The substitute pennants are used when alphabetic flags or numeric pennants need to be repeated in a signal, say KK. Without them, ships might to have to carry several sets of signal flags, but using the substitutes, up to four letters of the same kind can be represented in a single hoist.
The meaning of the substitute pennants is this, taking the second substitute as an example: "I stand in for the flag now in second position in this hoist", so the signal MKK would be set as flag M, flag K and second substitute pennant. HH would be flag H and first substitute pennant whereas 2100 would be pennant 2, pennant 1, pennant 0 and third substitute. You can try these signals and others by keying them in above and pressing "Click!" (don't hit "enter" on your keyboard).
However, the substitution counts only within the same type of flags, so the signal MG300 is set as flag M, flag G, pennant 3, pennant 0 and then second substitute - the 0 is the second of the numeric pennants.
And of course the substitutes can point to each other as well - in this way you can set 0000 using a single 0 pennant (try it!).
In practice, the ICS is organised so that you can't get ambiguous codings, for example, a two-letter code to be followed by more than one numeral will never consist of a repeated letter (i.e., HH77 is not a valid signal - try it to see why not). But you can try out illogical combinations in the demo. If you set a signal that would require a fourth or fifth substitute (what could such a signal be?), the demo will show the answer pennant instead. This is only to fill the space - such signals do not occur in reality.