14 CFR § 25.1309

The airplane's equipment and systems must be designed and installed so that:

The equipment and systems required for type certification or by operating rules, or whose improper functioning would reduce safety, perform as intended under the airplane operating and environmental conditions; and

Other equipment and systems, functioning normally or abnormally, do not adversely affect the safety of the airplane or its occupants or the proper functioning of the equipment and systems addressed by paragraph (a)(1) of this section.

The airplane systems and associated components, evaluated separately and in relation to other systems, must be designed and installed so that they meet all of the following requirements:

Each catastrophic failure condition—

Must be extremely improbable; and

Must not result from a single failure.

Each hazardous failure condition must be extremely remote.

Each major failure condition must be remote.

Each significant latent failure must be eliminated as far as practical, or, if not practical to eliminate, the latency of the significant latent failure must be minimized. However, the requirements of the previous sentence do not apply if the associated system meets the requirements of paragraphs (b)(1) and (b)(2) of this section, assuming the significant latent failure has occurred.

For each catastrophic failure condition that results from two failures, either of which could be latent for more than one flight, the applicant must show that—

It is impractical to provide additional fault tolerance; and

Given the occurrence of any single latent failure, the residual average probability of the catastrophic failure condition due to all subsequent active failures is remote; and

The sum of the probabilities of the latent failures that are combined with each active failure does not exceed 1/1000.

The airplane and systems must provide information concerning unsafe system operating conditions to the flightcrew to enable them to take appropriate corrective action in a timely manner. Systems and controls, including information, indications, and annunciations, must be designed to minimize flightcrew errors that could create additional hazards.

[Reserved]

The applicant must establish certification maintenance requirements as necessary to prevent the development of the failure conditions described in paragraph (b) of this section. These requirements must be included in the Airworthiness Limitations section of the Instructions for Continued Airworthiness required by § 25.1529.