To understand how power and data can be transmitted over the same cable, let us first quickly revisit how Ethernet systems are configured. The data pulses are transmitted through LAN magnetics. These magnetics contain a 1:1 pulse transformer (and usually include a common mode choke). The purpose of the transformer is safety isolation, prevention of a single point system failure, and avoiding of ground loop currents.



Here is a functional diagram of a typical LAN transformer. Fortunately for the PoE developers, the LAN transformers are usually center-tapped. The center taps of the cable side are normally connected through a capacitor or an RC to ground for common mode noise suppression in the twisted pair. The way PoE works is DC voltage 50-57V is applied between center taps of the LAN transformers. Because the impedances of both leads in a twisted pair are pretty much the same, the current splits equally between two halves of the coils. As the result, no net magnetic field is created in the transformer and this power flow does not affect the data. The short video below explains how it works.



The current flow in PoE line is normally controlled by a power MOSFET driven by a PSE controller. Most commercial PSE controller ICs have this MOSFET integrated in the same package. The positive rail is usually common for all ports, while the negative rail is controlled. On the receiving end in a powered device (PD) the DC voltage is taken likewise from the center taps of the transformers, which are connected to bridge rectifiers. The rectifiers are needed because PoE legacy IEEE specs allowed PoE voltage of either polarity. Usually, both pairsets are used because the power can be transmitted through both data and spare pairs. The diagram below shows connections in a typical 4-pair system.



Like in PSE, the positive rail in PD front end is usually continuous, while the negative rail is controlled by a power MOSFET driven by a PD controller. Many commercial PD controllers include an integrated MOSFET. In ON-state it connects the PoE line to DC-DC converter that powers the application.

A compliant PSE will not connect a DC power source to its output connector unless it discovers a compliant PD device on the other side of the cable. The way it works, PSE periodically probes the line in the procedure called detection. Only if a compliant PD device is found, the power will be applied in controlled fashion. After successful detection, before applying power a compliant PSE performs another procedure called classification. Its purpose is to discover how much power the PD wants, and to informs the PD how much power it may draw. After this stage PSE can apply power to the line. For the details see typical startup procedure of a PoE systems. If the PD requirement exceeds the PSE capability, the network device may turn on in a low power mode. Note that there are also non-compliant PSEs and injectors on the market. They are sometimes called "passive" or "dumb". Such a non-standard device will apply power to the line without going through detection and classification, i.e. regardless on what's connected on the load side of the cable. Basically, it works like a laboratory power supply. A non-complaint PSE often has short rise time. This can fry your network device unless you implement slow start externally.