Wellue / Viatom SleepU — protocol, capabilities and Somnolinc integration

Investigation:

2026-09-08. Tested retail SleepU: INFO model 1654, hardware AA, firmware 1.3.0, protocol 1.4, file version 3, branch 21070000.

Consolidated on 2026-09-14 from the August 20 live captures, September 8 investigation, and current repository documentation. No new device experiments were performed for this consolidation.

Protocol capabilities and implemented Android features are distinguished below. All command numbers are hexadecimal.

Verified below means exercised on this particular SleepU. SDK means found in the vendor library/demo, without establishing support on this firmware. Unknown means the evidence is insufficient. This is the complete command inventory recovered from the standard Oxy command builder, not a claim that every firmware command or product variant has been discovered.

Sources:

• Vendor LepuDemo, pinned revision, including its Oxy-family README and OxyActivity.kt.
• That checkout contains app/libs/lepu-blepro-1.3.9.aar (the README's dependency version is older). SHA-256: a578425905179cf5433aa6c9323b77fe8b809e7ecd5acf91a13c81711f7cf966. Inspected with CFR 0.152. Relevant classes: doad.ifgm (commands), doah.doab (OxyCommonBleInterface), doad.goto (wave), doad.try and doad.case (PPG), doae.dofd (file), doad.for (INFO). Obfuscated names apply only to this artifact. No vendor binary or decompiled source is included here.
• SleepU specifications and manufacturer manual describe standalone measurement, vibration alerts, internal storage, and live readings.
• Direct BLE captures and three downloaded files, kept outside Git in local/sleepu-protocol-2026-09-08/. These contain personal device/health data. plans/ble/05-sleepu-protocol/analyze.py checks captured frames and file structure.

Initial probes were read-only. Subsequent user-authorized write tests temporarily changed oxygen threshold 90 → 91 and motor intensity 20 → 21, then restored both with verified INFO readback. A grouped write of the original values and a clock write using the freshly read device time were also acknowledged. Factory data, firmware and stored recordings were not erased or rewritten. File reads open and close a transfer session.

The SDK's OxyII family has additional APIs and file types. Those are not evidence that this SleepU supports them. Likewise, the shared Oxy README's 150 Hz raw-PPG description must not be applied to the observed 125 Hz 8-bit waveform.

Scan using the advertised SleepU name and/or the custom Oxy service, then read INFO to establish the model/version. The service is shared across Oxy products. Only one central was used; disconnect ViHealth/Somnolinc before a host probe.

No standard Battery Service, DIS serial/model/version characteristics, or extra sensor characteristics were exposed in this discovery. Battery comes from the custom protocol; identity comes from INFO. RSSI is available from the BLE stack, not from an Oxy payload. Neither RSSI nor a device name authenticates a device.

All multibyte integers below are little endian. Offsets in subsequent tables refer to the payload, excluding the seven-byte frame header.

Request:  AA command (command XOR FF) block:u16 length:u16 payload CRC8
Response: 55 status  (status  XOR FF) block:u16 length:u16 payload CRC8

Total length is 8 + payload length. CRC covers everything except its own byte: polynomial 0x07, initial value 0, MSB first, no reflection or final XOR. Response status 0 is success; 1 is an error with a four-byte error code. The response does not echo the request command.

Subscribe before writing. Reassemble across notification boundaries, validate complement/length/CRC, and retain extra complete frames. The probe split writes into at most 20 bytes and successfully received fragmented 520-byte INFO/file frames. Do not limit protocol payloads to the ATT payload size.

Use one outstanding request across all command types. Dispatch by that request, not response length: a waveform, file block, and INFO can have overlapping lengths. File requests also carry a block counter. A timeout leaves response ownership ambiguous; stop the transaction and recover the connection instead of immediately issuing a different command that could consume the late reply.

The SDK resets its block counter for non-block commands, increments it for 04, and wraps before 65535. Do not interleave file transfer requests with other commands when following this implementation. Finish/close the file transaction, then resume live polling; waveform continuity across that pause is not guaranteed.

Error codes verified: 1 after a bad request CRC (August capture), 11 after unknown command 99, raw PPG, and box-info requests. Treat 11 as rejection of the request on this firmware, not proof about every variant. Other error code meanings are unverified; preserve the numeric code. The earlier notes mention family error 9 for a malformed filename but it was not established in these tests.

def crc8(data: bytes) -> int:
    crc = 0
    for byte in data:
        chk = crc ^ byte
        crc = 0
        if chk & 0x01: crc = 0x07
        if chk & 0x02: crc ^= 0x0E
        if chk & 0x04: crc ^= 0x1C
        if chk & 0x08: crc ^= 0x38
        if chk & 0x10: crc ^= 0x70
        if chk & 0x20: crc ^= 0xE0
        if chk & 0x40: crc ^= 0xC7
        if chk & 0x80: crc ^= 0x89
    return crc

Default ATT payload is 20 bytes.

Buffer notify data. A frame is complete when you have at least 7 bytes and len(buffer) >= 7 + LENGTH + 1. Then slice that many bytes and parse. Do not treat a 20-byte prefix as a full live packet. Do not cap LENGTH at 20 — INFO is 512.

Writes larger than 20 bytes must be chunked with a short delay. The live request is 8 bytes and fits in one write.

Strip trailing NUL padding, parse JSON, retain strings and unknown keys. These keys were actually returned:

SDK also recognizes OxiSwitch, HRSwitch, HRLowThr, HRHighThr, LightingMode, LightStr, SpO2SW, CurBuzzer, MtSW, MtThr, IvSW, IvThr, and SleepTime. They were absent here. An absent key is not evidence of a supported feature being disabled; avoid converting it into a false/zero capability claim. INFO is not required before basic live reads and the clock need not be synchronized to read data. Re-read identity/capabilities after reconnect.

One-second polling is adequate for existing numeric live display. It retrieves the current values, not a backlog. Timestamp replies on the host; the payload has no sample clock or sequence. Worn can remain true while SpO₂/pulse are invalid. Valid/invalid golden frames are included below. The wire fields above describe the complete payload; the current Android recording stores a subset, documented in the Somnolinc section below.

aa 17 e8 00 00 00 00 1b

CRC(aa 17 e8 00 00 00 00) = 0x1b

• HEADER 0x55
• CMD 0x00, XOR 0xFF
• BLOCK 0x0000
• LENGTH 13 (0x0d 00)
• 13-byte payload
• CRC

Host wrote aa 17 e8 00 00 00 00 1b. Device notified (reassembled):

55 00 ff 00 00 0d 00 62 41 00 00 00 00 00 07 03 04 08 01 00 21

Same session, five 1 s polls: SpO₂ 98, 98, 98, 98, 99; PR 65, 64, 63, 59, 58; PI 0.8 then 0.7; CRC valid each time.

No usable pulse / not settled. Same 21-byte live frame, CRC ok. Hide this in the UI.

55 00 ff 00 00 0d 00 00 00 00 00 00 00 00 06 03 00 c8 01 00 8f

SpO₂ validity gate: show only if spo2 != 0. The worn bit alone does not establish validity. Pulse zero is independently invalid; PI is unreliable while readings are invalid. Do not treat this packet as a protocol error.

Protocol errors are not text. They are a 12-byte 0x55 frame with CMD 0x01 (XOR 0xFE), LENGTH 4, payload = u32 little-endian error code. Fits in one notify.

Captured on this SleepU (2026-08-20):

Family note (not captured here): missing NUL on FILE_OPEN is error 9. Other codes not exercised.

Two back-to-back valid 0x17 writes both got live replies (no NACK). Bad CRC / unknown CMD do return 0x01. Still treat mixed command types as single-outstanding.

Not required for live view. Live 0x17 worked with no prior INFO or SetTIME.

Request (empty payload):

aa 14 eb 00 00 00 00 c6

Response: HEADER 0x55, CMD 0x00, LENGTH 512, JSON then NUL padding. Total 520 bytes, many 20-byte notifies. Reassemble using LENGTH; do not drop frames larger than 21 bytes.

Observed JSON (this unit, 2026-08-20):

{"Region":"CE","Model":"1654","HardwareVer":"AA","SoftwareVer":"1.3.0","BootloaderVer":"0.1.0.0","FileVer":"3","SPCPVer":"1.4","SN":"25062B0920","CurTIME":"2026-08-21,00:17:15","CurBAT":"6%","CurBatState":"3","CurOxiThr":"90","CurMotor":"20","CurPedtar":"99999","CurMode":"0","CurState":"1","BranchCode":"21070000","FileList":"20260816015317,20260819023106,20260820155126,20260820235052,"}

Require exactly 12 + N bytes. The SDK silently clamps malformed lengths; a recording implementation should report malformed packets instead. The waveform PI/state fields were zero even with valid numeric PI/worn values, so continue using 17 for those measures. There is no per-sample timestamp or sequence number.

The SDK preserves original waveByte but replaces values 156 and 246 with neighbors (or their average) in its display array. Their protocol meaning is unknown. Keep every original byte in recordings; any interpolation belongs only in visualization. Do not describe this 8-bit stream as raw red/infrared ADC data. The initial reply included suspicious repeated filler-like patterns; mark startup data as uncertain rather than treating the first batch as settled physiology.

All 131 replies in the sustained session completed with valid CRCs: 120 waveform, 6 numeric, 2 INFO, file open/close, and one deliberately rejected unknown command. INFO remained in measuring state and battery percent was unchanged across this short session. This is not an overnight endurance test.

Inference: the device drains a short waveform buffer capped at roughly one second/125 samples. Slow polling cannot retrieve all elapsed data. Which samples are retained during overflow, exact latency, and precise oscillator rate are unknown. Schedule waveform requests approximately every 200–250 ms with a single command arbiter, accounting for BLE latency. Preserve host monotonic request/reply times and batch boundaries. Flag stalls/125-sample saturation as possible loss; do not promise lossless reconstruction or invent exact sample timestamps.

The SDK decoder reads N as u16 at offset 0, followed by N nine-byte records: four little-endian bytes for infrared, four for red, one motion byte. Expected length is 2 + 9*N. The SDK stores optical words in Java ints; ADC bit depth, signedness and physical calibration are not established here.

The Oxy-family README describes 150 Hz for this API. This SleepU rejected it repeatedly while worn and measuring, including payload 00. There is no evidence of a separate mode that enables it. Do not expose this as an available capability or retry continuously after rejection on the same firmware.

1. Read INFO and take a snapshot of nonempty FileList entries.
2. Open an exact listed name plus NUL, block 0. Require a four-byte size response and a bounded, plausible size before allocating.
3. Request block 0, then 1, etc. Append verified payloads until the declared size; validate returned block numbers and reject empty/oversized/missing blocks.
4. Close the transfer, including on errors where the connection remains usable.
5. Validate header size/version/date, record divisibility and requested identity before accepting or deduplicating the recording. Preserve the original bytes.

Observed files were 75, 530 and 170 bytes, with 7, 98 and 26 samples and header durations 28, 392 and 104 seconds respectively. Thus all have exactly 4 seconds per numeric record. The 530-byte file arrived as 512 + 18 payload bytes. This raw binary transfer is not necessarily identical to a ViHealth export container or a file with a .vld extension.

Filename quirk: opening nonexistent 20000101000000 returned success with size 170 instead of an error. That transfer was closed without reading its body; whether it aliases a previous file or uses a fallback is unresolved. Never trust the open acknowledgement alone or silently label downloaded data with the request name. Validate the embedded start date against the requested date.

Summary-statistic names come from the SDK; their algorithms and alert thresholds were not independently validated. Do not interpret reserved sleep fields as sleep staging. Dates have no timezone; retain original wall time and explicit timezone assumptions separately. The four-second cadence does not establish whether each timestamp denotes an interval's beginning, end, or aggregation time.

The invalid sentinels differ from numeric live data's zero values. Do not graph 255% or 65,535 bpm, and reject out-of-range summary values. There are no waveform bytes in this layout.

The decompiled SDK labels flag masks 80, 40, 20, 10 as oxygen, pulse, motion and invalid warnings, but compares the masked results to 1, which would always yield false. It also derives sleep state from (flags & 30) » 4, overlapping those masks. All captured record flags were zero. This mapping is unverified and the SDK decoder is suspect; retain the byte without asserting warning or sleep-state semantics.

16 sends an ASCII-compatible JSON object with string values, e.g. {“SetTIME”:“2026-09-08,22:00:00”}. The builder casts characters to bytes rather than providing a general Unicode encoding. Use documented ASCII keys/values only. The SDK supports one key or a group of settings in the same object.

Do not infer writable keys merely by replacing Cur with Set. In particular, display settings, operating-mode changes and sensor-start/stop commands were not established by this investigation. Re-read INFO after a future deliberate settings write; an acknowledgement alone need not prove the requested value was applied.

All six tested setting requests returned success with payload 00 00 00 00. The grouped request contained original threshold/motor values; it verifies acceptance of that JSON shape, not atomic application of two changed values. The tests establish configuration read/write behavior, not the physical alert's trigger timing, vibration strength calibration, or persistence through power-off. Settings without readable original values were not toggled because their state could not be reliably restored.

18 is factory reset, not 1A. 1A programs factory information and FF negotiates optional encryption. Payload schemas for provisioning and the complete OEM security exchange remain unresolved. None is needed for retail live/file reads. The exposed update service is not sufficient to establish an upgrade recipe, supported image, rollback behavior or permission to flash firmware.

• Numeric 17 phone recording is implemented. Its timing, channel selection, validity handling and identity limits are documented below.
• A separate optional 1B track can preserve the live 8-bit pleth waveform. Give it its own format/sample-rate provenance, batch timestamps and gap markers; keep visual interpolation out of the saved bytes.
• Use one BLE request scheduler for INFO, numeric data, waveform and downloads. A file transfer can interrupt the short waveform buffer; schedule downloads outside waveform recording or explicitly mark the resulting gap.
• Import version 3 files as four-second SpO₂/pulse/motion history. They cannot backfill lost waveform, PI or battery samples.
• Do not advertise raw dual-channel PPG, raw accelerometry or remote recording control for this firmware. Cache rejections by firmware identity, not forever by Bluetooth address.

Remaining device experiments: finalize and retrieve a recording covering BLE streaming; check waveform continuity under movement/contact loss/reconnect; measure extended Android/background operation and power use; resolve filename fallback and nonzero file flags. These are explicit evidence gaps, not implied capabilities. Further configuration and DFU tests would be separate deliberate operations.

A subsequent roughly three-minute finalization watch continued to receive valid live data, but INFO stayed in measuring state and its file list did not change. The controlled internal-recording test therefore remains pending sensor removal and completion of the device's countdown; no new file was available to validate.

The analyzer uses Python's standard library and does not connect to a device:

python3 -m unittest discover -s plans/ble/05-sleepu-protocol -p 'test_*.py'
python3 plans/ble/05-sleepu-protocol/analyze.py capture local/sleepu-protocol-2026-09-08/sustained-wave-capture.json
python3 plans/ble/05-sleepu-protocol/analyze.py file local/sleepu-protocol-2026-09-08/*.bin

The capture command expects September probe events with kind=request/notify, hex bytes and notification times. It checks every request/response CRC, block matching, serialization and complete transactions before reporting counts and waveform timing. The file command validates version, calendar, byte size and record alignment. It reports aggregate validity counts without printing dates, serials or physiological sample values. Five regression tests cover a captured fragmented live frame, corruption/truncation, overlapping/unsolicited replies, waveform count validation/raw marker preservation, and file integrity/sentinels.

Connect the SpO₂ finger sensor in the live view and press Record. The phone records its live BLE readings together with any connected headband/chestbelt. SleepU can also be the only connected recording device. Stop record finalizes the capture and EDF+ export while leaving the live sensor connection active.

Connecting alone leaves the display frozen. Start resumes all connected live displays, including SleepU; Freeze holds their plots without interrupting an active recording. Record also resumes the displays, and Stop record freezes them, matching the headband/chestbelt controls. Resuming appends to the retained display history with a gray vertical separator in both SpO₂ and pulse. The traces do not connect across the omitted pause interval. BLE polling remains active while connected, independently of display updates. Turning the screen off or backgrounding the app freezes all live displays and keeps the connections and any active recording. Press Start to resume after returning.

This is phone recording of the existing approximately 1 Hz numeric feed. It does not download SleepU's internal files or request pleth/raw PPG waveform data.

The source sleepu-1 / stream live records SpO₂, pulse, PI, motion, battery percentage, worn, and countdown. Battery state, packed IV flags, and the step counter still arrive in the shared BLE packet but are omitted from new captures and EDF exports. Older recordings retain their original channel descriptors. Raw numeric invalid sentinels are retained in capture; EDF marks invalid oxygen/pulse/PI as missing, preserving other status channels. EDF uses its existing gap annotations and physical-minimum filler convention; consumers must honor the annotations rather than treating filler as a valid value.

Timestamps use Android elapsed realtime when the notification completing the frame arrives. SleepU sends no sample timestamps or sequence numbers. The capture retains each observation time; EDF uses a nominal 1 Hz grid, with indices rounded from elapsed time since the first reading. Missed polls and reconnect gaps remain holes, and competing observations in the same grid cell use the existing EDF collision handling. This timing is not the sensor's exact physiological sampling time. The firmware-segment fields describe one synthetic host-clock segment here.

Recording retains the SleepU connection when the app goes into the background. Changing a recorded SleepU connection stops and saves the current recording first. Automatic reconnect keeps the timeline; terminal connection loss follows the same stop behavior as the other recorded devices. Display visibility does not govern recording ownership: connected devices are selected when recording starts.

The current client does not read INFO identity. The descriptor's device identifier is a connection address, not a durable unit key or authenticated identity. Recording rejects a different connection address while attached. Serial/version metadata can be added when INFO support is implemented.

The Android client currently implements numeric polling only. Its frame codec caps payloads at 64 bytes; INFO/file/waveform support requires extending that limit and adding request-aware dispatch. The device capability matrix above does not imply those features are exposed by the app.

In the live view, open More → Export recording, select a completed recording, and press Export. This works for any device combination. The app copies the EDF and unchanged manifest.json into Downloads/Somnolinc/<recording-id>_export_<suffix>/. The EDF is named <recording-id>.edf, retaining the device/date identifier used by the private recording folder. Each export uses a separate folder; the original recording stays in private storage. Active, unfinished, and failed EDF exports are not listed. Exporting an older recording does not stop a current recording.

Android 10+ uses MediaStore Downloads without a storage permission. Android 8–9 requests storage permission when exporting. The UI reports success only after both files have been copied and published.