![Coordinates of a third-party workshop extracted from PLC, overlaid on a map. Coordinates of a third-party workshop extracted from PLC, overlaid on a map.](https://object.ceph-waw3.hswaw.net/mastodon-prod/media_attachments/files/111/528/185/056/590/929/original/3b71c66145a1f05c.png)
![A Selectron CPU831 TCMS/PLC on a workbench, being probed and programmed. A Selectron CPU831 TCMS/PLC on a workbench, being probed and programmed.](https://object.ceph-waw3.hswaw.net/mastodon-prod/media_attachments/files/111/528/164/371/123/713/original/4753298f022e1259.png)
We found that the PLC code actually contained logic that would lock up the train with bogus error codes after some date, or if the train wasn't running for a given time. One version of the controller actually contained GPS coordinates to contain the behaviour to third party workshops.
It was also possible to unlock the trains by pressing a key combination in the cabin controls. None of this was documented.
2/4