ELEVATOR ARRANGEMENT AND OPERATION METHOD WITH OPTION FOR TEMPORAL, DISABLING EXTERNAL CONTROL

Abstract

 An elevator arrangement (1) and a method for operating the same are described. The elevator arrangement comprises
- a car (3) being displaceable along a travel path (5),
- a drive unit (7) for displacing the car,
- an elevator controller (9) for controlling the drive unit in accordance with control instructions,
- internal instructing devices (11) for generating internal control instructions and submitting the internal control instructions to the elevator controller,
- an edge device (13) being configured for receiving external control instructions incoming via a data network (15) and submitting the external control instructions to the elevator controller, the edge device furthermore being configured for forwarding outgoing data via the data network, and
- a switch (17) for switching between different network access policies in the edge device. The edge device is configured for selectively implementing a firewall in a default configuration in accordance with a default network access policy or in a restricted configuration in accordance with a restricted network access policy. In the default configuration, the edge device forwards incoming external control instructions to the elevator controller and forwards outgoing data via the data network. In the restricted configuration, the edge device blocks incoming external control instructions from being forwarded to the elevator controller but forwards outgoing data via the data network.

Description

[0001] The present invention relates to an elevator arrangement. Furthermore, the invention relates to a method of operating an elevator arrangement, to a computer program product for implementing such method and to a computer readable medium storing such computer program product.

[0002] In an elevator arrangement, one or more cars are displaceable along a travel path upon being driven by one or more drive units. An elevator controller controls the drive unit(s) in accordance with control instructions. Conventionally, the elevator controller receives such control instructions from internal instructing devices being part of the elevator arrangement. Inter-alia, such internal instructing devices may be actuated by passengers e.g. for sending a call request to the elevator controller, indicating that the elevator car shall be sent to a specific floor. For example, such internal instructing devices may be push buttons at a car operation panel (COP) arranged within the car or a landing operation panel (LOP) arranged at one or each of multiple landings between which the car is to be displaced. Alternatively, the elevator controller may receive control instructions from other types of internal instructing devices such as contactless actuators, communication devices for communicating with a passenger's personal portable device (such as a smart phone), etc.

[0003] For specific purposes, such as for maintaining the elevator arrangement or in emergency cases where e.g. firemen require full control over the elevator arrangement, the elevator arrangement may be adapted for temporarily suppressing any communication of control instructions from internal instructing devices to the elevator controller. For example, for such suppression, a communication channel between the internal instructing devices and the elevator controller may be temporarily interrupted. Accordingly, for example a maintenance technician or firemen may obtain control over the elevator arrangement without being disturbed by the elevator arrangement being controlled in accordance to any control instructions received from internal instructing devices.

[0004] However, in modern elevator arrangements, there may be a further option for controlling the operation of the elevator arrangement, such option being referred to as remote controlling. For such remote controlling, the elevator arrangement generally further comprises an edge device. Such edge device is configured for receiving external control instructions via a data network. The data network may be the Internet or any other network connecting the elevator arrangement with external instructing devices being arranged remote to the elevator arrangement. The edge device may also be referred to as gateway and is generally configured for receiving the external control instructions incoming via the data network and submitting the external control instructions to the elevator controller. As the elevator controller may control the drive unit in accordance to such external control instructions, the operation of the elevator arrangement may be controlled remotely. For example, as one option, a passenger may use his smart phone to submit a request indicating that the elevator car is to be sent to a specific landing floor, such request being transmitted to a data cloud and then being forwarded to the edge device via the Internet serving as the data network and the edge device finally submitting the request to the elevator controller.

[0005] Furthermore, in modern elevator arrangements, telemonitoring (sometimes also referred to as remote monitoring) may be implemented. In such telemonitoring, data representing conditions within the elevator arrangement are acquired using e.g. data provided by sensors in the elevator arrangement and/or data provided by instructing devices and/or controllers of the elevator arrangement. Such acquired data may then be transmitted to the edge device which may then forward such data as outgoing data via the data network to e.g. an external monitoring unit. Accordingly, conditions and/or operations of the elevator arrangement may be remotely supervised.

[0006] For the above-mentioned specific purposes such as for maintaining the elevator arrangement or during an emergency, influencing an operation of the elevator arrangement as a result of remote controlling such operation is generally to be avoided.

[0007] Accordingly, there may be a need for an elevator arrangement enabling remote controlling as well as telemonitoring but also enabling temporarily suppressing any remote controlling. Furthermore, there may be a need for a method for operating the elevator arrangement such as to, in some conditions, enable remote controlling as well as telemonitoring whereas, in other conditions, disable remote controlling. Finally, there may be a need for a computer program product and a computer readable medium for implementing such method.

[0008] Such needs may be met with the subject-matter of the independent claims. Advantageous embodiments are defined in the dependent claims, described throughout the specification and/or visualised in the figures.

[0009] According to a first aspect of the present invention, an elevator arrangement is described. The elevator arrangement comprises a car, a drive unit, an elevator controller, several internal instructing devices, an edge device and a switch. The car is displaceable along a travel path. The drive unit is configured for displacing the car. The elevator controller is configured for controlling the drive unit in accordance with control instructions. The internal instructing devices is configured for generating internal control instructions and submitting the internal control instructions to the elevator controller. The edge device is configured for receiving external control instructions incoming via a data network and submitting the external control instructions to the elevator controller, the edge device furthermore being configured for forwarding outgoing data via the data network. The switch is configured for switching between different network access policies in the edge device. Therein, the edge device is configured for selectively implementing a firewall in one of a default configuration in accordance with a default network access policy and a restricted configuration in accordance with a restricted network access policy. In the default configuration, the edge device forwards incoming external control instructions to the controller and forwards outgoing data via the data network. In the restricted configuration, the edge device blocks incoming external control instructions from being forwarded to the controller but forwards outgoing data via the data network.

[0010] According to a second aspect, a method of operating an elevator arrangement is described. Therein, the elevator arrangement comprises a car, a drive unit, an elevator controller, internal instructing devices, an edge device and a switch, wherein all of these components may have the characteristics as described for embodiments of the first aspect of the invention. The method comprises at least a step of controlling the drive unit by the elevator controller based on control instructions submitted to the elevator controller from one of the instructing devices and the edge device. Therein, upon receiving a first signal from the switch, the edge device operates in a default configuration in which the edge device forwards incoming external control instructions to the elevator controller and forwards outgoing data via the data network. Furthermore, upon receiving a second signal from the switch, the edge device operates in a restricted configuration in which the edge device blocks incoming external control instructions from being forwarded to the elevator controller but forwards outgoing data via the data network.

[0011] According to a third aspect of the invention, a computer program product is described as comprising computer readable instructions which, when performed by a processor of an edge device in an elevator arrangement, instruct the edge device to perform the method according to an embodiment of the second aspect of the invention.

[0012] According to a fourth aspect of the invention, a computer readable medium is described, the computer readable medium comprising a computer program product according to an embodiment of the third aspect of the invention stored thereon.

[0013] Briefly summarised and without limiting the scope of the invention, basic ideas underlying embodiments of the invention and associated possible advantages will be roughly described as follows:
The approach described herein uses the capability of an edge device comprised in the elevator arrangement to manage data communication between the elevator control internal to the elevator arrangement and data processing devices external to the elevator arrangement in accordance with a network access policy. Such network access policy may be realised by suitably implementing a firewall within the edge device. According to the approach presented herein, the edge device is configured for implementing such firewall in different configurations. In a first configuration referred to herein as default configuration, the edge device is adapted such as to implement communication of external control instructions which are incoming via the data network and which are then forwarded by the edge device towards the elevator controller. In a second configuration referred to herein as restricted configuration, such communication of external control instructions is temporarily suppressed. The elevator arrangement comprises a specific switch via which the edge device may be switched between the different network access policies for activating either the default configuration or the restricted configuration.

[0014] Accordingly, by suitably setting the switch, the edge device may be set to its restricted configuration, thereby preventing any external control instructions to be forwarded towards the elevator controller. Therefore, in such situation, the elevator controller is prevented from controlling the displacement of the car due to receiving external control instructions, thereby allowing e.g. a maintenance technician to have full control of any car displacements.

[0015] However, while the remote control of car displacements may be temporarily suppressed by switching the edge device to its restricted configuration, telemonitoring functionalities shall still be operative independent of whether the edge device is switched to its default configuration or to its restricted configuration. Accordingly, both the default network access policy as well as the restricted network access policy defining that the edge device being in its default configuration or its restricted configuration, respectively, shall in all cases be adapted for forwarding data such as telemonitoring data via the data network towards the external data processing device. Accordingly, the elevator arrangement's capabilities for telemonitoring may be maintained also during the edge device being switched to its restricted configuration.

[0016] Overall, by suitably programming the firewall in the edge device, the edge device may be suitably configured for, in the default configuration, allowing remote controlling as well as telemonitoring whereas, in the restricted configuration, denying remote controlling while still enabling telemonitoring.

[0017] Therein, the approach described herein may be purely software-based, i.e. the default configuration and the restricted configuration may be implemented within the edge device using software only. In other words, conventional progammable edge devices may be used for realising the approach described herein and no hardware modifications need to be included in such edge devices but the different network access policies may be defined by software only.

[0018] In the following, possible features of embodiments of the invention and associated possible advantages will be described in more detail.

[0019] As indicated further above, modern elevator arrangements may be adapted for remote controlling as well as telemonitoring functionalities. For implementing such functionalities, an edge device included in the elevator arrangement manages a communication of control instructions and telemonitoring data. The control instructions are received via a data network to which the edge device is connected and may then be forwarded by the edge device towards the elevator controller. In the other direction, telemonitoring data may be received from inside the elevator arrangement and may then be forwarded by the edge device via the data network towards an external device such as a monitoring device.

[0020] During e.g. elevator maintenance, a technician generally has to make sure that the elevator car is under his exclusive control and no unintended car displacements occur.

[0021] As a brute force solution for obtaining such exclusive control, the technician conventionally suppresses all remote controlling functionalities by e.g. shutting down components of associated remote communication systems such as the edge device, the Internet gateway, etc. In a most simple approach, the technician just interrupts energy supply to such components or disengages signal plugs used for transferring signals between the edge device and the data network or between the edge device and the elevator controller.

[0022] However, in such brute force solution, not only remote controlling is suppressed but also telemonitoring functionalities are interrupted. Such interruption may result in insufficient supervision of the elevator arrangement and for example critical conditions within the elevator arrangement being no more correctly detected.

[0023] In order to avoid such insufficient supervision by continuously enabling telemonitoring while still providing the option for temporarily suppressing any remote controlling of the elevator arrangement, it is proposed herein to suitably adapt the functionalities of the edge device in the elevator arrangement.

[0024] Particularly, firewall functionalities in such edge device shall be adapted such that the edge device may be selectively operated either in a default configuration in which the firewall follows a default network access policy or in a restricted configuration in which the firewall follows a restricted network access policy. Both, the default configuration and the restricted configuration may be implemented in the edge device using suitable software programming.

[0025] Therein, in contrast to being in the default configuration, the edge device being in the restricted configuration does not forward incoming external control instructions to the elevator controller but blocks such incoming instructions, thereby preventing the elevator controller from displacing the car in reaction to any external control instructions.

[0026] However, in both, the default configuration and the restricted configuration, full telemonitoring functionality is maintained by enabling the edge device to forward outgoing data via the data network towards e.g. an external telemonitoring data processing device.

[0027] According to an embodiment, the switch is switchable between two switching statuses. Therein, in a first switching status, the switch sends a first signal to the edge device indicating that the edge device is to implement the default configuration in accordance with the default network access policy and, in a second switching status, the switch sends a second signal, which is different from the first signal, to the edge device indicating that the edge device is to implement the restricted configuration in accordance with the restricted network access policy.

[0028] In other words, while the switch itself may be a physical device, it may not be configured for mechanically interact with the edge device. Instead, the switch may only send first and second signals to the edge device for informing the edge device about its current switching status. Accordingly, while the switching status of the switch may correlate with a mechanical configuration of the switch, i.e. the switch may be actuated for example between different positional configurations, the switching status does not necessarily imply any mechanical modifications at the edge device but the information about the switching status is transmitted to the edge device only via signals such as electrical signals. Such signals may be interpreted within the edge device for suitably setting the edge device to its default configuration or its restricted configuration, respectively.

[0029] According to an embodiment, the edge device is configured for communicating with the elevator controller via a communication channel. The switch is then configured for communicating with the edge device but not interfering with the communication channel between the edge device and the elevator controller.

[0030] Expressed differently, a data communication between the edge device and the elevator controller may be established using a communication channel. Such communication channel may be a simple electric line extending between both components. Alternatively, the communication channel may be established using wireless data communication. While setting the switch to different switching statuses shall determine whether the edge device is set to its default configuration or to its restricted configuration, thereby determining whether the edge device forwards incoming external control instructions to the elevator controller or not, the switch shall preferably not directly interfere with the communication channel between the edge device and the elevator controller. Particularly, the switch shall not, depending on its switching status, selectively directly or indirectly interrupt the communication channel. More specifically, in case the communication channel is established with an electric line, switching the switch shall not induce selectively and reversibly interrupting such line. Instead, as an alternative to any mechanical interference between the switch and the communication channel, only information about the switching status of the switch shall be transmitted to the edge device which may, in reaction thereto, be switched to its restricted configuration. Therein, while the communication channel between the edge device and the elevator controller would still be operative in such restricted configuration, it is not used for transmitting any external control instructions to the elevator controller as such external control instructions are blocked internally within the edge device.

[0031] According to an embodiment, in both the default configuration and the restricted configuration, the edge device receives telemonitoring data from control components, actuator components and/or sensor components internal to the elevator arrangement and forwards such telemonitoring data as the outgoing data via the network to a monitoring device external to the elevator arrangement.

[0032] In other words, independent of its current configuration status, the edge device may receive data which are suitable for telemonitoring and may forward such telemonitoring data to an external unit which may use these data for example for supervising the elevator arrangement. Such telemonitoring capability shall not be interrupted even when the edge device is set to its restricted configuration. The telemonitoring data may be acquired from various internal components of same or different component types. Such internal component may be a sensor component configured for detecting or sensing conditions within the elevator arrangement. For example, such sensor component may be at least one of a temperature sensor, a humidity sensor, an air pressure sensor, a light sensor, an acoustic sensor, etc. Alternatively, the internal component may be an actuator component configured for actively actuating conditions within the elevator arrangement. For example, such actuator component may be an electric motor, a hydraulics, a pneumatics, etc. As a further alternative, the internal component may be a control component configured for controlling conditions within the elevator arrangement. Such control component may for example control an actuator component and/or may process data or signals received from a sensor component. The internal components may be interconnected with the edge device for establishing data communication in one or more directions towards and/or from the edge device. Optionally, the internal components may be also interconnected with each other. The internal components may be adapted for providing the telemonitoring data continuously or repeatedly or periodically.

[0033] According to an embodiment, the switch is configured for controlling the different network access policies in the edge device exclusively upon an activation of the switch being authorized.

[0034] Expressed differently, the switch may be configured such that it may not be actuated by any arbitrary person but requires an authorisation before being actuatable. For example, a person may have to identify and/or authorise an actuation of the switch by using an authorisation device or entering an authorisation code. For example, such authorisation device may be a key, a data storage device comprising authorisation data stored therein, etc. Accordingly, for example a maintenance technician may authorise actuating the switch and thereby temporarily disabling any remote controlling of the elevator arrangement, while actuating the switch by a non-authorised person is prevented.

[0035] According to an embodiment, the switch is a physical switch device.

[0036] In other words, the switch may be implemented as a physical device which may be actuated e.g. mechanically. For example, the switch may be a mechanical switch device having two switching positions and providing signals depending on its current switching position. Such a physical switch device may be located at a position where it is easily accessible for example for a maintenance technician. Particularly, such physical switch device may be located at a position having restricted access such that for example an authorised technician may actuate the switch but a non-authorised person as no access to the switch.

[0037] According to a specific embodiment, the switch is a key switch.

[0038] Such key switch may only be actuated upon an authorisation key authorises such actuation. For example, the key switch may comprise a mechanical lock locking an actuation of the switch unless being unlocked by a mechanical key. Alternatively, other types of key switches may be used, such key switches being unlocked using e.g. magnetical codes, optical codes, acoustic codes, etc.

[0039] In embodiments of the method of operating an elevator arrangement according to the second aspect of the invention, the elevator controller may control the operation of the drive unit and thereby displace the elevator car either based on internal control instructions which are received by the elevator controller from the internal instruction devices (i.e. from e.g. the car operation panel, landing operation panel, etc.) or based on external control instructions which have been generated e.g. in a remote controlling device and which have been transmitted via an external network such as the Internet to the edge device and are then forwarded to the elevator controller.

[0040] However, according to the proposed method, such forwarding of external control instructions may be temporarily suppressed by setting the edge device to its restriction configuration upon receiving a specific signal from a switch indicating that the edge device shall be operated in accordance with a restricted network access policy. Furthermore, according to the proposed method, even when being in its restricted configuration, the edge device shall continue to forward outgoing data such as telemonitoring data via the data network towards e.g. an external telemonitoring device.

[0041] A computer program product according to embodiments of the third aspect of the invention comprises computer readable instructions in any suitable computer language. Such instructions may program the edge device of the elevator arrangement. Particularly, a processor in such edge device may be instructed to perform, execute or control the method described herein upon performing the instructions of the computer program.

[0042] Such computer program may be stored on a computer readable medium according to an embodiment of the fourth aspect of the invention. Such medium may store the instructions permanently or non-permanently. For example, such medium may portable and may be e.g. a CD, a DVD, a flash memory, a ROM, a PROM, an EPROM, etc. Alternatively, the computer readable medium may be another computer, server or part of a data cloud from which the computer program may be downloaded via a network such as the Internet.

[0043] It shall be noted that possible features and advantages of embodiments of the invention are described herein partly with respect to an elevator arrangement and partly with respect to a method for operating an elevator arrangement. One skilled in the art will recognize that the features may be suitably transferred from one embodiment to another and features may be modified, adapted, combined and/or replaced, etc. in order to come to further embodiments of the invention.

[0044] In the following, advantageous embodiments of the invention will be described with reference to the enclosed drawing. However, neither the drawing nor the description shall be interpreted as limiting the invention.

[0045] Fig. 1 shows an elevator arrangement according to an embodiment of the present invention.

[0046] The figure is only schematic and not to scale. Same reference signs refer to same or similar features.

[0047] Fig. 1 shows an elevator arrangement 1. The elevator arrangement 1 comprises a car 3 which may be displaced vertically along a travel path 5 throughout an elevator shaft 6. A drive unit 7 is connected to the car 3 via suspension means 8 and may thereby displace the car 3. The drive unit 7 is controlled by an elevator controller 9 in accordance to control instructions.

[0048] Such control instructions may be generated as internal control instructions by internal instructing devices 11. Such internal instructing devices 11 may be for example call buttons 31 provided at a landing operation panel 33 or floor selection buttons 35 provided at a car operation panel 37. The internal instructing devices 11 may be part of the elevator arrangement 1 and may directly communicate with the elevator controller 9 for example via wirings and/or wireless communication within the elevator arrangement 1.

[0049] Alternatively, control instructions may be generated as external control instructions for example at an external remote control and/or monitoring device 27. Such external control instructions may then be submitted to the elevator arrangement 1 via a data network 15 such as the Internet and may be received at an edge device 13 forming an Internet gateway for the elevator arrangement 1. The edge device 13 may communicate with the elevator controller 9 via a communication channel 19. Such communication channel may be wiring-based or wireless. Upon the elevator controller 9 receiving such external control instructions, it may control displacements of the car 3 accordingly. Thereby, remote controlling of the elevator arrangement 1 may be established.

[0050] Furthermore, the edge device 13 may receive telemonitoring data from various internal components including control components 21, actuator components 23 and/or sensor components 25. The edge device 13 may then forward such telemonitoring data via the data network 15 connected thereto towards the external remote control and/or monitoring device 27.

[0051] In order to control data communication throughout the edge device 13, a firewall is implemented in the edge device 13. Such firewall operates in accordance to a network access policy defining which data are allowed to be transmitted and which data are to be blocked.

[0052] Specifically, the firewall implemented in the edge device 13 is adapted to operate in accordance to either a default network access policy, thereby setting the edge device to a default configuration, or in accordance with a restricted network access policy, thereby setting the edge device 13 to a restricted configuration.

[0053] In the default configuration, the edge device 13 may both, forward incoming external control instructions to the elevator controller 9 as well as forward outgoing data via the data network 15 towards the external remote control and/or monitoring device 27.

[0054] In contrast hereto, in its restricted configuration, the edge device 13 blocks incoming external control instructions such that these remotely generated instructions are not forwarded to the elevator controller 9, thereby temporarily suppressing remote controlling the elevator arrangement 1.

[0055] However, even in its restricted configuration, the edge device 13 continues forwarding outgoing data such as telemonitoring data via the data network 15 towards the external remote control and/or monitoring device 27, thereby maintaining telemonitoring functionalities.

[0056] Whether or not the edge device 13 is to be operated in its default configuration or in its restricted configuration may be determined using a switch 17. Such switch 17 may be a key switch 29 which may only be actuated or modified with regards to its switching status upon a preceding authorisation. Accordingly, only authorised personal may for example actuate the switch 17 from a first switching status to a second switching status, or vice versa. In the first switching status, the switch 17 sends a first signal to the edge device 13, thereby instructing the edge device 13 to operate in accordance with the default network access policy. In the second switching status, the switch 17 sends a second signal to the edge device 13, thereby determining that the edge device 13 operates in accordance with the restricted network access policy.

[0057] Finally, possible implementations and characteristics of the approach described herein are once more explained in a slightly different wording as follows:
Currently, there is no easy way for a fitter, fire fighter, or any other authorized user who needs full control of an elevator system, to exclude uncontrolled injection of operations from remote computers (e.g., from the Cloud). This could lead to hazardous situations, or uncertainties about a stability of the state of the elevator system during maintenance operation.

[0058] A brute force solution would involve the manual shut down of remote communication systems (e.g., the Internet gateway or edge device). However, that would also lead to a failure of standard telemonitoring messages, or even the alarming system, if implemented with Internet technologies (e.g., Voice over IP).

[0059] Therefore, a more fine-grained approach is presented that allows to manually control the shutting down of non-critical remote functionality.

[0060] Embodiments of the invention may include the following components:

1) A local group of elevators, connected in a local network, interfaced to the internet via a gateway, or to external components (e.g., a Lobby computer) that could be connected to the Internet, or inject messages from a remote location

2) A group wide switch controlling different network access policies (set by internal firewall rules). The switch has two different states:

a. Default: all authenticated and authorized incoming interactions are allowed

b. Restricted: all incoming interactions are unconditionally disabled

3) A dual Firewall configuration available on each elevator

a. A default configuration, which allows incoming authorized messages (e.g., remote requests of servicing a call)

b. A restricted configuration, which blocks all incoming messages which are not part of the local network of elevators and components

4) SW support on each control to dynamically allow the swapping of Firewalls rules

[0061] Embodiments of the invention may therefore be interpreted as including the single mapping of the switch to the two different network firewall rules.

[0062] This variant of the solution describes a group wide switch that will control the incoming traffic for all elevators in the group at once. Different embodiments might include the possibility of lift switches controlling the incoming traffic for each individual elevator.

[0063] A typical scenario that illustrates the rationale of an embodiment of the invention is as follows:

1) Elevator group is in passenger operation mode. Active firewall is the default one. All authorized external messages are allowed. For instance, a remote call to elevators can therefore be issued. Manual switch is in the "default position".

2) A technician requires undisturbed full access to the group of elevators. Therefore, it turns the switch to "restricted"

3) Each elevator in the system replaces the internal firewall rules with the restricted version, and reinitialize communication. Internet based necessary services, like telemonitoring and alarm communication, will still be enabled

4) Technician can service the elevator system with the confidence of being insulated from possible external interactions

5) When finished, technician will return the switch to the "default" position to allow back remote injection of messages

6) Each controller swaps back the firewall rules files, and re-initialize the communication

[0064] Finally, it should be noted that the term "comprising" does not exclude other elements or steps and the "a" or "an" does not exclude a plurality. Also elements described in association with different embodiments may be combined. It should also be noted that reference signs in the claims should not be construed as limiting the scope of the claims.

Claims

1. Elevator arrangement (1) comprising:

a car (3) being displaceable along a travel path (5),

a drive unit (7) for displacing the car (3),

an elevator controller (9) for controlling the drive unit (7) in accordance with control instructions,

internal instructing devices (11) for generating internal control instructions and submitting the internal control instructions to the elevator controller (9),

an edge device (13) being configured for receiving external control instructions incoming via a data network (15) and submitting the external control instructions to the elevator controller (9), the edge device (13) furthermore being configured for forwarding outgoing data via the data network (15),

a switch (17) for switching between different network access policies in the edge device (13),

wherein the edge device (13) is configured for selectively implementing a firewall in one of a default configuration in accordance with a default network access policy and a restricted configuration in accordance with a restricted network access policy, wherein, in the default configuration, the edge device (13) forwards incoming external control instructions to the elevator controller and forwards outgoing data via the data network (15),

wherein, in the restricted configuration, the edge device (13) blocks incoming external control instructions from being forwarded to the elevator controller but forwards outgoing data via the data network (15).

2. Elevator arrangement of claim 1,

wherein the switch (17) is switchable between two switching statuses, wherein, in a first switching status, the switch (17) sends a first signal to the edge device (13) indicating that the edge device (13) is to implement the default configuration in accordance with the default network access policy and,

wherein, in a second switching status, the switch (17) sends a second signal, which is different from the first signal, to the edge device (13) indicating that the edge device (13) is to implement the restricted configuration in accordance with the restricted network access policy.

3. Elevator arrangement of one of the preceding claims,

wherein the edge device (13) is configured for communicating with the elevator controller (9) via a communication channel (19),

wherein the switch (17) is configured for communicating with the edge device (13) but not interfering with the communication channel (19) between the edge device (13) and the elevator controller (9).

4. Elevator arrangement of one of the preceding claims,
wherein, in both the default configuration and the restricted configuration, the edge device (13) receives telemonitoring data from at least one of control components (21), actuator components (23) and sensor components (25) internal to the elevator arrangement (1) and forwards such telemonitoring data as the outgoing data via the network (15) to a monitoring device (27) external to the elevator arrangement (1).

5. Elevator arrangement of one of the preceding claims,
wherein the switch (17) is configured for controlling the different network access policies in the edge device (13) exclusively upon an activation of the switch (17) being authorized.

6. Elevator arrangement of one of the preceding claims,
wherein the switch (17) is a physical switch device.

7. Elevator arrangement of one of the preceding claims,
wherein the switch (17) is a key switch (29).

8. Method of operating an elevator arrangement,

the elevator arrangement (1) comprising:

a car (3) being displaceable along a travel path (5),

a drive unit (7) for displacing the car (3),

an elevator controller (9) for controlling the drive unit (7) in accordance with control instructions,

internal instructing devices (11) for generating internal control instructions and

submitting the internal control instructions to the elevator controller (9),

an edge device (13) being configured for receiving external control instructions incoming via a data network (15) and submitting the external control instructions to the elevator controller (9), the edge device (13) furthermore being configured for forwarding outgoing data via the data network (15), and

a switch (17),

wherein the method comprises:

controlling the drive unit (7) by the elevator controller (9) based on control instructions submitted to the elevator controller (9) from one of the instructing devices (11) and the edge device (13),

wherein, upon receiving a first signal from the switch (17), the edge device (13) operates in a default configuration in which the edge device (13) forwards incoming external control instructions to the elevator controller (9) and forwards outgoing data via the data network (15),

wherein, upon receiving a second signal from the switch (17), the edge device (13) operates in a restricted configuration in which the edge device (13) blocks incoming external control instructions from being forwarded to the elevator controller (9) but forwards outgoing data via the data network (15).

9. Computer program product comprising computer readable instructions which, when performed by a processor of an edge device (13) in an elevator arrangement (1), instruct the edge device (13) to one of performing, executing and controlling the method according to claim 8.

10. Computer readable medium comprising a computer program product according to claim 9 stored thereon.

Drawing