A method of performing failover for programmable logic controllers in an automation environment and controlling a physical system, the method comprising: receiving, by a first input/output module, sensor inputs from one or more field devices; creating, by the first input/output module, a copy of the sensor inputs for a first group of programmable logic controllers (PLCs) in a first PLC bank ; transferring, by the first input/output module, the copy of the sensor inputs to each PLC in the first group of PLCs; receiving, by the first input/output module, processing results from each PLC in the first group of PLCs in response to transferring the copy of the sensor inputs; determining, by the first input/output module, whether there are any inconsistencies between the processing results received from each PLC in the first group of PLCs; and if there are any inconsistencies between the processing results received from each PLC in the first group of PLCs, initiating a failover control process by a second PLC bank by sending a failover message to a second input/output module of the second PLC bank wherein the failover control process further comprises: deactivating, by the first input/output module, the first group of PLCs in the first PLC bank ; disabling, by the first input/output module, one or more output ports of the first group of PLCs in the first PLC bank associated with control of the physical system; and sending, by the first input/output module, a failover message to the second input/output module instructing the second input/output module to resume control and drop outputs for a predetermined number of cycles. receiving, by a first input/output module, sensor inputs from one or more field devices; creating, by the first input/output module, a copy of the sensor inputs for a first group of programmable logic controllers (PLCs) in a first PLC bank ; transferring, by the first input/output module, the copy of the sensor inputs to each PLC in the first group of PLCs; receiving, by the first input/output module, processing results from each PLC in the first group of PLCs in response to transferring the copy of the sensor inputs; determining, by the first input/output module, whether there are any inconsistencies between the processing results received from each PLC in the first group of PLCs; and if there are any inconsistencies between the processing results received from each PLC in the first group of PLCs, initiating a failover control process by a second PLC bank by sending a failover message to a second input/output module of the second PLC bank wherein the failover control process further comprises: deactivating, by the first input/output module, the first group of PLCs in the first PLC bank ; disabling, by the first input/output module, one or more output ports of the first group of PLCs in the first PLC bank associated with control of the physical system; and sending, by the first input/output module, a failover message to the second input/output module instructing the second input/output module to resume control and drop outputs for a predetermined number of cycles. deactivating, by the first input/output module, the first group of PLCs in the first PLC bank ; disabling, by the first input/output module, one or more output ports of the first group of PLCs in the first PLC bank associated with control of the physical system; and sending, by the first input/output module, a failover message to the second input/output module instructing the second input/output module to resume control and drop outputs for a predetermined number of cycles. <EOS>