“One version of the controller actually contained GPS coordinates to contain the behaviour to third party workshops.”
NEWAG’s Impuls trains kept locking up with bogus error codes after independent workshops serviced them. NEWAG blamed the workshops’ malpractice and said only NEWAG should do the work. Researchers pulled the PLC code and found lock logic tied to dates, idle time and workshop locations, plus an undocumented cabin key combo to unlock it. The malpractice was in the firmware.