There's also no good reason that there wasn't standard testing before adopting the P320 to be the M18. Sig undercut Glock on price and the DOD said "eh... good enuf"
If it’s a manufacturing defect as some theorize, then the sample guns could have passed with flying colors, but the later ones have the potential issue.
It's at least partially a design and engineering problem. Sig shoehorned the hammer-fired P250 fire control unit into the P320, which is striker fired. The P250, being hammer fired, uses a fully cocked hammer capable of setting off a primer when dropped, and the P320 (to my understanding) also uses a fully cocked striker, meaning less trigger input is required for firing.
Hammer fired guns are capable of doing this safely because they have a sear geometry that requires moving the hammer back against spring pressure with trigger input a very short distance before the hammer drops. Along with a functioning sear block in case the hammer slips off the sear without trigger input, this makes them very safe.
Basically every other striker fired gun on the market uses a semi-cocked striker with a trigger widget and sear block, which is a copy of Glock's design, and it's quite safe.
Sig deviated from this design without fully proving it out. Their guns don't have trigger widgets, which allows the trigger to move under momentum when dropped, causing repeatable firings. The fully cocked striker design leads to a shorter, crisper pull, but a sear slip leads to uncommanded firings, unlike a semi-cocked design, which doesn't have enough energy to fire a primer.
Combine this with poor control of manufacturing, intermingling of parts designed and intended for different calibers, as well as factories in the US and India with varying levels of quality control and poor spec for parts to begin with (metal injection molding for fire control parts), and safety critical systems like the sear block have been shown to not be 100% reliable. It's a system of cascading failures resulting in a firearm that's unsafe to carry loaded.
I’m asking out of complete ignorance here, and I’d like to learn. Why don’t these have nearly perfect safety mechanisms? To my naive mind, it seems easy to add a push button that comes between the striker and bullet, or locks the striker in place. Obviously it’s not that trivial or they’d probably have done it. Why is that?
I’ve owned rifles that had safeties that made it impossible to pull the trigger. Don’t these?
If you're asking why there's no manual safety, it's because the modern doctrine for handguns says that it is unnecessary, on the basis that the handgun should either be secure in the holster or - if drawn - ready to fire. A properly secure holster prevents trigger from being pulled even accidentally, so if the gun is impossible to fire at all without pulling the trigger (as e.g. the Glock design achieves for striker-fired guns), the holster is deemed sufficient, and manual safety is considered a misfeature that doesn't add safety but makes deploying the gun more error-prone.
FWIW this isn't even a new take. Many popular DA/SA guns cannot be put on safe at all when they're not cocked, even though they can be fired through double action - logic here being the same, between heavy trigger pull and hammer block it just cannot fire without a trigger pull.
That said I personally don't agree with this analysis. Or, more accurately, I believe that the increased risk from not being able to use the gun when it's needed is not properly balanced against the increased risk from making the gun easier to fire, especially in applications where handgun is not the primary weapon (which is almost always the case for the military).
I glossed over parts of this mechanism above, but partially pre-cocked strikers require the trigger bar to pull the striker back more before the trigger bar drops down, releasing the striker. The amount the striker is pre-cocked is not enough to ignite a primer, and the act of pulling the striker back against spring pressure mimics the sear geometry of a hammer fired gun.
Fully cocked strikers are ready to ignite a primer if the striker drops. I don't know of another design like Sig's that has a fully cocked striker, which is not to say there isn't one, or that they're all unsafe.
The P320 in particular suffers from compromises shoehorning a fire control unit designed for one gun into another.
Combined with poor manufacturing techniques, tolerance stacking, part mixing, and poor QA, the striker block, which is the last safety intended to block the striker without an explicit trigger pull, can become ineffective.
To answer your question, there's no mechanical reason a handgun cannot be designed an manufactured to not fire without explicit mechanical input from the user. Indeed almost every commercially produced handgun on the market fits this requirement. A combination of failures on Sig's part has allowed this to happen.
As mentioned it is possible to make double or even triple safe (or more).
But some of the types of safeties increase the change you won’t have it on (because time to disengage the safety is too long/complicated) or that they will introduce additional failure modes.
For some missions, “unsafe” is better than “too safe” - think one step from gun drawn, finger on the trigger.
This is one of the reasons Glocks are so popular, as the trigger safety is really “easy” to disengage as it’s the same as the mechanism you use to fire.
But it doesn’t protect YOU from being a dumbass. Safeties that do that are dangerous in another way.
There was a lot of standard testing, very controlled for that matter... it just didn't include drops at an angle that seem to allow for unintended discharge... If I were to guess, Sig is well aware of that angle at this point.
