IMAGEJ ISO certification state

[gkowalsky6AtGmail]

Dear List Members,

Is there any information about where ImageJ stands in means of ISO
9001 certification? Are there any commercial entities that can provide
ISO-certified (or certifiable) support of ImageJ in industrial
settings?

Your help is greatly appreciated!
Gregory Kowalsky

[Johan Henriksson-2]

I know of no such companies. Certifying open source software is tricky
business overall; lets take ISO 9000 as an example and grab the informal
version of it off wikipedia:

   - The quality policy is a formal statement from management, closely
   linked to the business and marketing plan and to customer needs.

business and customers are a rather fuzzy entities for open source. for a
starter, neither is defined by an authority

   - The quality policy is understood and followed at all levels and by all
   employees. Each employee works towards measurable objectives.

there are no employees. anyone can contribute. and if you receive a good
patch, how can you guarantee that they have read your quality policy?

   - The business makes decisions about the quality system based on
   recorded data.

very hard to implement in a decentralized "organization"

...

   - The business determines customer requirements.

usually not the case.

(many requirements omitted)
while in theory, an organization could have some sort of ISO 9001, it would
be highly contrived and rather useless. in addition, their own version of
imagej would be open source as well, allowing anyone else to sell it.

an even harder challenge is security certifications. these are needed for
e.g. cryptography. I recently heard a talk where such a certification cost
100k euro which is pretty hard to bare for a small consulting company...

out of curiosity: why do you want ISO 9001?

/Johan



On Wed, Feb 29, 2012 at 7:30 PM, gkowalsky6AtGmail <[hidden email]>wrote:

> Dear List Members,
>
> Is there any information about where ImageJ stands in means of ISO
> 9001 certification? Are there any commercial entities that can provide
> ISO-certified (or certifiable) support of ImageJ in industrial
> settings?
>
> Your help is greatly appreciated!
> Gregory Kowalsky
>

--
-----------------------------------------------------------
Johan Henriksson
PhD student, Karolinska Institutet
http://mahogny.areta.org  http://www.endrov.net

[David Eccles (gringer)]

On Wed, 29 Feb 2012 12:30:39 -0600, Gregory Kowalsky wrote:
> Is there any information about where ImageJ stands in means of ISO
> 9001 certification? Are there any commercial entities that can provide
> ISO-certified (or certifiable) support of ImageJ in industrial
> settings?

Here is the ImageJ license / disclaimer:

http://rsb.info.nih.gov/ij/disclaimer.html

I might as well copy it out in full, because it's quite short:

-- <START> --
ImageJ is being developed at the National Institutes of Health by an employee of the Federal
Government in the course of his official duties. Pursuant to Title 17, Section 105 of the United
States Code, this software is not subject to copyright protection and is in the public domain.
ImageJ is an experimental system. NIH assumes no responsibility whatsoever for its use by other
parties, and makes no guarantees, expressed or implied, about its quality, reliability, or any other
characteristic.
-- <END> --

Note "no guarantees... about its quality, reliability, or any other characteristic." The source code
from public releases can be found here:

http://rsbweb.nih.gov/ij/download/src/

and revision history / release notes here:

http://rsbweb.nih.gov/ij/notes.html
http://rsbweb.nih.gov/ij/docs/all-notes.html

There is also a mailing list (this one) for bugs, issues, and advice, with archives:

https://list.nih.gov/cgi-bin/wa.exe?A0=IMAGEJ

These are all essentially voluntary services, and may disappear tomorrow. However, it is a common
social convention for FOSS developers to provide at least source code and a method for contacting
developers to report issues.

Why do you ask the question about certification?

I have limited understanding about ISO 9001, but was under the impression that ISO 9001 was a
per-business thing, and I can't quite see how ISO 9001 certified ImageJ support would be useful
except as a "it pleases the investors" rubber stamp. Surely if your business is intending to commit
to ISO 9001, then the business itself will need to have a process in place for how problems of
quality are dealt with. It seems to go against the spirit of the certification to say, "we don't
have to worry about quality assurance for this, because someone else does that for us."

If you want to document your ImageJ use, it seems like it would be a fairly simple process to have a
short document with something like the following:

* ImageJ [http://rsbweb.nih.gov/ij/] is used for the following tasks:
  - calculating impact trajectories of Bacillis subtilis after sneezing
  - identifying 50 cent coins in images of our reception desk
* We use ImageJ version 1.46g
  - source code: http://rsbweb.nih.gov/ij/download/src/ij146g-src.zip [or better, a local copy]
  - release notes: http://rsbweb.nih.gov/ij/notes.html [or better, a local copy]
* Plugins used:
  - Slanted Edge MTF [http://rsbweb.nih.gov/ij/plugins/se-mtf/index.html], written by Carles Mitja
<email>
* Our bioinformatician, Jeff Sanders <email>, will be the first contact for day-to-day ImageJ issues
* In the event of program bugs, an email will be sent to the ImageJ mailing list or to the plugin
developer email address (depending on the suspected cause of the bug) for advice about a solution.
The communication will be recorded through the ImageJ mailing list archives
[https://list.nih.gov/cgi-bin/wa.exe?A0=IMAGEJ].

This document is current as of 1 March, 2012.
This document will be reviewed on or before 1 March 2013.

[Document location: /mnt/docserver/qc/sgreen/imagej_2012-Mar-01.odt]

I may be going into more detail than is necessary with that, but I don't know. I'm not a lawyer or
auditor, but just happened to find myself in a workplace many years ago that was both ISO 9001 and
ISO 15189 certified.

[John Minter]

David makes many great points here. It has been a while since I have needed to face auditors (my employer found the cost of certification greater than the benefit and instituted our own streamlined quality program) but the auditors responded well to such a well structured plan. I think the missing element is the specification of unit tests and known data sets. This is just as important for commercial software as well. The auditors really want to see that you are using due diligence to make certain to verify that the software you are using is producing correct results.


Best Regards,
John Minter

On Mar 1, 2012, at 4:37 AM, "David Eccles (gringer)" <[hidden email]> wrote:

> On Wed, 29 Feb 2012 12:30:39 -0600, Gregory Kowalsky wrote:
>> Is there any information about where ImageJ stands in means of ISO
>> 9001 certification? Are there any commercial entities that can provide
>> ISO-certified (or certifiable) support of ImageJ in industrial
>> settings?
>
> Here is the ImageJ license / disclaimer:
>
> http://rsb.info.nih.gov/ij/disclaimer.html
>
> I might as well copy it out in full, because it's quite short:
>
> -- <START> --
> ImageJ is being developed at the National Institutes of Health by an employee of the Federal Government in the course of his official duties. Pursuant to Title 17, Section 105 of the United States Code, this software is not subject to copyright protection and is in the public domain. ImageJ is an experimental system. NIH assumes no responsibility whatsoever for its use by other parties, and makes no guarantees, expressed or implied, about its quality, reliability, or any other characteristic.
> -- <END> --
>
> Note "no guarantees... about its quality, reliability, or any other characteristic." The source code from public releases can be found here:
>
> http://rsbweb.nih.gov/ij/download/src/
>
> and revision history / release notes here:
>
> http://rsbweb.nih.gov/ij/notes.html
> http://rsbweb.nih.gov/ij/docs/all-notes.html
>
> There is also a mailing list (this one) for bugs, issues, and advice, with archives:
>
> https://list.nih.gov/cgi-bin/wa.exe?A0=IMAGEJ
>
> These are all essentially voluntary services, and may disappear tomorrow. However, it is a common social convention for FOSS developers to provide at least source code and a method for contacting developers to report issues.
>
> Why do you ask the question about certification?
>
> I have limited understanding about ISO 9001, but was under the impression that ISO 9001 was a per-business thing, and I can't quite see how ISO 9001 certified ImageJ support would be useful except as a "it pleases the investors" rubber stamp. Surely if your business is intending to commit to ISO 9001, then the business itself will need to have a process in place for how problems of quality are dealt with. It seems to go against the spirit of the certification to say, "we don't have to worry about quality assurance for this, because someone else does that for us."
>
> If you want to document your ImageJ use, it seems like it would be a fairly simple process to have a short document with something like the following:
>
> * ImageJ [http://rsbweb.nih.gov/ij/] is used for the following tasks:
> - calculating impact trajectories of Bacillis subtilis after sneezing
> - identifying 50 cent coins in images of our reception desk
> * We use ImageJ version 1.46g
> - source code: http://rsbweb.nih.gov/ij/download/src/ij146g-src.zip [or better, a local copy]
> - release notes: http://rsbweb.nih.gov/ij/notes.html [or better, a local copy]
> * Plugins used:
> - Slanted Edge MTF [http://rsbweb.nih.gov/ij/plugins/se-mtf/index.html], written by Carles Mitja <email>
> * Our bioinformatician, Jeff Sanders <email>, will be the first contact for day-to-day ImageJ issues
> * In the event of program bugs, an email will be sent to the ImageJ mailing list or to the plugin developer email address (depending on the suspected cause of the bug) for advice about a solution. The communication will be recorded through the ImageJ mailing list archives [https://list.nih.gov/cgi-bin/wa.exe?A0=IMAGEJ].
>
> This document is current as of 1 March, 2012.
> This document will be reviewed on or before 1 March 2013.
>
> [Document location: /mnt/docserver/qc/sgreen/imagej_2012-Mar-01.odt]
>
> I may be going into more detail than is necessary with that, but I don't know. I'm not a lawyer or auditor, but just happened to find myself in a workplace many years ago that was both ISO 9001 and ISO 15189 certified.

[gkowalsky6AtGmail]

Dear Listmembers,

Than you for the replies, they do answer my question.

I was inquiring for a friend working in industrial settings, that
wanted to use ImageJ as a more flexible ( can't beat open-source) and
less expensive (can't beat free software) solution than the fully
certified software/service/support they are currently using from
particular manufacturer. Fortunately or unfortunately, but ISO
certification for QA equipment and tools is a must at his workplace.
Would be interesting, if this discussion will continue, possibly
leading to some solutions for ImageJ compliance solution.

Everybody understands that compliance is another term for "I am
following my orders", as in the army's abbreviation IGMO, but in some
cases we do not have another choice.

Best regards,
Gregory
...
David makes many great points here. It has been a while since I have
needed to face auditors (my employer found the cost of certification
greater than the benefit and instituted our own streamlined quality
program) but the auditors responded well to such a well structured
plan. I think the missing element is the specification of unit tests
and known data sets. This is just as important for commercial software
as well. The auditors really want to see that you are using due
diligence to make certain to verify that the software you are using is
producing correct results.


Best Regards,
John Minter

On Mar 1, 2012, at 4:37 AM, "David Eccles (gringer)" <[log in to unmask]> wrote:

> On Wed, 29 Feb 2012 12:30:39 -0600, Gregory Kowalsky wrote:
>> Is there any information about where ImageJ stands in means of ISO
>> 9001 certification?..
> Why do you ask the question about certification?
>
> I have limited understanding about ISO 9001, but was under the impression that ISO 9001 was a per-business thing, and I can't quite see how ISO 9001 certified ImageJ support would be useful except as a "it pleases the investors" rubber stamp...
> If you want to document your ImageJ use...
> * ImageJ [http://rsbweb.nih.gov/ij/] is used for the following tasks:
> - calculating impact trajectories of Bacillis subtilis after sneezing
> - identifying 50 cent coins in images of our reception desk
> * We use ImageJ version 1.46g
> - source code: http://rsbweb.nih.gov/ij/download/src/ij146g-src.zip [or better, a local copy]
> - release notes: http://rsbweb.nih.gov/ij/notes.html [or better, a local copy]
> * Plugins used...
> This document is current as of 1 March, 2012.
> This document will be reviewed on or before 1 March 2013.
>
> [Document location: /mnt/docserver/qc/sgreen/imagej_2012-Mar-01.odt]
>
> I may be going into more detail than is necessary with that, but I don't know. I'm not a lawyer or auditor, but just happened to find myself in a workplace many years ago that was both ISO 9001 and ISO 15189 certified.

[David Eccles (gringer)]

I'll start this off by saying that I like free and open source software, and would like to see it
everywhere, but it is not a magic bullet to deal with every problem the world has. It doesn't make
sense to me to pay for access to software (because that's an essentially unlimited resource), but it
does make sense to pay for service and support when time, learning, and failure are expensive.

On 06/03/12 06:00, Gregory wrote:
> I was inquiring for a friend working in industrial settings, that wanted to use ImageJ as a more
> flexible ( can't beat open-source) and less expensive (can't beat free software) solution than
> the fully certified software/service/support they are currently using from particular
> manufacturer.

So, they already have a system in place (and presumably documented assurance workflows) that does
the job for the company. Changing to ImageJ from this system is likely to be slow, time-consuming,
expensive, and will generate a fair amount of resistance.

 > more flexible (can't beat open-source)

If the software services provided by the current contractor are good, then the contractor should be
able to modify their program to accommodate new requirements. Just tell the company, "hey, ImageJ
can do *this*, here's the source code, could you please add something to your software that provides
a similar function?" If there's already a certified process for dealing with such problems, then I
can't see how an open-source design would be an improvement on that. The FOSS community have their
own priorities, and would be unlikely to fix/change the important things in a shorter time than a
dedicated software service.

 > less expensive (can't beat free software)

You mentioned a provision of support and service by the current contractor, which are things that
would also need to be paid for when using ImageJ, particularly when requiring a certification
process. This will be expensive. The "free" in free software relates to the freedom you have to do
what you like with the software, rather than the price. It just happens that in most cases the
liberty provision goes together with a gratis distribution.

Sure, there are ImageJ tutorials around which would go some way to dealing with the "service" issue,
but those tutorials are not customised for the particular situations of a company. You can ask on
this mailing list, "how can I do X?", and you'll probably get a number of different answers provided
for free with differing quality and an implicit disclaimer, "don't blame me if your computer explodes."

> Fortunately or unfortunately, but ISO certification for QA equipment and tools is a must at his
> workplace. Would be interesting, if this discussion will continue, possibly leading to some
> solutions for ImageJ compliance solution.

I've already mentioned how I might go about producing "some solutions for ImageJ [ISO 9001]
compliance". It's a bunch of hard work to get done, and it needs to get done at the company level.

- David