It can be controlled by a single chip microcomputer. Some elevators in OTS are controlled by single chip microcomputer, so is Toshiba's.
Some are controlled by CPLD/FPGA, and some are controlled by DSP(OTS high-end elevator), with different complexity.
From the program analysis, it is necessary to record the running times, even after the power failure, the previous use times will be recorded. From the hardware analysis, whether using single chip microcomputer, CPLD/FPGA or DSP, all internal parameters will disappear after power failure and will be automatically reset after power on. This is the basic working mode of hardware, so all data generated after power failure must be recorded by external memory chips, such as E2PROM and FLASH, if it is needed next time.
Theoretically, it can be cracked by the same processor that controls external storage, and the circuit can be completely realized, but there is still a problem, that is, coding;
If it only plays the role of simply recording the running times, I think if I write this program, I may think of encryption, such as 1 I XOR with ASCII code, or do encryption calculation in other ways, which may produce garbled codes such as SG*33T9#, but I can decrypt it through the inverse algorithm of my encryption, and the data stored in the external ROM is my encrypted data. In this case, even if other circuits are used to read data from external rom, there is no way to decrypt it.
Unless you are very familiar with the structure of the circuit and the encryption method of general elevator control, it is difficult to crack. Unless you completely replace the chip and then write your own program to run the elevator. This method is possible. But you need a lot of knowledge, whether it is software or hardware, and you need a certain depth of knowledge to complete it. You know, if you change the chip and write the program independently, you can even make your own elevator.
But the elevator is not complicated, it is very simple. Mainly physical structure.