The router sends the initial request, and simply waits for a well-formed answer from the Radius/TACACS server.  There is no active "keepalive" style checks, it doesn't ping the server, etc.

What the router does next, depends on your configured criteria.  In general, once the timeout expires (default is 5 seconds) or if a malformed response is received, the router will try the secondary server or fail down to the next configured authentication method.

Radius, unlike TACACS, can also mark a server as "dead" and cease to try authentications against it for a preconfigured amount of time.

See the following settings to tweak this behavior:

**Timeout Configuration:**

    TEST-1861(config)#tacacs-server timeout ?
      <1-1000>  Wait time (default 5 seconds)
    
    TEST-1861(config)#radius-server timeout ?
      <1-1000>  Wait time (default 5 seconds)


**Radius Dead-timer configuration:**

    TEST-1861(config)#radius-server deadtime ?
      <1-1440>  time in minutes

    TEST-1861(config)#radius-server dead-criteria ?
      time   The time during which no properly formed 
             response must be recieved from the RADIUS server
      tries  The number of times the router must fail 
             to receive a response from the radius server
             to mark it as dead
    
    TEST-1861(config)#radius-server dead-criteria time ?
      <1-120>  Time in seconds during which no response must
      be received from the RADIUS server in order to consider it dead
    
    TEST-1861(config)#radius-server dead-criteria tries ?
      <1-100>  Number of transmits to radius server without 
      responses before marking server as dead