Redundant automation controller with deductive power-up

An industrial control system having a first and second controller unit, the two controller units operable in a primary/secondary control relationship with a primary controller unit providing active control of an industrial process and a secondary controller unit providing back-up for the primary controller unit, the controller units each comprising:

• a communication link to another of the controller units;
• a state memory having data indicating the operation of the controller unit including whether the controller unit was operating as a primary or secondary controller unit during a time prior to a power-up of the controller unit;
• a processor executing a stored program to:
• (i) detect a power-up of the controller unit;
• (ii) upon the power-up query a state memory of the other controller unit and the state memory of the controller unit;
• and
• (iii) subsequent to the query when the state memory of the other controller unit indicates the other controller unit is present but operating neither as a primary controller unit nor a secondary controller unit, preventing the controller unit from operating as a primary controller unit unless such operation is indicated by execution of a predetermined set of rules operating on data from the state memories available to both the controller units, the rules uniquely indicating which of the controller units is likely to be most suitable to serve a primary controller;
• whereby the determination as to which controller unit becomes primary controller unit is not a race condition.