This article will explore how the Starlink REV3 (a.k.a. G3/V3) power architecture is implemented.
We will learn how the Starlink “PoE” is implemented and how the Starlink board powers up.
This information might be helpful for those doing Starlink repairs.
The primary focus will be on the rev3 boards, which are the most common worldwide (as of summer 2024).
Please let me know if you want a similar article for other revisions of the terminal.
Warning: A lot of pictures are below.
Starlink PoE implementation
All Starlink terminals (except MINI) are powered via the Ethernet data cable, which implements the proprietary Power Over Ethernet standard.
Voltages range in the cable from 48-56V, and the power is 45-320W, depending on the terminal model.
Please note that the Starlink PoE is incompatible with any PoE standard, such as PoE+ or PoE++. The power line pinout is different.
Besides, there are no PoE standards for such high-power devices.
Connecting any standard and dumb PoE injector might damage your Starlink or PoE injector. Always use PoE injectors designed for Starlink, such as Yaosheng or DishyPowa.
Most PoE standards typically implement some detection and classification of the connected devices. The Power Sourcing Equipment (PSE) controller sends a sensing voltage and detects the connected Powered Device (PD) response. This helps to negotiate safe voltage and power when it’s needed. You can read more about PoE detection/classification here.
Starlink is no exception but implements its own PoE signature and detection. A custom controller and detection circuits are in charge.
Here is the PoE circuit in the Gen 2 Starlink router.
Starlink PoE controller
This is quite an unusual chip.
The controller IC is SLG46620 – “GreenPAK” Programmable Mixed-signal Matrix from Renesas. This is a small CPLD-like chip, a one-time programmed microcontroller. SpaceX created and preprogrammed the design once, and now Renesas is producing these ICs. This is why you can’t google and replace this chip with something else.
Burned-in logic is quite simple: apply test voltage, measure consumption, enable main power MOSFET, measure consumption, and cut the voltage in case of trouble. Repeat.
This IC is used in the REV1/REV2 PoE brick (both for the router and the Dishy), HP, and the GEN2 router. They replaced it in the GEN3 router with an STM32 MCU.
The sense voltage is 2.7V for the GEN2 router and 4.4V for the REV1/REV2 PoE brick.
The trigger load on the line is <= 3.2K. When such resistance is measured between the Ethernet power pairs, the controller activates the power MOSFET. The REV1/REV2 PoE brick also checks for shorts between orange-to-green and blue-to-brown pairs, meaning all four lines are connected.
The PoE controller activates the main power for 876 ms and measures current consumption. If the consumption is not sufficient (the line load is no longer 3.2k), the controller cuts the power and sleeps for 450 ms. Then, the cycle is repeated.
Please note there is no handshake and complex verification from the terminal side. It will start when the appropriate voltage is applied to the line.
So, why non-standard PoE?
When the first Starlink terminal came out (in 2020), Dishy’s total power consumption was 180W.
The REV3’s power consumption was significantly reduced to 40W (non-heating mode). However, the current REV4 is also power-hungry.
HP Dishy can jump up to 300W, which is enormous.
There is no PoE standard for such high power. The best PoE++ can provide up to 90W.
SpaceX had to develop its own “standard” with all safety features.
REV1 and HP Dishes also use custom thicker Ethernet cables to provide enough power over the long cable.
Besides, Starlink does not use “PoE” or “Power Over Ethernet” phrases in its documents, labels, and even code.
Starlink REV3 architecture
Below, you can see the power architecture diagram for the REV3 terminal. Other revisions are somehow similar, but we are focusing on the REV3.
Brief description
Input PoE voltage is dropped down to 12V and then distributed across various voltage regulators.
These voltage regulators provide different voltages for the SoC, antenna array, GNSS, and other consumers. This is generally true for every Starlink revision.
The Input PoE current is controlled by the shunt and operational amplifier connected between the PoE return line (DC—) and the board’s GND.
The PoE detection circuit generates an initial power consumption signature, which the power supply uses to activate the main power.
The primary voltage regulator is L3751, which has a wide input range. This regulator drops the input PoE voltage to 12V, the primary internal voltage. Alternatively, they use LM5146, which is practically the same IC with the same pinout.
The MAX16056 power supervisor controls the primary regulator operation. The supervisor circuit implements input voltage monitoring and generates some delay for the L3751 enable pin. L3751, in turn, generates a Power Good signal, which is used for the SoC voltage regulator activation.
Starlink SoC with peripherals requires different voltages to operate. The MP8771 regulator generates 1V for the CPU cores.
Power Good output of the MP8771 activates Enable input of the MP8892. The MP8892 is much more complex and generates four voltages:
– 1.8V for the SoC IO module and GNSS receiver.
– 3.3V for the system clock generator (CADY) and GNSS receiver.
– 1.1V and 1.3V are also for the SoC, RAM, and GNSS receiver.
This 4-rail voltage regulator is connected to the SoC via the I2C bus and provides monitoring and regulation (AVS).
The MP20073 is a highly specialized regulator required by the DDR RAM.
The CADY clock generator section requires a 3.3V and ENABLE signal from the SoC’s GPIO. This section has three linear voltage regulators, which will be described below.
Five MP8795 voltage regulators provide power for the whole antenna array. All 16 Digital Beam Former (DBF) ICs with their Front End Modules (FEM) are getting power from these voltage regulators.
Two MP8795 generate 1V for the DBF digital section (DSP cores)—eight DBF ICs per regulator. Three MP8795 generate 1.8V for the DBF IO and FEM ICs. One regulator powers 10 DBF ICs with corresponding FEMs. The second regulator powers ten more. The third regulator powers the other four ICs.
Components placements on the PCB:
Click on the image to see the full-resolution version
Click on the image to see the full-resolution version
Modules description
Now that we’ve got the big picture let’s dive into the details of each module.
Input connector, Ethernet transformer, and PoE input
The input connector type is BM10B-ZPDSS-TF(LF)(SN). The cable side is ZDPR-10V-S.
Below, you can see the connector pinout (PCB side) and how the lines are routed to the PoE transformer. This info can be helpful if the connector is torn off the board.
The PoE transformer is 802.3bt-rated 7490220126 from Wurth Elektronik, but it’s hard to find. Possible replacements are 749022013 or WA8704-ALD.
Complete schematic of the input section:
The input section is a typical Ethernet/PoE circuit with the PoE transformer, Bob Smith termination, and protection elements.
The drain wire from the data cable is connected to the Dishy GND via a paralleled capacitor, resistor, and TVS diode.
The capacitor creates a low-impedance path for high-frequency noise. The 500k resistor helps drain any extra DC, effectively limiting the current in a normal situation. TVS diode SMAJ10 helps in extreme conditions, quickly draining any high-voltage spikes.
Ethernet lines are protected with two WE824015043 TVS arrays. There is no separate Ethernet PHY. Data lines are connected directly to the SoC.
The power lines are taken from the corresponding Ethernet pairs as described above.
There is also a slight tap in the form of a voltage divider, which monitors the input voltage.
The negative (return) line is connected to the GND via the 0.05R shunt. The LM7321MF amplifier measures the current across the shunt. This amplifier has a single power and “virtual” ground separated from the primary GND with the shunt. Additional components are required to create a frequency response and provide filtering before feeding the output voltage to an ADC input.
PoE detection
The PoE detection circuit is quite simple. It’s connected directly to the input 48V rail (PoE transformer) and generates the required signature for the power supply unit.
When the router’s sense voltage (2.7V) is applied to the PoE input, T2 immediately opens with the help of two 100k resistors connected to the base. T1 is closed, and the T2 base is not being shunted. The opened transistor loads the line with the 1K resistor. This value, plus some resistance from the cable, creates enough load to trigger the PoE controller in the Starlink router or Starlink power brick.
The voltage starts to rise, and when it reaches approximately 8.5V, the current starts flowing via the DDZ8V2C zener diode and eventually opens T1. This transistor shunts the T2 and disconnects the 1K load from the line. This happens quickly enough (less than 400 microseconds) to save the 1K resistor from overheating.
The power line remains active for 876 ms. This is enough time for the primary voltage regulator to kick in and consume power instead of the 1K resistor.
T1 remains open so that parasitic current consumption will be less than 0.00096A. This can be neglected.
MAX16056 supervisor
The primary purpose of the MAX16056 is the soft start of the L3751 when the power is stabilized.
The supervisor IC is powered directly from the input PoE line via current-limiting resistors and 5V TL4050 shunt voltage reference.
With a series of resistors and capacitors, the MAX16056 is configured for a 229 ms RESET line delay.
The RESET line is pulled down on start, disabling the LM3751 voltage regulator, and released when the timer elapses (229 ms).
This creates a descent start delay for the primary voltage regulator but still fits into the power activation cycle (876 ms).
L3751 primary voltage regulator
48V from the input section connected to the array of capacitors and additional TVS diode. This array helps compensate for losses in long cables during peak power consumption.
LM3751 is powered (VIN) via a small current limiting resistor from the input line. Two resistors on EN input form a voltage divider. This helps to activate the voltage regulator only when the input voltage is higher than a specific low limit. The minimum required voltage on the EN input is >1.2V. In this case, LM3751 will run with an input voltage higher than 38V. You can replace this voltage divider and make it run from lower voltages.
As described above, the EN input is also connected to the MAX16056 supervisor.
The PGOD pin directly drives the MP8771 EN input. When everything is good, this line should have 4.7V.
Two power MOSFETs are FDMS86182. The switching frequency is 250 KHz. The output voltage should be between 11.8 and 12V.
You can check how everything is placed on the PCB and interconnected in the messy picture below:
Here are the measurements of MOSFET gates for reference.
All measures are referenced to the GND. The Q1 high-side looks unusual with a higher Vpp because it’s not directly referenced to GND and is powered via the D2-C14 bootstrap circuit.
MP8771 core voltage regulator
The following primary voltage regulator to start after the L3751 is MP8771. This regulator provides a single 0.9-1V voltage for the SoC CPU cores.
PCB layout and essential signals:
MP8892 4-rail voltage regulator
MP8771 from the previous step activates MP8892 when everything is good. The MP8892 provides four voltages for the Clock module, GNSS, DDR RAM, and SoC IO module.
Unfortunately, there is no datasheet available for this chip. An additional reverse engineering is required.
The MP8892 is a complete power management IC (PMIC) integrating four high-efficiency, step-down DC/DC converters and a control interface (I2C). The voltage regulator provides up to 4.5A (single line) of current. The switching frequency is 1MHz, so the output inductors are pretty small.
The output voltages can be adjusted through the I2C bus or preset by the three-time, multiple-time programmable (MTP) memory e-fuse. In the case of Starlink, preprogrammed voltages are 3.3, 1.8, 1.3, and 1.1 V. The regulator always starts with these voltages.
MP8892 pinout:
Schematic is very simple:
PCB layout:
MP8892 is connected to the SoC I2C-3 bus for configuration and monitoring. The device address is 0x6F. The registers map is unknown since there is no public datasheet. Starlink firmware executing i2cdetect command on boot: i2cdetect -y -r 3 0x6f 0x6f
This is how it explained in the firmware code:
On some UTs, the PMIC only responds after querying it via i2cdetect with read byte commands for probing. It is unknown why. Nothing in the datasheet suggests this is needed.
Next, the code writes a specific value (0x3E) to register 0x02. It might be some voltage profile selection.
Most likely, there will be some additional writing and adjustments during runtime.
MP8795 and antenna array
Five MP8795 provides power for the antenna array. Three 1.8V voltages are provided for the RF front chips and DBF RF IO, and two 1V voltages are provided for DBF DSP cores. All voltage regulators are activated from the software (SoC GPIO) when the terminal is booted.
Here is how the power from these voltage regulators is distributed:
The 1.8V rails are for the DBF chips’ analog part (RF IO) and front-end elements (PA + LNA), and the 1V rails are for the DBF digital cores (DSP).
MP8795 V1 provides 1.8V for the DBF0, DBF15, DBF14, and DBF13 chips and all surrounding small FEM chips.
V2 provides 1V for the DBF15, DBF0, DBF1, DBF2, DBF3, DBF14, DBF13, and DBF4.
V3 provides 1.8V for the DBF1, DBF2, DBF3, DBF4, DBF5, DBF7, and all surrounding FEM chips.
V4 provides 1.8V for the DBF5, DBF7, DBF6, DBF9, DBF10, DBF8, DBF11, DBF12 and corresponding FEM chips.
V5 provides 1V for the last eight beamformers’ DSP cores: DBF6, DBF9, DBF10, DBF8, DBF11 and DBF12.
All five MP8795 regulators are implemented similarly, except for the feedback circuit. Two resistors define the output voltage.
In the 1.8V configuration, the R3 value is 4k, and the R4 value is 2k. In the 1V configuration, the R3 value is 2k, and the R4 value is 2.4k.
Additionally, the 1V variant has two capacitors for the soft start option, which is also implemented for the 1.8V regulator on some Starlink boards. There is no rev/pcba difference between these two versions (w/ 1.8V and w/o soft start).
Below is the PCB layout of one of the MP8795 regulators (left 1.8V). All components were marked according to the schematic.
Digital Beamformers and FrontEnd Elements
Beamformers and RF architecture are outside the scope of this article, but we will examine the general architecture, power bus, and crucial signal distribution.
Beamformer IC (codename – Shiraz) requires 1V for the DSP core and 1.8V for the RF IO.
The 1V line is split into three lines to provide power for different submodules of the Shiraz chip. Two 1V lines have additional filtering and bypass capacitors.
Each beamformer has 16 RFIO channels and 32 associated FrontEnd Modules (FEM, codename – Pulsar). Each FEM contains LNA and PA, plus an additional analog phase shifter. Thus, two patch antennas (for TX and RX) are connected to the single FEM. All FEMs are powered by the 1.8V bus. There are separate power inputs for the LNA and PA sections.
Additionally, there is a serial two-wires control bus (RFFE) between the beamformer and associated FEMs. RFFE clock line is terminated with a 33 ohm resistor.
DBF, FEM, and power lines PCB layout:
CADY clock generation and distribution
The CADY section is simple and contains a 60 MHz crystal generator, buffers, and differential amplifier.
The 60 MHz clock drives DBF chips (single-ended line) and the SoC (differential line). This module starts on power-on and provides the crucial clock for the SoC.
Additionally, the firmware activates some of the CADY components on boot.
SoC
The Starlink SoC’s codename is Catson (REV1-REV4). This article does not provide a detailed description of this chip. We will focus on essential power lines.
The power supply system is relatively standard, with many bypass capacitors. The capacity of most of the smaller capacitors is 100 nanofarads.
60 MHz voltage level is 0.4V (to GND).
Starlink motors and motors driver
Starlink drive motors are creatively repurposed motors from car folding mirror drives. They are regular brushed DC motors, 12V, with a typical consumption of about 0.4A.
A dual-channel DC motor driver, STSPIN840, controls these motors. The motor driver is controlled with PWM signals from the SoC and software. It provides feedback about motor consumption so the software will know when motors are stuck or reach extreme positions.
PCB socket is BM05B-ZESS-TBT(LF)(SN). The cable connector is ZER-05V-S.
Common Problems and Solutions
Problem: Starlink is not Starting, and there is no voltage on the PoE input connector.
Solution: Check the router/PoE injector. Check the state of the Starlink cable and proprietary connectors.
Problem: There is a constant low voltage on the PoE input.
Solution: Check the main voltage fuse inside the router or PoE injector. Check the state of the PoE detection circuit. Damaged resistors might prevent T2 from opening and loading the line.
Problem: PoE input voltage is jumping between low and high levels.
Solution: The Starlink is most likely not consuming power. Check that the 12V is not shorted. Check that MP3751 is starting and that the voltage on pin 1 (ENABLE) is present.
Problem: PoE input voltage jumps between low and high levels, and the primary inductor makes a clicking noise.
Solution: The 12V bus is shorted. Check all the voltage regulators. Remove the MP3751 inductor and apply voltage to the 12V using an external power supply. Set the power supply to 3V and maximum current. Next, find the overheating section.
Problem: Starlink is starting. The Starlink App always shows a “booting” state.
Solution: Install the Star Debug app from a marketplace and check the Dish tab and Ready States section. Most likely, some of the MP8795 is not working. Check all 1 and 1.8 voltages.
Problem: Starlink is starting, and Star Debug shows only RF failure. All 1 and 1.8 voltages are present.
Solution: Some of the Pulsar FEMs are not starting and most likely shorting the RFFE bus. Check resistance on the RFFE clock and DATA lines on each DBF section. Use a high-resolution multimeter to find the chip shorting the bus. Replace the faulted chip.
Problem: Starlink is starting. The Starlink App always shows a “booting” state; all modules are green.
Solution: Check the GPS state. Starlink will be stuck in the “booting” mode if there is no valid GPS signal. If necessary, replace or rework the STA8089 GNNS chip.
Thank you for reading. I hope this material will help you repair the REV3 Starlink terminal.
