Each EWIS must be designed and installed so that:

1. (a) Each catastrophic failure condition—

   1. (1) Is extremely improbable; and
   2. (2) Does not result from a single failure.
2. (b) Each hazardous failure condition is extremely remote.