Beurer BF500: connects via Standard GATT but receives no measurement data

[nimoba]

Description

The Beurer BF500 is discovered and recognized during scan as Standard GATT (BCS/WSS). BLE Scale Sync connects successfully and discovers services (including BCS 0000181b, WSS 0000181d, and two vendor-specific services 0000ffff and 00010203-0405-0607-0809-0a0b0c0d1912), but never receives any measurement data — even when actively weighing.
Before BlueZ pairing I got Unlock write error: Failed to initiate write and Failed to register notify session. After successful pairing (the BF500 requires passkey confirmation via SET button on the scale), the error is gone but still no data after "Matched adapter". Debug mode shows no additional output.
The Beurer HealthManager Pro app communicates fine with the scale, so BLE is functional. openScale also doesn't support the BF500 yet (oliexdev/openScale#1034).
Environment: Raspberry Pi 4, Home Assistant OS, Docker, v1.6.3
Happy to provide HCI snoop logs or help test if needed!

Use Case

I want to automatically sync body composition data from my BF500 to Home Assistant via MQTT and to my fitness tracking app via Webhook.

Alternatives Considered

No response

[KristianP26]

Hey @nimoba, thanks for the detailed report! The BF500 is an interesting one since even openScale doesn't support it yet.

The Standard GATT adapter (BCS/WSS) only works with scales that follow the Bluetooth SIG body composition profile exactly. The BF500 advertises those services but likely uses a vendor-specific protocol on top (the 0x0000ffff and 0x00010203-...1912 services are a strong hint). This means we'll need a dedicated Beurer BF500 adapter.

To build one, I'd need a few things from you:

1. Diagnostic output

Update to v1.6.4 (just released) and run the diagnostic tool. It now logs characteristic flags which helps understand the protocol:

docker pull ghcr.io/kristianp26/ble-scale-sync:latest

docker run --rm -it --network host --cap-add NET_ADMIN --cap-add NET_RAW \
  --group-add 112 -v /var/run/dbus:/var/run/dbus:ro \
  -e DEBUG=true \
  ghcr.io/kristianp26/ble-scale-sync:latest diagnose <YOUR_SCALE_MAC>

2. HCI snoop log (most important)

A Bluetooth packet capture while the Beurer HealthManager Pro app talks to the scale. This reveals the exact protocol: what gets written, what notifications come back, and in what order.

On Android:

1. Enable Developer Options > Enable Bluetooth HCI snoop log
2. Open Beurer HealthManager Pro, do a full weigh-in
3. Disable the snoop log
4. Pull the log: adb pull /sdcard/btsnoop_hci.log (path varies by device, sometimes under /data/misc/bluetooth/logs/)

On iOS this is trickier, but the PacketLogger profile works.

3. Scale details

• Does the BF500 display body composition (fat %, water %, muscle %, bone mass) on its screen, or just weight?
• What firmware version does the HealthManager Pro app show?
• Does the scale require the SET button for every connection, or only the first pairing?

With the HCI snoop log I can reverse-engineer the protocol and build a proper adapter. Looking forward to your data!

[KristianP26]

Hi @nimoba, to unblock a proper BF500 adapter I need two captures from your side.

The BF500 exposes the standard BCS (0x181b) and WSS (0x181d) services plus two vendor-specific services (0000ffff and the 128-bit 00010203-0405-0607-0809-0a0b0c0d1912). "No data after Matched adapter" almost certainly means the scale won't push any measurements until we write a vendor-specific command that wakes it up. That's why openScale is also stuck on oliexdev/openScale#1034.

1. btmon while BLE Scale Sync connects

Run this on the HA host (as root) while the container connects and tries to read:

# Terminal 1: start capture
sudo btmon -w /tmp/bf500-ble-scale-sync.log

# Terminal 2: step on the scale and let the container connect and time out
# (with DEBUG=true so we get the full service enumeration)

Stop btmon once the scan times out. This tells me which CCCDs we subscribe to, whether we're missing a required write, and whether the scale is actually silent or we're dropping its notifications.

2. HCI snoop log from the Beurer HealthManager Pro app

This is the big one. Because the app works, its HCI log reveals the exact vendor-specific handshake the scale expects. Please capture a full weigh-in (step on until body composition appears in the app) and send the log.

Android:

1. Settings > Developer Options > Enable Bluetooth HCI snoop log
2. Toggle Bluetooth off/on
3. Open HealthManager Pro and do a full weigh-in
4. Disable the snoop log
5. adb pull /data/misc/bluetooth/logs/btsnoop_hci.log

iPhone:

1. Install Apple's Bluetooth logging profile
2. Restart the phone
3. Open HealthManager Pro and do a full weigh-in
4. Volume-up + Volume-down + Power held for 1 second to trigger sysdiagnose
5. Settings > Privacy > Analytics & Improvements > Analytics Data and share the latest sysdiagnose_... archive (the Bluetooth packetlogger file is inside)

Also useful: the scale firmware version (visible in HealthManager Pro > scale settings).

With those two captures I can write a dedicated beurer-bf500.ts adapter that sends the same commands the official app does.

[nimoba]

Hi @KristianP26 ,

thank you very much for both your comments. Sorry also for my late response.
I will try to deliver you the info till end of the week. Thank you very much for your amazing work!

[KristianP26]

Hi @nimoba, friendly ping on this one. No rush at all, but if you don't get a chance to capture the logs in the next ~2 weeks, I'll close this for now to keep the tracker tidy. Happy to reopen any time once you have the captures ready. Thanks again for the patience and for reporting!