The hostile action of which you speak is included in the list of defined threats against which a Threat Assessment is conducted during Design and Development (as opposed to the TA before missions).
It is important to look at this subject in 3 distinct phases. 1. Attaining airworthiness, before Release to Service. This is a mandatory pre-requisite to; 2. Maintaining it and 3. Fitness for Purpose, which is actually what you speak of as it is an operational term in this sense. Crucially, the Safety Case MUST reflect the Build Standard in all 3 phases (which by definition means the BS must be maintained, which is the basic failure reported by MoD(PE) (to AMSO) in January 1988 the ARTs (to CAS and RAF Chief Engineer) from 1992. However, the regulations acknowledge that in exceptional circumstances the Safety Case may not reflect the actual Build Standard of individual aircraft or operational circumstances/emerging roles. The Apache rescue is an excellent example. But, they are crystal clear in that, regardless of whether it is a DA mod or a Service mod, the basic airworthiness must be attained and demonstrated in the first place. UORs allow circumvention of much torturous hoop jumping forced upon procurers, but not the airworthiness regs. I have never come across a case where it wouldn’t have been quicker just to follow the regs in the first place. In fact, the nature of UORs (where cost is less of an issue) means affordability is seldom an issue.
For example, the first two defined threats in the Def Stan are “inert projectiles” and “incendiary projectiles”. That implies hostility on someone’s part! Consider the C130 XV179 case. If these projectiles result in a fire risk, the defined mitigation is to fit Explosive Suppressant Foam. Note: You don’t have to think of the threat/risk, it is defined and so is the mitigation. The reader is pointed to MoD(PE) standards from the early 1980s. (e.g. DTD 5624, March 1981 and DTD 5627, April 1982). Both apply to fire suppression in Fuel Tanks and Dry Bays. That they existed in the first place means the risk was identified and funding committed to mitigation in, at least, the 1970s. That they were superseded meant someone was on top of their game and ensuring they were up to date. So far, so good. Implement these simple regs and you are well on the way.
What went wrong, and the Tornado, Chinook, Nimrod, Sea King etc cases share this common theme to a greater or lesser extent, is that the regulations were not implemented. THAT is why Haddon-Cave was commissioned, following ACM Loader’s statement to this effect in the XV230 BoI report.
What compounded this failure in each case, and what MoD refuse to address, is experienced staffs, both in Boscombe and MoD(PE), identified the risks, notified those responsible of their legal obligations AND the required mitigation – and were shown the door.
What further compounded these cases was MoD proceeded to lie through their back teeth and deny events which were a simple matter of record. Back to C130. In court they denied knowledge of ESF, saying it only came to their attention after the event. The legal people representing the families and the Coroner were singularly unimpressed when handed the aforesaid MoD specifications. Same on Chinook FADEC. MoD said “Not Safety Critical”. Lord Philip was handed the MoD policy directive from 1989 which proved it was. (DUS(DP)/924/11/2/9 dated 14th December 1989). I imagine he wasn’t impressed with MoD either. And so on. The individual cases are bad enough, but the cumulative effect and failure to “learn lessons” is appalling.
I could almost forgive the failure to integrate IFF failure warnings if it was a last minute, rush job, and the aircrew were warned. It wasn’t. I can even understand an inexperienced Project Manager or Engineering Authority initially overlooking it from the contract. After all, CDP ruled in 1996 he no longer required engineering experience in MoD – something Bernard Gray is now trying to overturn. We know typical IFF contracts didn’t seek a demonstration of installed performance, because the response from the IFF office was a child-like “It works on the bench so it’ll work on the aircraft” – if you don’t know what the installed performance is, how can you note any Limitations in the RTS? (In fact, the failure to integrate failure warnings is so fundamental it is not a Limitation, it is an Operational Constraint, meaning it is flagged at a much higher level and DEC are obliged to staff a requirement to remove it). However, what is truly unforgivable is the automatic response from two 2 Stars upon being notified aircrew were at risk due to failure to integrate failure warnings. They literally turned their backs and walked away, yet they were the last line of defence, supposedly providing “management oversight”. Overlook, more like. Their actions are reflected in the culture we see today in MoD, which Bernard Gray says he is trying to overcome. Best of luck mate.