SleepU — live BLE protocol

Wellue / Viatom SleepU (sleep oxygen monitor). Host-side contract for a live SpO₂ + pulse connection. Captured on-device 2026-08-20 (advertised SleepU 0920, SN 25062B0920, FW 1.3.0).

This page is enough to scan, connect, poll, decode live readings, and handle protocol errors. It does not cover overnight file download, PPG/waveform, or device settings.

Scan by local name containing SleepU, or by the service UUID below. Do not store the MAC as the only selector (address type not verified).

Put the probe on a finger before expecting valid SpO₂. Packets still arrive with no usable pulse; hide the value when spo2 == 0 (the worn bit can stay 1).

Custom service (not a SIG pulse-oximeter profile).

1. Scan until a device named SleepU* appears (or the service UUID is advertised).
2. Connect as central; discover the service and the two characteristics.
3. Subscribe to Notify (0734594a-…) before the first write.
4. Every 1 second, write the 8-byte live-param request on Write (8b00ace7-…), no write-response.
5. Reassemble notify chunks into one frame (see MTU).
6. Check header, CMD XOR, length, and CRC-8.
7. If CMD is 0x01: protocol error (see below). Do not decode as live data.
8. If CMD is 0x00 and LENGTH is 13: live payload. Publish SpO₂ / pulse only when spo2 != 0 (also treat pr == 0 as no value).
9. Unsubscribe and disconnect when the live view stops (the device stays awake while connected).

Do not send INFO, file, or settings commands while the 1 Hz loop is running. INFO is optional and is not required to start live polling.

Every request and response uses this layout. Integers are little-endian.

Total frame size = 8 + LENGTH (live 21, error 12, INFO 520).

def crc8(data: bytes) -> int:
    crc = 0
    for byte in data:
        chk = crc ^ byte
        crc = 0
        if chk & 0x01: crc = 0x07
        if chk & 0x02: crc ^= 0x0E
        if chk & 0x04: crc ^= 0x1C
        if chk & 0x08: crc ^= 0x38
        if chk & 0x10: crc ^= 0x70
        if chk & 0x20: crc ^= 0xE0
        if chk & 0x40: crc ^= 0xC7
        if chk & 0x80: crc ^= 0x89
    return crc

Default ATT payload is 20 bytes.

Buffer notify data. A frame is complete when you have at least 7 bytes and len(buffer) >= 7 + LENGTH + 1. Then slice that many bytes and parse. Do not treat a 20-byte prefix as a full live packet. Do not cap LENGTH at 20 — INFO is 512.

Writes larger than 20 bytes must be chunked with a short delay. The live request is 8 bytes and fits in one write.

Poll at 1 Hz. Empty payload.

aa 17 e8 00 00 00 00 1b

CRC(aa 17 e8 00 00 00 00) = 0x1b

• HEADER 0x55
• CMD 0x00, XOR 0xFF
• BLOCK 0x0000
• LENGTH 13 (0x0d 00)
• 13-byte payload
• CRC

Offsets below are into the payload. Full-frame index = payload offset + 7.

PI is perfusion index (pulse strength at the probe), not a second oxygen channel. Use it as signal-quality / confidence.

Host wrote aa 17 e8 00 00 00 00 1b. Device notified (reassembled):

55 00 ff 00 00 0d 00 62 41 00 00 00 00 00 07 03 04 08 01 00 21

Same session, five 1 s polls: SpO₂ 98, 98, 98, 98, 99; PR 65, 64, 63, 59, 58; PI 0.8 then 0.7; CRC valid each time.

No usable pulse / not settled. Same 21-byte live frame, CRC ok. Hide this in the UI.

55 00 ff 00 00 0d 00 00 00 00 00 00 00 00 06 03 00 c8 01 00 8f

Gate: show only if spo2 != 0. Do not require worn, and do not treat this packet as a protocol error.

Protocol errors are not text. They are a 12-byte 0x55 frame with CMD 0x01 (XOR 0xFE), LENGTH 4, payload = u32 little-endian error code. Fits in one notify.

Captured on this SleepU (2026-08-20):

Family note (not captured here): missing NUL on FILE_OPEN is error 9. Other codes not exercised.

Two back-to-back valid 0x17 writes both got live replies (no NACK). Bad CRC / unknown CMD do return 0x01. Still treat mixed command types as single-outstanding.

Not required for live view. Live 0x17 worked with no prior INFO or SetTIME.

Request (empty payload):

aa 14 eb 00 00 00 00 c6

Response: HEADER 0x55, CMD 0x00, LENGTH 512, JSON then NUL padding. Total 520 bytes, many 20-byte notifies. Reassemble using LENGTH; do not drop frames larger than 21 bytes.

Observed JSON (this unit, 2026-08-20):

{"Region":"CE","Model":"1654","HardwareVer":"AA","SoftwareVer":"1.3.0","BootloaderVer":"0.1.0.0","FileVer":"3","SPCPVer":"1.4","SN":"25062B0920","CurTIME":"2026-08-21,00:17:15","CurBAT":"6%","CurBatState":"3","CurOxiThr":"90","CurMotor":"20","CurPedtar":"99999","CurMode":"0","CurState":"1","BranchCode":"21070000","FileList":"20260816015317,20260819023106,20260820155126,20260820235052,"}

Do not send these during the 1 Hz poll.

• Filter scan: name SleepU* or service 14839ac4-7d7e-415c-9a42-167340cf2339
• Connect, discover write 8b00ace7-… and notify 0734594a-…
• Enable notify before the first 0x17 write
• Write aa 17 e8 00 00 00 00 1b at 1 Hz, no response
• Reassemble until 7 + LENGTH + 1 (live 21 B = 20+1; error 12 B; INFO 520 B)
• If CMD is 0x01: u32 LE error code — not live data
• Live data is CMD 0x00, LENGTH 13, CRC-8
• Decode spo2 u8, pr u16 LE, pi u8/10, battery u8
• Show SpO₂ only when spo2 != 0 (worn bit can be 1 while spo2 is still 0)
• Do not mix other commands into the 1 Hz loop; disconnect when idle