It must be shown by analysis that any probable malfunction or any probable single or multiple failure, or any probable improper operation of the engine will not cause the engine to --

(a) Catch fire;

(b) Burst (release hazardous fragments through the engine case);

(c) Generate loads greater than those ultimate loads specified in §33.23(a); or

(d) Lose the capability of being shut down.

[Amdt. 33-6, 39 FR 35467, Oct. 1, 1974, as amended by Amdt. 33-10, 49 FR 6852, Feb. 23, 1984]