Method for enacting failover of a 1:1 redundant pair of slave processors

A primary slave IOP, upon detecting an error, verifies the availability of a secondary slave IOP, then requests backup and takes itself out of being the primary. A secondary slave IOP assumes the role of the primary slave IOP. A master controller, detecting an error with the primary slave IOP, interrogates the primary and secondary slave IOPs for a status input, and then arbitrates between the first and second IOP to determine the IOP that is to take on the primary role. Finally the master controller awards the more operational IOP the role of the primary slave IOP, thereby completing the failover operation. A primary slave IOP which fails sets the output control signal as part of its failure handling and watchdog timeout function. The output control signal is also set to indicate backup for an unpowered IOP.