The idea behind the design of fail-safe controls is that there are enough to prevent accidental detonation when an atomic weapon is in a hostile environment (in

The idea behind the design of fail-safe controls is that there are enough to prevent accidental detonation when an atomic weapon is in a hostile environment (in this case falling out of a disintegrating aircraft). Given that the number of tests that must be done to ensure that a bomb doesn't detonate when any k of n bad events happen grows exponentially, you can only guarantee that the bomb is fail-safe to a certain degree; so it's not unreasonable that 3 of 4 switches failed to prevent detonation; the last one was designed in just as much as the first 3. Given that there haven't (as far as I know) been any accidental nuclear detonations despite the ridiculous number of accidental drops, I'd say the fail-safe control engineers are doing a pretty good job.