Search code examples
bluetoothraspberry-pibluezraspberry-pi4btle

Raspberry PI BTLE can discover a Fitbit and a Scale device, but cannot pair

I have been attempting to pair a FitBit Inspire HR and a RENPHO ES-26R scale with my Raspberry Pi (3B+, 4B, and Zero), all with the same negative results. Running bluetoothctl (v5.50), the devices can be seen (ED:67 is the scale, 01:C5 is the Fitbit) :

...
[CHG] Device ED:67:37:60:78:22 ManufacturerData Key: 0xffff
[CHG] Device ED:67:37:60:78:22 ManufacturerData Value:
  aa bb ed 67 37 60 78 22 00 01 23 14 ff ff ff 14  ...g7`x"..#.....
  00 6a 04 4d a2 02 1d 0c                          .j.M....
[CHG] Device 01:C5:59:47:49:F9 RSSI: -47
[CHG] Device 01:C5:59:47:49:F9 TxPower: 3
...

SCALE

When I attempt to pair or connect the scale, the outputs from bluetoothctl, hcidump, and gatttool are as follows:

bluetoothctl

Attempting to pair with ED:67:37:60:78:22
Failed to pair: org.bluez.Error.AuthenticationCanceled

hcidump

> HCI Event: Command Complete (0x0e) plen 4
    LE Remove Device From White List (0x08|0x0012) ncmd 1
    status 0x00
> HCI Event: Command Complete (0x0e) plen 4
    LE Add Device To White List (0x08|0x0011) ncmd 1
    status 0x00
> HCI Event: Command Complete (0x0e) plen 4
    LE Set Scan Parameters (0x08|0x000b) ncmd 1
    status 0x00
> HCI Event: Command Complete (0x0e) plen 4
    LE Set Scan Enable (0x08|0x000c) ncmd 1
    status 0x00
> HCI Event: Command Complete (0x0e) plen 4
    LE Set Scan Enable (0x08|0x000c) ncmd 1
    status 0x00

gatttool

> sudo gatttool -b ED:67:37:60:78:22 -I
[ED:67:37:60:78:22][LE]> connect
Attempting to connect to ED:67:37:60:78:22
Error: connect error: Connection refused (111)

Per a few threads I've seen, I've tried using the address type of both public and random, with no change. The hcidump doesn't seem to have a lot going on for the Scale.

EDIT

Inspecting the Scale further, it appears that it is not "connectable". Given that there are no defined services or characteristics, I started looking at the "manufacturing data" in the Advertisement. I can see that as the measurement on the scale changes, portions of the data are changing: 

ff ff aa bb ed 67 37 60 78 22 5e 94 d7 4d 7f 7e 3a 14 00 00 00 4d a2 02 8a 25
ff ff aa bb ed 67 37 60 78 22 5e 94 d7 4d 7f 7e 3a 14 00 d2 00 4d a2 02 8b 25
ff ff aa bb ed 67 37 60 78 22 5e 94 d7 4d 7f 7e 3a 14 00 d2 00 4d a2 02 8b 25
ff ff aa bb ed 67 37 60 78 22 5e 94 d7 4d 7f 7e 3a 14 00 60 04 4d a2 02 8b 25
ff ff aa bb ed 67 37 60 78 22 5e 94 d7 4d 7f 7e 3a 14 00 68 06 4d a2 02 8b 25
ff ff aa bb ed 67 37 60 78 22 5e 94 d7 4d 7f 7e 3a 14 00 68 06 4d a2 02 8b 25
ff ff aa bb ed 67 37 60 78 22 5e 94 d7 4d 7f 7e 3a 14 00 ad 07 4d a2 02 8c 25
ff ff aa bb ed 67 37 60 78 22 5e 94 d7 4d 7f 7e 3a 14 00 ad 07 4d a2 02 8c 25
ff ff aa bb ed 67 37 60 78 22 5e 94 d7 4e 7f 7e 3a 14 00 6b 08 4d a2 02 8c 25

Now I just need to confirm that the updated portions are actually weight data - once I figure out what is what in the soup (e.g., unit of measure, weight, etc.).

FITBIT

For the Fitbit, there are a lot more outputs, but the pairing still fails:

bluetoothctl

pair 01:C5:59:47:49:F9
Attempting to pair with 01:C5:59:47:49:F9
[CHG] Device 01:C5:59:47:49:F9 Connected: yes
[CHG] Device 01:C5:59:47:49:F9 ServicesResolved: yes
[CHG] Device 01:C5:59:47:49:F9 ServicesResolved: no
[CHG] Device 01:C5:59:47:49:F9 Connected: no
Failed to pair: org.bluez.Error.AuthenticationCanceled

hcidump

> HCI Event: Command Complete (0x0e) plen 4
    LE Set Scan Parameters (0x08|0x000b) ncmd 1
    status 0x00
> HCI Event: Command Complete (0x0e) plen 4
    LE Set Scan Enable (0x08|0x000c) ncmd 1
    status 0x00
> HCI Event: Command Complete (0x0e) plen 4
    LE Set Scan Enable (0x08|0x000c) ncmd 1
    status 0x00
> HCI Event: Command Status (0x0f) plen 4
    LE Create Connection (0x08|0x000d) status 0x00 ncmd 1
> HCI Event: Command Status (0x0f) plen 4
    LE Read Remote Used Features (0x08|0x0016) status 0x00 ncmd 1
> HCI Event: Command Complete (0x0e) plen 14
    LE Read Remote Used Features (0x08|0x0016) ncmd 1
> HCI Event: Command Status (0x0f) plen 4
    Disconnect (0x01|0x0006) status 0x00 ncmd 1
> HCI Event: Disconn Complete (0x05) plen 4
    status 0x00 handle 64 reason 0x16
    Reason: Connection Terminated by Local Host

gatttool

Unlike the Scale, I am able to use gatttool to connect to the Fitbit and retrieve characteristics: 

[01:C5:59:47:49:F9][LE]> connect
Attempting to connect to 01:C5:59:47:49:F9
Connection successful
[01:C5:59:47:49:F9][LE]> characteristics
handle: 0x0002, char properties: 0x02, char value handle: 0x0003, uuid: 00002a00-0000-1000-8000-00805f9b34fb
handle: 0x0004, char properties: 0x02, char value handle: 0x0005, uuid: 00002a01-0000-1000-8000-00805f9b34fb
handle: 0x0006, char properties: 0x02, char value handle: 0x0007, uuid: 00002a04-0000-1000-8000-00805f9b34fb
handle: 0x0008, char properties: 0x02, char value handle: 0x0009, uuid: 00002aa6-0000-1000-8000-00805f9b34fb
handle: 0x000b, char properties: 0x20, char value handle: 0x000c, uuid: 00002a05-0000-1000-8000-00805f9b34fb
handle: 0x000f, char properties: 0x02, char value handle: 0x0010, uuid: adabfb04-6e7d-4601-bda2-bffaa68956ba
handle: 0x0011, char properties: 0x06, char value handle: 0x0012, uuid: adabfb02-6e7d-4601-bda2-bffaa68956ba
handle: 0x0013, char properties: 0x12, char value handle: 0x0014, uuid: adabfb03-6e7d-4601-bda2-bffaa68956ba
handle: 0x0016, char properties: 0x10, char value handle: 0x0017, uuid: adabfb01-6e7d-4601-bda2-bffaa68956ba
handle: 0x0019, char properties: 0x20, char value handle: 0x001a, uuid: adabfb05-6e7d-4601-bda2-bffaa68956ba
handle: 0x001d, char properties: 0x12, char value handle: 0x001e, uuid: 558dfa01-4fa8-4105-9f02-4eaa93e62980
handle: 0x0021, char properties: 0x02, char value handle: 0x0022, uuid: 00002a29-0000-1000-8000-00805f9b34fb
handle: 0x0023, char properties: 0x02, char value handle: 0x0024, uuid: 00002a24-0000-1000-8000-00805f9b34fb
handle: 0x0025, char properties: 0x02, char value handle: 0x0026, uuid: 00002a25-0000-1000-8000-00805f9b34fb
handle: 0x0027, char properties: 0x02, char value handle: 0x0028, uuid: 00002a27-0000-1000-8000-00805f9b34fb
handle: 0x0029, char properties: 0x02, char value handle: 0x002a, uuid: 00002a26-0000-1000-8000-00805f9b34fb
handle: 0x002b, char properties: 0x02, char value handle: 0x002c, uuid: 00002a28-0000-1000-8000-00805f9b34fb
handle: 0x002d, char properties: 0x02, char value handle: 0x002e, uuid: 00002a23-0000-1000-8000-00805f9b34fb
handle: 0x002f, char properties: 0x02, char value handle: 0x0030, uuid: 00002a2a-0000-1000-8000-00805f9b34fb
handle: 0x0031, char properties: 0x02, char value handle: 0x0032, uuid: 00002a50-0000-1000-8000-00805f9b34fb

Additional Information

Bluetooth Service Status

● bluetooth.service - Bluetooth service
   Loaded: loaded (/lib/systemd/system/bluetooth.service; enabled; vendor preset: enabled)
   Active: active (running) since Thu 2020-04-09 18:32:27 BST; 24min ago
     Docs: man:bluetoothd(8)
 Main PID: 5515 (bluetoothd)
   Status: "Running"
    Tasks: 1 (limit: 4915)
   Memory: 1.1M
   CGroup: /system.slice/bluetooth.service
           └─5515 /usr/lib/bluetooth/bluetoothd --compat --noplugin=sap -E

Apr 09 18:32:27 archer systemd[1]: Starting Bluetooth service...
Apr 09 18:32:27 archer bluetoothd[5515]: Bluetooth daemon 5.50
Apr 09 18:32:27 archer systemd[1]: Started Bluetooth service.
Apr 09 18:32:27 archer bluetoothd[5515]: Excluding (cli) sap
Apr 09 18:32:27 archer bluetoothd[5515]: Bluetooth management interface 1.14 initialized

dmesg | grep Bluetooth

[   12.451287] Bluetooth: Core ver 2.22
[   12.451337] Bluetooth: HCI device and connection manager initialized
[   12.452111] Bluetooth: HCI socket layer initialized
[   12.452123] Bluetooth: L2CAP socket layer initialized
[   12.452151] Bluetooth: SCO socket layer initialized
[   12.462111] Bluetooth: HCI UART driver ver 2.3
[   12.462118] Bluetooth: HCI UART protocol H4 registered
[   12.462172] Bluetooth: HCI UART protocol Three-wire (H5) registered
[   12.462284] Bluetooth: HCI UART protocol Broadcom registered
[   12.677032] Bluetooth: BNEP (Ethernet Emulation) ver 1.3
[   12.677038] Bluetooth: BNEP filters: protocol multicast
[   12.677048] Bluetooth: BNEP socket layer initialized
[  818.140511] Bluetooth: RFCOMM TTY layer initialized
[  818.140529] Bluetooth: RFCOMM socket layer initialized
[  818.140542] Bluetooth: RFCOMM ver 1.11

Connection

WiFi and Bluetooth both are active on all of the PIs, and I am connected via SSH.

Closing

I've been walking many, many threads from multiple forums and making various recommended configuration changes (keeping the PI 3B+ clean as a control) with no success. I would much appreciate any advice or pointers on where to go next. There must be something I am missing somewhere - most likely something simple that is making most of you guffaw like you've never guffawed before :)

Thank you for your time in reading this lengthy question.

Solution

  • For the Scale, I was finally able to decode the important values (weight). There are a few bits which I still do not know what they are, but the main problem was solved. Given the following positions and values: 

    Position:    00 01 02 03 04 05 06 07 08 09 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25
Value:       ff ff aa bb ed 67 37 60 78 22 5e 97 4a 74 7f 7e 3a 15 00 6a 04 4d a2 02 4a 3d

    The mapping is as follows:

    • 0-3: Unknown at the moment. Values have not been observed to change
    • 4-9: Device Address
    • 10-13: Unix Timestamp
    • 14-16: Unknown at the moment. Values have been observed to change, but not very often.
    • 17: Stabilization indicator. A value of 0x15 (21) indicates the scale has stabilized the measurement
    • 18: Unknown at the moment. Always appears to be 00
    • 19-20: The Weight!. Although the scale displays the weight in Lbs, the transmitted value needs to be divided by 100 to arrive at Kg and can then be converted to other units as needed.
    • 21-23: Unknown at the moment. The values have not been observed to change
    • 24: Unknown at the moment. The value changes here and there during measurement, may be related to calculating BMI, etc.
    • 25: Unknown at the moment. The value sometimes changes at various points throughout the day. Does not seem directly related to the measurement itself.

    I was - mistakenly - attempting to use the FitBit for sanity; but, obviously the roles and services the two devices fulfill and provide - and how they advertise - are not similar at all, so it was a bad solutioning set :).

    I hope this helps anyone else trying to retrieve data from a scale (specifically Renpho ES-26R) which provides its data in the advertisement. If anyone else comes across the meanings of the unknown bits, please feel free to leave a comment with the information.

    Thanks!