Design change
Major-change evidence support for certified articles
Major-change evidence support helps a supplier or modifier substantiate a design change classified as major to an already-certified article or installation. It serves avionics, equipment, and modification teams whose change reopens part of the certification basis. The trigger is a change too significant to handle as minor, where the affected requirements, re-verification, and safety re-assessment all have to be shown. It examines the change classification rationale, the basis sections the change touches, the delta in requirements and test evidence, and the updated instructions for continued airworthiness. You receive a change-impact map, a substantiation gap list, and an evidence set scoped to what the major change actually affects.
When this review is needed
- A change to a fielded article is large enough that handling it as minor will not hold under scrutiny.
- An installation is being modified in a way that reopens part of the original certification basis.
- A change classification was made early and now needs a defensible written rationale behind it.
- A safety re-assessment is required because the change touches a function with a failure condition that matters.
The problem
A change called minor to save a cycle becomes the finding that stops the program. Classification is treated as a checkbox, the affected basis is scoped too narrowly, and the re-verification evidence covers the new design but never shows the parts that did not change are still substantiated. By the time the authority disagrees with the classification, the schedule has already been built on the wrong assumption.
What gets reviewed
- The change classification rationale and the criteria it was judged against
- The portion of the certification basis the change reopens
- The requirements that are added, deleted, or altered by the change
- Re-verification evidence for the changed function and its interfaces
- The safety re-assessment where a failure condition is affected
- Updated instructions for continued airworthiness driven by the change
Scope this review
Tell us the asset, the event, and the evidence in scope, and we will outline a focused first engagement.
Identify what is missing against the means of compliance.
What gets validated
- The classification rationale matches the regulatory criteria for a major change
- The affected basis is scoped to every requirement the change actually touches, not a subset
- Each altered requirement traces to re-verification evidence at the right level
- Unchanged functions adjacent to the change are shown to remain substantiated
- The safety assessment is reopened where the change moves a failure condition
- Derived requirements introduced by the change are captured and traced back to the assessment
Evidence normally required
- The original certification basis and the approved baseline being changed
- The change description and its draft classification rationale
- Existing requirements, design data, and test evidence for the affected area
- The current safety assessment and instructions for continued airworthiness
Common discrepancies
- A change classified minor whose effect on the basis is plainly major
- Re-verification that covers the new design but skips the interfaces it disturbs
- A safety assessment never reopened despite a changed failure condition
- Instructions for continued airworthiness that still describe the pre-change configuration
- Derived requirements from the change left out of the trace
What is at stake
An under-classified change forces a restart at the worst moment, with the safety assessment reopened and the field fleet now carrying a change whose data does not close. The rework lands on a team that has moved on to other programs, and the configuration of delivered units drifts from what the data describes.
How the work runs
Test the classification
Check the major or minor judgment against the regulatory criteria and document the rationale.
Map the delta
Isolate the basis sections and requirements the change reopens, including disturbed interfaces.
Scope the evidence
Identify the re-verification and safety re-assessment the change drives and find what is missing.
Assemble the package
Produce the change-impact map and a delta evidence set sized to the change.
What the buyer receives
- A change-impact map showing every basis section and requirement the change touches
- A substantiation gap list ordered by classification and review exposure
- A delta evidence set scoped to the change and its interfaces
Who uses the output
- Certification leads defending the classification at submittal
- Design engineering closing the re-verification gaps
- Configuration management updating the delivered baseline
How the work fits into the transaction or program
The support sits between the design change and the approval submission. It works from the existing baseline, isolates the delta the change introduces, and hands the team a substantiation set sized to the change rather than a full recertification.
Start with a single asset
Reduce finding cycles by checking the package first.
Aircraft-specific considerations
The classification threshold and the depth of re-substantiation move with the failure condition the changed function drives, so the same physical change can be major on one installation and minor on another depending on what it affects.
Regulatory limits
Endeavor Elements substantiates the applicant's change data. It does not classify the change on the authority's behalf, make the compliance finding, or guarantee the major-change approval is granted. The applicant and the authority hold those roles.
What this review does not cover
- Making the official change classification on the authority's behalf
- Issuing any change approval or amended certificate
- Performing the re-verification testing itself
Specific to this review
- Whether a change is major or minor turns on its effect on the certification basis and the safety assessment, not on the physical size of the modification.
- A change that looks isolated often disturbs adjacent interfaces, so re-verification scoped only to the new part is a recurring gap.
- An identical change can be classified differently across two installations because the affected failure condition differs.
- Instructions for continued airworthiness are part of the change substantiation and are commonly left describing the pre-change state.
Sources
U.S. Government (eCFR). Type certificates, STCs (Subpart E), TSO authorizations (Subpart O), PMA (Subpart K), and export airworthiness approvals (Subpart L).
SAE International. Development assurance process at aircraft and system level, including requirements capture and validation.
SAE International. Safety assessment methods (FHA, PSSA, SSA, FTA, FMEA) supporting development assurance level assignment.
RTCA. Objectives and lifecycle data for airborne software assurance, by design assurance level (DAL A-E).
Frequently asked questions
Does Endeavor Elements decide whether our change is major?
No. The authority confirms the classification. We test your rationale against the criteria and build the substantiation so the classification holds up at review.
Do we have to re-substantiate the whole article?
Usually not. The work isolates the delta the change introduces and the interfaces it disturbs, so the evidence is scoped to the change rather than a full recertification.
Relevant glossary terms
Related pages
Where this fits
Talk to an engineer who has done this work
We will walk through your current state, the records or evidence involved, and a scoped first engagement.
Walk through your situation with an engineer who has done this work.