As others have pointed out, there were multiple, redundant failsafes on the ballasts which would have led an intact sub to surface even if the crew were incapacitated or dead.