1. A control apparatus comprising:
a first controller configured to generate control signals for controlling a machine;
a second controller configured to generate the control signals for controlling the machine;
a transfer circuit coupled between the machine and respective control outputs of the first controller and the second controller, wherein the transfer circuit is configured to switch from a first state, where the transfer circuit passes the control signals from the first controller to the machine, to a second state, where the transfer circuit passes the control signals from the second controller to the machine, responsive to receiving a first failure signal from the first controller; and
an arbiter circuit operably coupled to the transfer circuit and having at least three arbiters, wherein the arbiter circuit is configured to control the transfer circuit from the first state to the second state responsive to any two or more of the at least three arbiters generating second failure signals.
2. The apparatus of claim 1, wherein the machine is an engine, the first controller is a first engine controller, the second controller is a second engine controller, and the control signals are engine control signals.
3. The apparatus of claim 2, further comprising one or more engine speed sensors operably coupled to the arbiters, wherein the arbiters are configured to receive respective one or more engine speed signals of an engine speed of the engine from the one or more engine speed sensors, and wherein the arbiters are configured to receive a reference signal of an ordered speed of the engine, and wherein the arbiters are configured to generate the second failure signals based on the engine speed and the ordered speed.

4. The apparatus of claim 3, wherein each of the arbiters is configured to generate the second failure signal: responsive to the engine speed continuously decreasing with respect to the ordered speed for at least a designated time period; and responsive to the engine speed falling below the ordered speed by at least a designated speed amount; and responsive to the engine speed falling below a designated speed floor set at a margin above an engine idle speed of the engine.
5. The apparatus of claim 2, wherein the at least three arbiters include a first SIOM of the first engine controller, a second SIOM, and the second engine controller.
6. The apparatus of claim 2, wherein:
the transfer circuit comprises a transfer relay and a parallel network of switches for controlling the transfer relay;
the parallel network of switches includes first and second switches connected in series and configured to be respectively controlled by the second failure signals from a first and a second of the at least three arbiters, third and fourth switches connected in series and configured to be respectively controlled by the second failure signals from the second and a third of the at least three arbiters, and fifth and sixth switches connected in series and configured to be respectively controlled by the second failure signals from the first and the third of the at least three arbiters; and
responsive to the second failure signals being present at any of both the first and second switches, or both the third and fourth switches, or both the fifth and sixth switches, the parallel network of switches is configured to control the transfer relay for the transfer circuit to be in the second state such that the transfer circuit passes the engine control signals from the second engine controller to the engine.
7. A marine vessel comprising a hull, the apparatus of claim 2 disposed in the
hull, and the engine disposed in the hull.

8. A control apparatus comprising:
a transfer relay that is configured, in a default condition, to pass engine commands from a standby controller to an engine, and that is configured, in a run condition, to pass the engine commands from a main controller to the engine; and
a transfer unit that is configured, in a run condition, to set the transfer relay to the run condition of the transfer relay, and that is configured, in a startup condition, to set the transfer relay to the default condition of the transfer relay;
wherein the transfer unit is configured to transition from the run condition of the transfer unit to the startup condition of the transfer unit responsive to receiving a first main controller failure indication from the main controller and responsive to receiving second main controller failure indications from any two of three arbiters.
9. The apparatus of claim 8, wherein the transfer unit includes a transfer override switch, and wherein the transfer unit is configured, responsive to the transfer override switch being in an actuated state, not to transition from the run condition of the transfer unit to the startup condition of the transfer unit responsive to receiving the first or second main controller failure indications.
10. The apparatus of claim 8, wherein:
the transfer relay includes a plurality of single pole double throw relays having respective common poles, normally closed poles, normally open poles, and coils; and
the common poles of the relays are connected to the engine, the normally closed poles of the relays are connected to receive the engine commands from the standby controller, the normally open poles of the relays are connected to receive the engine commands from the main controller, and the coils of the relays are connected to be energized in unison by the transfer unit.

11. The apparatus of claim 10, wherein the default condition of the transfer relay corresponds to the common poles of the relays being electrically connected to the normally closed poles of the relays when the coils are de-energized and the run condition of the transfer relay corresponds to the common poles of the relays being electrically connected to the normally open poles of the relays when the coils are energized.
12. The apparatus of claim 10, wherein the three arbiters include a first SIOM of the main controller, a second SIOM, and the standby controller.
13. The apparatus of claim 8, wherein the transfer unit comprises a parallel network of switches for actuating the transfer relay, and wherein the parallel network of switches includes first and second switches connected in series and respectively energized to opened conditions by the main controller failure indications from a first and a second of the three arbiters, third and fourth switches connected in series and respectively energized to opened conditions by the main controller failure indications from the second and a third of the three arbiters, and fifth and sixth switches connected in series and respectively energized to opened conditions by the main controller failure indications from the first and the third of the three arbiters, such that responsive to the transfer unit receiving the main controller failure indications from any two of the three arbiters, the transfer relay becomes de-energized and returns to its default condition.
14. The apparatus of claim 13, wherein the three arbiters include a first SIOM of the main controller, a second SIOM, and the standby controller.
15. The apparatus of claim 13, wherein the switches of the transfer unit are relays and the transfer relay is manually operable to its default condition and to its run condition.

16. The apparatus of claim 13, wherein the transfer relay includes plural semiconductor switches operable by one or more gate drive units that are configured to be energized by the transfer unit, wherein the plural semiconductor switches of the transfer relay include a first plurality of the semiconductor switches connected to, while energized, deliver the engine commands from the main controller to the engine, a plurality of connections for delivering the engine commands from the standby controller to the engine, and a second plurality of the semiconductor switches configured to, while energized, divert from the plurality of connections the engine commands from the standby controller, wherein the transfer unit is connected to energize and to de-energize together both the first and second pluralities of semiconductor switches.
17. The apparatus of claim 8, wherein each of the arbiters is configured to generate the second main controller failure indication based on a sensed engine speed of the engine and an ordered speed of the engine.
18. The apparatus of claim 17, wherein each of the arbiters is configured to generate the second main controller failure indication: responsive to the engine speed continuously decreasing with respect to the ordered speed for at least a designated time period; and responsive to the engine speed falling below the ordered speed by at least a designated speed amount; and responsive to the engine speed falling below a designated speed floor set at a margin above an engine idle speed of the engine.
19. A marine vessel comprising a hull, the apparatus of claim 8 disposed in the hull, and the engine disposed in the hull.
20. A method comprising:
with a first controller, generating control signals to control a machine;

with a second controller, generating the control signals to control the machine;
with a transfer circuit coupled between the machine and respective control outputs of the first controller and the second controller, switching from a first state, wherein the transfer circuit passes the control signals from the first controller to the machine, to a second state, wherein the transfer circuit passes the control signals from the second controller to the machine, responsive to receiving a first failure signal from the first controller; and
with an arbiter circuit operably coupled to the transfer circuit and having at least three arbiters, controlling the transfer circuit from the first state to the second state responsive to any two or more of the at least three arbiters generating second failure signals.