S7-1517H Output Drop During CPU Changeover: Substitute Value Fix

S7-1500H Redundant System Architecture

The SIMATIC S7-1500H redundant system is Siemens' high-availability controller class for processes that cannot tolerate a controller outage. The platform pairs two identical H-class CPUs - for example the CPU 1517H-3 PN - that execute the user program in lockstep and exchange status, memory, and IO data over redundant fiber-optic synchronization links. When the primary CPU is lost (STOP, fault, power loss, or a controlled RUN-to-RUN transition during commissioning), the backup CPU takes over program execution and resumes IO update within the system-defined changeover window.

A minimum S7-1500H system contains the following hardware items:

• 2 × H-CPUs (e.g., CPU 1517H-3 PN or CPU 1518H-4 PN)
• 2 × SIMATIC Memory Cards (one per CPU, identical content)
• 4 × Synchronization modules (two per CPU, plug-in on the back of the CPU)
• 2 × Synchronization cables (fiber-optic, ring topology for redundancy)
• 2 × PROFINET interfaces per CPU for IO and HMI communication
• Distributed IO stations (ET 200MP, ET 200SP, ET 200AL) connected to both H-CPUs' PROFINET ports

For the formal structure definition refer to the Siemens TIA Portal manual collection: Structure of the S7-1500H redundant system. A product-level overview of the S7-1500 R/H CPU family is published at SIMATIC S7-1500 R/H CPUs - High Availability.

Problem Statement: Outputs Drop on IM153-4 PN IO HF During Changeover

Field reports on S7-1517H systems describe the following behavior during a primary-to-backup changeover:

• The primary CPU is shut down (STOP, power-down, or controlled failover).
• The PROFINET IO update from the primary CPU to the ET 200MP station (IM153-4 PN IO HF) is interrupted.
• The digital output modules on the IM153-4 de-energize their outputs for a short window.
• Once the backup CPU assumes the role of primary and resumes PROFINET IO, the outputs re-energize.
• Observed total dropout window at the field device: approximately 0.5 s.

For actuators that must remain in their last commanded state - solenoid valves, motor contactors, indicator lamps, brake releases, dosing pumps in continuous service - a 0.5 s dropout is unacceptable. The symptom is treated by configuring the substitution behavior of the digital output module, not by retuning the changeover time.

Root Cause: Default Output Substitution Behavior

When PROFINET IO communication between the IO controller (CPU) and the IO device (IM153-4) is interrupted, the IO device applies the channel-level substitution value configured for the output module. The substitution value is applied per-channel, per-module, and remains in effect until the CPU resumes valid IO updates.

The default behavior depends on the output module's functional class:

• Basic (BA) digital output modules typically energize to 0 on loss of the IO relationship. They do not support "keep last value" or user-defined substitute values.
• Standard (ST) modules may offer a limited set of options, but the option set varies by article number.
• High Feature (HF) digital output modules support the full substitution-value options including Keep last value and a user-defined substitute value.

If the active output module is a BA or a ST-class module that only supports 0 V as the substitute value, the field actuator will de-energize for the duration of the controller changeover no matter what is configured at the CPU level. The substitution behavior is a property of the module, not the CPU.

ET 200MP IM153-4 PN IO HF Output Module Families

The IM 153-4 PN IO HF interface module accepts all SIMATIC S7-1500 digital and analog IO modules. The four functional classes - Basic (BA), Standard (ST), High Speed (HS), and High Feature (HF) - determine which substitution-value options are exposed in TIA Portal.

Configuring "Keep Last Value" Substitution in TIA Portal

The "Keep last value" option is configured per channel on the IO device. The following step-by-step procedure assumes TIA Portal V17 or later with the S7-1500H station and the IM 153-4 PN IO HF already configured.

1. In the project tree, expand the IM 153-4 PN IO HF station and open the slot containing the digital output module.
2. Select the module and open Properties in the inspector window.
3. Navigate to IO tags → Outputs → select the channel (e.g., channel 0 of a DQ 8 module).
4. Locate the Substitution value field and select "Keep last value" from the drop-down list.
5. If the module supports a per-channel assignment, repeat for each output channel that must hold its state during changeover.
6. Compile the project (Project > Compile > Hardware (rebuild all)) and download the hardware configuration to both H-CPUs and to the IM 153-4.

Configuring a User-Defined Substitute Value

For processes where "Keep last value" is undesirable but a specific safe state is required - for example a heating element that must drop to 0 while a feeder must remain 1 - configure a per-channel substitute value instead of "Keep last value".

1. Open the digital output module in TIA Portal and navigate to the same Outputs > [Channel] > Substitution value field.
2. Select "Substitute value" (the wording on the drop-down is the literal "Substitute value" entry, distinct from "Keep last value").
3. Enter the desired bit state (0 or 1) in the field that appears.
4. For analog output modules, enter the substitute value as a real number in the engineering units of the channel.
5. Compile and download as in the previous procedure.

Changeover Time: What You Can and Cannot Configure

The CPU changeover itself - from detection of primary loss to backup resume of RUN mode - is determined by the firmware and system configuration of the H-CPUs. The user cannot shorten or lengthen the changeover itself via TIA Portal. Field observation of approximately 0.5 s is consistent with a normally configured 1517H system; the upper bound published for S7-1500H changeover is in the low hundreds of milliseconds for properly synchronized systems.

What can be configured and that affects the field-visible behavior:

• Substitution value behavior on the digital output module (see above). This is the primary lever to eliminate the visible dropout.
• PROFINET update time on the IO device. A shorter update time shortens the time between IO-resume and the first valid output write, but does not prevent the substitution window.
• Watchdog time on the IO device. The watchdog is what triggers the substitution-value application. A shorter watchdog reduces the time before "Keep last value" takes effect.
• Sync cable length and topology. S7-1500H supports up to 10 km of fiber between the CPUs. Longer distances do not extend changeover time materially, but loss of sync due to link errors does affect failover quality.

Verification and Commissioning Procedure

After configuring "Keep last value" (or a substitute value) on every relevant output channel, perform the following verification before returning the system to production service.

1. Bring the redundant system into RUN-Redundant state. Both CPUs should show "RUN" with the system status flag indicating redundancy is active.
2. Force an output to a non-zero state via the program or the watch table.
3. Use a scope or a digital input on a separate counter to record the physical state of the output.
4. Trigger a controlled changeover: in TIA Portal, right-click the primary CPU and select "Stop primary CPU" or use the operator panel to switch CPUs.
5. Observe the output signal on the scope. With "Keep last value" correctly configured on an HF module, the output must remain at the last commanded state through the entire changeover. Any visible dropout indicates either the wrong module class, the wrong channel setting, or a parameter assignment error on the IM 153-4.
6. Repeat for each output channel that is required to hold state.
7. Document the test result per channel.

Diagnostic Indicators and Troubleshooting Matrix

Process Safety Considerations

Keep-last-value substitution is a process availability feature, not a safety feature. Where the output drives a safety function (a hardwired emergency stop, a Safety Integrity Level-rated output, a SIL-rated valve), the substitution behavior must be evaluated against the safety requirement. SIMATIC S7-1500F or S7-1500HF safety controllers with PROFIsafe handle safety outputs through the PROFIsafe protocol and have their own diagnostic and substitution semantics that supersede the standard IO substitution-value configuration.

Module Selection Checklist

When the existing IO module inventory cannot meet the keep-last-value requirement, apply the following selection rule:

1. Determine the required number of output channels, voltage class, and current rating.
2. Select the HF class variant of the matching channel count. HF modules are full-featured and always include the keep-last-value and substitute-value options.
3. Verify the module is supported by the ET 200MP IM 153-4 PN IO HF firmware version in use.
4. Update the TIA Portal hardware catalog if necessary.
5. Replace the module, re-download the configuration, and re-run the verification procedure above.

Frequently Asked Questions