Pre-standard 802.3at PoE detection

[chaseadam]

I have a device which can detect a "high power" PoE injector which only provides a single classification event (Type 1). The standard specifies 2 events (Type 2), which is what I believe the PD normally uses to determine if the PSE supports Class 4. Specifically the Cisco 3700 series determines Class 4 power of the "pre-compliant 802.3at" injector AIR-PWRINJ4=

I purchased a few AIR-PWRINJ4= thinking they were 802.11at compliant, but they are indicated as "pre-compliance" in documentation. I am using them with 3700 units so they work as expected, but I got curious.

When connecting a compliant 802.3at PD to the AIR-PWRINJ4=, it will not negotiate Class 4 power. The AIR-PWRINJ4= contains the MAX5922 which is an 802.3af chip, but supports Class 4 power per the datasheet.

Class 3 to Class 4 Threshold ICLASS_3-4 31 33 35 m

From what I understand about 802.3af, there is no mechanism to communicate from the PSE to the PD which power Classes are supported (e.g. the PSE must support Class 0-3). The mechanism 802.3at uses to indicate Class 4 availability is a second handshake to enable Type 2, which is not present in 802.3af (or the MAX5922). Additionally, the standard specifically calls out "non-compliant" scenario I think we are in.

Class 4 can only be used by IEEE 802.3at (Type 2) devices, requiring valid Class 2 and Mark 2 currents for the power up stages. An 802.3af device presenting a class 4 current is considered non-compliant and, instead, will be treated as a Class 0 device. https://en.wikipedia.org/wiki/Power_over_Ethernet emphasis added

The Aironet 3700 series differentiates between 802.3af (up to Class 3) and this pre-compliant AIR-PWRINJ4= (and other compliant?) 802.3at (up to Class 4), but from what I can tell based on the MAX5922 and traces, it does not (have to) use the "second handshake" procedure.

I believe the PM8803C PoE chip in the 3700 is using a non-standard pulse overlay on power up to determine the PSE is Type 2. The PM8803C chip will pull TP2 low to indicate a Type 2 PSE and it does so with the AIR-PWRINJ4= and with compliant 802.3at Type 2 PSEs, but the traces of activity are different.

TP2 and DET pin on PM8803C with AIR-PWRINJ4=


TP2 and DET pin on PM8803C with 802.3at Type 1 (previously 802.3af)


TP2 and DET pin on PM8803C with 802.3at Type 2


MAX5922 datasheet powerup


The AIR-PWRINJ4= contains a PIC 12F509 which does not appear to be necessary to complement the MAX5922. From the traces I am seeing, I believe the PIC may be introducing a pulse overlay after powerup to indicate it is a Type 2 PSE (which supports Class 4) and the PM8803C is using this to assert TP2. The only published sequence to assert TP2 is to use the two classification events. My hypothesis implies there is an unpublished sequence to get PM8803C to assert TP2 which was included for compatibility with this (Cisco specific?) power on pulse Type 2 indication.

The pulses are 6v with a cycle  of ~2.3ms and lasts ~115ms.

Curious if anyone has run into this before or can confirm my hypothesis.

[chaseadam]

Asked about undocumented PM8803C sequence on ST forum as well: https://community.st.com/s/question/0D53W00001KSmUUSA1/pm8803c-asserts-tp2-without-8023at-type-2-sequence