Failover happens in stages:
Detection: The system notices a failure. Methods include heartbeats, BFD (Bidirectional Forwarding Detection), or link state monitoring.
Decision: The backup decides to take over. It must verify the primary is truly down, not just experiencing network partition.
Transition: The backup assumes the primary role. This may involve ARP updates, route advertisements, or MAC address changes.
Each stage takes time. Faster detection means faster failover, but also more false positives.