Which product models can tolerate the failure of three out of four controllers?