Secondary Design Freeze, Revision Control and Manufacturing Change Management

A secondary-design freeze is a controlled baseline, not a promise that no further change will occur. After freeze, every change must identify affected requirements, circuits, devices, settings, SCL data, labels, manufacturing work and tests before it is authorised. Without that discipline, a “small” terminal or firmware substitution can silently defeat CT safety, trip-channel independence or inter-panel compatibility.

This guide defines practical release gates, configuration items, revision rules, engineering change control, vendor/manufacturing substitutions, red lines, regression testing and as-built handover for MV switchgear secondary systems.

Executive rules

Freeze a named, versioned baseline with an approved content manifest—never “the latest files in the folder.”
Separate requirement, functional, detailed-design, manufacturing, FAT and as-built baselines.
Control logic/settings/SCL/firmware and label/ferrule/cable databases with the same rigour as schematics.
No component, terminal, wire, relay card or software substitution is “form-fit-function equivalent” until interfaces and failure modes are reviewed.
Every change needs reason, affected objects, safety/protection impact, approval, implementation evidence and regression tests.
Red-line both ends of cross-panel/interface changes and update the master ICD/cable/I/O records.
Stop obsolete revisions reaching the shop floor/site; distribution and withdrawal are configuration controls.
As-built status requires physical verification and closed deviations—not simply renaming a pre-FAT drawing.

1. Standards and lifecycle context

Reference	Use
IEC 61850-4:2011+AMD1:2020	System/project management for utility automation systems with IED communication
IEC 61850-6:2009+A1:2018+A2:2024	SCL configuration exchange among IED/system engineering tools
IEC 61082-1:2014	Rules for electrotechnical diagrams, drawings and tables
IEC 81346-1:2022	Stable object structures/reference designations
IEC 81355-1:2024	Classification/designation of lifecycle information containers
IEC 62271-200:2021+AMD1:2024	MV switchgear assembly type/routine verification and configuration context
Project quality/configuration plan	Authorities, status codes, tools, records, audit, deviations and handover rules

The project should adopt one configuration-management plan across owner/EPC, switchgear vendor, relay supplier, system integrator and commissioning team. Each party can control its internal design while one integration authority controls interfaces and system baselines.

2. Configuration-item register

requirements/specifications and deviations;
single-line diagrams, protection/control philosophy and operating modes;
short-circuit, coordination, CT/VT, DC, transfer and other design studies;
functional/cause-and-effect/interlock/trip matrices;
schematics, terminal plans, internal wiring and cable/core schedules;
I/O/SCADA/alarm/interface-control documents;
panel layouts, BOM, datasheets and component approvals;
relay/IED hardware modules, firmware and licenses;
settings, programmable logic, configuration databases and checksums;
SCD/CID/IID/ICD files, network configuration, VLAN/address/time/cyber data;
ECAD libraries/templates and generated ferrule/device label files;
FAT/SAT procedures, test sets/configuration and approved results;
nonconformance, change, red-line and as-built records.

Each item needs unique ID, owner, current status/revision, format/tool/version, approval, dependencies and storage location. Hash/checksum can demonstrate exact digital identity but does not replace semantic review.

3. Recommended baseline gates

Gate	Minimum purpose
Requirements freeze	Scope, topology, standards, functional/performance and interfaces agreed
Functional-design freeze	Protection/control philosophy, modes, trip/interlock/cause-effect and I/O semantics approved
Detailed-design freeze	Schematics, terminal/cable, hardware, calculations, settings philosophy and network architecture coordinated
Manufacturing release	Buildable approved BOM/layout/wiring/labels with procurement deviations closed
FAT baseline	Exact as-built hardware/firmware/settings/logic/SCL/drawings under test
Shipment/site baseline	FAT defects/changes closed; transport splits and site work defined
As-built/operational baseline	Site changes/commissioning settings/tests physically verified and accepted

Do not freeze incomplete interfaces merely to meet a schedule. Record limited conditional freezes with exact open items, affected scope, owner/date and manufacturing hold points.

4. Design-freeze readiness review

approved topology, ratings and operating modes;
standards/editions and project exceptions frozen;
protection functions, zones, trip/BF/interlock and transfer logic complete;
CT/VT/DC/cable/coil/contact/network calculations accepted;
interfaces signed by both source and destination owners;
relay/I/O/common/terminal/cable/core allocation complete with spares;
EMC, segregation, earthing, cyber/time and environmental requirements integrated;
BOM device ratings/part numbers and manufacturer data approved;
settings/SCL/logic data model and responsibility defined;
FAT testability and test hardware/software available;
all review comments closed or formally dispositioned;
baseline manifest generated and approvals recorded.

5. Revision and status model

Use clear lifecycle status: working/review/approved for manufacture/approved for construction/as-built as project definitions require.
Revision number identifies a released state; minor working saves are version history, not issued revisions.
Every issue records purpose, date, author/checker/approver and concise change description.
Maintain document supersession and compatibility—drawing Rev C may require settings Rev 5 and SCD baseline B07.
Use transmittals/distribution logs and withdraw superseded shop/site copies.
Prevent uncontrolled PDF, native ECAD and database exports from claiming the same revision if content differs.
Protect approved originals; review comments/red lines occur on controlled copies linked to change records.

6. Engineering change request workflow

Initiate: identify need, defect/obsolescence/site condition and urgency.
Define: exact affected object/interface and proposed/alternative solution.
Classify: safety/protection, functional, interface, manufacturing, documentation-only or emergency.
Impact assess: studies, ratings, reliability/common mode, DC/EMC/cyber, settings/SCL, labels and schedule/cost.
Approve: required engineering, manufacturer, system operator and quality authorities.
Implement: update source data, drawings/BOM/configuration and physical product under work instruction.
Verify: inspection, calculation, regression/FAT/SAT and independent check proportionate to risk.
Release: issue new coordinated baseline/revision and withdraw obsolete information.
Close: confirm field/shop implementation, test evidence, as-built and affected-party notification.

7. Impact-analysis matrix

Change	Hidden impacts to check
Relay model/firmware	Function algorithms, I/O terminals, settings conversion, logic, SCL, cyber and test records
Output/interposing relay	DC inductive duty, voltage drop, suppression, delay/release and contact mapping
Terminal block	CT shorting/test function, conductor rating, bridges, footprint, labels and certification
Cable/core/size	Voltage drop, CT burden, fault clearing, gland/terminal, EMC, route and fire rating
DC MCB/fuse	Interrupting duty, remote fault current, selectivity, voltage drop and auxiliary contact
Logic/settings	Protection coordination, interlocks, SCADA/alarm, adjacent bays and operator procedures
Network switch/port	VLAN/QoS/GOOSE/SV/PTP, PRP/HSR, SCL, cyber and redundancy

8. Manufacturing substitution control

No procurement substitution by catalogue headline alone; compare exact datasheet and certified/type-test context.
Check dimensions/clearances/heat/terminal access as well as electrical ratings.
For relays/IEDs, check hardware revision, firmware, I/O isolation/common groups, binary thresholds, output DC duty and protocol profile.
For auxiliaries, check coil voltage envelope, power, pickup/dropout, release time, suppression and contact duty.
For cable/terminals, check conductor material/area/temperature/fire/EMC and tooling.
Assess whether substitution changes assembly type-test evidence or routine-test procedure.
Update BOM, layout, schematic, labels, spares, manuals and test plan before installation.
Maintain approved-alternative list with applicability limits; do not generalise one project approval.

9. Logic, settings, firmware and SCL control

Record native file, human-readable report, device/model/firmware and checksum.
Control settings group, active group and non-setting programmable logic separately.
Track SCD → IED configuration exports/imports and tool versions; avoid unmanaged direct online edits.
Reconcile GOOSE publishers/subscribers, datasets, control blocks and network changes after any signal modification.
Define authorised tools/users and audit extraction before/after site work.
Test conversion when firmware/tool version changes; do not assume import preserved semantics.
Back up commissioned files directly from the device and compare to approved baseline.
Store credentials/keys securely; do not embed secrets in general handover packages.

10. Interface-change control

Notify both endpoint owners before changing signal meaning, contact state, voltage, common, timing, terminal, cable core or data object.
Update ICD, I/O matrix, both schematics/terminal plans, cable schedule, SCADA and SCL together.
Check inversion/fail-state and interlock/trip-matrix regression.
Do not reuse a spare core/channel without verifying source/destination commons, segregation and failure domain.
For legacy/live interfaces, preserve existing IDs where practical; create explicit migration/temporary state.
Close cross-vendor acceptance before the physical change is released.

11. Shop-floor change and nonconformance

Stop and record build mismatch; do not “make it fit” then ask drafting to follow.
Tag affected panel/bay/device and quarantine unapproved components/work where required.
Distinguish nonconformance disposition: rework, repair, use-as-is with engineering concession, or reject.
Use marked-up controlled work instruction showing exact terminals/wires/parts.
Independent inspection verifies rework and no collateral damage.
Update native source data before regenerating drawings/ferrules—avoid manual PDF-only edits.
Repeat continuity/functional/dielectric/routine tests affected by rework.
Record serial/batch/technician/date and close the NCR/change reference in as-built package.

12. Late and emergency changes

Urgency changes sequence, not engineering accountability. An emergency/site temporary change needs an authorised risk assessment, limited scope, compensating controls, clear labels, expiry/owner and defined rollback. Then complete normal design, regression and as-built closure promptly. Temporary terminal jumpers, disabled GOOSE subscriptions or bypassed interlocks must be alarmed/recorded and independently removed.

13. Regression-test selection

direct changed circuit/function;
all channels sharing DC/common/card/terminal/cable/network dataset;
protection trip, breaker failure, interlock and ATS cause/effect;
CT/VT polarity/burden/earthing and safe test isolation;
SCADA/alarm/first-out/SOE/quality mapping;
GOOSE/SV/PTP/network redundancy and cyber access;
coil voltage/timing/contact duty after hardware/cable changes;
power-cycle/failure/restoration behaviour;
routine/dielectric/functional assembly tests affected by physical work;
documentation/settings/SCL extraction comparison after test.

14. As-built and handover closure

Collect signed shop/site red lines, NCRs, concessions and change records.
Update native ECAD/database/BOM/settings/SCL source—not only PDFs.
Regenerate drawings, schedules, labels/reports and consistency checks.
Field-verify safety-critical and sampled interfaces plus representative remaining circuits.
Extract relay/IED/network configurations from commissioned equipment and compare.
Link FAT/SAT/commissioning evidence and outstanding limitations.
Issue approved as-built baseline manifest/checksums and withdraw working copies.
Transfer editable native files, readable reports, tools/version requirements and spares data.
Train operator/maintenance staff on material changes and update procedures.

15. Metrics and audit

open changes/NCRs by risk and age;
post-freeze changes and root causes;
obsolete-revision incidents/near misses;
FAT/SAT defects attributable to interface/version mismatch;
unapproved firmware/settings/SCL deviations;
red-line-to-as-built closure time;
regression test completion/defect escape;
component obsolescence and spare compatibility;
periodic sampled physical-to-drawing accuracy audit.

16. Frequent mistakes

Mistake	Consequence	Correction
Freeze means no change	Changes go underground	Controlled post-freeze workflow
Only PDFs baselined	Settings/SCL/native data drift	Complete CI manifest
“Equivalent” relay/terminal accepted	Duty/common/test function changes	Formal interface/failure review
Revision increment without distribution withdrawal	Shop uses old issue	Transmittal/controlled access
One endpoint red-lined	Cross-panel mismatch	Master ICD and both ends updated
Changed function only retested	Shared/common effects missed	Impact-based regression
Pre-FAT drawing renamed as-built	Field truth not captured	Physical/config extraction verification

17. Release checklist

Configuration plan, roles and tools approved?
Complete CI/dependency manifest maintained?
Gate entry/exit criteria and conditional holds explicit?
Revision/status/distribution/withdrawal controlled?
Change impact includes safety, protection, interfaces, settings/SCL and tests?
Manufacturing substitutions formally qualified?
Logic/settings/firmware/network native files identified/checksummed?
Emergency/temporary change expiry and rollback governed?
Regression scope based on shared failure domains?
NCR/rework evidence and affected routine tests closed?
Physical/configuration as-built verification completed?
Operator/maintenance handover reflects final baseline?

References and further reading

Engineering note: Align status/revision terminology with the project contract and quality system; the controls above describe required outcomes, not a universal numbering syntax.