Preface

S7-1500R/H
Documentation Guide 1
New properties/functions 2
SIMATIC System overview 3
Application planning 4
S7-1500
S7-1500R/H redundant system Installation 5
Wiring 6
System Manual Configuration 7
Basics of program
execution 8
Protection 9
Commissioning 10
Display 11
Maintenance 12
Test and service functions 13
Technical specifications 14
Dimension drawings A
Accessories/spare parts B
Safety symbols C

05/2021
A5E41814787-AC
Legal information
Warning notice system
This manual contains notices you have to observe in order to ensure your personal safety, as well as to prevent
damage to property. The notices referring to your personal safety are highlighted in the manual by a safety alert
symbol, notices referring only to property damage have no safety alert symbol. These notices shown below are
graded according to the degree of danger.

DANGER
indicates that death or severe personal injury will result if proper precautions are not taken.

WARNING
indicates that death or severe personal injury may result if proper precautions are not taken.

CAUTION
indicates that minor personal injury can result if proper precautions are not taken.

NOTICE
indicates that property damage can result if proper precautions are not taken.
If more than one degree of danger is present, the warning notice representing the highest degree of danger will
be used. A notice warning of injury to persons with a safety alert symbol may also include a warning relating to
property damage.
Qualified Personnel
The product/system described in this documentation may be operated only by personnel qualified for the specific
task in accordance with the relevant documentation, in particular its warning notices and safety instructions.
Qualified personnel are those who, based on their training and experience, are capable of identifying risks and
avoiding potential hazards when working with these products/systems.
Proper use of Siemens products
Note the following:

WARNING
Siemens products may only be used for the applications described in the catalog and in the relevant technical
documentation. If products and components from other manufacturers are used, these must be recommended
or approved by Siemens. Proper transport, storage, installation, assembly, commissioning, operation and
maintenance are required to ensure that the products operate safely and without any problems. The permissible
ambient conditions must be complied with. The information in the relevant documentation must be observed.

Trademarks
All names identified by ® are registered trademarks of Siemens AG. The remaining trademarks in this publication
may be trademarks whose use by third parties for their own purposes could violate the rights of the owner.
Disclaimer of Liability
We have reviewed the contents of this publication to ensure consistency with the hardware and software
described. Since variance cannot be precluded entirely, we cannot guarantee full consistency. However, the
information in this publication is reviewed regularly and any necessary corrections are included in subsequent
editions.

Siemens AG A5E41814787-AC Copyright © Siemens AG 2018 - 2021.

Digital Industries Ⓟ 04/2021 Subject to change All rights reserved
Postfach 48 48
90026 NÜRNBERG
GERMANY
Preface

Purpose of the documentation

This documentation provides important information on the following aspects of the
S7-1500R/H redundant system:
• An overview of the redundant system
• Configuration and failure scenarios
• How to install, wire and commission the redundant system
• Information on maintenance and fault correction

Basic knowledge required

General knowledge in the field of automation engineering is required to understand this
documentation.

Validity of the documentation

This documentation applies to all products of the SIMATIC S7-1500R/H redundant system.

Note
In principle, all contents of the system manual for the H-CPU also apply to the fail-safe CPU
(HF-CPU). Deviating contents and special features are described as supplements and marked
with references.
When using HF-CPUs in safety mode, note the description of the F-system SIMATIC Safety
Programming and Operating Manual SIMATIC Safety - Configuring and Programming
(https://support.industry.siemens.com/cs/ww/de/view/54110126/en).

Conventions
STEP 7: In this documentation, "STEP 7" is used as a synonym for all versions of the
configuration and programming software "STEP 7 (TIA Portal)".
Please also see the notes indicated as follows:

Note
A note contains important information on the product described in the documentation, on
the handling of the product or on the section of the documentation to which particular
attention should be paid.

S7-1500R/H redundant system

System Manual, 05/2021, A5E41814787-AC 3
Preface

Special information

Note
Important note for maintaining operational safety of your plant
Plants with safety-related features are subject to special operational safety requirements on
the part of the operator. The supplier is also obliged to comply with special product
monitoring measures. For this reason, we inform you in personal notifications about product
developments and features that are (or could be) relevant to the operation of systems from a
safety perspective.
You should subscribe to the corresponding notifications in order to obtain the latest
information and to allow you to make any necessary modifications to your system.
Log on to Industry Online Support. Follow the links below and click on "Email on update" on
the right-hand side in each case:
• SIMATIC S7-300/S7-300F (https://support.industry.siemens.com/cs/ww/en/ps/13751)
• SIMATIC S7-400/S7-400H/S7-400F/FH
(https://support.industry.siemens.com/cs/ww/en/ps/13828)
• SIMATIC WinAC RTX (F) (https://support.industry.siemens.com/cs/ww/en/ps/13915)
• SIMATIC S7-1500/SIMATIC S7-1500F
(https://support.industry.siemens.com/cs/ww/en/ps/13716)
• SIMATIC S7-1200/SIMATIC S7-1200F
(https://support.industry.siemens.com/cs/ww/en/ps/13883)
• Distributed I/O (https://support.industry.siemens.com/cs/ww/en/ps/14029)
• STEP 7 (TIA Portal) (https://support.industry.siemens.com/cs/ww/en/ps/14340)

Recycling and disposal

For environmentally friendly recycling and disposal of your old equipment, contact a certified
electronic waste disposal company and dispose of the equipment according to the applicable
regulations in your country.

S7-1500R/H redundant system

4 System Manual, 05/2021, A5E41814787-AC
 Preface

Security information
Siemens provides products and solutions with industrial security functions that support the
secure operation of plants, systems, machines and networks.
In order to protect plants, systems, machines and networks against cyber threats, it is
necessary to implement – and continuously maintain – a holistic, state-of-the-art industrial
security concept. Siemens’ products and solutions constitute one element of such a concept.
Customers are responsible for preventing unauthorized access to their plants, systems,
machines and networks. Such systems, machines and components should only be connected
to an enterprise network or the internet if and to the extent such a connection is necessary
and only when appropriate security measures (e.g. firewalls and/or network segmentation)
are in place.
For additional information on industrial security measures that may be implemented, please
visit (https://www.siemens.com/industrialsecurity).
Siemens' products and solutions undergo continuous development to make them more
secure. Siemens strongly recommends that product updates are applied as soon as they are
available and that the latest product versions are used. Use of product versions that are no
longer supported, and failure to apply the latest updates may increase customers' exposure to
cyber threats.
To stay informed about product updates, subscribe to the
Siemens Industrial Security RSS Feed visit (https://www.siemens.com/industrialsecurity).

Siemens Industry Online Support

You can find current information on the following topics quickly and easily here:
• Product support
All the information and extensive know-how on your product, technical specifications,
FAQs, certificates, downloads, and manuals.
• Application examples
Tools and examples to solve your automation tasks – as well as function blocks,
performance information and videos.
• Services
Information about Industry Services, Field Services, Technical Support, spare parts and
training offers.
• Forums
For answers and solutions concerning automation technology.
• mySupport
Your personal working area in Industry Online Support for messages, support queries, and
configurable documents.
This information is provided by the Siemens Industry Online Support in the Internet
(https://support.industry.siemens.com).

S7-1500R/H redundant system

System Manual, 05/2021, A5E41814787-AC 5
Preface

Industry Mall
The Industry Mall is the catalog and order system of Siemens AG for automation and drive
solutions on the basis of Totally Integrated Automation (TIA) and Totally Integrated Power
(TIP).
You can find catalogs for all automation and drive products on the Internet
(https://mall.industry.siemens.com).

S7-1500R/H redundant system

6 System Manual, 05/2021, A5E41814787-AC
Table of contents

Preface ................................................................................................................................................... 3
1 S7-1500R/H Documentation Guide ...................................................................................................... 12
2 New properties/functions .................................................................................................................... 14
3 System overview ................................................................................................................................. 18
3.1 What is the S7-1500R/H redundant system?........................................................................ 18
3.1.1 Areas of application ........................................................................................................... 19
3.1.2 Operating principle of the S7-1500R/H redundant system ................................................... 23
3.1.3 Plant components and automation levels ........................................................................... 29
3.1.4 Scalability .......................................................................................................................... 30
3.1.5 Overview of features.......................................................................................................... 34
3.2 Configuration .................................................................................................................... 35
3.2.1 Structure of the S7-1500R redundant system ..................................................................... 35
3.2.2 Structure of the S7-1500H redundant system ..................................................................... 36
3.2.3 Configuration of a fail-safe system with SIMATIC S7-1500HF .............................................. 38
3.2.4 Components ...................................................................................................................... 40
3.3 S7-1500 R/H-CPUs .............................................................................................................. 42
3.3.1 Overview of the CPU technical specifications ...................................................................... 43
3.3.2 Redundancy....................................................................................................................... 44
3.3.3 Safety ................................................................................................................................ 51
3.3.4 Security ............................................................................................................................. 54
3.3.5 Diagnostics ........................................................................................................................ 56
3.3.6 Trace ................................................................................................................................. 58
3.3.7 PID control ......................................................................................................................... 60
3.4 Communication ................................................................................................................. 63
3.4.1 System and device IP addresses .......................................................................................... 63
3.4.2 Integrated interfaces for communication............................................................................ 65
3.4.3 HMI devices ....................................................................................................................... 66
3.5 Power supply ..................................................................................................................... 66
3.6 Software............................................................................................................................ 67
3.6.1 TIA Portal ........................................................................................................................... 67
3.6.2 SINETPLAN......................................................................................................................... 68
3.6.3 PRONETA ........................................................................................................................... 68
4 Application planning ........................................................................................................................... 69
4.1 Requirements .................................................................................................................... 69
4.2 Restrictions compared to the S7-1500 automation system .................................................. 71
4.3 Configuration versions ....................................................................................................... 73
4.3.1 S7-1500R/H configuration with IO devices in the PROFINET ring ......................................... 74
4.3.2 S7-1500R/H configuration with switches and linear topology.............................................. 76

S7-1500R/H redundant system

System Manual, 05/2021, A5E41814787-AC 7
Table of contents

4.4 Redundancy scenarios ....................................................................................................... 78

4.4.1 Introduction ...................................................................................................................... 78
4.4.2 Failure of the primary CPU ................................................................................................. 79
4.4.3 Failure of the backup CPU .................................................................................................. 81
4.4.4 Failure of the PROFINET cable in the PROFINET ring ............................................................ 83
4.4.5 Specific redundancy scenarios for S7-1500H ...................................................................... 85
4.4.5.1 Failure of a redundancy connection in S7-1500H................................................................ 85
4.4.5.2 Failure of both redundancy connections in S7-1500H > 55 ms apart ................................... 87
4.4.5.3 Failure of both redundancy connections and the PROFINET cable in the PROFINET ring ....... 89
4.4.5.4 Failure of the two PROFINET cables in the PROFINET ring on the backup CPU ...................... 91
4.5 Failure scenarios ................................................................................................................ 92
4.5.1 Failure of an IO device in the PROFINET ring ....................................................................... 93
4.5.2 Failure of a switch (with line topology) in the PROFINET ring .............................................. 95
4.5.3 Specific failure scenarios with S7-1500R............................................................................. 97
4.5.3.1 Two cable interruptions in the PROFINET ring in S7-1500R > 1500 ms apart ........................ 97
4.5.3.2 Two cable interruptions in the PROFINET ring in S7-1500R within ≤ 1500 ms ...................... 99
4.5.3.3 Failure of the primary CPU when IO devices have failed in the PROFINET ring .................... 101
4.5.4 Specific failure scenarios with S7-1500H .......................................................................... 104
4.5.4.1 Failure of both redundancy connections in S7-1500H ≤ 55 ms apart ................................. 104
4.5.4.2 Failure of one redundancy connection and the primary CPU in S7-1500H ......................... 106
4.5.4.3 Failure of the two PROFINET cables in the PROFINET ring at the primary CPU..................... 108
4.5.4.4 Failure of the redundant system through safe state of the HF-CPUs .................................. 110
4.6 Hardware configuration ................................................................................................... 112
4.7 Using HMI devices ........................................................................................................... 113
5 Installation......................................................................................................................................... 117
5.1 Basics .............................................................................................................................. 117
5.2 Installing the mounting rail .............................................................................................. 119
5.3 Installing the standard rail adapter ................................................................................... 123
5.4 Installing a load current supply ........................................................................................ 129
5.5 Installing R/H-CPUs ........................................................................................................... 132
6 Wiring ................................................................................................................................................ 134
6.1 Rules and regulations for operation .................................................................................. 134
6.2 Operation on grounded infeed ......................................................................................... 137
6.3 Electrical configuration .................................................................................................... 140
6.4 Wiring rules ..................................................................................................................... 141
6.5 Connecting the supply voltage ......................................................................................... 142
6.6 Connecting the load current supply .................................................................................. 144
6.7 Connecting the CPU to the load power supply .................................................................. 145
6.8 Connecting interfaces for communication with S7-1500R................................................. 147
6.8.1 Connecting the PROFINET ring to S7-1500 ....................................................................... 147

S7-1500R/H redundant system

8 System Manual, 05/2021, A5E41814787-AC
 Table of contents

6.9 Connecting interfaces for communication with S7-1500H ................................................ 150

6.9.1 Connecting redundancy connections (fiber-optic cables) .................................................. 150
6.9.1.1 Synchronization modules for S7-1500H ........................................................................... 150
6.9.1.2 Selecting fiber-optic cables .............................................................................................. 151
6.9.1.3 Installing fiber-optic cables .............................................................................................. 153
6.9.1.4 Connecting redundancy connections (fiber-optic cables) to S7-1500H .............................. 155
6.9.2 Connecting the PROFINET ring to S7-1500H ..................................................................... 159
7 Configuration..................................................................................................................................... 161
7.1 Configuring the CPU ........................................................................................................ 161
7.2 Configuration procedure .................................................................................................. 161
7.3 Project tree ...................................................................................................................... 168
7.4 Parameters ...................................................................................................................... 169
7.5 Process images and process image partitions.................................................................... 169
7.5.1 Process image - overview ................................................................................................. 169
7.5.2 Updating process image partitions in the user program .................................................... 170
8 Basics of program execution ............................................................................................................. 172
8.1 Programming the S7-1500R/H .......................................................................................... 172
8.2 Restrictions ...................................................................................................................... 175
8.3 Events and OBs ................................................................................................................ 177
8.4 Special instructions for S7-1500R/H redundant systems .................................................... 183
8.4.1 Disabling/enabling SYNCUP with the RH_CTRL instruction ................................................. 183
8.4.2 Determining the primary CPU with "RH_GetPrimaryID" ...................................................... 186
8.5 Asynchronous instructions ............................................................................................... 187
9 Protection .......................................................................................................................................... 194
9.1 Overview of the protection functions ............................................................................... 194
9.2 Protection of confidential configuration data .................................................................... 194
9.3 Configuring access protection for the CPU ........................................................................ 195
9.4 Using the display to set additional password protection .................................................... 199
9.5 Using the user program to set additional access protection ............................................... 199
9.6 Know-how protection ...................................................................................................... 200
9.7 Protection by locking the CPU .......................................................................................... 204
10 Commissioning .................................................................................................................................. 205
10.1 Overview ......................................................................................................................... 205
10.2 Check before powering on for the first time ..................................................................... 206
10.3 Commissioning procedure ............................................................................................... 207
10.3.1 Removing/plugging in SIMATIC memory cards .................................................................. 208
10.3.2 First power-on of the CPUs ............................................................................................... 211
10.3.3 CPU pairing...................................................................................................................... 211
10.3.4 Redundancy IDs ............................................................................................................... 213
10.3.5 Downloading projects to the CPUs.................................................................................... 218

S7-1500R/H redundant system

System Manual, 05/2021, A5E41814787-AC 9
Table of contents

10.4 Operating and system states ............................................................................................ 226

10.4.1 Overview ......................................................................................................................... 226
10.4.2 STARTUP operating state .................................................................................................. 230
10.4.3 STOP operating state ....................................................................................................... 233
10.4.4 SYNCUP operating state ................................................................................................... 233
10.4.5 RUN operating states ....................................................................................................... 234
10.4.6 SYNCUP system state ....................................................................................................... 235
10.4.7 System and operating state transitions ............................................................................. 247
10.4.8 Loss of redundancy .......................................................................................................... 257
10.4.9 Displaying and changing the system state ........................................................................ 260
10.5 CPU memory reset ........................................................................................................... 263
10.5.1 Automatic memory reset ................................................................................................. 264
10.5.2 Manual memory reset ...................................................................................................... 265
10.6 Backing up and restoring the CPU configuration ............................................................... 266
10.7 Time synchronization....................................................................................................... 270
10.7.1 Example: Configuring the NTP server ............................................................................... 272
10.8 Identification and maintenance data ................................................................................ 273
10.8.1 Reading out and entering I&M data .................................................................................. 273
10.8.2 Record structure for I&M data .......................................................................................... 275
10.8.3 Example: Read out firmware version of the CPU with Get_IM_Data ................................... 277
11 Display ............................................................................................................................................... 280
11.1 CPU display ...................................................................................................................... 280
12 Maintenance ...................................................................................................................................... 289
12.1 Replacing components of the S7-1500R/H redundant system ........................................... 289
12.1.1 Checking before replacing components............................................................................ 289
12.1.2 Replacing defective R/H-CPUs ........................................................................................... 292
12.1.3 Replacing defective redundancy connections ................................................................... 293
12.1.3.1 Replacing two defective PROFINET cables with S7-1500R.................................................. 294
12.1.3.2 Replacing a defective redundancy connection with S7-1500H .......................................... 295
12.1.3.3 Replacing defective synchronization module with S7-1500H ............................................ 295
12.1.3.4 Replacing both defective redundancy connections with S7-1500H.................................... 296
12.1.4 Replacing defective PROFINET cables................................................................................ 297
12.1.5 Replacing a defective SIMATIC memory card..................................................................... 298
12.1.6 Replace defective load current supply PM ......................................................................... 299
12.1.7 Replacing defective IO devices/switches ........................................................................... 300
12.2 Replacing the front cover ................................................................................................. 301
12.3 Replacing the coding element at the power connector of the load current supply ............. 302
12.4 Firmware update ............................................................................................................. 304
12.5 Resetting CPUs to factory settings .................................................................................... 309
12.6 Maintenance and repair ................................................................................................... 313
13 Test and service functions ................................................................................................................. 314
13.1 Test functions .................................................................................................................. 314
13.2 Reading out/saving service data ....................................................................................... 320

S7-1500R/H redundant system

10 System Manual, 05/2021, A5E41814787-AC
 Table of contents

14 Technical specifications..................................................................................................................... 322

14.1 Standards and Approvals.................................................................................................. 322
14.2 Electromagnetic compatibility .......................................................................................... 330
14.3 Shipping and storage conditions ...................................................................................... 332
14.4 Mechanical and climatic ambient conditions .................................................................... 333
14.5 Information on insulation tests, protection class, degree of protection and rated
voltage ............................................................................................................................ 336
14.6 Use of S7-1500R/H in Zone 2 hazardous area.................................................................... 337
A Dimension drawings .......................................................................................................................... 338
B Accessories/spare parts ..................................................................................................................... 341
C Safety symbols................................................................................................................................... 343
C.1 Safety-related symbols for devices without Ex protection.................................................. 343
C.2 Safety-related symbols for devices with Ex protection ....................................................... 344
Glossary ............................................................................................................................................. 346
Index .................................................................................................................................................. 361

S7-1500R/H redundant system

System Manual, 05/2021, A5E41814787-AC 11
S7-1500R/H Documentation Guide 1
The documentation for the redundant S7-1500R/H system is divided into three areas.
This division enables you to access the specific content you require.

Basic information
The System Manual and Getting Started describe in detail the configuration, installation,
wiring and commissioning of the redundant S7-1500R/H system. The STEP 7 online help
supports you in the configuration and programming.

Device information
Product manuals contain a compact description of the module-specific information, such as
properties, wiring diagrams, characteristics and technical specifications.

General information
The function manuals contain detailed descriptions on general topics regarding the
redundant S7-1500R/H system, e.g. diagnostics, communication.
You can download the documentation free of charge from the Internet
(https://support.industry.siemens.com/cs/ww/en/view/109742691).
Changes and supplements to the manuals are documented in a Product Information.
You can download the product information free of charge from the Internet
(https://support.industry.siemens.com/cs/ww/en/view/109742691).

S7-1500R/H redundant system

12 System Manual, 05/2021, A5E41814787-AC
 S7-1500R/H Documentation Guide

S7-1500/ET 200MP Manual Collection

The S7-1500/ET 200MP Manual Collection contains the complete documentation on the
redundant S7-1500R/H system gathered together in one file.
You can find the Manual Collection on the Internet
(https://support.industry.siemens.com/cs/ww/en/view/86140384).

SIMATIC S7-1500 comparison list for programming languages

The comparison list contains an overview of which instructions and functions you can use for
which controller families.
You can find the comparison list on the Internet
(https://support.industry.siemens.com/cs/ww/en/view/86630375).

"mySupport"
With "mySupport", your personal workspace, you make the best out of your Industry Online
Support.
In "mySupport", you can save filters, favorites and tags, request CAx data and compile your
personal library in the Documentation area. In addition, your data is already filled out in
support requests and you can get an overview of your current requests at any time.
You must register once to use the full functionality of "mySupport".
You can find "mySupport" on the Internet (https://support.industry.siemens.com/My/ww/en/).

Application examples
The application examples support you with various tools and examples for solving your
automation tasks. Solutions are shown in interplay with multiple components in the
system - separated from the focus on individual products.
You will find the application examples on the Internet
(https://support.industry.siemens.com/sc/ww/en/sc/2054).

S7-1500R/H redundant system

System Manual, 05/2021, A5E41814787-AC 13
New properties/functions 2
What's new in the S7-1500R/H redundant system System Manual, issue 05/2021 compared to
issue 11/2019

What's new? What are the customer benefits? Where can I find the infor-
mation?
New con- CPU 1518HF-4 PN The CPU 1518HF-4 PN expands the R/H-CPU As of System overview
tents portfolio with an HF-CPU. The CPU provides (Page 18) section
the following advantages:
• Powerful H-CPU with integrated F-
functionality
• The integrated F-functionality processes
standard and safety programs. This allows
fail-safe data to be evaluated in the stand-
ard user program. Due to this integration,
the system benefits and the comprehen-
sive functionality of SIMATIC are also
available for fail-safe applications.
• 3 PROFINET interfaces per CPU
Influence changeover time As of FW version V2.9, you can influence the PROFINET
of switched S1 devices changeover time between disconnection and (https://support.industry.sieme
return of switched S1 devices after a fail- ns.com/cs/ww/en/view/499488
ure/STOP of the primary CPU. 56) function manual
This function provides the following ad-
vantage:
• Optimization of the changeover time
between disconnection and return of
switched S1 devices
MRP interconnection The MRP interconnection process is an en- Redundancy (Page 60) section
hancement of MRP. MRP interconnection
allows the redundant coupling of two or more
rings with MRP in PROFINET networks.
MRP interconnection offers the following
advantages:
• There is no limit to the maximum number
of 50 devices in a ring when setting up
redundant network topologies.
• Monitoring of larger topologies with ring
redundancy.

S7-1500R/H redundant system

System Manual, 05/2021, A5E41814787-AC 14
 New properties/functions

What's new? What are the customer benefits? Where can I find the infor-
mation?
Simulation of R/H-CPUs PLCSIM Advanced V4.0 supports the simula- S7-PLCSIM Advanced
tion of the R/H-CPUs (https://support.industry.sieme
ns.com/cs/ww/en/view/109773
• Virtual commissioning of machines with 484/en) function manual
R/H-CPUs in a plant
• Automated testing of the STEP 7 user
program
Simulation provides the following ad-
vantages:
• Early error detection and risk minimization
• Shorter commissioning time
• No hardware costs
OB 72 (CPU redundancy As of FW version V2.9, the operating system Programming the S7-1500R/H
error) calls OB 72 on further events: (Page 172) section
• The R/H-system has entered RUN-
Redundant system state and the synchro-
nization of the two R/H-CPUs is possible
redundantly.
• The R/H-system has entered RUN-
Redundant system state, but the synchro-
nization of the two R/H-CPUs is not possi-
ble redundantly.
• The R/H-system is still in RUN-Redundant
system state and the synchronization of
the two R/H-CPUs is possible redundantly
now or again.
• The R/H-system is still in RUN-Redundant
system state, but the synchronization of
the two R/H-CPUs is no longer possible re-
dundantly.
"RH_CTRL" instruction As of FW version V2.9, the "RH_CTRL" instruc- Programming the S7-1500R/H
tion supports additional functions: (Page 172) section
• Request SYNCUP
• Switch primary CPU to STOP mode (only in
RUN-Redundant system state)
• Switch backup CPU to STOP mode
Instructions for recipe func- As of FW version V2.9, instructions for the STEP 7 online help
tions recipe functions are supported:
• RecipeExport (Export recipe)
• RecipeImport (Import recipe)

S7-1500R/H redundant system

System Manual, 05/2021, A5E41814787-AC 15
New properties/functions

What's new? What are the customer benefits? Where can I find the infor-
mation?
TO_BasicPos and "TO_BasicPos" technology object STEP 7 online help
SSI_Absolute_Encoder tech- With the "TO_BasicPos" instruction, you con-
nology objects trol a SINAMICS drive cyclically with the tech-
nology for SINAMICS S/G/V basic positioners.
SSI_Absolute_Encoder technology object
With the "SSI_Absolute_Encoder" instruction,
you use the user program to control the posi-
tion detection and measuring functions of the
TM PosInput technology object.

What's new in the S7-1500R/H redundant system System Manual, issue 11/2019 compared to
issue 10/2018

What's new? What are the customer benefits? Where can I find the infor-
mation?
New con- Switched S1 device The "Switched S1 device" function of the CPU Section Redundancy (Page 44)
tents enables operation of standard IO devices in
the S7-1500R/H redundant system.
Standard rail adapter You mount the R/H CPUs on a standardized Sec. Installing the standard rail
35 mm rail using the standard rail adapter. adapter (Page 123)
Testing with breakpoints When testing with breakpoints, you run a Section Test functions
program from breakpoint to breakpoint in the (Page 314)
STARTUP (startup OB) or RUN-Solo system
state. Testing with breakpoints provides you
with the following advantages:
• Testing SCL and STL program code with
the help of breakpoints
• Localization of logic errors step by step
• Simple and quick analysis of complex
programs prior to actual commissioning
• Recording of current values within indi-
vidual executed loops
• Using breakpoints for program validation
is also possible in SCL or STL networks
within LAD/FBD blocks.

S7-1500R/H redundant system

16 System Manual, 05/2021, A5E41814787-AC
 New properties/functions

What's new? What are the customer benefits? Where can I find the infor-
mation?
PID controller PID controllers are built into all R/H-CPUs as Sec. PID control (Page 60)
standard. PID controllers measure the actual
value of a physical variable, for example,
temperature or pressure, and compare the
actual value with the setpoint. Based on the
resulting error signal, the controller calculates
a manipulated variable that causes the pro-
cess value to reach the setpoint as quickly and
stably as possible.
The PID controllers offer you the following
advantages:
• Simple configuration and programming
through integrated editors and blocks.
• Simple simulation, visualization, commis-
sioning and operation via PG and HMI.
• Automatic calculation of the control pa-
rameters and tuning during operation.
• No additional hardware and software
required.
Changed Download modified user You can download a modified user program Sec. Downloading projects to
contents program in RUN-Redundant into the R/H CPUs in the RUN-Redundant sys- the CPUs (Page 218)
system state tem state.
Advantage: The redundant system will remain
in the RUN-Redundant system state during
changes to the user program. The system
state is not changed after RUN-Solo or
SYNCUP.
Backing up the configuration You do not have to interrupt the process dur- Section Backing up and restor-
of the S7-1500R/H redundant ing a backup while the plant is running. ing the CPU configuration
system in runtime Uninterrupted plant operation avoids high (Page 266)
restart and material costs.

Alarms in the user program Messages enable you to display events from Function manual Diagnostics
process execution in the S7-1500R/H redun- (https://support.industry.sieme
dant system and to quickly identify, accurate- ns.com/cs/ww/en/view/591929
ly locate, and correct errors. 26)

S7-1500R/H redundant system

System Manual, 05/2021, A5E41814787-AC 17
System overview 3
3.1 What is the S7-1500R/H redundant system?

S7-1500R/H redundant system

For the S7-1500R/H redundant system, the CPUs are duplicated, in other words redundant.
The two CPUs process the same project data and the same user program in parallel. The two
CPUs are synchronized over two redundancy connections. If one CPU fails, the other CPU
maintains control of the process.

Aims of using redundant automation systems

The aim of redundant automation systems is to reduce the probability of production
downtime by operating two systems in parallel.

Aims of fail-safe automation systems

The aim of fail-safe automation systems is to protect life, the environment and capital with
safe shutdown to a secure state.

Note
In principle, all contents of the system manual for the H-CPU also apply to the fail-safe CPU
(HF-CPU). Deviating contents and special features are described as supplements and marked
with references.

S7-1500R/H redundant system

System Manual, 05/2021, A5E41814787-AC 18
 System overview
3.1 What is the S7-1500R/H redundant system?

3.1.1 Areas of application

Objective
The S7-1500R/H redundant system offers a high degree of reliability and system availability. A
redundant configuration of the most important automation components reduces the
probability of production downtimes and the consequences of component errors.
The higher the risks and costs of a production downtime, the more worthwhile the use of a
redundant system. You can compensate for the generally higher investment costs by
avoiding production downtimes.

Use
In redundantly operated systems, failure or malfunction of individual automation
components must not impede the operation of the plant. S7-1500R/H redundant systems are
used in the following areas, for example:
• Tunnels
• Airports (for example baggage conveyors)
• Subways
• Shipbuilding
• Wastewater treatment plants
• High-bay warehouse

S7-1500R/H redundant system

System Manual, 05/2021, A5E41814787-AC 19
System overview
3.1 What is the S7-1500R/H redundant system?

Example 1: Avoiding downtimes

Automation task
An automation solution is required for a road tunnel to:
• Control the lighting in the tunnel
• Control the ventilation in the tunnel in line with the concentration of pollutants in the
tunnel

Feature
Uninterrupted operation of the ventilation system is required to keep the concentration of
pollutants below a set level. Constant availability must be ensured for the event that
individual automation components fail, for example because of a fire in the tunnel.

Solution
Three fans (M) ventilate the tunnel. The automation solution controls the fan speeds in line
with the measured pollutant concentration. Three sensors in the tunnel measure the
pollutant levels in the air. The S7-1500H redundant system with two redundant CPUs is used
to ensure fan availability.
As well as controlling the fans, the S7-1500H redundant system also controls the illumination
and the traffic lights.

Figure 3-1 Example: Tunnel automation

Benefits
The user program for controlling the fans runs on both CPUs in the S7-1500H redundant
system. You can position the two CPUs up to 10 kilometers apart. If one CPU or one
redundancy connection fails due to a local incident, the incident does not affect the
controlled process. The fans continue to operate.
You can find a detailed description of tunnel automation with S7-1500H in Getting started
(https://support.industry.siemens.com/cs/ww/en/view/109757712) Redundant system
S7-1500R/H.

S7-1500R/H redundant system

20 System Manual, 05/2021, A5E41814787-AC
 System overview
3.1 What is the S7-1500R/H redundant system?

Example 2: Avoiding high system restart costs as a result of data loss

Automation task
A logistics company needs a matching automation solution for controlling the storage and
retrieval unit in a high-bay warehouse.

Feature
The failure of a controller would have serious consequences. After the system restart, you
would have to reposition the storage and retrieval units and record the content of the
containers again. The automation solution must ensure that no data is lost if a CPU fails and
that the warehouse can continue to operate.

Solution
To store goods in and retrieve them from the bays, the storage and retrieval unit moves along
an X, Y and Z axis. If the process is interrupted, data can be lost and the location of the goods
is not known. To guard against the loss of data, the storage and retrieval unit is controlled by
the S7-1500R redundant system.

Figure 3-2 Example: High-bay warehouse

Benefits
If one CPU fails, the second CPU maintains control of the process. The project data and the
user program are saved redundantly and are not lost if a CPU fails. Once you have replaced
the defective CPU and switched it to RUN, the redundant system automatically synchronizes
the project data with the user program in the new CPU. The solution saves you service time
and downtime costs for the warehouse.

S7-1500R/H redundant system

System Manual, 05/2021, A5E41814787-AC 21
System overview
3.1 What is the S7-1500R/H redundant system?

Example 3: Avoiding equipment and material damage

Automation task
A steel works needs a matching automation solution to control a blast furnace for the steel
production.
Feature
Failures, especially in the process industry, can result in damages to the system, workpieces
or material. In a steelworks, there is a danger of the pig iron cooling if the process is
interrupted. The pig iron then cannot be used for the production of steel. The automation
solution must ensure that the plant continues to run if a CPU fails and that the material is not
damaged.
Solution
The S7-1500R redundant system controls the blast furnace. The distributed automation
components of the redundant system control the temperature, volume and pressure
parameters.

Figure 3-3 Example: Blast furnace

Benefits
The S7-1500R redundant system compensates for the possible failure of a CPU or redundant
connection. You do not have to interrupt the smelting process when replacing a CPU while
the plant is running. Uninterrupted plant operation avoids high restart and material costs.
Reference
You can find an example for SIMATIC Safety Integrated with the 1518HF-4 PN CPUs in the
section Safety (Page 51).

S7-1500R/H redundant system

22 System Manual, 05/2021, A5E41814787-AC
 System overview
3.1 What is the S7-1500R/H redundant system?

3.1.2 Operating principle of the S7-1500R/H redundant system

Introduction
S7-1500R/H redundant systems tolerate the failure of one of the two CPUs or an interruption
in the PROFINET ring. The S7-1500R and S7-1500H systems differ in structure, configuration
limits and performance.

Note
Each PROFINET ring may only contain one R-system or one H-system at a time.
A combined setup with one R-system and one H-system in the same PROFINET ring is not
supported.

S7-1500 design and operating principle

The figure below shows the typical structure of the S7-1500R redundant system.

① CPU 1515R-2 PN
② PROFINET cable (redundancy connections, PROFINET ring)
③ IO device
④ Switch

Figure 3-4 Structure of an S7-1500R redundant system

S7-1500R/H redundant system

System Manual, 05/2021, A5E41814787-AC 23
System overview
3.1 What is the S7-1500R/H redundant system?

The S7-1500R redundant system consists of:

• Two S7-1500R CPUs ①
• A PROFINET ring with the Media Redundancy Protocol ②
• IO devices ③
• Possibly switches ④
A PROFINET ring is required for the S7-1500R redundant system. The two CPUs must be
directly connected to each other with a PROFINET cable. All nodes can still communicate with
each other in the event of an interruption in the ring. All PROFINET devices in the PROFINET
ring must support media redundancy (MRP).
You can decouple further devices from the PROFINET ring via a ④ switch, e.g.:
• PROFINET devices with one port
• Non MRP-capable PROFINET devices
• PROFINET devices that do not support H-Sync Forwarding, such as standard IO devices
The redundancy connections in an S7-1500R system are the PROFINET ring with MRP ②.
One of the two CPUs in the redundant system takes on the role of primary CPU. The other
CPU takes on the role of the following CPU (backup CPU). The role of the CPUs can change
during operation. Synchronization of primary and backup CPU ensures rapid switchover
between CPUs in the event of a failure of the primary CPU. If the primary CPU fails, the
backup CPU takes over control of the process as the new primary CPU.
The redundancy connections use part of the bandwidth on the PROFINET cable for the
synchronization of the R-CPUs. This bandwidth is therefore not available for
PROFINET IO communication.

S7-1500R/H redundant system

24 System Manual, 05/2021, A5E41814787-AC
 System overview
3.1 What is the S7-1500R/H redundant system?

S7-1500H structure and operating principle

The figure below shows the typical structure of the S7-1500H redundant system.

① CPU 1517H-3 PN
② PROFINET cable (PROFINET ring)
③ Redundancy connections (fiber-optic cables)
④ IO device
⑤ Switch

Figure 3-5 Structure of an S7-1500H redundant system

The S7-1500H redundant system consists of:

• Two CPUs S7-1500H ①
• A PROFINET ring with the Media Redundancy Protocol ②
• Two redundancy connections ③
• IO devices ④
• Possibly switches ⑤
As with S7-1500R, the S7-1500H redundant system requires a PROFINET ring ② closed by the
CPUs. All nodes can still communicate with each other in the event of an interruption in the
ring. All PROFINET devices in the PROFINET ring must support media redundancy (MRP).

S7-1500R/H redundant system

System Manual, 05/2021, A5E41814787-AC 25
System overview
3.1 What is the S7-1500R/H redundant system?

You can decouple further devices from the ring via a ⑤ switch, e.g.:
• PROFINET devices with one port
• Non MRP-capable PROFINET devices, such as standard IO devices
Unlike in S7-1500R, the PROFINET ring and redundancy connections in S7-1500H are
separate. The two redundancy connections are fiber-optic cables ③ that connect the CPUs
directly over synchronization modules.
One of the two CPUs in the redundant system takes on the role of primary CPU. The other
CPU takes on the role of the following CPU (backup CPU). The role of the CPUs can change
during operation.
Synchronization of primary and backup CPU ensures rapid switchover between CPUs in the
event of a failure of the primary CPU. If the primary CPU fails, the backup CPU takes over
control of the process as the new primary CPU.
The synchronization of the H-CPUs does not affect the bandwidth on the PROFINET.

S7-1500R/H redundant system

26 System Manual, 05/2021, A5E41814787-AC
 System overview
3.1 What is the S7-1500R/H redundant system?

Differences between S7-1500R and S7-1500H

Table 3- 1 S7-1500R and S7-1500H system differences

S7-1500R S7-1500H
CPU 1513R-1 PN CPU 1517H-3 PN
CPU 1515R-2 PN CPU 1518HF-4 PN
Performance • Transfer rate of 100 Mbps (for synchronization • Significantly greater performance than
and communication) S7-1500R due to:
• Data work-memory: – Separate redundancy connections over fi-
– CPU 1513R-1 PN: max. 1.5 MB ber-optic cable

– CPU 1515R-2 PN: max. 3 MB – High computing power

• Code work-memory: • transfer rate of 1 Gbps (for synchronization)

– CPU 1513R-1 PN: max. 300 KB • Data work-memory:

– CPU 1515R-2 PN: max. 500 KB – CPU 1517H-3 PN: max. 8 MB
– CPU 1518HF-4 PN: max. 60 MB
• Code work-memory:
– CPU 1517H-3 PN: max. 2 MB
– CPU 1518HF-4 PN: max. 9 MB
Hardware • The CPUs are identical in design with the re- • The CPUs each have 2 optical interfaces.
spective S7-1500 standard versions. • Synchronization of the CPUs runs separately
• Synchronization of the CPUs takes place over from the PROFINET ring over fiber-optic ca-
the PROFINET ring. bles.
• When you use PROFINET devices with more • The full bandwidth of the PROFINET cable is
than two ports (e.g. switch) in the PROFINET available for PROFINET IO communication.
ring of an R-system, then H-Sync Forwarding is
mandatory for these devices.
• H-Sync Forwarding is recommended for all
devices in the PROFINET ring if you are using
PROFINET devices with only 2 ports in the
PROFINET ring of an R-system.
• Part of the bandwidth on the PROFINET cable
is required for synchronization of the CPUs.
Less bandwidth is therefore available for
PROFINET IO communication.
Range • Distance between the two R-CPUs: • Distance between the two H-CPUs:
– Max. 100 m without media converter – Maximum of 10 km (depends on the syn-
– Several kilometers with media converter chronization modules used)
(depends on the media converter used)
Configuration • In the PROFINET ring: Max. 50 PROFINET de- • In the PROFINET ring: Max. 50 PROFINET de-
limits
vices, including R-CPUs (max. 16 PROFINET vices (including H-CPUs)
devices recommended) • In the PROFINET ring and separated with
• In the PROFINET ring and separated with switches (line): Max. 258 PROFINET devices
switches (line): Max. 66 PROFINET devices (in- (including H-CPUs)
cluding R-CPUs)

S7-1500R/H redundant system

System Manual, 05/2021, A5E41814787-AC 27
System overview
3.1 What is the S7-1500R/H redundant system?

Comparison of S7-1500 standard system and S7-1500R/H

The table below sets out the key features of comparable CPUs of the S7-1500 automation
system and of the S7-1500R/H redundant system.

Table 3- 2 S7-1500 and S7-1500R/H comparison

S7-1500 S7-1500R/H
CPU 1513-1 PN CPU 1518F-4 CPU 1513R-1 PN CPU 1518HF-4 PN
CPU 1515-2 PN PN/DP CPU 1515R-2 PN
CPU 1517-3 PN/DP CPU 1517H-3 PN

Support for central I/O ✓ ✓ --- ---

Configuration control ✓ ✓ --- ---
Web server ✓ ✓ --- ---
CPU redundancy --- --- ✓ ✓
System redundancy S2 --- --- ✓ ✓
S1 device ✓ ✓ ✓ 1) ✓ 1)
Isochronous mode ✓ ✓ --- ---
Shared Device ✓ ✓ --- ---
IRT ✓ ✓ --- ---
MRP ✓ ✓ ✓ ✓
MRPD ✓ ✓ --- ---
OPC UA ✓ ✓ --- ---
Motion Control ✓ ✓ --- ---
PID control ✓ ✓ ✓ ✓
Security Integrated ✓ ✓ ✓ ✓
Protection function: Copy ✓ ✓ --- ---
protection
Safety mode 2) --- ✓ --- ✓
Integrated system diagnostics ✓ ✓ ✓ ✓
1) As switched S1 device
2) For personal, environmental or investment protection, you will need fail-safe automation systems (F-systems).

S7-1500R/H redundant system

28 System Manual, 05/2021, A5E41814787-AC
 System overview
3.1 What is the S7-1500R/H redundant system?

3.1.3 Plant components and automation levels

Plant components and automation levels

The schematic diagram below shows the key components of the redundant system from the
management level to the control level and the field level.

Figure 3-6 Possible configuration at the management, control and field level using the example of S7-1500R

From the management level, the master PC accesses the various devices at the control and
field level. The master PC is connected to the CPUs over Industrial Ethernet.
The R-CPUs at the control level are redundant in design. The IO devices at the field level are
connected to the R-CPUs within a PROFINET ring.
The redundant S7-1500R system cyclically exchanges IO data with another
PROFINET IO system via a PN/PN coupler. The left-hand side of the PN/PN coupler is assigned
to the S7-1500R redundant system. The right-hand side of the PN/PN coupler is assigned to
the CPU 1516-3 PN/DP (IO controller).
The configuration tolerates the failure of one CPU or an interruption in the PROFINET ring.
The primary CPU and the backup CPU execute the user program in parallel. If one CPU fails,
the second CPU maintains control of the process.
If the PROFINET ring is interrupted, for example as a result of a cable break or an IO device
failure, redundancy in the ring is lost. However, the IO devices that have not failed continue
to operate and can be accessed.

S7-1500R/H redundant system

System Manual, 05/2021, A5E41814787-AC 29
System overview
3.1 What is the S7-1500R/H redundant system?

3.1.4 Scalability

Introduction
Redundant systems are more cost-intensive to use than non-redundant systems:
• There are two CPUs.
• The physical connections (PROFINET ring and redundancy connections) can be required
over large distances.
The S7-1500R/H redundant system is scalable. This means that the S7-1500R and
S7-1500H systems have the same functional scope, but differ in terms of:
• Performance
• Hardware
• Range
• Configuration limits
• Costs

Note
MRP interconnection
MRP interconnection allows the redundant coupling of two or more rings with MRP in
PROFINET networks. With MRP interconnection, you are not limited to the maximum number
of devices in a ring when setting up redundant network topologies. You can find more
information in the section Redundancy.

S7-1500R/H redundant system

30 System Manual, 05/2021, A5E41814787-AC
 System overview
3.1 What is the S7-1500R/H redundant system?

S7-1500R
You connect the CPUs to the Industrial Ethernet over X2 PROFINET interfaces of CPUs
S7-1515R-2 PN or using an additional switch.
S7-1500R supports the following number of PROFINET devices (switches, S7-1500R/H CPUs,
S7-1500 CPUs (V2.5 or later), HMI devices, and IO devices such as ET 200MP and ET 200SP):
• In the PROFINET ring: max. 50 (recommended: max. 16)
• In the PROFINET ring and separated with switches (line): max. 66

Note
Recommendation for S7-1500R: Operate a maximum of 16 PROFINET devices (including
R-CPUs) in the PROFINET ring.
The number of devices in the PROFINET ring affects the availability of the S7-1500R system.
You should therefore operate no more than 16 PROFINET devices (including R-CPUs) in the
PROFINET ring. Operating significantly more devices in the PROFINET ring will reduce the
availability of the IO devices and the R-CPUs.
The technical specifications in the documentation are based on the recommended maximum
of 16 PROFINET devices in the ring in S7-1500R.

S7-1500R/H redundant system

System Manual, 05/2021, A5E41814787-AC 31
System overview
3.1 What is the S7-1500R/H redundant system?

The redundancy connections in S7-1500R are the PROFINET ring with MRP. The CPUs are
synchronized over the PROFINET ring.

① Load power supply (optional)

② CPU S7-1515R-2 PN
③ PROFINET cable (redundancy connections, PROFINET ring)
④ IO device in the PROFINET ring
⑤ Switch
⑥ IO device outside the PROFINET ring (separated with a switch)
Figure 3-7 S7-1500R configuration variant

S7-1500H
You connect the CPUs to the Industrial Ethernet over a PROFINET interface or using an
additional switch.
S7-1500H supports the following number of PROFINET devices (switches, S7-1500R/H CPUs,
S7-1500 CPUs (V2.5 or later) and HMI devices):
• In the PROFINET ring: max. 50
• In the PROFINET ring and separated with switches (line): max. 258

S7-1500R/H redundant system

32 System Manual, 05/2021, A5E41814787-AC
 System overview
3.1 What is the S7-1500R/H redundant system?

The redundancy connections in S7-1500H are two duplex fiber-optic cables that connect the
CPUs directly with plug-in synchronization modules.

① Load power supply (optional)

② CPU 1517H-3 PN
③ PROFINET cable (PROFINET ring)
④ Redundancy connections (2 duplex fiber-optic cables)
⑤ IO device in the PROFINET ring
⑥ Switch
⑦ IO device outside the PROFINET ring (separated with switch)
Figure 3-8 S7-1500H configuration variant

See also
Redundancy (Page 44)

S7-1500R/H redundant system

System Manual, 05/2021, A5E41814787-AC 33
System overview
3.1 What is the S7-1500R/H redundant system?

3.1.5 Overview of features

The S7-1500R/H redundant system meets all the requirements for a fault-tolerant system. The
figure below sets out the main features.

Figure 3-9 S7-1500R/H features

S7-1500R/H redundant system

34 System Manual, 05/2021, A5E41814787-AC
 System overview
3.2 Configuration

3.2 Configuration

3.2.1 Structure of the S7-1500R redundant system

Configuration
The S7-1500R redundant system comprises the following components:
• Two R-CPUs
• Two SIMATIC memory cards
• PROFINET cable (redundancy connections, PROFINET ring)
• IO devices
• Load current supply (optional)
The redundant system S7-1500R can be mounted on a common mounting rail or spatially
separated on 2 separate mounting rails. Connecting the PROFINET cable to the PROFINET
interfaces X1 P2 R of the CPUs directly connects the two CPUs. You set up the PROFINET ring
from the first CPU to the IO devices and the second CPU with the PROFINET interfaces X1 P1 R
of the CPUs.

S7-1500R/H redundant system

System Manual, 05/2021, A5E41814787-AC 35
System overview
3.2 Configuration

Configuration example

① Optional load current supply

② CPU
③ Mounting rail with integrated DIN rail profile
④ PROFINET cable (redundancy connections, PROFINET ring)
Figure 3-10 S7-1500R configuration example

3.2.2 Structure of the S7-1500H redundant system

Configuration
The S7-1500H redundant system comprises the following components:
• Two H-CPUs
• Two SIMATIC memory cards
• Four synchronization modules (two synchronization modules in each H-CPU)
• Two redundancy connections (two duplex fiber-optic cables)
• IO devices
• Load current supply (optional)
The S7-1500H redundant system should be installed either on one shared mounting rail or on
two separate mounting rails. You connect the two CPUs with fiber-optic cables to two
synchronization modules in each CPU. You set up the PROFINET ring with the
PROFINET interfaces X1 P1 R and X1 P2 R of the CPUs.

S7-1500R/H redundant system

36 System Manual, 05/2021, A5E41814787-AC
 System overview
3.2 Configuration

Configuration example

① Optional load current supply

② CPU (with two synchronization modules, connected underneath, not visible in the diagram)
③ Mounting rail with integrated DIN rail profile
④ Redundancy connections (fiber-optic cables)
⑤ PROFINET cable (PROFINET ring)
Figure 3-11 S7-1500H configuration example

S7-1500R/H redundant system

System Manual, 05/2021, A5E41814787-AC 37
System overview
3.2 Configuration

3.2.3 Configuration of a fail-safe system with SIMATIC S7-1500HF

Configuration
Fail-safe automation systems (F-systems) are used in systems with higher safety
requirements. F-systems control processes and ensure that they are in a safe state
immediately after shutdown. In other words, F-systems control processes in which an
immediate shutdown does not endanger persons or the environment. The 1518HF-4 PN CPU
is a high-availability H-CPU with integrated F-functionality (HF-CPU).
The HF-system is made up of the following components:
• Two HF-CPUs
• Two SIMATIC memory cards
• Four synchronization modules (two synchronization modules in each HF-CPU)
• Two redundancy connections (two duplex fiber-optic cables)
• IO devices with fail-safe modules
• Load power supply (optional)
You can combine fail-safe I/O modules and non-fail-safe I/O modules in the IO devices.
The HF-system (with the 1518HF-4 PN CPUs) exchanges:
• Safety-relevant data with fail-safe modules of the IO devices
• Non-safety-relevant data with non-fail-safe modules of the IO devices

S7-1500R/H redundant system

38 System Manual, 05/2021, A5E41814787-AC
 System overview
3.2 Configuration

Configuration example

① CPU 1518HF-4 PN
② Redundancy connections (fiber-optic cables)
③ ET 200SP IO device
④ PROFINET cable (PROFINET ring)
⑤ ET 200MP IO device with fail-safe and non-fail-safe modules
⑥ ET 200SP IO device with fail-safe and non-fail-safe modules

Figure 3-12 Example configuration of redundant system with two 1518HF-4 PN CPUs

Reference
You can find additional information on the fail-safe modules for ET 200SP/ET 200MP in the
associated system and device manuals.

S7-1500R/H redundant system

System Manual, 05/2021, A5E41814787-AC 39
System overview
3.2 Configuration

3.2.4 Components

Components of the S7-1500R/H redundant system

Table 3- 3 S7-1500R/H components

Component Function Diagram

Mounting rail The mounting rail is the rack of the S7-1500R/H automation
system. You can use the entire length of the mounting rail.
You can order the mounting rail as Accessories/spare parts
(Page 341).

Standard rail adapter The R/H-CPUs are mounted on a standardized 35 mm rail via
the standard rail adapter.
The standard rail adapter can be ordered as Accessories/spare
parts (Page 341).

PE connection element The screw set is inserted in the mounting rail's T-profile groove,
for mounting rail and is required for grounding the mounting rail.
The set of screws is included in the scope of delivery of the
mounting rails in the standard lengths (160 mm to 830 mm)
and can be ordered as Accessories/spare parts (Page 341).

S7-1500R/H redundant system

40 System Manual, 05/2021, A5E41814787-AC
 System overview
3.2 Configuration

Component Function Diagram

R/H-CPUs The CPU runs the user program.
Additional features and functions of the CPU:
• Communication via Industrial Ethernet
• Communication via PROFINET IO
• Redundant mode
• HMI communication
• Integrated system diagnostics
• Integrated protection functions (access and know-how
protection)

PROFINET cable You connect the CPUs and the IO devices in a PROFINET ring
using PROFINET cables.

Synchronization mod- You create 2 redundancy connections between the H-CPUs via
ules (for S7-1500H) fiber-optic cables using a total of 4 synchronization modules (2
in each H-CPU).
The following synchronization module versions can be ordered:
• Sync module 1 GB FO 10 m: for fiber-optic cables up to
10 m in length
• Sync module 1 GB FO 10 km: for fiber-optic cables up to
10 km in length
Fiber-optic cable (for They connect the 2 synchronization modules per CPU in pairs
S7-1500H) via a fiber-optic cable. The following lengths of fiber-optic
cables can be ordered:
• 1m
• 2m
• 10 m
• Up to 10 km (on request)

S7-1500R/H redundant system

System Manual, 05/2021, A5E41814787-AC 41
System overview
3.3 S7-1500 R/H-CPUs

Component Function Diagram

4-pin connection plug The 4-pin connection plug provides the supply voltage.
for CPU supply voltage

Load current supply The load current supply (PM) supplies the central modules
(PM) (CPU) with 24 V DC.
If you are using load current supplies, we recommend the
devices from the SIMATIC series. These devices can be mount-
ed on the mounting rail.
Various models of load current supply are available:
• PM 70 W 120/230 V AC
• PM 190 W 120/230 V AC

3.3 S7-1500 R/H-CPUs

The S7-1500R/H redundant system tolerates the failure of one of the two R- or H-CPUs in the
PROFINET ring. If the primary CPU fails, the backup CPU takes over control of the process as
the new primary CPU at the point of the interruption.
All relevant data is permanently synchronized between the CPUs over the redundancy
connections between primary CPU and backup CPU.
The primary CPU and the backup CPU execute the user program in parallel.
The display of the CPU shows you the control and status information in various menus. Quick
access to diagnostic alarms minimizes plant downtimes in the event of a service call.
For effective commissioning and fast optimization of drives and controls, the CPUs support
trace functions for all CPU tags.

S7-1500R/H redundant system

42 System Manual, 05/2021, A5E41814787-AC
 System overview
3.3 S7-1500 R/H-CPUs

3.3.1 Overview of the CPU technical specifications

The table below sets out the main technical specifications for the S7-1500 R/H CPUs.

Table 3- 4 Overview of the R/H-CPU technical specifications

CPU 1513R-1 PN CPU 1515R-2 PN CPU 1517H-3 PN CPU 1518HF-4 PN

Data work-memory, max. 1.5 MB 3 MB 8 MB 60 MB
Code work-memory, max. 300 KB 500 KB 2 MB 9 MB
Plug-in load memory (SIMATIC 32 GB 32 GB 32 GB 32 GB
memory card), max.
I/O address area, max. 32 KB/32 KB 32 KB/32 KB 32 KB/32 KB 32 KB/32 KB
PROFINET IO interfaces 1 1 1 1
PROFINET interfaces - 1 1 2
Processing time for bit opera- 80 ns 60 ns 4 ns 4 ns
tions
Display screen size 3.45 cm 6.1 cm 6.1 cm 6.1 cm
Suitable PROFINET devices (IO 50 (recommended: 50 (recommended: 50 50
devices, S7-1500R/H CPUs, max. 16) max. 16)
switches, S7-1500 CPUs (as of
V2.5) and HMI devices) in the
PROFINET ring, max.
Suitable PROFINET devices (see 66 66 258 258
above) in the PROFINET ring and
separated with switches (line),
max.
Modules per rack, max. 2 (PM and CPU) 2 (PM and CPU) 2 (PM and CPU) 2 (PM and CPU)
Distance between CPUs, max. Depends on media Depends on media Depends on the Depends on the
converter used (with converter used (with synchronization synchronization
PROFINET cable, PROFINET cable, module used: max. module used: max.
max. 100 m) max. 100 m) 10 km 10 km
Redundancy connections (syn- PROFINET ring PROFINET ring Fiber-optic cable Fiber-optic cable
chronization link)
System redundancy Yes Yes Yes Yes
Switchover time 1) 300 ms 300 ms 50 ms 50 ms
1) The switchover time is the time starting with the failure or stop of the primary CPU until the backup CPU becomes the
primary CPU and assumes control of the process as the primary CPU at the point of interruption. The switchover time can
lengthen the cycle time.

Reference
The full technical specifications can be found in the manuals for the CPUs and on the Internet
(https://mall.industry.siemens.com).

S7-1500R/H redundant system

System Manual, 05/2021, A5E41814787-AC 43
System overview
3.3 S7-1500 R/H-CPUs

3.3.2 Redundancy

Introduction
The S7-1500R/H redundant system is based on media redundancy (MRP) in the PROFINET
ring.
You can use the following IO devices on the redundant S7-1500R/H system:
• IO devices with S2 system redundancy
• Standard IO devices over the "Switched S1 device" function of the CPU

Media redundancy
Media redundancy is a function for ensuring network and plant availability.
The two CPUs in the redundant system must be located in a PROFINET ring that uses the
MRP media redundancy protocol. All PROFINET devices in the PROFINET ring must support
media redundancy (MRP).
S7-1500R uses the PROFINET ring to synchronize the two CPUs. S7-1500H uses the
redundancy connections over fiber-optic cables to synchronize the two CPUs. The PROFINET
ring (via PROFINET interfaces X1) is also mandatory for S7-1500H.
To set up a ring topology with media redundancy, you need to bring together the free ends of
a linear network topology in one device using 2 ports (ring ports, port label "R"). You specify
the ring ports in the device configuration.
In the S7-1500R/H redundant system, you need to configure the media redundancy role for
each of the two CPUs to Manager (Auto). For all other PROFINET devices in the PROFINET
ring, the media redundancy role Client must be configured. There is a communication
connection based on MRP between the redundancy manager and the redundancy clients. The
Media Redundancy Protocol (MRP) automatically reconfigures the data paths between the
individual devices if the ring is interrupted at any point.
You configure the media redundancy role for IO devices and other PROFINET devices in
STEP 7. For switches without system redundancy S2, you set the media redundancy role to
"Client" over the Web interface.

S7-1500R/H redundant system

44 System Manual, 05/2021, A5E41814787-AC
 System overview
3.3 S7-1500 R/H-CPUs

H-Sync Forwarding
H-Sync Forwarding enables a PROFINET device with MRP to forward synchronization data
(synchronization frames) of a S7-1500R redundant system only within the PROFINET ring.
In addition, H-Sync Forwarding forwards the synchronization data even during re-
configuration of the PROFINET ring. H-Sync Forwarding avoids a cycle time increase if the
PROFINET ring is interrupted.

Note
Support of H-Sync Forwarding
The technical specifications typically state whether a PROFINET device supports
H-Sync Forwarding.
The GSD file will also indicate whether the device supports H-Sync Forwarding. The device
supports H-Sync Forwarding when the "AdditionalForwardingRulesSupported" attribute in the
"MediaRedundancy" element is set to "true".

Conditions:
• H-Sync Forwarding is not relevant for redundant S7-1500H systems. With the redundant
S7-1500H system, the H-Sync frames are transmitted exclusively via the fiber-optic cables.
• When you use PROFINET devices with more than two ports (e.g. switch) in the
PROFINET ring of an R-system, then H-Sync Forwarding is mandatory for these
devices.
H-Sync frames leave the PROFINET ring with a switch without H-Sync Forwarding. This
results in an additional load on the network. Another serious result is that the redundancy
of other R-systems in the network can fail or startup can be prevented.
• H-Sync Forwarding is recommended for all devices in the PROFINET ring if you are
using PROFINET devices with only 2 ports in the PROFINET ring of an R-system.

S7-1500R/H redundant system

System Manual, 05/2021, A5E41814787-AC 45
System overview
3.3 S7-1500 R/H-CPUs

When you operate PROFINET devices without H-Sync Forwarding in the PROFINET ring of
the redundant S7-1500R system, the following scenario will result in an additional cycle
time increase:

1. The redundant S7-1500R system is in the RUN-Redundant system state.

2. The PROFINET cable which directly connects the two CPUs fails.
3. The PROFINET ring is interrupted.
4. The PROFINET ring is being reconfigured.
5. PROFINET devices without H-Sync Forwarding do not forward any H-Sync frames during the
reconfiguration time of the PROFINET ring.
6. The cycle time increases by the reconfiguration time of the PROFINET ring.
Figure 3-13 Failure of the PROFINET cable between the CPUs

If the cyclic program exceeds the cycle monitoring time, the time error OB (OB 80) may be
started. Redundancy is lost if the time error OB (OB 80) is not present or the double cycle
monitoring time was exceeded with OB 80. You can find additional information on the
response of the S7-1500R/H redundant system when cycle time is exceeded in the section
Events and OBs (Page 177).

Note
If failure of the PROFINET cable that directly connects the two CPUs of the redundant
S7-1500R system is unlikely, you can use PROFINET devices without H-Sync Forwarding in
the PROFINET ring of the redundant S7-1500R system.
Example: Both CPUs of the redundant S7-1500R/H system are located next to each other
in the control cabinet. In this case, it is unlikely that the PROFINET cable will fail.

S7-1500R/H redundant system

46 System Manual, 05/2021, A5E41814787-AC
 System overview
3.3 S7-1500 R/H-CPUs

System redundancy S2
IO devices with S2 system redundancy enable uninterrupted process data exchange with the
S7-1500R/H redundant system in the event of a CPU failure.
An IO device with system redundancy S2 supports system redundancy ARs.
In a redundant system, an IO device with system redundancy S2 has a system redundancy AR
with each of the two CPUs (IO controllers). An IO device thus supports ARs of two IO
controllers simultaneously (for the same modules).
A system redundancy AR can be the primary AR or the backup AR. An IO device activates the
data of the primary AR at the outputs. The data of the backup AR is merely saved.
• Behavior in the RUN-Redundant system state:
Both CPUs are IO controllers. PROFINET communication runs on both system redundancy
ARs simultaneously, in each case between one of the CPUs (IO controller) and the
IO device. If the primary CPU then fails, the backup CPU becomes the primary CPU and also
switches the backup AR to primary AR. The data of this AR then becomes active at the
outputs.
• Behavior in the RUN-Solo system state:
Only the primary CPU is the IO controller. PROFINET communication runs on the primary
AR between the primary CPU and the IO device. There is no AR between the backup CPU
and the IO device.
In STEP 7, you configure a IO device connected system-redundant by assigning an IO device
with S2 system redundancy to both CPUs of the redundant system S7-1500R/H.

S7-1500R/H redundant system

System Manual, 05/2021, A5E41814787-AC 47
System overview
3.3 S7-1500 R/H-CPUs

Switched S1 device
As of FW version V2.8, the S7-1500R/H redundant system supports the "Switched S1 device"
function.
The "Switched S1 device" function of the CPU enables operation of standard IO devices on the
S7-1500R/H redundant system.
Standard IO devices are always assigned to both CPUs of the S7-1500R/H redundant system.
In contrast to an IO device with S2 system redundancy, a standard IO device supports only
one AR. The AR for the IO-device is only set up once by the primary CPU.
• Behavior in the RUN-Redundant system state:
PROFINET communication runs on the AR between the primary CPU (IO controller) and the
standard IO device. There is no AR between the backup CPU and the standard IO device.
If the primary CPU fails or is switched to STOP, the S7-1500R/H redundant system
responds as follows:
– The AR between the primary CPU and the standard IO device is disconnected.
– The previous backup CPU becomes the new primary CPU.
– The S7-1500R/H redundant system temporarily has no access to the inputs and no
control over the outputs of the standard IO device. The status of the outputs depends
on the substitute value behavior of the respective channels.
– The new primary CPU builds an AR to the standard IO device.
– As soon as the new primary CPU has set up the AR, the S7-1500R/H redundant system
has access to the inputs again and control over the outputs of the standard IO device.
• Behavior in the RUN-Solo system state:
Only the primary CPU is the IO controller. PROFINET communication runs on the AR
between the primary CPU (IO controller) and the standard IO device. There is no AR
between the backup CPU and the standard IO device.
In STEP 7 you configure an IO device connected via the "Switched S1 device" function by
assigning a standard IO device to both CPUs of the redundant S7-1500R/H system.

Note
Standard IO devices in the redundant system S7-1500R
Standard IO devices usually do not support H-Sync Forwarding.
To avoid a cycle time increase if the PROFINET ring is interrupted, integrate the standard
IO devices behind a switch and not in the PROFINET ring.

S7-1500R/H redundant system

48 System Manual, 05/2021, A5E41814787-AC
 System overview
3.3 S7-1500 R/H-CPUs

Note
I-device as standard IO device
You cannot assign a device to the S7-1500R/H redundant system which you have configured
in STEP 7 as an I-device.
In order to operate an I-device as a standard IO device on the redundant system S7-1500R/H,
always configure the I-device via GSD file.
• SIMATIC CPU as an I-device
– First, in STEP 7 configure the SIMATIC CPU as an I-device with all transfer areas.
– Export the I-device as a GSD file. The GSD export can be found in the properties of the
PROFINET interface under "Operating mode" > "I-device communication" > "Export
Generic System Description file (GSD)".
– Install the GSD file in STEP 7.
• HMI device as I-device (function "direct key")
– The GSD files for SIMATIC Comfort Panel and SIMATIC Mobile Panel can be found in this
application example (https://support.industry.siemens.com/cs/ww/en/view/73502293).
Assign the device configured via GSD file to the redundant system S7-1500R/H.

As of FW version V2.9, you can influence the changeover time between disconnection and
return of switched S1 devices after a failure/STOP of the primary CPU. You can find additional
information in the PROFINET function manual
(http://support.automation.siemens.com/WW/view/en/49948856).

MRP interconnection
The MRP interconnection process is an enhancement of MRP and allows the redundant
coupling of two or more rings with MRP in PROFINET networks. MRP interconnection is - like
MRP - specified in the standard IEC 62439-2 (Edition 3).
MRP interconnection allows the monitoring of larger topologies with ring redundancy. With
MRP interconnection, you are not limited to the maximum number of 50 devices in a ring
when setting up redundant network topologies. For information on the quantity structure of
MRP Interconnection, refer to the SCALANCE XM-400/XR-500 Web Based Management (WBM)
configuration manual (https://support.industry.siemens.com/cs/ww/en/view/109760840).
The S7-1500R/H CPUs support MRP interconnection as of firmware version V2.9. Observe the
maximum number of devices that can be connected for R/H-CPUs. Additional information can
be found in the manuals for the R/H CPUs.

4 devices for MRP interconnection connections

2 MRP interconnection connections provide redundant coupling between 2 MRP rings. Four
devices are required for these 2 connections:
• One media redundancy interconnection manager (MIM)
• 3 media redundancy interconnection clients (MIC):
– Primary MIC
– Primary Coupled MIC
– Secondary Coupled MIC

S7-1500R/H redundant system

System Manual, 05/2021, A5E41814787-AC 49
System overview
3.3 S7-1500 R/H-CPUs

Example
The following figure shows the redundant coupling based on the example of S7-1500R in
2 rings:

① Primary MIC
② Media Redundancy Interconnection Manager (MIM)
③ Secondary Link
④ Secondary Coupled MIC
⑤ Primary Coupled MIC
⑥ Primary Link

Figure 3-14 Example: Redundant connection of S7-1500R in 2 rings with MRP interconnection

S7-1500R/H redundant system

50 System Manual, 05/2021, A5E41814787-AC
 System overview
3.3 S7-1500 R/H-CPUs

Reference
Additional information on media redundancy, system redundancy S2 and switched S1 device
can be found in the PROFINET function manual
(http://support.automation.siemens.com/WW/view/en/49948856).
Additional information on MRP interconnection can be found in the PROFINET function
manual (http://support.automation.siemens.com/WW/view/en/49948856) and in the
configuration manual SCALANCE XM-400/XR-500 Web Based Management (WBM)
(https://support.industry.siemens.com/cs/ww/en/view/109760840).

3.3.3 Safety

SIMATIC Safety Integrated of integrated F-functionality

For fail-safe operation of your plant, program the F-CPUs. Use the "STEP 7 Safety Advanced"
of the TIA Portal for this purpose. In combination with STEP 7, the F-CPU offers optimal
integration of fail-safe systems into your engineering environment; one controller, one
communication system and one engineering platform for standard and fail-safe automation:
• Integration of safety technology
• Instructions approved by German Technical Inspectorate for frequently required safety
applications
• Integration of safety functions up to SIL 3 in accordance with IEC 61508, SILCL 3 in
accordance with IEC 62061 and/or PL e and Category 4 in accordance with ISO 13849-1
• Uniform engineering for standard and safety automation
• Simple documentation of safety-related changes via the F change history in STEP 7 Safety
• Support in the acceptance of the safety program and no renewed acceptance of the safety
program after changes in the standard program

Advantages and customer benefits

Safety Integrated offers the following advantages:
• Engineering with SIMATIC STEP 7 Safety Advanced in STEP 7, same engineering and
operating concept for standard and fail-safe automation tasks.
• Use of instructions approved by the German Technical Inspectorate from the system
library Safety in the safety program, for example for protective door, emergency stop,
monitored feedback loop circuit and user acknowledgment; saves time and reduces the
error rate
• Simple connections of PROFIsafe devices via PROFINET
• Additional password protection for F-CPU and safety program for IT security.
• Integration in integrated system diagnostics

S7-1500R/H redundant system

System Manual, 05/2021, A5E41814787-AC 51
System overview
3.3 S7-1500 R/H-CPUs

Example of baggage conveyor system with emergency stop buttons

Automation task
In an airport, a baggage conveyor distributes the luggage. Conveyor belts and track switches
transport the luggage to the various terminals. If a dangerous situation or a baggage jam
occurs at a track switch position or transshipment facilities, personnel need to be able to stop
the conveyor belt immediately.

① Conveyor belt switch

② Transshipment equipment
③ Emergency stop buttons

Figure 3-15 Baggage conveyor system with emergency stop buttons

Feature
You need the 1518HF-4 PN CPUs. With the integrated F-functionality, you evaluate the
emergency stop buttons via PROFIsafe.

S7-1500R/H redundant system

52 System Manual, 05/2021, A5E41814787-AC
 System overview
3.3 S7-1500 R/H-CPUs

Solution
If one of the CPUs fails (loss of redundancy), the S7-1500HF redundant system switches from
the RUN-Redundant system state to the RUN-Solo system state. The HF-system reduces the
probability of an F-STOP being triggered on failure of a CPU.
You evaluate the emergency stop buttons at the track switch positions and transshipment
facilities via fail-safe modules in the ET 200SP distributed I/O system. If a dangerous situation
or a baggage jam occurs, an employee presses the emergency stop button.
Result: The redundant system shuts down the conveyor belt immediately via PROFIsafe.

① CPU 1518HF-4 PN
② Redundancy connections (fiber-optic cables)
③ ET 200SP IO device for controlling the conveyor belt
④ PROFINET cables (PROFINET ring)
⑤ ET 200SP IO device with fail-safe modules for evaluating the emergency stop buttons
⑥ Emergency stop buttons

Figure 3-16 Configuration with CPUs 1518HF-4 PN and ET 200SP with fail-safe modules

Advantages
Safety Integrated provides the following advantages:
• Engineering with SIMATIC STEP 7 Safety Advanced in the TIA Portal
• Simple connection of PROFIsafe devices over PROFINET
• Integration in integrated system diagnostics

S7-1500R/H redundant system

System Manual, 05/2021, A5E41814787-AC 53
System overview
3.3 S7-1500 R/H-CPUs

Reference
You can find a detailed description of F-CPU configuration and programming in the
SIMATIC Safety – Configuring and Programming
(https://support.industry.siemens.com/cs/ww/de/view/54110126/en) programming and
operating manual.

3.3.4 Security
Security means the protection of technical systems against sabotage, espionage and human
error.

Protection functions
For the setup of secure networks, the S7-1500R/H redundant system has an integrated
security concept from authorization levels up to block protection:

Table 3- 5 Overview of protection functions

Protection function Description

Protection of confiden- Protection of confidential CPU configuration data
tial configuration data
Integrity protection The CPUs feature integrity protection by default. Integration protection detects the following ma-
nipulations:
• To the engineering data on the SIMATIC memory card
• To the engineering data during data transfer between TIA Portal and CPU
• To the engineering data during data transfer between HMI system and CPU
• To the synchronization data during data transfer between primary and backup CPU
• To the encrypted firmware
Access protection Protection against unauthorized configuration changes through four or five (with HF-CPU) author-
ization levels and an integrated firewall
Know-how protection Protection against unauthorized access and modifications to algorithms with password protection
CPU lock Protection against unauthorized access by locking the front cover with a seal or a lock

You can find additional information about security mechanisms of the SIMATIC automation
systems in the Security with SIMATIC S7 controllers
(https://support.industry.siemens.com/cs/ww/en/view/77431846) document and in the
Communication (https://support.industry.siemens.com/cs/ww/de/view/59192925/en)
function manual.

S7-1500R/H redundant system

54 System Manual, 05/2021, A5E41814787-AC
 System overview
3.3 S7-1500 R/H-CPUs

Access protection example

You can choose from four or five (with HF-CPU) different access levels in STEP 7 to restrict
user access to functions and memory areas.

Figure 3-17 Access protection

If you only want to allow users access over HMI, for example, select the access level
"HMI access" in the TIA Portal. Only HMI access and access to diagnostics data is then possible
without entering a password.
Users can read and write tags over an HMI device with this access level.
Users cannot:
• Download blocks or the hardware configuration to the CPU
• Upload blocks or the hardware configuration from the CPU to the PG/PC
• Run writing test functions
• Change the operating state from the PG/PC
• Run firmware updates

Advantages and customer benefits of protection functions

The protection functions listed above protect your investments from unauthorized access and
manipulation, helping to secure plant availability.

PG/PC and HMI communication

With STEP 7 and WinCC as of Version V17, R/H-CPUs from firmware version 2.9 support
innovated and standardized secure PG/PC and HMI communication – referred to as Secure
PG/HMI communication for short.

Reference
You can find additional information on the protection functions described in the section
Protection (Page 194) and in the STEP 7 online help.
Siemens products and solutions are only one element of a comprehensive industrial security
concept. Please note the additional information on Industrial Security
(http://www.siemens.com/industrialsecurity).

S7-1500R/H redundant system

System Manual, 05/2021, A5E41814787-AC 55
System overview
3.3 S7-1500 R/H-CPUs

3.3.5 Diagnostics
All levels of automation in the S7-1500R/H redundant system have integrated diagnostics. All
SIMATIC products have integrated diagnostic functions that you can use to analyze, localize
and log faults and errors efficiently.
System diagnostics is integrated into the firmware of the CPUs and works independently of
the cyclic user program. Faults in the plant are immediately detected and reported on the
display devices.
A uniform display concept visualizes error messages as plain text information over:
• TIA Portal
• HMI devices
• CPU displays

S7-1500R/H redundant system

56 System Manual, 05/2021, A5E41814787-AC
 System overview
3.3 S7-1500 R/H-CPUs

Displaying faults in an IO device

The various components of the S7-1500R/H redundant system are connected over
PROFINET/Industrial Ethernet (IE). The devices detect faults in their modules (for example
IO device ET 200SP) and send diagnostics data to the assigned CPU. The CPU analyzes this
diagnostic information and notifies the connected display media. The information analyzed is
shown in graphic form in the configuration and programming software (TIA Portal), on the
HMI devices and on the CPU displays.

Figure 3-18 Overview of system diagnostics in a plant

Advantages and customer benefits

Integrated system diagnostics offers the following advantages:
• Diagnostics is always consistent with the actual state of the plant. In S7-1500R/H
redundant mode, the diagnostic information is synchronized between the CPUs.
• The uniform display concept enables efficient error analysis.
• The immediate identification of the error source in the event of an error speeds up
commissioning and minimizes production downtimes.
• By configuring diagnostics events, you tailor the diagnostics to the requirements of your
automation task.
Reference
You will find more information on diagnostics in the Diagnostics
(https://support.industry.siemens.com/cs/ww/en/view/59192926) function manual.

S7-1500R/H redundant system

System Manual, 05/2021, A5E41814787-AC 57
System overview
3.3 S7-1500 R/H-CPUs

3.3.6 Trace
The trace functionality facilitates troubleshooting and optimization for the user program.
Trace records device tags and evaluates the recordings. This allows you to analyze defective
signal responses. Tags are, for example, drive parameters or the system and user tags of a
CPU. Because the CPU records tags directly, the trace and logic analyzer function is suitable
for monitoring highly dynamic processes.

Note
Trace restrictions
The S7-1500R/H redundant system does not support the storage of measurements on the
SIMATIC memory card.

S7-1500R/H redundant system

58 System Manual, 05/2021, A5E41814787-AC
 System overview
3.3 S7-1500 R/H-CPUs

Example of signal response analysis

To analyze a specific signal response, you define the recording and trigger conditions for the
signals to be recorded.
① The trace function can be called in the project tree from the "Traces" folder under the top
CPU of the redundant system.
The trend diagram ② displays the selected signals of a recording. Bits are shown in the lower
diagram as a bit track.
The signal table ③ lists the signals of the selected measurement and provides setting options
for specific properties.

① Trace recordings for S7-1500R/H in the project tree

② Trend diagram
③ Signal table
Figure 3-19 Trace measurement for S7-1500R/H

S7-1500R/H redundant system

System Manual, 05/2021, A5E41814787-AC 59
System overview
3.3 S7-1500 R/H-CPUs

Advantages and customer benefits

The trace function offers the following advantages:
• Simultaneous recording of up to 16 different signals and up to four separate trace jobs
• A uniform standard for tag analysis that allows even sporadic errors to be located rapidly

Reference
You can find additional information on the trace function in the section Test functions
(Page 314) and in the Using the trace and logic analyzer function manual
(http://support.automation.siemens.com/WW/view/en/64897128).

3.3.7 PID control

PID controllers are built into all R/H-CPUs as standard. PID controllers measure the actual value
of a physical variable, for example, temperature or pressure, and compare the actual value
with the setpoint. Based on the resulting error signal, the controller calculates a manipulated
variable that causes the process value to reach the setpoint as quickly and stably as possible.
You can choose from three different PID technology objects:

PID technology object Description

PID_Compact The PID_Compact technology object provides a PID controller with integrated tuning for pro-
portional-action final controlling elements. Different operating modes are possible with
PID_Compact, e.g:
• Pretuning
• Fine tuning
• Automatic mode
• Manual mode
PID_3Step The PID_3Step technology object provides a PID controller with tuning for valves or actuators
with integrating behavior. You can configure the following controllers:
• Three-point stepping controller with position feedback
• Three-point stepping controller without position feedback
• Valve controller with analog output value
PID_Temp The PID_Temp technology object provides a continuous PID controller with integrated tuning.
PID_Temp is specially designed for temperature control and is suitable for heating or heat-
ing/cooling applications. Two outputs are available, one for heating and one for cooling. You
can also use PID_Temp for other control tasks. PID_Temp can be cascaded. You can use
PID_Temp in manual or automatic mode.

Note
Restriction
The display of the start value in the CPU and the corresponding comparison result in the
configuration editor of the PID technology object is only possible in the RUN-Solo system
state.

S7-1500R/H redundant system

60 System Manual, 05/2021, A5E41814787-AC
 System overview
3.3 S7-1500 R/H-CPUs

Example closed loop control of a valve in a mixer tap

The automation task is to control the valve of a mixer tap according to a desired temperature
setting. You configure the opening and closing of the valve in the PID_3Step technology
object. For this you need:
• An analog input channel for the actual value
• A digital output for "Control upwards" (e.g. open valve)
• A digital output for "Control downwards" (e.g. close valve)
The first step is to select the PID_3Step technology object in STEP 7:

Figure 3-20 Selection of the PID_3Step technology object in STEP 7

S7-1500R/H redundant system

System Manual, 05/2021, A5E41814787-AC 61
System overview
3.3 S7-1500 R/H-CPUs

After selecting the technology object, it is automatically stored in the project tree in the
Technology Objects folder. In the configuration window, select the desired parameter area
and enter the configuration data for the PID controller.

Figure 3-21 Configuration of the PID_3Step technology object in STEP 7

The required instance data module corresponds to the PID_3Step technology object.

Advantages and customer benefits

• Simple configuration and programming through integrated editors and blocks.
• Simple simulation, visualization, commissioning and operation via PG and HMI.
• Automatic calculation of the control parameters and tuning during operation.
• No additional hardware and software required.

Reference
You can find more information on PID controllers PID Control Function Manual
(https://support.industry.siemens.com/cs/ww/en/view/108210036).

S7-1500R/H redundant system

62 System Manual, 05/2021, A5E41814787-AC
 System overview
3.4 Communication

3.4 Communication

3.4.1 System and device IP addresses

Device IP addresses
For the interfaces of the CPUs and the IO devices to be accessible, the interfaces require
IP addresses that are unique within the network (device IP addresses).

MAC addresses
The CPUs have a unique MAC address for each interface and its ports. The MAC addresses of
the PROFINET ports are needed for the LLDP protocol, for example for the neighborhood
discovery function.
The number range of the MAC addresses is sequential. The first and last MAC addresses are
printed on the rating plate on the right-hand side of each CPU.

System IP addresses
In addition to the device IP addresses of the CPUs, the redundant system S7-1500R/H
supports system IP addresses:
• System IP address for the X1 PROFINET interfaces of the two CPUs (system IP address X1)
for CPU 1513R-1 PN, CPU 1515R-2 PN, CPU 1517H-3 PN and CPU 1518HF-4 PN
• System IP address for the X2 PROFINET interfaces of the two CPUs (system IP address X2)
for CPU 1515R-2 PN, CPU 1517H-3 PN and CPU 1518HF-4 PN
• System IP address for the X3 PROFINET interfaces of the two CPUs (system IP-address X3)
for CPU 1518HF-4 PN
You use the system IP addresses for communication with other devices (for example,
HMI devices, CPUs, PG/PC). The devices always communicate over the system IP address with
the primary CPU of the redundant system. This ensures that the communication partner can
communicate with the new primary CPU (previously backup CPU) in the RUN-Solo system
state after failure of the original primary CPU in redundant operation.
There is a virtual MAC address for each system IP address. The virtual MAC addresses of the
two PROFINET interfaces must be different from each other.
You enable the system IP addresses in STEP 7.
You can find information on configuring the system IP addresses and the virtual
MAC addresses in the section Configuration procedure (Page 161).

Advantages of system IP addresses over device IP addresses

• Targeted communication of the communication partner with the primary CPU.
• The S7-1500R/H redundant system can continue to communicate over a system IP address
even if the primary CPU fails.

S7-1500R/H redundant system

System Manual, 05/2021, A5E41814787-AC 63
System overview
3.4 Communication

Configuration example
The figure below shows a configuration in which the S7-1500R/H redundant system
communicates with other devices over the system IP address X2. The other devices are
connected to the S7-1500 redundant system over the X2 PROFINET interfaces.

Figure 3-22 Example: Communication of the S7 1500R/H redundant system over the system IP
address X2

Reference
You can find more information on the system IP address in the S7-1500R/H redundant system
in the Communication (https://support.industry.siemens.com/cs/ww/en/view/59192925)
function manual.

S7-1500R/H redundant system

64 System Manual, 05/2021, A5E41814787-AC
 System overview
3.4 Communication

3.4.2 Integrated interfaces for communication

The table below provides an overview of CPU communication options in the S7-1500R/H
redundant system.

Table 3- 6 S7-1500R/H communication options

Communication option Service available over:

PROFINET inter- PROFINET inter- PROFINET inter- System IP ad-
face X1 (de- face X2 (de- face X3 (de- dress (at inter-
vice IP address) vice IP address)1) vice IP address)2) faces X1, X2
and X3)
PROFINET IO ✓ --- --- ---
MRP (Media Redundancy Protocol) ✓ --- --- ---
LLDP (network topology detection) ✓ ✓ ✓ ---
PG communication for commissioning, test- ✓ ✓ ✓ ---
ing and diagnostics
HMI communication for operator control and ✓3) ✓3) ✓3) ✓
monitoring
Open User Communication ✓3) ✓3) ✓3) ✓
S7 communication as server ✓3) ✓3) ✓3) ✓
S7 routing ✓ ✓ ✓ ---
IP forwarding ✓ ✓ ✓ ✓
Time synchronization ✓ ✓ ✓ ---
1) Not with CPU 1513R-1 PN
2) Not with CPU 1513R-1 PN, CPU 1515R-2 PN and CPU 1517H-3 PN
3) Communication mainly over system IP address: If the communication partner uses a device IP address and the CPU with
this device IP address fails, communication between the communication partner and the S7-1500R/H also fails.

Reference
For more information on communication options, please refer to the Communication
function manual.

S7-1500R/H redundant system

System Manual, 05/2021, A5E41814787-AC 65
System overview
3.5 Power supply

3.4.3 HMI devices

HMI devices are used for machine-level process visualization and control. You use the same
HMI devices for the S7-1500R/H redundant system as for the standard S7-1500 system.
Using HMI communication, one or more HMI devices exchange data with the CPUs . Examples
of HMI devices are HMI Basic/Comfort/Mobile Panel.
The connection of the HMI device to the redundant system depends on the specific
application. In STEP 7, you can configure the following communication options:
• The HMI device communicates with the redundant system over the system IP address.
• The HMI device communicates with the R/H-CPUs (for example for diagnostics purposes)
over the device IP addresses.

Reference
You can find additional information on using HMI devices in the section Using HMI devices
(Page 113) and in the Communication function manual
(https://support.industry.siemens.com/cs/ww/en/view/59192925).
You can find an overview of all available HMI devices in the Industry Mall
(https://mall.industry.siemens.com/mall/en/WW/Catalog/Products/9109999?tree=CatalogTree)
.

3.5 Power supply

The CPUs of the redundant system have an integrated system power supply. You can add one
load current supply to the integrated system power supply.

Note
The CPUs are designed for fixed operation and continuous operation on a load current supply.

Load power supply (PM)

The load current supply (PM) supplies the system components and CPU. You can install the
load current supply directly to the left of the CPU (without connection to the backplane bus).

Using a SITOP power supply as an alternative to a load power supply

Alternatively, an external 24 V power supply from the SITOP range
(https://mall.industry.siemens.com/mall/en/WW/Catalog/Products/10008864) (SITOP smart or
SITOP modular) can be used:
• With redundant installation
(https://support.industry.siemens.com/cs/ww/de/view/109768676/en) of the
24 V power supply as protection against failure of a power supply unit
• With buffering of the 24 V power supply (e.g. with DC UPS) as protection against power
failure
• With selective monitoring of 24 V loads as protection against overload or short-circuit

S7-1500R/H redundant system

66 System Manual, 05/2021, A5E41814787-AC
 System overview
3.6 Software

3.6 Software

3.6.1 TIA Portal

The SIMATIC controllers are integrated into the Totally Integrated Automation Portal.
Engineering with TIA Portal offers:
• Configuration and programming
• Shared data management
• A uniform operating concept for control, visualization and drives
The TIA Portal simplifies integrated engineering in all configuration phases of a plant.

Figure 3-23 TIA Portal overview

S7-1500R/H redundant system

System Manual, 05/2021, A5E41814787-AC 67
System overview
3.6 Software

3.6.2 SINETPLAN
SINETPLAN (https://www.siemens.com/sinetplan), the Siemens Network Planner, helps you
plan automation systems and networks based on PROFINET. The tool facilitates the
professional and predictive dimensioning of your PROFINET system right from the planning
stage. SINETPLAN also assists with network optimization and helps you to make the best
possible use of network resources and to plan for reserves. This allows you to avoid problems
in commissioning and failures during productive operation even before planned use. This
increases the availability of the production plant and helps improve operational safety.
The advantages at a glance
• Network optimization thanks to port-specific calculation of the network load
• Increased production availability thanks to online scan and verification of existing systems
• Transparency before commissioning through import and simulation of existing
STEP7 projects
• Efficiency through securing existing investments in the long term and the optimal use of
resources

3.6.3 PRONETA
SIEMENS PRONETA (PROFINET network analysis) allows you to analyze the plant network
during commissioning. PRONETA features two core functions:
• The topology overview independently scans PROFINET and all connected components.
• The IO check is a rapid test of the wiring and the module configuration of a plant.
SIEMENS PRONETA (https://support.industry.siemens.com/cs/ww/en/view/67460624) is
available for free on the Internet.

S7-1500R/H redundant system

68 System Manual, 05/2021, A5E41814787-AC
Application planning 4
4.1 Requirements

Introduction
Please note the following requirements for use of the S7-1500R/H redundant system.

Hardware requirements

Table 4- 1 Hardware requirements

Property Requirement
S7-1500R/H CPUs • 2 identical R-CPUs or H-CPUs in the redundant system
• Identical article numbers and firmware versions for the two CPUs
• Firmware version display of the R/H-CPUs: As of FW version V2.6
PROFINET ring A PROFINET ring is required for all configuration variants (Page 73) of the S7-1500R/H redundant
system.

S7-1500R/H redundant system

System Manual, 05/2021, A5E41814787-AC 69
Application planning
4.1 Requirements

Property Requirement
PROFINET devices • Media redundancy (MRP)
– All PROFINET devices in the PROFINET ring support the function media redundancy.
– Both CPUs have the media redundancy role "Manager (auto)". All other devices in the
PROFINET ring have the media redundancy role "Client".
• H-Sync Forwarding - for PROFINET devices in the PROFINET ring with S7-1500R:
– When you use PROFINET devices with more than two ports (e.g. switch) in the PROFINET ring
of an R-system, then H-Sync Forwarding is mandatory for these devices.
– H-Sync Forwarding is recommended for all devices in the PROFINET ring if you are using
PROFINET devices with only 2 ports in the PROFINET ring of an R-system.
• Redundancy:
– With the switched S1 device function, you can operate any standard IO device on the redun-
dant S7-1500R/H system.
– An IO device must support S2 system redundancy for uninterrupted exchange of process da-
ta in the event of failure of the primary CPU (primary-backup switchover).
• The following SIMATIC PROFINET IO devices support system redundancy S2, media redundancy
and H-Sync forwarding:
– ET 200SP IM 155-6 PN HF (6ES7155-6AU00-0CN0), FW version V4.2 or later
– ET 200SP IM 155-6 PN/2 HF (6ES7155-6AU01-0CN0), FW version V4.2 or later
– ET 200SP IM 155-6 PN/3 HF (6ES7155-6AU30-0CN0), FW version V4.2 or later
– ET 200MP (6ES7155-5AA00-0AC0), FW version V4.2 or later
– PN/PN coupler (6ES7158-3AD10-0XA0), FW version V4.2 or later
– PN/MF coupler (6ES7158-3MU10-0XA0), FW version V5.0 or later
• Switches of the product families XC-200, XP-200 and XF-200BA support system redundancy S2,
media redundancy and H-Sync-Forwarding, for example SCALANCE XC208 (6GK5208-0BA00-
2AC2), FW version V4.0 or later.
• S7-1500 CPUs: Firmware version V2.5 or later
The redundant system does not recognize the S7-1500 CPUs when calculating the maximum
number of IO devices within and outside the PROFINET ring. If you use S7-1500 CPUs, you will
have to check the maximum number yourself.
• SINAMICS S120 PROFINET Control Unit (CU310-2 PN or CU320-2 PN) support system redundancy
S2 and media redundancy, FW version V5.2 or later.
Load current supply Load current supply PM for the R/H CPUs
PM The use of the PM is optional.
Suitable load current supplies:
• PM 70 W 120/230 V AC
• PM 190 W 120/230 V AC

1) If you use PROFINET devices that do not support H-Sync Forwarding in S7-1500R, additional cycle time increases may
occur in the RUN-Redundant system state. If the cyclic program exceeds the cycle monitoring time, the time error OB
(OB 80) may be started. You can find additional information in the section Events and OBs.

S7-1500R/H redundant system

70 System Manual, 05/2021, A5E41814787-AC
 Application planning
4.2 Restrictions compared to the S7-1500 automation system

Special case: Operating R/H CPU individually

You can operate an R/H CPU as a single CPU. If you do, please note the following:
• You always configure 2 R-CPUs or H-CPUs for S7-1500R/H, even if you only set up one CPU.
• The MAINT LED on the CPU is always yellow (maintenance demanded):
– The R/H system is not in redundant mode.
– No partner CPU was found.

Software requirements

Table 4- 2 Software requirements

Function Requirement
STEP 7 • CPU 1513R-1 PN, CPU 1515R-2 PN, CPU 1517H-3 PN: SIMATIC STEP 7 Professional,
V15.1 or later
• CPU 1518HF-4 PN: SIMATIC STEP 7 Professional V17 or higher

4.2 Restrictions compared to the S7-1500 automation system

Introduction
Please note the following restrictions with the S7-1500R/H redundant system compared to
the S7-1500 automation system.

Hardware restrictions

Table 4- 3 Hardware restrictions

Property Restriction
Fail-safe modules No support of fail-safe modules of the CPUs 1513R-1 PN,
1515R-2 PN and 1517H-3 PN. Fail-safe modules are only sup-
ported by the HF-CPUs.
Series machine projects, configuration Not supported
control (option handling)
Central I/O Central I/O modules are not supported in the hardware con-
figuration of the S7-1500R/H redundant system.
Cycle and response times Longer cycle and response times: You can find additional
information in the Cycle and response times
(https://support.industry.siemens.com/cs/ww/en/view/591935
58) function manual.

S7-1500R/H redundant system

System Manual, 05/2021, A5E41814787-AC 71
Application planning
4.2 Restrictions compared to the S7-1500 automation system

Software restrictions
Table 4- 4 Software restrictions

Function Restriction
Instructions Restrictions for specific instructions: You can find additional
information in the section Restrictions (Page 175).
Display: "Modules" menu command Not supported
Firmware update Firmware update via accessible devices is not supported.
Hardware detection in STEP 7 (read Not supported
out configuration)
HMI tags The direct entry of tags on the HMI device is only possible in
the RUN-Solo system state.
I-device The S7-1500R/H redundant system cannot be used as an I
device.
IRT Not supported
Calibrating analog modules You can only calibrate analog modules of an IO device in the
RUN-Solo system state.
1. Switch the CPU with redundancy ID 1 to the STOP operat-
ing state.
2. Establish an online connection with STEP 7 to the analog
module to be calibrated.
3. Perform the calibration of the analog module with STEP 7.
You can find more information on this topic in the STEP 7
online help.
4. Then start the CPU with redundancy ID 1.
Configured connections Connection type not support for communication connection.
Only programmed connections are supported.
Motion Control Motion Control functions are not supported in the CPUs
MRPD Not supported
Multiuser Engineering No support of commissioning mode (joint commissioning of a
project online).
Online functions No support of the SIMATIC Automation Tool (SAT-Tool). In
RUN-Redundant system state, only an online connection to
STEP 7 is possible. In RUN-Solo system state, multiple online
connections can be established at the same time.
OPC UA OPC UA (server and client) not supported
Secure OUC Not supported as certificate management is not possible for
the R/H CPUs:
If you have enabled Secure OUC, you can compile and load
the user program but cannot add certificates to the R/H CPUs.
PROFINET send clock 1 ms only
Shared Device Not supported
System power supply The following parameter is irrelevant:
"System power supply" > "General" > "Connection to supply
voltage L+/No connection to supply voltage L+"
Isochronous mode Isochronous mode is not supported
Testing with breakpoints You can only test with breakpoints in the STARTUP (startup
OB) or RUN-Solo system state.
Trace The storage of measurements on the SIMATIC memory card
(measurements in the device) is not supported.
Web server Not supported

S7-1500R/H redundant system

72 System Manual, 05/2021, A5E41814787-AC
 Application planning
4.3 Configuration versions

4.3 Configuration versions

Introduction
You can configure different versions of the S7-1500R/H redundant system. A PROFINET ring is
essential in all configuration variants.
For the configuration variants of the S7-1500R/H system, there is redundancy for the
following components:
• R/H-CPUs
• Synchronization interfaces
• Media in the PROFINET ring
This section describes the admissible configuration variants and their advantages/benefits.
The following convention applies:

Figure 4-1 Green traffic light

S7-1500R/H redundant system

System Manual, 05/2021, A5E41814787-AC 73
Application planning
4.3 Configuration versions

4.3.1 S7-1500R/H configuration with IO devices in the PROFINET ring

Introduction
The following sections set out configurations of the S7-1500R/H redundant system with
IO devices in the PROFINET ring.

Advantages/benefits
• IO devices with S2 system redundancy enable uninterrupted process data exchange with
the S7-1500R/H redundant system in the event of a CPU failure.
• The redundant system continues to operate following a cable interruption anywhere in
the PROFINET ring.

S7-1500R configuration

① CPU 1
② CPU 2
③ PROFINET cable (redundancy connections, PROFINET ring)
④ IO device ET 200MP (with system redundancy S2)
⑤ IO device ET 200SP (with system redundancy S2)

Figure 4-2 S7-1500R configuration with IO devices in the PROFINET ring

S7-1500R/H redundant system

74 System Manual, 05/2021, A5E41814787-AC
 Application planning
4.3 Configuration versions

S7-1500H configuration

① CPU 1
② CPU 2
③ Two fiber-optic cables (redundancy connections)
④ IO device ET 200SP (with system redundancy S2)
⑤ IO device ET 200MP (with system redundancy S2)
⑥ Standard IO device ET 200SP
⑦ Standard IO device ET 200MP
⑧ PROFINET cable (PROFINET ring)

Figure 4-3 S7-1500H configuration with IO devices in the PROFINET ring

S7-1500R/H redundant system

System Manual, 05/2021, A5E41814787-AC 75
Application planning
4.3 Configuration versions

4.3.2 S7-1500R/H configuration with switches and linear topology

Introduction
The following sections set out configurations of the S7-1500R/H redundant system with
switches and line topology.

Benefits/advantages
• You can use a switch to add an additional line topology to the PROFINET ring. Unlike the
PROFINET ring, the line topology is not redundant.
• PROFINET IO devices can be located in the PROFINET ring or they can be separated with a
switch.

S7-1500R configuration

① CPU 1
② CPU 2
③ PROFINET cable (redundancy connections, PROFINET ring)
④ IO device ET 200SP (with system redundancy S2)
⑤ IO device ET 200MP (with system redundancy S2)
⑥ Switch
⑦ Standard IO device ET 200SP
⑧ HMI device

Figure 4-4 S7-1500R configuration with switches and line topology

S7-1500R/H redundant system

76 System Manual, 05/2021, A5E41814787-AC
 Application planning
4.3 Configuration versions

S7-1500H configuration

① CPU 1
② CPU 2
③ Two fiber-optic cables (redundancy connections)
④ IO device ET 200MP (with system redundancy S2)
⑤ IO device ET 200SP (with system redundancy S2)
⑥ Standard IO device ET 200MP
⑦ Standard IO device ET 200SP
⑧ PROFINET cable (PROFINET ring)
⑨ Switch
⑩ HMI device

Figure 4-5 S7-1500H configuration with switches and line topology

S7-1500R/H redundant system

System Manual, 05/2021, A5E41814787-AC 77
Application planning
4.4 Redundancy scenarios

4.4 Redundancy scenarios

4.4.1 Introduction

Introduction
This section describes possible redundancy scenarios on the basis of various different
configuration variants. The redundancy scenarios do not result in process restrictions. In the
examples shown, the failures are tolerated by the redundant system.
The following convention applies:

Figure 4-6 Yellow traffic light

S7-1500R/H redundant system

78 System Manual, 05/2021, A5E41814787-AC
 Application planning
4.4 Redundancy scenarios

4.4.2 Failure of the primary CPU

Introduction
The following redundancy scenario describes the effects of a defective primary CPU.

Redundancy scenario

① Primary CPU → failed

② Backup CPU → becomes new primary CPU
③ PROFINET cable (redundancy connections, PROFINET ring)
④ IO device ET 200MP (with system redundancy S2)
⑤ IO device ET 200SP (with system redundancy S2)
⑥ Switch
⑦ Standard IO device ET 200SP

Figure 4-7 Failure of the primary CPU (using S7-1500R as an example)

S7-1500R/H redundant system

System Manual, 05/2021, A5E41814787-AC 79
Application planning
4.4 Redundancy scenarios

Sequence of events
1. The primary CPU of the redundant system fails in the RUN-Redundant system state.
2. The redundant system switches to the backup CPU. The backup CPU becomes the new
primary CPU. The redundant system switches to the RUN-Solo system state. You can find
additional information on the RUN-Solo system state in the section Operating and system
states (Page 226).
3. The new primary CPU exchanges process data with the IO devices.

Note
Temporary separation of standard IO devices in the event of failure of the primary
CPU
If the primary CPU fails, the standard IO devices ("switched S1 devices") are temporarily
separated from the S7-1500R/H redundant system. During this time, the configured
substitute value behavior applies to the modules of the standard IO devices.
The new primary CPU establishes the connections to the standard IO devices again. After a
short time, the primary CPU resumes exchanging process data with the standard IO
devices.

4. The redundancy of the system is restricted. The restriction has no impact on the process.
If another system component or another network segment fails, this can result in the failure
of the S7-1500R/H redundant system. You can find additional information in the section
Failure scenarios (Page 92).

Diagnostics
System state, operating states and error displays after primary-backup switchover:
• Redundant system → RUN-Solo system state
• Primary CPU (previously backup CPU) → RUN operating state
– MAINT LED → yellow light: The R/H system is not in the RUN-Redundant system state.
No partner CPU has been found in the redundant system. The PROFINET ring is open.
• Backup CPU (previously primary CPU) → failed

Note
To get detailed diagnostics information, evaluate the diagnostics buffer.

Solution
Replace the defective CPU. You can find additional information on the procedure in the
section Replacing defective R/H CPUs (Page 292).

S7-1500R/H redundant system

80 System Manual, 05/2021, A5E41814787-AC
 Application planning
4.4 Redundancy scenarios

4.4.3 Failure of the backup CPU

Introduction
The following redundancy scenario describes the effects of a defective backup CPU.

Redundancy scenario

① Primary CPU
② Backup CPU → failed
③ PROFINET cable (redundancy connections, PROFINET ring)
④ IO device ET 200MP
⑤ IO device ET 200SP

Figure 4-8 Failure of the backup CPU (using S7-1500R as an example)

Sequence of events
1. The backup CPU of the redundant system fails in the RUN-Redundant system state.
2. The redundant system switches to the RUN-Solo system state. You can find additional
information on the RUN-Solo system state in the section Operating and system states
(Page 226).
3. The primary CPU continues to exchange process data with the IO devices (and standard
IO devices).
4. The redundancy of the system is restricted. The restriction has no impact on the process.
If another system component or another network segment fails, this can result in the failure
of the S7-1500R/H redundant system. You can find additional information in the section
Failure scenarios (Page 92).

S7-1500R/H redundant system

System Manual, 05/2021, A5E41814787-AC 81
Application planning
4.4 Redundancy scenarios

Diagnostics
System state, operating states and error displays after primary-backup switchover:
• Redundant system → RUN-Solo system state
• Primary CPU → RUN operating state
– MAINT LED → yellow light: The R/H system is not in the RUN-Redundant system state.
No partner CPU has been found in the redundant system. The PROFINET ring is open.
• Backup CPU → failed

Note
To get detailed diagnostics information, evaluate the diagnostics buffer.

Solution
Replace the defective CPU. You can find additional information on the procedure in the
section Replacing defective R/H CPUs (Page 292).

S7-1500R/H redundant system

82 System Manual, 05/2021, A5E41814787-AC
 Application planning
4.4 Redundancy scenarios

4.4.4 Failure of the PROFINET cable in the PROFINET ring

Introduction
The following redundancy scenario describes the effects of a defective PROFINET cable in the
PROFINET ring.

Redundancy scenario

① Primary CPU
② Backup CPU
③ PROFINET cable (redundancy connections, PROFINET ring) → interrupted
④ IO device ET 200MP
⑤ IO device ET 200SP

Figure 4-9 Failure of a PROFINET cable in the PROFINET ring (using S7-1500R as an example)

S7-1500R/H redundant system

System Manual, 05/2021, A5E41814787-AC 83
Application planning
4.4 Redundancy scenarios

Sequence of events
1. A defective or disconnected PROFINET cable interrupts the PROFINET ring of the redundant
system.
2. The redundant system remains in the RUN-Redundant system state: The primary and backup
CPUs remain in the RUN-Redundant operating state.
3. The redundant system selects an alternative connection over the backup CPU. This allows
the redundant system to access all IO devices in the PROFINET ring again.
4. The redundancy of the system is restricted. The restriction has no effect on the process.
If another system component or another network segment fails, this can result in the
failure of the S7-1500R/H redundant system.
– If the PROFINET cable is also interrupted at another point, IO devices in the PROFINET
ring may fail depending on the location of the interruption.
– You can find additional information in the section Failure scenarios (Page 92).

Diagnostics
System state, operating states and error displays after the failure of the PROFINET cable:
• Redundant system → RUN-Redundant system state
• Primary CPU → RUN-Redundant operating state
– MAINT LED → yellow light: The PROFINET ring is open. There is only one redundancy
connection remaining in the redundant system.
• Backup CPU → RUN-Redundant operating state
– MAINT LED → yellow light: The PROFINET ring is open. There is only one redundancy
connection remaining in the redundant system.

WARNING
Failure of the redundant system S7-1500R
If the primary CPU fails in addition to the PROFINET cable, the backup CPU switches to the
STOP operating state. You can find more information in the section Failure of the primary
CPU when IO devices have failed in the PROFINET ring (Page 101).

Note
To get detailed diagnostics information, evaluate the diagnostics buffer.

Solution
Replace the defective PROFINET cable or reconnect the disconnected PROFINET cable. You
can find additional information on the procedure in the section Replacing defective PROFINET
cables.

S7-1500R/H redundant system

84 System Manual, 05/2021, A5E41814787-AC
 Application planning
4.4 Redundancy scenarios

4.4.5 Specific redundancy scenarios for S7-1500H

4.4.5.1 Failure of a redundancy connection in S7-1500H

Introduction
The following redundancy scenario describes the effects of a defective redundancy
connection in S7-1500H.

Redundancy scenario

① Primary CPU
② Backup CPU
③ One fiber-optic cable (redundancy connection) → interrupted
④ IO device ET 200SP
⑤ IO device ET 200MP
⑥ PROFINET cable (PROFINET ring)

Figure 4-10 Failure of a redundancy connection

S7-1500R/H redundant system

System Manual, 05/2021, A5E41814787-AC 85
Application planning
4.4 Redundancy scenarios

Sequence of events
1. One of the two redundancy connections (fiber-optic cables) is interrupted.
2. The system continues to exchange process data with the IO devices.
3. The redundancy of the system is restricted. The redundant system will remain in the
RUN-Redundant system state. The restriction has no effect on the process.

Diagnostics
System state, operating states and error displays after the failure of a redundancy connection:
• Redundant system → RUN-Redundant system state
• Primary CPU → RUN-Redundant operating state
– MAINT LED → yellow light: There is only one redundancy connection remaining in the
H system.
• Backup CPU → RUN-Redundant operating state
– MAINT LED → yellow light: There is only one redundancy connection remaining in the
H system.

WARNING
Failure of the redundant system
If the primary CPU fails in addition to the redundancy connection, the backup CPU switches
to the STOP operating state. You can find more information in the section Failure of one
redundancy connection and the primary CPU in S7-1500H (Page 106).

Note
To get detailed diagnostics information, evaluate the diagnostics buffer.

Solution
Replace the defective redundancy connection. You can find additional information on the
procedure in the section Replacing defective redundancy connections (Page 293).

S7-1500R/H redundant system

86 System Manual, 05/2021, A5E41814787-AC
 Application planning
4.4 Redundancy scenarios

4.4.5.2 Failure of both redundancy connections in S7-1500H > 55 ms apart

Introduction
The following redundancy scenario describes the effects of a defect in each of the two
redundancy connections in S7-1500H. In this redundancy scenario, the time between the
redundancy connection failures is > 55 ms.

Redundancy scenario

① Primary CPU (S7-1500H)

② Backup CPU (S7-1500H)
③ Two fiber-optic cables (redundancy connections) → interrupted
④ IO device ET 200MP
⑤ IO device ET 200SP
⑥ PROFINET cable (PROFINET ring)

Figure 4-11 Failure of both redundancy connections (> 55 ms apart)

S7-1500R/H redundant system

System Manual, 05/2021, A5E41814787-AC 87
Application planning
4.4 Redundancy scenarios

Sequence of events
1. The two redundancy connections (fiber-optic cables) are interrupted > 55 ms apart.
2. The redundant system switches to the RUN-Solo system state. The primary CPU remains in
the RUN operating state. The backup CPU switches to the STOP operating state.
3. The primary CPU continues to exchange process data with the IO devices.
4. The redundancy of the system is restricted. The restriction has no impact on the process.
If another system component or another network segment fails, this can result in the failure
of the S7-1500R/H redundant system. You can find additional information in the section
Failure scenarios (Page 92).

Diagnostics
System state, operating states and error displays after the failure of both redundancy
connections:
• Redundant system → RUN-Solo system state
• Primary CPU → RUN operating state
– MAINT LED → yellow light: The H-system is not in the RUN-Redundant system state. No
partner CPU has been found in the H-system.
• Backup CPU → STOP operating state
– MAINT LED → yellow light: The H-system is not in the RUN-Redundant system state. No
partner CPU has been found in the H-system.

Note
To get detailed diagnostics information, evaluate the diagnostics buffer.

Solution
Replace the defective redundancy connections. You can find additional information on the
procedure in the section Replacing defective redundancy connections (Page 293).

S7-1500R/H redundant system

88 System Manual, 05/2021, A5E41814787-AC
 Application planning
4.4 Redundancy scenarios

4.4.5.3 Failure of both redundancy connections and the PROFINET cable in the
PROFINET ring

Introduction
The following redundancy scenario describes the effects of a defect in each of the two
redundancy connections and in the PROFINET cable in the PROFINET ring.
In this redundancy scenario, the time between the redundancy connection failures
is > 55 ms.

Redundancy scenario

① Primary CPU
② Backup CPU
③ Two fiber-optic cables (redundancy connections) → interrupted
④ IO device ET 200SP
⑤ IO device ET 200MP
⑥ PROFINET cable (PROFINET ring) → interrupted

Figure 4-12 Failure of both redundancy connections and a PROFINET cable in the PROFINET ring

S7-1500R/H redundant system

System Manual, 05/2021, A5E41814787-AC 89
Application planning
4.4 Redundancy scenarios

Sequence of events
1. Both redundancy connections (fiber-optic cables) fail in the redundant system. The time
between the failures is > 55 ms.
2. The redundant system switches to the RUN-Solo system state. The primary CPU remains in
the RUN operating state. The backup CPU switches to the STOP operating state.
3. A defective PROFINET cable also interrupts the PROFINET ring.
4. The redundant system accesses all IO devices in the PROFINET ring again over the remaining
PROFINET cables.
5. The redundancy of the system is restricted. The restrictions have no effect on the process.

Diagnostics
System state, operating states and error displays after the failure of the redundancy
connections and PROFINET cable:
• Redundant system → RUN-Solo system state
• Primary CPU → RUN operating state
– MAINT LED → yellow light: The H-system is not in the RUN-Redundant system state. No
partner CPU has been found in the H-system. The PROFINET ring is open (requirement:
Primary CPU is MRP Manager).
• Backup CPU → STOP operating state
– MAINT LED → yellow light: The H-system is not in the RUN-Redundant system state. No
partner CPU has been found in the H-system.

Note
To get detailed diagnostics information, evaluate the diagnostics buffer.

Solution
Replace the defective redundancy connections and the defective PROFINET cable. You can
find more information on the procedure in the following sections:
• Replacing defective redundancy connections (Page 293)
• Replacing defective PROFINET cables

S7-1500R/H redundant system

90 System Manual, 05/2021, A5E41814787-AC
 Application planning
4.4 Redundancy scenarios

4.4.5.4 Failure of the two PROFINET cables in the PROFINET ring on the backup CPU

Introduction
The following redundancy scenario describes the effects of a defect of both PROFINET cables
in the PROFINET ring at the backup CPU.

Redundancy scenario

① Primary CPU
② Backup CPU
③ Two fiber-optic cables (redundancy connections)
④ IO device ET 200SP
⑤ IO device ET 200MP
⑥ PROFINET cables (PROFINET ring) → interrupted

Figure 4-13 Failure of both PROFINET cables in the PROFINET ring at the backup CPU

Sequence of events
1. Both PROFINET cables in the PROFINET ring upon failure of the backup CPU.
2. The redundant system will remain in the RUN-Redundant system state. The primary and
backup CPUs remain in the RUN-Redundant operating state.
3. The redundant system continues to reach all IO devices in the PROFINET ring.
4. The redundancy of the system is restricted. The restrictions have no effect on the process.

S7-1500R/H redundant system

System Manual, 05/2021, A5E41814787-AC 91
Application planning
4.5 Failure scenarios

Diagnostics
System state, operating states and error messages after the failure of both PROFINET cables
on the backup CPU:
• Redundant system → RUN-Redundant system state
• Primary CPU → RUN-Redundant operating state
– MAINT LED → yellow light: The PROFINET ring is open.
• Backup CPU → RUN-Redundant operating state
– MAINT LED → yellow light: The PROFINET ring is open. The backup CPU cannot accept
IO devices.

Note
To get detailed diagnostics information, evaluate the diagnostics buffer.

Solution
Replace the defective PROFINET cables. You can find additional information on the procedure
in the section Replacing defective PROFINET cables.

4.5 Failure scenarios

Introduction
This section describes possible failure scenarios with the various configuration variants. The
failure scenarios lead to process restrictions. In the examples shown, the redundant system
cannot tolerate the failures any longer.
The following convention applies:

Figure 4-14 Red traffic light

S7-1500R/H redundant system

92 System Manual, 05/2021, A5E41814787-AC
 Application planning
4.5 Failure scenarios

4.5.1 Failure of an IO device in the PROFINET ring

Introduction
The following failure scenario describes the effects of a defective IO device in the
PROFINET ring.

Failure scenario

① Primary CPU
② Backup CPU
③ PROFINET cable (redundancy connections, PROFINET ring)
④ IO device ET 200MP
⑤ IO device ET 200SP → failed

Figure 4-15 Failure of an IO device in the PROFINET ring (using S7-1500R as an example)

Sequence of events
1. An IO device in the PROFINET ring fails.
2. The PROFINET ring is interrupted.
3. The redundant system selects an alternative connection over the backup CPU. This allows
the redundant system to access all remaining IO devices in the PROFINET ring again.
4. The failure of the IO device has an impact on the process. If the failed inputs and outputs
have an important function in the system, their failure can have a critical impact on the
process.

S7-1500R/H redundant system

System Manual, 05/2021, A5E41814787-AC 93
Application planning
4.5 Failure scenarios

Diagnostics
System state, operating states and error displays after the failure of an IO device:
• Redundant system → RUN-Redundant system state
• Primary CPU → RUN-Redundant operating state
– MAINT LED: → yellow light: The PROFINET ring is open. Singular redundancy
connection available.
– ERROR LED → flashes red: An IO device has failed.
• Backup CPU → RUN-Redundant operating state
– MAINT LED → yellow light: The PROFINET ring is open. Singular redundancy connection
available.
– ERROR LED → flashes red: An IO device has failed.

WARNING
Failure of the redundant system
If the primary CPU fails in addition to the PROFINET cable, the backup CPU switches to the
STOP operating state. You can find more information in the section Failure of the primary
CPU when IO devices have failed in the PROFINET ring (Page 101).

Note
To get detailed diagnostics information, evaluate the diagnostics buffer.

Solution
Replace the defective IO device. You can find additional information on the procedure in the
section Replacing defective I/O devices/switches (Page 300).

S7-1500R/H redundant system

94 System Manual, 05/2021, A5E41814787-AC
 Application planning
4.5 Failure scenarios

4.5.2 Failure of a switch (with line topology) in the PROFINET ring

Introduction
The following failure scenario describes the effects of a defective switch (with line topology)
in the PROFINET ring.

Failure scenario

① Primary CPU
② Backup CPU
③ PROFINET cable (redundancy connections, PROFINET ring)
④ IO device ET 200MP
⑤ IO device ET 200SP
⑥ Switch → failed
⑦ IO device ET 200SP
⑧ HMI device

Figure 4-16 Failure of a switch in the PROFINET ring (using S7-1500R as an example)

S7-1500R/H redundant system

System Manual, 05/2021, A5E41814787-AC 95
Application planning
4.5 Failure scenarios

Sequence of events
1. A switch (with connected line topology) in the PROFINET ring fails.
2. The PROFINET ring is interrupted.
3. If applicable, the redundant system selects an alternative connection to the IO devices ④
and ⑤ over the backup CPU. This allows the redundant system to access all IO devices in the
PROFINET ring again.
4. The failure of the switch has an impact on the process as the IO devices in the line topology
can no longer be accessed.
If the failed inputs and outputs have an important function in the system, their failure can
have a critical impact on the process.

Diagnostics
System state, operating states and error displays after the failure of a switch:
• Redundant system → RUN-Redundant system state
• Primary CPU → RUN-Redundant operating state
– MAINT LED → yellow light: The PROFINET ring is open.
– ERROR LED → flashes red: One or more IO devices have failed.
• Backup CPU → RUN-Redundant operating state
– MAINT LED → yellow light: The PROFINET ring is open.
– ERROR LED → flashes red: One or more IO devices have failed.

WARNING
Failure of the redundant system
If the primary CPU fails in addition to the PROFINET cable, the backup CPU switches to the
STOP operating state. You can find more information in the section Failure of the primary
CPU when IO devices have failed in the PROFINET ring (Page 101).

Note
To get detailed diagnostics information, evaluate the diagnostics buffer.

Solution
Replace the defective switch. You can find additional information on the procedure in the
section Replacing defective I/O devices/switches (Page 300).

S7-1500R/H redundant system

96 System Manual, 05/2021, A5E41814787-AC
 Application planning
4.5 Failure scenarios

4.5.3 Specific failure scenarios with S7-1500R

4.5.3.1 Two cable interruptions in the PROFINET ring in S7-1500R > 1500 ms apart

Introduction
The following failure scenario describes the effects of two cable interruptions in the
PROFINET ring. In this failure scenario, the time between the two cable interruptions
is > 1500 ms.

Failure scenario

① Primary CPU
② Backup CPU
③ PROFINET ring → interrupted at two points
④ IO device ET 200MP
⑤ IO device ET 200SP

Figure 4-17 Two cable interruptions in the PROFINET ring (> 1500 ms apart)

Sequence of events
1. The PROFINET ring is interrupted at one point.
2. The redundant system remains in the RUN-Redundant system state: The primary and backup
CPUs remain in the RUN-Redundant operating state.
3. The PROFINET ring is interrupted at a second point > 1500 ms later.
4. The redundant system switches to the RUN-Solo system state. The primary CPU remains in
the RUN operating state. The backup CPU switches to the STOP operating state.
5. CPU redundancy has failed. The failure has an impact on the process. The RUN-Solo system
state and the cable interruptions mean that not all IO devices in the PROFINET ring can be
accessed.
If the failed inputs and outputs have an important function in the system, their failure can
have a critical impact on the process.

S7-1500R/H redundant system

System Manual, 05/2021, A5E41814787-AC 97
Application planning
4.5 Failure scenarios

Diagnostics
System state, operating states and error displays after the cable interruptions:
• Redundant system → RUN-Solo system state
• Primary CPU → RUN operating state
– MAINT LED → yellow light: The R-system is not in the RUN-Redundant system state. No
partner CPU has been found in the R-system. The PROFINET ring is open.
– ERROR LED → flashes red: One or more IO devices cannot be accessed.
• Backup CPU → STOP operating state
– MAINT LED → yellow light: The R-system is not in the RUN-Redundant system state. No
partner CPU has been found in the R-system. The PROFINET ring is open.

Note
To get detailed diagnostics information, evaluate the diagnostics buffer.

Solution
Replace the defective PROFINET cables. You can find additional information on the procedure
in the section Replacing defective redundancy connections (Page 293).

S7-1500R/H redundant system

98 System Manual, 05/2021, A5E41814787-AC
 Application planning
4.5 Failure scenarios

4.5.3.2 Two cable interruptions in the PROFINET ring in S7-1500R within ≤ 1500 ms

Introduction
The following failure scenario describes the effects of two cable interruptions in the
PROFINET ring. In this failure scenario, the time between the two cable interruptions
is ≤ 1500 ms.

Failure scenario

① Primary CPU
② Backup CPU
③ PROFINET ring → interrupted a 2 locations
④ IO device ET 200MP
⑤ IO device ET 200SP

Figure 4-18 2 cable interruptions in the PROFINET ring (within ≤ 1500 ms)

S7-1500R/H redundant system

System Manual, 05/2021, A5E41814787-AC 99
Application planning
4.5 Failure scenarios

Sequence of events
1. The PROFINET ring is interrupted at 2 points at a time interval of ≤ 1500 ms.
2. The redundant system switches to an undefined system state: The primary CPU remains in
the RUN operating state. The backup CPU becomes the primary CPU and remains in RUN
operating state.
3. The two primary CPUs continue to exchange process data with the accessible IO devices.
4. The redundancy of the system is defective. The redundant system is in an undefined system
state. The undefined system state can lead to dangerous states in the process.

WARNING
Undefined system state of the S7-1500R redundant system at the same time as a
cable interruption in the PROFINET ring at 2 points within ≤ 1500 ms.
Lay the PROFINET cables so that they are securely protected from damage. PROFINET
cables should also always be laid separately from each other. This makes simultaneous
damage to the PROFINET cables (within ≤ 1500 ms) unlikely.

Diagnostics
System state and operating states after cable interruptions:
• Redundant system → System state defective (undefined: Each R-CPU is in the RUN-Solo
system state).
• Primary CPU → RUN operating state
– MAINT LED → yellow light: The R-system is not in the RUN-Redundant system state. No
partner CPU has been found in the R-system. The PROFINET ring is open.
– ERROR LED → flashes red: An IO device has failed.
• Primary CPU (previously backup CPU) → RUN operating state
– MAINT LED → yellow light: The R-system is not in the RUN-Redundant system state. No
partner CPU has been found in the R-system. The PROFINET ring is open.
– ERROR LED → flashes red: An IO device has failed.

Note
To get detailed diagnostics information, evaluate the diagnostics buffer.

Solution
Please note the following solution:

Note
Before you replace the defective PROFINET cables, you must switch both R-CPUs to the STOP
operating state. Only then repair the PROFINET cables in the PROFINET ring. Afterwards,
switch the R-CPUs back to the RUN operating state.

You can find additional information on the procedure in the section Replacing defective
redundancy connections (Page 293).

S7-1500R/H redundant system

100 System Manual, 05/2021, A5E41814787-AC
 Application planning
4.5 Failure scenarios

4.5.3.3 Failure of the primary CPU when IO devices have failed in the PROFINET ring

Introduction
The following failure scenario describes the effects of a defective IO device in the
PROFINET ring and a defective primary CPU.

Failure scenario

① Primary CPU → failed (2nd failure in sequence of events)

② Backup CPU → switches to STOP operating state
③ PROFINET cable (redundancy connections, PROFINET ring)
④ IO device ET 200MP
⑤ IO device ET 200SP → failed (1st failure in sequence)

Figure 4-19 Failure of an IO device in the PROFINET ring and the primary CPU (using S7-1500R as an
example)

S7-1500R/H redundant system

System Manual, 05/2021, A5E41814787-AC 101
Application planning
4.5 Failure scenarios

Sequence of events
1. An IO device in the PROFINET ring fails.
2. As a result, the PROFINET ring is interrupted.
3. The redundant system selects an alternative connection over the backup CPU. This allows
the redundant system to access all remaining IO devices in the PROFINET ring again.
4. The primary CPU also fails.
5. The redundant system does not switch to the backup CPU and switches to the
STOP system state. The role of the backup CPU remains unchanged.

Note
The backup CPU cannot distinguish between the following scenarios:
• It can no longer access the primary CPU because the latter has failed.
• The other redundancy connection has also been interrupted and the primary CPU may
still be running.
That is why the backup CPU does not become the primary CPU. This prevents an
undefined system state.

6. The redundant system has failed. The process is no longer controlled by the redundant
system.

Diagnostics
System state, operating states and error displays after the failure of the IO device in the
PROFINET-Ring and the STOP of Backup CPU:
• Redundant system → STOP system state
• Primary CPU → failed
• Backup CPU → STOP operating state
– MAINT LED → yellow light: The R-system is not in the RUN-Redundant system state. No
partner CPU has been found in the R-system. The PROFINET ring is open.

Note
To get detailed diagnostics information, evaluate the diagnostics buffer.

S7-1500R/H redundant system

102 System Manual, 05/2021, A5E41814787-AC
 Application planning
4.5 Failure scenarios

Solution
Replace the defective IO device and the defective primary CPU. You can find additional
information on the procedure in the sections Replacing defective R/H CPUs (Page 292) and
Replacing defective I/O devices/switches (Page 300).

Note
Proceed as follows if you have ensured that the CPU is still working in the STOP operating
state and can access all important IO devices:
1. Replace the defective IO device.
2. Switch the CPU from STOP operating state to the RUN operating state.
3. Replace the defective CPU. Switch the new CPU to the RUN operating state.

S7-1500R/H redundant system

System Manual, 05/2021, A5E41814787-AC 103
Application planning
4.5 Failure scenarios

4.5.4 Specific failure scenarios with S7-1500H

4.5.4.1 Failure of both redundancy connections in S7-1500H ≤ 55 ms apart

Introduction
The following failure scenario describes the effects of a defect in each of the two redundancy
connections in S7-1500H. In this failure scenario, the time between the redundancy
connection failures is ≤ 55 ms.

Failure scenario

① Primary CPU
② Backup CPU
③ Two fiber-optic cables (redundancy connections) → interrupted
④ IO device ET 200SP
⑤ IO device ET 200MP
⑥ PROFINET cable (PROFINET ring)

Figure 4-20 Failure of both redundancy connections

S7-1500R/H redundant system

104 System Manual, 05/2021, A5E41814787-AC
 Application planning
4.5 Failure scenarios

Sequence of events
1. The two redundancy connections (fiber-optic cables) are interrupted ≤ 55 ms apart.
2. The redundant system switches to an undefined system state: The primary CPU remains in
the RUN operating state. The backup CPU becomes the primary CPU and remains in
RUN operating state.
3. The two primary CPUs continue to exchange process data with the PROFINET devices.
4. The redundancy of the system is defective. The redundant system is in an undefined system
state. The undefined system state can lead to dangerous states in the process.

WARNING
Undefined system state of the S7-1500H redundant system with simultaneous
interruption of the two redundancy connections ≤ 55 ms apart.
Lay the redundancy connections in such a way that the fiber-optic cables are securely
protected from damage. Also make sure when laying the cables that the two redundancy
connections are always separate from each other. This makes simultaneous damage to
the redundancy connections (< 55 ms apart) unlikely.

Diagnostics
System state and operating states after the failure of both redundancy connections:
• Redundant system → System state defective (undefined: Each H-CPU is in the
RUN-Solo system state).
• Primary CPU → RUN operating state
– MAINT LED → yellow light: The H-system is not in the RUN-Redundant system state. No
partner CPU has been found in the H-system.
• Primary CPU (previously backup CPU) → RUN operating state
– MAINT LED → yellow light: The H-system is not in the RUN-Redundant system state. No
partner CPU has been found in the H-system.

Note
To get detailed diagnostics information, evaluate the diagnostics buffer.

Solution
Please note the following solution:

Note
Before you replace the defective redundancy connections, you must switch both H-CPUs to
the STOP operating state. Only then repair the redundancy connections. Switch the H-CPUs
back to the RUN operating state.

You can find additional information on the procedure in the section Replacing defective
redundancy connections (Page 293).

S7-1500R/H redundant system

System Manual, 05/2021, A5E41814787-AC 105
Application planning
4.5 Failure scenarios

4.5.4.2 Failure of one redundancy connection and the primary CPU in S7-1500H

Introduction
The following failure scenario describes the effects of a defect in a redundancy connection
and the primary CPU in S7-1500H. In this failure scenario, the time between the failure of the
redundancy connection failure and of the primary CPU is > 55 ms.

Failure scenario

① Primary CPU → failed (2nd failure in sequence of events)

② Backup CPU
③ One fiber-optic cable (redundancy connection) → interrupted (1st failure in sequence of events)
④ IO device ET 200SP
⑤ IO device ET 200MP
⑥ PROFINET cable (PROFINET ring)

Figure 4-21 Failure of one redundancy connection and the primary CPU

S7-1500R/H redundant system

106 System Manual, 05/2021, A5E41814787-AC
 Application planning
4.5 Failure scenarios

Sequence of events
1. One of the two redundancy connections is interrupted.
2. Availability is restricted. The redundant system will remain in the RUN-Redundant system
state.
3. The primary CPU also fails. Due to the failure, the primary CPU is no longer visible for the
backup CPU.
4. The redundant system does not switch to the backup CPU, but switches to the STOP system
state. The role of the backup CPU remains unchanged.

Note
The backup CPU cannot distinguish between the following scenarios:
• It can no longer access the primary CPU because the latter has failed.
• The other redundancy connection has also been interrupted and the primary CPU may
still be running.
That is why the backup CPU does not become the primary CPU. This prevents an
undefined system state.

5. System redundancy has failed. The process is no longer controlled by the redundant system.

Diagnostics
System state and operating states after the failure of the redundancy connection and primary
CPU:
• Redundant system → STOP system state
• Primary CPU → failed
• Backup CPU → STOP operating state
– MAINT LED → yellow light: The H-system is not in the RUN-Redundant system state. No
partner CPU has been found in the H-system.

Note
To get detailed diagnostics information, evaluate the diagnostics buffer.

Solution
Replace the defective redundancy connection and the primary CPU. You can find additional
information on the procedure in the sections Replacing defective redundancy connections
(Page 293) and Replacing defective R/H CPUs (Page 292).

S7-1500R/H redundant system

System Manual, 05/2021, A5E41814787-AC 107
Application planning
4.5 Failure scenarios

4.5.4.3 Failure of the two PROFINET cables in the PROFINET ring at the primary CPU

Introduction
The following redundancy scenario describes the effects of a defect of both PROFINET cables
in the PROFINET ring at the primary CPU.

Redundancy scenario

① Primary CPU
② Backup CPU
③ Two fiber-optic cables (redundancy connections)
④ IO device ET 200SP
⑤ IO device ET 200MP
⑥ PROFINET cables (PROFINET ring) → interrupted

Figure 4-22 Failure of both PROFINET cables in the PROFINET ring at the primary CPU

Sequence of events
1. Both PROFINET cables in the PROFINET ring at the primary CPU fail. The redundant system
will not execute a primary-backup switchover. The redundant system will remain in the
RUN-Redundant system state.
2. The primary CPU can no longer access the IO devices in the PROFINET ring. The IO devices
will return to the substitute values.
3. The failure of both PROFINET cables affects the process, since the IO devices in the
PROFINET ring can no longer be reached from the primary CPU.

S7-1500R/H redundant system

108 System Manual, 05/2021, A5E41814787-AC
 Application planning
4.5 Failure scenarios

Diagnostics
System state, operating states and error displays after the failure of the PROFINET cables:
• Redundant system → RUN-Redundant system state
• Primary CPU → RUN-Redundant operating state
– MAINT LED → yellow light: The PROFINET ring is open.
– ERROR LED → flashes red: IO devices have failed.
• Backup CPU → RUN-Redundant operating state
– MAINT LED → yellow light: The PROFINET ring is open.
– ERROR LED → flashes red: IO devices have failed.

Note
To get detailed diagnostics information, evaluate the diagnostics buffer.

Solution
Replace the defective PROFINET cables. You can find additional information on the procedure
in the section Replacing defective PROFINET cables (Page 297).

S7-1500R/H redundant system

System Manual, 05/2021, A5E41814787-AC 109
Application planning
4.5 Failure scenarios

4.5.4.4 Failure of the redundant system through safe state of the HF-CPUs

Introduction
The following failure scenario describes the effects of data corruption on the safety program
of the integrated F-functionality (CPU 1518HF-4 PN). There are also IO devices with fail-safe
modules in the PROFINET ring.
You can find more information on data corruption in the safety program in the
SIMATIC Safety – Configuring and Programming
(https://support.industry.siemens.com/cs/ww/de/view/54110126/en) programming and
operating manual.

Failure scenario

① Primary CPU (CPU 1518HF-4 PN) → Data corruption in the safety program due to incorrect pro-
gramming
② Backup CPU (CPU 1518HF-4 PN)
③ Two fiber-optic cables (redundancy connections)
④ IO device ET 200SP
⑤ IO device ET 200MP
⑥ ET 200MP IO device with fail-safe modules
⑦ ET 200SP IO device with fail-safe modules
⑧ PROFINET cables (PROFINET ring)

Figure 4-23 Failure of the redundant system through safe state of the 1518HF-4 PN CPUs

S7-1500R/H redundant system

110 System Manual, 05/2021, A5E41814787-AC
 Application planning
4.5 Failure scenarios

Sequence of events
1. Data corruption in the safety program of the primary CPU occurs due to incorrect
programming (DIV instruction = 0 if enable output ENO is not connected).
2. The error response state switches all fail-safe inputs/outputs to the safe state. The HF-system
then switches to STOP system state.
3. System redundancy has failed. The process is no longer controlled by the redundant system.

Diagnostics
System state, operating states and error displays after failure:
• Redundant system → STOP system state
• Primary CPU → STOP operating state
– MAINT LED → yellow light: The H-system is not in the RUN-Redundant system state
• Backup CPU → STOP operating state
– MAINT LED → yellow light: The H-system is not in the RUN-Redundant system state

Note
To get detailed diagnostics information, evaluate the diagnostics buffer.

Solution
Check the user program (e.g. for write access to the F-data from the standard user program).

S7-1500R/H redundant system

System Manual, 05/2021, A5E41814787-AC 111
Application planning
4.6 Hardware configuration

4.6 Hardware configuration

Modules suitable for R/H-CPUs

The integrated system power supply of the R/H-CPU supplies the required power for
operation. Optionally, you can also use a load current supply.
The table below shows which modules can be used in the various R/H-CPU slots:

Table 4- 5 Maximum configuration

Module type Maximum number of Maximum number of mod-

modules, primary CPU ules, backup CPU (mount-
(mounting rail) ing rail)
Load current supply (PM) 1) Unlimited Unlimited
CPU 1 1
1) No connection to the backplane bus.

① Optional load current supply and first R/H-CPU

② Optional load current supply and second R/H-CPU

Figure 4-24 Assignment of slot numbers

S7-1500R/H redundant system

112 System Manual, 05/2021, A5E41814787-AC
 Application planning
4.7 Using HMI devices

Maximum number of PROFINET devices in the redundant system

The table below shows the maximum number of PROFINET devices in the redundant system.
The maximum number includes switches, S7-1500R/H CPUs, S7-1500 CPUs (V2.5 or later) and
HMI devices. It does not include media converters.

Table 4- 6 Number of PROFINET devices in the redundant system

PROFINET devices Maximum number, S7-1500R Maximum number, S7-1500H

In the PROFINET ring 50 (Recommendation 16) 1) 50
In the PROFINET ring and separated 66 258
with switches (line)
1) Recommendation: The number of devices in the PROFINET ring affects the availability of the
S7-1500R system. The number of PROFINET devices including R-CPUs in the PROFINET ring should
not exceed 16. If you operate significantly more devices in the PROFINET ring, the availability of the
IO devices and R-CPUs is reduced.
The technical specifications in the documentation are based on the recommended maximum of
16 PROFINET devices in the ring in S7-1500R.

4.7 Using HMI devices

Introduction
You can use the same HMI devices for the S7-1500R/H redundant system as for the
S7-1500 automation system.
If you use HMI devices in the PROFINET ring with S7-1500R, those HMI devices must support
media redundancy. The H-Sync forwarding function is also recommended.
If you use HMI devices in the PROFINET ring with S7-1500H, those HMI devices must support
media redundancy.
You transfer the HMI configuration to your HMI device using the configuration and
programming software (Engineering Station).
You can connect the HMI device to the redundant system with the system IP address.
Connection to the redundant system is possible within and outside the PROFINET ring. The
HMI device always communicates with the primary CPU over the system IP address in the
RUN-Redundant, RUN-Solo and STOP system states, provided you have activated the system
IP address and selected it in the connection configuration for the HMI device.
If the role of primary CPU switches to the other CPU, the communication relationship of the
HMI device also switches to the other (primary) CPU.
As an alternative to the system IP address, you can also use a device IP address to connect the
HMI device to an R/H-CPU. The HMI device then only communicates with the connected CPU.
When exchanging data via device proxy data, make sure that the IP addresses and system
IP addresses are correctly assigned to the PROFINET interfaces. You can find additional
information on devices proxy data in the STEP 7 online help.

S7-1500R/H redundant system

System Manual, 05/2021, A5E41814787-AC 113
Application planning
4.7 Using HMI devices

Connecting HMI devices over Industrial Ethernet and the PROFINET ring based on the example of
CPU 1518HF-4 PN/CPU 1517H-3 PN/CPU 1515R-2 PN
The figure below is an example of how you can connect the CPU 1518HF-4 PN to an
HMI device over Industrial Ethernet and the PROFINET ring. Connect the HMI devices in the
same way for the CPU 1517H-3 PN/CPU 1515R-2 PN.

Figure 4-25 Assembly example CPU 1518HF-4 PN: Connecting HMI devices over Industrial Ethernet
and the PROFINET ring

S7-1500R/H redundant system

114 System Manual, 05/2021, A5E41814787-AC
 Application planning
4.7 Using HMI devices

The CPUs 1517H-3 PN/CPU 1515R-2 PN has a PROFINET IO interface with 2 ports
(X1 P1 R, X1 P2 R) and a PROFINET interface with a port (X2 P1). The CPU 1518HF-4 PN has
an additional PROFINET interface with one port (X3 P1).
To connect an HMI device to the CPUs over Industrial Ethernet, you use the
X2/X3 PROFINET interfaces of the CPU. PROFINET interface X2/X3 supports PROFINET basic
functionality. The interface, for example, is suitable for communication with an HMI device or
configuration and programming software (Engineering Station).

Note
A PROFINET device (such as an HMI device) can only communicate with the redundant
system over the system IP address if it has been connected to both R/H-CPUs. Always connect
the PROFINET device to the same interfaces, X1 or X2/X3, on both R/H-CPUs. Do not mix
interfaces X1 and X2/X3: If you mix interfaces X1 and X2/X3, the HMI connection is no longer
redundant.

Integrate a switch into the PROFINET ring to connect an HMI device to the PROFINET ring. Use
this to establish a connection to the HMI device.
The PROFINET ring is set up using the PROFINET IO interfaces (X1) of the CPUs. If you operate
HMI devices within the ring, you need to assign the MRP role "Client" to the MRP domain. You
can find more information on HMI device application planning in the section Requirements
(Page 69).
You can find more information on the interfaces of the
CPUs 1518HF-4 PN/1517H-3 PN/1515R-2 PN in the relevant equipment manual.

S7-1500R/H redundant system

System Manual, 05/2021, A5E41814787-AC 115
Application planning
4.7 Using HMI devices

Connecting HMI devices over Industrial Ethernet, example with CPU 1513R-1 PN
The figure below shows how to connect an HMI device over Industrial Ethernet with the
CPU 1513R-1 PN.

Figure 4-26 Configuration example CPU 1513R-1 PN: Connecting the HMI device via a switch

CPU 1513R-1 PN has a PROFINET IO interface with 2 ports (X1 P1 R and X1 P2 R).
To connect an HMI device to the CPUs over Industrial Ethernet, you set up the PROFINET ring
over PROFINET interface X1. Integrate a switch into the PROFINET ring. Use this to establish
an Industrial Ethernet connection.
You can find additional information on the interfaces of CPU 1513R-1 PN in the relevant
device manual.

Reference
You can find more information on the system IP address in the section Configuration process
(Page 161) and in the Communication
(https://support.industry.siemens.com/cs/ww/de/view/59192925/en) function manual.
More information on how to set up an HMI connection to the S7-1500R/H redundant system
is available in the Communication
(https://support.industry.siemens.com/cs/ww/de/view/59192925/en) function manual.
See the following entry (https://support.industry.siemens.com/cs/ww/en/view/109781687)
for an example of how to connect an HMI-HMI device with S7-1500R/H.

S7-1500R/H redundant system

116 System Manual, 05/2021, A5E41814787-AC
Installation 5
5.1 Basics

Installation site
All modules of the S7-1500R/H redundant system are unenclosed equipment. You may only
install unenclosed equipment in housings, cabinets or electrical operating rooms indoors. The
housings, cabinets and electrical operating rooms must guarantee protection against electric
shock and spread of fire. The requirements for mechanical strength must also be met. The
housings, cabinets, and electrical operating rooms must not be accessible without a key or
tool. Personnel must be trained or approved for access.

Installation position
The S7-1500R/H redundant system is designed for use in the following mounting positions:
• Horizontal mounting position up to 60 °C
• Vertical mounting position up to 40 °C
Additional information can be found in the section Mechanical and climatic environmental
conditions.

Mounting rail
You can mount the following components on the mounting rails alongside the
S7-1500R/H CPUs, load current supplies:
• Terminals
• Circuit breakers
• Small contactors
• Similar components
These components can influence the installation dimensions for the cable duct.
Modules can be mounted right to the outer edge of the mounting rail.
The mounting rails are available in various lengths. You order the mounting rails using the
online catalog or the online ordering system. The available lengths and article numbers can
be found in the appendix Accessories/spare parts (Page 341).

S7-1500R/H redundant system

System Manual, 05/2021, A5E41814787-AC 117
Installation
5.1 Basics

Minimum clearances
Modules can be mounted right to the outer edge of the mounting rail. Maintain the following
minimum clearances when installing or dismantling the S7-1500R/H redundant system.

① Upper edge of the mounting rail

Figure 5-1 Minimum clearances in the control cabinet

Installation rules
The redundant system configuration consists of:
R/H-CPU and an optional load current supply.

WARNING
Protection from conductive contamination
Protect the devices from conductive contamination, taking into account the ambient
conditions.
Protection from conductive contamination can, for example, be achieved by installing the
devices in a control cabinet with the appropriate degree of protection.

S7-1500R/H redundant system

118 System Manual, 05/2021, A5E41814787-AC
 Installation
5.2 Installing the mounting rail

5.2 Installing the mounting rail

Introduction
The R/H-CPUs should be mounted either on one mounting rail or on two separate mounting
rails.

Lengths and drill holes

The mounting rails are delivered in six lengths:
• 160 mm
• 245 mm
• 482.6 mm (19 inches)
• 530 mm
• 830 mm
• 2000 mm
You can find the article numbers in the appendix Accessories/spare parts (Page 341).
The mounting rails (from 160 to 830 mm) come with two drill holes for fixing screws. A set of
screws for grounding the mounting rail is provided.
The 2000 mm mounting rail is designed for assemblies with special lengths and does not
have holes for fixing screws. No set of screws for grounding is included with the mounting
rail (can be ordered as accessories/spare parts (Page 341)).
The specifications of the maximum offsets between two drill holes can be found in the table,
"Dimensions for the drill holes".

Tools required
• Commercially available hacksaw
• Drill ∅ 6.5 mm
• Screwdriver
• Size 10 adjustable screw-wrench or socket wrench for grounding cable connection
• Adjustable screw-wrench, matching the selected fixing screws
• Stripping tool and crimp tool for the grounding cable

S7-1500R/H redundant system

System Manual, 05/2021, A5E41814787-AC 119
Installation
5.2 Installing the mounting rail

Accessories required
Use the following screw types for fastening the mounting rails:

Table 5- 1 Accessories required

For ... use ... Explanation

• Outer fixing screws M6 fillister head screws according to Choose a suitable screw length for your
ISO 1207/ISO 1580 (DIN 84/DIN 85) assembly.
• Additional fixing screws (for mount-
M6 hexagon head screws according to You also need washers for cylinder
ing rails > 482.6 mm) ISO 4017 (DIN 4017) head screws with an internal diameter
of 6.4 mm and an external diameter of
11 mm in accordance with
ISO 7092 (DIN 433).

Dimensions for the drill holes

Table 5- 2 Dimensions for the drill holes

"Standard" mounting rails "Longer" mounting rails

Length of the mounting Distance a Distance b

rail
160 mm 10 mm 140 mm
245 mm 10 mm 225 mm
482.6 mm 8.3 mm 466 mm
530 mm 15 mm 500 mm
830 mm 15 mm 800 mm

Additional fixing screws (for mounting rails > 530 mm)

For profile rails > 530 mm, we recommend using additional fixing screws at intervals of
>482.6 mm on the identification groove.

S7-1500R/H redundant system

120 System Manual, 05/2021, A5E41814787-AC
 Installation
5.2 Installing the mounting rail

Preparing the 2000 mm mounting rail for installation

Proceed as follows to prepare the 2000 mm mounting rail for installation:
1. Cut the 2000 mm mounting rail to the required length.
2. Mark the holes. The necessary dimensions can be found in the table "Dimensions for the drill
holes":
– Two drill holes at the beginning and end of the mounting rail
– Additional drill holes at equal intervals of 500 mm maximum, along the identification
groove
3. Drill the marked holes according to the selected type of fastening.
4. Ensure that there are no burrs or shavings on the mounting rail.

Note
To ensure secure installation of the modules, make sure that the drill holes are centered in
the identification groove. Only use the maximum size of screws.

① Identification groove for additional drill holes

② Additional drill hole
Figure 5-2 Preparing the 2000 mm mounting rail for installation

Installing the mounting rail

Install the mounting rails for the R/H-CPUs so that there is still sufficient space for installation
and heat dissipation. Please study the figure Minimum clearances in the control cabinet
(Page 118).
Screw the rail onto the mounting surface.

S7-1500R/H redundant system

System Manual, 05/2021, A5E41814787-AC 121
Installation
5.2 Installing the mounting rail

Attaching the protective conductor

The mounting rails of the S7-1500R/H redundant system must be connected to the protective
conductor system of the electrical system to ensure electrical safety.
Proceed as follows to connect the protective conductor:
1. Strip the grounding conductor with a minimum diameter of 10 mm2. Attach a ring terminal
for M6 bolts with the crimping pliers.
2. Slide the enclosed bolt into the T profile groove.
3. Insert the spacer, ring terminal with the grounding connector, flat washer, and lock washer
onto the bolt (in that order). Thread on the hexagon nut. Fasten the components in place
with the nut (torque 4 Nm).
4. Connect the opposite end of the grounding cable to the central grounding point/protective
conductor busbar (PE).
5. If you mount the redundant system on separate mounting rails, repeat steps 1 to 4 for the
second mounting rail.

Figure 5-3 Attaching the protective conductor (protective earth)

Note
Alternative grounding of the mounting rails
Grounding with the grounding screw is not required if the following requirements are met:
The mounting rails must be permanently connected to the protective conductor system using
an equivalent fitting that complies with the applicable standards, for example by permanent
attachment to a grounded control cabinet wall.

Reference
You can find more information on the exact dimensions of the mounting rails in the appendix
Dimension drawings (Page 338).

S7-1500R/H redundant system

122 System Manual, 05/2021, A5E41814787-AC
 Installation
5.3 Installing the standard rail adapter

5.3 Installing the standard rail adapter

Introduction
Use the standard rail adapter to mount the redundant SIMATIC S7-1500R/H-system on the
standardized 35 mm rails.
You order the DIN rail adapter as separate accessories.

Note
Note the following reduced technical specifications regarding mechanical load when
you install the S7-1500R/H modules on the 35 mm standard mounting rail using the
standard mounting rail adapter:
Vibration test acc. to IEC 60068-2-6 (sinusoidal)
• 5 Hz ≤ f ≤ 8.4 Hz, constant amplitude 3.5 mm
• 8.4 Hz ≤ f ≤ 150 Hz, constant acceleration 1 g
Duration of vibration: 10 frequency sweeps per axis in each of three perpendicular axes
Shock, tested according to IEC 60068-2-27
• Type of shock: Half-sine
• Shock intensity: 150 m/s2 peak value, 11 ms duration
• Direction of shock: 3 shocks each in +/- direction, along each of the 3 perpendicular axes

Article No.
6ES7590-6AA00-0AA0
The scope of delivery consists of ten adapters, ten hexagon socket-head screws and ten
washers.

S7-1500R/H redundant system

System Manual, 05/2021, A5E41814787-AC 123
Installation
5.3 Installing the standard rail adapter

View
The DIN rail adapter consists of a clamp, an adapter frame and a hexagon socket-head screw
with washer.

① Clamp
② Adapter frame
③ Hexagon socket-head screw
④ Washer

Figure 5-4 Parts of the DIN rail adapter

S7-1500R/H redundant system

124 System Manual, 05/2021, A5E41814787-AC
 Installation
5.3 Installing the standard rail adapter

Dimensional drawing

① Position of the adapter frame during mounting to the standard DIN rail 35 mm x 7.5 mm
② Position of the adapter frame during mounting to the standard DIN rail 35 mm x 15 mm
Figure 5-5 Dimensional drawing

S7-1500R/H redundant system

System Manual, 05/2021, A5E41814787-AC 125
Installation
5.3 Installing the standard rail adapter

Tools required
Wrench matching the hexagon socket head cap screw M6 according to
EN ISO 4762 (DIN 912).

Properties
● The standard rail adapter makes it possible to mount the S7-1500R/H mounting rail to the
standardized 35 mm standard rails.
● The DIN rail adapter allows for the use of prefabricated control cabinet and terminal box
systems.
● The total length of the S7-1500R/H mounting rail can be used again completely as before.
● To ensure optimal stability, the clearance between the two DIN rail adapters must be no
more than 250 mm or less.

Figure 5-6 Distance between two DIN rail adapters

Note
Note that, depending on the mounting rail width, the mounting rail adapter can protrude up
to 4 mm on each side due to the drill holes.
You can find an overview of the protrusion dimensions for the various DIN rails in the table
below.

S7-1500R/H redundant system

126 System Manual, 05/2021, A5E41814787-AC
 Installation
5.3 Installing the standard rail adapter

Table 5- 3 Additional lateral space required

Mounting rail Article No. Additional space required with

adapter
• 160.0 mm (with drill holes) 6ES7590-1AB60-0AA0 4 mm

• 245.0 mm (with drill holes) 6ES7590-1AC40-0AA0 4 mm

• 482.6 mm (with drill holes) 6ES7590-1AE80-0AA0 8 mm

• 530.0 mm 6ES7590-1AF30-0AA0 0 mm

• 830.0 mm (with drill holes) 6ES7590-1AJ30-0AA0 0 mm

Figure 5-7 DIN rail adapter protrusion

S7-1500R/H redundant system

System Manual, 05/2021, A5E41814787-AC 127
Installation
5.3 Installing the standard rail adapter

Procedure

Mounting on the standard DIN rail 35 mm x 7.5 mm

To install DIN rail adapter on the standard DIN rail 35 mm x 7.5 mm, follow these steps:
1. Set the clamp onto the standard DIN rail.
2. The shorter transverse edge of the adapter frame points towards the cabinet or box wall (2).
3. Place the S7-1500R/H mounting rail on the adapter frame so that the groove in the
S7-1500R/H mounting rail covers the groove in the adapter frame.
Place the S7-1500R/H mounting rail with the adapter frame onto the clamp (4).
4. Use screws to fasten the S7-1500R/H mounting rail to the standard rail adapter and the
standard mounting rail (tightening torque 5 Nm to 6 Nm).

Figure 5-8 Mounting sequence of the DIN rail adapter to the DIN rail 35 mm x 7.5 mm or 35 mm x 15 mm

S7-1500R/H redundant system

128 System Manual, 05/2021, A5E41814787-AC
 Installation
5.4 Installing a load current supply

Mounting to the standard DIN rail 35 mm x 15 mm

To install DIN rail adapter on the standard DIN rail 35 mm x 15 mm, follow these steps:
1. Set the clamp onto the standard DIN rail.
2. The longer transverse edge of the adapter frame points toward the cabinet or box wall (3).
3. Place the S7-1500R/H mounting rail on the adapter frame so that the groove in the
S7-1500R/H mounting rail fits into the groove in the adapter frame.
Place the S7-1500R/H mounting rail with the adapter frame onto the clamp (4).
4. Use screws to fasten the S7-1500R/H mounting rail to the standard rail adapter and the
standard mounting rail (tightening torque 5 Nm to 6 Nm).

5.4 Installing a load current supply

Introduction
Load current supplies do not have a connection to the backplane bus of the S7-1500R/H
redundant system and do not occupy a slot on the backplane bus.

Requirements
The mounting rail is installed.

Tools required
Slotted-head screwdriver with 4.5 mm blade

S7-1500R/H redundant system

System Manual, 05/2021, A5E41814787-AC 129
Installation
5.4 Installing a load current supply

Installing a load current supply

Watch the video sequence (https://support.industry.siemens.com/cs/ww/en/view/78027451)
To install a load current supply, follow these steps:
1. Hook the load current supply on the mounting rail.
2. Swivel the load current supply to the rear.

Figure 5-9 Installing a load current supply

3. Open the front cover.

4. Disconnect the power cable connector from the load current supply.
5. Screw the load current supply tight (torque 1.5 Nm).
6. Insert the already wired-up power cable connector into the load current supply.
For a description on how to wire the power cable connector, refer to the section Connecting
load current supply (Page 144).

Note
Load current supplies can only be mounted on the left or right side outside the S7-1500R/H
redundant system. If you mount a load current supply on the right of the configured setup,
the heat development of the load current supply may make a gap to the configured setup
necessary. For additional information, refer to the relevant manuals. The number of load
current supplies that can be used is unlimited.

S7-1500R/H redundant system

130 System Manual, 05/2021, A5E41814787-AC
 Installation
5.4 Installing a load current supply

Uninstalling the load current supply

The load current supply is wired up.
To uninstall a load current supply, follow these steps:
1. Open the front cover.
2. Shut down the load current supply.
3. Turn off the supply voltage.
4. Disconnect the power cable connector, and remove the connector from the load current
supply.
5. Unscrew the fixing screw.
6. Swivel the load current supply out of the mounting rail.

Reference
Additional information can be found in the manuals for the load current supplies.

S7-1500R/H redundant system

System Manual, 05/2021, A5E41814787-AC 131
Installation
5.5 Installing R/H-CPUs

5.5 Installing R/H-CPUs

Introduction
CPUs in the S7-1500R/H redundant system are installed in exactly the same way as CPUs in
the S7-1500 automation system.

Requirements
The mounting rail is installed.

Note
Protective film
Please note that the R/H-CPUs come with a removable protective film on the display.

Tools required
Slotted-head screwdriver with 4.5 mm blade

Installing R/H-CPUs
Watch the video sequence (https://support.industry.siemens.com/cs/ww/en/view/78027451)
Proceed as follows to install an R/H-CPU:
1. Install the CPU to the mounting rail.
Only with optional load current supply: Move the CPU to the load current supply on the left.

2. Swivel the CPU in to the rear.

3. Screw the CPU tight (torque 1.5 Nm).

S7-1500R/H redundant system

132 System Manual, 05/2021, A5E41814787-AC
 Installation
5.5 Installing R/H-CPUs

Uninstalling R/H-CPU
The R/H-CPU is wired.
Proceed as follows to uninstall an R/H-CPU:
1. Open the front cover.
2. Switch the CPU into STOP mode.
3. Turn off the supply voltage.
4. Pull off the connector for the supply voltage.
5. Disconnect the cables at the CPU:
– R-CPU: Disconnect the PROFINET cables.
– H-CPU: Disconnect the PROFINET cables and fiber-optic cables.
6. Undo the CPU fixing screw(s).
7. Pivot the CPU out of the mounting rail.

Device damage caused by electrical fields or electrostatic discharge

Electrostatic sensitive devices (ESD) are individual components, integrated circuits, modules
or devices that can be damaged by electrostatic fields or electrostatic discharge.

NOTICE
Device damage caused by electrical fields or electrostatic discharge
Electrical fields or electrostatic discharge can cause function failures that result from
damaged individual components, integrated circuits, modules or devices.
• Pack, store, transport and send electronic components, modules or devices only in the
original product packaging or in other suitable materials, e.g. conducting foam rubber or
aluminum foil.
• Only touch components, modules and devices when you have grounded yourself with
one of the following measures:
– Wear an ESD wrist strap
– Wear ESD shoes or ESD grounding strips in ESD areas with a conducting floor
• Place electronic components, modules and devices only on conducting surfaces (table
with ESD coating, conducting ESD plastic foam, ESD packing bag, ESD transport
container).

S7-1500R/H redundant system

System Manual, 05/2021, A5E41814787-AC 133
Wiring 6
6.1 Rules and regulations for operation

Introduction
The S7-1500R/H redundant system is a plant and system component. Special rules and
regulations must be adhered to in line with the area of application.
This section gives an overview of the key rules for integration of the redundant system into a
plant or system. Please follow these rules when connecting the S7-1500R/H redundant
system.

Specific application
Observe the safety and accident prevention regulations that are applicable to specific
applications (for example Machinery Directive).

EMERGENCY-STOP devices
EMERGENCY OFF equipment to IEC 60204 (corresponds to DIN VDE 0113) must remain
effective in all operating modes of the plant or system.

Excluding hazardous plant states

Hazardous operating states must not occur when
• The plant restarts after a voltage dip or power failure.
• Bus communication is reestablished following a fault.
• An undefined system state occurs in the S7-1500R/H. Example: Failure of both redundancy
connections ≤ 1500 ms apart (R-system) or ≤ 55 ms apart (H-system).
If a hazardous operating state occurs, force an EMERGENCY STOP.
An uncontrolled or undefined redundant system startup must not occur after the
EMERGENCY STOP device is unlocked.

External fuses/switches
Install the external fuses/switches in the proximity of the R/H-CPUs.

S7-1500R/H redundant system

System Manual, 05/2021, A5E41814787-AC 134
 Wiring
6.1 Rules and regulations for operation

Line voltage
The points to note for line voltage are set out below:
• For fixed plants or systems without multipole circuit breaker, a mains disconnection
device (multipole) must be available in the building installation.
• For the load current supply, the configured rated voltage range must correspond to the
local line voltage.
• For all power circuits of the S7-1500R/H redundant system, the fluctuation/deviation of
the line voltage from the rated value must be within the permitted tolerance.
You can find more information in the section Specifications for insulation tests, protection
class, degree of protection, and rated voltage (Page 336).

24 V DC supply
The points to note for a 24 V DC supply are set out below:
• Power supply units for the 24 V DC supply (SELV/PELV) must supply safety extra low
voltage in accordance with IEC 61131-2 or IEC 61010-2-201.
• To protect the S7-1500R/H redundant system from lightning and overvoltages, use
overvoltage arresters.
Suitable components for the lightning and overvoltage protection are specified in the
Defining interference-free controllers
(https://support.industry.siemens.com/cs/ww/en/view/59193566) function manual.

Requirements for power supplies in the event of voltage interruption

Note
To ensure adherence to IEC 61131-2, only use power packs/power supply units
(e.g. 230/400 V AC → 24 V DC) with a mains buffering time of at least 10 ms. Observe the
relevant requirements in your application (e.g. product standard for "burners" 30 ms
according to EN 298 or 20 ms according to NAMUR recommendation NE 21) with respect to
possible voltage interruptions. The latest up-to-date information on PS components is
available on the Internet (https://mall.industry.siemens.com).
Of course, these requirements also apply to power packs/power supply units not constructed
using S7-1500 or ET 200SP/S7-300-/S7-400 technology.

Protection against electrical shock

The mounting rails of the S7-1500R/H redundant system must be connected conductively to
the protective conductor to protect against electric shock.
You may only use conductors in the colors yellow-green for connections to protective
conductor connections.

S7-1500R/H redundant system

System Manual, 05/2021, A5E41814787-AC 135
Wiring
6.1 Rules and regulations for operation

Protection against external electrical influences

The following describes what you must pay attention to in terms of protection against
electrical influences and/or faults:
• The system for discharging electromagnetic interference must be connected to a
protective conductor with a sufficient cross-section for all plants with an S7-1500R/H
redundant system.
• You must ensure that all supply, signal and bus cables are correctly laid and installed.
• For signal and bus lines, a cable break, wire break or a cross-circuit must not lead to
undefined states in the plant or system.

Protection of redundancy connections against unauthorized access

Protect the redundant connections in a redundant S7-1500H system so that the
fiber-optic cables are protected against unauthorized access, e.g. by spatial access protection.

Reference
Additional information can be found in the function manual, Designing interference-free
controllers (https://support.industry.siemens.com/cs/ww/en/view/59193566).

S7-1500R/H redundant system

136 System Manual, 05/2021, A5E41814787-AC
 Wiring
6.2 Operation on grounded infeed

6.2 Operation on grounded infeed

Introduction
Information is provided below on the overall configuration of an S7-1500R/H redundant
system on a grounded incoming supply (TN-S network). The specific subjects discussed are:
• Shut-off devices, short circuit and overload protection in accordance with
– IEC 60364, corresponds to DIN VDE 0100
– IEC 60204, corresponds to DIN VDE 0113
• Load current supplies and load circuits

Grounded infeed
In the case of grounding incoming supplies (TN-S system) the neutral conductor (N) and the
protective conductor (PE) are each grounded. Both wires form a part of the overvoltage
concept. When a plant is in operation, the current flows across the neutral conductor. When a
fault occurs, for example a single ground fault between a live conductor and ground, the
current flows through the protective conductor.

Safe electrical isolation (SELV in accordance with IEC 61131-2 or IEC 61010-2-201)
Load current supplies with 24 V DC output voltage require safe electrical separation and
voltage limiting (extra low voltage). Load current supplies with a 24 V DC output voltage are
not connected to the protective conductor.
In accordance with IEC 61131-2 / IEC 61010-2-201, this protection is referred to as SELV
(Safety Extra Low Voltage).
The wiring of SELV circuits must be safely separated from the wiring of other circuits that are
not SELV, or the insulation of all conductors must be dimensioned for the higher voltage.

Protective extra-low voltage (PELV in accordance with IEC 61131-2 or IEC 61010-2-201)
Load current supplies with grounded 24 V DC output voltage require a safe connection to the
protective conductor and voltage limiting (extra low voltage).
In accordance with IEC 61131-2 / IEC 61010-2-201, this protection is referred to as PELV
(Protective Extra Low Voltage).
Either the wiring of PELV circuits must be safely isolated from the wiring of other circuits that
are not PELV, or the insulation of all wires must be dimensioned for the higher voltage.

S7-1500R/H redundant system

System Manual, 05/2021, A5E41814787-AC 137
Wiring
6.2 Operation on grounded infeed

Reference potential of the controller

The reference potential of the S7-1500R/H redundant system is connected to the mounting
rail over a high-resistance RC combination in the R/H-CPU. This connection conducts
high-frequency interference currents and prevents electrostatic charges. Despite the
grounded mounting rail, the reference potential of the S7-1500R/H redundant system has to
be considered as ungrounded due to the high-resistance connection.
If you want to configure the S7-1500R/H redundant system with a grounded reference
potential, establish an electrical connection between the M connection of the CPU and the
protective conductor.
You can find a simplified representation of the potentials in the section Electrical
configuration (Page 140).

Short-circuit and overload protection

Various measures as protection against short-circuits and overloads are required for setting
up a full installation. The nature of the components and the degree to which the required
measures are binding depends on the IEC (DIN VDE) regulation applicable to your plant
configuration. The table refers to the following figure and compares the IEC (DIN VDE)
regulations.

Table 6- 1 Components and required measures

Reference to follow- IEC 60364 IEC 60204

ing figure (DIN VDE 0100) (DIN VDE 0113)
Shut-off device for control system, sen- ① Main switch Disconnector
sors, and actuators
Short-circuit and overload protection: ② Single-pole protection of • With grounded sec-
In groups for sensors and actuators circuits
ondary circuit: Single-
pole protection
• Otherwise: All-pole
protection

S7-1500R/H redundant system

138 System Manual, 05/2021, A5E41814787-AC
 Wiring
6.2 Operation on grounded infeed

Overall configuration of S7-1500R/H

The figure below shows the overall configuration of the S7-1500R/H redundant system (load
current supply and grounding concept) with supply from a TN-S network.

① Main switch
② Short-circuit and overload protection
Figure 6-1 Operating the S7-1500R/H with grounded reference potential

Note
If you connect the S7-1500R/H redundant system via upstream local power supplies to your
own distribution (or batteries), then you do not have to provide any additional protective
measures against overvoltage.

S7-1500R/H redundant system

System Manual, 05/2021, A5E41814787-AC 139
Wiring
6.3 Electrical configuration

6.3 Electrical configuration

Galvanic isolation
In the redundant System S7-1500R/H, there is electrical isolation between:
• The communication interfaces (PROFINET) of the R-CPU and all other circuit components
• The communication interfaces (PROFINET) of the H-CPU and all other circuit components
High-frequency interference currents are conducted and electrostatic charges are avoided
through integrated RC combinations or integrated capacitors.

S7-1500R/H potentials
The figure below is a simplified diagram of potentials in the S7-1500R/H redundant system.

Figure 6-2 Potentials in S7-1500R/H using the example of CPU 1515R-2 PN

S7-1500R/H redundant system

140 System Manual, 05/2021, A5E41814787-AC
 Wiring
6.4 Wiring rules

6.4 Wiring rules

Introduction
Use suitable cables to connect the S7-1500R/H redundant system. The tables below set out
the wiring rules for the R/H-CPUs and load current supply.

R/H CPUs and load current supply

Table 6- 2 Wiring rules for R/H-CPUs and load current supply

Wiring rules for ... R/H-CPU Load current supply

Permitted cable cross-sections of solid cables (Cu) - -
- -
Permitted cable cross- Without wire-end fer- 0.25 to 2.5 mm2 0.5 to 2.5 mm2
sections of flexible cables rule AWG1): 24 to 14 AWG1): 20 to 14
(Cu)
With end sleeve 0.25 to 1.5 mm2 0.5 to 1.5 mm2
AWG1): 24 to 16 AWG1): 20 to 16
Number of wires per connection 1 1
Stripped length of the wires 10 to 11 mm 7 to 8 mm
End sleeves according to Without plastic sleeve Design A, 10 mm long Design A, 7 mm long
DIN 46228 With plastic sleeve Design E, 10 mm long Design A, 7 mm long
0.25 to 1.5 mm2
Sheath diameter - 8.5 mm
Tool 3 to 3.5 mm screwdriver, conic 3 to 3.5 mm screwdriver, conic
design design
Connection system Push-in terminal Screw terminal
Tightening torque - From 0.5 Nm to 0.6 Nm
1) American Wire Gauge

Permissible cable temperature

Note
Permissible cable temperatures
You must select sufficiently large wire cross-sections to ensure that the permissible cable
temperatures are not exceeded at the maximum ambient temperature of the redundant
system S7-1500R/H.
Example of power supply
At an ambient temperature of 40° C, a current of, for example, 4 A per wire and a cross-
section of 1.5 mm² Cu, a connecting conductor must be rated for a temperature range of at
least 70° C.

S7-1500R/H redundant system

System Manual, 05/2021, A5E41814787-AC 141
Wiring
6.5 Connecting the supply voltage

6.5 Connecting the supply voltage

Introduction
The supply voltage is supplied over a 4-pin connector at the front of the R/H-CPU (behind the
front flap, below).

Connection for supply voltage (X80)

The connections of the 4-pole connector have the following meaning:

① +24 V DC of the supply voltage (current limited to 10 A)

② Ground of the supply voltage (current limited to 10 A)
③ Ground of the supply voltage for loop-through
④ +24 V DC of the supply voltage for loop-through
⑤ Spring opener (one spring opener per terminal)

Figure 6-3 Connection for supply voltage

The cable connector enables you to loop the supply voltage uninterrupted, even when it is
unplugged.

Requirements
• Only wire the cable connector when the supply voltage is turned off.
• Follow the wiring rules (Page 141).

Tool-free connection of cables: multi-wire (stranded), with end sleeve or ultrasonic compressed
To connect a wire without tools, follow these steps:
1. Strip 8 to 11 mm of the wires.
2. Seal or crimp the wire with end sleeves.
3. Insert the cable into the push-in terminal as far as it will go.
4. Push the wired connector into the socket of the CPU.

Tools required
3 to 3.5 mm slotted-head screwdriver

S7-1500R/H redundant system

142 System Manual, 05/2021, A5E41814787-AC
 Wiring
6.5 Connecting the supply voltage

Connection of wires: multi-wire (stranded), without end sleeve, unprocessed

To connect a wire without end sleeve, follow these steps:
1. Strip 8 to 11 mm of the wires.
2. Press the screwdriver into the spring release. Insert the cable into the push-in terminal as far
as it will go.
3. Pull the screwdriver out of the spring release.
4. Push the wired connector into the socket of the CPU.

Loosening a wire
To unplug a wire, follow these steps:
1. Push with the screwdriver as far as it will go into the spring release.
2. Remove the wire from the push-in terminal.

Uninstalling the connection plug

With the screwdriver, pry the connector out of the CPU.

S7-1500R/H redundant system

System Manual, 05/2021, A5E41814787-AC 143
Wiring
6.6 Connecting the load current supply

6.6 Connecting the load current supply

Introduction
In the delivery condition of the load current supplies, power connectors are inserted. The
modules and the associated power connectors are coded. There are two parts to the coding
element. One coding element is located in the module, and the other in the power
connector. The load current supplies use identical power connectors for the voltage
connection.
The coding element prevents the insertion of a power connector into a different type of load
current supply.

Tools required
3 to 3.5 mm screwdriver

Connecting the supply voltage to a load current supply

Watch the video sequence (https://support.industry.siemens.com/cs/ww/en/view/78027451)
To connect the supply voltage, follow these steps:
1. Swing the front cover of the module up until the front cover latches.
2. Press down the unlocking button of the power cable connector (Figure 1). Remove the
power cable connector from the front of the module.
3. Loosen the screw on the front of the connector. This loosens the housing latch and the
cable relief. With a tightened screw the connector's cover can't be removed (Figure 2).
4. Pry off the connector cover using a suitable tool (Figure 3).

Figure 6-4 Connecting the supply voltage to a load current supply (1)

5. Strip the cable sheathing to a length of 35 mm. Strip the wires to a length of 7 to 8 mm.
Attach the end sleeves.
6. Connect the wires in the connector according to the connection diagram (Figure 4).
7. Close the cover (Figure 5).

S7-1500R/H redundant system

144 System Manual, 05/2021, A5E41814787-AC
 Wiring
6.7 Connecting the CPU to the load power supply

8. Retighten the screw (Figure 6). This effects a strain relief on the lines.

Figure 6-5 Connecting the supply voltage to a load current supply (2)

9. Insert the power connector into the module, until the latch engages.

Reference
You can find more information on connecting the 24 V DC output voltage of the load current
supply in the manuals for the relevant modules.

6.7 Connecting the CPU to the load power supply

Introduction
The load current supply is fitted with a plug-in 24 V DC output terminal (behind the front
cover at the bottom). You connect the cables for the supply voltage to the CPU at this
terminal.

Requirements
• Only wire the cable connector when the supply voltage is turned off.
• The connector for connecting the supply voltage to the CPU is already fitted. You can find
more information in the section Connecting the supply voltage (Page 142).

Tools required
3 to 3.5 mm screwdriver

S7-1500R/H redundant system

System Manual, 05/2021, A5E41814787-AC 145
Wiring
6.7 Connecting the CPU to the load power supply

Connecting the CPU to a load current supply

Watch the video sequence (https://support.industry.siemens.com/cs/ww/en/view/78027451)
To connect the cables for the supply voltage, follow these steps:
1. Open the front cover of the load current supply. Pull the 24 V DC output terminal down and
off.
2. Wire the 24 V DC output terminal to the wires of the CPU 4-pin connector.

3. Connect the load current supply to the CPU.

S7-1500R/H redundant system

146 System Manual, 05/2021, A5E41814787-AC
 Wiring
6.8 Connecting interfaces for communication with S7-1500R

6.8 Connecting interfaces for communication with S7-1500R

Connecting interfaces for communication

Connect the communication interfaces of the CPUs using standardized plug connectors.
Use prefabricated connecting cables for the connection. If you want to prepare
communication cables yourself, the interface assignment is specified in the CPU manuals.
Observe the mounting instructions for the connectors.

6.8.1 Connecting the PROFINET ring to S7-1500

Introduction
You connect the PROFINET ring between the two R-CPUs at the RJ45 sockets of
PROFINET interfaces X1 P1 R and X1 P2 R.

Requirements
• One of the two connections of the PROFINET ring between the two R-CPUs must not
contain any other IO devices, switches or other PROFINET devices apart from transparent
media converters.
• The default setting in STEP 7 is port 2 at PROFINET interface X1.
– Connect the PROFINET cable to the ports of the PROFINET interfaces of the two R-CPUs.
– The maximum length of the PROFINET cable is 100 m.
• You can extend the spatial distance between the two R-CPUs using a media converter
(electrical/optical). In this case, the maximum length depends on the type of media
converter used.
You can find more information in the documentation for the media converter:
– About the technical specifications
– About use
– About commissioning
• You connect the IO devices, switches and other PROFINET devices to the other
PROFINET ring connection. The default setting in STEP 7 is port 1 at PROFINET interface
X1.

S7-1500R/H redundant system

System Manual, 05/2021, A5E41814787-AC 147
Wiring
6.8 Connecting interfaces for communication with S7-1500R

Accessories required
• PROFINET cable for the PROFINET ring
• Optional transparent media converter (electrical ⇔ optical)

Procedure
To connect the PROFINET ring at SIMATIC S7-1500R, follow these steps:
1. Swing the front cover on the R-CPUs up.
2. Plug the PROFINET cable RJ45 connectors into the RJ45 sockets at
PROFINET interfaces X1 P2 R on the two R-CPUs.

Figure 6-6 PROFINET interface X1 P2 R: Connecting R-CPUs (bottom view)

S7-1500R/H redundant system

148 System Manual, 05/2021, A5E41814787-AC
 Wiring
6.8 Connecting interfaces for communication with S7-1500R

3. Plug the PROFINET cable RJ45 connectors into the RJ45 sockets at
PROFINET interfaces X1 P1 R on the two R-CPUs. Connect the other PROFINET devices in the
PROFINET ring.

Figure 6-7 PROFINET interface X1 P1 R:

4. Close the front cover on the R-CPUs.

S7-1500R/H redundant system

System Manual, 05/2021, A5E41814787-AC 149
Wiring
6.9 Connecting interfaces for communication with S7-1500H

6.9 Connecting interfaces for communication with S7-1500H

Connecting interfaces for communication

Connect the communication interfaces of the CPUs using standardized plug connectors.
Use prefabricated connecting cables for the connection. If you want to prepare
communication cables yourself, the interface assignment is specified in the CPU manuals.
Observe the mounting instructions for the connectors.

6.9.1 Connecting redundancy connections (fiber-optic cables)

6.9.1.1 Synchronization modules for S7-1500H

Introduction
You use the synchronization modules to create two redundancy connections between the
two H-CPUs. You need two identical synchronization modules per CPU which you connect
with fiber-optic cables.

View

Figure 6-8 Synchronization module

Maximum cable length (fiber-optic cable) between the two H-CPUs

In the S7-1500H redundant system, you need to use four synchronization modules of the
same type. You can order the following types of synchronization modules:

Maximum cable lengths between the two H- Article number

CPUs
10 m 6ES7960-1CB00-0AA5
10 km 6ES7960-1FB00-0AA5

S7-1500R/H redundant system

150 System Manual, 05/2021, A5E41814787-AC
 Wiring
6.9 Connecting interfaces for communication with S7-1500H

6.9.1.2 Selecting fiber-optic cables

Introduction
You can find an overview of fiber-optic cables, the necessary conditions and technical
specifications in the system manual Industrial Ethernet/PROFINET Passive network
components (https://support.industry.siemens.com/cs/ww/en/view/84922825).

Rules
Observe the following rules:
• If you use fiber-optic cables, ensure sufficient strain relief at the synchronization modules.
• Comply with the technical specifications for the fiber-optic cables used (attenuation,
bandwidth).

Cables up to 10 m
Use the synchronization module 6ES7960–1CB00–0AA5 in pairs with fiber-optic cables up to
10 m.
Select the following specifications with cable lengths of up to 10 m:
• 50/125 µ or 62.5/125 µ multimode fiber
• 2 x duplex cables per S7-1500H, crossover
• LC-LC connector type
The following cables are available as accessories for S7-1500H:

Table 6- 3 Fiber-optic cables as accessories

Length Article number

1m 6ES7960–1BB00–5AA5
2m 6ES7960–1BC00–5AA5
10 m 6ES7960–1CB00–5AA5

S7-1500R/H redundant system

System Manual, 05/2021, A5E41814787-AC 151
Wiring
6.9 Connecting interfaces for communication with S7-1500H

Cables up to 10 km
Use the synchronization module 6ES7960-1FB00-0AA5 in pairs with fiber-optic cables up to
10 km.
For cables over 10 m, you will need to have the fiber-optic cables custom-made. Select the
following specifications:
• Single-mode fiber (mono-mode fiber) 9/125 µ (fiber specification OS1 or OS2)
In exceptional cases, you can use the cables available as accessories in lengths of up to
10 m for commissioning and testing purposes. For permanent use, however, you must
use the cables specified in the table below with single-mode fibers.
Please see the following tables for the other specifications applicable to your specific
application.

Table 6- 4 Specifications for fiber-optic cables used indoors

Cabling Necessary components Specifications

Complete cabling routed Patch cable for indoors 2 x duplex cables for the redundant system (connector type LC-
within a building. LC, cores crossed):
• No cable junction Connector type in line with the other components.
between indoors and Installation cable for indoor 4-core multicore cables for the redundant system (connector
outdoors. use type LC-LC, cores crossed):
1 cable with 4 cores for the redundant system:
• Easy complete installa-
tion with pre- • Both interfaces in one cable
assembled cables. 1 or 2 cables with multiple shared cores for the redundant sys-
tem:
• Interfaces laid separately to increase availability (reduction
of common cause factor)
• Connector type in line with the other components

Table 6- 5 Specifications for fiber-optic cables used outdoors

Cabling Necessary components Specifications

A cable junction is re- Installation cable for Installation cable for outdoor use:
quired between the indoor outdoor applications (and
and outdoor area. indoor applications) • 1 cable with 4 cores per S7-1500H system
Installation through distri- Both interfaces in one cable
bution boxes (patch field).
Additional information can • 1 or 2 cables with multiple shared cores
be found in the section Interfaces laid separately to increase availability (reduction
below.
of common cause factor)
• Connector type in line with the other components
Patch cable for indoors Connector type in line with the other components.

S7-1500R/H redundant system

152 System Manual, 05/2021, A5E41814787-AC
 Wiring
6.9 Connecting interfaces for communication with S7-1500H

Installation of fiber-optic cables through distribution boxes (patch fields)

If cabling requires a transition from indoor to outdoor, you need to perform installation of the
fiber-optic cables via distribution boxes (patch fields). The distribution boxes (patch fields)
connect the different cables (patch and installation cables) and connector types with one
another. You need a separate distribution box (patch field) for each transition.

Note
The installation of connectors, distribution boxes (patch fields) and splicing of fiber-optic
cables is allowed as long as the additional attenuation does not exceed 1 dB.

① H-CPU
② Installation cable for outdoor use
③ Distribution box (patch field)
④ Splicing of the fiber-optic cables
⑤ Patch cable for indoors

Figure 6-9 Installation through distribution boxes (patch fields)

6.9.1.3 Installing fiber-optic cables

Introduction
Fiber-optic cables may only be laid by trained specialist personnel. Comply with all applicable
regulations and statutory requirements.
In practice, the installation of fiber-optic cables represents the most common cause of errors
and failures. These can be caused by:
• Kinks in the fiber-optic cable due to an insufficient bending radius
• Crushing as a result of excessive force caused by persons treading on the cable, by
pinching, or by other heavy cables
• Overstretching due to high tensile forces
• Damage caused by sharp edges

S7-1500R/H redundant system

System Manual, 05/2021, A5E41814787-AC 153
Wiring
6.9 Connecting interfaces for communication with S7-1500H

Quality assurance on site

Check the following points before laying the fiber-optic cables:
• Has the correct fiber-optic cable been delivered?
• Is there any visible transport damage to the product?
• Have you organized suitable intermediate on-site storage for the fiber-optic cables?
• Does the category of cable match that of the connecting components?

Installing fiber-optic cables

Note the following points when laying fiber-optic cables:
• Fiber-optic cables can be installed in open locations provided you can safely exclude any
damage in those areas (vertical risers, connecting shafts, telecommunications
switchboard rooms, etc.).
• Attach fiber-optic cables to mounting rails, for example cable trays or wire mesh ducts,
using cable ties. Take care not to crush the cables when fastening them. Make sure there
is not too much pressure on the fiber-optic cables.
• Before laying the fiber-optic cables: Deburr the edges of the holes. Round the holes. This
prevents damage to the sheathing when you pull in and fasten the cable.
• The bending radius must not be smaller than the value specified by the manufacturer.
• The branching radii of the cable ducts must correspond to the specified bending radius for
the fiber-optic cable.
• Lay the redundancy connections in such a way that the fiber-optic cables are securely
protected from damage.

WARNING
Undefined system state of the S7-1500H redundant system with simultaneous
interruption of the two redundancy connections ≤ 1500 ms apart (R-system) or ≤ 55 ms
apart (H-system).
Lay the redundancy connections in such a way that the fiber-optic cables are securely
protected from damage. Also make sure when laying the cables that the two redundancy
connections are always separate from each other. This makes simultaneous damage of the
redundancy connections ≤ 1500 ms apart (R-system) or ≤ 55 ms apart (H-system) unlikely.

Reference
Observe the installation notes for fiber-optic cables in the system manual Industrial
Ethernet/PROFINET Passive network components
(https://support.industry.siemens.com/cs/ww/en/view/84922825).

S7-1500R/H redundant system

154 System Manual, 05/2021, A5E41814787-AC
 Wiring
6.9 Connecting interfaces for communication with S7-1500H

6.9.1.4 Connecting redundancy connections (fiber-optic cables) to S7-1500H

Introduction
Make the redundancy connections (fiber-optic cables) between the two H-CPUs using the
sockets on the synchronization modules. You need two synchronization modules per CPU.
Connect the synchronization modules in pairs to the fiber-optic cables.

Requirements
• The redundancy connections (fiber-optic cables) must not include any additional media
converters, IO devices or switches. Distribution boxes are allowed.
• The redundancy connections can be a maximum of 10 m/10 km long.

Accessories required
• 4 synchronization modules 2 synchronization modules for each H-CPU
– Up to 10 m: Sync module 1 GB FO 10 m
– Up to 10 km: Sync module 1 GB FO 10 km
• 2 redundancy connections sync cable FO. The redundancy connections can be ordered in
the following lengths. You can find the article numbers in the appendix Accessories/spare
parts (Page 341).
– For sync module 1 GB FO 10 m: 1 m, 2 m, 10 m
– For sync module 1 GB FO 10 km: On request

S7-1500R/H redundant system

System Manual, 05/2021, A5E41814787-AC 155
Wiring
6.9 Connecting interfaces for communication with S7-1500H

Safety information

WARNING
Personal injury or material damage can occur in zone 2 hazardous areas
If you remove or attach a synchronization module during operation, personal injury and
damage can occur in hazardous areas of zone 2. Always disconnect the R/H-CPU from the
power supply before you remove or attach a synchronization module in hazardous areas of
zone 2.

CAUTION
The synchronization module contains a laser system and is classified as a "CLASS 1
LASER PRODUCT" in accordance with IEC 60825-1.
Can cause personal injury.
Avoid direct eye contact with the laser beam. Do not open the housing. Read the
information in the system manual carefully.

Figure 6-10 Class 1 laser products

S7-1500R/H redundant system

156 System Manual, 05/2021, A5E41814787-AC
 Wiring
6.9 Connecting interfaces for communication with S7-1500H

Inserting synchronization modules and connecting fiber-optic cables

To insert the synchronization modules and connect the fiber-optic cables, follow these steps:
1. Remove the blanking plugs from the synchronization modules.
2. Push the two synchronization modules as far as they will go from below into the module
slots at the H-Sync interfaces of port 1:
CPU 1517H-3 PN: X3 (H-Sync channel 1) and X4 (H-Sync channel 2)
CPU 1518HF-4 PN: X4 (H-Sync channel 1) and X5 (H-Sync channel 2)
The synchronization modules must audibly click into place. Then push the clip on each
synchronization module to the left. Result: The synchronization modules are locked into
place.

Figure 6-11 Inserting and locking synchronization modules

S7-1500R/H redundant system

System Manual, 05/2021, A5E41814787-AC 157
Wiring
6.9 Connecting interfaces for communication with S7-1500H

3. Hold the pre-assembled connectors of the redundancy connection by the housing. Push the
connectors into the sockets of the synchronization modules. You should hear the
connectors click into place.
4. Repeat steps 1 to 3 for the second H-CPU.

Figure 6-12 Connecting redundancy connections (fiber-optic cables) to S7-1500H

Uninstalling a synchronization submodule

To uninstall the synchronization modules, follow these steps:
1. Press down lightly on the connector release and hold while pulling the connector out of the
synchronization module.
2. Flip the synchronization module clip to the right.
3. Pull the synchronization module out of the H-Sync interface on the CPU.
4. Place the blanking plug on the synchronization module.
5. Repeat the process for all H-Sync interfaces on the H-CPUs.

S7-1500R/H redundant system

158 System Manual, 05/2021, A5E41814787-AC
 Wiring
6.9 Connecting interfaces for communication with S7-1500H

Protecting LC sockets on unused synchronization modules

Protect the LC sockets when storing unused synchronization modules:
Close off the LC sockets with the blanking plugs to protect them from dirt. The
synchronization modules come with blanking plugs inserted.

NOTICE
Reduced optical performance due to dirt
Even a small amount of dirt in the LC socket can affect the quality of the signal transmission.
Dirt can lead to synchronization losses in operation.
Protect the LC sockets from contamination during storage and installation of the
synchronization modules.

6.9.2 Connecting the PROFINET ring to S7-1500H

Introduction
You connect the PROFINET ring using the RJ45 sockets of
PROFINET interfaces X1 P1 R and X1 P2 R.

Accessories required
PROFINET cable for the PROFINET ring

S7-1500R/H redundant system

System Manual, 05/2021, A5E41814787-AC 159
Wiring
6.9 Connecting interfaces for communication with S7-1500H

Procedure
Plug the RJ45 connectors on the PROFINET cable in the PROFINET ring into the RJ45 sockets at
PROFINET interfaces X1 P1 R/X1 P2 R on the two H-CPUs.

Figure 6-13 Connecting the PROFINET ring to S7-1500H

S7-1500R/H redundant system

160 System Manual, 05/2021, A5E41814787-AC
Configuration 7
7.1 Configuring the CPU

Hardware and software requirements

You will find the hardware and software requirements for operating S7-1500R/H redundant
systems in the section Application planning (Page 69).

7.2 Configuration procedure

The following section takes you through the configuration process for an S7-1500R
redundant system step by step. The configuration consists of two CPUs 1515R-2 PN and two
IO devices (ET 200MP and ET 200SP).

Requirements
The configuration detailed assumes that:
• You have set the IP address of the PG/PC.

1. Creating a project and R-CPUs

1. Create a new project in STEP 7. Give the project a name.
2. Select CPU 1515R-2 PN from the hardware catalog in the network view of the hardware
configuration.
3. Drag and drop the CPU to the task window in the network view.
Result: STEP 7 automatically creates both 1515R-2 PN CPUs for the redundant system. STEP 7
displays both CPUs in the network view graphically.

Note
Deleting CPUs from the hardware configuration
You can only delete the two CPUs as a pair.

Figure 7-1 Display of CPUs in the network view

1. Open the CPUs in the device view. In the device view, the first CPU and the second CPU are
each in slot 1.
2. Give the CPUs unique names under Properties.

S7-1500R/H redundant system

System Manual, 05/2021, A5E41814787-AC 161
Configuration
7.2 Configuration procedure

2. Assigning IP addresses (device IP addresses)

STEP 7 automatically assigns an IP address to each PROFINET interface of a CPU. You can also
assign the IP addresses manually.
For PROFINET interface X1 of the CPUs, the IP addresses must be located in the same subnet.
The IP address is displayed in the CPU properties, in the "PROFINET interface [X1]" area of the
"IP protocol" section.

Figure 7-2 IP address

Redundancy IDs
In the STEP 7 project tree, each of the two CPUs is displayed with its own tree in the
redundant system:

Figure 7-3 Redundant system in the project tree

Each CPU of the redundant system has a redundancy ID. The redundancy ID is used to assign
a project tree in STEP 7 to the real CPU. The top CPU of the two in the tree is always the CPU
with the redundancy ID "1". The bottom CPU has the redundancy ID "2".
If a CPU has a valid hardware configuration and you change the redundancy ID of that CPU,
you also change the CPU's name and IP addresses. You can find more information in the
section Redundancy IDs (Page 213).

S7-1500R/H redundant system

162 System Manual, 05/2021, A5E41814787-AC
 Configuration
7.2 Configuration procedure

3. Assigning system IP addresses

In addition to the device IP addresses of the CPUs, you can also assign system IP addresses for
the S7-1500R/H redundant system.
You use the system IP addresses for communication with other devices (for example,
HMI devices, CPUs, PG/PC). The devices always communicate over the system IP address with
the primary CPU of the redundant system. This ensures, for example, that the communication
partner can communicate with the new primary CPU (previously backup CPU) in the
RUN-Solo system state after failure of the original primary CPU in redundant operation.
Proceed as follows to activate the system IP address for PROFINET interfaces X1 of the two
CPUs:
1. Select a CPU in the network view. Select the "Properties" tab in the Inspector window.
2. Select the area "PROFINET interface [X1]" and the section "System IP address for switched
communication" in the area navigation.
3. Make sure that the checkbox "Enable the system IP address for switched communication" is
selected for the interface X1. Apply or assign the system IP address in the "IP address" field.
The subnet mask cannot be modified and corresponds to the subnet mask of the device IP
address.
4. Apply or assign a virtual MAC address to the system IP address.
The virtual MAC address is 6 bytes long. The assignment of the bytes is hexadecimal.

Note
Virtual MAC address
Ensure that all MAC addresses stored in the Ethernet broadcast domain are unique. This
applies in particular to systems with third-party devices consisting of VRRP and redundant
systems that are configured through several STEP 7 projects.

5. The other CPU applies the settings automatically.

Figure 7-4 System IP address

You can find more information on the system IP address in the Communication function
manual (https://support.industry.siemens.com/cs/ww/en/view/59192925).

S7-1500R/H redundant system

System Manual, 05/2021, A5E41814787-AC 163
Configuration
7.2 Configuration procedure

4. Setting the cycle monitoring time

STEP 7 assigns default values for the minimum and maximum cycle times.
The default values are displayed in the "Cycle" area of the CPU properties.

Note
Set cycle time high
Select the maximum cycle time as high as your process allows.
• The time for the ongoing synchronization of the two CPUs in redundant operation is
included in the cycle time.
• A temporary increase in the cycle time can occur upon a system state transition SYNCUP →
RUN-Redundant.
If only one CPU controls the process (RUN-Solo system state), the cycle time is significantly
shorter than during redundant operation.

You can find more information on the cycle time and recommendations for parameterization
of the maximum cycle time and the minimum cycle time in the Cycle and response times
function manual (https://support.industry.siemens.com/cs/ww/en/view/59193558).
You can find information on system states in the section Operating and system states
(Page 226).

5. Creating IO devices
In the example, you add two IO devices with system redundancy S2 to the R-CPUs. To do so,
proceed as follows:
1. Switch to the network view.
2. Drag the interface module IM 155-5 PN HF to the task window as an IO device from the
hardware catalog.
3. Drag the required modules to the corresponding slots in the IO device.
4. Select the second IO device, IM 155-6 PN HF, in exactly the same way.
5. Assign the required modules.

S7-1500R/H redundant system

164 System Manual, 05/2021, A5E41814787-AC
 Configuration
7.2 Configuration procedure

6. Assigning IO devices to the redundant system

To assign IO devices to the S7-1500R/H redundant system, connect every IO device to each
CPU.
To do so, proceed as follows:
1. Drag-and-drop a line between the PROFINET interface of IM 155-5 PN HF and
PROFINET interface X1 of the left-hand CPU.
2. Drag-and-drop a line between the PROFINET interface of IM 155-5 PN HF and
PROFINET interface X1 of the right-hand CPU.
3. Assign the second IO device, IM 155-6 PN HF, to the two CPUs in exactly the same way. Set
the watchdog timer for the second IO device.
Result: The IO devices are connected to the redundant S7-1500R/H system.

Figure 7-5 IO devices assigned in the network view with system redundancy

Note
If you have configured modules for the IO devices and compile the project, you receive an
error message for the watchdog timer in the Inspector window. Set the watchdog timer
indicated in the error message.

S7-1500R/H redundant system

System Manual, 05/2021, A5E41814787-AC 165
Configuration
7.2 Configuration procedure

Display of the IO device assignments in STEP 7

Regardless of whether an IO device is connected as system redundant or as standard
IO device ("switched S1 device") to the redundant S7-1500R/H system, the network view
always shows "Multi assigned".
To determine which IO devices are connected system redundant and which ones are
connected as standard IO devices, follow these steps:
1. In the network view of STEP 7, select the redundant S7-1500R/H system.
2. In the tabular view of the network view switch to "I/O communication".
The table contains all assignments of IO devices to the PROFINET interfaces of the redundant
S7-1500R/H system.
The "Operating mode" column indicates how the IO device is connected to the redundant
S7-1500R/H system:
• IO device (S2): IO device is connected system redundant.
• IO device (S1): IO device is connected over the "Switched S1 device" function.
The following figure shows how STEP 7 displays the two IO devices with system redundancy
S2 in the tabular view of the network view.

Figure 7-6 Display of the IO device assignments in STEP 7

7. MRP role of the CPUs in the S7-1500R/H redundant system

As soon as you create an S7-1500R/H redundant system in STEP 7, STEP 7 automatically
assigns the MRP role "Manager (auto)" to the PROFINET interfaces X1 of both CPUs.

S7-1500R/H redundant system

166 System Manual, 05/2021, A5E41814787-AC
 Configuration
7.2 Configuration procedure

8. Defining the MRP role for additional devices in the ring in STEP 7
Proceed as follows to define the media redundancy for additional devices in the ring:
1. In the network view of STEP 7, select PROFINET interface X1 of one of the two CPUs of the
S7-1500R/H redundant system.
2. In the Inspector window, navigate to "Properties" > "General" > "Advanced options" > "Media
redundancy".
3. Click the "Domain settings" button.

Figure 7-7 S7-1500R/H: MRP role "Manager (auto)"

In the Inspector window, STEP 7 displays the properties of the MRP domain in which
PROFINET interface X1 of the CPU is located.
4. In the "MRP role" column of the "Devices" table, assign the MRP role "Client" to all other
devices.

Figure 7-8 S7-1500R/H: Assigning MRP roles to ring devices

9. Configuring devices outside the STEP 7 project

Set the MRP role "Client" for devices in the ring that are not located in STEP 7.
Example: For a switch, set the MRP role "Client" via the Web interface of the switch.

Reference
You can find information on the PROFINET topologies of S7-1500R/H redundant systems in
the PROFINET function manual.
(https://support.industry.siemens.com/cs/ww/en/view/49948856)

S7-1500R/H redundant system

System Manual, 05/2021, A5E41814787-AC 167
Configuration
7.3 Project tree

7.3 Project tree

Structure of the project tree

In the project tree, STEP 7 creates the project tree for the CPUs. The project tree has a tree
structure and contains all elements and editors of the project.

Table 7- 1 Structure of the project tree

Below the H system, you will find the device configuration

and diagnostic options that apply to the system as a whole.

The CPU displayed in the upper section of the project tree

has the redundancy ID "1". The properties of the CPU are
displayed below it.
This section also contains other properties of the redundant
system, the user program and other system-related project
items.
With the HF-CPUs, the Safety Administration Editor is locat-
ed in the top CPU.
The IO devices assigned to the CPU are listed under "Dis-
tributed I/O".

The CPU in the lower section of the project tree has the
redundancy ID "2". The properties of the CPU are displayed
below it.
The IO devices assigned to the CPU are listed under "Dis-
tributed I/O".

All distributed I/O devices used are listed under "Ungrouped

devices".

S7-1500R/H redundant system

168 System Manual, 05/2021, A5E41814787-AC
 Configuration
7.4 Parameters

7.4 Parameters
"Parameter assignment" means setting the module properties. This includes setting
addresses, enabling alarms and defining communication properties.
You assign the property parameters for the CPUs in the area navigation, in the STEP 7
Inspector window. The CPUs have general parameters and R/H-specific parameters. Some
parameters must be identical for both CPUs. STEP 7 applies these parameters to the second
CPU. Other parameters must be different on each CPU (for example device IP addresses). If
your configuration is not consistent, STEP 7 will point out the conflict.

Reference
You can find a detailed description of all CPU parameters in the STEP 7 online help.

7.5 Process images and process image partitions

7.5.1 Process image - overview

Process image inputs and outputs

The process image of the inputs and outputs is an image of the signal states. The CPU
transfers the values from the input and output modules to the process image inputs and
outputs. At the start of the cyclic program, the CPU transfers the process image output as a
signal state to the output modules. The CPU then transfers the signal states of the input
modules to the process image inputs.

Advantages of the process image

A consistent map of the process signals is available via the process image during cyclic
program execution. If a signal state at an input module changes during program execution,
the signal state is retained in the process image. The CPU does not update the process image
until the next cycle.

Consistency of the process image

When the process image is updated, the S7-1500R/H redundant system accesses the data of
each submodule as consistent data. This behavior is identical to that of S7-1500 CPUs.
The maximum data width that is accessed as consistent data for each submodule depends on
the IO system. For PROFINET IO, for example, this data width is 1024 bytes.

S7-1500R/H redundant system

System Manual, 05/2021, A5E41814787-AC 169
Configuration
7.5 Process images and process image partitions

32 process image partitions

The CPU uses process image partitions to synchronize the updated inputs/outputs of specific
modules with specific parts of the user program.
In the S7-1500R/H redundant system, the overall process image is subdivided into up to
32 process image partitions (PIP).
The CPU automatically updates the TPA 0 (automatic update) at the beginning of each
program cycle. You can find additional information in the Cycle and response times
(http://support.automation.siemens.com/WW/view/en/59193558) function manual.
You can assign other OBs to process image partitions PIP 1 to PIP 31 during configuration of
the IO devices.
The CPU always reads the process image partition of the inputs (PIPI) before processing the
associated OB. The CPU outputs the process image of the outputs (PIPQ) at the end of the OB.
The figure below illustrates the updating of a process image partition.

Figure 7-9 Updating a process image partition

7.5.2 Updating process image partitions in the user program

Requirements
Alternatively, you can also use the following instructions to update process images:
• "UPDAT_PI" instruction
• "UPDAT_PO" instruction
You will find the instructions in STEP 7 in the "Instructions" task card under "Extended
instructions". The instructions can be called from any point in the user program.
Requirements for updating process image partitions with the "UPDAT_PI" and "UPDAT_PO"
instructions:
• The process image partitions must not be assigned to any OB. This means the process
image partitions are not automatically updated.

Note
Update of PIP 0
PIP 0 (automatic update) cannot be updated with the "UPDAT_PI" and "UPDAT_PO"
instructions.

S7-1500R/H redundant system

170 System Manual, 05/2021, A5E41814787-AC
 Configuration
7.5 Process images and process image partitions

UPDAT_PI: Updates the process image partition of the inputs

With this instruction, you read the signal states from the input modules of the IO devices to
the process image partition of the inputs (PIPI).

UPDAT_PO: Updates the process image partition of the outputs

With this instruction, you transfer the process image partition (PIP) of the outputs to the
output modules of the IO devices.

Direct I/O access to the inputs and outputs of the IO devices

You also have direct read and write access to the I/O as an alternative to access via the
process image, should direct access be required for programming reasons. Direct (write) I/O
access also writes to the process image. This prevents a subsequent output of the process
image from again overwriting the value written by direct access.

Note
Avoid direct I/O access. Each instance of direct I/O access is synchronized in the RUN-
Redundant system state and results in a higher cycle time. Recommendation: Access the
inputs and outputs of the IO devices over the process image or process image partitions.

Reference
You can find more information on process image partitions in the Cycle and response times
(http://support.automation.siemens.com/WW/view/en/59193558) function manual.

S7-1500R/H redundant system

System Manual, 05/2021, A5E41814787-AC 171
Basics of program execution 8
8.1 Programming the S7-1500R/H

User program for the S7-1500R/H redundant system

For the design and programming of the user program, the same rules apply for the redundant
S7-1500R/H system as for the S7-1500 automation system.
The user program is stored identically in both CPUs in redundant operation. Both CPUs
process the user program event-synchronously.
From the point of view of user program execution, the S7-1500R/H redundant system
behaves like the S7-1500 automation system. Synchronization is integrated into the
operating system and runs automatically and hidden between the primary and backup CPU.

Specific instructions and blocks for the S7-1500R/H redundant system

Specific instructions and OBs are available for the S7-1500R/H redundant system.

"RH_CTRL" instruction
With the "RH_CTRL" instruction, you can influence the redundant system as follows:
• Lock performance of SYNCUP (Mode 3) or release performance of SYNCUP again
(Mode 4).
The goal is to allow SYNCUP only in less critical process phases if necessary (see section
Disabling/enabling SYNCUP with the RH_CTRL instruction (Page 183) for more
information).
As of firmware version V2.9:
• Request SYNCUP (Mode 7).
With this function, you can request a SYNCUP via the user program in RUN-Solo system
state.
• Switch primary CPU to STOP mode (Mode 8, only in RUN-Redundant system state).
In an emergency (e.g. fire alarm in the area of the primary CPU), you can perform a
primary-backup switchover as a precaution with this function.
• Switch backup CPU to STOP mode (Mode 9).

"RH_GetPrimaryID" instruction
You use the instruction "RH_GetPrimaryID" in the user program to read out which CPU is
currently the primary CPU (see section Determining the primary CPU with "RH_GetPrimaryID"
(Page 186) for additional information).

S7-1500R/H redundant system

System Manual, 05/2021, A5E41814787-AC 172
 Basics of program execution
8.1 Programming the S7-1500R/H

OB 72 (CPU redundancy error)

In addition to the OBs of the S7-1500 CPU, you can also use OB 72 (CPU redundancy error).
The operating system of each CPU of an R/H-system calls up the CPU redundancy error OB
(OB72) when one of the following events occurs:
• Loss of redundancy due to a CPU failure
• Loss of redundancy due to a CPU transition to STOP mode (triggered by the user or the
system)
Up to firmware version V2.8:
• The R/H system has entered the RUN-Redundant system state.
As of firmware version V2.9:
• The R/H-system has entered RUN-Redundant system state and the synchronization of the
two R/H-CPUs is possible redundantly.
• The R/H-system has entered RUN-Redundant system state, but the synchronization of the
two R/H-CPUs is not possible redundantly.
• The R/H-system is still in RUN-Redundant system state and the synchronization of the two
R/H-CPUs is possible redundantly now or again.
• The R/H-system is still in RUN-Redundant system state, but the synchronization of the two
R/H-CPUs is no longer possible redundantly.

Note
An R/H-system with non-redundant synchronization may not tolerate any further failures. In
this case, you need to check and possibly repair the PROFINET ring (R-system) or the fiber-
optic cables (H-system) immediately.

STEP 7 online help

You can find additional information on instructions and blocks in the STEP 7 online help.

S7-1500R/H redundant system

System Manual, 05/2021, A5E41814787-AC 173
Basics of program execution
8.1 Programming the S7-1500R/H

Special features in program execution

• You create the user program for the S7-1500R/H redundant system in the top CPU (for
example PLC_1) in the STEP 7 project tree.
• The S7-1500R/H redundant system does not support some of the instructions the
S7-1500 CPUs. Instructions that are not supported by the S7-1500R/H redundant system
are grayed out in STEP 7 in the "Instructions" task card.
STEP 7 shows the instructions that are not supported in the program code in red. If you
compile program code with instructions that are not supported, STEP 7 outputs an error
message.
The instructions that are not supported are set out in the section Restrictions (Page 175).
• In the case of instructions with the "LADDR" block parameter, you use this parameter to
determine which of the two CPUs is the target of this instruction.
Example: To read out the I&M data of the CPU with redundancy ID 1, specify the HW
identifier 65149 (or the "Local1" system constant) at the "LADDR" block parameter of the
Get_IM_Data instruction.
You can find more information about the block parameters and the system constants of
the S7-1500R/H redundant system in the STEP 7 online help.
• In the case of a SYNCUP, the execution time of many instructions operating
asynchronously is extended. If you call asynchronous instructions in SYNCUP system state
with the redundant S7-1500R/H system, the required function may not be triggered.
Solution: After SYNCUP ends, call the asynchronous instruction again. The function will
then be triggered.
Recommendation: Always call the asynchronous instructions cyclically.
• In contrast to the S7-1500 automation system, the redundant S7-1500R/H system
initializes temporary local data for functions (FCs) not only during optimized block access
but also during non-optimized block access. Information on system initialization for
optimized block access can be found in the STEP 7 online help.

Programming style guide

The programming guidelines described in the programming style guide help you to create a
uniform program code. You can better maintain and reuse the uniform program code. This
allows you to detect or avoid errors early on, for example, through compilers.
The programming style guide is available on the Internet
(https://support.industry.siemens.com/cs/ww/en/view/109478084).

S7-1500R/H redundant system

174 System Manual, 05/2021, A5E41814787-AC
 Basics of program execution
8.2 Restrictions

8.2 Restrictions

Instructions not supported

Table 8- 1 Unsupported instructions CPU 1513R / CPU 1515R / CPU 1517H / CPU 1518HF with firmware version V2.9

Instruction Description
Communication
GET Read data from a remote CPU
PUT Write data to a remote CPU
USEND Send data uncoordinated
URCV Receive data uncoordinated
BSEND Send data in segments
BRCV Receive data in segments
T_CONFIG Configure interface
TMAIL_C (V5.0 or later)1) Transfer email
OPC_UA_Connect Create connection
OPC_UA_NamespaceGetIndexList Read namespace indexes
OPC_UA_NodeGetHandleList Get handles for read and write access
OPC_UA_MethodGetHandleList Get handles for method calls
OPC_UA_TranslatePathList Read node parameters
OPC_UA_ReadList Read tags
OPC_UA_WriteList Write tags
OPC_UA_MethodCall Call method
OPC_UA_NodeReleaseHandleList Enable handles for read and write access
OPC_UA_MethodReleaseHandleList Enable handles for method calls
OPC_UA_Disconnect Close connection
OPC_UA_ConnectionGetStatus Read connection status
OPC_UA_ServerMethodPre Preparation of the server method call
OPC_UA_ServerMethodPost Post preparation of the server method call
WWW Synchronize user pages
S_USSI Initialize USS
FTP_CMD Setup of FTP connections from and to an FTP server
Extended instructions
SET_TIMEZONE2) Set time zone
SNC_RTCB Synchronize slave clocks
SYNC_PI Synchronize process image inputs
SYNC_PO Synchronize process image outputs
D_ACT_DP Enable/disable DP slaves
ReconfigIOSystem Reconfigure IO system
WR_REC Write data record to I/O (use new block WRREC)
RD_REC Read data record from I/O (use new block RDREC)
RCVREC Receive data record (I-device)
PRVREC Make data record available (I-device)
DPSYC_FR Synchronize DP slaves/Freeze inputs
DPNRM_DG Read diagnostics data from a DP slave

S7-1500R/H redundant system

System Manual, 05/2021, A5E41814787-AC 175
Basics of program execution
8.2 Restrictions

Instruction Description
DP_TOPOL Determine topology for DP master system
PE_WOL Start and end energy-saving mode via WakeOnLan
PE_I_DEV Control PROFIenergy commands in I-Device
WR_DPARM Transfer data record
ATTACH Attach OB to interrupt event
DETACH Detach OB from interrupt event
CREATE_DB Create data block
DataLogCreate Create data log
DataLogOpen Open data log
DataLogWrite Write data log
DataLogClear Empty data log
DataLogClose Close data log
DataLogDelete Delete data log
DataLogNewFile Data log in new file
READ_DBL Read from data block in load memory
WRIT_DBL Write from data block in load memory
DELETE_DB Delete data block
FileReadC Read file from memory card
FileWriteC Write file on memory card
Basic instructions
ReadFromArrayDBL Read from ARRAY data block in load memory
WriteToArrayDBL Write to ARRAY data block in load memory
Technology
All instructions for Motion Control (MC_Power, MC_Home, -
MC_...)
Time-based IO
TIO_SYNC Synchronize TIO modules
TIO_IOLink_IN Read in process input signals with time stamps
TIO_DI Read in edges at digital input and associated time stamps
TIO_IOLink_OUT Time-controlled output of process output signals
TIO_DQ Output edges time-controlled at digital output
1) The S7-1500R/H CPUs with firmware version V2.9 support the versions < V5.0 of the instruction "TMAIL_C".
2) Upon a call in the CPU, the instruction provides a negative return value RETVAL.

Unsupported OBs
The CPUs of the S7-1500R/H redundant system do not support the following OBs:
• Synchronous cycle interrupt OB
• OB 67 "MC-PreServo"
• OB 91 "MC-Servo"
• OB 92 "MC-Interpolator"
• OB 95 "MC-PostServo"

S7-1500R/H redundant system

176 System Manual, 05/2021, A5E41814787-AC
 Basics of program execution
8.3 Events and OBs

8.3 Events and OBs

Start events
The table below gives an overview of the possible event sources for start events and their
OBs:

Table 8- 2 Start events

Event sources Possible priorities Possible OB Default system Number of OBs

(default priority) numbers response1)
Startup 1 100, ≥ 123 Ignore 0 to 100
Cyclic program 1 1, ≥ 123 Ignore 0 to 100
Time-of-day interrupt 2 to 24 (2) 10 to 17, ≥ 123 Not applicable 0 to 20
Time-delay interrupt 2 to 24 (3) 20 to 23, ≥ 123 Not applicable 0 to 20
Cyclic interrupt 2 to 24 (8 to 17, fre- 30 to 38, ≥ 123 Not applicable 0 to 20
quency dependent)
Hardware interrupt 2 to 26 (16) 40 to 47, ≥ 123 Ignore 0 to 50
Status interrupt 2 to 24 (4) 55 Ignore 0 or 1
Update alarm 2 to 24 (4) 56 Ignore 0 or 1
Manufacturer-specific or profile- 2 to 24 (4) 57 Ignore 0 or 1
specific interrupt
CPU redundancy error 2 to 26 (26) 72 Ignore 0 or 1
Time error 22 80 Ignore 0 or 1
Maximum cycle time exceeded Depends on sys-
tem state2)
Diagnostics interrupt 2 to 26 (5) 82 Ignore 0 or 1
Removal/insertion of modules 2 to 26 (6) 83 Ignore 0 or 1
Rack error 2 to 26 (6) 86 Ignore 0 or 1
Programming error (only for global 2 to 26 (7) 121 STOP 0 or 1
error handling)
I/O access error (only for global 2 to 26 (7) 122 Ignore 0 or 1
error handling)
1) If you have not configured the OB.
2) See section "Response of S7-1500R/H redundant system when cycle time is exceeded"

S7-1500R/H redundant system

System Manual, 05/2021, A5E41814787-AC 177
Basics of program execution
8.3 Events and OBs

Response to start events

The occurrence of a trigger results in the following response:
• If the event comes from an event source to which you have assigned an OB, this event
triggers the execution of the assigned OB. The event enters the queue according to its
priority (exception: hardware interrupts).
• If the event comes from an event source to which you have not assigned an OB, the CPU
executes the default system reaction.

Note
Some event sources, such as startup, pull/plug, exist even if you do not configure them.

Response of OB 72 and OB 86 to system state transitions

If an IO device has failed, the OB 86 reports a "rack failure" if programmed. OB 72 "CPU
redundancy error" reports a loss of redundancy in the redundant system or failure of the
redundant synchronization.
The figure below shows the behavior of the two OBs during system state transitions from
RUN-Solo to RUN-Redundant and vice versa.

Figure 8-1 OB 72 and OB 86 during system state transitions

S7-1500R/H redundant system

178 System Manual, 05/2021, A5E41814787-AC
 Basics of program execution
8.3 Events and OBs

OB 86
There are three IO devices in the example. Each failure of one of the three IO devices is
followed by recovery of the IO device. Each IO device failure/IO device recovery is signaled.
Cyclic program execution is interrupted with an OB 86 call.
In the "Copy main memory" phase of the SYNCUP system state those OBs that interrupt the
cyclic program processing are processed. New diagnostic events are signaled but the OBs are
not yet processed. In the example, the failure of IO device 2 and the recovery of IO device 3
are signaled. However, the OB 86 are not processed until the following phase, "Making up
backup CPU lag".

Note
Order of execution of OB 86
Please note that the order of processing of the OB 86 may differ from the order of processing
of the associated diagnostic events.

Note
Station re-integration with errors
When a station returns with errors in an R/H-CPU, no attempt is made - in contrast to a
standard CPU - to output exact error information in the diagnostic buffer.

OB 72
If the system then switches to the RUN-Redundant system state, OB 72 "CPU redundancy
error" is called. OB 72 is called again:
• If the redundant system exits redundant operation and changes to the RUN-Solo system
state.
• If the redundant system is in redundant operation and the synchronization of the two
R/H-CPUs is no longer possible redundantly or is possible redundantly again.
All cases can be distinguished by the start information of OB 72. You can find further
information in the STEP 7 online help.

Note
Delayed execution of OB 72
There may also be a delay in executing OB 72 because the corresponding diagnostic event is
processed asynchronously to the user program.

OB behavior for standard IO devices with primary backup switching

If the primary CPU fails or goes to STOP, the standard IO devices are temporarily separated
from the redundant S7-1500R/H system. From the CPU perspective, the standard IO devices
fail. OB 72 "Redundancy error" is called, additional OB 86 "Module rack failure" for the failed
IO devices are not called, however. To detect the failed IO devices, call the DeviceStates
instruction in OB 72. To detect all failed IO devices, the OB 72 must have priority 26 (default).
With the "Switched S1 device" function, the new primary CPU establishes the ARs to the
standard IO devices again. OB 86 is called for each return of an IO device.

S7-1500R/H redundant system

System Manual, 05/2021, A5E41814787-AC 179
Basics of program execution
8.3 Events and OBs

Example: OB 72 CPU redundancy failure

Automation task
You use the S7-1500R redundant system to control a blast furnace. The S7-1500R redundant
system controls the blast furnace temperature, volume and pressure parameters.

Feature
In the event of a loss of redundancy, for example because the primary CPU fails, a signal lamp
in the blast furnace control room signals this event. The control room notifies the service
personnel. The service personnel replace the defective CPU.

Solution
OB 72 is called in the event of a CPU redundancy error. The user program in OB 72 controls a
digital output module (relay) in an ET 200SP with a connected signal lamp.

Response of S7-1500R/H redundant system when cycle time is exceeded

The tables below show how the redundant system responds when the cycle time is exceeded.
If the user program does not reach the cycle control point within the maximum cycle time,
the redundant system responds as described in the column "1st time cycle time is exceeded".
The redundant system then resets the cycle time monitoring.
If the maximum cycle time is exceeded for a second time in the same cycle, the redundant
system responds as described in the column "2nd time cycle time is exceeded". The
redundant system then resets the cycle time monitoring.
If the maximum cycle time is exceeded for a third time in the same cycle, the redundant
system responds as described in the column "3rd time cycle time is exceeded". The redundant
system then resets the cycle time monitoring (only when time error OB 80 is configured).

Table 8- 3 Response of S7-1500R/H redundant system when cycle time is exceeded, without OB 80

Initial situation 1st time cycle time is exceeded 2nd time cycle time is exceeded
System Primary Backup System Primary Backup System Primary Backup
CPU CPU CPU CPU CPU CPU
RUN-Solo RUN STOP STOP STOP STOP --- --- ---
SYNCUP1) RUN- SYNCUP STOP STOP STOP --- --- ---
Syncup
SYNCUP2) RUN- SYNCUP RUN-Solo RUN STOP STOP STOP STOP
Syncup
RUN- RUN- RUN- RUN-Solo RUN STOP STOP STOP STOP
Redundant Redundant Redundant
1) SYNCUP until snapshot of the work memory contents
2) SYNCUP after snapshot of the work memory contents

S7-1500R/H redundant system

180 System Manual, 05/2021, A5E41814787-AC
 Basics of program execution
8.3 Events and OBs

Table 8- 4 Response of S7-1500R/H redundant system when cycle time is exceeded with OB 80

Initial situation 1st time cycle time is ex- 2nd time cycle time is ex- 3rd time cycle time is ex-
ceeded ceeded ceeded
System Primary Backup System Primary Backup System Primary Backup System Primary Backup
CPU CPU CPU CPU CPU CPU CPU CPU
RUN- RUN STOP RUN- RUN STOP STOP STOP STOP --- --- ---
Solo Solo + OB 80
SYNCUP RUN- SYNCUP SYNCUP RUN- SYNCUP STOP STOP STOP --- --- ---
1) Syncup Syncup
+ OB 80
SYNCUP RUN- SYNCUP SYNCUP RUN- SYNCUP RUN- RUN STOP STOP STOP STOP
2) Syncup Syncup + OB 80 Solo + OB 80
+ OB 80

RUN- RUN- RUN- RUN- RUN- RUN- RUN- RUN STOP STOP STOP STOP
Redun- Redun- Redun- Redun- Redun- Redun- Solo + OB 80
dant dant dant dant dant dant
+ OB 80 + OB 80
1) SYNCUP until snapshot of the work memory contents
2) SYNCUP after snapshot of the work memory contents

Assignment between event source and OBs

The type of OB determines where you assign OB to event source:
• For hardware interrupts: Assignment in hardware configuration
• For all other OB types: Assignment when the OB is created, where applicable after you
have configured the event source

S7-1500R/H redundant system

System Manual, 05/2021, A5E41814787-AC 181
Basics of program execution
8.3 Events and OBs

OB priority and runtime behavior

If you have assigned an OB to the event, the OB has the priority of the event.
S7-1500R/H CPUs support the priorities 1 (lowest) to 26 (highest). The following items are
essential to the execution of an event:
• Call and execution of the assigned OB
• The update of the process image partition of the assigned OB
The user program processes the OBs exclusively on a priority basis. This means the program
processes the OB with the highest priority first when multiple OB requests occur at the same
time. If an event occurs that has a higher priority than the currently active OB, this OB is
interrupted*. The user program processes events of the same priority in order of occurrence.
*Exception: In the RUN-Redundant system state, a higher-priority OB 83 "Pull/plug modules"
does not interrupt the execution of an OB 82 "Diagnostic interrupt".

Note
Communication
Communication (for example test functions with the PG/PC) always operates with a priority of
15. To avoid unnecessarily prolonging the program runtime in the case of time-critical
applications, make sure that these OBs are not delayed or interrupted by communication.
Assign a priority > 15 for these OBs.

Reference
Additional information on organization blocks is available in the STEP 7 online help.

S7-1500R/H redundant system

182 System Manual, 05/2021, A5E41814787-AC
 Basics of program execution
8.4 Special instructions for S7-1500R/H redundant systems

8.4 Special instructions for S7-1500R/H redundant systems

8.4.1 Disabling/enabling SYNCUP with the RH_CTRL instruction

Introduction
You use the "RH_CTRL" instruction to disable SYNCUP or to enable the execution of the
SYNCUP for the S7-1500R/H redundant system. The disable applies:
• Until you cancel it with the "RH_CTRL" instruction or
• Until the S7-1500R/H redundant system switches to the STOP system state

Figure 8-2 RH_CTRL instruction

S7-1500R/H redundant system

System Manual, 05/2021, A5E41814787-AC 183
Basics of program execution
8.4 Special instructions for S7-1500R/H redundant systems

Example: Disabling/enabling SYNCUP for a baggage handling system

Automation task
A baggage handling system at an airport is used to distribute pieces of baggage. When a
flight lands, all baggage is loaded onto the baggage handling system. The baggage passes
through a scanner at high speed. The scanner checks the destination of the baggage:
• If a piece of baggage has reached its destination airport, the baggage handling system
forwards it directly to baggage claim.
• If a piece of baggage has not reached its final destination, the system immediately
redirects it towards the connecting flight.

① Scanner
② Deflector
Figure 8-3 Airport baggage handling system

To ensure high availability for the baggage handling system, you use an S7-1500R/H
redundant system as controller. If one of the CPUs fails (loss of redundancy), the S7-1500R/H
redundant system switches from the RUN-Redundant system state to RUN-Solo. A CPU
continues to ensure the control of the baggage handling system, but no second redundant
CPU is available.
Replace the failed CPU with a replacement CPU. The procedure for replacing the CPU is
described in the section Replacing defective R/H-CPUs (Page 292).

S7-1500R/H redundant system

184 System Manual, 05/2021, A5E41814787-AC
 Basics of program execution
8.4 Special instructions for S7-1500R/H redundant systems

As soon as you set the exchanged CPU to RUN, the R/H-System responds as follows:
• The replaced CPU (Backup CPU) switches to SYNCUP operating state and sends a
corresponding status message to the primary CPU.
• The primary CPU then switches from the RUN operating state to RUN-Syncup.
• The S7-1500R/H redundant system then does a SYNCUP.
During SYNCUP, the user program of the primary CPU runs through a cycle with an extended
cycle time. In this cycle, there is a delay before the redundant system responds to input signal
changes.
If a piece of baggage passes the scanner during the SYNCUP, the redundant system only
responds to the scanner after the extended cycle described above. In the worst case scenario,
the piece of baggage has already passed the deflector before the system responds. The piece
of baggage is then moved to baggage claim rather than to the connecting flight.

Feature
You need the "RH_CTRL" instruction, which allows you to disable and enable the execution of
the SYNCUP as required.

Solution
You use the "RH_CTRL" instruction to disable the execution of the SYNCUP system state for
the S7-1500RH redundant system. If the disable is no longer required, you enable the
execution of the SYNCUP again with the "RH_CTRL" instruction.
Disable the execution of the SYNCUP to avoid a long program cycle when the baggage
handling system is operating at or near capacity. To do so, call the "RH_CTRL" instruction with
block parameter MODE = 3 in the user program.
Replace the failed CPU with a replacement CPU.
As soon as you set the exchanged CPU with disabled SYNCUP to RUN, the R/H-System
responds as follows:
• The exchanged CPU (Backup CPU) shows the SYNCUP state.
• The Primary CPU then displays the RUN-Syncup state.
• The redundant system switches to the SYNCUP system state. The redundant system is not
yet running a SYNCUP.
As soon as the baggage handling system is operating at low capacity, for example at night,
enable the SYNCUP system state. To do so, call the "RH_CTRL" instruction with block
parameter MODE = 4 in the user program.
The redundant system runs a SYNCUP. The redundant system then switches to the RUN-
Redundant system state. Now disable SYNCUP again by calling the "RH_CTRL" instruction in
the user program with the block parameter MODE = 3.

Reference
You can find additional information on the "RH_CTRL" instruction in the STEP 7 online help.
You can find more information on SYNCUP in the section SYNCUP system state (Page 235).

S7-1500R/H redundant system

System Manual, 05/2021, A5E41814787-AC 185
Basics of program execution
8.4 Special instructions for S7-1500R/H redundant systems

8.4.2 Determining the primary CPU with "RH_GetPrimaryID"

You use the "RH_GetPrimaryID" instruction to read out which CPU is currently the primary
CPU. The instruction outputs the redundancy ID of the primary CPU at the
Ret_Val block parameter.

Figure 8-4 "RH_GetPrimaryID" instruction

Example: Reading maintenance information from the SIMATIC memory card of the primary CPU
Proceed as follows to read specific maintenance information from the SIMATIC memory card
of the primary CPU:
1. Get the redundancy ID of the primary CPU with "RH_GetPrimaryID".
2. Read the maintenance information from the SIMATIC memory card of the primary CPU with
"GetSMCInfo".
– If the CPU with redundancy ID 1 is the primary CPU, enter "12" at the Mode block
parameter ("1" for redundancy ID, "2" for maintenance information).
– If the CPU with redundancy ID 2 is the primary CPU, enter "22" at the Mode block
parameter ("2" for redundancy ID, "2" for maintenance information).

Reference
You can find more information on the "RH_GetPrimaryID" instruction in the STEP 7 online
help.

S7-1500R/H redundant system

186 System Manual, 05/2021, A5E41814787-AC
 Basics of program execution
8.5 Asynchronous instructions

8.5 Asynchronous instructions

Introduction
During program execution a distinction is made between synchronous and asynchronous
instructions.
The "synchronous" and "asynchronous" properties relate to the temporal relationship
between the call and execution of the instruction.
The following applies to synchronous instructions: When the call of a synchronous instruction
is complete, execution of the instruction is also complete.
This is different in the case of asynchronous instructions: When the call of an asynchronous
instruction is complete, execution of the asynchronous instruction is not necessarily complete
yet. This means the execution of an asynchronous instruction can extend over multiple calls.
The CPU processes asynchronous instructions in parallel with the cyclic user program.
Asynchronous instructions generate jobs in the CPU for their processing.
Asynchronous instructions are usually instructions for transferring data, for example data
records for modules, communication data, or diagnostics data.

S7-1500R/H redundant system

System Manual, 05/2021, A5E41814787-AC 187
Basics of program execution
8.5 Asynchronous instructions

Difference between synchronous/asynchronous instructions

The figure below shows the difference between the processing of an asynchronous
instruction and a synchronous instruction. In this figure the CPU calls the asynchronous
instruction five times before its execution is complete, e.g. a data record has been completely
transferred.
With a synchronous instruction, the instruction is fully executed in each call.

① First call of the asynchronous instruction, start of execution

② Intermediate call of the asynchronous instruction, execution continues
③ Last call of the asynchronous instruction, completion of execution
④ A job is fully processed by a synchronous instruction with each call.
Duration of a fully executed job

Figure 8-5 Difference between asynchronous and synchronous instructions

Note
Processing of an asynchronous instruction during the SYNCUP system state
If the S7-1500R/H redundant system executes SYNCUP, this extends the processing time for
an asynchronous instruction.
The dynamic behavior of the system state SYNCUP requires that you call asynchronous
instructions cyclically (e.g. in OB 1).

S7-1500R/H redundant system

188 System Manual, 05/2021, A5E41814787-AC
 Basics of program execution
8.5 Asynchronous instructions

Parallel processing of asynchronous instruction jobs

A CPU can process several asynchronous instruction jobs in parallel. The CPU processes the
jobs in parallel under the following conditions:
• Jobs for an asynchronous instruction are started while other jobs for that instruction are
still running.
• The maximum number of simultaneously running jobs for the instruction is not exceeded.
The figure below shows the parallel processing of two jobs of the WRREC instruction. The two
instructions are executed simultaneously for a certain duration.

Figure 8-6 Parallel processing of the asynchronous instruction WRREC

Note
Dependencies between asynchronous statements
The call sequence in the user program may differ from the processing sequence of the
asynchronous instructions. This can lead to problems with dependencies between
asynchronous instructions.
Solution: To ensure correct timing of processing, use the status outputs of the asynchronous
statements in a sequencer. If an asynchronous instruction is finished and this is
acknowledged via the parameter DONE, then only the next asynchronous instruction should
start.
Example: For the RecipeImport and RecipeExport recipe functions, you need a CSV file for the
recipe data. If you use the same CSV file for import and export, then the two asynchronous
statements are dependent on each other. Link the status of the DONE parameter of the
RecipeImport instruction in a sequencer to the next step where the RecipeExport is executed.
The link thus ensures correct processing.

S7-1500R/H redundant system

System Manual, 05/2021, A5E41814787-AC 189
Basics of program execution
8.5 Asynchronous instructions

Assigning calls of an instruction to a job

To execute an instruction over multiple calls, the CPU must be able to uniquely relate a
subsequent call to a running job of the instruction.
To relate a call to a job, the CPU uses one of the following two mechanisms, depending on
the type of the instruction:
• Using the instance data block of the instruction (for "SFB" type)
• Using the input parameters of the instruction that identify the job. These input parameters
must match in each call during processing of the asynchronous instruction.
Example: The instruction "RD_DPARA" is identified by LADDR and RECNUM.

Status of an asynchronous instruction

An asynchronous instruction shows its status via the block parameters STATUS/RET_VAL and
BUSY. Many asynchronous instructions also use the block parameters DONE and ERROR.
The figure below shows the two asynchronous instructions WRREC and RD_DPARA.

① The input parameter REQ starts the job to execute the asynchronous instruction.
② The output parameter DONE indicates that the job was completed without error.
③ The output parameter BUSY indicates whether the job is currently being executed. When
BUSY=1, a resource is allocated for the asynchronous instruction. When BUSY= 0, the resource
is free.
④ The output parameter ERROR indicates that an error has occurred.
⑤ The output parameter STATUS/RET_VAL provides information on the status of the job execution.
The output parameter STATUS/RET_VAL receives the error information after the occurrence of
an error.

Figure 8-7 Block parameters of asynchronous instructions using the instructions WRREC and
RD_DPARA as examples.

S7-1500R/H redundant system

190 System Manual, 05/2021, A5E41814787-AC
 Basics of program execution
8.5 Asynchronous instructions

Summary
The table below provides you with an overview of the relationships described above. It shows
in particular the possible values of the output parameters if execution of the instruction is not
complete after a call.

Note
The output parameters of an synchronous instruction can change on every call.
You therefore evaluate the relevant output parameters after each call of the asynchronous
instruction.

Table 8- 5 Relationship between REQ, STATUS/RET_VAL, BUSY and DONE during a "running" job.

Seq. no. of the Type of call REQ STATUS/RET_VAL BUSY DONE ERROR
call
1 First call 1 W#16#7001 1 0 0
Error code (e.g. W#16#80C3 for 0 0 1
lack of resources)
2 to (n - 1) Intermediate call Not relevant W#16#7002 1 0 0
n Last call Not relevant W#16#0000, if no errors have 0 1 0
occurred.
Error code if errors occurred. 0 0 1

Use of resources
Asynchronous instructions use resources in the CPU during their execution. The resources are
limited depending on the type of CPU and instruction. The CPU can only simultaneously
process a set maximum number of asynchronous instruction jobs. The resources are available
again after a job has been processed successfully or with errors.
Example: For the RDREC instruction, an S7-1500R/H CPU can process up to 20 jobs in parallel.
If the maximum number of simultaneous jobs for an instruction is exceeded, the following
occurs if another job is started:
• The job is not executed.
• The ERROR output parameter returns a value of 1.
• The STATUS block parameter returns the error code W#16#80C3 (lack of resources).

Note
Lower-level asynchronous instructions
Some asynchronous instructions use one or more lower-level asynchronous instructions for
their processing. This dependence is shown in the tables below.
Please note that each lower-level instruction typically occupies one resource in the
instruction's resource pool.

S7-1500R/H redundant system

System Manual, 05/2021, A5E41814787-AC 191
Basics of program execution
8.5 Asynchronous instructions

Extended instructions: maximum number of simultaneously running jobs

Table 8- 6 Maximum number of simultaneous jobs for asynchronous extended instructions and
lower-level instructions used

Extended instructions 1513R-1 PN 1515R-2 PN 1517H-3 PN 1518HF-4 PN

Distributed I/O
RDREC 20
WRREC 20
ASI_CTRL uses RDREC, WRREC
PROFIenergy
PE_START_END uses RDREC, WRREC
PE_CMD uses RDREC, WRREC
PE_DS3_Write_ET200S uses RDREC, WRREC
PE_WOL uses RDREC, WRREC, TUSEND, TURCV, TCON, TDISCON
Module parameter assignment
RD_DPAR 10
RD_DPARA 10
RD_DPARM 10
Diagnostics
Get_IM_Data 10
GetStationInfo 10
Recipes
RecipeExport 10
RecipeImport 10

Communication: maximum number of simultaneously running jobs

Table 8- 7 Maximum number of simultaneous jobs for asynchronous instructions and

lower-level instructions used for Open User Communication

Open User Communi- 1513R-1 PN 1515R-2 PN 1517H-3 PN 1518HF-4 PN

cation
TSEND 88 108 288 384
TUSEND
TRCV 88 108 288 384
TURCV
TCON 88 108 288 384
TDISCON 88 108 288 384
T_RESET 88 108 288 384
T_DIAG 88 108 288 384
TSEND_C uses TSEND, TUSEND, TRCV, TCON, TDISCON
TRCV_C uses TSEND, TUSEND, TRCV, TURCV, TCON, TDISCON

S7-1500R/H redundant system

192 System Manual, 05/2021, A5E41814787-AC
 Basics of program execution
8.5 Asynchronous instructions

Table 8- 8 Lower-level instructions used for asynchronous instructions for MODBUS TCP

MODBUS TCP 1513R-1 PN 1515R-2 PN 1517H-3 PN 1518HF-4 PN

MB_CLIENT uses TSEND, TUSEND, TRCV, TURCV, TCON, TDISCON
MB_SERVER uses TSEND, TUSEND, TRCV, TURCV, TCON, TDISCON

Table 8- 9 Lower-level instructions used for asynchronous instructions for communications proces-
sors

Communications pro- 1513R-1 PN 1515R-2 PN 1517H-3 PN 1518HF-4 PN

cessors
PtP communication
Port_Config uses RDDEC, WRREC
Send_Config uses RDDEC, WRREC
Receive_Config uses RDDEC, WRREC
Send_P2P uses RDDEC, WRREC
Receive_P2P uses RDDEC, WRREC
Receive_Reset uses RDDEC, WRREC
Signal_Get uses RDDEC, WRREC
Signal_Set uses RDDEC, WRREC
Get_Features uses RDDEC, WRREC
Set_Features uses RDDEC, WRREC
USS communication
USS_Port_Scan uses RDDEC, WRREC
MODBUS (RTU)
Modbus_Comm_Load uses RDDEC, WRREC

Reference
You can find additional information on block parameter assignment in the STEP 7 online help.

S7-1500R/H redundant system

System Manual, 05/2021, A5E41814787-AC 193
Protection 9
9.1 Overview of the protection functions

Introduction
This section describes the functions for protection from unauthorized access:
• Protection of confidential configuration data
• Access protection
• Know-how protection
• Protection by locking the CPUs

Other CPU protective measures

The following measures provide extra protection against unauthorized access from external
sources and through the network:
• Do not activate time-of-day synchronization over NTP servers.
• Do not activate PUT/GET communication.

9.2 Protection of confidential configuration data

As of STEP 7 V17, you have the option of assigning a password for protecting confidential
configuration data of the respective CPU. This refers to data such as private keys that are
required for the proper functioning of certificate-based protocols.
You can find detailed information on protecting confidential configuration data in the
Communication (https://support.industry.siemens.com/cs/ww/en/view/59192925) function
manual.

S7-1500R/H redundant system

System Manual, 05/2021, A5E41814787-AC 194
 Protection
9.3 Configuring access protection for the CPU

9.3 Configuring access protection for the CPU

Introduction
The S7-1500R/H redundant system has four or five different access levels to limit access to
specific functions.
By setting up access levels and passwords, you limit the functions and memory areas that are
accessible without a password. The individual access levels and corresponding passwords are
specified in the object properties of the CPUs.

Rules for passwords

Ensure that passwords are sufficiently secure. Passwords must not follow a machine-
recognizable pattern.
Apply the following rules:
• Assign a password that is at least 8 characters long.
• Use different cases and characters: uppercase/lowercase, numbers and special characters.

Access levels for the CPUs

Table 9- 1 Access levels and access restrictions

Access levels Access restrictions

Full access including Users of STEP 7 and HMI applications have access to all standard and fail-safe functions.
fail-safe (no protec- A password is not required.
tion)
Full access Users of STEP 7 have access to standard functions.
(no protection) HMI applications can access all functions (fail-safe and standard).
Required password: For additional access to the fail-safe functions, the user must enter the pass-
word for "Full access incl. fail-safe" in STEP 7.
Read access In this access level, only read access to the hardware configuration and the blocks is possible without
a password. HMI access and access to diagnostics data is also possible.
Neither blocks nor the hardware configuration can be downloaded to the CPUs without the pass-
word.
The following actions are not possible without the password either: Writing test functions and firm-
ware updates (online).
HMI access The same access restrictions apply to HMI access as to read access.
The following actions are not possible without the password either: Change of operating state
(RUN/STOP/SYNCUP) and display of online/offline comparison status.
No access (complete When the CPUs have complete protection, no read or write access to the hardware configuration or
protection) blocks is possible (without access authorization in the form of a password). HMI access is not possi-
ble either.
Authentication with the correct password provides full access to the CPUs again.

Reference
You can find a list of which functions are possible in the various protection levels in the
STEP 7 online help under "Setting options for protection".

S7-1500R/H redundant system

System Manual, 05/2021, A5E41814787-AC 195
Protection
9.3 Configuring access protection for the CPU

Properties of the access levels

Each access level allows unrestricted access to certain functions without a password, for
example identification using the "Accessible devices" function.
The default setting of the CPUs is "No access (complete protection)". In the default access
level, the user is not allowed to read or modify the hardware configuration or the blocks. To
obtain access to the CPUs, assign parameters alternatively in the properties of the CPU:
• A password for the protection level "No access (complete protection)"
• Another protection level, e.g. "Full access (no protection)".
Communication between the CPUs via the communication functions in the blocks is not
restricted by the access level of the CPUs.
Entering the correct password enables access to all the functions that are allowed in the
given level.

Note
Configuring an access level does not replace know-how protection
Configuring access levels offers a high degree of protection against unauthorized changes to
the CPU through network access. Access levels restrict the rights to download the hardware
and software configuration to the CPUs. However, blocks on the SIMATIC memory card are
not write-protected or read-protected. Use know-how protection to protect the code of blocks
on the SIMATIC memory card.

S7-1500R/H redundant system

196 System Manual, 05/2021, A5E41814787-AC
 Protection
9.3 Configuring access protection for the CPU

Behavior of functions in different access levels

The STEP 7 online help includes a table listing the online functions available in the various
access levels.

Configuring access levels

Proceed as follows to configure the access levels for the CPUs:
1. Open the properties of the CPUs in the Inspector window.
2. Open "Protection & Security" in the area navigation.
A table with the possible access levels appears in the Inspector window.

Figure 9-1 Possible access levels

3. Activate the required protection level in the first column of the table. The green check marks
in the columns to the right of the access level show which operations are still possible
without entering the password. In the example (Figure: Possible access levels), read access
and HMI access are still possible without a password.
4. In the "Enter password" column, specify a password for the access level "Full access" in the
first row. In the "Confirm password" column, enter the selected password again to avoid
incorrect entries.
5. Assign additional passwords as required for other access levels.
6. Download the hardware configuration for the access level to take effect.
The CPUs log the following actions with an entry in the diagnostics buffer:
• Input of the correct or incorrect password
• Changes to access level configuration

S7-1500R/H redundant system

System Manual, 05/2021, A5E41814787-AC 197
Protection
9.3 Configuring access protection for the CPU

Behavior of a password-protected CPU during operation

The protection of the CPUs takes effect for an online connection after you have loaded the
settings into the CPUs. If you set a higher access level and download it to the CPU, all other
online connections will be interrupted. You will then need to establish a new online
connection.
Before an online function is executed, STEP 7 checks the necessary permission and, if
necessary, prompts the user to enter a password. The functions protected by a password can
only be executed by one programming device/PC at any one time. Another programming
device/PC cannot log on.
Access authorization to the protected data applies for the duration of the online connection
or for as long as you have STEP 7 open. The menu command "Online > Clear access rights"
cancels the access authorization.
You can limit access to a password-protected CPU in RUN locally on the display. This prevents
access even with a password.

Access levels for F-CPU

For the fail-safe CPU, there is an additional access level besides the four access levels
described. For additional information on this access level, refer to the description of the fail-
safe system SIMATIC Safety Programming and Operating Manual SIMATIC Safety -
Configuring and Programming
(https://support.industry.siemens.com/cs/ww/en/view/54110126).

S7-1500R/H redundant system

198 System Manual, 05/2021, A5E41814787-AC
 Protection
9.4 Using the display to set additional password protection

9.4 Using the display to set additional password protection

Blocking access to a password-protected CPU

You can block access to password-protected CPUs (local password block) on the CPU display.
The block is effective if the mode selector is set to RUN.
The access block requires a configured protection level in STEP 7 and applies regardless of
password protection. Even if someone accesses the CPUs via a connected PG/PC and has
entered the correct password, access to the CPUs is denied.
Set the access block separately for each access level on the display.
The backup CPU takes over the settings during SYNCUP. Changes to the access block for
primary CPU or backup CPU in RUN-Redundant system state are also applied to the other CPU.

Procedure
If you want to block access to the CPUs via the display, you need to configure an access level
with a password in STEP 7.
If you set local access protection for the CPUs on the display, the block applies to both CPUs in
the RUN-Redundant system state. Proceed as follows:
1. On the display, select the Settings > Protection menu.
2. Confirm your selection with "OK". For each access level, specify whether or not access in the
RUN operating state is allowed:
– Allow: Access to the CPUs is possible with the right password in STEP 7.
– Deactivated in RUN: If the mode selector is set to RUN, no additional logon to the CPUs
is possible with the rights of this access level. Access is denied despite the fact that the
user knows the password. If the operating mode switch is in the STOP position, then
access with the password is enabled again.

Access protection for the display

Configure a password for the display in STEP 7 in the properties of the CPU. This protects local
access protection with a local password.

9.5 Using the user program to set additional access protection

Access protection with the user program

In addition to access protection via the display, you have another option. You can also restrict
access to a password-protected CPU using the ENDIS_PW instruction in STEP 7.
You can find more information on this instruction in the STEP 7 online help under "ENDIS_PW:
Limit and enable password legitimation".

S7-1500R/H redundant system

System Manual, 05/2021, A5E41814787-AC 199
Protection
9.6 Know-how protection

9.6 Know-how protection

Application
You can use know-how protection to protect one or more OB, FB or FC blocks as well as
global data blocks in your program from unauthorized access. To restrict access to a block,
assign a password. The password offers high-level protection against unauthorized reading
and manipulation of the block. Know-how protection does not involve the CPU (offline access
in STEP 7).

Password provider
As an alternative to manual password input, you can assign a password provider to STEP 7.
When using a password provider, you select a password from a list of available passwords.
When a protected block is opened, STEP 7 connects to the password provider and retrieves
the corresponding password.
You need to install and activate a password provider before you can connect it. A settings file
in which you define the use of a password provider is also required.
A password provider offers the following advantages:
• The password provider defines and manages the passwords. When know-how protected
blocks are opened, you work with symbolic names for passwords. For example, a
password is marked with the symbolic name "Machine_1" in the password provider. The
actual password behind "Machine1" is not disclosed to you.
A password provider therefore offers optimum block protection as the users do not know
the password themselves.
• STEP 7 automatically opens know-how protected blocks without the direct entry of a
password. This saves you time.
You can find more information on connecting a password provider in the STEP 7 online help.

Readable data
If a block is know-how protected, only the following data is readable without the correct
password:
• Block title, comments and block properties
• Block parameters (INPUT, OUTPUT, IN, OUT, RETURN)
• Call structure of the program
• Global tags without information on the point of use

S7-1500R/H redundant system

200 System Manual, 05/2021, A5E41814787-AC
 Protection
9.6 Know-how protection

Further actions
Further actions that can be carried out with a know-how protected block:
• Copying and deleting
• Calling in a program
• Online/offline comparison
• Loading

Global data blocks and array data blocks

You protect global data blocks (global DBs) from unauthorized write access with know-how
protection. If you do not have the valid password, you can only read the global data block
without information on the point of use. The global data block cannot be changed, however.
Know-how protection is not available for array data blocks (array DBs).

Setting up block know-how protection

Proceed as follows to set up block know-how protection:
1. Open the properties of the block in question.
2. Select the "Protection" option under "General".

Figure 9-2 Setting up block know-how protection

3. Click "Protection" to display the "Define protection" dialog.

Figure 9-3 Defining protection

4. Enter the new password in the "New password" box. Enter the same password in the
"Confirm password" box.

S7-1500R/H redundant system

System Manual, 05/2021, A5E41814787-AC 201
Protection
9.6 Know-how protection

5. Click "OK" to confirm your entry.

6. Close the "Know-how protection" dialog by clicking "OK".
Result: The blocks selected are know-how-protected. Know-how protected blocks are marked
with a padlock in the project tree. The password entered applies to all blocks selected.

Note
Password provider
Alternatively, you can set up know-how protection for blocks with a password provider.

Opening know-how protected blocks

Proceed as follows to open a know-how protected block:
1. Double-click on the block to open the "Access protection" dialog.
2. Enter the password for the know-how protected block.
3. Click "OK" to confirm your entry.
Result: The know-how-protected block opens.
After opening the block you can edit the program code and the block interface of the block
until you close the block or STEP 7. You need to enter the password again the next time you
open the block. If you close the "Access protection" dialog with "Cancel", the block will open
but the block code will not be displayed. You will not be able to edit the block.
If you copy the block or add it to a library, this does not cancel the know-how protection of
the block. The copies will also be know-how-protected.

Changing block know-how protection

Proceed as follows to change block know-how protection:
1. Select the block for which you want to change know-how protection. The protected block
must not be open in the program editor.
2. In the "Edit" menu, select the "Know-how protection" command to open the "Change
protection" dialog.
3. To change the password for know-how protection, enter the current password under "Old
password".
4. Now enter a new password under "New password" and confirm the password under
"Confirm password".
5. Click "OK" to confirm your entry.
Result: The password for know-how protection of the selected block has been changed.

S7-1500R/H redundant system

202 System Manual, 05/2021, A5E41814787-AC
 Protection
9.6 Know-how protection

Removing block know-how protection

Proceed as follows to remove block know-how protection:
1. Select the block from which you want to remove know-how protection. The protected block
must not be open in the program editor.
2. In the "Edit" menu, select the "Know-how protection" command to open the "Change
protection" dialog.

Figure 9-4 Removing know-how protection

3. To remove block protection, enter the current password under "Old password". Leave the
fields for the new password blank.
4. Click "Remove" to confirm your entry.
Result: Know-how protection for the selected block has been canceled.

S7-1500R/H redundant system

System Manual, 05/2021, A5E41814787-AC 203
Protection
9.7 Protection by locking the CPU

9.7 Protection by locking the CPU

Locking options
Provide additional protection for your CPUs from unauthorized access (for example to the
SIMATIC memory card) by using a secure front cover.
You have the following options, for example:
• Attach a seal
• Secure the front cover with a lock (shackle diameter: 3 mm)

Figure 9-5 Locking latch on a CPU

S7-1500R/H redundant system

204 System Manual, 05/2021, A5E41814787-AC
Commissioning 10
10.1 Overview

Introduction
This section includes information on the following topics:
• Check before powering on for the first time
• Commissioning procedure
• Removing/inserting the SIMATIC Memory Cards
• First power-on of the CPUs
• CPU pairing
• Assigning redundancy IDs
• Downloading projects to the CPUs
• Operating and system states
• CPU memory resets
• Backing up and restoring the configuration
• Time synchronization
• Identification and maintenance data

Commissioning requirements

Note
Performing tests
You must ensure the safety of your plant. You therefore need to run a complete functional
test and make the necessary safety checks before the final commissioning of a plant.
Also allow for any possible foreseeable errors in the tests. This prevents you from putting
persons or equipment at risk during operation.

Software tools for commissioning

SIEMENS PRONETA provides commissioning support. You can find more information on
SIEMENS PRONETA in the section Software (Page 67).

S7-1500R/H redundant system

System Manual, 05/2021, A5E41814787-AC 205
Commissioning
10.2 Check before powering on for the first time

10.2 Check before powering on for the first time

Before the first power-on, check the installation and the wiring of the S7-1500R/H redundant
system.

Questions for checking

The following questions provide instructions for checking your system in the form of a
checklist.

Rack
• Are the mounting rails firmly mounted to the wall, in the frame, or in the cabinet?
• Are the cable ducts correctly installed?
• Have the minimum clearances been observed?

Grounding concept
• Are the mounting rails connected to the protective conductors?
• If applicable, are all further protective conductor connection points on the S7-1500R/H
redundant system connected to the protective conductor? Has the protective conductor
been tested?
• Are the required equipotential bonding cables connected with low impedance to the
relevant sections of the plant?

Module installation and wiring

• Are all the modules inserted / installed in accordance with the installation plan and
configuration with STEP 7 and screwed firmly to the mounting rails?
• Have all synchronization modules been installed and locked in the S7-1500H redundant
system? You should hear the modules click into place in the module slots.
• Are all redundancy connection connectors in the S7-1500H redundant system correctly
connected to the LC sockets? You should hear the connectors click into place in the LC
sockets.
• Are the redundancy connections (PROFINET cable) between the CPUs in the S7-1500R
redundant system connected to the correct ports of PROFINET interface X1? The ports
used must correspond to the configuration in STEP 7.
• Are the PROFINET devices in the S7-1500R/H redundant system connected?

Load current supply

• Are all load current supplies switched off?
• Is the power cable connector correctly wired?
• Has the connection to line voltage been established?

S7-1500R/H redundant system

206 System Manual, 05/2021, A5E41814787-AC
 Commissioning
10.3 Commissioning procedure

10.3 Commissioning procedure

Requirements
• The CPUs are in the "Factory settings" state or have been reset to factory settings. You can
find more information in the section Resetting CPUs to factory settings (Page 309).
• The CPUs have the same or compatible article numbers.
• The SIMATIC memory cards are as delivered or have been formatted and are not write-
protected.
• The two CPUs of the S7-1500R/H redundant system have the same firmware version. You
can find more information in the section Firmware update (Page 304).

Procedure for commissioning SIMATIC S7-1500R/H

To commission the S7-1500R/H redundant system, we recommend the following procedure:

Table 10- 1 Procedure for commissioning SIMATIC S7-1500R/H

Step Procedure Further information

1 Configure hardware in STEP 7 Section Configuration (Page 161)
2 Create user program Section Programming the S7-1500R/H (Page 172) and STEP 7 online
help
3 Insert required modules Section Installation (Page 117)
4 Wire and check configuration (cable for Section Wiring (Page 134)
supply voltage, PROFINET ring, redundancy
connections)
5 Insert SIMATIC memory cards in the CPUs Section Removing/plugging in SIMATIC memory cards (Page 208)
6 Switch on CPUs, optional load current supply Section First power-on of the CPUs (Page 211)
and distributed I/O
7 CPU pairing Section CPU pairing (Page 211)
8 Assign CPUs redundancy IDs Section Redundancy IDs (Page 213)
9 Check LEDs You can find the meaning of the LEDs in the module manuals.
10 Evaluate information on the CPU displays Section CPU display (Page 280)
11 Load hardware configuration and user pro- Section Downloading projects to the CPUs (Page 218)
gram to the CPUs
12 Test inputs and outputs The following functions are helpful: Monitoring and modifying tags,
testing with program status, forcing, controlling the outputs in
STOP. You can find more information in the section Test and service
functions (Page 314).

Procedure for commissioning a SIMATIC Safety F-system

For commissioning, you need the CPUs 1518HF-4 PN. The procedure for commissioning the
F-system is not fundamentally different to commissioning an R/H-system. You use the Safety
Administration Editor to commission SIMATIC Safety and activate safety mode. The Safety
Administration Editor is assigned to the top CPU in the STEP 7 project tree.
You can find additional information on commissioning an F-system SIMATIC Safety and the
Safety Administration Editor in the programming and operating manual
SIMATIC Safety – Configuring and Programming
(https://support.industry.siemens.com/cs/ww/en/view/54110126).

S7-1500R/H redundant system

System Manual, 05/2021, A5E41814787-AC 207
Commissioning
10.3 Commissioning procedure

10.3.1 Removing/plugging in SIMATIC memory cards

Requirements
For the S7-1500R/H redundant system, you need a SIMATIC memory card for each of the two
CPUs.
The CPUs only support pre-formatted SIMATIC memory cards. If required, format the SIMATIC
memory cards before using them in the CPU.
You can find more information on formatting SIMATIC memory cards in the function manual
Structure and use of the CPU memory
(https://support.industry.siemens.com/cs/ww/en/view/59193101).
Make sure that the SIMATIC memory cards of the two CPUs are not write-protected.

Inserting SIMATIC memory cards

Proceed as follows to insert a SIMATIC memory card:
1. Open the front cover of the CPU.
2. Insert the SIMATIC memory card, as shown on the CPU, into the slot for the SIMATIC
memory card.

Figure 10-1 Slot for the SIMATIC memory card

3. Carefully insert the SIMATIC memory card into the CPU, pushing gently, until the card clicks
into place.

S7-1500R/H redundant system

208 System Manual, 05/2021, A5E41814787-AC
 Commissioning
10.3 Commissioning procedure

Removing SIMATIC memory cards

Proceed as follows to remove a SIMATIC memory card:
1. Open the front cover.
2. Switch the CPU to STOP.
3. Gently push the SIMATIC memory card into the CPU. Once it has clicked into place, remove
the SIMATIC memory card.
Only remove the SIMATIC memory card in the POWER OFF or STOP state of the CPU. Ensure
that:
• No writing functions are active in STOP. Writing functions are online functions with the
PG/PC, for example loading/deleting a block and test functions.
• No writing functions were active before POWER OFF
If you remove the SIMATIC memory card during a write process, the following problems can
occur:
• The data contents of a file are incomplete.
• The file is no longer readable, or no longer exists.
• The entire content of the card is corrupted.
Please also note the following FAQs on the Internet
(https://support.industry.siemens.com/cs/ww/en/view/59457183) for removal of the
SIMATIC memory card.

Note
If you switch a CPU in redundant mode to the STOP operating state, the S7-1500R/H
redundant system switches to the RUN-Solo system state. The other CPU maintains control of
the process.

S7-1500R/H redundant system

System Manual, 05/2021, A5E41814787-AC 209
Commissioning
10.3 Commissioning procedure

CPU response after a SIMATIC memory card is removed or inserted

Inserting or removing the SIMATIC memory card in STOP operating state triggers a re-
evaluation of the SIMATIC memory card. The CPU compares the content of the configuration
on the SIMATIC memory card with the backed-up retentive data. If the backed-up retentive
data matches the data of the configuration on the SIMATIC memory card, the retentive data
is retained. If the data differs, the CPU automatically performs a memory reset. A memory
reset deletes the retentive data on the CPU. You can find more information on memory resets
in the section CPU memory reset (Page 263).
The CPU evaluates the SIMATIC memory card. This process is indicated by the RUN/STOP LED
flashing.

Note
Using the SIMATIC memory card as a firmware update card
If you use the SIMATIC memory card as a firmware update card, pulling and plugging the card
will not result in the loss of retentive data.

Reference
You can find more information on the SIMATIC memory card in the function manual Structure
and use of the CPU memory
(https://support.industry.siemens.com/cs/ww/en/view/59193101).

S7-1500R/H redundant system

210 System Manual, 05/2021, A5E41814787-AC
 Commissioning
10.3 Commissioning procedure

10.3.2 First power-on of the CPUs

Requirements
• The SIMATIC S7-1500R/H redundant system has been installed.
• The system has been wired.
• The SIMATIC memory cards are in the CPUs.

Procedure
Proceed as follows to commission the CPUs:
1. Turn on the load current supply.
Result:
• The CPUs run an LED test. All LEDs flash at 2 Hz,
– the RUN/STOP LED flashes alternately yellow/green
– the ERROR-LED red
– the MAINT LED yellow.
• The CPUs run system initialization and evaluate the SIMATIC memory cards:
– The RUN/STOP LED flashes yellow at 2 Hz.
• When system initialization is complete, the CPUs switch to STOP:
– The RUN/STOP LED lights up in yellow.

10.3.3 CPU pairing

Introduction
Pairing is the mutual recognition of the two CPUs within a network. During pairing, the CPUs
exchange information for mutual identification. Example: Checking for matching article
number and firmware version.
Successful pairing of two CPUs is a fundamental requirement for redundant operation.

Requirement
For successful pairing, the CPUs must have the same firmware version and the same or
compatible article numbers.
An invalid configuration variant prevents the pairing of two CPUs, for example more than two
R-CPUs in the PROFINET ring. Pairing errors are reported in the diagnostics buffer.

S7-1500R/H redundant system

System Manual, 05/2021, A5E41814787-AC 211
Commissioning
10.3 Commissioning procedure

Pairing procedure
Proceed as follows to pair two CPUs
1. Create a redundancy connection between two CPUs. Connect the CPUs to the relevant ports
of the interfaces (for example for R-CPUs: X1 P2 R).
2. POWER ON both CPUs.

Loss of pairing
If pairing is already established, an invalid configuration variant will lead to the loss of
pairing. Loss of pairing in RUN system state also causes the loss of synchronization between
primary CPU and backup CPU. The system switches to the RUN-Solo system state.
The primary CPU switches to the RUN operating state and takes on sole control of the
process. The backup CPU switches to the STOP operating state.
In the event of the loss of pairing as a result of the failure of the primary CPU, the backup CPU
becomes the new primary CPU and takes on sole control of the process.

Checking pairing state

You can find out how to check the success of pairing on the display and in STEP 7 in the
section Checking before replacing components (Page 289).

Checking pairing in the RUN-Solo system state

Please observe the following rules if the redundant system is in the RUN-Solo system state:
• Do not immediately start replacing components.
• Do not immediately switch the failed CPU to the RUN operating state.
First check the pairing status in the RUN-Solo system state.

CAUTION
Do not switch the failed CPU in the RUN-Solo system state to the RUN operating state.
This could result in an undefined system state for the redundant system. Both CPUs would
become primary CPUs.
If the S7-1500R/H redundant system is in the RUN-Solo system state, you must not
immediately switch the backup CPU to the RUN operating state.
Possible cause: No pairing between the two CPUs. Check the pairing status on the display or
on the basis of the diagnostics status or diagnostics buffer.
If there is no pairing, the redundancy connections have been interrupted. Follow the
procedure described in the section Checking before replacing components (Page 289).

S7-1500R/H redundant system

212 System Manual, 05/2021, A5E41814787-AC
 Commissioning
10.3 Commissioning procedure

Primary and backup CPU role assignment

The primary CPU and backup CPU roles are assigned by the S7-1500R/H redundant system
during pairing.
The redundant system always attempts to restore the previous roles of the R/H CP. The
following applies here: The CPU that last controlled the process becomes the primary CPU.
Requirement: The system time has been set correctly.
After restoring the factory settings, the redundant system assigns the roles according to the
following criteria:
The redundant system compares the following criteria of the two SIMATIC memory cards and
prioritizes the assignment of roles:
• SIMATIC memory card contains a STEP 7 project
→ High priority
• SIMATIC memory card is empty and writable
→ Medium priority
• SIMATIC memory card:
– missing or
– inserted, is empty or is not writable
→ Low priority

Result:
If the two R/H CPUs have different priorities, the CPU with the higher priority becomes the
primary CPU.
If the priorities are identical, the R/H CPU with the lower CPU serial number becomes the
primary CPU (see nameplate on the CPU or on the CPU display).

Note
If an R/H CPU is in RUN mode, the assigned role does not change when pairing again.

10.3.4 Redundancy IDs

Introduction
For redundant operation, the two CPUs in the redundant system must process identical
project data. In SYNCUP, the operating system copies the content of the SIMATIC memory
card from the primary CPU to the backup CPU.
The load memories contain the project data of both CPUs. This duplication of the project data
is necessary for ensuring redundant operation. By assigning the redundancy IDs, you define
which project data a CPU uses for itself.

S7-1500R/H redundant system

System Manual, 05/2021, A5E41814787-AC 213
Commissioning
10.3 Commissioning procedure

Redundancy IDs 1 and 2

Redundant operation is only possible if the two CPUs have different redundancy IDs. The
redundancy IDs can have values of 1 and 2. The CPUs save the redundancy IDs in their
retentive data areas.
Both CPUs have redundancy ID 1 in the following cases:
• Default setting upon initial commissioning
• After reset to factory settings
In the STEP 7 project tree, each of the two CPUS is displayed with its own tree. The
redundancy ID is used to assign a project tree to the real CPU in STEP 7. The upper CPU of the
two CPUs in the project tree always has a redundancy ID of 1. The lower CPU of the two
always has a redundancy ID of 2.
Diagnostics displays are assigned to the real CPUs in the project tree in the same way.

Figure 10-2 Assignment of the redundancy IDs between project tree and real configuration

Assigning redundancy IDs to CPUs in the configuration

Requirement: The CPUs have the same firmware version and the same or compatible article
numbers.
You have the following options for assigning different redundancy IDs to the CPUs:
• Automatic assignment
• Assignment using the display

S7-1500R/H redundant system

214 System Manual, 05/2021, A5E41814787-AC
 Commissioning
10.3 Commissioning procedure

Automatic assignment

Requirement:
Both real CPUs of the redundant system have the same redundancy ID (e.g."1").

Options for automatic assignment:

• Both CPUs are in STOP. There is pairing between the two CPUs. The ERROR LEDs are
flashing red.
Procedure: Switch the left-hand CPU in the configuration to the RUN operating state.
Result: The right-hand CPU in the configuration changes its redundancy ID.
• The left-hand CPU in the configuration is in RUN operating state. The right-hand CPU in
the configuration is in STOP. Both redundancy connections are separated, therefore there
is no pairing between the two CPUs.
Procedure: Implement pairing between the two CPUs by establishing at least one
redundancy connection. Result: The right-hand CPU in the configuration changes its
redundancy ID.
• The left-hand CPU in the configuration is in RUN. The right-hand CPU in the configuration
is in POWER OFF. At least one redundancy connection is established. There is no pairing
between the two CPUs due to POWER OFF.
Procedure: POWER ON the right-hand CPU in the configuration. Result: The right-hand
CPU in the configuration changes its redundancy ID.

Assignment using the display

Requirements:
The two real CPUs in the redundant system:
• Are connected to each other
• Have redundancy ID 1
• The mode switches of the CPUs are in the STOP position
• Both CPUs are in POWER OFF mode

S7-1500R/H redundant system

System Manual, 05/2021, A5E41814787-AC 215
Commissioning
10.3 Commissioning procedure

Procedure:
Proceed as follows to assign the redundancy IDs via the CPU display:
1. POWER ON the CPU to which you want to assign redundancy ID 2.
2. On the display of that CPU, select the menu command "Overview > Redundancy". Assign the
CPU redundancy ID 2.
Once you have assigned the CPU redundancy ID 2, the CPU will automatically restart.
3. Switch the other CPU POWER OFF.
4. Download the project and the hardware configuration to the CPU that you want to switch to
RUN first.

Figure 10-3 Assigning redundancy IDs

Reading redundancy IDs from the display

As well as assigning redundancy IDs over the display, you can read out the redundancy ID
with the menu command "Overview > Redundancy". The display always shows the
redundancy ID of the CPU on whose display you query the redundancy ID.

S7-1500R/H redundant system

216 System Manual, 05/2021, A5E41814787-AC
 Commissioning
10.3 Commissioning procedure

Switching redundancy IDs over the display

Since each of the CPUs already has its own redundancy ID, you can exchange the redundancy
IDs of the CPUs for each other if required.
Switching redundancy IDs can, for example, be useful in the following situations:
• You only have access to one of the two CPUs.
• You have incorrectly assigned the redundancy IDs.

Note
Switching the redundancy IDs switches the assignment of the real CPUs to the project
trees in the project navigation.
If the two real CPUs contain the same project, switching the redundancy IDs switches all
configured properties between the CPUs. These include, for example, the IP addresses of the
PROFINET interfaces, the device names and the configured topology.

On the display, you can exchange on only one CPU the redundancy IDs already assigned for
both CPUs.
Proceed as follows to switch the redundancy IDs:
1. Make sure that both CPUs are in STOP operating state:
2. Make sure that the two CPUs are connected to each other.
3. Change the redundancy ID of a CPU using the display.
Result: Once the redundancy ID has been changed on one CPU, both CPUs restart and each
now has the previous redundancy ID of the other.

Incompatible assignment of redundancy IDs

There is pairing between the two CPUs. You can find more information in the section CPU
pairing (Page 211).
In the following case, the redundant system automatically checks the compatibility of the
redundancy IDs:
• Both CPUs are in STOP operating state and they have the same redundancy ID.
If the same redundancy ID has been assigned to both CPUs, the ERROR LEDs on both CPUs
flash in red. Each CPU display indicates an assignment conflict (symbol ). The CPUs
generate an entry in the diagnostics buffer. You can read the entry on the display, for
example.
To establish redundant mode, resolve the assignment conflict in one of the following ways:
• Assign a different redundancy ID to one CPU using the display.
• Switch the CPU that is to retain its assigned redundancy ID to the RUN operating state.

Behavior of the CPUs when redundancy IDs are changed

Please note that you can only change the redundancy ID of a CPU in STOP operating state.
After each successful change of a redundancy ID, the CPU in question automatically restarts.

S7-1500R/H redundant system

System Manual, 05/2021, A5E41814787-AC 217
Commissioning
10.3 Commissioning procedure

10.3.5 Downloading projects to the CPUs

Introduction
You need to download the project data to the CPU. Download either offline using the
SIMATIC memory card or over an online connection from the PG/PC/HMI device to a CPU. The
complete project data (all configuration data and the complete user program) can only be
downloaded when a CPU is in STOP operating state.

Note
Simultaneous online access to both CPUs
Simultaneous online access to both CPUs from STEP 7 is not possible. You can access either
the primary CPU or the backup CPU.

Options for downloading

To download project data into the S7-1500R/H redundant system, you have the following
options:

In the STOP system state, download:

• The complete project data to the primary CPU
• The complete project data to the backup CPU

In the RUN-Solo system state, download:

• The user program to the primary CPU
• The complete project data to the backup CPU

In the RUN-Redundant system state, download:

• the modified user program into the redundant system.

Note
Loading in the RUN-Redundant system state: Check for sufficient free space before a
write function
Before a write function is performed, the system checks whether there is enough free space
on the SIMATIC memory cards of the CPUs for the function. Write functions are online
functions with the PG/PC, e.g. test functions, loading a modified user program in the
RUN-Redundant system state.
If there is not enough space on a SIMATIC memory card or on both SIMATIC memory cards,
the write function is aborted and the redundant system continues operation with the original
configuration. The redundant system will remain in the RUN-Redundant system state.

S7-1500R/H redundant system

218 System Manual, 05/2021, A5E41814787-AC
 Commissioning
10.3 Commissioning procedure

Note
Password for confidential configuration data
With S7-1500R/H CPUs, the password for confidential PLC configuration data is only loaded
onto one of the two CPUs during loading. In order that the SYNCUP process works and that
the partner CPU also works properly, the password must be transferred to the partner CPU
before the SYNCUP, using the Online and Diagnostics editor:
• In the Online and diagnostics view, you specify the area "Password to protect confidential
PLC configuration data".
• Enter the required password and click the "Set" button. If the correct password has been
entered, the partner CPU can use the protected PLC configuration data and start the
SYNCUP process.

Note
Loading the safety program with an F-system SIMATIC Safety with the
1518HF-4 PN CPUs
You can find the exact procedure in the SIMATIC Safety - Configuring and Programming
(https://support.industry.siemens.com/cs/ww/EN/view/54110126) programming and
operating manual.

Downloading project data to the CPU

By default, the project data is downloaded to the primary CPU.

Procedure
Proceed as follows:
1. Right-click to select the S7-1500R/H system in the project tree.
2. Select the "Download to device" > "Hardware and software (changes only)" command from
the shortcut menu.
The "Extended download" dialog window shows the addresses of the configured CPUs in the
"Configured access nodes of..." table.
1. Select the subnet from the "Type of the PG/PC interface" drop-down lists.
2. Select the adapter at the "PG/PC interface".
3. Select the interface to which the PG/PC is connected from the "Connection to
interface/subnet" drop-down list. Alternatively, select the entry "Try all interfaces".

S7-1500R/H redundant system

System Manual, 05/2021, A5E41814787-AC 219
Commissioning
10.3 Commissioning procedure

4. Then click on the "Start search" button.

Figure 10-4 "Extended download" dialog window (primary CPU)

The "Select target device" table shows the CPUs in the S7-1500R/H system and their roles.
The primary CPU is already selected. Requirement: You have already assigned the
IP addresses using the displays of the CPU (for example for commissioning) or over
accessible devices in STEP 7.
5. Click "Load".

Note
Remember the redundancy IDs of the CPUs in the configuration:
• The real CPU with redundancy ID 1 uses the project data of the top CPU in the STEP 7
project tree.
• The real CPU with redundancy ID 2 uses the project data of the bottom CPU in the STEP 7
project tree.
You read out the redundancy ID of a CPU over the display with the menu command
"Overview > Redundancy". You can find more information on assigning redundancy IDs in the
section Redundancy IDs (Page 213).

"Load preview" dialog window

If necessary, the project data is compiled before the download. You can only load project data
that is consistent and has been compiled without errors.
The "Load preview" dialog window sets out the key information on the load process to be run:

Procedure
1. After compilation, check the messages in the "Load preview" dialog window.
2. If the S7-1500R/H system is not in STOP, stop the system. To do so, select "Stop RH system"
in the "Action" column of the drop-down menu.
3. Click the "Download" button to start the download.

S7-1500R/H redundant system

220 System Manual, 05/2021, A5E41814787-AC
 Commissioning
10.3 Commissioning procedure

Starting the CPU after loading

The "Results of loading" dialog window displays the results of the loading process.

WARNING
CPU startup with user program with errors
Before starting the CPU, make sure that a user program with errors:
• Cannot cause damage or injury
• Will not lead to dangerous system states

Requirement
The CPU mode selector is in the RUN position.

Procedure
1. To start the primary CPU after loading is complete, select "Start module" in the "Action"
column.
2. To complete loading, click "Finish".
Result: The primary CPU switches to the RUN operating state.
3. Switch the backup CPU to the RUN operating state.
Result: After successful SYNCUP, the S7-1500R/H system switches to redundant mode.

Note
Role change during loading
Beware of a possible role change between primary and backup CPU shortly before, during or
after loading.
A role change can occur during loading if the primary CPU fails (power failure, hardware
defect) or is in STOP and:
• You switch the backup CPU to RUN operating state during this time using the mode
selector, the display or a communication command.
or
• You switch on the backup CPU during this time.
In the event of a role change, the new primary CPU starts up with the old project data. The
new project data in the backup CPU is overwritten with the old project data during
synchronization of the two CPUs for redundant operation.

S7-1500R/H redundant system

System Manual, 05/2021, A5E41814787-AC 221
Commissioning
10.3 Commissioning procedure

Downloading project data to the backup CPU

By default, the project data is downloaded to the primary CPU. In the SYNCUP system state,
the project data is then transferred from the primary CPU to the backup CPU.
You can also download the project data to the backup CPU. This makes sense if the
backup CPU is to be primary CPU with its project data upon a restart.

Requirement
The backup CPU is in STOP mode.

Procedure:
1. Download the project data to the backup CPU. The primary CPU continues to control the
process.
2. Switch the primary CPU to the STOP operating state after loading.
3. Switch the backup CPU to the RUN operating state. It becomes the new primary CPU and
controls the process on its own with the newly loaded user program in the RUN-Solo system
state.
4. Switch the new backup CPU to the RUN operating state.
Result: The system state is RUN-Redundant.

Note
Please note the following during download to the backup CPU:
If the project uses retentive data, the backup CPU runs with its data which may be outdated.

Detailed procedure for download to the backup CPU:

1. Right-click to select the S7-1500R/H system in the project tree.
2. Select "Hardware and software (changes only)" under "Download to backup CPU".
The backup CPU is now selected instead of the primary CPU in the "Extended download"
dialog window.

Figure 10-5 "Extended download" dialog window (backup CPU)

S7-1500R/H redundant system

222 System Manual, 05/2021, A5E41814787-AC
 Commissioning
10.3 Commissioning procedure

Load user program in RUN-Solo system state

The redundant system is in the RUN-Redundant system state. You can download a modified
user program to the primary CPU.
Advantages:
• During downloading, the primary CPU maintains control of the process. The plant remains
in operation.
• Restore the previous user program:
After loading in the RUN-Solo operating mode, the backup CPU is in the STOP mode The
previous user program is still on the backup CPU.
If you want to restore the previous user program, then switch the primary CPU to the STOP
operating mode and then the backup CPU to the RUN operating state. Result: The backup
CPU with the previous user program starts as primary CPU.
Then switch the backup CPU to the RUN operating state. Result: The redundant system
with the previous user program is in the system state Run-Redundant.

Note
If you restore the previous user program, the procedure describes leads to the STOP
system of the redundant system.

Procedure
Proceed as follows to download the user program in RUN:
1. Switch the backup CPU to the STOP operating state. The S7-1500R/H system switches to
RUN-Solo system state.
2. Download the modified user program to the primary CPU with "Download to device" >
"Software (changes only)". The primary CPU continues to control the process.
3. Switch the backup CPU to the RUN operating state.
The primary CPU remains in the RUN operating state and synchronizes the modified user
program with the backup CPU in SYNCUP.
Result: The S7-1500R/H system switches back to redundant mode with the modified user
program.

S7-1500R/H redundant system

System Manual, 05/2021, A5E41814787-AC 223
Commissioning
10.3 Commissioning procedure

Downloading a modified user program in RUN-Redundant system state

From firmware version V2.8 of the R/H CPUs, you can download a modified user program in
RUN-Redundant system state. If no error messages are issued during the download process,
the modified user program is then downloaded into the redundant system.
Advantage: The redundant system remains in the RUN-Redundant system state during the
download.

Changes in the user program

The redundant system remains in the RUN-Redundant system state during the download
process when the following changes are made to the user program:

Table 10- 2 Loading changes in the RUN-Redundant system state

User program Action Feature to note

Text lists (alarms) New, Change -
Comments New, Change, Delete Exception: Comments in the hardware con-
figuration
Blocks Consistent loading of multiple changes -
OB New, Change, Delete, Change properties -
FB, FC, DB, user data type UDT New, Change, Delete -
FB, FC Change code, Change interface -
DB Change properties (change "Optimized -
block access" attribute)
New Actual values in the new data blocks are set to
start values.
Change name/type of tags, add or delete Actual values of tags in the structurally modi-
tags (memory reserve not enabled) fied data blocks are set to start values.
Add new tags (memory reserve activated) Actual values of added tags within the
memory reserve are set to start values.
PLC tags Add (timers, counters, bit memories) -

Note
Response time when downloading a modified user program into the R/H CPUs in the
RUN-Redundant system state
During the download process in the RUN-Redundant system state, the response time of the
system is restricted compared with the normal redundant mode. The more changes the user
program contains, the higher the impact on the response time.

Requirements
• Possible as of firmware version V2.8
• SIMATIC memory cards of the R/H CPUs with sufficient free storage space
• The redundant system is in the RUN-Redundant system state.

S7-1500R/H redundant system

224 System Manual, 05/2021, A5E41814787-AC
 Commissioning
10.3 Commissioning procedure

Procedure
There are various ways of downloading the modified user program in RUN-Redundant system
state:

Options for downloading Proceed as follows to download the modified user program in the
in the RUN-Redundant RUN-Redundant system state:
system state
Downloading the modified 1. Select the program folder or the blocks of the modified user program
user program to the pri- in the project tree.
mary CPU
2. Select the "Download to device" button or select the "Online > Down-
load to device" menu command.
1. Select the S7-1500R/H system in the project navigation.
2. Press the right mouse button. Select the "Download to device" >
"Software (only changes)" command from the shortcut menu.
Downloading the modified 1. Select the S7-1500R/H system in the project navigation.
user program to the back-
up CPU 2. Press the right mouse button. Select the "Download to backup CPU" >
"Software (only changes)" command from the shortcut menu.

Result: The redundant system remains in the RUN-Redundant system state with the modified
user program.

Note
The redundant system remains in the RUN-Redundant system state only with the menu
command "Download to device" > "Software (only changes)".
The following menu can subsequently stop the redundant system:
• "Download to device" > "Hardware configuration"
• "Download to device" > "Software (all blocks)"
• Download to device >" Hardware and software" (only changes)

S7-1500R/H redundant system

System Manual, 05/2021, A5E41814787-AC 225
Commissioning
10.4 Operating and system states

10.4 Operating and system states

10.4.1 Overview

Operating states
Operating states describe the behavior of an individual CPU at a specific time. Knowledge of
the operating states of the CPUs is useful for programming startup, testing and error
diagnostics. The status LEDs on the front of the CPU and the CPU display indicate the current
operating state.
Like standard S7-1500 CPUs, the S7-1500R/H CPUs have the operating states STOP, STARTUP
and RUN. For operation as redundant system, one of the two CPUs can take on an additional
operating state, SYNCUP, for synchronizing the two subsystems. The RUN operating mode is
divided into the following states for redundant systems:
• RUN
• RUN-Syncup
• RUN-Redundant.

System states
The system states enable the direct assessment of the behavior of a redundant system. They
result from the combination of the operating states of the individual CPUs.
• STOP
• STARTUP
• RUN-Solo
• SYNCUP
• RUN-Redundant

S7-1500R/H redundant system

226 System Manual, 05/2021, A5E41814787-AC
 Commissioning
10.4 Operating and system states

Event-controlled synchronization
Event-controlled synchronization ensures that both CPUs in a redundant system can operate
redundantly (RUN-Redundant system state).
For all events that could result in different internal subsystem states, the operating system
automatically synchronizes the data of the primary and backup CPU.
Primary and backup CPU are, for example, synchronized in the event of:
• Direct access to the IO devices
• Events that interrupt cyclic program execution
• Updates to user times, for example S7 timer
• Updates to the process image
• Changes to data through communication functions
• Access to data that could be different on the different CPUs, for example current time,
system time, or runtime messages

Synchronization for redundant mode

In the SYNCUP system state, the operating system synchronizes the user programs in the two
CPUs for redundant operation.
Synchronization ensures that both CPUs can operate redundantly. In the event of failure of
the primary CPU in redundant operation, the backup CPU takes over control of the process as
the new primary CPU at the point of interruption.

Requirements for achieving a redundant system state

If the following requirements are met, the redundant system reaches the RUN-Redundant
system state:
• The requirements for use of the S7-1500R/H redundant system have been met (see
section Application planning (Page 69)).
• The two CPUs of the redundant system have recognized each other, which means pairing
was successful (see section CPU pairing (Page 211));
• You have commissioned the system as detailed in the section Commissioning procedure
(Page 207).

S7-1500R/H redundant system

System Manual, 05/2021, A5E41814787-AC 227
Commissioning
10.4 Operating and system states

Overview of system and operating states

The figure below shows the possible operating states of the CPUs and the resulting system
states.
In general, the two CPUs have equal priority; each CPU can be either primary or backup.

S7-1500R/H redundant system

228 System Manual, 05/2021, A5E41814787-AC
 Commissioning
10.4 Operating and system states

Figure 10-6 System and operating states

The following table provides you with an overview of how the redundant system starts and at
the same time runs through the various operating modes and system states. The following
initial situation and steps are an example.
The operating and system states are described in detail in the following sections.

Table 10- 3 Redundant system startup

No. in Primary CPU System state Backup CPU

diagram
Initial situation: Both CPUs are in STOP operating state. The mode selectors are also in the STOP position.
Step 1: Switch the mode selector of the CPU that is to be primary CPU from STOP to RUN.
① The CPU switches to STARTUP and STOP → STARTUP The CPU remains in STOP mode.
executes startup OB 100 and
other available startup OBs.
② Following successful STARTUP, STARTUP → RUN-Solo The CPU remains in STOP mode.
the CPU switches to RUN.
The CPU runs like a standard CPU
in RUN and executes the user
program.
Step 2: Switch the mode selector on the backup CPU from STOP to RUN.
③ RUN → RUN-Syncup RUN-Solo → SYNCUP STOP → SYNCUP
The two user programs are synchronized for redundant mode. The primary CPU copies the contents of the
load and work memory to the backup CPU. The backup CPU catches up with user program processing on the
primary CPU. After successful synchronization, the memory content is identical on the two CPUs.
④ RUN-Syncup → RUN-Redundant SYNCUP → RUN-Redundant SYNCUP → RUN-Redundant
After the SYNCUP CPUs go to RUN-Redundant mode. Both CPUs process the user program synchronously.
OB 72 is also triggered by the state transition. You can find additional information on the OB 72 in the section
Programming the S7-1500R/H (Page 207).

See also
Programming the S7-1500R/H (Page 172)

S7-1500R/H redundant system

System Manual, 05/2021, A5E41814787-AC 229
Commissioning
10.4 Operating and system states

10.4.2 STARTUP operating state

Startup processing (in the primary CPU only)

STARTUP is only executed by the primary CPU.
In STARTUP, the primary CPU behaves just like an S7-1500R/H standard CPU.

Response
Before the CPU starts to execute the cyclic user program, a startup program is executed.
By suitably programming startup OBs, you can initialize variable tags for your cyclic program
in the startup routine. You can program one or more startup OBs, or none at all.

Points to note
• All outputs are disabled or respond as configured for the given module: They provide a
configured substitute value or retain the last value output and switch the controlled
process to a safe operating state.
• The process image is initialized.
• The process image is not updated.
To read the current state of inputs during STARTUP, you can access inputs with direct
I/O access.
To initialize outputs during STARTUP, you can write values via the process image or with
direct I/O access. However, the values are first output at the outputs during the transition
to the RUN operating mode.
• The CPU always starts up in warm restart mode.
– If you define data as retentive, its content is retained beyond program startup after
STOP or a power failure.
– The non-retentive bit memories, timers and counters are initialized.
– The non-retentive tags in data blocks are initialized.
• During STARTUP, cycle time monitoring is not yet running.
• The CPU processes the startup OBs in the order of the startup OB numbers. The
CPU processes all programmed startup OBs regardless of the selected startup type (Figure
"Setting the startup behavior").
• If a relevant event occurs, the CPU can start the following OBs in startup:
– OB 82: Diagnostics interrupt
– OB 83: Removal/insertion of modules
– OB 86: Rack error
– OB 121: Programming error (only for global error handling)
– OB 122: I/O access error (only for global error handling)
You can find a description of how to use global and local error handling in the STEP 7
online help.
The CPU does not start all other OBs until the transition to the RUN operating state.

S7-1500R/H redundant system

230 System Manual, 05/2021, A5E41814787-AC
 Commissioning
10.4 Operating and system states

Behavior when expected and actual configurations do not match

The configuration downloaded to the CPU is the expected configuration. The actual
configuration is the actual, physical configuration of the automation system. If the expected
configuration and actual configuration differ, the hardware compatibility setting defines the
behavior of the CPU.

Aborting or not running startup

If errors occur during startup, the CPU aborts STARTUP and returns to the STOP operating
state.
The CPU does not perform STARTUP under the following conditions:
• You have not inserted a SIMATIC memory card or an invalid one is inserted.
• You have not downloaded a hardware configuration to the CPU.

S7-1500R/H redundant system

System Manual, 05/2021, A5E41814787-AC 231
Commissioning
10.4 Operating and system states

Configuring startup behavior

You configure the behavior of the CPU in STEP 7 in the "Startup" group of the CPU properties.
Proceed as follows to set the startup behavior:
1. Select the CPU in the device view of the STEP 7 hardware network editor.
2. In the properties, select the "Startup" area.

Figure 10-7 Setting the startup behavior

① Sets the startup type after POWER ON

② Defines the startup behavior for the event that a module in a slot does not correspond to
the configured module. This parameter applies to the CPU and to all the modules for
which no other setting has been selected.
• Startup CPU only if compatible: In this setting, a module in a configured slot must be
compatible with the configured module. Compatible means that the module matches
the configured module in terms of:
– The number of inputs and outputs
– The electrical and functional properties
• Startup CPU even if mismatch: With this setting, the CPU starts up irrespective of the
type of module inserted.
③ Specifies a maximum period (default: 60 000 ms) in which the distributed I/O must be
ready for operation.
If the distributed I/O is ready for operation within the configuration time, the CPU
switches to RUN.
If the distributed I/O is not ready for operation within the configuration time, the startup
behavior of the CPU depends on the hardware compatibility setting.

S7-1500R/H redundant system

232 System Manual, 05/2021, A5E41814787-AC
 Commissioning
10.4 Operating and system states

10.4.3 STOP operating state

Response
The CPU does not execute the user program in the STOP operating state.
All outputs are disabled or respond as configured for the given module if both CPUs are in
STOP operating state: They provide a configured substitute value or retain the last value
output and thus hold the controlled process in a safe operating state.

Points to note
The backup CPU establishes no connections to the IO devices in the STOP operating state.
The primary CPU establishes connections to the IO devices in the STOP operating state. The
primary CPU activates the system IP address even in the STOP operating state if the system
IP address has been configured.
If both CPUs are in STOP and you download a configuration to one CPU, note the following:
• You have not downloaded a configuration to the backup CPU and the backup CPU should
become the primary CPU:
Switch the backup CPU to the primary CPU (either in the event dialog of the download
process or via the mode switch of the CPU).
• Downloading to the primary CPU configures the connected IO devices in line with the
downloaded hardware configuration, even in STOP operating state.

10.4.4 SYNCUP operating state

SYNCUP operating state (only in the backup CPU)

In the SYNCUP operating state, the operating system synchronizes the backup CPU with the
primary CPU. The primary CPU is in the RUN-Syncup operating state and controls the process.
Unlike the primary CPU, the backup CPU does not go through the STARTUP operating state.
You can find more information in the section SYNCUP system state (Page 235).

Points to note
You have only limited access to online functions during SYNCUP. You can find more
information in the section Test functions (Page 314).

S7-1500R/H redundant system

System Manual, 05/2021, A5E41814787-AC 233
Commissioning
10.4 Operating and system states

10.4.5 RUN operating states

RUN operating states

The primary CPU goes through multiple operating states before reaching the RUN-Redundant
system state:
• RUN
• RUN-Syncup
• RUN-Redundant
The backup CPU only has the RUN-Redundant operating state.

Response
In the RUN operating state, the primary CPU behaves just like an S7-1500 standard CPU. It
performs cyclic, time-driven and interrupt-driven program execution on its own.
Addresses that are in the "Automatic update" process image are automatically updated in
each program cycle. You can find more information in the section Process images and
process image partitions (Page 169).
Once the CPU has written the outputs and read the inputs, it runs through the cyclic program
from the first instruction to the last instruction. Events with a higher priority such as
hardware interrupts, diagnostic interrupts and communication can interrupt the cyclic
program flow and prolong the cycle time.
If you have configured a minimum cycle time, the CPU does not terminate the cycle until
after this minimum cycle time has expired, even if the user program is completed sooner.
The operating system monitors the runtime of the cyclic program on the basis of a
configurable upper limit known as the maximum cycle time. You can restart this time
monitoring at any point in your program by calling the RE_TRIGR instruction.
If the cyclic program exceeds the maximum cycle time, the operating system may start the
time error OB (OB 80). You can find additional information in the section Start events
(Page 177).

Points to note in the RUN operating state

In non-redundant operation, the CPUs are independent of each other. They can have
different projects.

RUN-Syncup operating state

In the RUN-Syncup operating state, the backup CPU synchronizes with the primary CPU. The
SYNCUP that temporarily affects the primary CPU (for example delay of asynchronous
services, cycle time extension through transfer of the load and work memory contents) runs
simultaneously in the backup CPU. You can find more information in the section
SYNCUP system state (Page 235).

RUN-Redundant operating state

The redundant system is in the RUN-Redundant system state. Both CPUs process the user
program synchronously.

S7-1500R/H redundant system

234 System Manual, 05/2021, A5E41814787-AC
 Commissioning
10.4 Operating and system states

10.4.6 SYNCUP system state

Requirements
• The article numbers and firmware versions of the two CPUs are the same.
• There is a SIMATIC memory card in each CPU.
• The PROFINET ring is closed.
• There is at least one redundancy connection (fiber-optic cable) in the S7-1500H redundant
system.
• Media redundancy role:
– The two CPUs have the media redundancy role "Manager (auto)".
– All other devices in the PROFINET ring have the media redundancy role "Client".
• Pairing for the two CPUs has been implemented.
• The primary CPU is in the RUN operating state.
• The execution of SYNCUP is not disabled (default setting).
• No load functions are running.
• Testing with breakpoints is not used.
No SYNCUP is performed during testing with breakpoints. You will find more information
on testing with breakpoints in the STEP 7 online help.

SYNCUP system state

Synchronization in the SYNCUP system state ensures that the two CPUs can operate
redundantly. With the SYNCUP system state, the redundant system switches from RUN-Solo
to the RUN-Redundant system state. Afterwards, both CPUs synchronously process the same
user program.

S7-1500R/H redundant system

System Manual, 05/2021, A5E41814787-AC 235
Commissioning
10.4 Operating and system states

Starting SYNCUP
The initial situation is the RUN-Solo system state. The primary CPU of a redundant system is in
the RUN operating state and the backup CPU is in the STOP operating state.
The operating states are shown on the displays:

Table 10- 4 Starting SYNCUP

Primary CPU Backup CPU

Start SYNCUP by:

• Starting the backup CPU via the PG/PC/HMI device or the display, and the mode selector is
set to RUN.
or
• Switching the mode selector on the backup CPU from STOP to RUN.
or
• Powering on the backup CPU (mode selector to RUN).

S7-1500R/H redundant system

236 System Manual, 05/2021, A5E41814787-AC
 Commissioning
10.4 Operating and system states

Preparing the SYNCUP system state

After SYNCUP starts, the CPUs prepare SYNCUP:
• The backup CPU switches to SYNCUP operating state and sends a status message to the
primary CPU.
• The primary CPU then switches from the RUN operating state to RUN-Syncup.
The current operating states are shown on the displays:

Table 10- 5 Preparing SYNCUP

Primary CPU Backup CPU

Sequence of the SYNCUP system state

The operating systems of the two CPUs run through SYNCUP in five phases:
• Copying the SIMATIC memory card ①
• Restart of the backup CPU ②
• Finishing tasks ③
• Copying the work memory ④
• Making up backup CPU lag ⑤
The display of the primary CPU shows you the current phase of the SYNCUP system state.
The display of the backup CPU shows "Connect..." state during the phases ② to ⑤ until the
RUN-Redundant system state is reached.

S7-1500R/H redundant system

System Manual, 05/2021, A5E41814787-AC 237
Commissioning
10.4 Operating and system states

① Copying the SIMATIC memory card

The primary CPU copies parts of the load memory to the backup CPU:
• User program, system blocks and project data of the CPU from the \SIMATIC.S7S folder

Note
Overwriting load memory content
Copying overwrites the load memory contents on the SIMATIC memory card of the backup
CPU with the content of the primary CPU load memory.

The display of the primary CPU indicates the copying progress.

Table 10- 6 Copying the SIMATIC memory card

Primary CPU Backup CPU

The backup CPU copies the transferred load memory contents to its work memory.

S7-1500R/H redundant system

238 System Manual, 05/2021, A5E41814787-AC
 Commissioning
10.4 Operating and system states

② Restart of the backup CPU

The backup CPU restarts and automatically switches back to the SYNCUP operating state.
The display of the backup CPU shows the "Connecting..." state.

Table 10- 7 Restart of the backup CPU

Primary CPU Backup CPU

S7-1500R/H redundant system

System Manual, 05/2021, A5E41814787-AC 239
Commissioning
10.4 Operating and system states

③ Finishing tasks
The instructions running asynchronously on the primary CPU are terminated and new ones
are accepted but not started.
From this point on, restarted asynchronous instructions are delayed until the "Copying the
working memory" phase. The "BUSY" output parameter of instructions is"1". However,
processing does not yet start.
The communication connections in the primary CPU are temporarily ended. You can no
longer delete, load, generate or compress blocks in the user program. You can no longer run
any test or commissioning functions.

Table 10- 8 Preparing the copying of the work memory

Primary CPU Backup CPU

S7-1500R/H redundant system

240 System Manual, 05/2021, A5E41814787-AC
 Commissioning
10.4 Operating and system states

④ Copying the work memory

The backup CPU establishes connections to the IO devices (only with S2 system redundancy).
The primary CPU stores a consistent snapshot of its memory contents and some system
memory contents (backup CPU dump) at the next cycle control point: Process image, bit
memory, SIMATIC time/count functions, temporary local data, data block contents.
After the snapshot, the primary CPU immediately resumes user program execution.
Communication connections are reestablished and asynchronous instructions are started.
The primary CPU copies the consistent snapshot to the backup CPU and continues operating
in parallel. Data blocks, the process image, etc. are immediately overwritten with current data
from the primary CPU.
The display of the primary CPU indicates the operating state.

Table 10- 9 Copying the work memory

Primary CPU Backup CPU

The backup CPU is busy accepting the data before it can also process the user program.

S7-1500R/H redundant system

System Manual, 05/2021, A5E41814787-AC 241
Commissioning
10.4 Operating and system states

⑤ Making up backup CPU lag

In phase ⑤, the backup CPU catches up with the primary CPU.
The communication connections on the backup CPU become available during the catch-up
process.
The backup CPU sends a status message on its program progress to the primary CPU at each
cycle control point.
The display of the primary CPU indicates the lag of the backup CPU.

Table 10- 10 Making up backup CPU lag

Primary CPU Backup CPU

Once the backup CPU has caught up, both CPUs switch to the RUN-Redundant operating
state. Both CPUs process the user program synchronously.

Note
High load during SYNCUP
The higher load during SYNCUP can prolong the program cycle.
If SYNCUP is taking too long and the displays are not showing any progress, you can abort
SYNCUP and optimize your user program. You can find more information under
"SYNCUP system state aborts".

Note
Setting a sufficiently long maximum cycle time
Configure a sufficiently long maximum cycle time for the CPUs. A temporary increase in the
cycle time can occur upon a system state transition SYNCUP → RUN-Redundant.

S7-1500R/H redundant system

242 System Manual, 05/2021, A5E41814787-AC
 Commissioning
10.4 Operating and system states

Effects of the SYNCUP system state

In SYNCUP, there are different effects on the execution of the user program and
communication functions. The effects are set out in the table below.

Table 10- 11 Properties of SYNCUP

Procedure Effects during the SYNCUP system state

Processing of the user program on the All priority classes (OBs) are processed. Processing is delayed during the snap-
primary CPU shot. After the snapshot, the primary CPU immediately resumes user program
execution and asynchronous instructions are started.
Deleting, loading, generating and com- Blocks cannot be deleted, loaded, generated or compressed.
pressing blocks
Processing communication functions The execution of parts of functions is limited and delayed. The system makes up
the delays in all functions after SYNCUP.
PG/PC operation Depending on the SYNCUP phase, online connections from the PG/PC to the CPU
may not be possible.
Test and commissioning functions, for Depending on the SYNCUP phase, no test and commissioning functions may be
example "Monitor and modify tags", possible.
"Monitoring (on/off)".
Connection handling in the primary CPU All communication connections are initially aborted.
After the snapshot, the primary CPU re-establishes communication connections
with active connection establishment. Note that the CPU takes some time to re-
establish the communication connections.
The CPU re-establishes connection endpoints for communication connections
with passive connection setup.
Connection handling in the backup CPU All communication connections are initially aborted.
The backup CPU establishes connections (ARs) to the IO devices (only with S2
system redundancy).
The communication connections on the backup CPU become available during
the backup CPU catch-up process.
Diagnostics alarms Diagnostic alarms can be delayed during the SYNCUP system state. The OB 82
reports delayed diagnostic alarms.
If diagnostic alarms occur during the "Making up backup CPU lag" phase, the
diagnostic alarms can prolong this phase. You can find additional information in
the section Basics to the Program processing (Page 177).

S7-1500R/H redundant system

System Manual, 05/2021, A5E41814787-AC 243
Commissioning
10.4 Operating and system states

SYNCUP system state aborts

Abort is possible in a range of cases even if you have successfully launched the
SYNCUP system state:
• If one of the two CPUs POWERS OFF.
• If you switch the backup CPU to STOP; the primary CPU continues operating in
RUN operating state.
The abort of SYNCUP may be delayed by a few seconds.
• If you set the primary CPU to STOP; the redundant system switches to the STOP system
state as the backup CPU was not ready to take over control of the process (not shown in
the following figure). The backup CPU restarts.
• If the backup CPU lag is not reduced to less than the smallest value after 100 program
cycles and 10 to 13 seconds, the primary CPU aborts SYNCUP. Evaluate the diagnostics
buffer of the primary and the backup CPU.
• If one of the CPUs detects an error that impedes progress, for example if the cycle time is
exceeded in the primary CPU.
• If the PROFINET ring was already interrupted before changing to the SYNCUP system state
or if the PROFINET ring is interrupted during SYNCUP.
• If there are other devices in the PROFINET ring apart from the CPUs to which the media
redundancy role "Manager" or "Manager (auto)" was assigned.

S7-1500R/H redundant system

244 System Manual, 05/2021, A5E41814787-AC
 Commissioning
10.4 Operating and system states

You can find a detailed list of the causes of error and remedies in the table SYNCUP abort:
Causes and solutions.

Figure 10-8 SYNCUP system state aborts

Table 10- 12 Sequence of events: SYNCUP aborts

No. in diagram Primary CPU System state Backup CPU

Initial situation: The S7-1500R/H redundant system is in the SYNCUP system state. An error occurs in the backup CPU.
① The CPU does not switch from the SYNCUP → RUN-Solo If SYNCUP aborts, the backup
RUN-Syncup operating state to RUN- CPU may restart and then
Redundant, but instead returns to RUN switch to the STOP operating
and continues to execute the user state. The backup CPU is ready
program. for a new SYNCUP.

Procedure for error correction

1. Eliminate the error.
2. Switch the backup CPU from STOP to RUN.
The backup CPU switches from STOP to the SYNCUP operating state. Synchronization restarts.

S7-1500R/H redundant system

System Manual, 05/2021, A5E41814787-AC 245
Commissioning
10.4 Operating and system states

Causes of error and troubleshooting

There are various possible causes of a SYNCUP system state abort. In the event of a SYNCUP
abort, evaluate the diagnostics buffer of the primary and the backup CPU.

Table 10- 13 SYNCUP abort: Causes and solutions

Cause of SYNCUP abort Solution

Too little memory on the SIMATIC memory card of the back- Delete data from the SIMATIC memory card or use a SIMATIC
up CPU. memory card with greater memory capacity. You can find
more information in the function manual Structure and use
of the CPU memory
(https://support.industry.siemens.com/cs/ww/en/view/59193
101).
The name of files or directories on the SIMATIC memory card Make sure that file and/or directory names do not contain
of the backup CPU contains unsupported characters. umlauts (ö, ä, ü, Ö, Ä, Ü).
The number of hierarchy levels used in directories on the Make sure that the directory structure does not consist of
SIMATIC memory card of the backup CPU is too large. more than 6 hierarchy levels (e.g.
(F:) SIMATIC MC/1/2/3/4/5/6/file.txt).
System overload. The user program load is too high, and the Use the "RT_INFO" instruction to generate statistics on the
backup CPU is therefore not catching up with program exe- runtime of OBs, communication or the user program.
cution on the primary CPU. You can shorten the backup CPU delay compared to the
primary CPU by:
• Addressing the CPU overload by reducing the post-
processing of cyclic events (events from one source, for
example start events for a cyclic interrupt OB).
You can find more information in the Cycle and response
times
(https://support.industry.siemens.com/cs/ww/en/view/59
193558) function manual.
• Not setting too low a minimum cycle time for program
cycle OBs or increasing the minimum cycle time. This re-
duces the frequency at which the program cycle OBs are
called.
The load on the redundancy connections between primary Reduce the load on the redundancy connections between
and backup CPU is too high. As a result, the backup CPU is primary and backup CPU by:
not catching up with program execution on the primary CPU.
• Reducing the post-processing of cyclic events (see above)
• Avoiding instructions that increase the synchronization
load, for example direct access, time access (for example
RD_SYS_T, WR_SYS_T, RD_LOC_T)
• Reducing communication (HMI, PG/PG, Open User Com-
munication, etc.)
• Complying with the configuration rules
Maximum cycle time in the primary CPU exceeded • Reduce the cycle time by setting a lower communication
load in the hardware configuration.
• Configure a sufficiently long maximum cycle time.
• If there is an OB 80 (time error OB) in the downloaded
user program, it is called by the operating system to tol-
erate the cycle time being exceeded (see section Start
events (Page 177)).

S7-1500R/H redundant system

246 System Manual, 05/2021, A5E41814787-AC
 Commissioning
10.4 Operating and system states

Cause of SYNCUP abort Solution

Primary CPU or backup CPU goes into STOP operating state. Switch the primary CPU or backup CPU into RUN operating
state.
PROFINET ring interrupted Replace defective PROFINET cables or PROFINET devices in
the PROFINET ring.
In the PROFINET ring, in addition to the two CPUs, there are Configure the media redundancy role "Client" for all other
other devices with the media redundancy role "Manager" or devices in the PROFINET ring.
"Manager (auto)".
Supply voltage of the primary or backup CPU has failed. Restore the supply voltage. Replace a defective load current
supply (PM).
Simultaneous POWER OFF / POWER ON switching at both Switch both CPUs POWER OFF/ON again. The SYNCUP is
CPUs during SYNCUP: executed again.
If you switch both CPUs POWER OFF/ON at the same time
during SYNCUP, SYNCUP will be aborted.

10.4.7 System and operating state transitions

System state transitions

The following figure shows the system state transitions of the redundant S7-1500R/H system.

Figure 10-9 System state transitions

S7-1500R/H redundant system

System Manual, 05/2021, A5E41814787-AC 247
Commissioning
10.4 Operating and system states

Operating state transitions

Operating state transitions of the redundant system
The following figure shows the operating state transitions of the primary and backup CPU.

Figure 10-10 Operating state transitions

S7-1500R/H redundant system

248 System Manual, 05/2021, A5E41814787-AC
 Commissioning
10.4 Operating and system states

① POWER ON → STARTUP, POWER ON → SYNCUP

Transition Description Effect

System state POWER ON → STARTUP After POWER ON →
transition The CPUs implement pairing after switch-on. The redundant system then STARTUP, the primary
switches to STARTUP if: CPU clears the non-
retentive memory and
• The mode selector is set to the RUN position; resets the contents of
• The hardware configuration and program blocks are consistent, non-retentive data
blocks to the initial val-
and ues of the load memory.
• The startup type "Warm restart - RUN" is set Retentive memory and
or retentive DB contents
are retained.
• The startup type "Warm restart - Operating mode before POWER OFF" is
set and the system was in RUN-Solo, SYNCUP or RUN-Redundant before
POWER OFF.
The CPU that becomes the primary CPU runs the STARTUP.
The primary CPU switches to the STARTUP operating state.
Operating state POWER ON → STARTUP
transitions The CPUs implement pairing after switch-on. The primary CPU then switches
to the STARTUP operating state if:
• The mode selector is in the RUN position;
• The hardware configuration and program blocks are consistent,
and
• The startup type "Warm restart - RUN" is set

or
• The startup type "Warm restart - Operating mode before POWER OFF" is
set and the CPU was in STARTUP, RUN, RUN-Syncup or RUN-Redundant
before POWER OFF.
POWER ON → SYNCUP
The CPUs implement pairing after switch-on. The backup CPU then switches
to the SYNCUP operating state if:
• The mode selector is in the RUN position
and
• The primary CPU is in the STARTUP or RUN operating state.

S7-1500R/H redundant system

System Manual, 05/2021, A5E41814787-AC 249
Commissioning
10.4 Operating and system states

Automatic STARTUP after POWER ON only possible for the primary CPU

Note
The automatic STARTUP after POWER ON only for the primary CPU prevents a CPU with
outdated, retentive data from automatically changing to the RUN operating mode.
You can switch the backup CPU manually to RUN, this then automatically becomes the
primary CPU and starts with its retentive data.

If you have parameterized "Startup after POWER ON" "Warm restart..." as the startup type,
then the primary CPU only carries out the startup if the CPU became the primary CPU in
POWER ON, i.e.:
• No partner CPU found
or
• Due to the role assignment, the local CPU became the primary CPU and the partner CPU
became the backup CPU
If a CPU became the backup CPU in POWER ON, then:
• if all the requirements are met, this results in an automatic SYNCUP
or
• the backup CPU changes to STOP
In both cases the CPU remains the backup CPU and can therefore not automatically carry
out the STARTUP.

To illustrate the process, here are two examples:

① No STARTUP after parameterization "Warm restart - RUN"

Requirements:
• You have parameterized "Warm restart - RUN" for both CPUs.
• The pairing was successful for both CPUs.
• Both CPUs are in STOP.
• Both mode switches are set to RUN.
Procedure:
1. POWER OFF/POWER ON the backup CPU. Result: The CPU becomes the backup CPU again
and changes to STOP.
2. POWER OFF/POWER ON the primary CPU. Result: The CPU changes to RUN. The redundant
system switches to the RUN-Solo system state.
3. Switch the backup CPU to POWER OFF/POWER ON again. Result: The redundant system
switches to the SYNCUP system state.

S7-1500R/H redundant system

250 System Manual, 05/2021, A5E41814787-AC
 Commissioning
10.4 Operating and system states

② No STARTUP after parameterization "Warm restart - operating mode before POWER

OFF"
Requirements:
• You have parameterized "Warm restart - operating mode before POWER OFF" for both
CPUs.
• The redundant system is in the RUN-Redundant system state.
Procedure:
1. POWER OFF both CPUs at the same time.
2. Set the mode selector for the primary CPU to STOP.
3. POWER ON both CPUs again. Result: The redundant system switches to the STOP system
state.

② POWER ON → STOP

Transition Description Effects

System state POWER ON → STOP The primary CPU clears
transition The redundant system switches to the STOP system state after switch-on if: the non-retentive
Operating state memory and resets the
• The CPUs have different firmware versions contents of non-
transitions
retentive data blocks to
or the initial values of the
• The mode selector is in the STOP position load memory. Reten-
or tive memory and reten-
tive DB contents are
• The hardware configuration and program blocks are inconsistent retained.
or
• The startup type "No restart (remain in STOP)" is set
or
• The startup type "Warm restart - Operating mode before POWER OFF" is set
and the redundant system was in STOP before POWER OFF.

S7-1500R/H redundant system

System Manual, 05/2021, A5E41814787-AC 251
Commissioning
10.4 Operating and system states

③ STOP → STARTUP

Transition Description Effects

System state STOP → STARTUP The primary CPU clears
transition The redundant system switches to the STARTUP system state if: the non-retentive
memory and resets the
• You set a CPU to RUN via the PG/PC or the display and the mode selector is contents of non-
set to RUN retentive data blocks to
the initial values of the
or load memory. Reten-
• You set the mode switch from STOP to RUN. tive memory and reten-
tive DB contents are
The CPU that you switch from STOP to RUN first remains/becomes the primary retained.
CPU. It switches to the STARTUP operating state and processes the startup
blocks. If there is a role change
between primary and
The backup CPU remains in STOP. backup CPU, connected
Operating state STOP → STARTUP IO devices are tempo-
transition After switch-on, the primary CPU switches to the STARTUP operating state if: rarily unavailable.

• The hardware configuration and program blocks are consistent

and
• You set the CPU to RUN via the PG/PC or the display and the mode selector
is set to RUN

or
• You set the mode switch from STOP to RUN.

S7-1500R/H redundant system

252 System Manual, 05/2021, A5E41814787-AC
 Commissioning
10.4 Operating and system states

④ STARTUP → RUN-Solo, STARTUP → RUN

Transition Description Effects

System state STARTUP → RUN-Solo The process image is
transition The redundant system switches from STARTUP to the RUN-Solo system state if: updated and pro-
cessing of the cyclic
• The primary CPU has initialized the PLC tags user program begins.
and The outputs of the IO
devices are initialized.
• The primary CPU has executed the startup blocks successfully
and
• "Startup CPU only if compatible" is configured, there is feedback from all IO
devices before the end of the configuration time and all IO devices match
the configured hardware configuration or "Startup CPU even if mismatch"
is configured and the configuration time is up.
The backup CPU remains in STOP.
Operating state STARTUP → RUN
transition The primary CPU switches to the RUN operating state if:
• The CPU has initialized the PLC tags;
• The CPU has executed the startup blocks successfully;

and
• "Startup CPU only if compatible" is configured, there is feedback from all IO
devices before the end of the configuration time and all IO devices match
the configured hardware configuration or "Startup CPU even if mismatch"
is configured and the configuration time is up.

S7-1500R/H redundant system

System Manual, 05/2021, A5E41814787-AC 253
Commissioning
10.4 Operating and system states

⑤ RUN-Solo → SYNCUP, RUN → RUN-Syncup, STOP → SYNCUP

Transition Description Effects

System state RUN-Solo → SYNCUP See section SYNCUP
transition The primary CPU is in the RUN operating state. The redundant system switch- system state
es from the RUN-Solo system state to the SYNCUP system state if: (Page 235)

• You set the backup CPU to RUN via the PG/PC, the display or the RH_CTRL
instruction (Mode 7) and the mode selector is set to RUN

or
• You switch the mode selector on the backup CPU from STOP to RUN.

or
• You POWER ON the backup CPU (mode selector to RUN)

and
• the SYNCUP system state is not disabled by the RH_CTRL instruction.
Operating state RUN → RUN-Syncup
transitions The primary CPU switches from the RUN operating state to the RUN-Syncup
operating state if:
• You set the backup CPU to RUN via the PG/PC or the display and the mode
selector is set to RUN

or
• You switch the mode selector on the backup CPU from STOP to RUN.

or
• You POWER ON the backup CPU (mode selector to RUN).
STOP → SYNCUP
The backup CPU switches from the STOP operating state to the SYNCUP oper-
ating state.

⑥ SYNCUP → RUN-Redundant, RUN-Syncup → RUN-Redundant

Transition Description Effects

System state SYNCUP → RUN-Redundant This system state tran-
transition The redundant system switches from SYNCUP to the RUN-Redundant system sition does not have
state if SYNCUP has successfully run. any effect on data.
In the RUN-Redundant system state, the two CPUs execute the user program Communication con-
synchronously. nections (HMI, PG/PC)
on the backup CPU
Note: A temporary increase in the cycle time can occur upon a system become available.
state transition SYNCUP → RUN-Redundant. Configure a sufficiently long
maximum cycle time for the CPUs. Both CPUs process the
user program synchro-
Operating state RUN-Syncup → RUN-Redundant nously.
transitions The primary CPU switches from the RUN-Syncup operating state to the RUN-
Redundant operating state if SYNCUP has successfully run.
SYNCUP → RUN-Redundant
The backup CPU switches from the SYNCUP operating state to the RUN-
Redundant operating state if SYNCUP has successfully run.

S7-1500R/H redundant system

254 System Manual, 05/2021, A5E41814787-AC
 Commissioning
10.4 Operating and system states

⑦ RUN-Redundant → RUN-Solo, RUN-Redundant → RUN

Transition Description Effects

System state RUN-Redundant → RUN-Solo This system state tran-
transition The redundant system switches from the RUN-Redundant system state to the sition does not have
RUN-Solo system state (loss of redundancy) if: any effect on the data.

• You POWER OFF one of the CPUs.

or
• A CPU detects an error which prevents further work.

or
• The cycle time was exceeded once, see section Events and OBs (Page 177)

or
• You set one of the CPUs to STOP with the PG/PC, the display, the RH_CTRL
instruction (Mode 8/9) or the mode selector.
The primary CPU switches to RUN or the backup CPU becomes the primary
CPU and switches to RUN.
Operating state RUN-Redundant → RUN This operating state
transition The primary CPU switches from the RUN-Redundant operating state to the transition does not
RUN operating state and continues to execute the user program. have any effect on
data.

⑧ RUN-Redundant → STOP, RUN-Solo → STOP, RUN → STOP

Transition Description Effects

System state tran- RUN-Redundant → STOP, RUN-Solo → STOP This system state tran-
sition The redundant system switches from the RUN-Redundant/RUN-Solo system sition does not have
state to the STOP system state if: any effect on data.

• The redundant system detects an error that prevents further processing

or
• The redundant system processes a STOP command in the user program
or
• You set the redundant system to STOP with the PG/PC.
Operating state RUN-Redundant → STOP, RUN → STOP These operating state
transitions The primary CPU switches from the RUN-Redundant/RUN operating state to transitions have no
the STOP operating state if: effect on data.

• The CPU detects an error that prevents further work on one of the two
CPUs.

or
• You set the CPU to STOP with the PG/PC, the display or the mode selector.
RUN-Redundant → STOP
The backup CPU switches from the RUN-Redundant operating state to the
STOP operating state.

S7-1500R/H redundant system

System Manual, 05/2021, A5E41814787-AC 255
Commissioning
10.4 Operating and system states

⑨ SYNCUP → RUN-Solo, RUN-Syncup → RUN

Transition Description Effects

System state SYNCUP → RUN-Solo This system state tran-
transition The redundant system switches from the SYNCUP system state to the RUN- sition does not have
Solo system state if: any effect on data.

• You execute POWER OFF for the backup CPU

or
• The redundant system detects an error during SYNCUP that prevents re-
dundant operation

or
• You set the backup CPU to STOP with the PG/PC, the display or the mode
selector.
Primary CPU op- RUN-Syncup → RUN These operating state
erating state The primary CPU switches from the RUN-Syncup operating state to the RUN transitions have no
transition operating state and continues to execute the user program. effect on data.

⑩ SYNCUP → STOP, RUN-Syncup → STOP

Transition Description Effects

System state SYNCUP → STOP This system state tran-
transition The redundant system switches from the SYNCUP system state to the STOP sition does not have
system state if: any effect on data.

• You set the primary CPU or both CPUs to STOP with the PG/PC, the display
or the mode selector.
• SYNCUP Is aborted as a result of an error in the primary CPU or in both
CPUs.
Operating state RUN-Syncup → STOP These operating state
transitions The primary CPU switches from the RUN-Syncup operating state to the STOP transitions have no
operating state if: effect on data.

• The primary CPU detects an error that prevents further processing

or
• You set the primary CPU to STOP with the PG/PC, the display or the mode
selector

or
• The redundant system processes a STOP command in the user program.
SYNCUP → STOP
The backup CPU restarts and switches to the STOP operating state after
SYNCUP aborts if:
• SYNCUP Is aborted due to an error (for causes and remedies, see section
SYNCUP system state (Page 235))

or
• You set the CPU to STOP with the PG/PC, the display or the mode selector.

S7-1500R/H redundant system

256 System Manual, 05/2021, A5E41814787-AC
 Commissioning
10.4 Operating and system states

⑪ STARTUP → STOP

Transition Description Effects

System state STARTUP → STOP This system state tran-
transition The redundant system switches from the STARTUP system state to the STOP sition does not have
system state if: any effect on data.
Primary CPU op- This operating state
• The primary CPU detects an error during startup that prevents further
erating state transition does not
transition processing have any effect on
data.
or
• You set the primary CPU to STOP with the PG/PC, the display or the mode
selector

or
• The primary CPU processes a STOP command in startup OB

or
• In the CPU properties, you have set the following for startup behavior:
– Too short a configuration time for the distributed I/O and
– "Startup CPU only if compatible"
The primary CPU switches to STOP.

10.4.8 Loss of redundancy

Introduction
The following section explains in more detail the system and operating state transitions ⑦
from the System and operating state transitions (Page 247) section.
• RUN-Redundant → RUN-Solo
• RUN-Redundant → RUN

Response
Loss of redundancy means:
• The redundant system switches from the RUN-Redundant system state to the RUN-Solo
system state.
• The primary CPU switches from the RUN-Redundant operating state to RUN (1)
or
• Primary-backup switchover: The backup CPU becomes the primary CPU and switches from
the RUN-Redundant operating state to RUN (2).
The primary CPU continues to execute the user program in the RUN operating state and
exchanges process data with the IO devices.

S7-1500R/H redundant system

System Manual, 05/2021, A5E41814787-AC 257
Commissioning
10.4 Operating and system states

Causes of redundancy loss

The redundant system switches from the RUN-Redundant system state to RUN-Solo if:
• You POWER OFF one of the CPUs.
• You set one of the two CPUs to STOP with the PG/PC, the display, the RH_CTRL instruction
(Mode 8/9) or the mode selector.
• A CPU detects an error that prevents continued processing, for example:
– Failure of a CPU, for example as a result of a hardware defect.
– Cycle time exceeded

(1) Primary CPU switches to the RUN operating state

Figure 10-11 Primary CPU switches to the RUN operating state

S7-1500R/H redundant system

258 System Manual, 05/2021, A5E41814787-AC
 Commissioning
10.4 Operating and system states

Table 10- 14 Response to loss of redundancy: Primary CPU switches to RUN

No. in Primary CPU System state Backup CPU

diagram
Initial situation: The S7-1500R/H redundant system is in the RUN-Redundant system state.
The backup CPU fails because of a hardware defect.
① The CPU switches from RUN- RUN-Redundant → RUN-Solo Following the error, the CPU switches
Redundant to RUN. The CPU be- from the RUN-Redundant operating state
haves like a standard CPU and con- to STOP or POWER OFF.
tinues to process the user program.

Error elimination procedure for redundant operation

1. Eliminate the error.
2. Start the backup CPU.
The backup CPU switches from the STOP operating state to the SYNCUP operating state.
Synchronization starts as detailed in the section SYNCUP system state (Page 235).

(2) Primary-backup switchover

Figure 10-12 Primary-backup switchover

S7-1500R/H redundant system

System Manual, 05/2021, A5E41814787-AC 259
Commissioning
10.4 Operating and system states

Table 10- 15 Response to primary CPU error: Backup CPU becomes primary CPU and switches to RUN

No. in CPU 1 System state CPU 2

diagram
Initial situation: The S7-1500R/H redundant system is in the RUN-Redundant system state.
The primary CPU (CPU 1) fails because of a hardware defect.
① Following the failure, CPU 1 switch- RUN-Redundant → RUN-Solo CPU 2 becomes primary CPU and switch-
es from the RUN-Redundant operat- es to the RUN operating state. The CPU
ing state to STOP or POWER OFF. behaves like a standard CPU and contin-
ues to process the user program.

Error elimination procedure for redundant operation

1. Eliminate the error.
2. Start CPU 1.
CPU 1 becomes the backup CPU and switches from the STOP operating state to the
SYNCUP operating state.
Synchronization starts as detailed in the section SYNCUP system state (Page 235).

10.4.9 Displaying and changing the system state

Introduction
For commissioning and service, you require information on the system state of the redundant
system. Examples:
• The redundant system does not switch to the RUN-Redundant system state upon initial
commissioning.
• The primary CPU has failed due to a fault.

Options
You have the following options for displaying and changing the system state of the
S7-1500R/H redundant system:
• Using the mode selectors on the CPUs, you can change the operating states of the CPUs
and therefore the system state
• Via the displays of the primary and backup CPU
• In STEP 7, for example when the R/H-CPUs are far apart

S7-1500R/H redundant system

260 System Manual, 05/2021, A5E41814787-AC
 Commissioning
10.4 Operating and system states

Display of the primary and backup CPU

Displaying the operating state:
The operating state of the primary and backup CPU is shown in the status information in the
top section of the displays. The two operating states define the system state.
Examples:
• Status information for the primary and backup CPUs: RUN-Redundant, RUN-Redundant.
Result: The system state is RUN-Redundant.
• Status information for the primary and backup CPUs: RUN, STOP. Result: The system state
is RUN-Solo.
Changing the operating state:
Switch the CPU to the required operating state in the "Settings > RUN / STOP" menu of the
display.

Note
Please note that you can only implement the system states RUN-Redundant and STOP
through the displays by switching both CPUs to the operating state RUN or STOP .

SIMATIC S7-1500 Display Simulator

A simulation of the display of the available menu commands is available in the
SIMATIC S7-1500 Display Simulator
(https://support.industry.siemens.com/cs/ww/en/view/109761758).

S7-1500R/H redundant system

System Manual, 05/2021, A5E41814787-AC 261
Commissioning
10.4 Operating and system states

STEP 7
Displaying the system state:
The R/H-system operating panel (Online & Diagnostics) displays the system status.
Changing the system state:
On the R/H system control panel (Online & diagnostics):
• STOP system state: Press the STOP R/H-System button.

Figure 10-13 STOP system state on the R/H system control panel

On the CPU control panels (Online & diagnostics):

• RUN-Redundant system state: Press the RUN R/H-System button on both CPU operator
panels.

Note
Please note that you cannot switch the S7-1500R/H system to the RUN-Redundant system
state over the R/H system control panel. You implement the RUN-Redundant system state
by switching each CPU on its control panel to RUN.

S7-1500R/H redundant system

262 System Manual, 05/2021, A5E41814787-AC
 Commissioning
10.5 CPU memory reset

10.5 CPU memory reset

Basics of a memory reset

Memory resets can be performed for the primary and for the backup CPU. Memory resets are
generally only useful for the primary CPU.
Reason: Following a primary CPU memory reset, you need to trigger synchronization for
redundant operation. In SYNCUP, the backup CPU is synchronized with the retentive data
from the primary CPU. Following SYNCUP, the backup CPU processes the same user program
as the primary CPU.
The memory reset process for R/H-CPUs is identical to that for the S7-1500 standard CPUs.
The CPU must be in the STOP operating state for a memory reset.
A memory reset returns the CPU to its "initial state".

Note
A memory reset only ever affects the CPU to which you have applied the function. For a
memory reset of both CPUs, apply the function to each in turn.

Memory reset means:

• An existing online connection between your programming device/PC and the CPU is
terminated.
• The content of the work memory and the retentive and non-retentive data are deleted.
• The diagnostics buffer, time of day, IP address and the redundancy ID are retained.
• Subsequently the CPU is initialized with the loaded project data (hardware configuration,
code and data blocks, force jobs). The CPU copies this data from the load memory to the
work memory.
• Data blocks no longer have actual values but rather their configured start values.
• Force jobs remain active.

Detecting a CPU memory reset

The RUN/STOP LED flashes yellow at 2 Hz. After completion, the CPU switches to STOP. The
RUN/STOP LED lights up yellow.

S7-1500R/H redundant system

System Manual, 05/2021, A5E41814787-AC 263
Commissioning
10.5 CPU memory reset

Result after memory reset

The following table provides an overview of the contents of the memory objects after
memory reset.

Table 10- 16 Memory objects after memory reset

Memory object Contents

Redundancy ID Retained
Actual values of the data blocks, instance data blocks Initialized
Bit memories, timers and counters Initialized
Entries in the diagnostics buffer1) (retentive area) Retained
Entries in the diagnostics buffer (non-retentive area) Initialized
IP addresses Retained
Device name (module name) Retained
Counter readings of the runtime meters Retained
Time of day Retained
1) The entries in the diagnostics buffer are the 500 most recent entries.

Note
Password for protection of confidential configuration data
The password for protection of confidential configuration data is retained after a memory
reset of the CPU. The password is only deleted when the "Delete password for protection of
confidential PLC configuration data" option is set.
You can find additional information on the password for protection of confidential
configuration data in the Communication
(https://support.industry.siemens.com/cs/ww/en/view/59192925) function manual.

10.5.1 Automatic memory reset

Possible causes of automatic memory reset

Proper continuation of work is prevented in the following cases. The CPU performs an
automatic memory reset.
These can be caused by:
• User program is too large and cannot be loaded to the work memory in full.
• The project data on the SIMATIC memory card are damaged, for example because a file
was deleted.
• You remove or insert the SIMATIC memory card. The backed-up retentive data differs in
structure from the data in the configuration on the SIMATIC memory card.
• SYNCUP aborts in the backup CPU. You can find more information in the section
SYNCUP system state (Page 235).

S7-1500R/H redundant system

264 System Manual, 05/2021, A5E41814787-AC
 Commissioning
10.5 CPU memory reset

10.5.2 Manual memory reset

Reason for manual memory reset

Memory reset is required to reset the primary or backup CPU to its "initial state". Memory
resets can only be run in the STOP operating state of a CPU.

CPU memory reset

There are three options for performing a CPU memory reset:
• Using the mode selector
• Using the display
• Using STEP 7

Procedure using the mode selector

Note
Memory reset ↔ Reset to factory settings
The procedure described below also corresponds to the procedure for resetting to factory
settings:
• Selector operation with inserted SIMATIC memory card: CPU executes a memory reset
• Selector operation without inserted SIMATIC memory card: CPU executes reset to factory
settings

Proceed as follows for a CPU memory reset using the mode selector:
1. Set the mode selector to STOP.
Result: The RUN/STOP LED lights up yellow.
2. Set the mode selector to MRES. Hold the switch in this position until the RUN/STOP LED
lights up for the second time and remains continuously lit after three seconds. Then release
the mode selector.
3. Within the next three seconds, switch the mode selector back to the MRES position and then
back to STOP.
Result: The CPU executes a memory reset.
For information on resetting the CPU to factory settings, please refer to the section Resetting
CPUs to factory settings (Page 309).

Procedure using the display

To navigate to the desired "Memory reset" menu command, select the following sequence of
menu commands and confirm after each selection with "OK".
• Settings → Reset → Memory reset
Result: The CPU executes a memory reset.

S7-1500R/H redundant system

System Manual, 05/2021, A5E41814787-AC 265
Commissioning
10.6 Backing up and restoring the CPU configuration

Procedure using STEP 7

Requirement: There is an online connection between the CPU ad PG/PC.
Proceed as follows for a CPU memory reset with STEP 7:
1. Open the "Online Tools" task card of the CPU.
2. Click "MRES" in the "CPU operator panel" pane.
3. Click "OK" in response to the confirmation prompt.
Result: The CPU executes a memory reset.

10.6 Backing up and restoring the CPU configuration

Backup from online device

You may make changes in the operation of your plant. For example, you may add new
devices, replace existing ones or adapt the user program. If these changes result in
undesirable behavior, you can restore the plant to an earlier state. Before you download a
changed configuration to the CPU, first use the option "Backup from online device" to create a
complete backup of the current device state. If you have assigned a password to protect
confidential PLC configuration data, then this password is not secured. For more information
on the password, refer to the section Protection of confidential configuration data
(Page 194).

Upload from device (software)

With the option "Upload from device (software)", you load the software project data from the
CPU to an existing CPU in the project.

Upload device as new station

If you are operating a new PG/PC in the plant, the STEP 7 project that was used to create the
plant configuration might not be available. In this case, you can use the option "Upload
device as new station" to load the device data to a project in your PG/PC.

Snapshot of the actual values

To allow you to restore the actual values at a later date, back up the actual values of the data
blocks using the option "Snapshot of the actual values".

S7-1500R/H redundant system

266 System Manual, 05/2021, A5E41814787-AC
 Commissioning
10.6 Backing up and restoring the CPU configuration

Overview of backup types

The table below shows the backup of CPU data depending on the selected type of backup and
its specific characteristics:

Table 10- 17 Types of backup

Backup from Upload from de- Upload device as Snapshot of the

online device vice (software) new station actual values
Actual values of all DBs ✓ ✓ ✓ ✓
(global and instance data blocks)
Blocks of the type OB, FC, FB and ✓ ✓ ✓ --
DB
PLC tags ✓ ✓ ✓ --
(tag names and constant names)
Hardware configuration ✓ -- ✓ --
Actual values (bit memories, timers ✓ -- -- --
and counters)
Contents of the SIMATIC memory ✓ -- -- --
card
Entries in the diagnostics buffer -- -- -- --
Current time -- -- -- --
Properties of the type of backup
Backup can be edited -- ✓ ✓ ✓
Backup possible in system state RUN-Solo1), STOP RUN-Redundant, RUN-Redundant, RUN-Redundant,
RUN-Solo, STOP RUN-Solo, STOP RUN-Solo, STOP
1) From backup CPU

Example: Backup from online device

The following example shows how to carry out a complete backup of the current device state
of the CPUs in STEP 7. The S7-1500R/H redundant system is in the RUN-Redundant system
state. Special consideration should be given to the following:
• Before the backup, the backup CPU goes into STOP mode.
• The CPU data of the backup CPU is backed up.
To start the backup, proceed as follows:
1. Right-click to select the S7-1500R/H system in the project tree.
2. Select the "Backup from online device" command from the shortcut menu.
3. The "Upload preview" dialog window sets out the key information on the backup process to
be run. To make a backup, you need to set the S7-1500R/H redundant system to the RUN-
Solo system state.
Note: If you open the entry "Stop module" in the preview, then you can see which CPU is
stopped.
4. In the "Action" column, select the "Stop module" command from the drop-down menu.

S7-1500R/H redundant system

System Manual, 05/2021, A5E41814787-AC 267
Commissioning
10.6 Backing up and restoring the CPU configuration

5. Click "Upload from device". The backup CPU switches to the STOP operating state. The
backup of the CPU data of the backup CPU begins. The backup is saved in the folder of the
top CPU in the project tree.
6. Switch the redundant system to the RUN-Redundant system state again.

Example: Restoring a backup of an online device

If you have saved the CPU data beforehand, you can transfer the backup back to the device.
The saved backup is then restored to the CPU.
The S7-1500R/H redundant system is in the RUN-Redundant system state. Special
consideration should be given to the following:
• The backup is loaded into the primary CPU.
• Before the restore, the redundant system goes to the STOP system state.
To start the backup restore, proceed as follows:
1. In the project, open the folder of the top CPU in the project tree to display the lower-level
objects.
2. Open the "Online backups" folder.
3. Select the backup you want to restore.
4. In the "Online" menu, select the "Download to device" command.
5. The "Load preview" dialog window sets out the key information on the restore process to be
run: For a restore, you must switch the S7-1500R/H redundant system to the STOP system
state.
6. In the "Action" column, select the "Overwrite" command from the drop-down menu.
7. Click "Download". The redundant system switches to the STOP system state. The backup is
transferred to the primary CPU and restored. The "Load results" dialog then opens. In this
dialog, you can check whether or not the loading operation was successful and take any
further action that may be necessary (no action, start modules).
8. Click "Finish".

Reference
You can find more information on the various types of backup in the STEP 7 online help.

Emergency address (emergency IP)

If you cannot access the CPU via the IP address, you can set a temporary emergency
IP address for the CPU. To the more information on emergency address options, please refer
to the Communication (https://support.industry.siemens.com/cs/ww/de/view/59192925/en)
function manual.

S7-1500R/H redundant system

268 System Manual, 05/2021, A5E41814787-AC
 Commissioning
10.6 Backing up and restoring the CPU configuration

Storage of multilingual project texts

Different categories of texts are created when you configure a CPU, for example
• Object names (names of blocks, modules, tags, etc.)
• Comments (for blocks, networks, watch tables, etc.)
• Messages and diagnostic texts
Texts are provided by the system, for example texts in the diagnostics buffer, or they are
created during configuration, for example messages.
Texts exist in the project in one language or, after a translation process, in multiple
languages. You can maintain project texts in all languages available to you in the project tree
(Languages & resources > Project texts). The texts created during configuration can be
downloaded to the CPU.
The following texts containing the project data are downloaded to the CPU in the chosen
languages and are also used by the CPU display:
• Diagnostics buffer texts (not editable)
• Status texts for the module status (cannot be changed)
• Message texts with associated text lists
• Tag comments and step comments for PLC Code Viewer
• Comments in watch tables
The following texts are also loaded into the CPU in the selected languages with the project
languages, but are not used by the CPU display:
• Comments in tag tables (for tags and constants)
• Comments in global data blocks
• Comments of elements in block interfaces of FBs, FCs, DBs and UDTs
• Network titles in blocks written in LAD, FBD or STL
• Block comments
• Network comments
• Comments of LAD and FBD elements

S7-1500R/H redundant system

System Manual, 05/2021, A5E41814787-AC 269
Commissioning
10.7 Time synchronization

The S7-1500R/H CPUs support archiving of multilingual project texts in up to three different
project languages. If the project texts for a project language nevertheless exceed the memory
space reserved for them on the SIMATIC memory card, the project cannot be downloaded to
the CPU. The download is aborted with a notice that not enough memory space is available.
In such a case, take measures to reduce the required storage space, for example by
shortening comments.

Note
SIMATIC memory card
Make sure that there is enough available storage space on your SIMATIC memory card for
downloading projects.
In order to be able to download and back up projects, the project size and the size of files on
the SIMATIC memory card may not exceed 2 GB.
Do not manipulate any contents in the OMSSTORE folder on the SIMATIC memory card.

You can find information on reading out the memory usage of the CPU and the SIMATIC
memory card in the Structure and Use of the CPU Memory
(https://support.industry.siemens.com/cs/de/de/view/59193101/en) Function Manual.
You can find information on parameter assignment of multilingual project texts in STEP 7 in
the STEP 7 online help.

10.7 Time synchronization

Introduction
All S7-1500R/H CPUs have an internal clock. The clock shows:
• The time of day with a resolution of 1 millisecond
• The date and the day of the week
The CPUs take into account the time change caused by daylight saving time.
In redundant mode, the two CPUs of the S7-1500R/H redundant system constantly
synchronize their internal clocks.
You can synchronize the time of the CPUs using the NTP procedure.

S7-1500R/H redundant system

270 System Manual, 05/2021, A5E41814787-AC
 Commissioning
10.7 Time synchronization

Principle of operation
In NTP mode, the device sends time queries at regular intervals (in client mode) to the
NTP server in the subnet (LAN). Based on the replies from the servers, the most reliable and
most accurate time is calculated and the time of day on the S7-1500R/H CPU is synchronized.
The advantage of this mode is that it allows the time to be synchronized across subnets. You
can synchronize the time of day of up to a maximum of four NTP servers. You address a
communications processor or an HMI device, for example, as sources for time
synchronization via the IP addresses.
The update interval defines the interval between the time queries (in seconds). The value
range for the interval is 10 seconds to one day. In NTP mode, it is generally UTC (Universal
Time Coordinated) that is transferred. UTC corresponds to GMT (Greenwich Mean Time).

Conditions
• In the S7-1500R/H redundant system, you need to configure time synchronization in
NTP mode for each CPU individually. If possible, use the same settings for both CPUs.
• The settings for time synchronization with NTP mode are defined at PROFINET interface
X1. PROFINET interface X2 uses the settings from PROFINET interface X1.
• Make sure that the primary CPU maintains a constant connection to the NTP server. The
backup CPU then receives its synchronized time of day from the primary CPU.

Procedure
Proceed as follows to enable time synchronization for a CPU:
1. Configure the interface properties in the "Properties > General > PROFINET interface > Time
synchronization" parameter group. Select the "Enable time synchronization via NTP server"
option.
2. Enter the IP addresses of up to four NTP servers at parameter "Server 1-4".
3. Set the time interval for time queries at the parameter "Update interval".

S7-1500R/H redundant system

System Manual, 05/2021, A5E41814787-AC 271
Commissioning
10.7 Time synchronization

10.7.1 Example: Configuring the NTP server

Configuring time synchronization with your own NTP server

Automation task
You use your own server in your network. Your own server offers the following advantages:
• Protection against unauthorized external accesses
• Every device that you synchronize with your own NTP server uses the same time.
You want to synchronize the CPUs of your S7-1500R/H redundant system with this
NTP server.

Conditions and parameters

• You have your own NTP server in your network with the IP address 192.168.1.15.
• S7-1500R/H redundant system

Solution
1. Navigate to "Properties > General > PROFINET interface > Time synchronization > NTP mode"
in the properties of the first CPU.
2. For "Server 1:", enter the IP address of the NTP server: 192.168.1.15.

Figure 10-14 Example: Configuring the NTP server

3. Repeat steps 1 and 2 for the second CPU.

4. Download the hardware configuration to the primary CPU.

Result
The S7-1500R/H redundant system synchronizes its time with NTP server 192.168.1.15.

S7-1500R/H redundant system

272 System Manual, 05/2021, A5E41814787-AC
 Commissioning
10.8 Identification and maintenance data

10.8 Identification and maintenance data

10.8.1 Reading out and entering I&M data

I&M data
Identification and maintenance data (I&M data) is information saved on the module. The data
is:
• Read-only (I data) or
• Read/write (M data)
Identification data (I&M0): Manufacturer information about the module that can only be
read. Some identification data is also printed on the housing of the module, for example
article number and serial number.
Maintenance data (I&M1, 2, 3): Plant-specific information, for example installation location.
Maintenance data for S7-1500R/H is created during configuration and downloaded to the
redundant system.
S7-1500R/H supports identification data I&M0 to I&M3. Exception: The synchronization
modules for S7-1500H only support identification data I&M0.
The I&M identification data supports you in the following activities:
• Checking the plant configuration
• Locating hardware changes in a plant
• Correcting errors in a plant
Modules can be clearly identified online using the I&M identification data.

Options for reading out I&M data

• Over the user program
• From the display of the CPUs
• Via STEP 7 or HMI devices

S7-1500R/H redundant system

System Manual, 05/2021, A5E41814787-AC 273
Commissioning
10.8 Identification and maintenance data

Reading I&M data over the user program

You have the following options for reading module I&M data in the user program:
• Using the RDREC instruction
The data record structure for centrally inserted modules and for distributed modules
accessible over PROFINET IO is described in the section Record structure for I&M data
(Page 275).
• Using the Get_IM_Data instruction

Note
Get_IM_Data: Loss of redundancy when reading out the I&M data from the
S7-1500 R/H CPU displays up to FW version V2.8
If you read out the I&M data from the displays of the CPUs, then the "Get_IM_Data"
instruction might, under certain circumstances, return different data to the two CPUs of
the S7-1500R/H redundant system. Further processing of this data in the user program
could possibly result in loss of redundancy.
Do not use the HW identifiers of the displays (65154, 65354) for the LADDR parameter of
the "Get_IM_Data" instruction.

Reference
The description of the instructions can be found in the STEP 7 online help.

Reading I&M data from displays

Proceed as follows to read the I&M data of a CPU:
1. Navigate to the "Overview/PLC" menu on the display of the CPU.
2. Select "Plant designation" or "Location identifier". Click "OK" to confirm.

Reading I&M data via STEP 7

Requirement: There must be an online connection to the CPU.
Proceed as follows to read the I&M data using STEP 7 from the primary and backup CPU:
1. Select the CPU in the project tree.
2. Go to "Online & diagnostics".
3. In the "Diagnostics" folder, select the "General" area.

S7-1500R/H redundant system

274 System Manual, 05/2021, A5E41814787-AC
 Commissioning
10.8 Identification and maintenance data

Enter maintenance data over STEP 7

STEP 7 assigns a default module name. You can enter the following information:
• Plant designation (I&M 1)
• Location identifier (I&M 1)
• Installation date (I&M 2)
• Additional information (I&M 3)
To enter maintenance data via STEP 7, follow these steps:
1. Select the CPU in the STEP 7 device view.
2. Go to properties, "General", and select the "Identification & Maintenance" area.
3. Enter the data.
During the loading of the hardware configuration, the maintenance data (I&M 1, 2, 3) are
also loaded.

10.8.2 Record structure for I&M data

Reading I&M records via user program (centrally and distributed via PROFINET IO)
Use Read data record ("RDREC" instruction) to access specific identification data. Under the
associated record index you obtain the corresponding part of the identification data.
The records are structured as follows:

Table 10- 18 Basic structure of data records with I&M identification data

Contents Length (bytes) Coding (hex)

Header information
BlockType 2 I&M0: 0020H
I&M1: 0021H
I&M2: 0022H
I&M3: 0023H
BlockLength 2 I&M0: 0038H
I&M1: 0038H
I&M2: 0012H
I&M3: 0038H
BlockVersionHigh 1 01
BlockVersionLow 1 00
Identification data
Identification data I&M0/Index AFF0H: 54 -
(see table below) I&M1/Index AFF1H: 54 -
I&M2/Index AFF2H: 16 -
I&M3/Index AFF3H: 54 -

S7-1500R/H redundant system

System Manual, 05/2021, A5E41814787-AC 275
Commissioning
10.8 Identification and maintenance data

Table 10- 19 Record structure for I&M identification data

Identification data Access Example Explanation

Identification data 0: (record index AFF0H)
VendorIDHigh Read (1 bytes) 0000H Vendor name
VendorIDLow Read (1 bytes) 002AH (002AH = SIEMENS AG)
Order_ID Read (20 bytes) 6ES7515-2RM00-0AB0 Article number of module
(for example CPU 1515R-1 PN)
IM_SERIAL_NUMBER Read (16 bytes) - Serial number (device-specific)
IM_HARDWARE_REVISION Read (2 bytes) 1 corresponds to hardware version
(e.g. 1)
IM_SOFTWARE_REVISION Read Firmware version Provides information about the firmware
(1 byte) V version of the module (e.g. V1.0.0)
• SWRevisionPrefix

• IM_SWRevision_Functional_E (1 byte) 0000H - 00FFH

nhancement

• IM_SWRevision_Bug_Fix (1 byte) 0000H - 00FFH

• IM_SWRevision_Internal_ (1 byte) 0000H - 00FFH

Change
IM_REVISION_COUNTER Read (2 bytes) 0000H Provides information about parameter
changes on the module
(not used)
IM_PROFILE_ID Read (2 bytes) 0000 H Generic Device
IM_PROFILE_SPECIFIC_TYPE Read (2 bytes) 0001H CPU
0003H I/O modules
IM_VERSION Read 0101H Provides information on the ID data ver-
(1 byte) sion
• IM_Version_Major (0101H = Version 1.1)
• IM_Version_Minor (1 byte)

IM_SUPPORTED Read (2 bytes) 000EH provides information about the available

identification and maintenance data
(I&M1 to I&M3)
Maintenance data 1: (Record index AFF1H)
IM_TAG_FUNCTION Read/write (32 - Enter an identifier for the module here,
bytes) that is unique plant-wide.
IM_TAG_LOCATION Read/write (22 - Enter the installation location of the
bytes) module here.
Maintenance data 2: (Record index AFF2H)
IM_DATE Read/write (16 YYYY-MM-DD HH:MM Enter the installation date of the module
bytes) here.
Maintenance data 3: (Record index AFF3H)
IM_DESCRIPTOR Read/write (54 - Enter a comment about the module here.
bytes)

S7-1500R/H redundant system

276 System Manual, 05/2021, A5E41814787-AC
 Commissioning
10.8 Identification and maintenance data

10.8.3 Example: Read out firmware version of the CPU with Get_IM_Data

Automation task
You want to check whether the modules in your redundant system have the current
firmware. The firmware version of the modules can be found in the I&M 0 data. The IM 0 data
is the basic information for a device. I&M 0 data contains information such as:
• Manufacturer ID
• Article number and serial number
• Hardware and firmware version
To read out the I&M 0 data, use the "Get_IM_Data" instruction. You read the I&M 0 data of all
modules in the user program of the CPU with "Get_IM_Data" instructions and store the I&M 0
data in a data block.

Conditions and parameters

The following block parameters of the "Get_IM_Data" instruction are important for reading
out the I&M data of the CPU:
• LADDR: You enter the system constants or hardware identifier of the CPU at the LADDR
parameter. You have the following options:
– "Local1" (65149): The instruction always returns the I&M data of the CPU with
redundancy ID 1.
– "Local2" (65349): The instruction always returns the I&M data of the CPU with
redundancy ID 2.
• IM_TYPE: Enter the I&M data number (for example "0" for I&M 0 data) at the IM_TYPE
block parameter.
• DATA: Area for storing the I&M data read (for example in a global data block). Store the
I&M 0 data in an area of the data type "IM0_Data".
This example shows you how to read out the I&M 0 data of a CPU 1513R-1 PN
(redundancy ID 1, 6ES7513-1RL00-0AB0).

S7-1500R/H redundant system

System Manual, 05/2021, A5E41814787-AC 277
Commissioning
10.8 Identification and maintenance data

Solution
Proceed as follows to read out the I&M 0 data of the CPU with the redundancy ID 1:
1. Create a global data block to store the I&M 0 data.
2. Create a structure of the data type "IM0_Data" in the global data block. You can assign any
name to the structure ("imData" in this case).

Figure 10-15 Example: Data block for I&M data

3. Create the "Get_IM_Data" instruction in the user program, for example in OB 1.

4. Connect the "GET_IM_DATA" instruction as follows:

Figure 10-16 Example: Read out I&M0 data from the S7-1500R redundant system

5. Call the "Get_IM_Data" instruction in the user program.

S7-1500R/H redundant system

278 System Manual, 05/2021, A5E41814787-AC
 Commissioning
10.8 Identification and maintenance data

Result
The "Get_IM_Data" instruction has stored the I&M 0 data of the CPU with redundancy ID 1 in
the data block.
You can view the I&M 0 data online in STEP 7, for example with the "Monitor all" button in
the data block. The CPU in the example is a CPU 1513R-1 PN (6ES7513-1RL00-0AB0) with the
firmware version V2.8. The serial number of the CPU is 'S C-F9S840662018'.

Figure 10-17 Example: I&M 0 data of an R CPU

Benefits
You can see from the data block at a glance which module requires an update.

S7-1500R/H redundant system

System Manual, 05/2021, A5E41814787-AC 279
Display 11
11.1 CPU display

Introduction
The following section gives an overview of how the R/H-CPU display operates. Detailed
information on the individual options, a training course and a simulation of the selectable
menu items is available in the SIMATIC S7-1500 Display Simulator
(https://support.industry.siemens.com/cs/ww/en/view/109761758).

Display
The R/H-CPUs have a front cover with a display and operating keys. The display of the CPUs
shows you the control and status information in various menus. You use operating keys to
navigate through the menus and make a variety of settings in the process.

Benefits
The display offers the following advantages:
• Reduced downtimes through diagnostic messages in plain text
• Less time required for commissioning and maintenance, shorter plant downtime.
• Shorter downtimes due to read/write access to force tables and read/write access to watch
tables.
The watch and force tables allow you to monitor and modify the actual values of
individual tags of a user program on the display. You can find additional information on
the watch and force tables in the section Test and service functions (Page 314) and in the
STEP 7 online help.
• Visualization of the SYNCUP system state with graphic and percentage progress display
• Overview of status of safety mode and of F-parameters of integrated F-CPU

Password protection for the display

In the properties of the CPUs, you configure a password in STEP 7 for display operation. Local
access protection is thus protected with a local password. Password protection can be
configured differently for each display.

S7-1500R/H redundant system

System Manual, 05/2021, A5E41814787-AC 280
 Display
11.1 CPU display

Operating temperature for the display

To increase the service life of the display, the display switches off when the permitted
operating temperature is exceeded. When the display has cooled down again, it switches
back on automatically. When the display is switched off, the LEDs continue to show the status
of the CPUs.
You can find additional information on display temperatures in the technical specifications in
the CPU manuals.

Note
The R/H-CPUs have no internal temperature measurement. Reading out the internal
temperature of the R/H-CPUs is not supported.

Display
The following figures show an example of a large display (left: for example CPU 1517H-3 PN)
and small display (right: CPU 1513R-1 PN) of a CPU.

① CPU status information

② Names of the menus
③ Data display field
④ Navigation aid, e.g. OK/ESC or the page number

Figure 11-1 Example views of the displays

S7-1500R/H redundant system

System Manual, 05/2021, A5E41814787-AC 281
Display
11.1 CPU display

Regarding ①: CPU status information

The following table shows the CPU status information that can be retrieved via the display.

Table 11- 1 CPU status information

Color and icons for the status Meaning

data
Green • RUN
• RUN-Syncup
• RUN-Redundant
Orange • STARTUP
• SYNCUP
• STOP
• STOP - firmware update
Red FAULT
White • Connection established between CPU and display.
Protection level configured.

• At least one alarm is active in the CPU.

• No SIMATIC memory card inserted in the CPU.
• No user program loaded.
Force job is active in the CPU.

F-capability activated. Safety mode active. The symbol is grayed out when safety mode is
deactivated.

Fail-safe CPU

S7-1500R/H redundant system

282 System Manual, 05/2021, A5E41814787-AC
 Display
11.1 CPU display

Regarding ②: Names of the menus

The following table shows the available menus of the display.

Table 11- 2 Names of the menus

Main menu items Meaning Description

Overview The "Overview" menu contains information about:
• Properties of the local CPU
• Properties of the F-CPU
– Status of the safety mode
– Collective signature
– Date of the last changes
• Redundancy properties, for example
– Display of role (primary CPU or backup CPU)
– Displaying and setting the redundancy ID
– Display of the pairing state
• Properties of the inserted SIMATIC memory card
Diagnostics The "Diagnostics" menu includes:
• Display of alarms
• Display of the diagnostics buffer
• Read and write access to force and watch tables
• Display of cycle time
• Display of memory used
Settings In the "Settings" menu you:
• Assign IP address and PROFINET device name of the CPU
• Setting date/time
• Set operating states (RUN/STOP)
• Perform a CPU memory reset or reset to factory settings
• Disabling and enabling passwords
• Disable/enable display with display password
• Format SIMATIC memory card
• Run firmware update and display status
• Convert SIMATIC memory card or delete user program
Modules The "Modules" menu is not supported for R/H-CPUs.

Display In the "Display" menu you can configure settings related to the display, such
as language setting, brightness and energy-saving mode. The energy-saving
mode dims the display. Standby mode switches off the display.

S7-1500R/H redundant system

System Manual, 05/2021, A5E41814787-AC 283
Display
11.1 CPU display

Menu icons
The following table shows the icons that are displayed in the menus.

Table 11- 3 Menu icons

Icon Meaning
Editable menu item.

Select the required language.

A message is available in the next lower level page.

There is an error in the next lower level page.

The marked module is not accessible.

Navigate to the next lower level page.

In edit mode you make the selection using two arrow keys:
• Down/up: Jumps to the selection or is used to select the desired digits/options.
In edit mode you make the selection using four arrow keys:
• Down/up: Jumps to the selection or is used to select the desired digits.
• Left/right: Jumps one place forward or back.
The alarm is not yet acknowledged.

The alarm is acknowledged.

S7-1500R/H redundant system

284 System Manual, 05/2021, A5E41814787-AC
 Display
11.1 CPU display

Control keys
You operate the display using the following keys:
• Four arrow keys: "up", "down", "left", "right"
If you press and hold an arrow key for 2 seconds, this generates an automatic scroll
function.
• One ESC key
• One OK key

Figure 11-2 Control keys

Note
If the display is in energy-saving mode or in standby mode, you can exit this mode by
pressing any key.

Functions of the "OK" and "ESC" keys

• For menu commands in which an entry can be made:
– OK → valid access to the menu command, confirmation of input, and exit from the edit
mode
– ESC → restore original content (changes are not saved) and exit edit mode
• For menu commands in which no entry can be made:
– OK → to next submenu command
– ESC → back to previous menu command
Hold ESC for about 3 seconds on any screen of the display. Result: You automatically return to
the home page.

S7-1500R/H redundant system

System Manual, 05/2021, A5E41814787-AC 285
Display
11.1 CPU display

Tooltips
Some of the values shown on the display can exceed the available display width. The values
in question include:
• Station name
• Plant designation
• Location identifier
• PROFINET device name
The available display width is frequently exceeded on CPUs with small displays.
If you focus on the relevant value on the display and press the "Left" arrow key, a tooltip
appears. The tooltip shows the name of the value in complete length. To hide the tooltip
again, press the "Left" arrow key again or the "ESC" key.

Figure 11-3 Tooltip function

S7-1500R/H redundant system

286 System Manual, 05/2021, A5E41814787-AC
 Display
11.1 CPU display

Uploading image to the display via STEP 7

In the STEP 7 device view, you download an image from your file system to the CPU display
with the "Display > User-defined logo" function. Different images can be downloaded to the
two R/H-CPUs for clearer differentiation.

Figure 11-4 Uploading image to CPU

To display the uploaded image in the correct aspect ratio, use images with the following
dimensions depending on the CPU:

Table 11- 4 Dimensions

CPU Dimensions Supported formats

CPU 1513R-1 PN 128 x 120 pixels Bitmap, JPEG, GIF, PNG
CPU 1515R-2 PN 240 x 260 pixels Bitmap, JPEG, GIF, PNG
CPU 1517H-3 PN 240 x 260 pixels Bitmap, JPEG, GIF, PNG
CPU 1518HF-4 PN 240 x 260 pixels Bitmap, JPEG, GIF, PNG

If the uploaded image exceeds the specified dimensions, the display shows only part of the
image. The "Adapt logo" option in STEP 7 allows you to reduce the image to the specified
dimensions. However, note that the original aspect ratio of the image is not retained in such
cases.

Displaying image on the display

To display the uploaded image on the display of the CPU, press the ESC key in the main
screen of the display. When you upload an image and are in the main screen, the display
automatically shows the image after 60 seconds. To hide the image again, press any key on
the display.

S7-1500R/H redundant system

System Manual, 05/2021, A5E41814787-AC 287
Display
11.1 CPU display

Available language settings

You can set the following languages separately for menu and message texts:
• Chinese
• German
• English
• French
• Italian
• Japanese
• Korean
• Portuguese (Brazil)
• Russian
• Spanish
• Turkish
You select the required language directly at the display in the "Display" menu or in STEP 7 in
the hardware configuration of the CPU under "User interface languages".
Proceed as follows to display message texts on the display:
1. Configure the project language that you want to be displayed as the interface language.
– To do so, select a CPU and navigate to the "Multiple languages" area ("Properties >
General > Multilingual support") in the Inspector window.
– Assign the required project languages to the interface languages.
2. Download the message texts to the CPU as a software component.
– To do so, select the "Consistent download" option under "Text libraries" in the "Load
preview" dialog (default).

Reference
Important information/special requirements for the display of HF-CPUs can be found in the
Product Information F-CPUs S7-1500
(https://support.industry.siemens.com/cs/ww/de/view/109478599/en).

S7-1500R/H redundant system

288 System Manual, 05/2021, A5E41814787-AC
Maintenance 12
12.1 Replacing components of the S7-1500R/H redundant system

12.1.1 Checking before replacing components

Introduction
Please observe the following rules if the redundant system is in the RUN-Solo system state:
• Do not immediately start replacing components.
• Do not immediately switch the failed CPU to the RUN. operating state.
First check the pairing status in the RUN-Solo system state.

Checking pairing in the RUN-Solo system state

CAUTION
Do not switch the failed CPU in the RUN-Solo system state to the RUN operating state.
This could result in an undefined system state for the redundant system. Both CPUs would
become primary CPUs.
If the S7-1500R/H redundant system is in the RUN-Solo system state, you must not
immediately switch the backup CPU to the RUN operating state.
Possible cause: No pairing between the two CPUs. Check the pairing status on the display or
on the basis of the diagnostics status or diagnostics buffer.
If there is no pairing, the redundancy connections have been interrupted, for example. In
this case, please note the procedure below.

S7-1500R/H redundant system

System Manual, 05/2021, A5E41814787-AC 289
Maintenance
12.1 Replacing components of the S7-1500R/H redundant system

Checking pairing state

You have the following options for checking the pairing state:
• Directly from the display of the backup CPU.
In the "Overview > Redundancy > Pairing state" menu:
– Paired
– Single paired (X*P*)
– Not paired
– Not paired - Too many partners
– Not paired - Article number mismatch
– Not paired - Firmware mismatch

Primary CPU Backup CPU

Example: Paired

S7-1500R/H redundant system

290 System Manual, 05/2021, A5E41814787-AC
 Maintenance
12.1 Replacing components of the S7-1500R/H redundant system

• In STEP 7 in the diagnostic status (Online & diagnostics) of the S7-1500R/H system:
Check the system state in the diagnostic status:
– Pairing: "Paired" is shown in the "Pairing state" field.
– No pairing: "No pairing" is displayed in the "Pairing status" field.

Figure 12-1 "Paired" diagnostics state

• In STEP 7 in the diagnostics buffer (Online & diagnostics): Check the entries on pairing.

Procedure
To start the pairing, for example when redundancy connections are interrupted, follow these
steps:
1. Set the mode selector for the backup CPU to STOP.
2. S7-1500R: Repair the PROFINET cables in the PROFINET ring. Insert the PROFINET cables into
the R-CPU interfaces.
S7-1500H: Repair the fiber-optic cables and synchronization modules. Insert the fiber-optic
cables into the synchronization modules.
3. Check for successful pairing of the redundant system. Please note the information in
"Checking pairing state" above.
4. Set the mode selector for the backup CPU to RUN.

Result
The S7-1500R/H redundant system switches to the RUN-Redundant system state.

S7-1500R/H redundant system

System Manual, 05/2021, A5E41814787-AC 291
Maintenance
12.1 Replacing components of the S7-1500R/H redundant system

12.1.2 Replacing defective R/H-CPUs

Initial situation
One of the two R/H-CPUs has failed or the R/H-CPU is no longer working.
The S7-1500R/H redundant system is in the RUN-Solo system state.

Note
Replacing defective HF-CPU with safety program
You can find the exact procedure in the SIMATIC Safety - Configuring and Programming
(https://support.industry.siemens.com/cs/ww/de/view/54110126/en) programming and
operating manual.

Requirements
• Read the information in the section Checking before replacing components (Page 289).
• The replacement CPU has the same article number and firmware version as the failed
R/H-CPU. It may be necessary to load an older firmware version onto the replacement CPU.
• The replacement CPU has a SIMATIC memory card with sufficient storage capacity.
• The primary CPU has not disabled SYNCUP (default).

Procedure for replacing R/H-CPUs

Proceed as follows to replace an R/H-CPU in the redundant system:
1. Switch off the supply voltage to the failed R/H-CPU.
2. Remove the connector for the supply voltage.
3. Disconnect all PROFINET bus connectors. Then remove the bus connectors from the
R/H-CPU.
4. For H-CPUs only: Disconnect the redundancy connections (fiber-optic cables) at the H-CPU.
5. For H-CPUs only: Pull the synchronization modules out of the H-CPU.
6. Remove the failed R/H-CPU.
7. Install the replacement CPU with the SIMATIC memory card inserted and the mode selector
in the STOP position.
8. For H-CPUs only: Insert the synchronization modules in the replacement CPU.
9. For H-CPUs only: Insert the redundancy connections (fiber-optic cables) in the
synchronization modules.
10.Insert the PROFINET bus connectors into the R/H-CPU.
11.Push the connector for the supply voltage into the socket on the R/H-CPU.
12.Switch the supply voltage back on.
13.Check the pairing.
14.Start the replacement CPU.

S7-1500R/H redundant system

292 System Manual, 05/2021, A5E41814787-AC
 Maintenance
12.1 Replacing components of the S7-1500R/H redundant system

Result
1. The replaced R/H-CPU executes SYNCUP.
2. The replaced R/H-CPU switches to the RUN-Redundant operating state and operates as
backup CPU.

12.1.3 Replacing defective redundancy connections

Introduction
This section describes the following replacement scenarios:
S7-1500R:
• Replace defective PROFINET cable with S7-1500R.
The PROFINET ring has been interrupted at any given point. You can find additional
information in the section Replacing defective PROFINET cables (Page 297).
• Replace two defective PROFINET cables with S7-1500R.
The PROFINET ring has been interrupted at two points.
S7-1500H:
• Replace a defective redundancy connection with S7-1500H.
A fiber-optic cable has been interrupted.
• Replace defective synchronization module with S7-1500H.
• Replace two defective redundancy connections with S7-1500H.
Both fiber-optic cables have been interrupted.

Evaluating the diagnostics buffer

Detailed diagnostics information is provided in the diagnostics buffer of the R/H-CPU. The
entries are particularly useful in the replacement scenarios for the redundancy connections:
• S7-1500R: They contain information on whether one PROFINET cable or both PROFINET
cables have been interrupted or a port of an R-CPU is defective.
• S7-1500H: You can access information on whether a fiber-optic cable has been
interrupted or the synchronization module is defective (with additional module
diagnostics).

S7-1500R/H redundant system

System Manual, 05/2021, A5E41814787-AC 293
Maintenance
12.1 Replacing components of the S7-1500R/H redundant system

12.1.3.1 Replacing two defective PROFINET cables with S7-1500R

Initial situation: Failure of two PROFINET cables, one after the other
Two PROFINET cables in the PROFINET ring have been interrupted one after the other at two
points (> 1500 ms apart).
The S7-1500R redundant system is in the RUN-Solo system state.

Requirement
Read the information in the section Checking before replacing components (Page 289).

Procedure: Replacing the two PROFINET cables

Proceed as follows to replace the defective PROFINET cables:
1. Locate the defective PROFINET cables in the PROFINET ring.
2. Replace the PROFINET cables, one after the other.
3. If necessary, restart each of the two CPUs on after the other.

Result
The redundant system switches to the RUN-Redundant system state.

Initial situation: Failure of two PROFINET cables simultaneously

Two PROFINET cables in the PROFINET ring have been interrupted at two points
simultaneously (≤ 1500 ms apart).
Both R-CPUs are primary CPUs. The S7-1500R redundant system is in an undefined system
state.

Procedure: Replacing the two PROFINET cables

Proceed as follows to replace the defective PROFINET cables:
1. Immediately switch both R-CPUs to the STOP operating state.
2. Locate the defective PROFINET cables in the PROFINET ring.
3. Replace the PROFINET cables, one after the other.
4. Then start the R-CPUs.

Result
The redundant system switches to the RUN-Redundant system state.

S7-1500R/H redundant system

294 System Manual, 05/2021, A5E41814787-AC
 Maintenance
12.1 Replacing components of the S7-1500R/H redundant system

12.1.3.2 Replacing a defective redundancy connection with S7-1500H

Initial situation
One redundancy connection (fiber-optic cable) has been interrupted. Display shows: Single
pairing with information on interface and port.
The S7-1500H redundant system is in the RUN-Redundant system state.

Procedure: Replacing the redundancy connection

Proceed as follows to replace a defective redundancy connection:
1. Check the LEDs X3/X4 (CPU 1517H-3 PN) or LEDs X4/X5 (CPU 1518HF-4 PN). You can
pinpoint the defective redundancy connection on the basis of which LEDs are off.
2. Check the redundancy connection that you have located with the LEDs.
3. If the redundancy connection is defective, replace the fiber-optic cable.

Result
The defective redundancy connection has been replaced. The X3/X4 or X4/X5 LEDs flicker
yellow/green.

12.1.3.3 Replacing defective synchronization module with S7-1500H

Initial situation
A synchronization module has failed.
The redundant S7-1500H is in the RUN-Redundant system state.

Procedure: Replacing the synchronization module

Proceed as follows to replace a defective synchronization module:
1. Check the LEDs X3/X4 (CPU 1517H-3 PN) or LEDs X4/X5 (CPU 1518HF-4 PN) on the primary
and backup CPU. Locate the defective synchronization module on the basis of which LEDs
are off.
2. Replace the defective synchronization module. Connect the redundancy connection
(fiber-optic cable).
3. If the X3/X4 or X4/X5 LEDs remain off, replace the synchronization module on the other
CPU.

Result
The defective synchronization module has been replaced. The X3/X4 or X4/X5 LEDs flicker
yellow/green.

S7-1500R/H redundant system

System Manual, 05/2021, A5E41814787-AC 295
Maintenance
12.1 Replacing components of the S7-1500R/H redundant system

12.1.3.4 Replacing both defective redundancy connections with S7-1500H

Initial situation: Failure of both redundancy connections, one after the other
The two redundancy connections (fiber-optic cables) have been interrupted one after the
other (> 55 ms apart).
The S7-1500H redundant system is in the RUN-Solo system state.

Requirement
Read the information in the section Checking before replacing components (Page 289).

Procedure: Replacing both redundancy connections

Proceed as follows to replace the defective redundancy connections:
1. Check the LEDs X3/X4 (CPU 1517H-3 PN) or LEDs X4/X5 (CPU 1518HF-4 PN) on the primary
and backup CPU. If all LEDs are off, both redundancy connections are defective.
2. Replace the redundancy connections (fiber-optic cables) one after the other.
3. Start the CPU which is in STOP mode.

Result
The defective redundancy connections have been replaced. The redundant system switches
to the RUN-Redundant system state. The X3/X4 or X4/X5 LEDs flicker yellow/green.

Initial situation: Failure of both redundancy connections simultaneously

The two redundancy connections (fiber-optic cables) have been interrupted simultaneously
(≤ 55 ms apart).
Both H-CPUs are primary CPUs. The S7-1500H redundant system is in an undefined system
state.

Procedure: Replacing both redundancy connections

Proceed as follows to replace the defective redundancy connections:
1. Immediately switch both H-CPUs to the STOP operating state.
2. Replace the redundancy connections (fiber-optic cables) one after the other.
3. Switch the H-CPUs back to the RUN operating state.

Result
The redundant system switches to the RUN-Redundant system state. The X3/X4 or X4/X5 LEDs
flicker yellow/green.

S7-1500R/H redundant system

296 System Manual, 05/2021, A5E41814787-AC
 Maintenance
12.1 Replacing components of the S7-1500R/H redundant system

12.1.4 Replacing defective PROFINET cables

Initial situation
The PROFINET ring has been interrupted at any given point. The MAINT LEDs on both CPUs
are yellow. The following is shown on the S7-1500R display: Single pairing with information
on interface and port.
The S7-1500R/H redundant system is in the RUN-Redundant system state.

Procedure: Replacing the PROFINET cable

Proceed as follows to replace the defective PROFINET cable:
1. Check the X1 P1/X1 P2 LEDs on the primary and backup CPU. LEDs that are off indicate an
interruption to the PROFINET ring.
2. Locate the defective PROFINET cable in the PROFINET ring. Check the link RX/TX LEDs of the
PROFINET nodes. If the link RX/TX LEDs are switched off, there is no connection between the
interface of the PROFINET device and the communication partner.
3. Replace the defective PROFINET cable.

Result
The defective PROFINET cable has been replaced.
The X1 P1/X1 P2 LEDs on the primary and backup CPU are yellow. The MAINT LEDs on both
CPUs are off.

S7-1500R/H redundant system

System Manual, 05/2021, A5E41814787-AC 297
Maintenance
12.1 Replacing components of the S7-1500R/H redundant system

12.1.5 Replacing a defective SIMATIC memory card

Initial situation
The SIMATIC memory card of a CPU is defective. System diagnostics reports a system error.
The CPU affected has switched to the STOP operating state.
The S7-1500R/H redundant system is in the RUN-Solo system state.

Note
Replacing defective SIMATIC memory card in HF-CPU with safety program
You can find the exact procedure in the SIMATIC Safety - Configuring and Programming
(https://support.industry.siemens.com/cs/ww/de/view/54110126/en) programming and
operating manual.

Requirement
• Read the information in the section Checking before replacing components (Page 289).
• The new SIMATIC memory card must have sufficient memory for the project.

Procedure
Proceed as follows to replace a defective SIMATIC memory card:
1. Replace the SIMATIC memory card in the CPU in STOP.
2. Start the CPU.

Result
1. The redundant system runs SYNCUP. SYNCUP transfers the project data from the primary to
the backup CPU.
2. The CPU switches to the RUN-Redundant operating state and operates as backup CPU. The
redundant system is in the RUN-Redundant system state again.

Reference
If there is not enough memory space on a SIMATIC memory card, the card can be replaced
during operation. You will find the procedure, the response of the redundant system and
other information on the SIMATIC memory card in the function manual Structure and use of
the CPU memory (https://support.industry.siemens.com/cs/de/de/view/59193101/en).

S7-1500R/H redundant system

298 System Manual, 05/2021, A5E41814787-AC
 Maintenance
12.1 Replacing components of the S7-1500R/H redundant system

12.1.6 Replace defective load current supply PM

Initial situation
A load current supply PM has failed.
The S7-1500R/H redundant system is in the RUN-Solo system state.

Requirement
Read the information in the section Checking before replacing components (Page 289).

Procedure
Proceed as follows to replace a defective load current supply:
1. Switch off the mains supply (24 V DC or 230 V AC).
2. Replace the defective load current supply PM.
3. Switch the mains supply back on.
4. Switch on the replaced load current supply PM.

Result
1. The CPU with the replaced load current supply PM runs SYNCUP. Requirement: The CPU
mode selector is in RUN.
2. The CPU switches to the RUN-Redundant operating state and operates as backup CPU. The
redundant system is in the RUN-Redundant system state again.

S7-1500R/H redundant system

System Manual, 05/2021, A5E41814787-AC 299
Maintenance
12.1 Replacing components of the S7-1500R/H redundant system

12.1.7 Replacing defective IO devices/switches

Initial situation
A PROFINET device (IO device/switch) in the PROFINET ring has failed, for example because of
a defect in the IO device or failure of the power supply. The PROFINET ring has been
interrupted. The MAINT LEDs on both CPUs are yellow. The ERROR LEDs on both CPUs are
flashing red.
The S7-1500R/H redundant system is in the RUN-Redundant system state.

Note
If a switch/IO device fails, the S7-1500R/H redundant system has no access to the
downstream devices in the connected line topology.

Procedure
Proceed as follows to replace a defective PROFINET device:
1. Locate the faulty PROFINET device.
2. Switch off the supply voltage for the PROFINET device.
3. Disconnect the cables for the supply voltage.
4. Disconnect the PROFINET cables from the ports of the PROFINET device.
5. Replace the PROFINET device.
6. Connect the PROFINET cables to the ports of the PROFINET device.
7. Connect the cables for the supply voltage to the PROFINET device.
8. Switch the supply voltage back on.

Note
Setting the media redundancy role Client for the PROFINET devices
If you replace a PROFINET device in the PROFINET ring, you need to assign the media
redundancy role "Client" to the PROFINET device in STEP 7. The client media redundancy role
setting is important for nodes that are not IO devices (such as switches). These nodes do not
receive the parameters assigned by the R/H CPUs.
Replaced IO devices are automatically configured by the R/H-System and receive the correct
setting again.

Result
The PROFINET ring has been closed again. The PROFINET device can be accessed again in the
S7-1500R/H redundant system. The MAINT and ERROR LEDs on both CPUs are off.

S7-1500R/H redundant system

300 System Manual, 05/2021, A5E41814787-AC
 Maintenance
12.2 Replacing the front cover

12.2 Replacing the front cover

Replacing the front cover

The front cover is pluggable. If necessary, you can take off the front cover or replace the front
cover during runtime (RUN-Redundant). Removing or replacing the front cover does not
affect the CPU in operation.
To remove the front cover from the CPU, follow these steps:
1. Flip up the front cover until the front cover stands at a 90° angle to the front of the module.
2. In the top section of the front cover, press on the anchor(s): Two anchors with
CPU 1515R-2 PN, CPU 1517H-3 PN and CPU 1518HF-4 PN. One anchor with
CPU 1513R-1 PN.
At the same time, pull the front cover towards you and off.
The view in the figure below is an example of CPU 1515R-2 PN.

① Fasteners for removing and fitting the front panel

Figure 12-2 Removing and fitting the front panel

WARNING
Personal injury or material damage can occur in zone 2 hazardous areas
If you remove or attach the front cover during operation, personal injury and damage can
occur in hazardous areas of zone 2.
Always deenergize the R/H-CPU from the power supply before you remove or attach the
front cover in hazardous areas of zone 2.

S7-1500R/H redundant system

System Manual, 05/2021, A5E41814787-AC 301
Maintenance
12.3 Replacing the coding element at the power connector of the load current supply

12.3 Replacing the coding element at the power connector of the load
current supply

Introduction
The coding consists of a 2-part coding element.
Ex factory a part of the coding element is inserted into the back side of the power connector.
The other part is firmly inserted in the load current supply.
This prevents the insertion of a power connector of a load current supply into a module of a
different type.

DANGER
Do not manipulate the coding element, or leave it off
• Changing or replacing the coding element can result in dangerous system states.
• To avoid damage, do not change or replace the coding element.
• You must not remove the coding element.

Replacement parts scenario

Insertion of the coding element into a new power connector in the case of a replacement
part.

DANGER
Dangerous voltage
When installing the coding element, you must take into account the supply voltage of the
load current supply: 24 V DC, 24/48/60 V DC or 120/230 V AC/DC
Only install the coding element with switched-off voltage.
You must insert the coding element in such a way that the power connector matches the
power supply module in terms of voltage.

S7-1500R/H redundant system

302 System Manual, 05/2021, A5E41814787-AC
 Maintenance
12.3 Replacing the coding element at the power connector of the load current supply

Procedure
To replace the coding element on the power connector of the load current supply, follow
these steps:
1. Orient yourself using the labeling on the power cable connection.

Figure 12-3 Labeling on the power connector

2. Orient yourself using the red marking on the coding element.

3. The coding element has 3 red markings. Turn the coding element in such a way that one of
the 3 red markings corresponds to the voltage indicated on the connector.
4. Insert the coding element into the back side of the power cable connector, until you hear it
click into place. The figure below shows you how to insert a coding element into a power
cable connector for 24 V DC.

Figure 12-4 Inserting a coding element into a power connector

S7-1500R/H redundant system

System Manual, 05/2021, A5E41814787-AC 303
Maintenance
12.4 Firmware update

12.4 Firmware update

Introduction
You use firmware files to update the firmware of the CPUs, displays and the IO devices (for
example for new functions). The retentive data is retained after the firmware has been
updated.

Note
CPUs operating in redundant mode
CPUs operating in redundant mode must have the same article number and the same
firmware version.

For the replacement of components, the two CPUs operating in redundant mode must have
the same firmware version. Downgrades are therefore possible as well as updates.

Note
CPU downgrades and upgrades
You cannot upgrade a standard CPU or F-CPU to an R-CPU or H-CPU. You cannot downgrade
the firmware of an R/H-CPU to a standard or F-CPU either.

We recommend that you always update to the latest firmware version available for the
respective article number. The previous versions of the firmware are only intended as a
backup to enable you to downgrade to the original version.
A firmware update has no effects on the user program of the CPU on which the update was
performed. However, a downgrade can have effects on the user program if you use new
functions in the user program which were not yet supported by the firmware of the CPU.
The following entry (https://support.industry.siemens.com/cs/de/en/view/109478459) lists all
firmware versions for the CPUs including displays. You will also find a description of the new
functions of the respective firmware versions.

S7-1500R/H redundant system

304 System Manual, 05/2021, A5E41814787-AC
 Maintenance
12.4 Firmware update

Requirement
You have downloaded the files for the firmware update from Siemens Industry Online
Support (https://support.industry.siemens.com/cs/ww/en/ps).
On this Web page, select:
Automation technology > Automation systems > SIMATIC industrial automation systems >
Controllers > Advanced Controller > S7-1500 > CPUs > Redundant CPUs

Figure 12-5 Product tree using the S7-1500 as an example

From this position, navigate to the specific type of module that you want to update. To
continue, click on the "Software downloads" link under "Support". Save the required firmware
update files.
Before installing the firmware update, make sure that the modules are not being used.

Options for the firmware update

The options for performing a firmware update are as follows:
• Online in STEP 7 via Online & Diagnostics
• Via the SIMATIC memory card: For CPU and display only
The table below gives an overview of the various options for a firmware update.

Firmware update CPU Display PROFINET IO devices

STEP 7 via Online & diagnostics ✓ ✓
SIMATIC memory card ✓ --

S7-1500R/H redundant system

System Manual, 05/2021, A5E41814787-AC 305
Maintenance
12.4 Firmware update

Procedure: online in STEP 7 via Online & diagnostics

Requirements: There is an online connection between the CPU/PROFINET IO device and
PG/PC.
Proceed as follows to perform a firmware update online via STEP 7:
1. Select the module in the device view.
2. Select the "Online & diagnostics" menu command from the shortcut menu.
3. In the "Functions" folder, select the "Firmware update" group.
For a CPU, you can select whether you want to update the CPU or the display.
4. Click the "Browse" button to select the path to the firmware update files in the "Firmware
update" area.
5. Select the correct firmware file. The table in the firmware update area lists all modules for
which an update is possible with the selected firmware file.
6. Click the "Run update" button. If the module can interpret the selected file, the file is
downloaded to the module. If you need to change the CPU operating state, STEP 7 prompts
you to do so with dialogs.

Note
Updating PROFINET IO device
The R/H system remains in the RUN-Redundant system state if you update an IO device.

Updating the firmware

The "Run firmware after update" check box is always selected.
Once the files have been successfully loaded, the CPU accepts the firmware and operates
with the new firmware.

S7-1500R/H redundant system

306 System Manual, 05/2021, A5E41814787-AC
 Maintenance
12.4 Firmware update

Procedure with the SIMATIC memory card

Proceed as follows to perform a firmware update using the SIMATIC memory card:
1. Insert a SIMATIC memory card into the SD card reader of your PG/PC.
2. To store the update file on the SIMATIC memory card, select the SIMATIC memory card
under "Card reader/USB memory" in the project tree.
3. Select the "Card Reader/USB memory > Create firmware update memory card" command in
the "Project" menu.
4. Use a file selection dialog to navigate to the firmware update file. You can then also decide
whether to delete the content of the SIMATIC memory card or add the firmware update files
to the SIMATIC memory card.
5. Insert the SIMATIC memory card with the firmware update files into the CPU.
The firmware update begins shortly after the SIMATIC memory card has been inserted.
The display indicates that the CPU is in STOP and is running a firmware update.
The display shows a results screen after completion of the firmware update.
6. The RUN LED on the CPU lights up in yellow and the MAINT LED flashes yellow.
Remove the SIMATIC memory card after the firmware update is complete.
If you subsequently wish to use the SIMATIC memory card as a program card, leave the
SIMATIC memory card in the CPU. To do so, after completion of the firmware update, select
the "Convert memory card" menu item on the display.
Alternatively, you can also convert the SIMATIC memory card to a program card in STEP 7.

Note
Memory size of the SIMATIC memory card
If you perform a firmware update via the SIMATIC memory card, you must use a large enough
card.
Check the specified file sizes of the update files when downloading them from Siemens
Industry Online Support. The total size of the update files must not exceed the available
memory size of your SIMATIC memory card.
You can find more information on the capacity of SIMATIC memory cards in the section
Accessories/spare parts (Page 341) and in the function manual Structure and use of the
CPU memory (https://support.industry.siemens.com/cs/de/de/view/59193101/en).

S7-1500R/H redundant system

System Manual, 05/2021, A5E41814787-AC 307
Maintenance
12.4 Firmware update

Installation of the firmware update of R/H-CPUs

For a firmware update of the R/H-CPUs, you must switch both R/H-CPUs to the STOP operating
state. A role change between primary and backup CPU can occur during the firmware update.
The initial situation is assumed in the following: CPU 1 is the primary CPU. CPU 2 is the
backup CPU.
You must proceed in the following order for retentive data to be retained during a firmware
update:
1. Switch CPU 2 to the STOP operating state.
2. Run the update for CPU 2.
Please note: Ignore any pairing error (incorrect firmware) after CPU 2 startup.
3. Switch CPU 1 to the STOP operating state.
4. Now run the update for CPU 1.
5. Switch CPU 1 to the RUN operating state.
6. Switch CPU 2 to the RUN operating state.

WARNING
Risk of impermissible system states
The installation of the firmware update switches the CPUs to the STOP operating state and
therefore the redundant system to the STOP system state. STOP can impact the operation of
an online process or a machine.
Unexpected operation of a process or a machine can lead to fatal or severe injuries and/or to
material damage.
Ensure before installing the firmware update that the CPU is not controlling any active
process.

Installation of the firmware update for R/H-CPU displays

Firmware updates for the R/H-CPU displays are run in the RUN-Solo system state. A role
change between primary and backup CPU can occur during the firmware update. The initial
situation is assumed in the following: CPU 1 is the primary CPU. CPU 2 is the backup CPU.
Follow the sequence below:
1. Switch CPU 2 to the STOP operating state.
2. Run the update for the CPU 2 display.
3. Switch CPU 2 to the RUN operating state. Wait until the R/H system switches to the
RUN-Redundant system state.
4. Switch CPU 1 to the STOP operating state.
5. Run the update for the CPU 1 display.
6. Switch CPU 1 to the RUN operating state. Wait until the R/H system switches to the
RUN-Redundant system state.

S7-1500R/H redundant system

308 System Manual, 05/2021, A5E41814787-AC
 Maintenance
12.5 Resetting CPUs to factory settings

Behavior after the firmware update

After the firmware update, check the firmware version of the updated module.

Reference
You can find more information on firmware updates in the STEP 7 online help.

12.5 Resetting CPUs to factory settings

Introduction
The CPU can be reset to its as-delivered condition using "Reset to factory settings". The
function deletes all information saved internally on the CPU.
Recommendation:
Switch the CPU to its as-delivered condition if:
• You remove a CPU and use it elsewhere with a different program.
• You store the CPU.
When resetting to factory settings, remember that the IP address parameters are also deleted.

Options for resetting a CPU to factory settings

You can reset the CPU to its as-delivered condition:
• Using the mode selector
• Using the display
• Using STEP 7

S7-1500R/H redundant system

System Manual, 05/2021, A5E41814787-AC 309
Maintenance
12.5 Resetting CPUs to factory settings

Procedure using the mode selector

Make sure that the CPU is in STOP operating state: The CPU display indicates the STOP
operating state: The RUN/STOP LED lights up yellow.

Note
Reset to factory settings ↔ Memory reset
The procedure described below corresponds to the procedure for a memory reset:
• Selector operation with inserted SIMATIC memory card: CPU executes a memory reset
• Selector operation without inserted SIMATIC memory card: CPU executes reset to factory
settings

Restore the factory settings of the CPU as follows:

1. Set the mode selector to the STOP position.
Result: The RUN/STOP LED lights up yellow.
2. Remove the SIMATIC memory card from the CPU. Wait until the RUN/STOP LED stops
flashing.
3. Set the mode selector to the MRES position. Hold the mode selector in this position until the
RUN/STOP LED lights up for the second time and remains continuously lit after 3 seconds.
Then release the mode selector.
4. Within the next three seconds, switch the mode selector back to the MRES position and then
back to STOP.
Result: The CPU executes a "Reset to factory settings", during which time the RUN/STOP LED
flashes yellow. When the RUN/STOP LED lights up in yellow, the CPU has been reset to factory
settings and is in the STOP operating state. The "Reset to factory settings" event is entered in
the diagnostics buffer.

Note
Resetting the CPU to the factory settings with the mode selector also deletes the IP address of
the CPU and resets the redundancy ID to 1.

Procedure using the display

Make sure that the CPU is in STOP operating state: The CPU indicates the STOP operating
state. The RUN/STOP LED lights up yellow.
1. Wait until the RUN/STOP LED stops flashing.
2. To navigate to the required "Factory settings" menu command, select the following
sequence of menu commands and confirm each selection with "OK".
– Settings → Reset → Factory settings
Result: The CPU executes a "Reset to factory settings", during which time the RUN/STOP LED
flashes yellow. When the RUN/STOP LED lights up in yellow, the CPU has been reset to factory
settings and is in the STOP operating state. The "Reset to factory settings" event is entered in
the diagnostics buffer.

S7-1500R/H redundant system

310 System Manual, 05/2021, A5E41814787-AC
 Maintenance
12.5 Resetting CPUs to factory settings

Procedure using STEP 7

Proceed as follows to reset a CPU to factory settings with STEP 7:
Make sure that there is an online connection to the CPU.
1. Open the Online and Diagnostics view of the CPU.
2. In the "Functions" folder, select the "Reset to factory settings" group.
3. If you want to keep the IP address, select the "Keep IP address" option button. If you want to
delete the IP address, select the "Delete IP address" option button.

Note
"Delete IP address" deletes all IP addresses, regardless of how you established the online
connection.
If a SIMATIC memory card is inserted, selecting the "Delete IP address" option has the
following effect:
• The IP addresses are deleted and the CPU is reset to factory settings.
• The configuration (including IP address) on the SIMATIC memory card is then
downloaded to the CPU. If there is no saved configuration (because the SIMATIC
memory card has been cleared or formatted, for example), no new IP address is
assigned.

4. Click the "Reset" button.

5. Click "OK" in response to the confirmation prompts.
Result: The CPU executes a "Reset to factory settings", during which time the RUN/STOP LED
flashes yellow. When the RUN/STOP LED lights up in yellow, the CPU has been reset to factory
settings and is in STOP. The "Reset to factory settings" event is entered in the diagnostics
buffer.

S7-1500R/H redundant system

System Manual, 05/2021, A5E41814787-AC 311
Maintenance
12.5 Resetting CPUs to factory settings

Result after resetting to factory settings

The table below gives an overview of the contents of the memory objects after the reset to
factory settings.

Table 12- 1 Result after resetting to factory settings

Memory object Contents

Redundancy ID Set to "1"
Actual values of the data blocks, instance data blocks Initialized
Bit memories, timers and counters Initialized
Retentive tags of technology objects Initialized
Entries in the diagnostics buffer (retentive area) Initialized
Entries in the diagnostics buffer (non-retentive area) Initialized
IP address Depends on the procedure:
• Using mode switch: Is deleted
• Using display: Is deleted
• Using STEP 7: Depends on the setting of the "Retain IP ad-
dress"/"Delete IP address" option buttons
Device name (module name) Is set to "CPUcommon"
Counter readings of the runtime meters Initialized
Time of day Set to "00:00:00, Jan. 01, 2012"

Note
IP address conflict
Resetting the CPU to the factory settings also deletes the IP address of the CPU and resets the
redundancy ID to 1. Please note the following:
An S7-1500R/H redundant system that is already in operation is switched to the STOP system
state. If you reset the CPU with redundancy ID 2 to factory settings, that CPU is assigned the
IP address of the other CPU (with redundancy ID 1). This results in an IP address conflict. You
can only access the CPU with the emergency address. You can find information on the
emergency address in the section Backing up and restoring the CPU configuration (Page 266).
Possible remedy: Using the display, assign the CPU the redundancy ID previously set. You can
then access the CPU over the original IP address again.

Note
Password for protection of confidential configuration data
The password for protection of confidential configuration data is retained after the CPU is
reset to factory settings. The password is only deleted when the "Delete password for
protection of confidential PLC configuration data" option is set.
You can find additional information on the password for protection of confidential
configuration data in the Communication
(https://support.industry.siemens.com/cs/ww/de/view/59192925/en) function manual.

S7-1500R/H redundant system

312 System Manual, 05/2021, A5E41814787-AC
 Maintenance
12.6 Maintenance and repair

Reference
You can find more information on "Reset to factory settings" in the section on memory areas
and retentivity in the function manual Structure and use of the CPU memory
(http://support.automation.siemens.com/WW/view/en/59193101), and in the STEP 7 online
help. For information on CPU memory resets, please refer to the section CPU memory reset
(Page 263).

12.6 Maintenance and repair

The R/H CPUs are maintenance-free.

Note
Repairs to the R/H CPUs may only be carried out by the manufacturer.

S7-1500R/H redundant system

System Manual, 05/2021, A5E41814787-AC 313
Test and service functions 13
13.1 Test functions

Introduction
You have the option of testing the operation of your user program on the CPU. You monitor
the signal states and values of tags. You preassign values to tags to allow you to simulate
specific situations for program execution.

Note
Using test functions
Using test functions affects the program execution time and thus the cycle and response
times of the controller.

Note
Test functions in the RUN-Redundant system state: Check for sufficient free space
before a write function
Before a write function is performed, the system checks whether there is enough free space
on the SIMATIC memory cards of the CPUs for the function. Writing functions are online
functions with the PG/PC, for example, loading/deleting a block, test functions, loading a
modified user program in RUN-Redundant system state.
If there is not enough space on a SIMATIC memory card or on both SIMATIC memory cards,
the write function is aborted and the redundant system continues operation with the original
configuration. The redundant system will remain in the RUN-Redundant system state.

Requirements
• There is an online connection to the relevant primary or backup CPU. A simultaneous
online connection to both CPUs is not possible.
• An executable user program is available in the CPU.
• The redundant system must not be in the SYNCUP system state.
Exception: The test functions "Test with a force table" and "Trace function" are also
supported in the SYNCUP system state. However, there is no online connection during the
SYNCUP system state. You can find more information in this section.

S7-1500R/H redundant system

System Manual, 05/2021, A5E41814787-AC 314
 Test and service functions
13.1 Test functions

Test options
• Testing with program status
• Testing with breakpoints (only in the STARTUP (startup OB) or RUN-Solo system state)
• Testing with a watch table
• Testing with a force table
• Testing with a PLC tag table
• Testing with a data block editor
• Testing with the LED flash test
• Testing with a trace function

Testing with program status

The program status allows you to monitor the execution of the program. You can display the
values of operands and the results of logic operations (RLO). This allows you to detect and fix
logical errors in your program.

Note
Restrictions with the "Program status" function
Monitoring loops can significantly increase the cycle time. The increase in cycle time depends
on the following factors:
• The number of tags to be monitored
• The actual numbers of loops run through

WARNING
Testing with program status
Testing with the "Program status" function can cause serious damage and injury if there are
functional disruptions or program errors.
Make sure that you take appropriate measures to exclude the risk of dangerous states
occurring before running a test with the "Program status" function.

S7-1500R/H redundant system

System Manual, 05/2021, A5E41814787-AC 315
Test and service functions
13.1 Test functions

Testing with breakpoints

With this test option, you set breakpoints in your program, establish an online connection,
and enable the breakpoints on the CPU. You then execute a program from one breakpoint to
another.
Requirements:
• You can only test with breakpoints with the primary CPU in the STARTUP (startup OB) or
RUN-Solo system state.
• Setting breakpoints is possible in the programming language SCL or STL.
Testing with breakpoints provides you with the following advantages:
• Localization of logic errors step by step
• Simple and quick analysis of complex programs prior to actual commissioning
• Recording of current values within individual executed loops
• Using breakpoints for program validation is also possible in SCL or STL networks within
LAD/FBD blocks.

Note
Restrictions during testing with breakpoints
• If you test with breakpoints, there is a risk that you will exceed the cycle time of the
R/H-CPU.
• SYNCUP is rejected if a breakpoint is set in the RUN-Solo system state.
• If you set breakpoints in the standard user program in an HF-system with the CPUs
1518HF-4 PN, errors occur in the safety program. If you nevertheless want to use
breakpoints for testing, you must disable safety mode beforehand. Observe the additional
information about the errors and effects in the programming and operating manual
SIMATIC Safety - Configuring and Programming
(https://support.industry.siemens.com/cs/ww/de/view/54110126/en).

Difference between modifying and forcing

The fundamental difference between the modifying and forcing functions is the storage
behavior:
• Modifying: Modifying tags is an online function and is not stored in the CPU. You can end
the modifying of tags in the watch table or force table or by terminating the online
connection.
• Forcing: A force job is written to the SIMATIC memory card and is retained after a POWER
OFF. The S7-1500R/H CPU displays an active force job with a symbol. You can only end the
forcing of peripheral inputs and peripheral outputs in the force table.
A force job is transferred to the backup CPU in SYNCUP. The force job is then effective in
both CPUs in the RUN-Redundant system state.

S7-1500R/H redundant system

316 System Manual, 05/2021, A5E41814787-AC
 Test and service functions
13.1 Test functions

Testing with watch tables

The following functions are available in the watch table:
• Monitoring of tags
Using watch tables, you can monitor the actual values of the individual tags of a CPU user
program.
– On the PG/PC
– On the display of the CPU
Please note the following requirement for displaying the tag values on the CPU display:
You must specify a symbolic name for each tag in the "Name" column of the force table.
You monitor the following operand areas:
– Inputs and outputs (process image) and bit memory
– Contents of data blocks
– Peripheral inputs and peripheral outputs
– Timers and counters
• Modifying tags
You use this function to assign values to the individual tags of a user program or a CPU on
the PG/PC. Modifying is also possible with Test with program status.
The following operand areas are modifiable:
– Inputs and outputs (process image) and bit memory
– Contents of data blocks
– Peripheral inputs and peripheral outputs (for example, %I0.0:P, %Q0.0:P)
– Timers and counters

S7-1500R/H redundant system

System Manual, 05/2021, A5E41814787-AC 317
Test and service functions
13.1 Test functions

Testing with a force table

The following functions are available in the force table:
• Monitoring of tags
You use watch tables to monitor the actual values of the individual tags of a CPU user
program.
– On the PG/PC
– On the display of the CPU
You can monitor the table with or without trigger conditions.
Please note the following requirement for displaying the tag values on the CPU display:
You must specify a symbolic name for each tag in the "Name" column of the force table.
You monitor the following tags:
– Bit memory
– Contents of data blocks
– Peripheral inputs
• Forcing of peripheral inputs and peripheral outputs
You can force individual peripheral inputs or peripheral outputs.
– Peripheral inputs: Forcing peripheral inputs "bypasses" sensors/inputs by specifying
fixed values for the program. Instead of the actual input value via a process image or
direct access, the program receives the force value.
– Peripheral outputs: Forcing peripheral outputs "bypasses" the complete program by
specifying fixed values for the actuators.
The advantage of the force table is that you can simulate different test environments and
overwrite tags in the CPU with a fixed value. This enables you to intervene in the running
process in a regulating way.

Testing with a PLC tag table

You can monitor the current data values of tags in the CPU directly in the PLC tag table. To do
so, open the PLC tag table and start the monitoring.
You may also copy PLC tags to a watch table or force table and monitor, modify or force them
there.

S7-1500R/H redundant system

318 System Manual, 05/2021, A5E41814787-AC
 Test and service functions
13.1 Test functions

Testing with a data block editor

The data block editor offers different options for monitoring and modifying tags. These
functions directly access the actual values of the tags in the online program. Actual values are
the current values of tags in the CPU work memory at any given moment during program
execution. The following functions for monitoring and modifying are available in the
database editor.
• Monitor tags online
• Modify individual actual values
• Create a snapshot of the actual values

Note
Setting data values during commissioning
During plant commissioning, you often need to adjust data values to adapt the program to
local conditions.
The declaration table for data blocks offers some functions for this purpose.

Testing with the LED flash test

In many online dialogs, you can perform an LED flash test. This feature is useful if you are not
sure which device in the hardware configuration corresponds to the device currently selected
in the software.
If you click on the "Flash LED" button in STEP 7 under Online & diagnostics (online access),
specific LEDs flash on the device currently selected. The RUN/STOP, ERROR, and MAINT LEDs
flash on the CPU. The LEDs flash until you cancel the flash test.

Testing with a trace function

The trace function is used to record the CPU tags, depending on settable trigger conditions.
Examples of tags are the system and user tags of a CPU. The CPU saves the recordings. If
necessary, you can display the recordings with STEP 7 and evaluate them.
• Restriction: The storage of measurements on the SIMATIC memory card (measurements in
the device) is not supported for R/H-CPUs.
• Procedure
– The trace function can be called from the folder of the top CPU in the project tree,
under the name "Traces".
– In the "Measurements" system folder, double-click to open the recording to display the
measurement. The "Diagram" tab for the measurement opens in the work area.
Please also see the FAQs on the Internet
(https://support.industry.siemens.com/cs/ww/en/view/102781176) for testing with the trace
function.
Reference
Additional information on the test functions can be found in the STEP 7 online help.
You can find more information on testing with trace functions in the function manual Using
the trace and logic analyzer function
(http://support.automation.siemens.com/WW/view/en/64897128).

S7-1500R/H redundant system

System Manual, 05/2021, A5E41814787-AC 319
Test and service functions
13.2 Reading out/saving service data

13.2 Reading out/saving service data

Service data
In addition to the contents of the diagnostics buffer, the service data contain numerous
additional data points about the internal status of the CPU. If a problem occurs with the CPU
that you cannot resolve with other methods, send the service data to the Product Support
team. The Product Support team will use the service data to help you with problem analysis.
Please note the following:
• Read out the service data in the following cases:
– Immediately after a CPU has switched to the STOP operating state.
– Immediately after a loss of synchronization in the redundant system.
• Always read out the service data of the primary and the backup CPU.

Note
You cannot execute a download to the device while reading out the service data of the CPU.

Requirement
The S7-1500R/H redundant system must not be in the SYNCUP or RUN-Redundant system
state.

Methods of reading service data

You can read service data with:
• STEP 7
• SIMATIC memory card

Procedure using STEP 7

You can find more information on saving service data with the keyword "Saving service data"
in the STEP 7 online help.

S7-1500R/H redundant system

320 System Manual, 05/2021, A5E41814787-AC
 Test and service functions
13.2 Reading out/saving service data

Procedure using the SIMATIC memory card

Use the SIMATIC memory card to save the service data if communication with the CPU is not
possible over the Ethernet. In all other cases, save the service data using STEP 7.
The procedure using the SIMATIC memory card is more time-consuming than the other
options for saving the service data. You must also ensure before saving that there is sufficient
memory space on the SIMATIC memory card.
Proceed as follows for the R/H-CPU to save service data using the SIMATIC memory card:
1. Insert the SIMATIC memory card into the card reader of your PC/PG.
2. Open the job file S7_JOB.S7S in an editor.
3. Overwrite the entry PROGRAM with the STRING or character string DUMP in the editor.
Do not use any spaces/line breaks/quotation marks to ensure that the file size is exactly
4 bytes.
4. Make sure that the SIMATIC memory card is not write-protected. Insert the SIMATIC memory
card into the card slot of the CPU.
For the R/H-CPU, you require one card ≥ 32 MB in each case.
5. Save the file under the existing file name.
Result: The CPU writes the service data file DUMP S7S to the SIMATIC memory card and
remains in STOP.
Service data transfer is complete when the STOP LED stops flashing and is lit continuously. If
service data transfer has been successful, only the STOP LED lights up.
In the event of errors in transfer, the STOP LED is lit continuously and the ERROR LED flashes.
The CPU also stores a text file with information on the error that occurred in the DUMP.S7S
folder.

S7-1500R/H redundant system

System Manual, 05/2021, A5E41814787-AC 321
Technical specifications 14
Introduction
This chapter lists the technical specifications of the system:
• The standards and test values that the modules of the S7-1500R/H redundant system
comply with and fulfill.
• The test criteria according to which the S7-1500R/H redundant system was tested.

Technical specifications for the modules

The technical specifications of the individual modules can be found in the manuals of the
modules themselves. In the event of deviations between the statements in this document
and the manuals, the statements in the manuals take priority.

14.1 Standards and Approvals

Currently valid markings and authorizations

Note
Information on the components of the S7-1500R/H redundant system
The identifiers and approvals currently valid are printed on the components of the
S7-1500R/H redundant system.

S7-1500R/H redundant system

System Manual, 05/2021, A5E41814787-AC 322
 Technical specifications
14.1 Standards and Approvals

Safety information

WARNING
Personal injury and damage to property may occur
In hazardous areas, injury and damage can occur if you disconnect plug-in connections
during operation of an S7-1500R/H redundant system.
Always switch off the power to the S7-1500R/H redundant system before disconnecting
plug-in connections in hazardous areas.

WARNING
Explosion hazard
If you replace components, compliance with Class I, Div. 2 or zone 2 may become invalid.

WARNING
Deployment requirements
This device is only suitable for use in Class I, Div. 2, Group A, B, C, D; Class I, zone 2, Group
IIC, or in non-hazardous areas.

Safety of the plant or the system

NOTICE
Safety is the responsibility of the assembler
The safety of any plant or system incorporating the equipment is the responsibility of the
assembler of the plant or system.

Five safety rules for work in or on electrical installations

A set of rules, which are summarized in DIN VDE 0105 as the "five safety rules", are defined
for work in or on electrical installations as a preventative measure against electrical accidents:
1. Disconnect
2. Secure to prevent reconnection
3. Verify that the equipment is not live
4. Ground and short-circuit
5. Erect barriers around or cover adjacent live parts
These five safety rules must be applied in the above order prior to starting work on an
electrical system. After completing the work, proceed in the reverse order.
It is assumed that every electrician is familiar with these rules.

S7-1500R/H redundant system

System Manual, 05/2021, A5E41814787-AC 323
Technical specifications
14.1 Standards and Approvals

CE mark
The S7-1500R/H redundant system complies with the harmonized European standards (EN)
for programmable logic controllers published in the official gazettes of the European
Community. The S7-1500R/H redundant system meets the requirements and protection
targets of the following directives.
• 2014/30/EU "Electromagnetic Compatibility" (EMC Directive)
• 2014/34/EU "Equipment and protective systems intended for use in potentially explosive
atmospheres" (Explosion Protection Directive)
• 2011/65/EU "Restriction of the use of certain hazardous substances in electrical and
electronic equipment" (RoHS Directive)
EU declarations of conformity for the respective authorities are available from:
Siemens AG
Digital Industries
Factory Automation
DI FA TI COS TT
Postfach 1963
D-92209 Amberg
The EU declarations of conformity are also available for download from the Siemens Industry
Online Support website, under the keyword "Declaration of Conformity".

cULus approval
Underwriters Laboratories Inc. in accordance with
• UL 508 (Industrial Control Equipment) OR UL 61010-1 and UL 61010-2-201
• CAN/C22.2 No. 142 (Process Control Equipment) OR CAN/CSA C22.2 No. 61010-1 and
CAN/CSA C22.2 No. 61010-2-201

OR

S7-1500R/H redundant system

324 System Manual, 05/2021, A5E41814787-AC
 Technical specifications
14.1 Standards and Approvals

cULus HAZ. LOC. approval

Underwriters Laboratories Inc. in accordance with
• UL 508 (Industrial Control Equipment) OR UL 61010-1 and UL 61010-2-201
• CAN/CSA C22.2 No. 142 (Process Control Equipment) OR CAN/CSA C22.2 No. 61010-1 and
CAN/CSA C22.2 No. 61010-2-201
• ANSI/ISA 12.12.01
• CAN/CSA C22.2 No. 213 (Hazardous Location)
APPROVED for use in
Class I, Division 2, Group A, B, C, D T4;
Class I, Zone 2, Group IIC T4
Installation Instructions for cULus haz.loc.
• WARNING - Explosion Hazard - Do not disconnect while circuit is live unless area is known
to be non-hazardous.
• WARNING - Explosion Hazard - Substitution of components may impair suitability for Class
I, Division 2 or Zone 2.
• This equipment is suitable for use in Class I, Division 2, Groups A, B, C, D; Class I, Zone 2,
Group IIC; or non-hazardous locations.
WARNING: EXPOSURE TO SOME CHEMICALS MAY DEGRADE THE SEALING PROPERTIES OF
MATERIALS USED IN THE RELAYS.

FM approval
Factory Mutual Research (FM) according to
• Approval Standard Class Number 3611, 3600, 3810
• ANSI/UL 121201
• ANSI/UL 61010-1
• CAN/CSA C22.2 No. 213
• CAN/CSA C22.2 No. 61010-1
• CAN/CSA C22.2 No. 0-10
APPROVED for use in Class I, Division 2, Group A, B, C, D T4;
Class I, Zone 2, Group IIC T4
Installation Instructions for FM
• WARNING - Explosion Hazard - Do not disconnect while circuit is live unless area is known
to be non-hazardous.
• WARNING - Explosion Hazard - Substitution of components may impair suitability for Class
I, Division 2 or Zone 2.
• This equipment is suitable for use in Class I, Division 2, Groups A, B, C, D; Class I, Zone 2,
Group IIC; or non-hazardous locations.
WARNING: EXPOSURE TO SOME CHEMICALS MAY DEGRADE THE SEALING PROPERTIES OF
MATERIALS USED IN THE RELAYS.

S7-1500R/H redundant system

System Manual, 05/2021, A5E41814787-AC 325
Technical specifications
14.1 Standards and Approvals

ATEX approval
According to EN 60079-15 (Electrical apparatus for potentially explosive atmospheres - Part
15: Type of protection "n") and EN 60079-0 (Electrical apparatus for potentially explosive gas
atmospheres - Part 0: General Requirements).

OR
According to EN 60079-7 (Electrical apparatus for potentially explosive atmospheres - Part 7:
Increased safety "e") and EN IEC 60079-0 (Electrical apparatus for potentially explosive gas
atmospheres - Part 0: General Requirements).

Special conditions in hazardous areas:

1. The equipment shall only be used in an area of not more than pollution degree 2, as defined
in EN 60664-1.
2. The equipment shall be installed in a suitable enclosure providing a degree of protection not
less than IP54 in accordance with EN 60079-15 or EN 60079-7. The ambient conditions
must be taken into consideration for use.
3. Provisions shall be made to prevent the rated voltage from being exceeded by transient
disturbances of more than 119 V.

IECEx approval
According to IEC 60079-15 (Explosive atmospheres - Part 15: Equipment protection by type of
protection "n") and IEC 60079-0 (Explosive atmospheres - Part 0: Equipment - General
requirements).

OR
According to IEC 60079-7 (Explosive atmospheres - Part 7: Equipment protection by increase
safety "e") and IEC 60079-0 (Explosive atmospheres - Part 0: Equipment - General
requirements).

S7-1500R/H redundant system

326 System Manual, 05/2021, A5E41814787-AC
 Technical specifications
14.1 Standards and Approvals

Special conditions in hazardous areas:

1. The equipment shall only be used in an area of not more than pollution degree 2, as defined
in IEC 60664-1.
2. The equipment shall be installed in a suitable enclosure providing a degree of protection not
less than IP54 in accordance with EN 60079-15 or EN 60079-7. The ambient conditions
must be taken into consideration for use.
3. Provisions shall be made to prevent the rated voltage from being exceeded by transient
disturbances of more than 119 V.

CCCEx approval
According to GB 3836.8 (Explosive atmospheres-Part 8: Equipment protection by type of
protection "n") and GB 3836.1 (Explosive atmospheres - Part 1: Equipment - General
requirements).
Ex nA IIC T4 Gc

Special conditions in hazardous areas:

• The equipment shall only be used in an area of not more than pollution degree 2, as
defined in GB/T 16935.1.
• The equipment shall be installed in a suitable enclosure providing a degree of protection
not less than IP54 in accordance with GB 3836.8. The ambient conditions must be taken
into consideration for use.
• It must be ensured that the transient protection is set to a value which does not exceed
140% of the rated peak voltage value at the supply terminals of the device.

RCM Declaration of conformity for Australia/New Zealand

The S7-1500R/H redundant system meets the requirements of EN 61000-6-4.

Korea Certification
KC registration number: KCC-REM-S49-S71500
Please note that this device corresponds to limit value class A in terms of the emission of
radio frequency interference. This device can be used in all areas, except residential areas.
이 기기는 업무용(A급) 전자파 적합기기로서 판매자 또는 사용자는 이 점을 주의하시기 바라며
가정 외의 지역에서 사용하는 것을 목적으로 합니다.

Marking for the Eurasian Customs Union

EAC (Eurasian Conformity)
Customs Union of Russia, Belarus and Kazakhstan
Declaration of conformity with the technical requirements of the Customs Union (TR CU).

S7-1500R/H redundant system

System Manual, 05/2021, A5E41814787-AC 327
Technical specifications
14.1 Standards and Approvals

IEC 61131-2
The S7-1500R/H redundant system meets the requirements and criteria of standard
IEC 61131-2, excluding the requirements set out in sections 11 to 14 of the standard
(Programmable logic controllers, part 2: Equipment requirements and tests).

IEC 61010-2-201
The S7-1500R/H redundant system fulfills the requirements and criteria of standard
IEC 61010-2-201
(Safety requirements for electrical equipment for measurement, control, and laboratory use
Part 2-201: Particular requirements for control equipment).

PROFINET standard
The PROFINET interfaces of the redundant S7-1500R/H system are based on the standard
IEC 61158 Type 10.

Marine approval
Classification societies:
• ABS (American Bureau of Shipping)
• BV (Bureau Veritas)
• DNV- GL (Det Norske Veritas - Germanischer Lloyd)
• LRS (Lloyds Register of Shipping)
• Class NK (Nippon Kaiji Kyokai)
• CCS (China Classification Society)

S7-1500R/H redundant system

328 System Manual, 05/2021, A5E41814787-AC
 Technical specifications
14.1 Standards and Approvals

Industrial use
The S7-1500R/H redundant system is designed for use in industrial environments. It meets
the following standards for this type of use:
• Requirements on emission EN 61000-6-4: 2007 + A1: 2011
• Requirements on immunity EN 61000-6-2: 2005

Use in mixed areas

Under certain circumstances, you can use the S7-1500R/H redundant system in a mixed area.
A mixed area is used for residential purposes and for commercial operations that do not
significantly impact on residents.
If you use the S7-1500R/H redundant system in a mixed area, you must ensure that radio
interference emission complies with the limit classes of the technical standard EN 61000-6-3.
Suitable measures for observing these limits for use in a mixed area are, for example:
• Installation of the S7-1500R/H redundant system in grounded control cabinets
• Use of noise filters in the supply cables
An individual acceptance test is also required.

Use in residential areas

Note
S7-1500R/H redundant system not intended for use in residential areas
The S7-1500R/H redundant system is not intended for use in residential areas. Using the
S7-1500R/H redundant system in residential areas can affect radio and television reception.

Reference
The certificates for the identifiers and approvals can be found in Siemens Industry Online
Support on the Internet (http://www.siemens.com/automation/service&support).

S7-1500R/H redundant system

System Manual, 05/2021, A5E41814787-AC 329
Technical specifications
14.2 Electromagnetic compatibility

14.2 Electromagnetic compatibility

Definition
Electromagnetic compatibility (EMC) is the ability of an electrical installation to function
satisfactorily in its electromagnetic environment, without affecting that environment.
The S7-1500R/H redundant system also meets the requirements of EMC legislation for the
European Single Market. This is dependent on the S7-1500R/H redundant system complying
with the requirements and guidelines relating to electrical equipment.

EMC in accordance with NE21

The S7-1500R/H redundant system meets the EMC specifications of NAMUR guideline NE21.

Pulse-shaped disturbances
The table below shows the electromagnetic compatibility of the S7-1500R/H redundant
system with regard to pulse-shaped disturbances.

Table 14- 1 Pulse-shaped disturbances

Pulse-shaped disturbance Test voltage Corresponds

with degree of
severity
Electrostatic discharge in accordance Air discharge: ±8 kV 3
with IEC 61000-4-2. Contact discharge: ±6 kV 3
Burst pulses (high-speed transient dis- ±2 kV (power supply line) 3
turbances) in accordance with ±2 kV (signal cable > 30 m) 4
IEC 61000-4-4.
±1 kV (signal cable < 30 m) 3
High-energy single pulse (surge) in accordance with IEC 61000-4-5
External protective circuit required (not for 230 V modules)
You can find more information in the Designing interference-free controllers func-
tion manual.
• Asymmetric coupling ±2 kV (power supply cables)
DC with protective elements 3
±2 kV (signal/data line only > 30 m), with
protective elements
• Symmetric coupling ±1 kV (power supply cable) DC with pro-
tective elements
±1 kV (signal/data line only > 30 m), with
protective elements

S7-1500R/H redundant system

330 System Manual, 05/2021, A5E41814787-AC
 Technical specifications
14.2 Electromagnetic compatibility

Sinusoidal disturbances
The following table shows the electromagnetic compatibility of the S7-1500R/H redundant
system with respect to sinusoidal disturbances (RF radiation).

Table 14- 2 Sinusoidal disturbances with RF radiation

RF radiation in accordance with IEC 61000-4-3/NAMUR 21 Corresponds with de-

Electromagnetic RF field, amplitude-modulated gree of severity
80 MHz to 2.7 GHz 10 V/m 3
2.7 GHz to 6 GHz 3 V/m 2
80 % AM (1 kHz)

The following table shows the electromagnetic compatibility of the S7-1500R/H redundant
system with respect to sinusoidal disturbances (RF coupling).

Table 14- 3 Sinusoidal disturbances with RF coupling

RF coupling in accordance with IEC 61000-4-6 Corresponds with de-

gree of severity
from 10 kHz
10 Vrms 3
80 % AM (1 kHz)
150 Ω source impedance

Emission of radio interference

Interference emission of electromagnetic fields in accordance with EN 55016

Table 14- 4 Interference emission of electromagnetic fields

Frequency Interference emission Measuring distance

30 MHz to 230 MHz < 40 dB (µV/m) QP 10 m
230 MHz to 1000 MHz < 47 dB (µV/m) QP 10 m
From 1 GHz to 3 GHz < 76 dB (µV/m) P 3m
From 3 GHz to 6 GHz < 80 dB (µV/m) P 3m

Interference emission via the AC power supply in accordance with EN 55016.

Table 14- 5 Interference emission via the AC power supply

Frequency Interference emission

0.15 MHz to 0.5 MHz < 79 dB (µV) Q
< 66 dB (µV) M
0.5 MHz to 30 MHz < 73 dB (µV) Q
< 60 dB (µV) M

S7-1500R/H redundant system

System Manual, 05/2021, A5E41814787-AC 331
Technical specifications
14.3 Shipping and storage conditions

14.3 Shipping and storage conditions

Introduction
The S7-1500R/H redundant system meets the specifications regarding shippings and storage
conditions pursuant to IEC 61131-2. The following information applies to modules that are
shipped and/or stored in their original packaging.

Shipping and storage conditions for modules

Table 14- 6 Shipping and storage conditions

Type of condition Permissible range

Free fall (in shipping package) ≤1m
Temperature from -40 °C to +70 °C
Barometric pressure From 1140 to 660 hPa (corresponds to an eleva-
tion of -1000 to 3500 m)
Relative humidity 5% to 95%, without condensation
Sinusoidal vibrations in accordance with IEC 5 - 8.4 Hz: 3.5 mm
60068-2-6 8.4 - 500 Hz: 9.8 m/s2
Shock in accordance with IEC 60068-2-27 250 m/s2, 6 ms, 1000 shocks

S7-1500R/H redundant system

332 System Manual, 05/2021, A5E41814787-AC
 Technical specifications
14.4 Mechanical and climatic ambient conditions

14.4 Mechanical and climatic ambient conditions

Operating conditions
The S7-1500R/H redundant system is designed for stationary use in weather-proof locations.
The operating conditions are based on the requirements of IEC 61131-2:2017:
• OTH4
• STH4 (R/H CPUs: Minimum ambient temperature -40 °C, minimum relative humidity 5%)
• TTH4 (R/H CPUs: minimum relative humidity 5%)

Test of mechanical ambient conditions

The table below provides important information with respect to the type and scope of the
test of ambient mechanical conditions.

Table 14- 7 Test of mechanical ambient conditions

Condition tested Test Standard Comment

Vibration Vibration test according Type of oscillation: Frequency sweeps with a rate of change of 1 oc-
to IEC 60068-2-6 (Sinus) tave/minute.
5 Hz ≤ f ≤ 8.4 Hz, constant amplitude 7 mm
8.4 Hz ≤ f ≤ 150 Hz, constant acceleration 2 g
Duration of oscillation: 10 frequency sweeps per axis, along each of the
3 mutually perpendicular axes
Shock Shock, tested according Type of shock: Half-sine
to IEC 60068-2-27 Shock intensity: 15 g max., duration 11 ms
Direction of shock: 3 shocks each in +/- direction, along each of the
3 perpendicular axes
Continuous shock Shock, tested according Type of shock: Half-sine
to IEC 60068-2-27 Shock intensity: 250 m/s2 peak value, 6 ms duration
Direction of shock: 1000 shocks each in (+/-) direction, along each of the
3 mutually perpendicular axes

Reduction of vibrations
If the S7-1500R/H redundant system is exposed to severe shock or vibration, take appropriate
measures to reduce the acceleration or the amplitude.
We recommend installing the S7-1500R/H redundant system on damping materials (for
example, rubber-bonded metal mounting).

S7-1500R/H redundant system

System Manual, 05/2021, A5E41814787-AC 333
Technical specifications
14.4 Mechanical and climatic ambient conditions

Climatic ambient conditions

The table below shows the permissible climatic environmental conditions for the
SIMATIC S7-1500R/H redundant system during operation.

Table 14- 8 Climatic ambient conditions

Ambient conditions Permissible range Comments

Temperature: To increase the service life of the display, the
horizontal mounting posi- 0 °C to 60 °C display switches off when the permitted operat-
tion: 0 °C to 40 °C ing temperature is exceeded.
vertical mounting position: At certain temperatures, the display switches off
and on again. You can find more information in
the technical specifications in the CPU manuals.
Temperature variation 10 K/h -
Relative humidity from 10 % to 95 % Without condensation
Barometric pressure From 1140 to 795 hPa Corresponds to an altitude of -1000 m to 2000 m.
Note the following section "Using the redundant
S7-1500R/H system over 2000 m above sea level".
Pollutant concentration ANSI/ISA-71.04 severity level G1; G2; G3 -

Using the redundant S7-1500R/H system over 2000 m above sea level

Table 14- 9 R/H-CPUs for maximum installation altitude 5000 m or 3000 m

CPU designation Article number Version Max. installation altitude

CPU 1513R-1 PN 6ES7513-1RL00-0AB0 FS01 or higher 5,000 m
CPU 1515R-2 PN 6ES7515-2RM00-0AB0
CPU 1517H-3 PN 6ES7517-3HP00-0AB0
CPU 1518HF-4 PN 6ES7518-4JP00-0AB0 FS01 or higher 3,000 m

The maximum "operating height above sea level" is described in the technical specifications
of the respective module. The product data sheets with daily updated technical specifications
can be found on the Internet (https://support.industry.siemens.com/cs/ww/en/ps/td) at
Industry Online Support. Enter the article number or the short description of the desired
module on the website.
For altitudes > 2000 m, the following constraints apply to the maximum specified ambient
temperature:

Restrictions of the specified maximum ambient temperature in reference to the

installation altitude

Installation altitude Derating factor for ambient temperature 1)

-1000 m to 2000 m 1.0
2000 m to 3000 m 0.9
3000 m to 4000 m 0.8
4000 m to 5000 m 0.7
1) Base value for application of the derating factor is the maximum permissible ambient temperature
in °C for 2000 m.

S7-1500R/H redundant system

334 System Manual, 05/2021, A5E41814787-AC
 Technical specifications
14.4 Mechanical and climatic ambient conditions

Note
• Linear interpolation between altitudes is permissible.
• The derating factors compensate for the decreasing cooling effect of air at higher altitudes
due to lower density.
• Note the mounting position of the respective CPU in the technical specifications. The basis
is the standard IEC 61131-2:2017.
• Make sure that the power supplies you use are rated for altitudes > 2000 m.
• The displays of the R/H CPUs are designed for an altitude of ≤ 3,000 m. When operating
the device at altitudes > 3,000 m, you may experience problems with the CPU display in
rare cases; however, these do not affect operation of the CPU.
• The synchronization modules for the CPU 1517H-3 PN/CPU 1518HF-4 PN (sync module
1 GB FO 10 m: 6ES7960-1CB00-0AA5, Sync module 1 GB FO 10 km:
6ES7960-1FB00-0AA5) are also released for 5000 m.

Effects on the availability of modules

The higher cosmic radiation present during operation at altitudes above 2000 m will also
start to have an effect on the failure rate of electronic components (the so-called soft error
rate). In individual cases this might result in a primary backup switchover.

PFDavg, PFH values for HF-CPUs

Below you will find the probability of failure values (PFDavg, PFH values) for the HF-CPUs with
a service life of 20 years and with a repair time of 100 hours:

Operation in low demand mode Operation in high demand or continuous

low demand mode mode
According to IEC 61508:2010: high demand/continuous mode
PFDavg = Average probability of dangerous According to IEC 61508:2010:
failure on demand PFH = Average frequency of a dangerous fail-
ure [h-1]
< 2E-05 < 1E-09

S7-1500R/H redundant system

System Manual, 05/2021, A5E41814787-AC 335
Technical specifications
14.5 Information on insulation tests, protection class, degree of protection and rated voltage

14.5 Information on insulation tests, protection class, degree of

protection and rated voltage

Insulation
The insulation is designed in accordance with the requirements of IEC 61010-2-201.

Note
For modules with 24 V DC (SELV/PELV) supply voltage, electrical isolation is tested with
707 V DC (type test).

Pollution degree/overvoltage category in accordance with IEC 61131-2, IEC 61010-2-201

• Pollution degree 2
• Overvoltage category: II

Protection class according to IEC 61131-2, IEC 61010-2-201

The S7-1500R/H redundant system meets protection class I requirements and parts of
protection classes II and III.

Degree of protection IP20

Degree of protection IP20 in accordance with IEC 60529 for all modules of the S7-1500R/H
redundant system:
• Protection against contact with standard test fingers
• Protection against foreign objects with diameters in excess of 12.5 mm
• No protection against water

Rated voltage for operation

The S7-1500R/H redundant system works with the rated voltages and corresponding
tolerances listed in the table below.

Table 14- 10 Rated voltage for operation

rated voltage Tolerance range

24 V DC 19.2 V DC to 28.8 V DC1)
1) Static value: Generation as protective extra-low voltage with safe electrical isolation in accordance
with IEC 61131-2 or IEC 61010-2-201.

S7-1500R/H redundant system

336 System Manual, 05/2021, A5E41814787-AC
 Technical specifications
14.6 Use of S7-1500R/H in Zone 2 hazardous area

14.6 Use of S7-1500R/H in Zone 2 hazardous area

Reference
You can find more information in the product information Use of modules in a Zone 2
Hazardous Area (http://support.automation.siemens.com/WW/view/en/19692172).

S7-1500R/H redundant system

System Manual, 05/2021, A5E41814787-AC 337
Dimension drawings A
Mounting rail 160 mm

Figure A-1 Mounting rail 160 mm

Mounting rail 245 mm

Figure A-2 Mounting rail 245 mm

S7-1500R/H redundant system

338 System Manual, 05/2021, A5E41814787-AC
 Dimension drawings

Mounting rail 482.6 mm

Figure A-3 Mounting rail 482.6 mm

Mounting rail 530 mm

Figure A-4 Mounting rail 530 mm

S7-1500R/H redundant system

System Manual, 05/2021, A5E41814787-AC 339
Dimension drawings

Mounting rail 830 mm

Figure A-5 Mounting rail 830 mm

Mounting rail 2000 mm

Figure A-6 Mounting rail 2000 mm

S7-1500R/H redundant system

340 System Manual, 05/2021, A5E41814787-AC
Accessories/spare parts B
General accessories

Table B- 1 General accessories

Designation Article number

Mounting rail
• Mounting rail, 160 mm (with drill holes) 6ES7590-1AB60-0AA0

• Mounting rail, 245 mm (with drill holes) 6ES7590-1AC40-0AA0

• Mounting rail, 482 mm (with drill holes) 6ES7590-1AE80-0AA0

• Mounting rail, 530 mm (with drill holes) 6ES7590-1AF30-0AA0

• Mounting rail, 830 mm (with drill holes) 6ES7590-1AJ30-0AA0

• Mounting rail, 2000 mm (without drill holes) for cutting to 6ES7590-1BC00-0AA0

length
Standard rail adapter, 10 adapters, 10 hexagon socket screws and 6ES7590-6AA00-0AA0
10 washers
PE connection element for mounting rail, 2000 mm (spare part), 6ES7590-5AA00-0AA0
20 units
4-pole connection plug for supply voltage (spare part), 10 units 6ES7193-4JB00-0AA0
U connector (spare part), 5 units 6ES7590-0AA00-0AA0
70 mm display for CPU (spare part) 6ES7591-1BA02-0AA0
35 mm display for CPU (replacement part) 6ES7591-1AA01-0AA0
Power cable connector with coding element for power supplies 6ES7590-8AA00-0AA0
(spare part), 10 units
Synchronization module for CPU 1517H-3 PN, CPU 1518HF-4 PN
• Sync module 1 GB FO 10 m 6ES7960-1CB00-0AA5

• Sync module 1 GB FO 10 km 6ES7960-1FB00-0AA5

Redundancy connections for CPU 1517H-3 PN, CPU 1518HF-4 PN

• Sync cable FO 1 m (multimode fiber) 6ES7960-1BB00-5AA5

• Sync cable FO 2 m (multimode fiber) 6ES7960-1BC00-5AA5

• Sync cable FO 10 m (multimode fiber) 6ES7960-1CB00-5AA5

• Sync cable FO up to 10 km (single-mode fiber) On request

S7-1500R/H redundant system

System Manual, 05/2021, A5E41814787-AC 341
Accessories/spare parts

Designation Article number

PROFINET cables for redundancy connections, PROFINET ring of
CPU 1513R-1 PN, CPU 1515R-2 PN;
PROFINET cables for PROFINET ring of CPU 1517H-3 PN,
CPU 1518HF-4 PN
• Industrial Ethernet FastConnect RJ45 plug 180 degrees, 1 unit 6GK1901-1BB10-2AA0

• Industrial Ethernet FastConnect RJ45 plug 180 degrees, 10 6GK1901-1BB10-2AB0

units

• Industrial Ethernet FastConnect RJ45 plug 90 degrees, 1 unit 6GK1901-1BB20-2AA0

• Industrial Ethernet FastConnect RJ45 plug 90 degrees, 10 6GK1901-1BB20-2AB0

units

SIMATIC memory cards

Table B- 2 SIMATIC memory cards

Article number Capacity

6ES7954-8LCxx-0AA0 4 MB
6ES7954-8LExx-0AA0 12 MB
6ES7954-8LFxx-0AA0 24 MB
6ES7954-8LL02-0AA0 256 MB
6ES7954-8LPxx-0AA0 2 GB
6ES7954-8LT02-0AA0 32 GB

Media converter (electrical ⇔ optical)

Table B- 3 Media converter (electrical ⇔ optical)

Article number Article number

SIMATIC NET Media Converter SCALANCE X101-1 6GK5101-1BB00-2AA3
RUGGEDCOM RMC-24-TXFXSM-XX 6GK6001-0AC01-0EA0
Additional media converters On request

Online catalog
You can find more article numbers for the S7-1500R/H redundant system on the Internet
(https://mall.industry.siemens.com) in the online catalog and online ordering system.

S7-1500R/H redundant system

342 System Manual, 05/2021, A5E41814787-AC
Safety symbols C
C.1 Safety-related symbols for devices without Ex protection
The following table contains an explanation of the symbols located in your SIMATIC device,
its packaging or the accompanying documentation.

Symbol Meaning
General warning sign Caution/Notice
You must read the product documentation. The product documentation contains
information about the potential risks and enable you to recognize risks and im-
plement countermeasures.
Read the information provided by the product documentation.
ISO 7010 M002

Ensure the device is only installed by electrically skilled person.

IEC 60417 No. 6182

Note that connected mains lines must be designed according to the expected
minimum and maximum ambient temperature.

Note that the device must be constructed and connected in accordance with EMC
regulations.

Note that a 230 V device can be exposed to electrical voltages which can be dan-
gerous.
ANSI Z535.2

Note that a device of Protection Class III may only be supplied with a protective
low voltage according to the standard SELV/PELV.
IEC 60417-1-5180 "Class III equipment"

Be aware that the device is only approved for the industrial field and only for in-
door use.

Note that an enclosure is required for installing the device. Enclosures are consid-
ered:
• Standing control cabinet
• Serial control cabinet
• Terminal boxes
• Wall enclosure

S7-1500R/H redundant system

System Manual, 05/2021, A5E41814787-AC 343
Safety symbols
C.2 Safety-related symbols for devices with Ex protection

C.2 Safety-related symbols for devices with Ex protection

The following table contains an explanation of the symbols located in your SIMATIC device,
its packaging or the accompanying documentation.

Symbol Meaning
The assigned safety symbols apply to devices with Ex approval.
You must read the product documentation. The product documentation contains
information about the potential risks and enable you to recognize risks and im-
plement countermeasures.

Read the information provided by the product documentation.

ISO 7010 M002

Ensure the device is only installed by electrically skilled person.

IEC 60417 No. 6182

Observe the mechanical rating of the device.

Note that connected mains lines must be designed according to the expected
minimum and maximum ambient temperature.

Note that the device must be constructed and connected in accordance with EMC
regulations.

When the device is under voltage, note that it may not be installed or removed, or
plugged or pulled.

Note that a 230 V device can be exposed to electrical voltages which can be dan-
gerous.
ANSI Z535.2

Note that a device of Protection Class III may only be supplied with a protective
low voltage according to the standard SELV/PELV.
IEC 60417-1-5180 "Class III equipment"

Be aware that the device is only approved for the industrial field and only for in-
door use.

S7-1500R/H redundant system

344 System Manual, 05/2021, A5E41814787-AC
 Safety symbols
C.2 Safety-related symbols for devices with Ex protection

Symbol Meaning
For Zone 2 potentially explosive atmospheres, be aware that the device may only
be used when it is installed in an enclosure with a degree of protection ≥ IP54.

For Zone 22 potentially explosive atmospheres, be aware that the device may only
be used when it is installed in an enclosure with a degree of protection ≥ IP6x.

S7-1500R/H redundant system

System Manual, 05/2021, A5E41814787-AC 345
Glossary

AR
The AR (Application Relation) covers all communication relations between IO controller and
IO device (for example IO data, data records, interrupts).

Automation system
Programmable logic controller for the open-loop and closed-loop control of process chains in
the process engineering industry and in manufacturing technology. The automation system
consists of different components and integrated system functions according to the
automation task.

Backup CPU
Role of a CPU in the S7-1500R/H redundant system. If the R/H system is in the RUN-Redundant
system state, the primary CPU controls the process. The backup CPU processes the user
program synchronously and can take over process control if the primary CPU fails.

Baud rate
Data transmission rate indicates the number of bits transmitted per second (baud rate = bit
rate).

Bit memory
Bit memory is a component of the system memory of the CPU for saving intermediate results.
You access the bit memory through the user program bit by bit, byte by byte, word by word
or double word by double word.

Bus
Joint transmission path to which all devices in a fieldbus system are connected.

Bus cable connector

The bus cable connector is the physical connection between bus node and bus cable.

Bus, self-assembling
The modules are lined up on the mounting rail. They are mechanically and electrically
connected to each other with a U connector as they are swiveled into position. In this way the
bus is extended with each module.

S7-1500R/H redundant system

346 System Manual, 05/2021, A5E41814787-AC
 Glossary

Code block
In SIMATIC S7, a code block contains part of the STEP 7 user program.

Configuration
Systematic arrangement of the individual modules (configuration).

Connection plug
The connection plug provides the physical connection between devices and the cable, for
example.

Consistent data
Consistent data is data that belongs together in terms of content. Consistent data items are
read and written together.

Counter
Counters are components of the system memory of the CPU. You can modify the content of
the "counter cells" using STEP 7 instructions. Example: counting up or down).

CPU
The Central Processing Unit (CPU) contains the operating system and executes the user
program. The user program is located on the SIMATIC memory card and is processed in the
work memory of the CPU. The PROFINET interfaces on the CPU allow simultaneous
communication with PROFINET devices, PROFINET controllers, HMI devices and PGs/PCs.

Crimping
Procedure whereby two components joined together, e.g. wire end sleeve and cable, are
connected with one another through plastic strain.

S7-1500R/H redundant system

System Manual, 05/2021, A5E41814787-AC 347
Glossary

Cycle control point

The cycle control point marks the end of a cycle and the start of the next cycle. The cycle time
statistics and monitoring of the configured maximum cycle time start at the cycle control
point.
Once the cycle control point has been reached, the CPU writes the process image output to
the output modules, reads the state of the inputs in the input modules and then executes the
first program cycle OB.
The following requirements must be met for reaching the cycle control point in redundant
mode:
• the primary CPU has reached the end of the cyclic program
• the backup CPU has reached the end of the cyclic program and reported this to the
primary CPU
• if a minimum cycle time was configured, this is removed

Cycle time
The cycle time is the time a CPU requires to execute the cyclic user program once.

Cyclic interrupt
You will find further information in the glossary entry "Interrupt, cyclic".

Data block
Data blocks (DBs) are data areas in the user program that contain user data. Available data
blocks:
• Global data blocks that you can access from all code blocks.
• Instance data blocks that are assigned to a specific FB call.

Device
A device can send, receive or amplify data via the bus, e.g. IO device via PROFINET IO.

Device names
Each IO device must have a unique device name. This is required to allow the IO controller to
communicate with an IO device. Advantage: Device names are easier to manage than
complex IP addresses.
In its delivery state, an IO device has no device name. A device name must be assigned using
the PG/PC before an IO device can be addressed by an IO controller. Example: For
transmission of the configuration data (e.g. the IP address) during startup or for exchanging
user data in cyclic mode.

S7-1500R/H redundant system

348 System Manual, 05/2021, A5E41814787-AC
 Glossary

Diagnostics
Monitoring functions include:
• Detection, localization and classification of errors, faults and alarms.
• Display and further evaluation of errors, faults and alarms.
They run automatically while the system is in operation. This increases the availability of
systems by reducing commissioning times and downtimes.

Diagnostics buffer
The diagnostics buffer is a battery-backed memory area in the CPU where diagnostics events
are stored in their order of occurrence.

Diagnostics interrupt
You will find further information in the glossary entry "Interrupt, diagnostics".

Distributed I/O system

System with I/O modules that are configured on a distributed basis, at a large distance from
the CPU controlling them.

DP
Distributed I/O

Equipotential bonding
Electrical connection (equipotential bonding conductor) that brings the conductive parts of
electrical equipment and other conductive parts to the same or approximately the same
potential. This prevents disruptive or dangerous voltages arising between these parts.

Fail-safe systems
Fail-safe systems (F-systems) are characterized by the fact that they remain in the safe state
during the occurrence of specific failures or immediately transition into a different safe state.

F-CPU
An F-CPU is a CPU with F-capability that has been approved for use in SIMATIC Safety. A
standard user program can also be run in the F-CPU.

S7-1500R/H redundant system

System Manual, 05/2021, A5E41814787-AC 349
Glossary

Firmware of the CPU

In SIMATIC, a distinction is made between the firmware of the CPU and user programs.
The firmware is a software embedded in electronic devices. The firmware is permanently
connected to the hardware in functional terms. It is usually saved in a flash memory, such as
EPROM, EEPROM or ROM, and cannot be replaced by the user or only with special tools or
functions.
User program: You will find further information in the glossary entry "User program".

Firmware update
You update the module firmware with a firmware update. A firmware update is, for example,
run for new functions of a CPU or an interface module.

Function
A function (FC) is a code block with no static data. A function allows you to pass parameters
in the user program. Functions are thus suited for programming frequently recurring complex
functions, such as calculations.

Function block
A function block (FB) is a code block with static data. An FB allows you to pass parameters in
the user program. Function blocks are thus suited for programming frequently recurring
complex functions, such as closed-loop controls or operating mode selection.

Functional ground
Functional ground is a low-impedance current path between electric circuits and ground. It is
not intended as a protective measure but rather, for example, for improvement of
interference immunity.

Ground
Conductive ground whose electrical potential can be set equal to zero at any point.
All interconnected, inactive parts of a piece of equipment.

Ground
Conductive ground whose electrical potential can be set equal to zero at any point.
All interconnected, inactive parts of a piece of equipment.

Grounding
Grounding means connecting an electrically conductive part to a grounding electrode by
means of a grounding system.

S7-1500R/H redundant system

350 System Manual, 05/2021, A5E41814787-AC
 Glossary

GSD file
As a Generic Station Description, this file contains all the properties of a PROFINET or
PROFIBUS device that are necessary for its configuration.

Hardware interrupt
You will find further information in the glossary entry "Interrupt, hardware".

H-Sync forwarding
H-Sync Forwarding enables a PROFINET device with MRP to forward synchronization data
(synchronization frames) of a S7-1500R redundant system only within the PROFINET ring.
In addition, H-Sync Forwarding forwards the synchronization data even during
reconfiguration of the PROFINET ring. H-Sync Forwarding avoids a cycle time increase if the
PROFINET ring is interrupted.
S7-1500R: H-Sync Forwarding is recommended for all PROFINET devices with only 2 ports in
the PROFINET ring. All PROFINET devices with more than two ports (e.g. switch) in the
PROFINET ring must support H-Sync forwarding.
S7-1500H: H-Sync forwarding is not relevant for redundant S7-1500H systems.

I/O module
Device of the distributed I/O that is used as an interface between the controller and the
process.

Identification data
Information that is saved in modules, and that supports the user in reviewing the system
configuration and locating hardware changes.

Instance data block

Each call of a function block in the STEP 7 user program is assigned a data block, which is
automatically generated. Values of the input, output and in/out parameters are stored in the
instance data block, as is the local block data.

Interface module
Module in the distributed I/O system. The interface module connects the distributed I/O
system to the CPUs (IO controllers) via a fieldbus, and prepares the data of the I/O modules.

S7-1500R/H redundant system

System Manual, 05/2021, A5E41814787-AC 351
Glossary

Interrupt
The operating system of the CPU distinguishes between various priority classes that control
the execution of the user program. These priority classes include interrupts such as hardware
interrupts. When an interrupt occurs, the operating system automatically calls an assigned
organization block. You program the required reaction in the organization block (for example
in an FB).

Interrupt, cyclic
The CPU generates a cyclic interrupt periodically within a parameterizable time grid and then
processes the corresponding organization block.

Interrupt, diagnostics
Diagnostics-capable modules signal detected system errors to the CPU using diagnostics
interrupts.

Interrupt, hardware
A hardware interrupt is triggered by interrupt-triggering modules following a certain event in
the process. The hardware interrupt is signaled to the CPU. The CPU then processes the
assigned organization block according to the priority of this interrupt.

Interrupt, time-delay
The time-delay interrupt is one of the program execution priority classes of SIMATIC S7. The
time-delay interrupt is generated upon expiration of a timer started in the user program. The
CPU then processes the corresponding organization block.

Interrupt, time-of-day
The time-of-day interrupt is one of the program execution priority classes of SIMATIC S7. The
time-of-day interrupt is generated based on a specific date and time. The CPU then processes
the corresponding organization block.

Interrupt, update
When it receives an update interrupt, the operating system calls the update interrupt OB. This
may happen if you changed a parameter on a slot of a device.

IP address
The IP address is made up of four decimal numbers with a range of values from 0 through
255. The decimal numbers are separated by a dot (for example 192.162.0.0).
The IP address consists of the following:
• Address of the network
• Device address (PROFINET interface of the IO controllers/IO devices)

S7-1500R/H redundant system

352 System Manual, 05/2021, A5E41814787-AC
 Glossary

Isolated modules
In the case of isolated input/output modules, the reference potentials of the control and load
circuits are electrically isolated. Examples are optical isolators, relays or transformers.
Input/output circuits can be connected to common potential.

Load current supply

The load current supply supplies the electric input and output circuits of the module.

MAC address
Each port of a PROFINET interface (PROFINET device) is assigned a unique global device
identifier in the factory. This 6-byte long device identifier is the MAC address.
The MAC address is divided into:
• 3-byte manufacturer ID
• 3-byte device ID (consecutive number)
The MAC addresses are generally shown on the front of the device.
Example: 08-00-06-6B-80-C0

Non-isolated modules
In the case of non-isolated input and output modules, the reference potentials of the control
and load circuits are electrically connected.

NTP
The Network Time Protocol (NTP) is a standard for synchronizing clocks in automation
systems via Industrial Ethernet. NTP uses the UDP connectionless network protocol.

Operating states
Operating states describe the behavior of a single CPU at any given time.
The primary CPU of the S7-1500R/H redundant system has the operating states STOP,
STARTUP, RUN, RUN-Syncup and RUN-Redundant. The backup CPU has the operating states
STOP, SYNCUP and RUN-Redundant.

Organization block
Organization blocks (OBs) form the interface between the operating system of the CPU and
the user program. The organization blocks determine the order in which the user program is
executed.

S7-1500R/H redundant system

System Manual, 05/2021, A5E41814787-AC 353
Glossary

Pairing
Pairing is the mutual recognition of the CPUs of an S7-1500R/H system within a network.
During pairing, the CPUs exchange information for mutual identification. Example: Checking
for matching article number and firmware version. Successful pairing of two CPUs is a
fundamental requirement for redundant operation.

Parameter
• Tag of a STEP 7 code block:
• Tag for setting the behavior of a module (one or more per module). In as-delivered state,
every module has an appropriate basic setting, which you can change by configuring in
STEP 7. There are static and dynamic parameters

Parameters, dynamic
You can change dynamic module parameters during operation by calling an SFC in the user
program, for example, limits of an analog input module.

Parameters, static
You cannot change static module parameters with the user program, but only with
configuration in STEP 7, for example, the input delay of a digital input module.

PELV
Protective Extra Low Voltage = safety extra low voltage connected to protective earth

Pre-wiring
Wiring of the front connector in the "pre-wiring position" at the I/O module or before you
insert the front connector into the I/O module.

Primary CPU
Role of a CPU in the S7-1500R/H redundant system. If the R/H system is in the RUN-Redundant
system state, the primary CPU controls the process. The backup CPU processes the user
program synchronously and can take over process control if the primary CPU fails.

Primary-backup switchover
The primary CPU has the leading role within the redundant system. If the primary CPU fails
following a fault, the backup CPU takes over the primary role and operates as the primary
CPU.

S7-1500R/H redundant system

354 System Manual, 05/2021, A5E41814787-AC
 Glossary

Process image (I/O)

The CPU transfers the values from the input and output modules to this memory area. At the
start of the cyclic program, the CPU transfers the process image output as a signal state to the
output modules. The CPU then reads the signal states of the input modules into the process
image inputs. The CPU then executes the user program.

Product version (PV) = Function version (FV)

The product version or function version provides information on the hardware version of the
module.

PROFINET
PROcess FIeld NETwork, open Industrial Ethernet standard that continues PROFIBUS and
Industrial Ethernet. A cross-manufacturer communication, automation, and engineering
model defined by PROFIBUS International e.V. as an automation standard.

PROFINET IO
Communication concept for the realization of modular, distributed applications within the
scope of PROFINET.

PROFINET IO controller
Device used to address connected IO devices (for example distributed I/O systems). The
IO controller exchanges input and output signals with assigned IO devices. The IO controller
is often the CPU on which the user program is running.

PROFINET IO device
Distributed field device that can be assigned to one or more IO controllers. Examples:
Distributed I/O system, valve terminals, frequency converters, switches

PROFIsafe
Safety-oriented PROFINET IO bus profile for communication between the → safety program
and the F-I/O module in a fail-safe system.

Push-in terminal
Terminal for the tool-free connection of wires.

S7-1500R/H redundant system

System Manual, 05/2021, A5E41814787-AC 355
Glossary

Redundancy connection/redundancy connections

The redundancy connection in an S7-1500R system is the PROFINET ring with MRP. The
redundancy connection uses part of the bandwidth on the PROFINET cable for the
synchronization of the CPUs. This bandwidth is therefore not available for PROFINET IO
communication.
Unlike in S7-1500R, the PROFINET ring and redundancy connections in S7-1500H are
separate. The two redundancy connections are fiber-optic cables that connect the CPUs
directly over synchronization modules. The bandwidth on the PROFINET cable is available for
PROFINET IO communication.

Redundancy ID
The load memory of both CPUs contains the project data of one as well as the other CPU. By
assigning the redundancy IDs, you define which project data a CPU uses for itself.

Redundant systems
Redundant systems have multiple (redundant) instances of key automation components.
Process control is maintained if a redundant component fails.

Reference potential
Potential from which the voltages of the circuits involved are observed and/or measured.

Restart
A warm restart deletes all non-retentive bit memory and resets non-retentive DB contents to
the initial values from load memory. Retentive bit memory and retentive DB contents are
retained. Program execution begins at the call of the first startup OB. A restart is triggered
with CPU POWER OFF/POWER ON.

Retentivity
A memory area whose content is retained after power failure and after a STOP to RUN
transition is retentive. The non-retentive area bit memory area, timers and counters are reset
after a power failure and after a STOP to RUN transition. The non-retentive content of data
blocks is reset to the initial values.

Row
All the modules attached to a mounting rail.

Runtime error
Error that occurs during execution of the user program in the automation system (thus not in
the process).

S7-1500R/H redundant system

356 System Manual, 05/2021, A5E41814787-AC
 Glossary

Safety class
Safety level (Safety Integrity Level) SIL according to IEC 61508. The greater the Safety
Integrity Level, the stronger the measures for preventing system errors as well as for control
of system errors and hardware failures.
With the fail-safe modules, use up to safety class SIL3 is possible.

Safety function
Mechanism integrated in F-CPU and F-I/O that enables use in the SIMATIC Safety fail-safe
system.
According to IEC 61508: Function that is implemented by a safety relay to keep the system in
the safe state in case of a specific error or to bring it into a safe state.

Safety program
Safety-oriented user program

SELV
Safety Extra Low Voltage = Safety extra-low voltage

SNMP
SNMP (Simple Network Management Protocol) is the standardized protocol for performing
diagnostics on and assigning parameters to the Ethernet network infrastructure.
In the office setting and in automation engineering, devices from a wide range of vendors on
the Ethernet support SNMP.
You can operate SNMP-based applications on the same network in parallel to applications
with PROFINET.
The scope of supported functions varies depending on the device type. For example, a switch
has more functions than a CP 1616.

S7-1500R/H redundant system

System Manual, 05/2021, A5E41814787-AC 357
Glossary

Switch
PROFIBUS is a linear network. The communication nodes are linked by means of a passive
cable - the bus.
By contrast, Industrial Ethernet consists of point-to-point connections: Each communication
node is directly connected to exactly one communication node.
If you want to link a communication node to several communication nodes, you connect this
communication node to the port of an active network component (the switch). You can
connect other communication nodes (including switches) to the other ports of the switch.
The connection between a communication node and the switch remains a point-to-point
connection.
A switch thus has the task of regenerating and distributing received signals. The switch
"learns" the MAC addresses of a connected PROFINET device or additional switches. The
switch only forwards those signals that are intended for the connected PROFINET device or
switch.
A switch has a specific number of connections (ports). You connect at most one
PROFINET device or additional switch to each port.

Switched S1 device
The "Switched S1 device" function of the CPU enables operation of standard IO devices on the
S7-1500R/H redundant system.
PROFINET communication runs on an AR between the primary CPU and the standard
IO device. When replacing the primary CPU, the standard IO device is briefly disconnected
from the S7-1500R/H redundant system until the new primary CPU has set up an AR to the
standard IO device.

Synchronization module
You use the synchronization modules to create the redundancy connections between the
CPUs of the redundant S7-1500H system. You need two synchronization modules per CPU
that you connect in pairs with fiber-optic cables.

System states
The system states of the S7-1500R/H redundant system result from the operating states of
the primary and backup CPU. The term system state is used as a simplified expression that
refers to the operating states that occur simultaneously on both CPUs. The S7-1500R/H
redundant system has the system states STOP, STARTUP, RUN-Solo, SYNCUP and RUN-
Redundant.

S7-1500R/H redundant system

358 System Manual, 05/2021, A5E41814787-AC
 Glossary

System IP address
In addition to the device IP addresses of the CPUs, the redundant system S7-1500R/H
supports system IP addresses:
• System IP address for the X1 PROFINET interfaces of the two CPUs (system IP address X1)
• System IP address for the X2 PROFINET interfaces of the two CPUs (system IP address X2)
You use the system IP addresses for communication with other devices (for example, HMI
devices, CPUs, PG/PC). The devices always communicate over the system IP address with the
primary CPU of the redundant system. This ensures that the communication partner can
communicate with the new primary CPU (previously backup CPU) in the RUN-Solo system
state after failure of the original primary CPU in redundant operation.

TIA Portal
Totally Integrated Automation Portal
The TIA Portal is the key to the full performance capability of Totally Integrated Automation.
The software optimizes operating, machine and process sequences.

Time-delay interrupt
You will find further information in the glossary entry "Interrupt, time-delay".

Time-of-day interrupt
You will find further information in the glossary entry "Interrupt, time-of-day".

Timer
Timers are components of the system memory of the CPU. The operating system
automatically updates the content of the "timer cells" asynchronously to the user program.
STEP 7 instructions define the precise function of the timer cell (for example on-delay) and
trigger its execution.

Update interrupt
You will find further information in the glossary entry "Interrupt, update".

User program
In SIMATIC, a distinction is made between user programs and the firmware of the CPU.
The user program contains all instructions, declarations and data that control a system or
process. The user program is assigned to the redundant system. Structuring into smaller unit
is supported.
Firmware: You will find further information in the glossary entry "Firmware of the CPU".

S7-1500R/H redundant system

System Manual, 05/2021, A5E41814787-AC 359
Glossary

Value status
The value status describes a specific signal state. The value status is constantly updated and
cyclically transmitted by the field device as a quality statement together with the measured
value.

Warm restart
You will find further information in the glossary entry "Restart".

S7-1500R/H redundant system

360 System Manual, 05/2021, A5E41814787-AC
Index
First power-on, requirements, 211
Identification data, 273, 275
2 Identification data - record structure, 275
Procedure, 207
24 V DC supply, 135
Removing/plugging in a SIMATIC memory card, 208
Communication, 63
Configuration, 38, 138, 161
A
Electrical, 140
Access levels Of the redundant system S7-1500H, 25, 36
Assign parameters, 197 Of the redundant system S7-1500H, 25, 36
Access levels for the CPUs, 195 Of the redundant system S7-1500R, 23, 35
Access protection for the display, 199 Of the redundant system S7-1500R, 23, 35
Access protection with the user program, 199 On grounded reference potential, 137
Accessories, 341 Configuration versions of S7-1500R/H, 73
Ambient conditions Configuring the NTP server, 272
Climatic, 334 Connecting communication interfaces to S7-
Mechanical, 333 1500H, 150
Operating conditions, 333 Connecting communication interfaces to S7-
Approvals, 322 1500R, 147
CE, 324 Connecting PROFINET ring
cULus, 324 To S7-1500H, 159
FM, 325 To S7-1500R, 147
IEC 61010-2-201, 328 Connecting redundancy connections (fiber-optic
IEC 61131-2, 328 cables) to S7-1500H, 155
Asynchronous instructions, 187 Connecting the supply voltage, 142
Automation levels, 29 Connection plug
4-pin, 42
Control, 316
B Correct defect, 289
Exchange load current supply, 299
Backup types of the CPU data, 267
Replace coding element on mains connection
Breakpoints, 316
plug, 302
Replace redundancy connection for S7-1500H, 295
Replacing IO device/Switch, 300
C
Replacing PROFINET cable, 297
Cable length Replacing PROFINET cables for S7-1500R, 294
up to 10 km, 152 Replacing R/H-CPUs, 292
up to 10 m, 151 Replacing redundant connections, 293
Cable temperature, 141 Replacing redundant connections for S7-1500H, 296
Causes and solutions, 246 Replacing SIMATIC memory card, 298
CE approval, 324 Replacing the front cover, 301
Changes previous version of system manual, 16 Replacing the synchronization module for S7-
Climatic ambient conditions, 334 1500H, 295
Coding element, 144 CPU, 41
Power connector, 302 Backup/restore contents, 267
Commissioning, 275 Reading out service data, 320
Check before power-on, 206 Reset to factory settings, 309
First power-on, 211 CPU redundancy error, 178

S7-1500R/H redundant system

System Manual, 05/2021, A5E41814787-AC 361
Index

cULus approval, 324 Installation, 153

Selection, 151
Firmware update, 304
D Using STEP 7, 306
Via the SIMATIC memory card, 307
Degree of protection IP20, 336
FM approval, 325
Device IP addresses, 63
Force table, 318
Assigning, 162
Forcing, 316
Diagnostics, 56
F-systems, 38, 207
Difference between synchronous/asynchronous
F-systems, 38, 207
instructions, 188
Differences between S7-1500R and S7-1500H, 27
Dimension drawing
G
Mounting rail, 338
Disable SYNCUP, 183 Galvanic isolation, 140
Display, 280 Grounded extra-low-voltage, 137
Basics, 280 Grounded infeed, 137
Control keys, 285 Grounding, 122
Languages, 288 Configuration on grounded reference potential, 137
Menu, 283 Overview of the CPU, 139
Menu icons, 284
Password protection, 280
Upload image to display, 287 H
Distribution boxes, 153
Hardware
Downloading a project to the CPUs, 219
Requirements, 69
Downloading project data, 218
Restrictions, 71
Hardware restrictions, 71
H-CPU
E
Installing, 132
Electrical relationships, 140 Uninstalling, 133
Electromagnetic compatibility (EMC), 330 HMI devices
Disturbances, 330 Connecting, 114
Radio interference, 331 Use, 113
Electrostatic discharge, 330 HMI devices, 66
Emergency address, 268 H-Sync Forwarding, 45
Emergency IP, 268
EMERGENCY-STOP devices, 134
Entering maintenance data, 275 I
I&M data
Read, 273
F
Identification data
Factory settings, 310 Record structure, 275
Fail-safe automation systems, 38 IEC 60204, 134
Failure scenarios, 78, 92 IEC 61010-2-201, 328
FAQs IEC 61131-2, 328
Firmware update, 309 Infeed
Removing a SIMATIC memory card, 209 grounded, 137
F-CPU, 51 Installation
Features of the S7-1500R/H redundant system, 34 Basics, 117
Fiber-optic cable, 41 DIN rail adapter, 123
Connection, 150 Load current supply, 130

S7-1500R/H redundant system

362 System Manual, 05/2021, A5E41814787-AC
 Index

Mounting rail, 119, 121 Drill holes, 120

R/H-CPU, 132 Fastening, 120
Installation position, 117 Installation, 121
Installation rules, 118 Length, 120
Installing the standard rail adapter, 123 MRP interconnection, 49
Instructions not supported, 175
Insulation, 336
N
NTP procedure, 271
K
Know-how protection, 200
Know-how protection for blocks O
Changing, 202
OB 72, 178
Removing, 203
OB 86, 178
Setting up, 201
OBs
Event source, 181
Priorities and runtime behavior, 182
L
Opening know-how protected blocks, 202
Languages Operating mode
Display, 288 Changing, 261
LED flashing test, 319 Configuring startup behavior, 232
Lightning protection, 135 Displaying, 261
Line voltage, 135 RUN, 234
Load current supply, 42 RUN-Redundant, 234
Connecting a CPU, 146 Run-Syncup, 234
Installing, uninstalling, 130 STARTUP, 230
Load power supply (PM), 66 STOP, 233
Loss of redundancy SYNCUP, 233
Response of OB 72 and OB 86, 178 Operating principle of the S7-1500H redundant
Loss of redundancy, 257 system, 25
Operating principle of the S7-1500R redundant
system, 23
M Operating state transitions, 248
Overall configuration, 139
MAC addresses, 63
Overview
Maintenance, 289
Components of an S7-1500R/H, 40
Firmware update, 304
Grounding the CPU, 139
Reading out service data, 320
System and operating states, 228
Reset to factory settings, 310
Overview of the CPU technical specifications, 43
Test functions, 314
Maximum configuration, 112
Media converter (electrical ⇔ optical), 342
P
Media redundancy (MRP), 44
Assigning MRP roles, 167 Pairing, 212
Memory reset Password provider, 200
Automatic, 264 Patch fields, 153
Basics, 263 PE connection element, 40
Manual, 265 PELV
Minimum clearances, 118 Grounded extra-low-voltage, 137
Mounting rail, 40, 117, 119 PID control, 60
Attaching the protective conductor, 122 PID controller, 60
Dimension drawing, 338 Plant components, 29

S7-1500R/H redundant system

System Manual, 05/2021, A5E41814787-AC 363
Index

PLC tag table, 318 Front cover, 301

Pollution degree, 336 IO device/switch, 300
Power supply, 66 Load current supply, 299
Process image PROFINET cable, 297
Inputs and outputs, 169 PROFINET cables for S7-1500R, 294
Process image partition R/H-CPU, 292
Update in the user program, 171 Redundancy connection for S7-1500H, 295
PROFINET cable, 41 Redundancy connections, 293
Program execution, 174 Redundancy connections at S7-1500H, 296
Program status, 315 SIMATIC memory card, 298
Project languages, 269 Synchronization module for S7-1500H, 295
Project tree, 168 Requirements
PRONETA, 68 Hardware, 69
Protection, 195, 201, 204 Software, 71
Access levels, 195 Restrictions
Against electrical shock, 135 Software, 72
Behavior of a password-protected CPU, 198
Know-how protection, 201
Mechanical locking, 204 S
Protection against external electrical influences, 136
S7 routing, 65
Protection class, 336
S7-1500 hardware configuration
Protection functions, 54
Slots, 112, 113
S7-1500R/H
Overview of components, 40
R
S7-1500R/H communication options, 65
R/H-CPU S7-1500R/H components, 40
Accessories, 341 Safe electrical isolation, 137
Configuration versions, 73 Safety Administration Editor, 207
Display, 280 Safety requirements, 38
Hardware configuration, 112 Safety rules, 323
Memory reset, 263 Scalability, 30
Reference potential, 138 SELV
Replacing, 292 Safe electrical isolation, 137
Rack failure, 178 Service data, 320
Radio interference, 329, 331 Read via SIMATIC memory card, 321
rated voltage, 336 Reading, 320
R-CPU Save via STEP 7, 320
Installing, 132 Shipping conditions, 332
Uninstalling, 133 Short-circuit and overload protection, 138
Redundancy, 44 SIMATIC memory cards, 342
Failure, 78 SIMATIC Safety Integrated, 51
Redundancy IDs SINETPLAN, 68
Assigning, 215 SITOP power supply, 66
Reading, 216 Software, 67
Replacing, 217 Requirements, 71
Redundant system startup, 229 Restrictions, 72
Reference potential of the controller, 138 Spare parts, 341
Removing/plugging in a SIMATIC memory card Specific application, 134
CPU response after a SIMATIC memory card is Specific blocks, 172
removed or inserted, 210 Standard rail adapter, 40
Replacement of components, 289 Standards, 322
Coding element on power plug, 302 Start events, 177

S7-1500R/H redundant system

364 System Manual, 05/2021, A5E41814787-AC
 Index

Storage conditions, 332 User program, 172

Switched S1 device, 48 Download in the RUN-Redundant system state, 224
Synchronization modules, 41, 150 Download in the RUN-Solo system state, 223
Plug and pull, 157 Using PROFINET devices, 113
Uninstalling, 158
SYNCUP system state, 235, 246
Cancel, 244 W
Preparations, 237
Watch tables, 317
Requirements, 235
Wiring, 134
Sequence of events, 237
General rules, 134
System diagnostics, 57
HMI devices, 114
System differences between S7-1500R and S7-
Load current supply, 144
1500H, 27
Supply voltage at the R/H-CPUs, 142
System IP address
Without tools, 142
Assigning, 163
Wiring rules, 141
System IP address, 63
System redundancy, 47
System state
Changing, 262
Displaying, 262
System state transitions, 247

T
Technical specifications
Climatic ambient conditions, 334
CPU S7-1500R/H, 43
Electromagnetic compatibility (EMC), 330
Shipping and storage conditions, 332
Standards and Approvals, 322
Test functions, 314
Test voltage, 336
TIA Portal, 67
Time synchronization, 271
Tooltips, 286
Trace, 58
Trace function, 319

U
Uninstalling
Load current supply, 131
R/H-CPU, 133
Use, 19
From HMI devices, 113
In hazardous area Zone 2, 337
in industrial environments, 329
in mixed areas, 329
in residential areas, 329

S7-1500R/H redundant system

System Manual, 05/2021, A5E41814787-AC 365