EV BMS Cybersecurity Testing Now Made Mandatory in India

Key Highlights

• AIS-156 Amendment No. 5 adds BMS cybersecurity testing.

• Bluetooth, BLE and other wireless BMS interfaces are covered.

• Unauthorised access to safety-critical functions will be tested.

• Android and iOS devices can be used to simulate attacks.

• REESS makers must declare wireless interface and accessible functions.

India has strengthened safety rules for electric vehicles by introducing cybersecurity testing for Battery Management Systems (BMS) that use Bluetooth, Bluetooth Low Energy (BLE) or other wireless communication technologies.

The requirement has been added through Amendment No. 5 to AIS-156-2020, bringing wireless BMS security under the testing framework for L-category electric vehicles, including electric two- and three-wheelers.

What Has Changed Under AIS-156?

The amendment introduces a new Clause 6.12, specifically covering security testing of BMS units equipped with wireless interfaces. The main objective is to ensure that an unauthorised smartphone, mobile application or other device cannot connect to the BMS and operate safety-critical battery functions.

AIS-156 already included testing of BMS safety functions. However, the latest amendment expands the framework to check whether wireless communication can be misused to discover, connect to or send unauthorised commands to the BMS.

What Will Cybersecurity Testing Check?

The testing covers access to important live battery information and control functions. These include:

• Live BMS data such as voltage, current, temperature and state of charge.

• Opening or closing battery contactors or relays.

• Enabling or disabling charging and discharging.

• Controlling cell balancing functions.

• Resetting battery faults.

• Changing configuration parameters or protection thresholds.

• Reading, writing or updating BMS firmware through a wireless connection.

This means manufacturers must ensure that wireless connectivity cannot be used to interfere with functions that could affect vehicle or battery safety.

Why Has India Introduced This Requirement?

The move follows cybersecurity concerns involving Bluetooth-enabled BMS units used in some low-cost e-rickshaws. In July, CERT-In received reports that unauthorised individuals were using publicly available BMS mobile applications to abruptly switch off moving e-rickshaws.

The government said some BMS units used in low-cost e-rickshaws had default or no credentials. This could allow unauthorised users to connect to the system, change settings or stop battery discharge.

Following these concerns, the government took action against applications identified as capable of such misuse. The Ministry of Heavy Industries also issued an advisory regarding Bluetooth BMS vulnerabilities to SIAM, ACMA and vehicle testing agencies.

How Will BMS Cybersecurity Testing Be Conducted?

The prescribed test setup allows testing agencies to simulate attacks from unauthorised third-party applications and devices. Android and iOS smartphones can be used for testing. Agencies may also use Bluetooth protocol analysers or sniffers, generic BLE GATT browsers and Bluetooth Classic terminal applications to attempt device discovery, connection and command injection.

Testing can be performed using an actual vehicle or a bench rig with the battery pack powered. Where applicable, a simulated vehicle-running condition can also be created. Data loggers and CAN or UART analysers can record BMS responses, including contactor states and fault flags, helping testers determine whether unauthorised commands have affected the battery system.

Manufacturers Must Declare Wireless BMS Details

The amendment also places additional declaration requirements on REESS manufacturers. Manufacturers must provide details of the wireless interface, including the chipset, Bluetooth profiles, exposed services or characteristics, intended pairing method, and all commands and functions accessible through the wireless connection.

Importantly, testing must initially be performed with the battery system in its default configuration as supplied to the customer. Manufacturers cannot apply security hardening specifically for the test before the initial assessment. The battery pack must also be conditioned to a 40% to 60% state of charge, unless another level is specifically required.

What This Means for Electric Vehicle Safety

The new requirement marks an important shift in EV safety testing. Battery security is no longer limited to physical and electrical protection; wireless access to safety-critical BMS functions is also being examined.

For electric three-wheelers and other L-category EVs using connected BMS technology, the rules are designed to reduce the risk of unauthorised access, unexpected battery shutdowns, configuration changes and other potentially dangerous interference.

Also Read: Eicher EV Push Accelerates: Electric Truck and Bus Fleet Nears 2,000 Units

CMV360 Says

India’s updated AIS-156 requirements bring cybersecurity into the safety testing of wireless BMS systems used in L-category EVs. The move addresses real-world concerns around unauthorised access to Bluetooth-enabled battery systems, particularly in e-rickshaws. By testing wireless connections, commands, configuration changes and firmware access, the amendment aims to make connected EV batteries safer, more secure and harder to manipulate remotely.