Readiness: foxBMS 2 Battery Management Development Platform

Verdict: Ready with caveats · 2026-09-03 · est. parts cost $288–$352 (active silicon + one debug probe for one bench; discretes and PCB fabrication not priced) Cybersecurity — software & network: Review before networking

This is the cold check for this lab — there is no previous report, so it establishes the baseline every future check will measure drift against. foxBMS 2 is modular: a bench needs the BMS Master, one interface card and one slave family, not all three variants the bill of materials lists. One complete path is fully in stock today — TMS570LC4357 master, LTC6820 interface and LTC6811-1 12-cell slave are all Active with healthy stock. The caveats are real, though: the JTAG debug probe every bench needs shows zero stock at all three authorized distributors on a 12-week factory lead, the MAXIM interface line's part number does not resolve to any catalog product and the closest real part is a different package, the 18-cell LTC slave is discontinued at DigiKey in both temperature grades, and the NXP 14-cell slave is on Last Time Buy. Take the LTC 12-cell path, order probes a term ahead, and the lab runs.

Action required

Cybersecurity — software & network

Review before networking — Fourteen pinned Python build dependencies carry known advisories (six rated high, including remote-code-execution class flaws in GitPython and click) and the documented toolchain install performs unverified binary downloads, though the target board itself exposes no network services.

What this means for your lab

Everything checked this run runs on the instructor's or student's build PC, not on the battery-management board itself. The target board is flashed over JTAG and, per the snapshot, exposes no Ethernet, web interface or SSH login, so there is nothing on it for someone on the network to log into. The real exposure is the build machine: the project pins 114 Python packages, and fourteen of them have known security bugs, including a GitPython flaw that can turn a crafted git option into arbitrary commands and a click flaw that can do the same through an editor helper. These bite when the machine processes something from outside the project - an untrusted repository, image, font or XML file - so the practical risk is a compromised lab PC rather than a hijacked battery pack. The install instructions also download toolchains as binary archives without any checksum or signature check, which means a bad download or a tampered mirror would not be noticed. What to do: bump the flagged pins in requirements.txt (most have fixed versions available), check each downloaded archive against the publisher's checksum before extracting, and keep the CAN, Modbus and instrument links on an isolated bench network. One thing this check could not establish is the operating system: the documentation never states a Windows or Linux version, so whether the host OS is still receiving security updates is unknown and worth confirming with campus IT.

Not checked

• Host operating system (Windows / Linux): no OS version is stated in INSTALL.md, so no end-of-life or support lookup is possible; the snapshot's suggested 'Windows 11 / Ubuntu 22.04' is not supported by the sources and was not assumed
• PowerShell: unpinned - INSTALL.md requires only '7 or later', so there is no specific version to check
• Git: unpinned - no version stated in INSTALL.md
• 7-Zip: unpinned - no version stated in INSTALL.md
• Visual Studio Code: unpinned - no version stated in INSTALL.md
• TI Code Composer Studio 12.8.1: vendor IDE with no public advisory database indexed by OSV; version is pinned but not checkable
• TI HALCoGen 04.07.01: vendor code generator with no public advisory database indexed by OSV; version is pinned but not checkable
• MinGW-w64 8.1.0 (GCC 8.1.0): SourceForge toolchain builds are not an OSV ecosystem, and an endoflife.date lookup for product 'gcc' returned product_not_found, so its support state is unknown
• Doxygen 1.14.0: upstream Doxygen releases are not covered by an OSV ecosystem
• Graphviz 14.0.0: upstream Graphviz releases are not covered by an OSV ecosystem
• draw.io Desktop 28.1.2: upstream drawio-desktop releases are not covered by an OSV ecosystem
• pre-commit hook tools (.pre-commit-config.yaml): the hook config was not fetched this run; its tool versions are pinned separately from requirements.txt and were not checked
• foxBMS 2 embedded firmware (target C source, FreeRTOS): source-only embedded code with no package registry or advisory database to check against
• gcc 8.1.0: support status: endoflife.date has no such product

Parts

Hardware bill of materials and silicon elements

Substitutes

Verify any substitute against its datasheet and against the board's own footprint before ordering.

Other dependencies

• Source repository https://github.com/foxBMS/foxbms-2 — live and reachable this run; requirements.txt, pyproject.toml and INSTALL.md were all fetched successfully from the master branch.
• Hardware release archives https://iisb-foxbms.iisb.fraunhofer.de/foxbms/gen2/hardware/release/ (master-v1.2.3, interface-*, slave-* zips) — not checked. These archives are the only source of the Altium schematics, layouts and the full discrete-component BOMs, so the entire fabrication path depends on that Fraunhofer server staying available. Worth confirming manually.
• Project documentation site https://iisb-foxbms.iisb.fraunhofer.de/foxbms/gen2/docs/html/latest/ — not checked this run.
• TI tool download pages (Code Composer Studio 12.8.1, HALCoGen) — not checked this run; both require a TI account, which the lab setup assumes.
• Fabrication — designed in Altium Designer, OSHWA certified under UID DE000128. Board dimensions, layer stackup, copper weights and surface finish are not stated in the uploaded materials; they live in the Gerber, ODB++ and .PcbDoc files inside the remote release archives, so fabrication cannot be quoted from what is here. Not checked.
• Discrete components, connectors and isolation transformers — not priced; their line-by-line BOMs are inside those same remote archives.

Watch list

• MC33775ATA1AE (NXP 14-cell slave) — Last Time Buy with ECIA lifecycle risk High. Channel stock is deep today (Arrow ~11.9k) but this line will disappear; expect it to be unobtainable at a future check.
• LTC6813HLWE-1#3ZZPBF (18-cell LTC slave) — discontinued at DigiKey in both temperature grades, with a single distributor holding 3 units. The most likely part to become genuinely unobtainable next.
• TMDSEMU110-U (XDS110 probe) — zero stock across all three authorized distributors on a 12-week lead. Watch whether stock returns or lead times stretch further.
• MAX17841BAGU/V+ (MAXIM interface) — unresolved identity and footprint question. Until the board file is read, treat this whole interface variant as unbuildable.
• LTC6820HMS#PBF — healthy overall, but DigiKey stock is thin at 45 units; Mouser and Newark carry the depth. Worth re-checking that the other two hold.