How an IEC 62305-2:2024 risk assessment is calculated

A strike does not have to hit the clinic to count against it. The building gathers flashes from a zone of ground around it, the collection area, and the taller and larger it is, the wider that zone. The method works out four of these: the area for a direct flash to the structure (Ad), the area for a flash to the ground near it (Am), the area for a flash to the power line (Al), and the area for a flash near that line (Ai).

For the structure itself, picture the building footprint with a margin added all the way round, and that margin grows with height because a taller building reaches out to catch strikes that would otherwise have hit the nearby ground. Worked with the direct-strike formula of IEC 62305-2:2024 clause A.2.1.2, equation (A.3), for a 40 by 20 by 6 metre block, our clinic's direct-strike collection area Ad comes out at about 0.004 square kilometres (3 978 square metres). The near-strike area Am is a broader band around the building and comes out larger. The line areas Al and Ai depend on the length of the overhead power line and the strip of ground along it; for the example we take a single line giving an illustrative line collection area of about 0.04 square kilometres, not a value you can read off the standard.

The point of this step is simple: each thing exposed to lightning, the structure and every connected line, pulls strikes from its own patch of ground, and the size of that patch is the first number in the rate. A taller clinic, or a longer overhead line, would collect from a wider area and carry more risk before anything else is even considered.

With a collection area in hand, the rate of dangerous events is the local lightning activity multiplied by that area, then adjusted by a location factor for shielding. The lightning activity is the ground strike-point density, the number of ground strike points per square kilometre per year. Our example clinic sits in a location we gave a density of 3 strike points per square kilometre per year.

Multiply that density by the direct-strike collection area Ad of about 0.004 square kilometres (equation (A.5), clause A.2.4) and you get a base rate of 3 times 0.004, which is about 0.012 events per year, roughly one direct strike every eighty-four years. Because the clinic stands alone with nothing to shield it, its location factor stays at its full value rather than reducing the rate, so the adjusted rate for direct strikes stays near 0.012 per year. A building hemmed in by taller neighbours would carry a location factor that cut this figure down, and that is exactly how the method credits shielding. The same multiplication, density times area times location factor, gives the rate for the near-strike source and for each line source, using their own collection areas.

So the first term in every component, the rate, is now a concrete frequency: how many dangerous events of each kind the clinic faces per year. For our worked example we will carry the direct-strike rate of about 0.012 per year forward, and treat the line and near-strike rates the same way when their components come up. Remember the density and the location factor here are illustrative; the real strike-point density for a site and the real location factors come from the standard and the site data.

The rate tells you how often a dangerous event happens. The probability tells you how often that event actually causes the damage in question, and it is a number between zero and one. This is the term protection changes, so it is where the design conversation lives.

Take the danger to people from touch and step voltages near the clinic after a direct strike. With no protection in place, we set an illustrative probability of 1.0 for that harm: nothing is stopping the strike current reaching a person, so given the event the harm is taken as certain for the example. Now add a lightning protection system. An LPS captures the strike and leads it safely to earth, and a higher class captures a wider range of strike currents, so it cuts that probability hard. The class of system follows the lightning protection level; for the example, fitting a class II system pulls that probability down to 0.05, the value IEC 62305-2:2024 Table B.3 gives for a class II LPS, a twentyfold reduction in that one term. This is simplified: for injury from touch and step voltages the standard also multiplies in a reduction factor r_t for the ground or floor surface (equation (B.2), Table B.2), which on its own brings the probability to a hundredth or less. We leave it out so the arithmetic stays easy to follow. Coordinated surge protective devices do the same job for a different component: they might lower the probability that an induced surge from the power line knocks out the clinic's equipment from an illustrative 1.0 down to 0.03.

Each measure is credited only where it physically helps. The LPS lowers the probability of physical damage from a direct strike but does nothing for the surge arriving along the power line; the SPDs lower the surge-failure probability but do not stop a roof catching fire. Keeping the probabilities separate per component is what lets the calculation pick the right measures rather than over-fitting one. The SPD reduction shown is illustrative; the real probability values and the credit each measure earns come from the standard's tables.

The third term, the loss, scales the consequence. It is the fraction of what is at stake, life, the structure and its contents, or the function of the internal systems, that is lost when the damage actually occurs, and it captures the difference between a strike on an empty shed and one on a building full of people. For the clinic, the loss that matters most is injury to people, death included, because patients and staff are inside through the day and some cannot evacuate quickly.

Loss rises with the people exposed and with special hazards, and falls with measures that limit how far harm spreads. For the example we set an illustrative loss factor for injury from a strike of 0.01, reflecting an occupied but not crowded building with no explosive or flammable stock. A packed venue, or one with a hard-to-evacuate occupancy and flammable or explosive contents, would carry a higher loss factor and so a larger risk from the same strike. Going the other way, fire detection and suppression, compartmentation that stops a fire crossing the building, and bonding that limits the reach of touch and step voltages all reduce the loss. Because the loss multiplies the rate and the probability, cutting it is a real route to bringing a risk down even where the strike itself cannot be made less likely. As before, this 0.01 is an illustrative value for the worked example; the real loss factors come from the standard.

Now the three terms combine. A risk component is the rate multiplied by the probability multiplied by the loss. That single line is the engine of the whole assessment, and we can run it for the clinic with the numbers gathered so far.

Take the component for injury to people from a direct strike, before any protection. The rate was about 0.012 events per year, the probability of harm was 1.0, and the loss was 0.01. Multiply them: 0.012 times 1.0 times 0.01 gives an illustrative component value of about 0.00012 per year, written 1.2 times ten to the minus four. That one number is the annual risk this single way-of-being-harmed contributes. Now apply the class II LPS, which pulls the probability from 1.0 down to 0.05. The same component becomes 0.012 times 0.05 times 0.01, which is about 0.000006 per year, twenty times smaller, purely because one term in the product moved. Because this simplified example leaves out r_t, a real calculation of this component would come out smaller still.

This is the lever the assessment turns on. Halve a probability and you halve that component; cut the loss with fire measures and you shrink the consequence without touching how often strikes land. A real building has many components, one for each source-and-damage pairing, but every one is this same three-term product. Apart from the class II probability of 0.05 from IEC 62305-2:2024 (Ed.3) Table B.3, the values above are illustrative, chosen so the arithmetic is easy to follow.

One component is not the whole risk. The risk R is the sum of every component that can harm the people inside or damage the building at the clinic: injury from touch and step voltages, physical damage such as a fire that follows a strike, and the failure of any life-safety systems, from both direct strikes and strikes on the power line. You compute each relevant component as rate times probability times loss, then add them.

For the example, say the unprotected clinic has three components feeding the risk R: the injury component of about 0.00012 we worked out, a physical-damage component of about 0.00006, and an internal-failure-leading-to-harm component from the power line of about 0.00003. Add them and the illustrative risk R is roughly 0.00021 per year, written about 2 times ten to the minus four. The same summing builds the frequency of damage F from the components that bear on the availability of the internal systems, which would matter more for a data centre or a control room than for this clinic. The 2010 edition listed economic loss, public service and cultural heritage as categories of their own; the 2024 edition removed them and folded what remains into the three it defines. Most of our clinic's R comes from its injury part, R_L1, and R as a whole is the figure that decides its verdict. The numbers shown are illustrative example values, not figures from the standard.

With the risk R summed, the test is a single comparison. The combined risk R has a tolerable risk R_T it is judged against, and the frequency of damage F its own tolerable frequency, and the rule is plain: a value at or below its tolerable value passes, and a value above it means the building needs protection. Under the 2024 edition there is no separate economic test: pure economic loss and loss of service are covered by the frequency of damage F, which is judged against F_T like any other figure. The 2010 edition weighed a purely economic loss on cost and benefit instead, with no tolerable line.

For the worked example we use an illustrative tolerable risk R_T of 0.00001 per year, written ten to the minus five, the kind of small number a tolerable risk takes. Compare it with the unprotected clinic's risk R of about 0.00021 per year. The computed risk is well above the tolerable value, by roughly twenty times, so the unprotected clinic fails: it needs protection. The comparison is the verdict. A building can clear the risk R yet still fall down on the frequency of damage to its internal systems, which is why each figure is checked against its own tolerable value. Every number in this worked example is illustrative. IEC 62305-2 clause 7.3 NOTE 1 gives R_T = 1 × 10⁻⁵ per year as a representative value. The standard allows a different value after detailed investigation, and national or local regulation may fix R_T, F_T and the Annex A, B, C and E rules and parameter values. The value applied to a real assessment is stated in its jurisdiction line.

That single comparison is the answer the whole calculation exists to produce: does this building need lightning protection, yes or no, for each kind of loss it is exposed to. Everything before it, the inputs, the areas, the rate, the probabilities, the losses and the components, exists to make this verdict defensible and traceable back to the clause behind each number.

A failed risk is not the end of the assessment, it is the start of the design. You add the measures that act on the components carrying most of the risk, recompute those components, and re-sum the risk, repeating until it sits below the tolerable value. Because the method shows which components dominate, the choice of measure is targeted rather than a blanket specification.

For the clinic, the risk R was dominated by physical damage and life safety from direct strikes, so we fit the class II LPS from Step 4. That pulled the injury component from about 0.00012 down to about 0.000006, and the physical-damage component down in step, from 0.00006 to about 0.000003. Adding coordinated SPDs on the incoming power line cut the surge-failure component from 0.00003 to about 0.0000009. Re-summing the reduced components, the illustrative protected risk R falls to roughly 0.0000099 per year, just under the tolerable 0.00001. The clinic passes, if only just, and the assessment records exactly which measures earned the pass. Had it still failed, you would add the next measure, fire detection and compartmentation to cut the loss, or a higher LPS class to cut the probability further, and recompute again. These figures stay illustrative throughout; a real recomputation uses the standard's coefficients for every measure.

The chain above is exact but unforgiving by hand: dozens of components, each with its own collection area, rate, probability and loss, all recomputed every time a measure is added or a dimension changes. Lumex^™, our IEC 62305 platform, runs the full IEC 62305-2:2024 method on the building you describe with the real coefficients from the standard, computes every component, compares each risk against its tolerable value, and shows which measures bring a failing risk into line, with the reasoning traceable clause by clause. See how an IEC 62305 assessment works or explore the platform. To go deeper on the concepts, read the IEC 62305-2 risk assessment method, or start from what is IEC 62305.