Use comm and IO based watchdogs to perform the switchover. Master always writes state changes to slave via Ethernet so handoff can be seamless. IO semaphore to hand control back and forth: all pretty standard computer science stuff. Run identical code in both PLCs.
Analog IO follows master and is not bumpless. Digital IO can be bumpless. Due to the lack of bumpless analog IO, application and state machines need to be able to handle bumps on analog handoff.
Ken is right: this is no cakewalk. Its faster, simpler and more reliable to use off-the-shelf for low volumes (it seems to work that way with everything, doesn't it). However, as an analogy, in spite of the fact that I can buy a fabulous new car off the showroom floor, that doesn't stop me from taking the time to enjoy building my own. To complete the analogy, the chance that I'm going to do as good a job building that car as a few dozen engineers and millions of dollars is about zero - but I still enjoy doing it.
You need enough volume to justify the roll-your-own approach and be prepared to test thoroughly. And because you're not going to easily handle bumpless analog transfer, this low-end approach only works for apps that can handle that analog 'reset' on transition - or you have to design your own analog transition circuit.