Selling open source hardware

[homebrew]

Hi everyone!

Dave was talking in his last video on the use of the open source hardware logo, which brought up a topic that I would really like to discuss.

What can I actually sell as a hobbyist electronics designer?

Of course, I can share the schematics and EDA files as I like. But with actual hardware, it gets apparently A LOT more tricky. At least here in the EU one has to declare CE conformity on pretty much everything. Even on kits and since this year I think also on evaluation boards.

That includes at least the Low Voltage Directive, EMV and more, depending on the type of design. You need to do a risk assessment, provide a manual and so on and so on...

That means it would be practically impossible to legally sell a simple shield for the arduino or the PI, just to make an example.

So how do you deal with that? Simply never sell anything? Or has anybody really gone through that process for a hobby project design!?

And no, it's not about earning money. For me it's more like a service thing. For example, economy of scale is pretty good, when it comes to PCBs so why not order 30 instead of 3 and sell the rest to anybody interested ...

[rstofer]

Can you just sell the PCB with only ROHS compliance?  Let the buyer purchase the parts from somewhere else.

Or, just give up hope!  I know I feel better having done that...

[homebrew]

Probably not even that.

The problem is, that a specific PCB will inevitably lead to a specific product. And this product has to be "safe" when built according to the design.

So from what I understand, it would however be legal to (re)sell ROHS conform components and even breadboard-style PCBs. But selling PCBs for a specific design might actually be problematic ...

[Tabs]

Actually there may be some avenues open to you depending on the nature of your PCB.

Confirm the following yourself....
Firstly kits for assembly by the user do not need to be CE marked. If you supply the PCB then you have to make sure it's rohs (now part of CE). The PCB is electrically benign so no emc or lvd. This is especially true if the end user is supplying the parts.

If your assembled PCB is for r&d then you don't need CE marking. Eg a dev board. The first arduino and pi were not CE. I think now they are....

If your using the radio spectrum then above do not apply. You will need CE. Unless you are using 2.4ghz de regulated band.

The following is what I see on quotes for testing products I helped design. This was true 2 years ago, since then I convinced my company to build it's own chamber so not had to outsource this for a while....

The costs vary depending on your product class. An emc chamber can cost £1200 per day (more if you are present for the testing) or £4000 for a complete suite of tests.

If your product is not powered off mains or if it uses a generic brick then you could test it with batteries then your cost comes down because you bypass most tests.

The final cost on emc depends mostly on test time and the number of tests. The longest tests are usually conducted immunity. It's best to minimise the run time of these tests by using the minimum number of cables and to stick below 100mhz as the highest internally generated frequency as this let's you test to 1ghz only.

Some tests you can do at home by hiring the equipment... ESD gun, FTB and surge generator, and conducted immunity, emissions. Typical cost of £200 per day per equipment.

Safety testing can be more expensive £6000 to £10000. Again cheaper if not mains powered.

If you do this then your costs will sky rocket if you fail and have to do exploratory tests, fix and retest.

The biggest thing from a compliance point of view is that your product is safe and does not cause interference with other products. If your product is interfered with by something else and this isn't a safety issue then the authorities don't really care because this just represents a customer relationship problem for you. They only get involved if lots of your customers complain or bring class action law suite.

There's lots of ways to minimise the cost, as always I'll cover my ass by stating you should seek your're own legal advice.


Sent from my SM-N930F using Tapatalk

[homebrew]

Confirm the following yourself....
Firstly kits for assembly by the user do not need to be CE marked. If you supply the PCB then you have to make sure it's rohs (now part of CE). The PCB is electrically benign so no emc or lvd. This is especially true if the end user is supplying the parts.

If your assembled PCB is for r&d then you don't need CE marking. Eg a dev board. The first arduino and pi were not CE. I think now they are....

The role of the "end user" might indeed be the problem. Apparently the argument for the kits and eval-boards does not hold anymore in current regulation. That might also be the reason for the rPI and Arduino to be declared CE - they are directly sold to the end user. Even large kit sellers (e.g. Velleman) now declare their kits conform:

http://www.velleman.eu/images/tmp/CE%20modules%20081106.pdf

Regarding the EMC regulations, I now found this:
http://ec.europa.eu/DocsRoom/documents/9863/attachments/1/translations/en/renditions/pdf

See the flowchart on page 16:
"Components or sub-assemblies" -> "intended for incorporation into an apparatus" -> "by the end user" -> APPARATUS

So selling benign components without any intention where they are to be used (e.g. selling assortments of resistors) should not be a problem. But I think one will have a hard time discussing away the intention from a custom made PCB ...

The only way out would be to see the PCB as a single unique part, being completely passive and hence excluded (at least) from EMC. However, this argument feels awkward, because now the applicability of the regulation would depend on whether or not I sell (or even just offer) the PCB together with other components or not ...

Seems wired .. and thus is probably wrong.   

[Srbel]

I am glad my country is not part of the EU, and that it will never be.

[EEVblog]

That means it would be practically impossible to legally sell a simple shield for the arduino or the PI, just to make an example.

Yet countless people do that don't they?

[homebrew]

That means it would be practically impossible to legally sell a simple shield for the arduino or the PI, just to make an example.

Yet countless people do that don't they?

Yes, in the same way as countless people smoke weed ... but that doesn't make the situation any better.

I think what open hardware (besides the licensing framework) would also need is a clear and pragmatic approach to these regulatory demands. Otherwise open hardware will never evolve into a competitive environment (like OSS for example). It is just too easy to sue somebody if he doesn't adhere to the regulations and standards.

On the open source software side, this has all been thought through during the last decades. But it was maybe far easier from the beginning, as nobody is ever liable for buggy software, even if it accidentally destroys all your data. Starting a fire because of a design flaw in an open hardware project is another story ...

And yes, an acceptable answer to the initial question could really be, that is is just not possible in the EU to legally sell small scale projects...

[CJay]

And yes, an acceptable answer to the initial question could really be, that is is just not possible in the EU to legally sell small scale projects...

So yet another corporate stitch up eh...

What a ridiculous situation yet our politicians cannot see why innovation is dead for all but corporates or well funded individuals.

We've killed the man in the shed.

[AndyC_772]

Well, OK, but what if the man in the shed wants to sell something that's actually dangerous, or which does interfere with TV and radio reception?

CE isn't perfect by any means, but it's one of a very few good things to come out of the EU, IMHO. Test your product once, to a common set of standards, and you can sell it anywhere in Europe. Without that regime in place, companies would have to test to each individual country's standards, which is a monumental pain in the backside, and hugely expensive and time consuming.

Just ask anyone who ever designed telephone equipment back in the day.

[homebrew]

We've killed the man in the shed.

Actually it is worse than that. We've killed the shed ... people are still there ...

Sharing is fundamental to any *open something* community to work. For open hardware real sharing is apparently legally not possible. Sure, on one hand I see the need to protect the market from unsafe products. But on the other hand it eliminates the possibility of sharing at the level of open products, thereby eliminating any from of economy of scale. Yes, everybody can now order any component desired and can order pcbs of any complexity - but at what costs?

In this framework also open hardware business models are not feasible (I mean real open hardware - not just PDF schematics), as the community could not properly be involved in the design process.

So from that perspective, I totally understand why we don't have any significant open hardware projects ...

[b_force]

Well, OK, but what if the man in the shed wants to sell something that's actually dangerous, or which does interfere with TV and radio reception?

CE isn't perfect by any means, but it's one of a very few good things to come out of the EU, IMHO. Test your product once, to a common set of standards, and you can sell it anywhere in Europe. Without that regime in place, companies would have to test to each individual country's standards, which is a monumental pain in the backside, and hugely expensive and time consuming.

Just ask anyone who ever designed telephone equipment back in the day.

I think people have to agree with this.

Yes there are downsides to all of it. I still don't get why CE has to be so expensive. There is no reason for it.

But if you see what kind of bizarre things you can buy in other countries like China and even the US (the whole wall plug design leaves me full of questions, most dangerous type of connector I have ever seen).

As an individual started you just have to be clever.
All low voltage/power are pretty much fine. As mentioned above, kits are also fine.
The problem starts with projects like SMPS power supplies etc.
But if you sell it as some kind of DIY/test/development project I think you're still fine.

[Zero999]

On the open source software side, this has all been thought through during the last decades. But it was maybe far easier from the beginning, as nobody is ever liable for buggy software, even if it accidentally destroys all your data. Starting a fire because of a design flaw in an open hardware project is another story ...

Software is totally different. It's just data, nothing else.

As far as buggy software is concerned: no one gets killed if someone loses their data but with hardware people can die if it's unsafe. Indeed the same does apply to software: if it's safety critical such as an aeroplane autopilot, the software has to go through as many rigorous tests as the hardware.

As far as the original topic is concerned: CE does not stop one from selling open source hardware, so long as it meets the relevant regulations, whether this is practical or no is another story.

[homebrew]

Sure hardware is a different thing than software. But the actual philosophy of open hardware as community of practice and sharing came from the world of software.

Of course we have to accept and obey the rules!
And of course we do not want to put people in any danger.

And that brings us really back to the initial question: How do you deal with that, when you want to offer more than just the EDA-files?

[AndyC_772]

Yes there are downsides to all of it. I still don't get why CE has to be so expensive. There is no reason for it.

CE testing is just a commercial service, and there are plenty of places that do it. Just like any other commercial service, the price is determined by competition and by what the market will bear.

It does require an awful lot of costly equipment, specialist facilities and expertise. I generally reckon about £1000/day for EMC lab time.

[tggzzz]

As far as buggy software is concerned: no one gets killed if someone loses their data...

Clearly you are young, inexperienced in the ways things fail, and lack experience. You - and everybody else on this forum - really should read comp.risks e.g. via the archive at http://catless.ncl.ac.uk/Risks/ It is a low volume very high quality group, and I recommend using the RSS feeds.

Engineers, as opposed to technicians, have to be concerned with theoretical and practical failure modes. Indeed, large part of engineering is not about how things work (the easy bit); it is about how things fail and how to avoid the failures.

[homebrew]

Clearly you are young, inexperienced in the ways things fail, and lack experience. You - and everybody else on this forum - really should read comp.risks e.g. via the archive at http://catless.ncl.ac.uk/Risks/ It is a low volume very high quality group, and I recommend using the RSS feeds.

Engineers, as opposed to technicians, have to be concerned with theoretical and practical failure modes. Indeed, large part of engineering is not about how things work (the easy bit); it is about how things fail and how to avoid the failures.

Yes, maybe some of us are inexperienced ... so what? Get over it!
For me this is fine - I would consider myself as an "advanced hobbyist" nothing less, nothing more.

But in the current framing, open hardware is just fake. When no way of dealing with the regulations pragmatically can be found, it is nothing more than marketing BS for big companies. An open community can ONLY work if everybody has the right to modify and share a good and is at the same time the only person responsible himself for the goods he is using from the community.

NOBODY with a sane mind would invest his spare time into designing/improving something if he has to take unmanageable legal risks in doing so. This would be an investment without any expected returns but high risks involved.

But as long as open hardware is just treated just as open documentation about hardware, it seems fine (CERN-OHL http://www.ohwr.org/attachments/2388/cern_ohl_v_1_2.txt):

5. Warranty and liability
5.1 DISCLAIMER – The Documentation and any modified Documentation are
provided "as is" and any express or implied warranties, including, but
not limited to, implied warranties of merchantability, of satisfactory
quality, non-infringement of third party rights, and fitness for a
particular purpose or use are disclaimed in respect of the
Documentation, the modified Documentation or any Product.

The TARP-license is even more explicit on that (https://www.tapr.org/TAPR_Open_Hardware_License_v1.0.txt):

7.1  THE DOCUMENTATION IS PROVIDED ON AN"AS-IS" BASIS WITHOUT
WARRANTY OF ANY KIND, TO THE EXTENT PERMITTED BY APPLICABLE LAW.  ALL
WARRANTIES, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO ANY
WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE, AND
TITLE, ARE HEREBY EXPRESSLY DISCLAIMED.
7.2  IN NO EVENT UNLESS REQUIRED BY APPLICABLE LAW WILL ANY LICENSOR
BE LIABLE TO YOU OR ANY THIRD PARTY FOR ANY DIRECT, INDIRECT,
INCIDENTAL, CONSEQUENTIAL, PUNITIVE, OR EXEMPLARY DAMAGES ARISING OUT OF
THE USE OF, OR INABILITY TO USE, THE DOCUMENTATION OR PRODUCTS,
INCLUDING BUT NOT LIMITED TO CLAIMS OF INTELLECTUAL PROPERTY
INFRINGEMENT OR LOSS OF DATA, EVEN IF THAT PARTY HAS BEEN ADVISED OF THE
POSSIBILITY OF SUCH DAMAGES.

But now compare this to OSS licenses such as the GPL (https://www.gnu.org/licenses/gpl.txt). You'll see it is pretty much the same, But remember the BIG DIFFERENCE there is that the software IS THE PRODUCT and not some meta-information.

15. Disclaimer of Warranty.
  THERE IS NO WARRANTY FOR THE PROGRAM, TO THE EXTENT PERMITTED BY
APPLICABLE LAW.  EXCEPT WHEN OTHERWISE STATED IN WRITING THE COPYRIGHT
HOLDERS AND/OR OTHER PARTIES PROVIDE THE PROGRAM "AS IS" WITHOUT WARRANTY
OF ANY KIND, EITHER EXPRESSED OR IMPLIED, INCLUDING, BUT NOT LIMITED TO,
THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
PURPOSE.  THE ENTIRE RISK AS TO THE QUALITY AND PERFORMANCE OF THE PROGRAM
IS WITH YOU.  SHOULD THE PROGRAM PROVE DEFECTIVE, YOU ASSUME THE COST OF
ALL NECESSARY SERVICING, REPAIR OR CORRECTION.

You see, the members of the OSS community are pretty much protected in terms of being held responsible for mistakes. And they share products...

For Hardware this will simply not work. When somebody want's to transform a design into real physical hardware, all regulatory hell breaks loose. And it doesn't matter if you sell it, give it away for free, sell it as a finished product or just as a kit ... It has to comply to the regulations (and needs to be safe)! The risks involved are not transferable to the user.

So the question still persists: How do we deal with security in open hardware projects in a way that participative community development is still possible without violating the regulations?

[Chris Mr]

How about selling the postage more expensively and calling the item 'free' - just a (bad) idea!

[homebrew]

How about selling the postage more expensively and calling the item 'free' - just a (bad) idea!

Yes - these little 'tricks' don't work either. The regulations don't care if you make money with the product. As soon as somebody else gets in contact with your 'product' everything must apply.

[b_force]

Yes there are downsides to all of it. I still don't get why CE has to be so expensive. There is no reason for it.

CE testing is just a commercial service, and there are plenty of places that do it. Just like any other commercial service, the price is determined by competition and by what the market will bear.

It does require an awful lot of costly equipment, specialist facilities and expertise. I generally reckon about £1000/day for EMC lab time.

And for startup companies, 1000-2000 bucks a day is not doable.
I knew someone who worked in one of the notified bodies in NL. The main reason why they are so expensive, is because all work is done by people with a degree (Msc, Bsc etc) plus there is a lot of paperwork.
Which comes down to the fact that I have to pay someone around 100-150 euro an hour (or more), just to sit behind a desk a type stuff into a computer.  .
I just don't get it, this strategy would be like digging your own grave for every commercial company.
Apparently it's standard in the world of licenses, blows my mind 

[Zero999]

As far as buggy software is concerned: no one gets killed if someone loses their data...

Clearly you are young, inexperienced in the ways things fail, and lack experience. You - and everybody else on this forum - really should read comp.risks e.g. via the archive at http://catless.ncl.ac.uk/Risks/ It is a low volume very high quality group, and I recommend using the RSS feeds.

Engineers, as opposed to technicians, have to be concerned with theoretical and practical failure modes. Indeed, large part of engineering is not about how things work (the easy bit); it is about how things fail and how to avoid the failures.

How do you know what level of experience I have?

I have been involved in the design of safety critical machinery before and although I haven't actually written safety critical software, I'm well aware of the requirements.

Even thought there are some risks of identity theft or hacking, it's not in the same league as a plane crash.

[tggzzz]

As far as buggy software is concerned: no one gets killed if someone loses their data...

Clearly you are young, inexperienced in the ways things fail, and lack experience. You - and everybody else on this forum - really should read comp.risks e.g. via the archive at http://catless.ncl.ac.uk/Risks/ It is a low volume very high quality group, and I recommend using the RSS feeds.

Engineers, as opposed to technicians, have to be concerned with theoretical and practical failure modes. Indeed, large part of engineering is not about how things work (the easy bit); it is about how things fail and how to avoid the failures.

How do you know what level of experience I have?

I have been involved in the design of safety critical machinery before and although I haven't actually written safety critical software, I'm well aware of the requirements.

Even thought there are some risks of identity theft or hacking, it's not in the same league as a plane crash.

If you read comp.risks as I suggested, you will find there are many ways in which faulty code and even "just" lost data are in the same league as a plane crash! Some are worse, since they could kill far more than a single plane's "self loading freight".

If you prefer a book from the ACM Press, try https://www.amazon.co.uk/Computer-Related-Risks-Press-Peter-Neumann/dp/020155805X Newmann is the comp.risks moderator, and regrettably little has changed since 1994. Anybody that doesn't know what the ACM is shouldn't be let loose with a keyboard

[mikeselectricstuff]

It is not mandatory to do any testing at all, third-party or otherwise.
CE marking means you declare that the product meets the requirements for the product category.
There are many ways to satisfy yourself that it does without using an expensive test house.

[homebrew]

It is not mandatory to do any testing at all, third-party or otherwise.
CE marking means you declare that the product meets the requirements for the product category.
There are many ways to satisfy yourself that it does without using an expensive test house.

Of course. But especially this kind of argumentative 'proof' would require a really substantial knowledge on the regulations and even more so on the topics involved. Is that even possible as a community effort?

Is there any guidance out there how to even approach this?

[mikeselectricstuff]

Something that those who have done some testing could do is publish their results. That would provide some useful baseline figures to compare similar designs.
 
However the more pragmatic argument is OSHW is such a miniscule part of the market that unless your product kills someone nobody is going to take any notice.
Look at all the lethal mains adapters from China on ebay - the people who enforce these things have a gazillion things to investigate before some piddly little OSHW gadget.
If someone wants to challenge your CE marking, someone has to pay for some tests - who has the funds to do that ?