NFPA 780 surge protection: what Section 4.19 requires
Section 4.19 of NFPA 780-2026 is a requirement, not guidance. It says where surge protective devices go, the ratings they must meet and how they are connected, and it leans on NEC Article 242 for the rest.
NFPA 780 surge protection is the set of rules in Section 4.19 of NFPA 780-2026 that requires surge protective devices on every power service and on every signal and data line that enters a protected structure.
An air terminal, a down conductor and a grounding electrode keep a direct strike out of the building fabric. They do nothing for the surge that a strike a kilometre away pushes along the incoming power cable. Annex A.4.19.1 of the standard makes that point directly: surge protection is there for the indirect effects on the services, as one part of a coordinated system, not as a substitute for strike termination.
Section 4.19 sits in Chapter 4, the mandatory general requirements, so a system specified to NFPA 780 includes surge protection. Buy the standard from the NFPA for design and certification.
Checked against NFPA 780-2026 and NFPA 70 (the National Electrical Code, or NEC) 2026 edition, 30 September 2026.
Which surge protective devices does NFPA 780 require?
NFPA 780-2026 splits surge protection by what the device protects and at what voltage. Pick the wrong family and you are reading the wrong subsection.
SPDs, 1,000 V and below
Listed Type 1 or Type 2 surge protective devices, permanently installed on premises wiring at 1,000 volts or less. The family that covers almost every building service.
Surge arresters, above 1,000 V
Fixed devices on any circuit, equipment or system that runs above 1,000 V, such as a medium voltage service. Same placement rules as SPDs (4.19.3.1), with their own rating and conductor rules.
Surge protectors, signal and data
Listed protectors on signal, data and communication systems. Annex A.4.19.4.1 counts antennas among these services.
Annex A.3.3.47 places a Type 1 SPD ahead of the service disconnect overcurrent device, a Type 2 after it, and a Type 3 at the point of use. For how IEC 62305 classes the same devices, see SPD types under IEC 62305.
Where must surge protection be installed?
At every power service, on every signal and data line that enters or leaves, and on runs between buildings over 100 ft.
| Location | What NFPA 780-2026 asks for | Section |
|---|---|---|
| Every power service | Required. The SPD is part of the service equipment or mounted right next to it | 4.19.2.1, 4.19.2.1.1 |
| Power run to another building, over 100 ft (30 m) | Required where the service, feeder or branch circuit leaves or enters the structure | 4.19.2.2 |
| Sub panels and point of use | Permitted, in addition to the required devices, anywhere up to the equipment served | 4.19.2.3 |
| Services above 1,000 V | Surge arresters, placed by the same rules as the service and outbuilding SPDs | 4.19.3.1 |
| Signal, data and communication lines entering or leaving | Required, unless the service provider has already dealt with the lightning surge threat | 4.19.4.1, 4.19.4.1.1 |
| Signal or data run to another building, over 100 ft (30 m) | Required at the building boundary; Annex A suggests a protector at both ends | 4.19.4.2, A.4.19.4.2 |
| Outdoor athletic scoreboards | Every circuit in or out, to Section 4.19 | 5.10.2 |
| Structures with flammable vapors | Section 4.19 plus NFPA 70, outside the classified area when practicable | 7.3.6.1 to 7.3.6.3 |
| Structures housing explosives | Every power, signal, data and communication conductor in or out | 8.6, 8.7.1.4, 8.7.4.2 |
| Wind turbines | Surge protection to Section 4.19, close to the equipment it protects | 9.3.1, 9.3.2 |
| Solar PV arrays | DC side PV SPDs, SPDs at the PV system disconnect of an ac module system, and at the inverter ac output | 12.4.2, 12.4.3 |
Surges travel both ways along a service, so Annex J.6.2.1 warns that a camera, gate motor or pump at the far end of a cable needs protection at its own end too. For the chapter rules, see NFPA 780 tanks and flammable vapors and NFPA 780 solar arrays.
What ratings does NFPA 780 set for SPDs?
A floor for current handling and a ceiling for let-through voltage, each cited to its 2026 section.
| Rating | Value in NFPA 780-2026 | Section |
|---|---|---|
| Test waveform (power SPD) | Combination waveform generator test, 1.2/50 µs with 8/20 µs | 4.19.2.5 |
| Nominal discharge current, In, at the service | 20 kA or more on each phase (8/20 µs wave) | 4.19.2.6 |
| Voltage protection rating (VPR) | No higher than Table 4.19.2.7 for each mode on the connected system | 4.19.2.7 |
| Short-circuit current rating | Marked on the SPD (receptacles excepted), and never below the available fault current | 4.19.2.8 to 4.19.2.8.2 |
| Maximum continuous operating voltage (MCOV) | Above the upper tolerance of the utility supply | 4.19.2.9 |
| Status indication | A visual sign that the SPD is working | 4.19.2.15 |
| Surge arrester duty cycle rating | At least 125 percent of the highest system voltage at that point | 4.19.3.2 |
| Surge arrester conductors | 6 AWG copper, 4 AWG aluminum, or a material with the capacity and withstand rating of 6 AWG copper (check the printed size wording in your copy) | 4.19.3.7 |
| Surge protector, Imax | 10 kA or more (8/20 µs wave) | 4.19.4.3 |
| PV SPDs and inverter ac output | In of 20 kA for each mode (8/20 µs wave) | 12.4.2.1.1, 12.4.3.2 |
Table 4.19.2.7 gives a limit for each mode that applies (line to line, line to neutral, line to ground and neutral to ground) across eleven distribution systems. Two examples: on a 120/208 V wye system the ceiling is 700 V for the neutral and ground modes and 1,200 V line to line, and on 277/480 V wye with a solid ground it is 1,200 V and 1,800 V. The VPR itself is a manufacturer rating from a 6 kV, 3 kA combination wave (definition 3.3.52). In the 2020 edition, surge protection was Section 4.20 and this was Table 4.20.4; the 20 kA and 10 kA figures were already there. See NFPA 780 2026 changes.
The 20 kA figure is a floor. Annex A.4.19.2.6, which is informative, recommends a higher In than the minimum where lightning is frequent. Where extra SPDs are fitted, it suggests at least 10 kA per mode on downstream equipment and 5 kA per mode at the point of use.
How SPDs and surge protectors must be connected
A well rated SPD on long, looped leads performs like a poorly rated one. For power SPDs, the device goes on each ungrounded conductor where it is used (4.19.2.11), may sit between any two of the circuit's conductors (4.19.2.11.1), and is wired with leads kept as short and straight as the installation allows (4.19.2.11.2). Annex A.4.19.2.12 explains why: an SPD is only as effective as the low impedance of its path to ground. Annex A.4.19.4.8 makes the same point for data protectors, where longer or looped leads raise the voltage that reaches the equipment.
The resistance of the grounding electrode system that grounds the SPDs must meet NFPA 70 (4.19.2.12). The enclosure is marked with its environmental rating (4.19.2.13.2), and the device may sit indoors or outdoors (4.19.2.10) but must stay reachable for inspection (4.19.2.14).
Signal and data surge protectors carry rules of their own. They must be grounded (4.19.4.5), except protectors that work by isolation (4.19.4.5.1); the rest follow NFPA 70 Chapter 8 (4.19.4.5.2). Where that grounding point is more than 20 ft (6 m) from the protector, you add a supplementary ground reference at the protector itself (4.19.4.6), such as an equipotential ground bus bar, structural steel or a secondary panel ground (4.19.4.6.1). A protector may never be grounded through a lightning down conductor (4.19.4.7). For how the SPD ground ties into the rest of the earthing, read NFPA 780 grounding and bonding.
How NFPA 780 relates to NEC Article 242
NFPA 70-2026 is a referenced publication of NFPA 780-2026 (Section 2.2). Article 242 sets the electrical code floor for every SPD and surge arrester; NFPA 780 surge protection raises it for lightning.
| Topic | NEC 2026 | NFPA 780-2026 |
|---|---|---|
| Scope split | Article 242 Part II: SPDs up to 1000 V ac or 1500 V dc. Part III: surge arresters above 1000 V (242.1) | The same 1,000 V line between SPDs and surge arresters, plus a third family for signal and data (4.19.1) |
| Where SPDs are required | Services to dwelling units, dormitories, hotel guest rooms and similar sleeping areas (230.67(A)), plus some systems such as emergency switchgear (700.9) | Every power service of the protected structure, whatever the occupancy, and outbuilding runs over 100 ft (4.19.2.1, 4.19.2.2) |
| Service SPD rating | In not less than 10 kA (230.67(E)) | In of 20 kA or more on each phase (4.19.2.6) |
| Type at the service | Type 1 or Type 2 (230.67(C)); Type 1 connection points in 242.13(B), Type 2 in 242.14 | Type 1 or Type 2, listed (4.19.1) |
| Let-through voltage | No numeric ceiling in Article 242 | VPR per mode no higher than Table 4.19.2.7 (4.19.2.7) |
| SPD connecting conductors | At least 14 AWG copper or 12 AWG aluminum (242.28) | As short as possible, no needless bends (4.19.2.11.2) |
| Surge arrester conductors | At least 6 AWG, in copper or aluminum (242.52) | 6 AWG copper, 4 AWG aluminum, or a material of equal capacity and withstand rating (4.19.3.7) |
An installation built to NFPA 780 must also satisfy the NEC, so meet the stricter of the two. The usual gap is the service rating: a 10 kA device that meets NEC 230.67 does not meet NFPA 780 Section 4.19.2.6. Surge arrester conductors are the other: NEC 242.52 accepts 6 AWG in copper or aluminum, while NFPA 780-2026 Section 4.19.3.7 names 4 AWG for aluminum, which is the larger conductor. Confirm the exact size wording of 4.19.3.7 in your purchased copy. The NEC also bars reconditioned SPDs and arresters (242.3(B)). Whether either code binds a given building is covered in is lightning protection required by code.
When can surge protection be left out?
Section 4.19.2.4 lets SPDs be omitted in three cases, each decided under engineering supervision: the surge threat is negligible, the lines already have equivalent protection, or fitting the devices would make the installation less safe. A parallel rule for signal lines drops the protector where the service provider has already dealt with the lightning threat (4.19.4.1.1).
Annex A.4.19.2.4 draws a firm line around that allowance. It is there for configurations the standard cannot foresee, not for an installer who finds the devices inconvenient. The annex gives examples that qualify, such as a short run under 100 ft in grounded metal conduit between two buildings, or a fibre link with no metal in it. It lists four ways to support the decision: a risk assessment to IEC 62305-2, a flash density check (above one flash per square kilometre per year, consider protection), the site's own damage records, or an analysis of the field a nearby strike would couple into the services.
One limit overrides all four: if a surge could create a hazard just by shutting a system down, the annex says not to exempt it. Keep the written justification, because the authority having jurisdiction (AHJ) may ask for it.
How surge protection changes the Annex L risk result
SPDs installed to Section 4.19 earn a credit in the detailed assessment, but only on a structure that can use it.
P_C drops from 1 to 0.03
The probability that a direct strike causes failure of internal systems, P_C, is 1 with no SPD protection and 0.03 with SPDs provided to Section 4.19. Its notes allow lower values for better than minimum SPDs.
Only with an LPS or a continuous frame
The SPD credit to P_C counts only in a structure protected by a lightning protection system, or one whose frame is continuous metal or reinforced concrete.
The service probabilities follow
With SPDs on a connected service, P_U and P_Z each take the lower of their own value and P_C, and P_V and P_W take the lower of P_U and P_C.
Coordinated SPDs at the equipment
For strikes near the structure, P_M can take the lower of P_C and its own value only where coordinated SPDs are fitted at the equipment. Equipment with a withstand voltage below 1.5 kV, or unknown, is assessed with P_M of 1.
Annex L is informative: the credit guides the protection decision rather than setting a requirement. The NFPA 780 Annex L guide covers the full method.
Common mistakes and what inspectors check
A common NFPA 780 surge protection failure is treating the SPD as an electrical add-on, not part of the lightning protection system. The usual gaps, with the section each breaks:
- A 10 kA device at the service. It meets the NEC dwelling rule, not the 20 kA per phase of 4.19.2.6.
- Only the power service protected. Telephone, data, CATV, alarm and antenna lines all need surge protectors (4.19.4.1, A.4.19.4.1).
- Outbuildings forgotten. A feeder or data cable to a gatehouse or pump house over 100 ft needs protection where it crosses each building boundary (4.19.2.2, 4.19.4.2).
- Long or coiled leads. 4.19.2.11.2 and 4.19.4.8 ask for short, straight connections.
- A protector bonded to a down conductor. Prohibited by 4.19.4.7, because the down conductor is the path the strike current takes to ground.
- VPR above the table. Check the published VPR for each mode against Table 4.19.2.7 for the actual distribution system, not a similar one.
- No working status indicator, or a device behind a locked panel. 4.19.2.15 asks for a visual indication and 4.19.2.14 for access.
- SPDs inside a hazardous area in an ordinary enclosure. Chapter 7 prefers them outside the classified location and, where inside, in an enclosure identified for it (7.3.6.2, 7.3.6.3).
At the service panel, most of this can be checked by eye: the status indicator shows the SPD is working (4.19.2.15), the device can be reached (4.19.2.14), the short-circuit current rating is marked on it (4.19.2.8), and its leads run short and straight (4.19.2.11.2).
Section 1.7 asks for inspection or testing every year or at the interval the AHJ sets. Annex D, which is informative, adds a visual check that SPDs show no damage and that status lights still work (D.1.2), and testing of surge protection equipment as part of maintenance (D.2.2.2). On explosives facilities the rule is mandatory and tighter: surge protection is inspected at least every 7 months and after any suspected strike (8.9.6.3). The NFPA 780 inspection checklist covers the full routine.
The risk side of surge protection
Lumex does not design or select SPDs, and it does not certify an installation. What it does is run the NFPA 780-2026 Annex L assessment, the quick screen and the detailed R1 to R4, on Voltrace, with the working behind every figure. You record whether SPDs to Section 4.19 are fitted, and the report shows P_C and the service probabilities it changes, each cited to Table L.6.7.4 and L.6.6.2.3 to L.6.6.2.8.
When a structure fails a tolerable value, Lumex tries the measures the engineer controls, surge protection among them, and shows which package brings every judged risk within limits. A review-due date and reminder, set to 12 months for NFPA 780, keep the assessment from going stale. Record whether Section 4.19 SPDs are fitted when you start an NFPA 780 assessment, and read the P_C change in the report. See how Lumex runs NFPA 780.
Related reading: NFPA 780 explained, chapter by chapter, the Annex L risk assessment, NFPA 780 grounding and bonding, the NFPA 780 inspection checklist, surge protection for solar arrays under Chapter 12, SPD types in IEC 62305, and which lightning standard applies to your project.
Questions answered
Does NFPA 780 require surge protection?
Where must SPDs be installed under NFPA 780?
What rating does NFPA 780 require for a service entrance SPD?
How does NFPA 780 relate to NEC Article 242?
Is a 10 kA SPD enough for an NFPA 780 installation?
Can surge protection be omitted under NFPA 780?
Can a surge protector be grounded to a lightning down conductor?
Do SPDs change the NFPA 780 Annex L risk assessment?
Lumex computes the method of the standard you choose, IEC 62305-2:2024, AS 1768:2021 or NFPA 780-2026, and shows the working. It does not certify a structure. You may not issue or submit a Lumex output until a competent person, qualified where the structure is located, has reviewed the inputs and the result and signed it.
NFPA 780-2026 Annex L gives default tolerable values of 1E-5 per year for loss of life or injury and 1E-3 for loss of service and of historical significance, and the owner or the authority having jurisdiction may set others. Every NFPA 780 assessment in Lumex states the values that applied.
Get started today