George:
Have you experienced the "double program mode", or is this just something that you've heard?
I've had some difficulty with doing somehthing similar to this, when I've accidently tried downloading a program (containing a bunch of changes) to the primary instead of the secondary PLC, and the switchover occurs during the download, confusing both the PLCs and RSLogix.
When dealing with BCM/BEM PLC's, I follow these rules:
1) Connect only through the DF1 port (or ethernet port, if available), not via Data Highway. This way I don't accidently get "bumped" off the PLC that I think I'm working on.
2) Only make changes to the secondary PLC. That way, if something goes wrong, the primary is still in control, with a good program.
One technique I've used to trigger a change-over is to write a negative value to an active timer (I usually have one timer as a "one-second pulse" that's running all the time.) Do that when online with the primary (violating rule #2), and it will fault, and the secondary will kick in.
Needless to say, this should be done on a timer which is not being synchronized by logic.
I've had some peculiar things happend with BCM/BEM module systems. I've made online changes to the primary plc, and when I went to make them to the secondary (with no switchover) THE CHANGES WERE ALREADY THERE! (This is the reason for rule #2).