A cockpit design deficiency in a Cessna twin-engine aircraft led to pilots inadvertently shutting down both engines after confusing unguarded engine stop switches with adjacent fuel enrichment buttons. The stop switches, which cut engine operation when activated, were positioned immediately below the fuel enrichment controls used during normal flight operations. Because both sets of controls were physically proximate and the stop switches lacked protective guards, pilots reaching for the enrichment buttons made contact with the shutdown controls instead, triggering a dual-engine power loss event. The incident illustrates a textbook human factors failure in which control placement and the absence of tactile or mechanical differentiation created conditions for a consequential error.
The broader human factors principle at work here is one of the most studied in aviation cockpit design: the danger of placing high-consequence, infrequently used controls adjacent to routine-use controls without physical safeguards. Guarded switches — those requiring a pilot to lift a cover or perform a deliberate secondary action before activation — exist precisely to interrupt the kind of habitual, confirmatory-glance-free reach that experienced pilots develop over time. When fatigue, workload, or distraction compounds the design flaw, the probability of an inadvertent activation rises sharply. A dual engine shutdown on a twin-engine piston aircraft eliminates all immediate redundancy and, depending on altitude and configuration, can leave the crew with extremely limited options for recovery.
For Part 91, 91K, and 135 operators flying Cessna piston or turboprop twins, this incident is a direct call to audit cockpit control layouts against the actual physical habits of line crews. Operators should identify any unguarded stop, fuel shutoff, or feathering controls positioned near high-frequency-use buttons and evaluate whether physical guards, distinct tactile shapes, or positional separation are adequate. This is particularly relevant during preflight and runup phases, when pilots may be moving quickly through checklists and muscle memory is most likely to override deliberate cross-checking. Some older Cessna airframes were certified under design standards that predate modern human factors rigor, meaning the regulatory floor does not guarantee a safe ergonomic layout.
This event connects to a persistent and well-documented pattern in aviation safety: legacy aircraft designs that remain airworthy from an airworthiness certificate standpoint but carry embedded human factors hazards that were not addressed at original certification. The FAA's ongoing push for Safety Management Systems (SMS) in Part 135 operations, and NBAA's human factors guidance for business aviation crews, both emphasize proactive identification of these latent hazards rather than waiting for incidents to reveal them. Modification shops and avionics houses have in many cases developed retrofit solutions — including guarded switch covers and relabeled panels — that operators can pursue as part of a formal hazard mitigation program. The cost of a guard is negligible against the consequence of a dual-engine shutdown at cruise altitude.