2023-12-05 13:58 UTC
I can finally reveal some research I've been involved with over the past year or so.
We (@redford, @mrtick and I) have reverse engineered the PLC code of NEWAG Impuls EMUs. These trains were locking up for arbitrary reasons after being serviced at third-party workshops. The manufacturer argued that this was because of malpractice by these workshops, and that they should be serviced by them instead of third parties.
1/4
Replies (1)
-
@q3k@social.hackerspace.pl 2023-12-05 13:59
We found that the PLC code actually contained logic that would lock up the train with bogus error codes after some date, or if the train wasn't running for a given time. One version of the controller actually contained GPS coordinates to contain the behaviour to third party workshops. It was also possible to unlock the trains by pressing a key combination in the cabin controls. None of this was documented. 2/4