Siemens SIMATIC S7-1500 System Manual page 133

Failure scenario
①
②
③
④
⑤
Figure 5-40 Failure of an IO device in the PROFINET ring and the primary CPU (using S7-1500R as an
example)
Sequence of events
1. An IO device in the PROFINET ring fails.
2. As a result, the PROFINET ring is interrupted.
3. The redundant system selects an alternative connection over the backup CPU. This allows
the redundant system to access all remaining IO devices in the PROFINET ring again.
4. The primary CPU also fails.
5. The redundant system does not switch to the backup CPU and switches to the STOP
system state. The role of the backup CPU remains unchanged.
NOTE
The backup CPU cannot distinguish between the following scenarios:
– It can no longer access the primary CPU because the latter has failed.
– The other redundancy connection has also been interrupted and the primary CPU may
That is why the backup CPU does not become the primary CPU. This prevents an
undefined system state.
6. The redundant system has failed. The process is no longer controlled by the redundant
system.
S7-1500R/H redundant system
System Manual, 11/2022, A5E41814787-AD
Primary CPU → failed (2nd failure in sequence of events)
Backup CPU → switches to STOP operating state
PROFINET cable (redundancy connections, PROFINET ring)
IO device ET 200MP
IO device ET 200SP → failed (1st failure in sequence)
still be running.
Application planning
5.5 Failure scenarios
133