Royal Navy Merlin Crew Shut Down Two Working Engines After a Fuel Fault Looked Like a Double Engine Failure

The crew of a Royal Navy Merlin helicopter shut down two healthy engines after mistaking one runaway engine for a double engine failure, leaving the aircraft without power at low level over the sea at night, a UK military inquiry published on September 11, 2026 has found.

The Merlin HC4, ZJ135 of 846 Naval Air Squadron, ditched off the Dorset coast on September 4, 2024. The handling pilot, Lieutenant Rhodri Leyshon, suffered a serious injury in the impact that prevented him from escaping, and was later pronounced dead in hospital.

The Defence Safety Authority’s service inquiry traced it to a split diaphragm in a fuel component on the number two engine, weakened by a procedure the engine maker Safran introduced in 2020. The panel made 44 recommendations.

Three minutes over the sea

The crew were flying night deck landing training with HMS Queen Elizabeth about 25 nautical miles south of Lyme Regis. At 20:46:30, at 125 feet on approach to the ship, the diaphragm in the number two engine’s high-pressure fuel metering unit split.

That engine’s torque peaked at 136.5 percent and main rotor speed climbed from 102 to 107 percent. Engines one and three automatically wound back to between 0 and 30 percent torque to hold rotor speed within limits.

The crew got a master warning, an engine-fail audio alert and a red ENG FAIL warning. They declared a mayday for a double engine failure and planned a running landing back aboard the carrier.

On the final approach, the aircraft commander moved the condition switches for engines one and three straight from FLIGHT to OFF, without the second-crew-member confirmation that Merlin procedures call for on flight-critical switches.

The number two engine then hit its overspeed protection, which cut its fuel. Restart attempts failed, and ZJ135 struck the water at 20:49:30, three minutes after the diaphragm split. The other two crew escaped with minor injuries.

Why a three-engine helicopter still lost all power

The AW101 Merlin flies on three Safran RTM322 engines, a redundancy the fleet’s risk assessments relied on. The trap was the warning: the report says ENG FAIL did not show which engine had malfunctioned, because a torque split can mean one engine failing low or one failing high.

Telling the two apart takes other cues, such as rotor speed, which here had risen above normal rather than drooping. The panel found the stack of warnings “almost certainly dominated” the handling pilot’s attention.

Some helicopters, such as the NH90, show a dedicated ENG DIFF caption for a torque split. The panel rated the reading of the Merlin’s cockpit indications a contributory factor and, according to Navy Lookout, recommended a review of the warning system.

It ruled the lack of a shared crew plan, with no discussion of engine conditions, and the switch selection a causal factor.

A part weakened in the workshop

In November 2020, Safran brought a “setting-in” procedure to the RTM322 from its other engines, abruptly depressurizing the fuel system 10 times to free a regulator valve. On those engines the pressure changes acted on an upstream shut-off valve; on the RTM322 that valve sits downstream, so the diaphragm took the stress.

The approval never assessed the effect on the regulator itself, and Safran’s processes required no written record of it. Of 226 diaphragms suspected of going through the procedure, 117 were examined and 10 had damage that could lead to a split.

One came from ZJ998, another Merlin whose engine ran away while refuelling at RNAS Yeovilton on October 31, 2023. That fault got the lowest possible risk rating, on the strength of overspeed protection and triple redundancy, and the panel judged that reasonable.

The procedure has now ceased, and the inquiry recommends an audit of Safran Helicopter Engines’ maintenance and design approvals.

Currency and survival

The crew were within regulatory limits for the sortie, but the handling pilot was not current in deck landings and the commander was not current for deck landings on night-vision goggles. The panel believed the resulting skill fade very likely undermined their handling of the emergency.

It judged the impact survivable. Lt Leyshon’s seat was set for 209 pounds (95 kg), less than his actual mass, and the report says his injury was likely caused by reduced operation of the seat’s load-attenuating devices.