[Delphinus]

Steve and Jack explained perfectly what I meant. The risk of "a failure of some kind" is greater but the risk of "what damage is going to be done" is mitigated (ie, limited). Thinking of process control there are concepts such as "fault-tolerance" and "fail-safe" and "single point of failure." "Fail-safe" means we recognize the possibility of a failure, but if a failure happens, it is left in a safe state. "Fault-tolerant" means that a failure might happen, but the process will be able to continue unaffected. Since a heater cannot be guaranteed "fail-safe" then you want to use a heater such that that if it suffers a worst-case scenario failure (and Murphy's Law dictates that the possibility of this is darn near 100%), then you want to be able to know that it won't cook your tank all by itself. I.e, NOT a "single point of failure." If you use TWO heaters then they both have to fail on to cook your tank, and the possibility of THAT is (theoretically) half that of a single heater failing on. Thus the multiple heater scenario is closer to a "fault tolerant" design.

This only makes sense if you're using heaters that by themselves are underpowered for the tank. If you are using fully redundantly sized heaters then indeed you are just doubling the risk of a meltdown. This is an important assumption to be pointed out.

Don't get me wrong: I'm not knocking the secondary controller idea. The reason THAT is good idea is that using a secondary controller (as well as the thermostat in the heater) is that in that scenario, you don't have "single point of failure." No one item failing is enough to shut you down.

There you go. Next lesson will be "programming in a real-time dual-redundant semi-fault-tolerant environment." Oh wait .... That's my job not my reefing hobby. Forget that! :D