  Developers of some safety critical systems construct a safety case.
Developers changing a system during development or after release must analyse
the change's impact on the safety case. Evidence might be invalidated by
changes to the system design, operation, or environmental context. Assumptions
valid in one context might be invalid elsewhere. The impact of change might not
be obvious. This paper proposes a method to facilitate safety case maintenance
by highlighting the impact of changes.
