Royal Navy Merlin inquiry finds two working engines shut down before fatal ditching

A Royal Navy inquiry has found that a failed fuel-pump component and ambiguous warnings preceded the shutdown of two serviceable engines aboard Merlin HC Mk 4 ZJ135. The third engine then automatically cut its own fuel supply, leaving the helicopter without power before its fatal ditching off Dorset.

The findings, published on September 12, 2026, explain how a single-engine malfunction escalated during deck-landing training with HMS Queen Elizabeth on September 4, 2024. Lieutenant Rhodri Leyshon, 31, was fatally injured. The aircraft commander and an aircrewman escaped. The inquiry traced the initial failure to a diaphragm inside the No. 2 engine’s high-pressure fuel-pump assembly.

One overproducing engine looked like two failing engines

When the diaphragm split, excess fuel entered the No. 2 engine. Its torque peaked at 136.5%, while main-rotor speed rose from 102% to 107%. The aircraft management system reacted as designed: to control rotor speed, it reduced output from the No. 1 and No. 3 engines to between 0% and 30% torque.

That automatic response created the central diagnostic problem. A large torque split can indicate that one engine is producing too much power, but an identical split can also appear when two engines are producing too little. The Merlin’s warning logic did not clearly identify which of those conditions was occurring.

The crew concluded that engines No. 1 and No. 3 had failed. No crew member formally challenged that diagnosis, according to the inquiry, and the condition switches for both engines were moved directly from FLIGHT to OFF without the required second-person confirmation for flight-critical switches.

This was not a case of the automatic control system simply failing. It reduced the two serviceable engines as intended to manage the rotor-speed increase. The safety problem was that the resulting cockpit indications did not make the underlying high-torque fault sufficiently clear during a time-critical emergency at low altitude, over the sea and in darkness.

The last engine removed itself from the system

Once the two serviceable engines had been shut down, the malfunctioning No. 2 engine carried the remaining load. It reached its 117% overspeed threshold, triggering an automatic fuel cut. The helicopter was then powerless and entered an unpowered descent.

ZJ135 struck the water three minutes after the initial malfunction, at 62 knots and a descent rate of 1,984 feet per minute. Those recorded figures establish the aircraft’s final condition, but they do not reduce the accident to one cockpit action. The board identified an interconnected sequence involving the mechanical failure, warning interpretation, crew coordination, switch-confirmation discipline and recent training exposure.

The aircraft commander had missed the 15-hour monthly competency target in four of the preceding six months and had flown once during the previous 40 days. The panel assessed that collective skill fade very likely weakened the crew’s ability to manage the complex emergency. That is an inquiry finding about crew readiness and coordination, not proof that flying hours alone caused the accident.

A maintenance process weakened more than one diaphragm

Investigators traced the failed diaphragm’s weakness to a Safran maintenance procedure introduced in November 2020. The process repeatedly pressurized and abruptly depressurized the RTM322 fuel system to free a regulator valve. Safran manufactures the RTM322 engines installed in the Merlin.

Of 226 diaphragms suspected of having undergone the procedure, 117 were examined after the accident. Ten showed damage capable of developing into a split. Another affected diaphragm had been installed in Merlin ZJ998, which experienced an identical engine runaway while being refuelled at Royal Naval Air Station Yeovilton on October 31, 2023.

The inquiry nevertheless judged the earlier risk assessment reasonable. It found that the later combination a major torque split, no immediate trip of the overproducing engine and manual shutdown of the other two engines would not previously have been considered a credible progression. That distinction matters: the earlier event established a component problem, but it did not by itself reveal the complete accident chain encountered by ZJ135.

Recommendations extend beyond the engines

The report calls for a qualified review of whether the Merlin’s engine warnings can distinguish these competing fault conditions more clearly. It also recommends an audit of Safran’s UK maintenance and design approvals, revised malfunction training, examination of cockpit emergency lighting and a review of rescue-hoist availability.

Survivability systems also came under scrutiny. Only two of the four aft flotation bags worked as intended, while the forward bags did not deploy after their controlling busbar flooded during impact. These findings did not initiate the loss of power, but they widened the inquiry from engine management to the aircraft’s ability to support escape and rescue after a ditching.

The panel issued 44 recommendations, which the Royal Navy said were accepted in full. Some have been implemented, while work continues on the remainder. Acceptance is therefore not the same as completed modification: the critical next step is turning the documented warning, maintenance, training and survival-system findings into verified fleet-level changes.

By David Whitaker — Associate editor for AMI’s aerospace and drone systems desk, translating flight systems, aircraft programs, spaceflight, and UAV developments into accessible technical stories.