Don't try to use the fault handler to initiate a message. That's not the purpose of the fault handler.
Use a repeating timer to fire a MSG instruction from the "monitoring" controller to the "monitored" controller, as described in RA Knowledgebase article ID # 21989. This uses the "Get Attribute List" service to read values from the Device Identity object.
This will allow you to read the Run/Prog/Fault controller state and Rem/Remote/Prog keyswitch position from the remote controller.
If the Message instruction fails with a communication error, you know that there is a communications path problem between the controllers.