There is an example that does exactly that, take a look at the configurations and start there.
I assume you mean the multiple-failover-failback example. I did look at it but did not find any hints. This example uses <allow-failback>true</allow-failback> - just as I do.
I also assume I don't need to set <shared-store>true</shared-store> because I don't want to share the storage.
According the manual (Chapter 39. High Availability and Failover) the setup <failover-on-shutdown>false</failover-on-shutdown> is optional because it stands for another feature: Even on normal shutdown (not a kill) the failover might happen. Nevertheless I set this to true.
Might you please tell me what the important difference is between this configuration and mine?
I figured out why multiple-failover-failback works with live/backup/backup: All of the servers use the same (shared) store. This is no option for me because the servers run on different machines and I must not use shared storage.