Lightning risk assessment for data centres

A data centre can lose service without anything catching fire and without a single direct strike on the building. One surge induced on an incoming power or data line is enough to reach the racks and take down internal systems, and the outage that follows hits every user the facility serves. That is why the asset a data centre has to protect is continuity of service, not the structure, and why an IEC 62305 risk assessment for one looks different from an assessment of an ordinary building.

The standard and its method do not change for a data centre; what changes is where the risk sits. The value and the vulnerability are in the electronics, so the failure of internal systems from a strike-induced surge becomes the central concern, the risks tied to loss of service and economic loss carry the weight, and the many lines entering the building become the paths the engineer has to worry about most. This guide explains why data centres are an extreme case, which risks dominate, why internal-system failure leads, how incoming lines drive the result, how the assessment supports uptime expectations, and what makes modelling one different in practice.

IEC 62305 produces a risk of loss of human life, R, and a separate frequency of damage, F, for the availability of the internal systems, and it recognises the loss categories L1 to L4 (loss of human life, loss of service to the public, loss of cultural heritage and economic loss). For most occupied buildings the risk R leads, because the worst outcome of a strike is harm to the people inside. A data centre shifts that balance. The buildings are often lightly staffed or unmanned, but they deliver a service that many people and businesses depend on, and an interruption is expensive by the hour.

So the frequency of damage F, the availability of the internal systems, and the economic loss usually carry the most weight in a data centre study. An outage affects every customer the facility serves, and the frequency of damage measures how often a strike would cause it, while the cost of that downtime, lost transactions, broken service-level commitments, recovery work, is the economic loss weighed alongside. The risk of loss of human life R still has to be assessed and still has to pass, because staff and visitors can be present, but it is rarely the figure that decides the protection. This is close to the reverse of a hospital or a crowded public building, where life safety is the whole point, and it changes which loss the assessment is really driving down.

New to how the risk R and the frequency of damage F are built? The IEC 62305-2 risk method sets out how each is assembled from its components, and what is IEC 62305 covers the damage and loss model the risks rest on.

A data centre is one of the most heavily connected buildings there is. Beyond its power feeds it takes in a large number of data and telecom lines, often from more than one provider and over more than one route for redundancy. Every one of those connections is a path a strike-induced surge can travel along into the facility, which is why the lines, rather than the roof, are usually where the assessment finds most of the risk.

Two properties of each line drive its contribution. The length of a line sets how much of the surrounding ground a strike near it can couple into the cable, so a long external run collects more than a short one. The routing, whether the line runs overhead or buried, screened or unscreened, alongside other services or alone, changes how much of a nearby strike actually reaches the building. Together these set the line-related risk components, and on a facility with many long connected lines those components often outweigh the risk from a direct strike on the structure itself.

This is the part of the IEC 62305 method that a single occupied building rarely stresses and that a data centre stresses hard, much as a telecom site does for the lines feeding its equipment shelter. Getting the count, the lengths and the routing of the connected lines right, and the SPDs that protect each entry, is what decides the answer for this kind of facility.

Data centres are built and sold on availability. Uptime tiers and the redundancy behind them, duplicated power paths, backup generation, redundant cooling, exist to keep service running through a fault. Lightning is one of the threats to that availability, and it is one the redundant mechanical and electrical design does not fully answer, because an induced surge can reach equipment on more than one power path at once.

An IEC 62305 assessment supports the availability target by putting a number on it. It estimates how often a strike-related event could cause an outage and shows that the surge protection, bonding, shielding and zoning bring that frequency below an acceptable level. It does not replace the redundant power and cooling that uptime tiers are built on, and it is not the same exercise as a tier certification. What it gives is the recognised evidence that the lightning threat to continuity has been assessed on the numbers and controlled, rather than left as an assumption that the building is probably fine.

Lumex models a data centre as a structure with its zones, its incoming power and data lines and its protection measures, then runs the IEC 62305-2 method across them. It shows how coordinated SPDs, bonding, shielding and the zone scheme bring the risk of internal-system loss below the tolerable level, and it lets an engineer add lines, adjust their lengths and routing, and see the line-related risk move, which is exactly the part of the picture a heavily connected facility lives or dies on. Every figure traces back to the clause behind it, so an operator, auditor or insurer can follow the reasoning rather than take a single number on trust.

New to the standard? Start with what is IEC 62305, then see the Lumex platform for how a facility is assessed end to end.