I am fairly certain that the only reason that the VC10K was going to have an escape system was that the Victor had one. Don't forget that, when the idea of the VC10K was being mooted , the Victor/Buccaneer accident was still fresh in the minds of some.
That would have required rather more than the 'million pound dustbin', vasco. The Victor / Buccaneer accident caused structural failure of the Victor which bunted and disintegrated; only one pilot, the late 'Neddy' Hanscombe, survived (just..) but there would have been no survivors of such an accident involving a VC10 unless the crew had ejector seats, which would have required a complete redesign of the VC10K flight deck at huge expense.
Most tanker aircraft have a fuel system which provides both receiver fuel and fuel for the tanker itself. Notable exceptions are the A310MRTT, whose outer tanks feed only the aircraft, the KC-135Q which supported the SR-71 and was configured with independent systems as the Habu needed special fuel - and AiMA's A310 boom demonstrator which, as purely a proof-of-concept aircraft, has only a single 7200 litre tank for receiver offload purposes.
With a 'common' fuel system, it is sensible to include a device which inhibits offload at a particular fuel value, so that the tanker is not put at risk of running itself out of fuel. When that level is reached, the crew may elect under certain circumstances to offload further fuel, having overridden the low level system. In the VC10 / VC10K this was a fixed fuel state; I suppose it could be considered a 'suicide switch' as incautious operation could indeed lead to a really, really dull crew transferring all their fuel to receivers, leaving themselves in control of a glider with only the ELRAT to provide electrical power - and no hydraulics.
More modern tankers (with mission planning systems which actually work, Mick
) allow the crew to set a 'Min Off-Task Fuel' value on the flight deck, so that the tanker will stop transfer at the minimum fuel required for the tanker to leave the AARA, transit back to base, make an approach, go-around, and divert to an alternate, reaching the alternate with 30 min final reserve. The transit from the area to destination also includes contingency fuel; the 'MOTF' can be calculated for either still-air, statistical met. or 'met. of the day' conditions. But it's important that, although the MOTF is accurately calculated by mission software, the
actual MOTF is agreed and set directly by the crew, not some brainless computer which thinks it knows best. An example of which was some tanker aircraft which flew a hi-lo-hi profile to a distant AARA and started offloading to a receiver with a stiff tailwind. When they turned back into wind, 'HAL' decided that, at the low TAS and consequent low GS they were now flying, the tanker had reached MOTF and promptly closed the pod valves on the receivers! HAL didn't know that the plan was to climb to high level for recovery and assumed they would lumber all the way home at low level....
