~~META:
title=Maico ECA 100 ipro MCU replacement
description=shit hits fan: reverse engineering and hacking Maico fan PCB
keywords=SEO, dokuwiki, reverse engineering, 💩, poo, pee, shit hits fan, #viral, disassembly, Maico, fan, PCB, MCU, ESP, ESP8266, LDO, humidity, sensor, webinterface, Wi-Fi, repair, hack, hacking, bathroom, LNK306
~~
====== When 💩 hits AC-Fan: Maico ECA 100 ipro VZC ======
Initially, I just wanted to have an //occupied// signal for a bathroom in a shared flat the fan is installed in. Eventually, I decided to cut power of MCU: I realized I was going all in, a replacement MCU was needed. \\
I hope this write-up helps somebody repairing their PCB, provides an easy start for modifying or is at least a pleasant //nice2read//. \\
I am aware that Maico offers interconnected fans and aftermarket PCBs (e.g. ECA ipro RC(H)) - it is just not what I was looking for. \\
It was supposed to be "smart", but what does "smart" mean in this case? To me, a well suited solution (for a non-smart-home shared flat). \\
After some drifting off with my thoughts, what I came up with was:
* have an occupied signal¹
* get rid of annoying, timer based only trigger²
* better control: [[projects:maico_fan#the_third_button|light switch toggle]] to turn fan on/off for 💩-mode³
* from control to regulation: turn on fan on high humidity⁴
* needs to be standalone, with easy way to configure: [[projects:maico_fan#wifi_webinterface|cloudless Wi-Fi webpage interface]]⁵
* night mode (gets time via NTP)
* stopwatch [[projects:maico_fan#pee_game|pee time game]] for fun⁶
¹ *//getting cold feet out of bed, going down the stairs to the WC in winter, realizing it's occupied. betting back to bed warming up, repeat.//* A solution was needed, light is always turned on when occupied in the windowless room. \\
² Do you fit into one of the four(?) time interval settings? I do not. \\
³ this should have been included all along in the first place! How can that have been missed? Or have I missed something here? \\
⁴ Maico offers sensors. My PCB had an unpopulated pin header socket and therefore free space \\
⁵ To make it standalone, I wanted to have Wi-Fi as the shared flat has no smart home which it could be integrated into. There always is REST and MQTT as addition. \\
⁶ ??? There was a stopwatch game; time from pee to finish over washing hands thoroughly and done. [[projects:maico_fan#pee_game|Read here.]] \\
\\
Read on but don't let the 💩 hit the fan! (no pun intended) - take care. \\
===== Disclaimer =====
Think. I am not responsible of what you do. This is for educational purposes out of curiosity and my personal use only. \\
⚠️ The PCB is connected to mains 230VAC! ⚡︎⚡️ Be aware of what you do. This is no kid's game, it can be life-threatening or worse if you are not careful. Have an LED-light ready when you cut power to bathroom in the fuse box. \\
I am not responsible for anything you do, this is not meant to be a tutorial to mimic. It is just a write-up of the steps I have taken to achieve a goal I have striven for. \\
Link to [[https://www.maico-ventilatoren.com/cms-live/EN/Dokumente/IM0017697.PDF|original manual]] \\
If you feel not comfortable with a repair, get original ECA100 ipro VZC circuit board for [[https://www.maico-ventilatoren.com/produkte/p/platinen-g59683/pl-abde-eca-100-ipro-vzc-p123331|73€ with cover]] and [[https://www.maico-ventilatoren.com/produkte/p/platinen-g59683/pl-abde-eca-100-ipro-h-b-p133410|81€]] with pin header for sensor. 🧂 \\
I am not affiliated, nor does this project violate any copyright (AFAIK, if you feel different, contact me). No, I do not sell any hardware. Seriously, just buy a genuine Maico replacement PCB if yours should be broken, avoid danger. ⚡︎⚡️💥🔥 \\
===== Reverse Engineering =====
The fan consists of an 1-phase AC motor, a PCB controlling it and the shell/casing. \\
Unmodified ECA 100 ipro VZC series has the following hardware on PCB:
> MCU: PIC16F677 -I/SS
> AC/DC: LNK304DN
> Optocoupler: P185
> Triac: ST T405Q 600
>
> varistor: [[https://www.mouser.de/ProductDetail/EPCOS-TDK/B72210S2271K111?qs=jkF2ZuEVxWA3J34wyD4QmQ%3D%3D|S10K275]]
> input cap1: 400V 4.7
On some PCBs it's nearly impossible to read part numbers on the backside of PCB as the high voltage portion on the backside is painted in clear protective glue. For measurements, I have just scratched it. You can melt the glue carefully to close up the scratches again - do not burn components or anything, rather try out Plastik 70 (no ad, not tried out yet). \\
The backside of the PCB has no silkscreen - unfortunately, that is why I have made up some names for test points, e.g. ACF (=AC Frequency input) \\
I have quickly sorted all parts in KiCad according to PCB layout - with some imagination. Yes, I am well aware that schematics are normally not drawn like that. It is only my shared notes; if you want to pick up on them, separate parts and create a board layout, go for it :). It might contain errors, I actually haven't checked. \\
{{:projects:maico-fan:hardware:schematics_wo-mcu.png?600|}} schematics without MCU \\
TL;DR schematics: LNK304 provides 5V power with optocoupler as feedback. Resistors scale down voltage for AC-wave signal, which is fed into PIC16 via transistors. PIC16 triggers Triac (according to AC-wave). \\
Download KiCad (>=v6) schematics, complete with PIC16 pinout: **Todo ** \\
#TODO: measure capacity of (now desoldered) X-Caps. \\
Interesting is that the Triac switches Neutral, not Live conductor: in my world that is considered bad practice. //Is there something I do not see here?// \\
Pinout of PIC16\\
^ Pin# ^ Name ^ description ^ additional info ^
| 1 | VCC | 5V | cut pins 1,2,3,17 not only VCC! |
| 2 | FAN | output: trigger signal for Triac/Fan | goes over R13 to Triac |
| 3 | Light | input: light signal | |
| 17 | ACF | input: (AC frequency) AC wave signal for syncing | |
| 10 | Button left | time till turn on select | |
| 12 | Button right | overrun time select | |
| 5-8 | LEDs 1-4 | | |
| | Connection to pin-header | header for Maico humidity/motion sensor | **#TODO insert pinout** |
| 20 | GND | Ground | ⚠ directly connected to N-line |
{{:projects:maico-fan:hardware:photos:img_20220304_153631.jpg?200|}} first testing steps with PCB wire \\
**for better (test) pads, rather see [[projects:maico_fan#hardware_modification|chapter modification]] or even better the newly created [[projects:maico_fan#pcb_scan|PCB scan]] :)** \\
==== logic analyzer capture ====
The Triac is triggered by PIC16 synced to AC-wave signal (provided by opto-coupler). Triacs do not turn off automatically again if fired, unless voltage drops to 0V (or complicated circuit added). So what you see on logic analyze capture is just the triggering signal for Triac (//D0//), not the duration it is turned on. The durance is the point the Triac is triggered until signal of opto-coupler (//D1//) is low (and therefore AC-wave crosses 0V). \\
The fan has originally only two speeds, configurable via jumpers: slow (78m³/h) and fast (92m³/h). \\
{{:projects:maico-fan:hardware:logic-analyzed.jpg?900|logic analyzed}} \\
Interesting to see is that duration of positive and negative part of AC wave is different (11.75ms vs 8.25ms). Timings differ in speed modes: In the first, the firing of Triac in negative AC part is off by 1.55ms, I believe to compensate the differing duration. In the second mode the Triac is always fired roughly in the middle of the intervals, so there seems to be no compensation. Makes me wonder if this is intentional or just a mistake. \\
==== PCB scan ====
More than three years after the start of the project, I got hands on a broken PCB (due to water damage) on Kleinanzeigen in 2025. I desoldered all parts and scanned the PCB for your convenience. I did not have any [[life_hacks:glue#solvent_cement|solvents]] but acetone nail polish at hand, which does not work that well with the glue getting sticky the AC part of the PCB backside is painted with. Is the glue what they call "Plastik 70"? What I did is heat the glue with hot-air rework station and wipe most of it off with a cloth - the mite rest was removed with acetone (nail polish). \\
{{:projects:maico-fan:hardware:photos:pcb-scan:maico-pcb-scan_cleaned_repaired_rotated.png?800|}} \\
**#TODO: add size measurements of PCB in scan and names for pads+components on backside of PCB** \\
I admit, I have not cleaned the board properly, as it was corroded and toast anyways.
The trace of L-line was burned up of this broken PCB, I have redrawn it in pink to show the original trace. \\
According to the datasheet, the PCB is 18 x 20 x 125 (Width x Height x Depth in mm) in size. In my POV, the depth would rather be the height. \\
Thanks to the PCB scan, you can see the needed points easily where to solder the wires to for [[projects:maico_fan#hardware_modification|modifying the hardware]]. \\
==== Board repair ====
The broken board I got from Kleinanzeigen has (at least) burned Varistor (VDR1) and capacitor C1. Check for burned through PCB traces and replace those two parts. \\
To desolder C1 with iron, wind tinned braided wire around so it is soldered to both pads for heat transfer. This way it is easy to remove SMD parts without ripping off pads. The flux may be with you. \\
Also try disconnecting the original sensor (if your version has one) - the humidity sensor I got bundled with is bad too. \\
==== original humidity sensor ====
Together with the broken PCBs, I got a humidity sensor (which I did not have at the time of the project). The sensor is glued into a plastic shell, the transparent glue //looks// to be similar to the one on backside of the PCB. \\
The plastic cover of the PCB housing has a rubber cover, which is cut open if a sensor is installed. Tip to close it up again: put crepe tape over the hole and close up with [[life_hacks:glue#hot_glue|hot glue]] from the other side. \\
**#TODO insert photos** \\
#TODO: #TBD insert pinout \\
communication protocol / find out sensor type? -> not really worth the hassle. \\
Don't have a sensor (version) like I did not? Read on. I have replaced it with SparkFun HTU21D sensor. \\
==== No PIC16 Firmware dump ====
#TBD
As I now own a PICKit3 (I have not at the time of doing this project)... I still have not connected it, because I then only will realize that it probably has readout protection in place. \\
The principle of PIC16 firmware has already been reverse engineered, no need for a hex dump. \\
I do not know if firmware differs for models w/o sensor. My //guess//: probably same firmware; the pin header is unpopulated. \\
===== Hardware modification =====
> ⚠ Always make sure casing of electronics is sealed against moisture properly again! The PCB-scan shows what happens if not. 240VAC ⚡ water 💧 = 🌋 magic smoke 💨 or 🧯🔥. Keep in mind that mains part of PCB is painted with some glue on the backside for a reason. \\
**MCU replacement**: cut traces of PIC16 (at least pins 1,2,3 and 17) or desolder completely. \\
See the photo for a suggestion where to cut traces carefully. This is only reversible if you fix the traces. Scars will be left, do not burn any SMD-caps. \\
{{:projects:maico-fan:hardware:photos:traces_cut.jpg?200|}} \\
The following hardware modifications will be done: \\
> ESP8266-12F for Wi-Fi
> ↳ upgrade buck converter to LNK306DN!
> ASM1117-3V3 LDO module (5V to 3.3V)
> Humidity+Temp sensor (HTU21D)
Why ESP8266? Because:
- it has Wi-Fi and sufficient GPIOs
- peak power fits output limit of LNK306
- it fits physically into the original housing as PCB-sandwich
- it is what I had lying around in 2022 and was cheap (~1.3€)
- there was no ESP32 C-series in '22
To squeeze in all that hardware, build a sandwich with hot glue as sauce between the layers: 🥪\\
* Wait! Have you upgraded to LNK306DN already? If not, do so now, this is mandatory! Read below how to. \\
* ASM1117-board fits on the front side below the buttons (I admit, it is necessary to grind off a bit at the edges to ensure it is not longer than PCB). Requirement: Pin header for original sensor needs to be unpopulated (desolder otherwise) and lower plastic pin-clip for PCB needs to be trimmed/cut down. \\
* Solder SMD resistors directly on the underside of ESP8266-12 (see picture closely), so no space is wasted. \\
* Add humidity sensor breakout board in the plastic cover of housing (HTU21D fits nicely after slicing in a hole in the rubber of the cover). Why HTU21D? Because I had it lying around. There are other sensors which could fit too, e.g. SHT30/31, AHT20/30, Si7021, BME280, etc. Check measurements if the breakout board would fit. \\
> #Note: modern way would be to use a RISCV-MCU board with ESP-IDF. ESP32-C3 / C6 super mini should fit the space too and can also be powered by LNK306. There was no C-series when I have done this project. \\
⚠️ ESP draws way more power than PIC16: Upgrade buck converter to LNK306DN as drop-in replacement for sufficient power. There are pages with current measurements, [[https://ullisroboterseite.de/esp8266-strom.html|e.g. for ESP8266 here]]. LNK304 is not suitable for the peak currents of ESP, IIRC. \\
If you have no SMD-rework station, desolder pins one by one by bending each pin up - alternatively cut pins with a rotary tool before carefully. Drop and solder in LNK306 as replacement IC. Don't forget to wash off flux with isopropyl alcohol (and consider restoring protective, non-conducting glue coat with Plastik 70?). I have not used my SMD-rework station either here, which was a good idea b/c the moisture sealing glue over the PCB and components is a sticky mess when heated up over a large area. \\
⚠️ You do not find EMC tests here, (even though I have at least some EMI test equipment). The electrical measurements are fine, LNK306 works for me 24/7 for ~3 years now. \\
See [[https://www.letscontrolit.com/wiki/images/8/8d/ESP-12E_Basic_flashing_connection.jpg|schematics on letscontrolit.com/wiki for ESP-12 module to connect needed resistors]]. If you solder one side of SMD resistors directly on the pad of ESP12 underside and the needed wires on the other side of the resistors, no space is wasted (1st photo, see magnified where the red arrows are). Consider fixing resistors and wire joint with [[life_hacks:glue|glue]], I have chosen [[life_hacks:glue#uv_glue|UV-glue]]. Unfortunately, I have not taken a photo of that. \\
See [[projects:maico_fan#pcb_scan|chapter PCB scan]] to see where to solder the wires. \\
Now make the sandwich with hot glue as sauce between the layers: \\
{{:projects:maico-fan:hardware:photos:esp-sandwich.jpg?400|}}
{{:projects:maico-fan:hardware:photos:top-bottom.jpg?450|}}\\
🥪 prototype setup \\
So the sandwich consists of the main-PCB (space below the buttons) as the base, with (trimmed) ASM1117 breakout board, topped off with ESP8266. The cables routed between the layers is the spaghetti speciale. As the cherry on top, the humidity sensor breakout module is stuck inside the plastic housing with a hole cut into the rubber cover for the sensor-IC, sealed by hot-glue. Trim/cut down lower plastic pin-clip of housing for PCB. \\
Tip: ASM1117 LDO module only needs GND once (it is a rail) so you can skip the cable for GND "out". \\
> ⚠ Remember: NEVER solder rigid cables onto SMD pads like TestPoints! The leverage is high, so is the danger to rip off the pad. PCB wires might be too labile - use proper flex cords. \\
> ⚠ take some sandpaper and make PCB a smidge narrower with round edges so no wires are accidentally squeezed
> Keep everything isolated AFAP and/or add prophylactic isolation \\
See [[projects:maico_fan#pcb_scan|PCB scan]] where to solder wires for FAN, ACF and Light-signal. \\
You might want to cut traces of jumper pins and misuse the 4-pin header for UART (VCC, RX,TX, GND) to easily flash - mark it //»no jumpers!«// \\
Repurpose existing buttons by connecting them to ESP for GPIO0 flash-mode and reset pin. \\
I have not connected the LEDs, as there is a webpage for configuration, no reason to be all 90's. You might use GPIO# 1,2,15, which are still unused. \\
To install the humidity sensor, I have cut a small hole of the size of the sensor IC into the rubber. \\
⚠️ Seal rubber of housing cover when installing humidity sensor with hot glue! No moisture allowed on the PCB, this is still mains AC! ⚡ \\
As the new humidity sensor is not as raised as the original one, you have to cut away some plastics of the outer fan housing so the sensor is "free to breathe". \\
**#TODO: make and insert photo of humidity sensor rubber** \\
==== Pinout ESP-12 ====
^ GPIO/Pin# ^ name ^ description ^ Note ^
| 13 | ACF | ACF_PIN is signal of AC-wave frequency as binary logic |
| 12 | LIGHT_PIN| Light switch detection with AC-wave logic signal |
| 14 | FANOUT_PIN | switches triac on for fan | Triacs can actively only be turned on, not off. It turns off on crossing AC |
| 0 | button left | Flash-mode (+OTA) | has multi function |
| RST | button right | ESP-RESET -> reboot |
| 3 | RX | | Do not connect any pins for UART if AC connected! power via USB only |
| 1 | TX | free* | *HIGH at boot debug output at boot, boot fails if pulled LOW |
| 2 | | free* | *HIGH at boot connected to on-board LED, boot fails if pulled LOW |
| 15 | | free* | *SPI (CS) Boot fails if pulled HIGH |
| 4 | SDA | Data for humidity sensor |
| 5 | SCL | clock for humidity sensor |
| 16 | RST_WAKE | RTC timer to wake ESP | → Requires GPIO16 (D0) connected to RST |
| | GND | Ground | ⚠ directly connected to N-line |
| | VSS | 3.3V from ASM1117 | LNK306->ASM1117->3.3V for ESP |
Of course you can use free GPIOs for the LEDs on PCB, but there are [[projects:maico_fan#further_ideas_and_usps|better ideas and good use cases]]. \\
Note: wake from deep sleep is only possible if GPIO16 timer is connected to RST. Otherwise Reset button has to be pressed (which better is wired to one of the buttons on the Maico PCB) or turn AC-power off+on. \\
\\
===== Firmware =====
This project started as a quick way to improve the fan in a shared flat (which I actually do not live in), I started it with reusing an old POC university-project using Arduino. Oh, well, there is always a next project to start differently again. I talked myself into believing that some other person in the flat might maintain it. Also, this was my chance to use something else than FreeRTOS and see what people always talk about being done with Arduino - let's see for ourself. \\
For initial flashing you need a UART-USB adapter (USB to TTL converter), e.g. CH340, CP2102 or similar. \\
⚠️ Do not power PCB by AC for flashing. Mains voltage is dangerous for you and your computer! Always use VCC of USB-adapter. \\
Later on you can use OTA for flashing (unless/until you screw up) \\
**For easy development, I have used a Wemos D1 Mini ESP8266 module.** \\
> #Note: the modern way would be to use ESP-IDF with an ESP32 RISCV-MCU, like C3 or C6. There was no C-series in '22. \\
=== OTA ===
Update ESP8266 Firmware either via ArduinoOTA or upload firmware image on html-page /ota-update. HTML is embedded in firmware (together with network AP rescue page) so it still works if there are no pages in FS. \\
Output binary files of Arduino can be found in some temp directory, which are used to flash on html-OTA. \\
Use [[https://github.com/earlephilhower/arduino-esp8266littlefs-plugin|esp8266littlefs-plugin]] to upload .html files to LittleFS - (tutorial e.g. on [[https://randomnerdtutorials.com/install-esp8266-nodemcu-littlefs-arduino/|randomnerdtutorials.com]]). \\
See button config how to put ESP into ArduinoOTA mode. \\
=== Button config ===
The buttons on PCB are repurposed:
* right button = RESET| reboots/wakes the ESP.
* left button = puts ESP into Flash-mode if RESET pressed together with it.
* left button function no.2: To go into OTA-mode for ArduinoOTA, RESET then wait ~2s and hold left button till connected to Wi-Fi [~ a few seconds]
* //#TBD: #Todo function no.3: left button for WPS // \\
==== 1+1=3 Interrupts trick ====
The ESP8266 has two hardware timers: Timer0 is already used for Wi-Fi, making only Timer1 available for user-defined timer interrupts. \\
We need an interrupt to detect AC-wave signal and could use another timer-interrupt to generate a signal to trigger the triac for the motor, which makes two interrupts - with only one(!) left. \\
Sure, doing time measurements in code would work, it seems not very elegant with an async webserver. The clever trick is that we do not need the interrupts concurrently for AC-wave detection and motor triac-firing. As the TRIAC is only triggered when AC-wave signal is high, we can use Timer1 for both two interrupts by switching it back and forth between AC-wave and motor signal generation. \\
Now 💩 really hits the fan: 1+1=3, Problem solved ?:) The nice way? I think it is a well thought way, you decide. \\
//Side note for the reader:// A TRIAC can only be turned on by the gate, not off. Once triggered, it remains on until the current through it drops below the holding current—usually at the AC zero crossing. \\
All signals have been verified with a cheap ~5€ usb-logic analyzer and output with an oscilloscope //(thanks for the good old Fluke, dad! O:-)//
==== The third button ====
The two buttons on PCB are already in use, the third "button" is the connected light switch to L1 (see Maico manual how to correctly connect light switch/bulb to L1-input of PCB). To use light switch as function input is so obvious that I do not know how this could have been missed in the first place - sorry. \\
//It's so simple:// Toggle the light switch on+off to change mode. \\
I know, it is bad on the light source, but still. I will rather replace a worn cap than miss this function. (No light bulb harmed yet [~3 years], AFAIK). I have recently seen it in some Philips(?) ceiling light for changing light color temp, too. \\
The MCU detects if the light switch is toggled within a specified time. It puts the fan into "kack" mode (read next chapter). Toggle again to turn if off again. You can configure actions however you want on settings webpage. This way you do not even need to bother to take your phone out to control fan over the web interface or smart home function. \\
How is it done? First of all, both interrupts (even 1+1=3) are already taken. So we need to use polling, which is fine, as it is not time critical, just an informative input signal. The light input signal is an AC-wave switched binary logic signal, so you have to consider that the light has to be turned off/on for so long that it definitely hits the positive AC wave. A duration between two light switch toggles of at least ~100ms is advised (which is perfectly fine, you just have to know. Set maximum interval toggle duration in web-settings). \\
💞 This is the most loved function of the fan in the flat (next to humidity). \\
💡 With added bonus functionality to see on webpage if light is turned on, it is my all time favorite and has kept me from some cold feet in the past. \\
There is another awesome use case for the light switch when some small circuit is added. Just a teaser for now, I will have noted it in the future [[projects:maico_fan#further_ideas_and_usps|@Ideas&USPs]] \\
==== Wi-Fi + Webinterface ====
The '90s have called, they wanted their jumpers and LEDs back. As ESP8266 has Wi-Fi, let's use it for a nice local web interface. No cloud, no gateway. I have started with a non-async Arduino webserver taken from some old and simple POC university project. //Let's go in and out. Twenty minute adventure.// I switched to ESPAsyncWebSrv-lib, a switch I should have made sooner (and what about stepping this project up away from Arduino? 🤡). \\
The values of the variables in firmware are synced with HTML using JavaScript and AJAX with JSON format. Why? I made all this without AI in 2022 and chose what seemed to suite best. It is nice that some of the "workload" is on the end device. \\
CSS is used to make html look nice. \\
So the bidirectional communication from MCU to web can be shown as:
> MCU with async webserver ↔ AJAX/JS ↔ HTML
The MCU loads four html files from LittleFS and serves them as webpages: 1) index 2) settings 3) network 4) webOTA \\
When changes are done in network and settings pages, their values are saved in an .ini file using LittleFS. \\
=== 3) network ===
If Wi-Fi is unable to connect (e.g. on first start), ESP is put into access point (AP) mode. Connect. Because going to **//192.168.4.1//** to change SSID+password is unintuitive, an AsyncDNSServer creates a captive portal, redirecting to ///wificred// as AP default page. On this page, configure network settings (mDNS-name, IP) anytime.\\
Default mDNS-name is: //kacken.local///. Better change name to fan.local/ or something more suitable for public. .local is fixed by mDNS. (Use your openWrt router to change e.g. to .wg [WG=WohnGemeinschaft; shared flat in German]). \\
There is a small version of this page embedded in firmware, so it is always possible to connect (and use webOTA too) if something is broken. \\
AP.html screenshot \\
{{:projects:maico-fan:software:screen-network.png?400|}} \\
=== 1) index ===
Current time for index web page is fetched over internet via NTP. It is used for night sleep mode / power saving interval. By design ESP8266 can only be woken from deep sleep by reset and timer (if GPIO16 connected to RST). Otherwise use light sleep only for power saving. \\
**index.html** \\
{{:projects:maico-fan:software:screen-kacken.png?300|}}
new design: {{:projects:maico-fan:software:screen-power.png?400|}} \\
**#TODO: create screenshot running on ESP with real values instead of placeholder** \\
**#TODO: create gif to show different modes with changing emojis** \\
The fan can be controlled via a simple html-button. Date&Time from NTP fetch is shown on html-page for convenience. \\
The status of the light is shown together with a timer to see for how long light is on (positive minute counter) or since when it is off (negative minute counter). Please do not misuse it for stalking or something alike. Use it to estimate if it could still stink 💩. \\
The [[projects:maico_fan#pee_game|stopwatch time of pee game]] is shown on the bottom with trophy 🏆 \\
Clicking on the blue info ⓘ starts a 30s countdown js-timer for washing hands (remember to keep your phone clean too). \\
One to two live changing unicode symbols are shown in big (for fanciness), representing if light is on and the current mode the fan control is in. \\
There are several 'modes' implemented the fan can be run in. Defined by \\
- timer (original PIC16 function replicated)
- high(er) humidity
- light switch toggle, aka 'kack' mode -> #rename to //"power"// mode
Unicode symbols are used to show modes and status on the webpage looking neat, modern and easily readable.
legend shown on /settings webpage: \\
💡 = light is turned on (shown in all modes if true) \\
🌪️ = fan running (t1/t2 original mode) \\
💦 = fan running, humidity high \\
🚿 = fan running in high speed (humidity raised rapidly) \\
💩 = fan running in mode 'kacken' -> #rename to //"power"// \\
🚻 = turned off fan, light turned ON \\
🆓 = turned off fan, light is OFF \\
\\
There are GET commands (REST) to control the fan too.
> /kacken: puts fan into fast mode for configured time
> /aus: turns fan off. will be overridden on changed mode
> /peestart: starts peeing game
> /pissoff: stops stopwatch of game
=== 2) settings ===
Go to ///settings// to change UI controls, light switch, humidity and fan specific behaviors. \\
**settings.html screenshot** \\
{{:projects:maico-fan:software:screen-fan-settings.png?direct&400|}} \\
All settings are explained by mouse-over tooltips and are clickable on smartphone. \\
Maximum run time can be set for safety precaution - this time is reset on mode change. \\
Don't forget to set your [[projects:maico_fan#pee_game|pee fan timer]].\\
All configurations and settings are stored in flash (LittleFS) with .ini-format. This includes your Wi-Fi password, which sits there unencrypted (but then, you are inside the network already anyways). Do not initially create the save-files, they are created automatically by firmware. \\
As seen in the screenshot, I have used the word "kacken" a lot, which is informal German for "(to) poop". The initial project name was //KackenESP// and that's what it still is. I like the emoji 💩. The implemented "kack mode" turns the fan to high speed for a set time, either by html-button or light switch toggling. \\
[[https://www.youtube.com/watch?v=cM-lJP3g9e8]] \\
It is just a bad and honest name for a function to turn on the fan, get over or #rename it. It is meant in the natural way: we all have to poop. A good naming substitute may be //"power"//? \\
=== 4) webOTA ===
webOTA has its html-page embedded in firmware. There are no checks for anything. Be aware of what you upload/flash, you can break it - (connecting UART-cables for flashing might be tedious when fan already installed). There also is ArduinoOTA != webOTA. Read OTA section above. \\
In conjunction with versioned firmware, it can be used as auto-updater. Poll URL for newer FW and update automatically. \\
==== Pee game ====
So what's that now? Relax, nothing kinky. It's a time based fun which was played in the shared flat and IMO deserves its own headline: There never has been a name for the game, I had to give the variable some name and chose "pee_time" as it fits flat, (bad reference jokes to π were omitted). \\
Are you quicker (with washing hands thoroughly!) than a predefined time (~1min)? Turn light on, do your small duty and turn light off again. If you are too slow, the fan spins shortly to acoustically signal that time has passed and you have lost! Check your time on the webpage - you can start+stop the stopwatch game there too (alternative to using the light switch). \\
#Todo: [[projects:maico_fan#further_random_usp_ideas|add scoreboard leadership]] with acronyms/name entries. \\
At least there is a trophy already 🏆 if you succeed - challenge accepted? :) \\
==== Humidity sensor ====
HTU21D sensor breakout board is used because it fits nice physically and I had it at hand. Note that internal temperature sensor is for heating element of humidity sensor. So if you poll humidity sensor too much, temp will rise and might even wear out sensor sooner. Bonus: you might be able to use temperature sensor for approx. ambient temperature - if your MCU in PCB sandwich radiates less heat than mine or place the sensor further away, like the original one. \\
Quick and high raise of Humidity will trigger shower mode with high fan speed till threshold is less than configured. \\
⚡️💦 Do not forget to check hole in rubber for sensor that it is sealed properly (hot glue works nicely). 💧⚡︎\\
=== variable fan speed ===
As seen in [[projects:maico_fan#logic_analyzer_capture|logic analyzer capture]] of the two available speeds, the fan speed is set by shifting trigger timing for Triac. So basically we can shift the timing inside the interval safely, if we keep the analyzed logic in mind = variable fan speed. \\
Do not switch Triac too near on crossing AC, as we are using 1+1=3 interrupts trick and the used interrupt must be free. \\
=== MQTT ===
#TBD #INSERT MQTT addresses table \\
As ESP8266 only provides Wi-Fi as wireless communication, MQTT is added for a proper way to add the fan to smart homes (e.g. HomeAssistant). This is just a bonus, as the fan control is standalone with its web-server already and offers REST API commands. \\
===== Further ideas and USPs =====
I have written down and remove this section again, as I do not want to play out my trump open handed when applying with @Maico. \\
The deleted, crossed out line might be extended to a section later with future projects satisfying USPs. \\
Deleted section is still to be unlocked, not published yet and has been replaced by this crossed out line as placeholder. \\
Actually, this hole wiki is not listed on google etc. (yet) \\
**#TODO?: reinsert removed part used for application** \\
+++++++++++++++++++++++++++ \\
- Create modular/custom PCB layout (for ESP32-C6?). ✅ Circuit done, not uploaded/shared/public yet. ☐ Create new dokuwiki-section for schematics. ☐ rewrite for Zigbee in ESP-IDF/FreeRTOS. ☐ Implement USPs ☐ Let others profit for € or $, sell (to Maico? PCBs on Tindie?). \\
Last of my thoughts: 💭💫\\
- Readers task (you) if wanted: (Re)create (custom) PCB layout in KiCad with help of schematics and PCB scans. \\
- Learn from [[projects:maico_fan#bonus_2the_riddle_of_eca150_win_free_gift|ECA150 VZC and participate in mail-giveaway, win some prices]]. Why would I want to have (the to me still mysterious) "M"-line too? Wait, there is some NFC-app series now too?! \\
- Read //[[projects:maico_fan#bonus_2the_riddle_of_eca150_win_free_gift|name scheming and 2 cents]]// if you want my IMHO \\
===== Peroration =====
The PCB is optimized for low cost, as you can see on the series resistors for light detection. I like the design, it does not seem over complicated - this is my first AC-fan RE though. What I absolutely dislike is that Triac switches Neutral instead of Live conductor. \\
The modification project was fun, I got an understanding how this AC fan is driven. LNK was upgraded, //only// the optocoupler was killed by me by accident in the beginning and had to be replaced - no other harm done (besides the knife attack on PIC16 traces of course..) :D \\
The ESP8266 with LNK306 and ASM1117-LDO module, sandwiched with HTU21 is doing its job fine for ~3 years now (time of writing) without any issues (actually 24/7 w/o night power saving). ✅ Long term test passed. \\
What would I do differently if it was my product? I would build it more modular with better galvanic isolation from logic level to mains AC and switch Live instead of Neutral with Triac. A more modern MCU with Zigbee would be better suitable for smart homes. Actually, I have build the circuit as schematics already. @Maico: Are you interested? I also have [[projects:maico_fan#further_ideas_and_usps|further ideas and USPs]] ;) I might like to sell parts of the work, also freed of 💩 and //kack-// labels, replaced by nice Maico design, maybe? Excellent choice. \\
@reader: I hope it was a write-up to enjoy :) Feedback and corrections welcome! Consider to [[https://www.paypal.com/donate/?hosted_button_id=PNZBZJYL5RXJ2|donate some real cookies]] 🍪 as this page uses none. \\
Also win free gift 🎁 by helping to [[projects:maico_fan#bonus_2the_riddle_of_eca150_win_free_gift|solve the Riddle of ECA150 VZC (RC)]] \\
//#note to myself: trying to be hip with emojis all over does not suite me.// \\
You are now pleased with the downloads: \\
===== Downloads =====
Let me download everything! \\
#unlock download link later, after application. \\
**#TODO** \\
> Software license ?! CC?
#insert OTA binaries \\
#insert littleFS files \\
#insert german html translation \\
#insert schematics \\
#insert pdf-article (dated) \\
#download everything together, zipped (with date tag)\\
Your task if wanted: (Re)create (custom) PCB layout in KiCad with help of schematics and PCB scans \\
Note: \\
> own, custom circuit with ESP32-C6 already created, but not published/shared yet. #TBD \\
-> "the timestamp of software isn't from 2022, are you cheating?" I am not, I have corrected some bugs and tried to tidy up a bit for your pleasure just before releasing this write-up. Didn't bother, no cheating, no AI used. \\
-> #Note to myself: still need to upload SW. \\
===== Bonus: the motor itself =====
Obviously I could not take apart the fan in the shared flat. But as written in [[projects:maico_fan#pcb_scan|section PCB scan]], I have gotten a burned up, rusty fan with water damage on Kleinanzeigen. \\
So, how to disassemble it?
- pull off fan rotor to the front (it is tightly stuck onto the shaft, consider winding a string behind all rotor blades and pull on that)
- pop off rubber sealed lid carefully on the back side (not glued, only stuck 👍 still handle carefully)
- losen all obvious screws on front and backside of fan
- take apart with brains - unlike me (motor toast=>I ripped the case apart and lost a photo due to it.)
{{gallery>:projects:maico-fan:hardware:photos:fan-motor}}
It has proper industry bearings. Some photos (-1) for you to enjoy. \\
===== Bonus 2: the Riddle of ECA150, win free gift =====
I do not own ECA150, I have just stumbled across a nice photo of RC version on Kleinanzeigen (hope I don't violate any copyright? mail me). I have gotten curious about the ICs used on that PCB and am sharing guesses.
{{:projects:maico-fan:hardware:photos:150ipro-rc.jpeg?320|}}
{{:projects:maico-fan:hardware:photos:150-ic.jpeg?300|}} \\
The etched "silkscreen" on the PCB says SIM300-0 / TCM300-0 module. According to the logo, a [[https://www.enocean.com/de/produkt/tcm-300/|TCM300]] 868 MHz module by EnOcean is used. [[https://www.enocean.com/wp-content/uploads/downloads-produkte/en/products/enocean_modules/tcm-300/user-manual-pdf/TCM300_TCM320_UserManual_Nov2021.pdf|Link to pdf datasheet (2MB)]].\\
The power input looks different with the two big yellow caps and no L1-line (how does it work?). What is written in red on the yellow caps?\\
The output is: 2x wire socket (J3 marked 1 | K) + 3x wiresocket (J2 marked 1 | M | C). "1" is probably L-mains and "K" = Common / Neutral or “Kapillar”. What is "M"? A Sensor? Or rather „Mitternetz“ Schalterphase / Steuerphase, a second motor input? J2 is probably used for the electrical shutter.\\
Really disappointing that there is no mention of J2 and J3 wiring or any fan connection //(or am I blind?)//. \\
What is the label of the IC "U1" cycled in red? I bet it is LNK30x?! \\
Pictures are hard to come by (probably best on Kleinanzeigen/ebay/online market) - I have not checked for long. Question remains: What is on the underside of the PCB? \\
A link to official [[https://www.maico-ventilatoren.com/cms-live/media/AnleitungenHTML5/ECA%20150%20ipro/Resources/pdf/516208651.pdf|Maico pdf datasheet (17.3MB, multi lang) here]]. \\
> 🎁 How does the back side look like and what can be read on the ICs? I give away a small free grift to chose from for electronic tinkering (shipping included within Germany): Just submit some good info or (broken) PCB =) 🎁 \\
> Send mail to: **contribute@super-se.de** - no spam please. \\
ECA150 ipro is a bigger fan (the number represents the duct diameter), here 150mm. Throughput is 200-250m³/h. There are now four modes (Comfort, Night, Save(?->Spar), **Power**) - why do I not have such cool names? //*note to myself to rename "kacken" to **power***// \\
Apparently there is ECA100 ipro RC too. I do not know how it looks like.
For ECA150 see [[https://www.maico-ventilatoren.com/produkte/p/platinen-g59683/pl-eca-150-ipro-rc-p123355|RC spare replacement PCB]] (for 318€?!) //#[[https://die-kaenguru-chroniken.fandom.com/wiki/Fr%C3%BCher_war_alles_2D|Känguru side note]]: But 318€?! That's 636 DMark! That's 1272 Ostmark. That's at least 6360 Ostmark auf'm Schwarzmarkt! … Jaa, I know what you are now thinking … 6360€ today would be 127200 Ostmark auf'm Schwarzmarkt … // \\
There is a cheaper version without wireless master/slave interconnect [[https://www.maico-ventilatoren.com/produkte/p/platinen-g59683/pl-eca-150-ipro-vzc-h-b-p132185]] (for //only// 90€ on Maico HP). \\
What MCU does it use? PIC16 again? Then RC version probably shares the same MCU for motor control on the backside of PCB with added wireless module? I have no idea (yet?). \\
Maybe we should build things on our own again? //Maico fun chapter #2?// \\
There are at least two even more simplistic versions in 150-series. I have not investigated how they might work or what their features are. See pictures cross-loaded from official Maico HP (@Maico: is that ok? *kindly ask*).
{{https://www.maico-ventilatoren.com/cms-live/media/Produktfotos/IM0018811.PNG?225}}
{{https://www.maico-ventilatoren.com/cms-live/media/Produktfotos/IM0018807.PNG?225}}
{{https://www.maico-ventilatoren.com/cms-live/media/Produktfotos/IM0018799.PNG?225}}
{{https://www.maico-ventilatoren.com/cms-live/media/Produktfotos/IM0018809.PNG?225}} \\
[RC | VZC | VZ | ipro K only] \\
=== name scheming and 2 cents ===
I wonder about the acronym lettered names. The are more simple, single sided PCBs (VZ version for //mere// 40€..). VZ has a single potentiometer to configure some value/parameter and 3x wire socket only. Question: The missing 'C' in VZ probably stands for "Control", missing logic. And 'V' and 'Z'? Verzögerungs-Zeitschalter? - I am having a hard time guessing here, is this somewhere public or obvious? And "ECA"? "Einbau Compact Axial"? \\
I get "H" for humidity, "B" for Bewegung/motion, but why "F" when it is called "Lichtsteuerung" / controlled by light sensor? Double confusing as "H" is "Feuchte-Vollautomatik" and not humidity on the german Maico HP. \\
So what does ipro K stand for? ele//K//trischem Innenverschluss? There is a version with only "K" letter, (no further suffix). It has 2x+3x wire sockets with only a huge cap and a resistor(?) (style coil?) on the front. I admit, would be fun to see how the lasts cents are shaped off of this product. \\
@Maico: Why does the name scheming sound like some of my variable names? ¯\_(ツ)_/¯ (this is no rant, just my unfiltered string of thoughts). \\
I have just googled economic news to Maico and have seen that the new generation has taken over with Mr. Müller & Mr. Beck in 2025 and that an NFC-App enabled version has been released? All the best! :) \\
//*note to myself*//: look into NFC-App / PCB \\
A kindly meant observation: If I look at the Maico HP, I feel not that I have a good guide to chose what I could use as a customer. If it was my product page, I would have a category product selector guide filtered by my special use cases via keyword filter. Then have some nice dynamic comparison overview of relevant products. I also had hard times finding spare part pages without a web search engine. It feels like a riddle to find out what is smart to chose - just my 2 cents. :) \\
=== Gathered info from pictures ===
On RC there is no optocoupler on the front side of PCB (is there one one the back side?). It is missing L1-light switch AC-input. How come cheaper versions have L1 light switch input, whereas RC does only have L+N? Is it motion sensor only? WT.. //#note: check manual// \\
There are three diodes around switching regulator(?IC label?), 680 µH inductor, the 4.7 400V cap, some minor parts and 4*100Ω next to the two fat caps (I wonder about). \\
One button, one LED, a pin-header for available sensors. TCM300 with wire antenna on RC version. \\
There are two large yellow 1.3µF 250VAC caps on the input(? or are they used with motor? Are that the new X-Class caps for EMI?) \\
The VZC (non-RC) version seems to be more similar to ECA100 ( - apparently there also is a RC(H) version for ECA100). Visually there seems to be an optocoupler and L1-light switch AC-input. It has two buttons, four LEDs and two jumpers. \\
It shares the two large yellow caps with RC-version though. \\
==== Side quest ====
How do other fan/ventilator manufacturers do it? How do the PCBs of ebm-papst look like? //Like a Bosch.?// \\
Oh, and I have just learned that there is some NFC-app enabled product line by Maico?! \\
Added 01/2026:
=== Helios ===
As time of writing, I am temporarily living in flat which has two fans from Helios, model M1/100 F and N/C version. \\
The fan in the shower room only runs slow in high humidity mode, the other in the WC never runs. The sticker on the cover has the wiring diagram printed on it. Configuration is done via DIP switches on PCB after having screwed off the plastic cover (DIP table inside cover). Connecting cable to terminal 1 or 2 changes behavior of fan too. \\
On opening, I have found out that the Varistor is totally blown, so no wonder it is not working at all. \\
I will try not to reverse engineer the whole thing too. \\
{{gallery>:projects:maico-fan:helios}}
[[https://global.heliosventilatoren.de/mediadata/product/mbv/M1_100_120_F_19053-005_1022.pdf|link to manual pdf (4.26MB); redirect to helios]] \\
As I try to resist to create schematics, here just a few thoughts what components are seen on the PCB: \\
There is not that much on the PCB. One L+N input and another double terminal. A relay turns on the fan over a transistor. There are two diodes (one in input), a coil and a varistor as protection on input. Voltage for PIC16 seems to be broken down by resistors only, there are two zener-diodes hidden too, below 10uF and 220uF caps. \\
As seen in the screenshot below, the setting of the jumpers can have a capacitor added, which limits the speed of the motor. \\
{{:projects:maico-fan:helios:info:jumpers.png?nolink&450|}}
Schematics of how jumpers work on page 15 in manual \\
I have connected a PICKit3 to see if MCU is still alive. The PIC16F616 has readout protection in place. The pins for connecting PICkit are right on the opposite PCB side of MCU. \\
> VCC - MCLR - GND - ICSPDATA - ICSPCLK \\
There is another 4-pin header near one edge of PCB with pinout: (read from middle to edge) \\
> Pin2 - VCC - GND - Pin3 \\
It is used in "F" model for a humidity sensor breakout board with bus-wire soldered onto these pads. The main PCB seems to be the same as "N/C" model. \\
As the PIC answers, the defective varistor was removed for testing: Runs in manual mode but not when light switch is connected to other terminal for time interval mode. White 2pin-component (coil?) gets warm. Have measured zener-diodes, one of it seems dead. Two of the four input 4703 SMD resistors are worn out. As I have limited tools and components in this flat, my landlord got a new fan. The PCB I let RIP (for now), the motor is put aside as spare part. \\