Jones v. Goodrich Corporation

• Court: District Court, D. Connecticut
• Decided: September 30, 2019
• Docket: 3:12-cv-01297
• Status: Unknown

Opinion

UNITED STATES DISTRICT COURT DISTRICT OF CONNECTICUT

BRENDA JONES, AS CO- : ADMINISTRATOR OF THE ESTATE : OF JOHN DAVID HORTMAN, ET AL., : Plaintiffs, : : v. : 3:12-cv-01297-WWE : GOODRICH CORPORATION, ET AL., : Defendants. :

MEMORANDUM OF DECISION ON DEFENDANTS’ MOTION FOR SUMMARY JUDGMENT ON THE ISSUE OF IMPLIED FIELD PREEMPTION

In this action, plaintiffs assert claims of strict liability, negligence, breach of warranty, breach of contract, and fraud, stemming from the fatal crash of an AH-6M “Mission Enhanced Little Bird” helicopter on August 8, 2011, at Fort Benning, Georgia. U.S. Army pilots, John David Hortman and Steven Redd, were killed in the accident. Pursuant to the Court’s request, the parties submitted briefs on the issue of implied field preemption, that is when Congress intends federal law to occupy the field to the exclusion of state law. Although the parties disagree as to many of the underlying technical aspects of the case, the issue of field preemption is primarily one of law. Moreover, even when resolving all ambiguities and drawing all reasonable inferences in favor of plaintiffs, the Court finds, based on Second Circuit precedent, that plaintiffs’ state law claims are preempted. For the following reasons, summary judgment will be granted in defendants’ favor. BACKGROUND Plaintiffs’ helicopter was powered by a single Rolls-Royce Model 250 Series IV engine with a specific designation of 250-C30R/3M. Plaintiffs submit that moments before the crash impact that killed Captain Hortman and Chief Redd, the Full Authority Digital Electronic Control (“FADEC”) computer that

controls all aspects of engine operation in their helicopter experienced a “step count fault,” which caused a failure of the FADEC. A step count fault is caused by, among other things, a faulty fuel metering valve potentiometer (“MVP”), which is part of the hydromechanical unit that physically meters fuel to the combustion chamber. The fault caused the FADEC to enter a fixed fuel mode where the pilot cannot alter the fuel flow and power to the engine. The Army required both the baseline Mission Enhanced Little Bird engine and all of the modifications, including modifications to the FADEC, to be FAA certified. Any changes in equipment that were required by the Army also required the Original Equipment Manufacturers (“OEMs”) to obtain additional FAA certification. Plaintiffs’ statement of additional uncontested facts provides:

“It is clear that the FAA was the ‘Airworthiness Authority for the C30R/3M engine.” [ECF No. 488, ¶ 27]. DISCUSSION A motion for summary judgment will be granted where there is no genuine issue as to any material fact and it is clear that the moving party is entitled to judgment as a matter of law. Celotex Corp. v. Catrett, 477 U.S. 317, 322 (1986). "Only when reasonable minds could not differ as to the import of the evidence is summary judgment proper." Bryant v. Maffucci, 923 F.2d 979, 982 (2d Cir.), cert. denied, 502 U.S. 849 (1991). The burden is on the moving party to demonstrate the absence of any material factual issue genuinely in dispute. American International Group, Inc. v. London American International Corp., 664 F.2d 348, 351 (2d Cir. 1981). In

determining whether a genuine factual issue exists, the court must resolve all ambiguities and draw all reasonable inferences against the moving party. Anderson v. Liberty Lobby, Inc., 477 U.S. 242, 255 (1986). If a nonmoving party has failed to make a sufficient showing on an essential element of his case with respect to which he has the burden of proof, then summary judgment is appropriate. Celotex Corp., 477 U.S. at 323. If the nonmoving party submits evidence which is "merely colorable," legally sufficient opposition to the motion for summary judgment is not met. Anderson, 477 U.S. at 249. Implied Field Preemption “When Congress intends federal law to ‘occupy the field,’ state law in that

area is preempted.” Crosby v. National Foreign Trade Council, 530 U.S. 363, 372 (2000). The Second Circuit has found clear congressional intent to occupy the entire field of aviation safety. Goodspeed Airport LLC v. East Haddam Inland Wetlands & Watercourses Com’n, 634 F.3d 206, 210 (2d Cir. 2011). Indeed: “The United States Government has exclusive sovereignty of airspace of the United States.” 49 U.S.C. § 40103(a)(1). In Air Transport Ass'n of America, Inc. v. Cuomo (ATA), 520 F.3d 218, 225 (2d Cir. 2008), this Court observed that several of our sister circuits, and several district courts within our own circuit, have concluded that Congress intended to occupy the entire field of air safety and thereby preempt state regulation of that field. ATA examined evidence of Congressional “intent to centralize air safety authority and the comprehensiveness of [ ] regulations pursuant to that authority,” under both the Aviation Act and the ADA.

Goodspeed, 634 F.3d at 210. After concluding in Goodspeed that Congress intended to occupy the entire field of air safety, the Second Circuit recognized the second step of the implied preemption inquiry as an analysis of whether the state laws at issue intrude upon the preempted field of air safety. Id. at 211. Goodspeed dealt with environmental laws that required a permit for tree removal on wetlands near the Airport. The Second Circuit determined that neither the Connecticut Inland Wetlands and Watercourses Act (“IWWA”) nor the Connecticut Environmental Protection Act (“CEPA”) prohibited the removal of the obstructions at issue. Moreover, the Airport was not licensed by the FAA, was not federally funded, and had no federal agency approval or mandate to remove the trees from its property. Id. at 211. The state laws did not enter the scope of the preempted field in either their purpose or their effect: “On their face, the IWWA, CEPA, and the local permit process established pursuant thereto do not address issues of air safety.” Id. at 210. In sum, despite Congress’s intent to occupy the entire field of air safety, there was no federal interest in the Airport’s proposed actions, as the state laws at issue did not interfere with federal law. Seven years after its decision in Goodspeed, The Second Circuit affirmed that “Congress intended the FAA, as amended by the ADA, to occupy the field of air safety.” Fawemimo v. American Airlines, Inc., 751 Fed. Appx. 16, 19 (2d Cir. 2018) (summary order). Accordingly, “State laws that conflict with the FAA or sufficiently interfere with federal regulation of air safety are thus preempted.” Id. The Second Circuit recently confirmed its two-step field preemption analysis in Tweed-New Haven Airport Authority v. Tong, 930 F.3d 65, 74 (2d Cir. 2019). After recognizing federal preemption of the “entire field of air safety,” the

Court of Appeals looked to whether the runway statute at issue fell within the scope of that preemption. Id. The runway statute at issue in Tweed effectively prohibited lengthening of the primary runway beyond its current length of 5,600 feet. The limitation directly restricted weight load, passenger capacity, and types of planes that can use the runway. Id. at 74. The Court held that “[t]his localized, state-created limitation is incompatible with the FAAct’s objective of establishing a uniform and exclusive system of federal regulation in the field of air safety.” Id. The Second Circuit also looked to the FAA’s involvement with Tweed: [T]he FAA’s involvement with Tweed and its runway project has been direct and significant. The Airport is federally regulated and exists within the Tweed-New Haven Airport Layout Plan (“ALP”), which is approved by the FAA. The FAA maintains full control over any modification to the ALP, including runway length. The Airport is classified by the FAA as a primary commercial service airport and is required to hold an operating certificate under FAA regulation 14 C.F.R. Part 139. A Master Plan is required of all Part 139 airports, and Tweed’s Master Plan, which includes extending the length of the runway up to 7,200 feet, was approved by the FAA as far back as 2002. This level of federal interest and involvement is further indication that the Runway Statute is preempted.

Id. at 75. The outcome of the Second Circuit’s field preemption analysis in Tweed was simple: “We straightforwardly conclude that the Runway Statute falls well within the scope of the FAAct’s preemption because of its direct impact on air safety.” Id. at 74. Plaintiffs submit three primary arguments as to why their claims in this case are not preempted based on Tweed and its predecessors. Plaintiffs argue: (1) The circumstances of Tweed do not speak to implied field preemption or to any

issues arising in the instant litigation; (2) The FAA’s interest and involvement with aircraft engine-component design and certification is insufficient to position such issues within the preempted realm of air safety; and (3) The subject military aircraft is not subject to FAA certification requirements, so the state laws at issue do not intrude upon the preempted field of air safety. Finally, plaintiffs submit that their manufacturing defect claims should survive a finding of field preemption. Field Preemption vs Conflict Preemption Plaintiffs first submit that “[t]he [Tweed] case has absolutely no bearing on whether there is Implied Field Preemption because the Connecticut Runway Statute actually conflicted with federal law.” Nevertheless, the case itself clearly

belies plaintiff’s reasoning. Indeed, the Second Circuit directly addressed this argument when made by the State in Tweed: In response to all of this, the State maintains that implied preemption is not warranted because the Runway Statute “does not prevent Tweed from complying with any federally-mandated safety standards.” Appellee’s Br. at 56-57. But the State confuses different branches of implied preemption law: conflict preemption and field preemption. Conflict preemption exists when a state law “actually conflicts with federal law,” English v. Gen. Elec. Co., 496 U.S. 72, 79, 110 S.Ct. 2270, 110 L.Ed.2d 65 (1990), in other words, where “state law stands as an obstacle to the accomplishment” of Congress’s intent, Hillsborough County v. Automated Med. Labs., Inc., 471 U.S. 707, 713, 105 S.Ct. 2371, 85 L.Ed.2d 714 (1985). This case involves field preemption, not conflict preemption. Field preemption exists where “Congress intended the Federal Government to occupy [a field] exclusively.” Air Transp. Ass’n, 520 F.3d at 220. And as we have seen, Congress intended the FAAct to occupy the entire field of air safety including runway length.

Tweed, 930 F.3d at 75 (emphasis added). Federal Interest and Involvement Second, plaintiffs submit that the level of federal interest presented by the FAA’s product certification scheme is insufficient to warrant a finding of preemption. In Tweed, the Second Circuit looked to the level of federal interest and involvement with the Airport and its runway project and found it to be “direct and significant.” Id. at 75. Plaintiffs attempt to contrast the FAA’s aircraft design and certification scheme as a mere “spot check.” The Court is not persuaded. Indeed, the Second Circuit’s decision in Fawemimo undercuts plaintiff’s position. 751 Fed. Appx. at 19. The plaintiff in Fawemimo brought a common law negligence action challenging the overall design of the airplane’s monitors and seats after she allegedly hit her head on a television monitor above her seat: Fawemimo’s claims are also barred by implied preemption. Congress intended the FAA, as amended by the ADA, to occupy the field of air safety. Goodspeed Airport LLC v. East Haddam Inland Wetlands & Watercourses Comm’n, 634 F.3d 206, 210 (2d Cir. 2011). State laws that conflict with the FAA or sufficiently interfere with federal regulation of air safety are thus preempted. Id. at 210–211. American produced evidence that its installation of monitors and seats was approved by federal agencies. Because the complaint challenges the overall design of the monitors and seats, it depends on a common law rule for monitors and seats that would conflict with requirements established by the federal government. This result would be contrary to the FAA’s goal of centralizing, in the federal government, the regulation of air safety. See Air Transp. Ass’n., 520 F.3d at 225 (applying implied preemption to prevent state from enacting varying prohibitions on food and drink that would “unravel[ ] the centralized federal framework for air travel”). Accordingly, Fawemimo’s claim is incompatible with the federal government’s authority to regulate the field of air safety and is preempted.

Fewemimo, 751 Fed. Appx. at 19-20; see also Spinrad v. Comair, Inc., 825 F. Supp. 2d 397, 412 (E.D.N.Y. 2011) (“Comair is undoubtedly correct that plaintiff's action would be preempted if it were premised solely the theory that the airstairs were defectively designed for use as an emergency exit.”). The Court finds that the federal design and certification requirements governing aircraft engine components are easily as direct and significant as those governing cabin design in Fewemimo and stairway design in Spinrad. The Federal Aviation Regulations (“FARs”) are pervasive and include regulations governing engine control systems. See 14 C.F.R. § 33.28.1 This section’s “requirements are applicable to any system or device that is part of engine type design, that controls, limits, or monitors engine operation, and is necessary for the continued airworthiness of the engine.” Id. Moreover, plaintiffs admitted that in order to have the R/3M engine included on the type certificate for the M250 family of engines, Rolls-Royce Corp. submitted seventy (70) engineering test reports, department reports, design specifications, reports from GPECS, manuals, and engineering drawings, all of which proved to the FAA that the R/3M engine met federal certification standards. In addition, plaintiffs admit that the FAA awarded type-certification of the R/3M engine, equipped with the EMC-35A FADEC, on September 24, 2001. See Crout v. Haverfield International, Inc., 269 F. Supp. 3d 90, 101 (W.D.N.Y. 2017) (“to the extent that those cases

1 14 C.F.R. § 33.28, “Engine control systems,” is appended at the end of this decision to demonstrate the comprehensive nature of the Federal Aviation Regulations. [from outside the Second Circuit] conflict with Goodspeed Airport's clear holding that the FARs preempt state law regarding air safety, this Court is bound by the law in this Circuit.”). Design and certification decisions for components directly affecting airworthiness clearly fall within the scope of the “entire field of aviation safety.”

As in Fewemimo, plaintiffs’ attempt to enforce common law rules for aircraft components would interfere with the uniform requirements established by the federal government. See Fewemimo, 751 Fed. Appx. at 19-20. Localized, state- by-state standards of care regarding such components are incompatible with the FAA’s objective of establishing a “uniform and exclusive system of federal regulation.” Air Transport Ass’n of America, Inc. v. Cuomo, 520 F.3d 218, 224 (2d Cir. 2008). Even the FAA has taken the view that preemption extends to product liability claims. Sikkelee v. Precision Airmotive Corp., 822 F. 3d 680, 693 (3d Cir. 2016). The Third Circuit in Sikkelee declined to defer to the agency’s view on preemption and instead drew a line between regulations governing in-flight

operations (preempted) and aircraft design (not preempted). Id. at 694. Plaintiffs cite to Sikkelee for the proposition that designing, and manufacturing aircraft parts is not related to in-air operations of aircraft. Therefore, plaintiffs argue that, “much like the tree cutting regulations in Goodspeed, the state law products liability claims in this case do not intrude into the field of air safety.” Nevertheless, the Second Circuit has not distinguished between in-air operations on the one hand and design and manufacture on the other. Absent such a distinction, aircraft engine component design falls squarely within the “entire field of air safety.” Indeed, Fawemimo involved a claim by an airline passenger who alleged that she hit her head on a television monitor above her seat while boarding the aircraft; the Second Circuit held that such a design claim is field preempted without examining whether the parts were related to in-air operations. Fawemimo, 751 Fed. Appx. at 19. Moreover, the instant case involves

design defect claims that allegedly caused the helicopter to crash, so the components at issue here are more related to in-air operations than is location of the television monitors, which the Second Circuit found to be preempted. Accordingly, the Court finds that, under Second Circuit precedent, the level of federal interest presented by the FAA’s product certification scheme sufficient to warrant a finding of preemption. Military Aircraft Third, plaintiffs submit that regardless of any broad finding of preemption of the entire field of aviation safety, the military helicopter at issue in this case was not subject to FAA certification requirements. See U.S. v. Aero Spacelines, Inc., 361 F.2d 916, 921-22 (9th Cir. 1966) (“[A]ircraft used exclusively in the

service of the government, but not including any government-owned aircraft engaged in carrying persons or property for commercial purposes, have long been exempt from regulatory control and from rules and regulations relating to civil aircraft.”). Defendants respond that they were still bound by federal regulations governing post-certification conduct on the part of a certificate holder, including: • reporting “any failure, malfunction, or defect in any product or article manufactured by it that it has determined has resulted in [serious failures or malfunctions],” 14 C.F.R. § 21.3(a); • reporting “any defect in any product or article manufactured by it that has left its quality system and that it determines could result in [serious failures or malfunctions],” 14 C.F.R. §21.3(b);

• obtaining FAA approval prior to implementing any “major” design change (i.e., a change that appreciably impacts an aircraft’s “operational characteristics,” something a FADEC change indisputably would impact), 14 C.F.R. § 21.93(a); 21.97; and

• complying with any Airworthiness Directive (“AD”) issued by the FAA, including submission of design changes necessary to address the issue(s) identified in the AD, 14 C.F.R. § 21.99.

Moreover, defendants point out that plaintiffs admitted that “any subsequent changes to the R/3M Engine, including the FADEC had to first be approved by the FAA.” The decision to exempt government military aircraft from FAA standards in certain contexts does not constrain the clear congressional intent to occupy the entire field of aviation safety. It merely represents a choice by Congress to relieve American armed forces from civilian restraints that would be unreasonable in a war setting, not an opportunity for states to impose patchwork standards of care on suppliers of the military forces of the United States. Imposition of various common law rules upon military aircraft would be incompatible generally with the federal government’s authority to regulate the field of air safety, and specifically with the decision by Congress to relax regulations for aircraft used exclusively in the service of government. Manufacturing Defect Claims Plaintiffs submit that even if the Court finds the entire field of aviation safety to be preempted, plaintiffs’ manufacturing defect claims should survive. See McConologue v. Smith & Nephew, Inc., 8 F. Supp. 3d 93 (D. Conn. 2014). Nevertheless, the manufacturing claims in McConologue were not preempted in part because the plaintiff there alleged violation of the federal regulations: The sufficiently alleged that the Ceramic Liner implanted in his body was not manufactured in accordance with federal standards and that the failure to meet these standards resulted in the defect observed on the device implanted in his body; thus his manufacturing defect claim survives preemption under § 360k and meets the pleading standards set forth in Iqbal and Twombly.

Id. at 105 (emphasis supplied). Defendants respond that plaintiffs’ manufacturing claim should fail because there is no evidence that the components at issue did not comply with federal design specifications at the time of assembly, as required for a manufacturing defect claim. See Ga. Prod. Liab. Law § 6:1 & n. 9 (“Proof that the product possessed a defect at the time it left the manufacturer is essential [to a manufacturing defects claim].” (citing Restatement (Third) of Torts). Here, post- accident testing only reveals an “out of specification” finding after several years in the field. Defendants also argue that they did not manufacture the FADEC MVP at issue, so any manufacturing defect claim against them must fail. Defendants point out that plaintiffs conceded that the MVP was supplied by third-party vendor. See Mohanty v. Toyota Motor Sales, USA, Inc., 2018 WL 11408590, at *2 (N.D. Ga. 2008) (“[B]ecause Defendant did not manufacture the vehicle in question, Defendant cannot be held strictly liable for any alleged manufacturing defect that caused Plaintiff's injuries.”); see also Giordano v. PGT Industries, Inc., 2007 WL 4233002, at *3 (S.D.N.Y. 2007) (“To hold a defendant liable for manufacturing a defective product, the plaintiff must, of course, be able to prove that the defendant actually manufactured the product.”). Accordingly, plaintiffs manufacturing defect claim will not survive summary judgment. CONCLUSION Plaintiffs’ state law claims of strict liability, negligence, breach of warranty, breach of contract, and fraud are field preempted. Accordingly, summary

judgment will be granted in favor of defendants. Dated this 30th day of September, 2019, at Bridgeport, Connecticut.

/w/Warren W. Eginton WARREN W. EGINTON SENIOR UNITED STATES DISTRICT JUDGE 14 C.F.R. § 33.28 Engine control systems.

(a) Applicability. These requirements are applicable to any system or device that is part of engine type design, that controls, limits, or monitors engine operation, and is necessary for the continued airworthiness of the engine. (b) Validation— (1) Functional aspects. The applicant must substantiate by tests, analysis, or a combination thereof, that the engine control system performs the intended functions in a manner which: (i) Enables selected values of relevant control parameters to be maintained and the engine kept within the approved operating limits over changing atmospheric conditions in the declared flight envelope; (ii) Complies with the operability requirements of §§ 33.51, 33.65 and 33.73, as appropriate, under all likely system inputs and allowable engine power or thrust demands, unless it can be demonstrated that failure of the control function results in a non-dispatchable condition in the intended application; (iii) Allows modulation of engine power or thrust with adequate sensitivity over the declared range of engine operating conditions; and (iv) Does not create unacceptable power or thrust oscillations. (2) Environmental limits. The applicant must demonstrate, when complying with §§ 33.53 or 33.91, that the engine control system functionality will not be adversely affected by declared environmental conditions, including electromagnetic interference (EMI), High Intensity Radiated Fields (HIRF), and lightning. The limits to which the system has been qualified must be documented in the engine installation instructions. (c) Control transitions. (1) The applicant must demonstrate that, when fault or failure results in a change from one control mode to another, from one channel to another, or from the primary system to the back-up system, the change occurs so that: (i) The engine does not exceed any of its operating limitations; (ii) The engine does not surge, stall, or experience unacceptable thrust or power changes or oscillations or other unacceptable characteristics; and (iii) There is a means to alert the flight crew if the crew is required to initiate, respond to, or be aware of the control mode change. The means to alert the crew must be described in the engine installation instructions, and the crew action must be described in the engine operating instructions; (2) The magnitude of any change in thrust or power and the associated transition time must be identified and described in the engine installation instructions and the engine operating instructions. (d) Engine control system failures. The applicant must design and construct the engine control system so that: (1) The rate for Loss of Thrust (or Power) Control (LOTC/LOPC) events, consistent with the safety objective associated with the intended application can be achieved; (2) In the full-up configuration, the system is single fault tolerant, as determined by the Administrator, for electrical or electronic failures with respect to LOTC/LOPC events; (3) Single failures of engine control system components do not result in a hazardous engine effect; and (4) Foreseeable failures or malfunctions leading to local events in the intended aircraft installation, such as fire, overheat, or failures leading to damage to engine control system components, do not result in a hazardous engine effect due to engine control system failures or malfunctions. (e) System safety assessment. When complying with this section and § 33.75, the applicant must complete a System Safety Assessment for the engine control system. This assessment must identify faults or failures that result in a change in thrust or power, transmission of erroneous data, or an effect on engine operability producing a surge or stall together with the predicted frequency of occurrence of these faults or failures. (f) Protection systems. (1) The design and functioning of engine control devices and systems, together with engine instruments and operating and maintenance instructions, must provide reasonable assurance that those engine operating limitations that affect turbine, compressor, fan, and turbosupercharger rotor structural integrity will not be exceeded in service. (2) When electronic overspeed protection systems are provided, the design must include a means for testing, at least once per engine start/stop cycle, to establish the availability of the protection function. The means must be such that a complete test of the system can be achieved in the minimum number of cycles. If the test is not fully automatic, the requirement for a manual test must be contained in the engine instructions for operation. (3) When overspeed protection is provided through hydromechanical or mechanical means, the applicant must demonstrate by test or other acceptable means that the overspeed function remains available between inspection and maintenance periods. (g) Software. The applicant must design, implement, and verify all associated software to minimize the existence of errors by using a method, approved by the FAA, consistent with the criticality of the performed functions. (h) Aircraft-supplied data. Single failures leading to loss, interruption or corruption of aircraft-supplied data (other than thrust or power command signals from the aircraft), or data shared between engines must: (1) Not result in a hazardous engine effect for any engine; and (2) Be detected and accommodated. The accommodation strategy must not result in an unacceptable change in thrust or power or an unacceptable change in engine operating and starting characteristics. The applicant must evaluate and document in the engine installation instructions the effects of these failures on engine power or thrust, engine operability, and starting characteristics throughout the flight envelope. (i) Aircraft-supplied electrical power. (1) The applicant must design the engine control system so that the loss, malfunction, or interruption of electrical power supplied from the aircraft to the engine control system will not result in any of the following: (i) A hazardous engine effect, or (ii) The unacceptable transmission of erroneous data. (2) When an engine dedicated power source is required for compliance with paragraph (i)(1) of this section, its capacity should provide sufficient margin to account for engine operation below idle where the engine control system is designed and expected to recover engine operation automatically. (3) The applicant must identify and declare the need for, and the characteristics of, any electrical power supplied from the aircraft to the engine control system for starting and operating the engine, including transient and steady state voltage limits, in the engine instructions for installation. (4) Low voltage transients outside the power supply voltage limitations declared in paragraph (i)(3) of this section must meet the requirements of paragraph (i)(1) of this section. The engine control system must be capable of resuming normal operation when aircraft-supplied power returns to within the declared limits. (j) Air pressure signal. The applicant must consider the effects of blockage or leakage of the signal lines on the engine control system as part of the System Safety Assessment of paragraph (e) of this section and must adopt the appropriate design precautions. (k) Automatic availability and control of engine power for 30–second OEI rating. Rotorcraft engines having a 30–second OEI rating must incorporate a means, or a provision for a means, for automatic availability and automatic control of the 30–second OEI power within its operating limitations. (l) Engine shut down means. Means must be provided for shutting down the engine rapidly. (m) Programmable logic devices. The development of programmable logic devices using digital logic or other complex design technologies must provide a level of assurance for the encoded logic commensurate with the hazard associated with the failure or malfunction of the systems in which the devices are located. The applicant must provide evidence that the development of these devices has been done by using a method, approved by the FAA, that is consistent with the criticality of the performed function.