An industrial automation controller comprising: a first processing unit including a first processor (252a, 302), a first memory, a first clock source, and a first fault indicator signal, the first processing unit configured to execute a first safety loop (427; 404, 412, 416, 418); a second processing unit including a second processor (252b, 312), a second memory, a second clock source, and a second fault indicator signal, the second processing unit configured to execute a second safety loop (427; 414, 422, 430, 432, 434); a communication link configured to provide status information between the first processing unit and the second processing unit; a communications device (308, 310) operatively associated with Input/Output, I/O, communications between the first processing unit and one or more remote devices; and a handler operatively associated with the first processing unit and the second processing unit, the handler configured to receive as inputs the first fault indicator signal and the second fault indicator signal, characterized in that: the handler is an integrated circuit, and the integrated circuit is further configured to: provide data communications between the first processor and the communications device, and disable the I/O communications if the second fault indicator signal represents a fault condition associated with an execution of the second safety loop. a first processing unit including a first processor (252a, 302), a first memory, a first clock source, and a first fault indicator signal, the first processing unit configured to execute a first safety loop (427; 404, 412, 416, 418); a second processing unit including a second processor (252b, 312), a second memory, a second clock source, and a second fault indicator signal, the second processing unit configured to execute a second safety loop (427; 414, 422, 430, 432, 434); a communication link configured to provide status information between the first processing unit and the second processing unit; a communications device (308, 310) operatively associated with Input/Output, I/O, communications between the first processing unit and one or more remote devices; and a handler operatively associated with the first processing unit and the second processing unit, the handler configured to receive as inputs the first fault indicator signal and the second fault indicator signal, characterized in that: the handler is an integrated circuit, and the integrated circuit is further configured to: provide data communications between the first processor and the communications device, and disable the I/O communications if the second fault indicator signal represents a fault condition associated with an execution of the second safety loop. the handler is an integrated circuit, and the integrated circuit is further configured to: provide data communications between the first processor and the communications device, and disable the I/O communications if the second fault indicator signal represents a fault condition associated with an execution of the second safety loop. provide data communications between the first processor and the communications device, and disable the I/O communications if the second fault indicator signal represents a fault condition associated with an execution of the second safety loop.