2
\$\begingroup\$

I am developing a small electronic product which, if all works fine, I think about producing and selling in small numbers.

Currently I use an ESP32 DevKit for the development. That is the ESP32 development board with "everything" included like power regulator, USB connection, etc. https://www.aliexpress.com/item/4000093185394.html

The schematic for that DevKit is published here https://www.espressif.com/en/support/download/documents

In theory, when I want to build my own product I could:

A) Use all or most of the PCB design of that DevKit board and add the few extra components which I need all in one PCB.

B) Or I could design my own PCB and solder the DevKit board on my PCB which would include only a few extra components.

B is much easier for me because the DevKit boards are ready and cheap available.

Is it good practice to do that? Or are there good reasons to put everything on one PCB including the parts which are now on the ESP32 DevKit board?

\$\endgroup\$
7
  • \$\begingroup\$ You have to ask and answer all those questions yourself. It might be fine practice to use a Dev kit for a one off chicken hatchery project, for example. Or sell a few. So long as it meets the needs with the price for it, and you can support your customers the way they should be, then it may not matter much. Or it may matter a lot. Since your don't tell us what you are doing, there's no chance to venture even an opinion, let alone an educated one. I don't see how anyone can help you in this. Not with as much as you've written. \$\endgroup\$
    – jonk
    Dec 18, 2019 at 6:25
  • 1
    \$\begingroup\$ You would have to check whether you are legally allowed to use the dev kit in a product (see related question electronics.stackexchange.com/questions/67030/…). And you might consider whether compliance with codes and standards is feasible when you are using a dev kit (see this question electronics.stackexchange.com/questions/332208/…) \$\endgroup\$
    – oliver
    Dec 18, 2019 at 6:35
  • \$\begingroup\$ That being said, I think it doesn't make sense to just "copy" the dev kit layout to your own board if you don't at least change the layout (e.g. in order to better comply with EMC regulations) or achieve lower cost by doing so. \$\endgroup\$
    – oliver
    Dec 18, 2019 at 6:42
  • 1
    \$\begingroup\$ And honestly, I would ask myself the question whether security could be a concern (which I think is more probable for small scale products). If I were Xi Jinping, and if I wanted to rule the world in the James Bond villain fashion, then I guess the first thing I would do is to flood the world with a cheap IOT component that eventually would allow me to turn off critical infrastructure by pressing a red button on my desk. \$\endgroup\$
    – oliver
    Dec 18, 2019 at 6:51
  • \$\begingroup\$ @oliver yeah right. \$\endgroup\$ Dec 18, 2019 at 7:00

5 Answers 5

2
\$\begingroup\$

I use dev boards because they save me time, are known to work, should have met the required EMC standards, are easier to install and maintain, and if I drop dead the person taking over my project won't have too much trouble figuring it out.

If you make your own rf PCB, or use a part of the dev board modified in any way that could affect EMC compliance then you will probably have to get it tested to be legal, which would be prohibitively expensive for a small production run. All this is avoided if you use a pre-approved board.

Conspiracy theories aside, buying from AliExpress or eBay is a bit risky because you don't know if the device is compliant, even if it looks identical to one that does. If you are worried about it then buy from a reputable company like Sparkfun or Digikey. If that still doesn't assuage your fears then sell the product without the module and let the customers source it themselves.

Also consider the application - might it put you at the wrong end of a lawsuit if something goes wrong? If it's a 'hobby' project and you aren't making a lot of money out of it then you probably have nothing to worry about. Millions of these EPS32 modules are being used throughout the World, so if they were a problem we probably would have heard about it. But you have to evaluate the risk. If there's even a small possibility that your product could cause harm then it might be best not to sell it.

\$\endgroup\$
6
  • \$\begingroup\$ Don't wanna be obtrusive on the security point. But "we probably would have heard about it" is not a valid argument because there might be a backdoor in the hardware that is only exploited in a very specific scenario. If one uses the ESP to control the lighting of a fishtank, that might be irrelevant, but already for a smart home application I would be cautious. Call that conspiracy theory if you want, or just accept that people arrive at different risk priorities. \$\endgroup\$
    – oliver
    Dec 18, 2019 at 8:40
  • \$\begingroup\$ Man what the actual f... You point him out with "We probably would have heard about it" and then saying its not a valid argument. But then carries on with "There MIGHT be a backdoor" - "Only exploited in a very specific scenario" .. Do you hear yourself ? \$\endgroup\$
    – Sorenp
    Dec 18, 2019 at 8:59
  • \$\begingroup\$ @Sorenp: calm down, this is not your favorite social harassment platform. Have you even heard about the term risk management? It is very common in engineering and it actually deals with eventualities. By the way, I can't hear myself, but probably you can... \$\endgroup\$
    – oliver
    Dec 18, 2019 at 9:11
  • \$\begingroup\$ By 'a problem' I was talking about the possibility of causing interference in normal operation, not hypothetical 'back doors' put into the chip by James Bond style villains. But hey, that's why I went back to using my 1992 Amiga 1200 to browse the web - with a CPU too simple to hide a back door in and the OS in mask-ROM so it can't be hacked. I also wrote my own network driver, and disassembled the web browser to make sure there was nothing hidden in it. Scammers and the NSA can't touch me when I use that machine! (especially when I wear my tinfoil hat...). \$\endgroup\$ Dec 18, 2019 at 9:12
  • 1
    \$\begingroup\$ @BruceAbbott: what is so wrong about recommending the OP to make a risk assessment that deals with a (possibly remote) probability that there might be a backdoor. In fact backdoors are not that uncommon as you seem to indicate by using the term "conspiracy theories". Notice that a conspiracy theorist would claim that there IS a backdoor, whereas I only say that there COULD be a backdoor for good reason. But somehow I seem to have hit a sensitive spot by mentioning this. \$\endgroup\$
    – oliver
    Dec 18, 2019 at 9:17
2
\$\begingroup\$

I see this is an old thread, but this is worth mentioning.

First, the OP asks if it's OK to just use an off-the-shelf dev kit, NOT the module it has mounted on it's back. I would refrain from this, as you have absolutely no control of availability, quality, EOL notices and price.

Using the module, however, is another story. The module has been certified by various standards agencies for compliance with the various standards. It contains the Espress chip, and a few other components that have been assembled according to a controlled document and can't be altered without loosing that approval.

As far as conspiracy theories go, it can be done in so many ways that it'll never be detected without detailed analysis in an NSA level lab. The security camera products are the best example. They sit up there looking at what's happening, but that's not the danger. If you put them on the inside of your firewall, and on your secure network, they have all the time in the world to probe that network. Being an inside "trusted" device, they can send emails out about what they've found. They can even ask for updates of their firmware, or receive new code from time to time. Often the update account is hardcoded, so the admin can't change or disable it.

We lazy developers can download "free" modules from Github to make our high pressure, zero schedule, projects get done on time. Seed back door code, cleverly hidden in self-modifying subroutines, can hatch a spy application in code domestically written. Be careful about downloaded modules in wireless or network code.

\$\endgroup\$
1
  • \$\begingroup\$ good point on distinction between the board and the module \$\endgroup\$
    – Maple
    Apr 21, 2021 at 15:06
1
\$\begingroup\$

A number of development board makers specify that they are not to be sold in commercial products. They are usually sold at very low prices with little or no profit margin by companies wanting to sell the chips. This is true of ST Microelectronics, for example. Now, for small production runs and low sales you can probably get away with ignoring this, but if it comes to their attention it could cause problems.

On the other hand, copying what they have is quite legitimate as long as you make your own boards.

\$\endgroup\$
1
\$\begingroup\$

I would strongly advocate against using any DevKits/Debug platforms/Evaluation kits in commercial products at all. It is a very bad practice and a huge risk.

The problem is that the kits are generally not standardized and not produced in big quantities (unless it is an Arduino or something very common like this). The documentation can be very limited as well especially for the cheap and popular boards from AliExpress. This severely limits production rate and what is even worse after a year or two after your product is put into production you are pretty much guaranteed to end up in a situation when the exact same boards you used before are no longer available and all the new ones have a slightly changed pinout or some different parts that require slightly different firmware so no pin to pin compatible replacements exist. The situation leads to many incomplete PCBs having to be scrapped and some engineer having to work on the thing again probably without knowing exactly what he is dealing with in order to change the layout or editing or at least recompiling the firmware. Not only it is going to be a direct financial loss but it is a lot of wasted time and human resources and even risks of not having the right people available at all when they are needed. In theory there can be legal issues as well.

So one way or another the decision will most likely eventually end up costing a lot of money and your boss will not be very happy to find out about the timebomb you have hidden inside your design. Don't ever do that unless the outcome I described is for some reason exactly what you want for the company you work for.

As for the ESP32 DevKit specificly it is a very simple board. The only case when I would even briefly consider using it in any product is if it allows you to avoid making any custom PCBs at all. Otherwise there is just no excuse for not going with just ESP32 module itself instead.

\$\endgroup\$
1
\$\begingroup\$

Yes you absolutely can, if you have:

  1. Gone through the schematics and understood what they mean.
  2. Have tested several modules.
  3. Are compliant with your countries laws on selling electronics (laws are too varied to list, but if anyone wants the US or Oz ones let me know in comments). In some (most?)countries, if you solder a Dev kit to a PCB you are making a new electronic product and will need to get it registered for legal sales.

Kits are standardized BUT their parts may be inconsistent. The major cheap ESP32 Dev Kit manufacturers (eg LiLyGo, Heltec, etc) may change things without documentation, but this is very rare, and won't affect the pinouts

Some cost/benefits:

  • Cost you will need to test more thoroughly as some variation between boards will occur: usually chips are okay, but internal resistors etc will vary (so things like voltage leak will vary).
  • Benefit rapid deployment
  • Benefit Potentially already certified. Certification in US, EU, Aus, NZ can be really expensive; and often takes a few iterations, with each one costing.
  • Cost you are paying for a bunch of bits you don't need
  • Cost you will rarely get the best voltage drain (this varies wildly across manufacturers)
  • Benefit a reasonably well tested board if you go with a common manufacturer.

Note: Chips don't magically download back-doors. To have a back door there must be code that you have not written which will be:

  • Libraries (any module your testing typically has a library)
  • IDE code (eg Arduino IDE)
  • OS (eg Raspbian, Windows, etc) If you trust the libraries, your IDE, your programmers and any OS used then you are good to go unless you are building something like a security camera or fire-defence system. In that case you would probably want to go the PCB route for that extra bit of hardware reliability and go through all the libraries you're using (Slight tangent but the hospital ventilation machines I got to work on had eight back up MCUs. Yes, eight! Point being tailor your redundancy and security to the risk)

Last point: Let me encourage anyone in this field to start going through the steps of developing PCBs (getting them made for you). You will be forced to massively up your understanding of what you're doing and why, as well as opening up a bunch of options; in the long run your products will be better.

\$\endgroup\$

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.