Redundancy is key. My approach has always been to figure out how much wattage I need and then run three of half that number. So if you need 300 watts total, run three 150 watt heaters. That way no one failed heater can either over or under heat the tank. Mostly heaters fail off, but having internal thermostats protects you against a central controller (if you use one) from sticking on. Ideally, you would not rely on a single controller though.