In addition to what bronson already said: Once upon a time I did production support for a military radar power supply. One of my tasks is something we called

In addition to what bronson already said: Once upon a time I did production support for a military radar power supply. One of my tasks is something we called Diminishing Material Sources (DMS). Basically, we had a system that would be produced over the course of 10 years and would need to be supported for a minimum 20 years after it was produced. The design, of course, had to be complete before production started, so tack 7 years on to the front. Not every supplier would want to keep producing specific parts long enough to support our needs, so if something was going to drop out of production I had to perform a DMS analysis to find a substitute. That involved either finding a drop-in replacement or redesigning part of the circuit. The former was sometimes painful, because a new supplier would need to have its parts evaluated for compatibility, which meant dozens of hours of testing parts and testing boards with parts installed. The latter was an order of magnitude more painful. Any change to the design meant a partial or full re-qualification, and the cost could be anywhere from hundreds of thousands to tens of millions of dollars. Anything that involved changing the circuit board automatically went to the right side of that scale. The "simple certification process" involves intensive environmental stress and screening testing: thermal shock on assembled boards (-40C to 70C transition in 30s); operational thermal cycling (repeated cycles of -40C to 70C with the hardware operating); and operational vibration testing (several tens of minutes operating while attached to a table shaking violently enough to liquefy your internal organs). There is also accelerated life testing, which determines if the modified design will meet the system longevity requirements. Depending on what changed and the system complexity, this may have to be repeated at multiple subsystem levels above the affected board. For this reason we bent over backwards not to change the design unless we had no other choice. Design changes brought too much risk for us, our customers, and our end users. For this reason the military much prefers the spiral upgrade process for maintaining long-lived systems: once you get some practical experience with the current version, start work on an upgrade package that contains multiple fixes and enhancements at once and switch to that when it is ready. Sometimes it is even possible to retrofit existing systems with the spiral upgrades.