Even the "guaranteed measure of maintenance" is not guaranteed. You don't get an SLA on patches or bugfixes from microsoft. You don't get an uptime SLA. Its all "best effort" or worse "when we feel like it". And the few SLAs they give you, e.g. on cloud stuff, are useless because it basically is "get your money back for that month". And the SLA measurement is done by their own downtime announcements, so a complete joke. Software lifetimes exist and are published, but guess what? Within that lifetime, you get "updates", but nowhere do you get any kind of guarantee about what is updated, what is fixed, how fast, if ever.

And no kind of safety-oriented anything will run windows or any microsoft software. There is no windows edition of therac-25. The stuff you see in a hospital is normal workstation PCs for non-safety-relevant data entry and display. As soon as it becomes safety-relevant like controlling your heart-lung-machine, auto-dosing your medications, controlling the x-ray beam, you are far away from anything microsoft.

And actually, OSS is used more often in those safety-relevant settings. Why? Not because the OSS maintainers themselves would themselves provide any support, SLA or warranty. But because the nature of OSS provides third parties the possibility to certify, maintain and guarantee for their special 'safety-relevant-libxml2-fork'. Sometimes this is done by the device vendors themselves, sometimes they buy this from others. But it happens, and it is growing in frequency.

https://www.codethink.co.uk/news/trustable-software.html (Linux) https://access.redhat.com/en/compliance/iso-26262-asil-b (Linux) https://www.lynx.com/case-studies/secure-linux-medical-devic... (Linux) https://developer.arm.com/Tools%20and%20Software/Arm%20Compi... (clang/llvm)

There is tons more. Basically any compiler for safety-relevant embedded stuff is either clang or gcc under the hood. Linux is frequently encountered when the real-time requirements aren't too strict. With Linux also comes the usual Linux ecosystem of OSS libs and services. It won't look like your normal desktop OS, but quite a lot in that area is OSS.

Nothing at all from microsoft (except a useless BS certification "you can use Azure Devops as a code repo to store you ASIL-D code...").

Don't forget that microsoft is the only cloud provider who regularly has so much downtime and eye popping exploits against its cloud infra.