Change Impact Analysis for Carryover & Modified Systems
Most automotive programs are brownfield. Learn how ISO 26262-2, Clause 6.4 and ISO 26262-8, Clause 8 keep carryover parts, variants and facelifts safe through a structured impact analysis that decides what must be re-verified.
- Chapters
- 10
- Chapters
- Figures
- 13
- Figures
- Worked example
- 1
- Worked example
Quick answers
- What is change impact analysis in ISO 26262?
- Change impact analysis evaluates what a modification to an existing item or element affects, and which safety lifecycle activities must therefore be repeated. ISO 26262 covers it in two places: ISO 26262-2, Clause 6.4 calls for an impact analysis when a project starts from an existing item or element and uses it to tailor the lifecycle, and ISO 26262-8, Clause 8 governs change management during and after development. The analysis identifies affected work products, assesses effects on safety goals, scopes re-verification, and is documented and approved before the change is implemented.
- When is an impact analysis required for a carryover part?
- Whenever a safety-related item or element is changed or reused in a new context. ISO 26262-8 expects every change request to go through an impact analysis, even one that looks like a calibration tweak. For carryover, the key question is whether the original assumptions still hold: assumptions of use, the operating domain, environmental conditions and interface contracts each have to be checked against the new vehicle. A new supplier or a different sensor coverage can ripple all the way back to the hazard analysis. The guide has a chapter on structuring this reuse argument.
Why it pays for itself
A defensible step-by-step method
Turn "is this change safe?" into a documented impact analysis, from a precise change description to approval, that states which lifecycle activities must be repeated, updated or validly reused.
Re-test what matters, not everything
Scope re-verification with a risk-based regression strategy that scales with the ASIL, avoiding both dangerous under-testing and weeks of full re-runs done out of habit.
Carryover arguments that hold
Check SEooC assumptions and the operating domain against the new context and close the gaps, so reused elements enter the safety case with an argument an assessor accepts.
What you’ll be able to do
Run a structured impact analysis
Describe a change precisely, find the affected work products and decide which activities to repeat.
Classify changes and their ripple
Use change categories to predict where the effects of a modification propagate.
Argue carryover and reuse
Check reused elements and their assumptions against the new context before relying on them.
Scope regression by risk
Justify which tests to re-run and which evidence to reuse instead of re-running everything.
Anchor work to baselines
Use configuration baselines so every impact analysis states exactly what is changing.
Chapter by chapter
- 01
Most Projects Are Brownfield
See why most automotive work modifies existing systems and why that makes safety harder than a clean-sheet design.
- The greenfield myth
- What brownfield covers
- Why brownfield is safety-hard
- 02
Modifications in ISO 26262
Learn where change lives in the standard, what triggers a safety impact analysis, and how Part 2 and Part 8 divide the work.
- Two clauses, one goal
- Clause map for change
- Item versus element scope
- 03
The Impact-Analysis Method
Work through a stepwise impact analysis and see why traceability is the engine that makes it possible.
- Six-step process
- Traceability as the engine
- Required outputs and records
- 04
Carryover & Reuse Arguments
Check whether reused elements still hold in a new context, including SEooC assumptions and a changed operating domain.
- Validating SEooC assumptions
- Changed operating domain
- Reuse gap analysis
- 05
Classifying Changes
Sort change requests into categories and follow how each kind of change ripples through the work products.
- Change type taxonomy
- Change-to-activity matrix
- Ripple propagation
- 06
Regression & Re-Verification
Decide what to re-test and what evidence can be reused, with a strategy that scales with the ASIL.
- Re-verification decisions
- Regression strategy by ASIL
- Evidence reuse conditions
- 07
Configuration & Baselines
Understand why impact analysis depends on controlled baselines and how configuration drift silently undermines it.
- ISO 26262-8 configuration duties
- Baselines as anchors
- Configuration drift
- 08
Change-Management Workflow
Move a change request from submission to re-release, with clear roles and the link to confirmation measures.
- End-to-end workflow
- Roles and responsibilities
- Confirmation measures link
- 09
Worked Example
Apply the method to a front radar replacement on an existing lane-keeping system and build its impact analysis table.
- Front radar swap
- Impact analysis table
- Lessons from the example
- 10
Pitfalls & Checklist
Recognize the most dangerous impact-analysis shortcuts and review an analysis before it goes to approval.
- Dangerous pitfalls
- Review checklist
- Key takeaways
Read all 10 chapters with Expert.
Start with a free account: the complete Functional Safety Concept guide and 5 practice exams a month, then upgrade when you need this guide.
Expert plan pricingNot just text: the visual toolkit
Brownfield reality schematic
The range of brownfield work set against the ISO 26262 mechanisms that govern it.
Change-impact cascade
How one change spreads across the work-product graph.
Change classification decision tree
Routes a change request to its category and the activities it implies.
Regression strategy matrix
Test domains triaged against the output of the impact analysis.
Configuration baseline timeline
The baselines an impact analysis anchors to, and how drift opens up between them.
Swapping a front radar on an existing lane-keeping system
A facelift replaces the front radar of a lane-keeping and highway assist system with a different supplier part, and the guide walks through the resulting impact analysis.
- Item definition and system boundary for the new sensor
- Whether the wider field of view reopens the hazard analysis
- Timing and latency effects on the technical safety concept
- Hardware analysis inputs from the new supplier
- Which work products are affected and which can be reused
Unlock in course
Who this guide is for
- Engineers on facelift, variant or carryover programs, which is most programs
- Safety managers who must sign off change requests without re-running the whole lifecycle
- Change control board members deciding what a "simple sensor swap" really touches
- Anyone whose assessor asked for the impact analysis behind a reused element
Frequently Asked Questions
Common questions about Change Impact Analysis for Carryover & Modified Systems
Start the course today
A free account unlocks one full concept guide, 3 work product templates, 1 guided process, the Markov and RBD simulators, and 5 practice exams per month. The Pro and Expert plans unlock more of the 93-guide library. No credit card required.
Continue with
Where this topic leads next.
- Verification and assessmentHomologation, Regulations & LiabilityA functionally safe vehicle is not automatically a street-legal one, and an approved vehicle is not automatically liability-proof. Learn how type approval, the key UN Regulations and product liability law interlock with ISO 26262 for E/E and automated driving systems.
- Verification and assessmentProduction, Operation, Service & DecommissioningISO 26262-7 governs the safety lifecycle after design release: production controls, operation and service instructions, field monitoring, repair and diagnostics, and safe end-of-life decommissioning of high-voltage and pyrotechnic systems.
- Vehicle domainsActuator SafetyMotors, valves and relays are where safety goals become physical: learn how actuation channels fail stuck or runaway, how feedback and diagnostics catch it, and how safe states from de-energize to active hold are engineered and quantified.