S 1.25 Overvoltage protection

Initiation responsibility: Head of IT, Building Services Manager, IT Security Officer

Implementation responsibility: Building Services

Overvoltages can arise at any time in any electrically conductive network, regardless of whether the network is used for supplying power or transmitting data. Such overvoltages are usually caused by other electrical power consumers connected to the same supply network. In contrast, overvoltages due to lightning are much more rare, although they have a significantly higher potential to cause damage.

Overvoltages can not only propagate through a building and the IT operated in it over the cables installed in the building, but also over other electrically conductive external connections such as telephone lines and water or gas pipes. In addition, overvoltages can also be induced on internal lines.

The safeguards necessary for the protection of IT devices are the same for the most part regardless of the cause of the overvoltage. The standard DIN EN 62305 "Protection against lightning" (corresponds to the VDE 0185-305 and IEC 62305 standards) valid since October 2006 completely revised the lightning and overvoltage protection concept. After a transition period of 2 years, all previous standards applying to lightning and overvoltage protection became invalid on 1 October 2008.

An overvoltage protection concept must be developed based on the new DIN EN 62305 standard.

DIN EN 62305 Part 2 "Risk management" is the first standard to describe generally binding methods for risk-based lightning and overvoltage protection. Part 3 deals with "Physical damage to structures and life hazard", and Part 4 handles "Electrical and electronic systems within structures".

Emergency power systems (EPSs) and uninterruptible power supplies (UPSs) also need to be taken into account in the overvoltage protection concept, of course. Although a UPS offers a certain amount of protection to the devices connected to it, it should by no means be considered an overvoltage protection device and should be treated as an electronic device requiring protection instead.

The concept of energetic co-ordination has replaced the previous three overvoltage protection stages (coarse, medium, and fine protection). According to the standard, energetic co-ordination is only mandatory when external lighting protection is used. For the sake of information security, though, energetic co-ordination should also be considered in cases where there is no external lighting protection. In simple terms, this means the following:

1.Examination by an expert inspector

2.Computer simulation using a suitable method of approximation

3.Installation of SPDs from a single product family for which the manufacturer provides verification of the energetic co-ordination

This lightning and overvoltage protection design creates lightning protection zones (LPZs) that are contained within each other like the skin of an onion. The zones are designated LPZ 0, LPZ 1, LPZ 2 etc., from the outside inwards, with the protection increasing as you go inwards. Note, though, that a zone can only be formed when there is an outer zone surrounding it. This means, for example, that you cannot form LPZ 2 without having an LPZ 1.

LPZ 1 is usually adequate for simple electrical and electromechanical devices. LPZ 2 must be realised at a minimum to protect electronic devices such as IT hardware and UPSs. For particularly sensitive devices, for example devices used in medical or measurement and sensor technology, it will probably be necessary to form LPZ 3.

Note:

The lightning protection zones (LPZs) must not be confused with the protection classes of the external lightning protection system (abbreviated to LPS).

Whether or not an LPS is necessary and if so, which protection class it should have, must be decided based on the risk assessment (according to Part 2 of DIN EN 62305). It is not enough any more just to closely examine a list of buildings!

In many cases, it is not necessary to form LPZ 2 or LPZ 3 to cover the entire building. While the transition from LPZ 0 (which is the area outside of the building, where lightning can actually strike directly) to LPZ 1 should be located as close to the building shell as possible, higher LPZs of any size can be formed at any location. It is important in this case, though, to make sure that no pipes protected by LPZ 1 only (such as heating pipes) run through higher LPZs.

The previously required minimum cable lengths between the surge protection devices and the various LPZs are not mandatory any more. There are single-component SPDs available that allow a transition from LPZ 0 directly into LPZ 2.

The protective effect of an SPD only applies to a certain length of cable (on the incoming and outgoing cable) which has to be specified by the manufacturer in the individual case. If the outgoing cable length is exceeded, then additional SPDs must be installed to maintain the required level of protection.

According to DIN EN 62305, a lightning protection system (LPS) must be inspected in intervals ranging from 1 to 4 years depending on the protection class. The standard does not explicitly state inspection intervals for the overvoltage protection devices. For the sake of information security, though, all SPDs should be checked periodically (at least once per year) and after any events and replaced, if necessary. In order to be able to perform these checks, though, only SPDs with an integrated malfunction indicator or (even better) a service life indicator should be installed, provided that such SPDs are available.

In addition to overvoltage protection for all systems that conduct electricity, it is also necessary to implement safeguards against electrostatic charge in server rooms and in the core units of computer centres. The resistance to current flow of the floor coverings used in such rooms must be between 10 and 100 megaohms. The classification according to DIN standard 4102-1 "Fire behaviour of building materials and elements" must be at least "B1 low flammability". This also applies to raised and double floors.

Regardless of the size and design of the overvoltage protection, it must be noted that comprehensive potential equalisation is required for all electrical equipment connected to the overvoltage protection circuit! Most damage inflicted on IT equipment by overvoltage can be attributed to improperly implemented potential equalisation.

Review questions:

© Federal Office for Information Security. All rights reserved.