Writing a FLOSS checker for MISRA-C

[pkrebs]

Good morning,

I'm (once more) thinking of implementing a static analysis tool for checking C sources against the MISRA-C:200 rules and release it as FLOSS (e. g. under GPL or a similar permissive license). However, I would need some questions answered before I can meaningfully undertake this task - I figure, that this is the best place to ask. What I would like to know is:

- Are there any legal restrictions when implementing a static analyser that claims to check the MISRA rules, i. e. is it even allowed to advertise this as a feature?
- Is it allowed to release such an analyser under a FLOSS license? The only problem I can think of is, that it is in principle possible to "reverse engineer" the rules out of the tool's source code, which could be seen as distributing the guidelines "for free".
- If a FLOSS release is permitted, are there any legal obligations to inform the MISRA Consortium of the release and subsequent additions to the tool (e. g. implementation of further MISRA rules)?

If someone can think of additional problems considering MISRA and FLOSS, don't hesitate to mention them (I am by no means a FLOSS license expert, those are just the problems I can immediately see).

Many thanks in advance for all pointers and answers.

Best Regards,

Peter

[MISRA Reply]

In general MISRA welcomes tool support for its rule sets, whether these are released under commercial terms or an "open source" arrangement. In either case the tool developer is required to enter into a license agreement to permit the use of the MISRA name (which is a registered trademark) and where appropriate the rule texts (which are copyrighted).

Also it is MISRA's policy not to endorse any particular tool.

MISRA's license policies exist primarily to preserve the integrity of the rule texts which are the result of many person-years of effort by a number of very dedicated volunteers and we want to discourage variations that could cause confusion. This is the main motivation behind our licensing policies, so that end-users have a clear baseline to work with.

In this respect attempts to avoid licensing the rules through creating a paraphrase of the texts are also discouraged since much effort has been expended by members of the MISRA activities in creating clear and unambiguous statements of the rules.

In the case of an open-source tool, therefore, we would not permit the rule texts to be included if the entire tool were released under the GPL or similar arrangement. It would be acceptable for an open-source tool to include the rule texts if the MISRA checker part of the tool were released as an additional module under a commercial license agreement that contained the expected restrictions on reverse engineering or extracting of information from the software.

For a tool which is released on an entirely open-source basis, the practical solution is that diagnostic messages from the tool can only cite the MISRA rule number and not the rule text.