It sounds like what you need to do is redo the database on upgraded machines, place this as the secondary and tertiary controllers and seamlessly switch over. So your upgraded system becomes the hot-spare and you switch-over just as you would when the primary controller fails. Then you create a new tertiary controller.

So the difficulty is now of keeping two different databases in sync until you are ready to switch over. That I'll leave to the database gurus.