. As one example, the ThreadX Safety Manual Section 6.4 states that “Possible
anomalies are either found internally by running the test suite comprised of 107 pseudo applications that effectively perform functional ‘black box’ testing over the entire ThreadX RTOS….”
In
general, branding programs have proven valuable for Eclipse members, and to drive participation in, and value of Eclipse initiatives. As a point of reference, Eclipse has established a similar branding program based on quality verification with its Adoptium
working group.
Note
that this branding program is completely orthogonal to the topic of safety.
Any claims of safety certification by a device manufacturer would be completely separate from access to or usage of the Quality Verification Suite (“QVS”). This branding program is based on defining a quality criteria for use of the ThreadX trademark and the
licensing of that trademark. It is specifically not related to safety.
In
such a scenario, the branding program would involve the following. There are many assumptions that need to be validated here!
- For each release
- of ThreadX, a quality verification suite (“QVS”) will be made available for each component (ThreadX, FileX, USBX, …). This test suite will be made available under the
- Eclipse
- Foundation Quality Verification Suite License.
- Note that this alone
- may require additional thought and consideration as the EFQVSL is a binary
- license. It
- is certainly likely that each downstream adopter of ThreadX will be required to compile the test suite from source code themselves in order to run it on the device under test. Not sure how to deal with this….
- Note that the EFQVSL
- requires self-testing and self-reporting by adopters. Need to verify that this is acceptable in the embedded ecosystem.
- As per the EFQVSL,
- any party that fully passes all of the tests in the QVS can make good faith claims that they meet the quality requirements. But also as per the license they are not granted a license to use any Eclipse Foundation trademarks. But nominative fair use would imply
- that adopters could say things like “we fully passed the QVS”.
- Note that we may
- want to name the QVS something other than “ThreadX”.
- Note that many adopters
- use a mix of the ThreadX components. (E.g. a device could use ThreadX and FileX, but not GUIX or USBX.) We would have to allow for use of just the tests applicable to the device under test.
- Similar to Jakarta
- EE and Sparkplug we will develop a logo and trademark for ThreadX that Member companies could put on their products which pass the QVS. Use of the logo would require each such company to be a member of the ThreadX working group and to have executed a trademark
- license agreement with the Eclipse Foundation.
--
Mike Milinkovich
Executive Director Eclipse Foundation AISBL
CONFIDENTIAL: This e-mail may contain information that is confidential or otherwise protected from disclosure and intended only for the party to whom it is addressed. If you are not the intended recipient, please notify the sender by return and delete this e-mail. You are hereby formally advised that any unauthorized use, disclosure or copying of this email is strictly prohibited and may be unlawful.
threadx mailing list
threadx@xxxxxxxxxxx
To unsubscribe from this list, visit https://accounts.eclipse.org