A method of managing change in a complex system begins with identifying an unsatisfied need to be met by the system. To satisfy the need a proposed change to the system to satisfy the need is represented a high-level representation of the proposed change. The high-level representation is mapped to a low-level executable semantic model, which is used to validate the proposed change and ensure the proposed change meets the identified and does not require additional changes to the system. On a condition that the validating steps determines that additional changes are required the additional changes are represented in the high-level representation of the system; the high-level change is mapped to the low-level executable semantic model and the additional changes are re-validated.