Readiness: Annin Robotics AR4 Robot Arm

Verdict: Ready with caveats · 2026-09-03 · est. parts cost $830–$1,035 Cybersecurity — software & network: Review before networking

This is the cold check — no previous readiness report exists for this lab, so these figures establish the baseline for future drift comparison. Every electronic part in the bill of materials was found in stock at an authorized distributor or a mainstream retailer at an ordinary price; nothing is obsolete, end-of-life, or unobtainable. The caveats are about ordering the right thing rather than about availability. The Teensy 4.1 is no longer catalogued under any PJRC part number, and DigiKey's top hit for "TEENSY 4.1" is a $9.95 Ethernet accessory rather than the board — an easy and expensive mis-order. Three requirements the snapshot states (the E-stop's low-level contact rating, the servo's fit in the printed gripper pocket, and the limit-switch bracket hole pattern) are specified only in the offline assembly manuals, which are not in the uploaded materials, so they could not be checked against any candidate part. The six stepper motors are sold only as a vendor-designated package; individual motor part numbers and gear ratios were not checked.

The estimated cost covers the controller electronics and consumables checked here plus the StepperOnline motor package. It excludes the optional encoders, the aluminium/hardware kits, and 3D-printed parts — those are priced separately under Other dependencies.

Action required

Cybersecurity — software & network

Review before networking — No advisories were found, but every component in the stack is unpinned or undeterminable, and the documented setup runs unverified downloads - including one installed as root - so the security state is unknown rather than clean.

What this means for your lab

Nothing in this check turned up a known vulnerability, but that is mostly because almost nothing here has a version anyone can check - it is not a clean bill of health. The arm talks to the PC over USB cables rather than the network, and the lab's documentation describes no login service, open port or default password, so there is no obvious way for someone else on the campus network to reach the robot directly. The real exposure is in how the software gets installed. The setup instructions download the Arduino IDE and a system device-rules file straight off the internet and use them without checking that the files are what they claim to be - one of them is copied in with administrator rights, and the IDE is deliberately run with its own safety sandbox switched off. The driver code is likewise pulled fresh from GitHub at build time, from two different accounts, with no fixed version. Anyone able to tamper with those downloads would be running their code on your lab PC. Practical steps: build the lab PC once and write down exactly which versions you installed; check the Arduino IDE download against Arduino's published checksum; open the Teensy rules file and read it before copying it in as administrator; and if you use the optional Docker setup, leave out the option that hands your SSH keys to the container. If you plan to run the ROS 2 software across more than one machine, raise it with campus IT and put those machines on their own network segment first - this check found nothing that tells us how that traffic is protected, and unknown is not the same as safe.

Not checked

• Microsoft Windows 10 / 11 host: The sources name only the family, and endoflife.date needs a feature-update cycle (its Windows cycles are of the form 11-24h2-w, 10-22h2); lookups on both '11' and '10' returned no cycle match, so support status is unknown.
• ROS 2 Jazzy Jalisco: endoflife.date's 'ros' product lists only ROS 1 cycles (noetic, melodic, lunar, kinetic), so there is no ROS 2 cycle to match Jazzy against.
• AR4 HMI Python dependencies (10 packages): All 10 are unpinned; OSV needs an exact version, so none could be checked.
• ROS 2 stack packages from annin_ar4_driver/package.xml (20): ROS package.xml carries no versions and the README installs them with bare apt, so there is no exact version to check.
• Arduino IDE 2.3.6: Not checked: no package named 'arduino-ide' exists in the npm registry, and no advisory database covers the Arduino IDE desktop application under that name.
• PJRC Teensyduino board support package: Installed from a live board-manager index with no release pinned, and vendor board packages have no vulnerability database.
• Bounce2 (Arduino library): Arduino libraries have no vulnerability database, and no version is pinned.
• AR4 Teensy 4.1 and Arduino Nano firmware sketches: Vendor firmware with no public vulnerability tracking, and the installed sketch version is not pinned by the repository.
• AR4-MK3 Control Software (AR4 HMI desktop application): Custom vendor application with no advisory database; its release numbers are not checkable software versions.
• wmctrl and libfuse2t64: Unpinned Ubuntu system packages; the version is whatever the OS installs on the day.
• rocker (OSRF Docker wrapper): Unpinned tool with no version stated in the documentation.
• arduino-ide 2.3.6: no package by this name in the registry
• windows 11: support status: version matches no release cycle on endoflife.date
• ros jazzy: support status: version matches no release cycle on endoflife.date

Parts

Substitutes

None needed.

Other dependencies

• 3D-printed structural parts (AR4-MK5/MK4/MK3-3D-Print-Files.zip, structural components, covers and spacers, misc, servo gripper CAD, travel-track CAD): fabrication dependency. If the department does not print in-house, a ready-made AR4 MK5 Robot 3D Printed Parts Set is $299.98 (white, lavender, gray and red all list at the same price). Print parameters — layer height, infill, PETG/ABS/PLA+ — are in the manual PDFs: not checked.
• Custom PCBs: none required. The materials contain no Gerber, Eagle or KiCad files; both controllers are commercial off-the-shelf boards wired to external drivers.
• Annin Robotics kits (the vendor's intended purchase route, prices from the same shopping search): AR4 MK5 Robot Combo Kit $1,189.00; AR4 MK5 Hardware Kit $319.00; AR4 MK5 Electrical Parts Kit $229.00.
• Annin Robotics resource portal and download host (www.anninrobotics.com, anninrobotics.com/wp-content/uploads/): live — the kits page was fetched successfully this run. It states plainly that the vendor does not sell motors and that the project is two purchases: the Annin combo kit, and the motors and drivers package direct from StepperOnline. Individual manual, CAD and firmware archive URLs were not fetched: not checked.
• StepperOnline AR4 package product page: could not be fetched this run (blocked, timeout, or gone), so live stock and the seller's own price are unverified. Reach it through the link on the Annin FAQ page.
• PJRC (www.pjrc.com/store/teensy41.html): live, fetched successfully. It confirms SparkFun now manufactures Teensy products, and restates the board's 3.3 V limit: "Teensy 4.1 pins accept 0 to 3.3V signals. The pins are not 5V tolerant."
• GitHub repositories (Annin-Robotics/ar4_ros_driver and Annin-Robotics/ar4-hmi): both live on branch main, listed successfully this run.
• Offline assembly manuals (AR4-MK5-Robot-Manul-1.1.pdf and siblings): indexed by the project but not present as text in the uploaded materials. Every mechanical dimension this check wanted to verify — bracket hole spacing, servo pocket, motor part numbers, gear ratios — lives in them: not checked.

Watch list

• SparkFun 20359 (Teensy 4.1) — effectively single-distributor. The ECIA record lists DigiKey as the only stocking distributor (860 units), with supply-chain risk rated Low-Med. The snapshot allows no substitute: the firmware depends on Teensy 4.1 pin assignments, interval timers and RAM. If that one warehouse empties, the lab stops.
• The stepper motor package — a single supplier relationship, not a catalogue part. The vendor's own page routes all motor purchases to StepperOnline, and this check could not read that page directly. If the partnership lapses, rebuilding the motor BOM requires the offline manuals.
• Same Sky AMT102-V — healthy today (Active, 3774 in stock), but note the manufacturer renamed from CUI Devices to Same Sky; search under both names at the next check so a rename is not mistaken for a discontinuation.
• Arduino Nano A000005 — no risk signal today (Active, 3498 at DigiKey, 7 authorized distributors with stock), but the classic ATmega328P Nano is a long-lived board whose retail variants shift toward USB-C. Confirm the connector type when reordering, and re-match the Mini-B cable to it.
• Retail commodity lines (E-stop, limit switches, servo, cables) — these have no fixed part number, so drift here shows up as the specific model vanishing rather than as a price move. Record whichever model is actually bought so the next check has a real baseline.