You don't indicate what version of code you are running on the controllers, but in the newer releases, I know 6.0.188.0 has it and I believe that 4.2.207.0 has this feature as well; but you can set a priority on the AP's. So if there are key areas of your facility that are more important than others you can specify them to have priority to associate to the controller so that in the end if one controller failed you'd only have 4 AP's down.
The other option would be to configure H-REAP on the 16 AP's although this is more overhead and management work, it would afford you the ability to lose the controllers and main working as long as the AP's don't lose power.
Those would be my two options.
Any one else got some thoughts?
Hope this helps.
