If you have a backup controller, how do you know that it's still working when you need it? It could have failed ages ago, but without giving any signs. It could suffer from the same design flaw as the primary controller, so it could stop at the same time!

Designing a fault tolerant system is much harder than designing a reliable system. For critical systems, a common solution is to use three controllers, all running at the same time. A majority voting system chooses the correct output and ignores a faulty output. To eliminate coding errors, each controller should be coded up by a separate software team.

Is your system that critical?