16.4.1 The limits of safe use of any of the stabilization
control system devices shall be based on demonstrations and a verification
process in accordance with annex 9.
16.4.2 Demonstration in accordance with annex 9 shall determine any adverse effects
upon safe operation of the craft in the event of an uncontrollable
total deflection of any one control device. Any limitation on the
operation of the craft as may be necessary to ensure that the redundancy
or safeguards in the systems provide equivalent safety shall be included
in the craft operating manual.