Redundant automation controller permitting replacement of components during operation

A primary controller communicating with a secondary controller to, at a switch-over time, cease execution of a user program and cause the secondary controller to begin execution of the user program, the primary controller comprising:

• an electrical backplane having a series of electrical connectors halves;
• functional modules having corresponding connector halves removably connected to the connector halves of the electrical backplane allowing the functional modules and allowing the functional modules to communicate with each other on the backplane and to communicate a fault status on the backplane when the functional modules detect a fault internal to the functional modules;
• disconnection detection circuitry communicating with the backplane to:
• (a) detect a fault status from a functional modules and in response to cause a switch-over of control to the secondary controller,
• (b) detect a removal of a functional module where such removal prevents communication of a fault status by the functional module and in response to cause a switchover of control to the secondary controller,
• (c) detect a reconnection of a functional module and absence of a fault status and in response to cause a return of control to the primary controller.