How do Royalty payments work?

The standard way is to (1) have a precisely defined royalty and (2) detailed computation of the royalty, combined with an audit right.

In most contracts calling for a royalty to be paid on IP, payments of royalties usually happen on a periodic basis -- monthly, quarterly, annually, whatever. As part of that, the licensee usually has to give an accounting of how the royalty was calculated. On top of that, the licensor usually gets an audit right -- the right to go in (or, actually, to have an accountant go in) and look through the licensee's records to ensure that they're paying the correct amount.

Recognize that there are several ways to cheat. You've identified one: just fibbing about the number of units sold. Another is in the calculation of the royalty itself -- often, the royalty is x% of sales AFTER a bunch of line items. Each of those line items is an opportunity for the licensee to reduce your royalty. Another way to cheat is to sell the product with other products or services and allocate most of the revenue to those other products or services, instead of to the licensed product where it belongs.

First off if it is a major company (say a Fortune 100) selling high priced industrial machines they will not want to risk getting sued for cheating you out of commissions. It is too easy to prove your case.

Since the machines are high priced, do they have serial numbers? If so ship the software directly to the customers yourself and license it for use on that serial number machine only. You can also include a licensing dongle if you like so that your software will not run without the dongle.

You may want to also charge the customers an annual maintenance fee for software upgrades. Once again ship the upgrades directly to the customers yourself and once again tie the upgrade to the particular serial number so that it can not be used to upgrade any other copy.

People who buy million dollar industrial machines are quite used to such practices as well as paying substantial ongoing maintenance fees. This is not consumer software.

First- there is a third option you have not mentioned. You get paid a fixed amount to write the software, and then a royalty on each unit sold. The payment does not cover all your costs in writing the software but does ensure you get something from the deal and that the other party is serious about the deal.

The answer to your question is: You must have a written contract with the company that spells out all rights and obligations. It will require a lawyer (on both sides) to negotiate this contract. We have done this hundreds of times with our software products (we have standrd license agreements specifically for our products.)

Things to look out for:

1. Indemnity- will the other party protect you if they are sued when their machine does something bad.
2. Specify exactly what the royalty payment is based on.
3. Specify how often the royalty payment is made, what the penalties are for late payment, and give you the right to audit their books to ensure the royalties are correct. (Typically you pay for the audit, and if they under report sales by x% they have to pay for the audit, plus of course pay back royalties.)
4. One nice item tom add is something to prevent them from writing the same software themselves and then dumping you. (This often happens if your software becomes a big success- they can then afford to write the same software and stop paying you.)

I'm wondering how this sort of thing can work with software, and how does one enforce the policy to make sure the company is not cheating.

There are 2 ways to enforce how your customer use your software: contractually and technologically. You should use both methods in tandem. Gary E covered the legal and written-contract side of things, so I'll just cover the technological way of enforcing how your customers use your software.

(Technologically) Enforcing how your customers use your software

The way you limit how many times your customers install your software is by using "hardware-locked" licensing. I'm founder of the company that makes LimeLM (hardware-locked licensing for Windows/Mac/Linux/etc.), so obviously I'm going to recommend you go with our solution. But I'm also going to describe how to build this yourself. And I can go into further detail if you want.

The most commonly used method of hardware-locked licensing is online activation. This is what greater than 99% of end-users of companies using LimeLM use. There are other variants of hardware-locked licensing ("offline" activation, dongles, floating licensing, etc.). However, for most companies, online activation is the best bet.

Most people have encountered the "online activation" type of licensing when they purchase a copy of Microsoft Windows or Microsoft Office.

When a customer uses well designed online activation it looks nearly identical to “serial-only” licensing. That is, the customer buys a copy of your software and gets a 20 to 30 character serial number like “ABCD-EFGH-IJKL-MNOP-…”. The customer enters this serial number into your program or your program’s installer. Then, when the user clicks an “Activate” button, some “magic” happens behind the scenes. Your app will either let the customer use your app on that machine or your app will tell the customer to buy another license.

What’s the “magic” behind online activation? (a.k.a. how to build it yourself)

If you don't want to buy a 3rd party licensing solution like LimeLM, you can always build it yourself. But what you build has to be technologically sound.

The broad overview of how any well-designed online activation licensing system works is like this:

• Your customer enters a serial (e.g. “ABCD-EFGH-IJKL-MNOP-…”).
• Your software generates a “fingerprint” to uniquely and anonymously identify the customer’s computer.
• This serial and the computer's unique "fingerprint" are sent to an activation server.
• If the server allows the activation then the serial & fingerprint are cryptographically signed and sent back to the user.
• Based on this cryptographically signed block your app or installer will know whether the user is allowed to use your application or not.

The whole activation process is a huge topic that can get exceedingly technical. This is the condensed version. The hardware "fingerprinting" in itself is a gigantic topic. There are a thousand wrong ways to do it (using an IP address, MAC address, etc., etc.).

The best way to get a fingerprint for a computer is to use every piece of hardware in the computer (RAM, CPU, motherboard, bios, primary hard disk, networking card internal details, etc., etc.).

If you want me to go into further detail, just ask.