Connection Manager Automatic Failover

Several years back we tried to implement automatic failover on a cluster handled by 2 Connection Managers instances , this was on 11.5, but we had some horrors moments like ending up with 2 primaries getting updates simultaneously without communicating with each other. Since then we were really apprehensive of using that solution(although the PRIORITY option was added later to resolve that kind of issues). We still use CMs, mostly to separate our read only transactions from read/write but all failovers are done manually. My question is for those using the FAILOVER option on 12.1. How is it working? is it robust enough?