Definition
Failover refers to the automatic or semi-automatic switching to backup resources when the primary system, primary network, or primary node fails, to ensure service continuity and availability. In ICMP, Failover includes Carrier Fallback for operator switching and Region Failover for regional disaster recovery, and it is a core capability for ensuring 24/7 service availability.
Switching Levels
Failover can be implemented at multiple levels: Connection Level — Carrier Fallback, switching to a backup carrier when the main network is unavailable; Platform Level — Region Failover, switching to a backup region when the primary region fails; Component Level — database master-slave setup, multiple API instances, load balancing health checks. These levels can be combined to form multi-layer redundancy. Switching can be triggered automatically (based on health checks or timeouts) or manually.
Switching Strategy
The failover strategy needs to be clearly defined: trigger conditions (fault detection methods, thresholds); failover sequence and priority; RTO (Recovery Time Objective), RPO (Recovery Point Objective); whether automatic failback is allowed and the conditions for failback. In cross-border scenarios, Region Failover must consider Data Residency to ensure that the backup region complies with regulatory requirements; Carrier Fallback must consider Geo-Based Pricing to avoid switching to high-cost networks.
Practice in ICMP
SimtoLink ICMP uses a Multi-Region, Geo-Distributed architecture, supporting Region Failover; at the connection layer, it supports Carrier Fallback and Multi-Operator redundancy. The platform achieves fault detection through health checks, heartbeats, and monitoring alerts, and implements failover through DNS, load balancing, and policy deployment to ensure business continuity for customers.
Which layer of resource moves during a switch
Failover is a general name. Which layer the action happens on changes the result completely. A connectivity-layer switch changes the operator the device is attached to. A platform-layer switch changes the region the service runs in. A component-layer switch changes the database primary, an API instance, or a queue. A failure above does not have to trigger a switch below. When a regional API is unavailable, moving field SIMs to another operator may restore the device-side network while customer systems still cannot call the management platform. Switching only the database to a standby does not change the network the device is attached to.
Each layer needs its own standby object and its own switch record. The connectivity-layer standby is another operator that can be used. The platform-layer standby is another region where the same service is already deployed. The component-layer standby is a replica already synchronized to the agreed place. “Automatic failover” with no standby object only detects failure again and again. After the switch, callers have to be able to find the new entry, for example name resolution or load distribution pointing at the new instance. If they cannot, the switch finished internally and external traffic still hits the old address.
Detection conditions automatic switching depends on
Automatic switching depends on consecutive failures, not on a single timeout. Health checks have to cover the real business path. A check that only sees the process still running, while the database can no longer be written, will keep succeeding. Thresholds should include a count or a duration, and they should be separate from business timeouts, so one slow query does not move the primary database. If the network where the checker itself sits is down, “the checker cannot see it” must not be treated directly as “the service is dead.” Probe from two places before deciding to switch.
Also state whether to switch back, and how long the standby must stay healthy before that. A connectivity-layer switch-back has to follow the cooldown of carrier fallback, so the boundary does not oscillate. A regional switch has to confirm that the standby region’s data location meets data residency. If it does not, stop at read-only or at a manual decision. Do not automatically move writes there. The recovery-time target and how much data may be lost should be written down in advance. Otherwise the switch succeeds and the accounting data is stuck at an old point that is not acceptable. A manual switch needs permission and a record, so a mis-click does not send production traffic into a drill environment.
A standby path that breaks tariff or residency constraints
A standby path that works technically is not automatically usable for the business. If the standby operator charges a high price the contract does not cover, automatic switching produces a cost during the incident that cannot be explained to the customer. If the standby region is outside the agreed residency, the switch writes personal data and detail records in the wrong place, and the copies are hard to pull back after the incident. A component-layer switch to a database that lags too far lets new enablements and suspensions overwrite old data, or lets old data cover the new operations.
If both sides believe they are primary, writes split. The prevention is a clear handoff of authority during the switch. The old primary refuses writes after it loses authority. Changing only the direction of traffic, and not fencing the old primary, makes two updates collide the moment the network recovers. Health checks that are too strict switch on a brief jitter, and the service is less stable than if it had not switched. A drill that uses the production entry and is not isolated takes real customers to the standby region. The switch record should include the detection basis, the old resource, the new resource, and whether switch-back is allowed. Afterward, check which of the three layers actually moved. Do not use a successful regional switch to explain a device that is still attached to the original operator.
A failover drill should say in advance which layer it moves, and which signal counts as success. Connectivity-layer success is the device attaching again to the standby operator and establishing a session. Regional success is the customer request reaching the standby region and writes still landing in an allowed data location. Component-layer success is the old primary no longer accepting writes, and the new primary’s data point matching what was expected. Checking all three layers with one “drill passed” hides a test that only saw the process still alive. After the drill, check whether any traffic still points at the standby object. If it does, switch back and confirm the old primary has recovered authority. A drill with no review leaves nobody knowing which check to trust the next time there is a fault.