Renpho scales

The Renpho R-MSC04 (MorphoScan Nova) and newer ES-CS20M revisions on service 0x1A10 speak Renpho's own protocol. Most other Renpho models use the QN protocol; see QN scales. The ES-WBE28 and ES-26BB-B need no setup. The A-R003 advertises no name, so it needs ble.scale_mac on the default Linux transport and on macOS.

Supported models

Model	Adapter in the log	Body composition
R-MSC04 (MorphoScan Nova)	Renpho R-MSC04	BMI estimate; the scale's own with ble.rmsc04_profile_byte
ES-CS20M on service 0x1A10	ES-CS20M	From the measured resistance
ES-WBE28	Renpho ES-WBE28	BMI estimate
A-R003 (Experimental)	Renpho ES-WBE28	BMI estimate
ES-26BB-B	Renpho ES-26BB	From the measured impedance

Setup

1. Set ble.scale_mac to the scale's address (scan lists it).
2. Set the first user's height and last_known_weight, or a weight_range whose middle is close to their weight. The R-MSC04 and the ES-CS20M are sent a guest profile built from the first user.
3. Weigh in and stay on the scale until its display shows the results.

A weigh-in that worked logs Measurement: with the weight.

Guest profile

Right after connecting, ble-scale-sync sets the scale's clock to the host's time and time zone and writes a guest profile, as the Renpho app does. The profile holds the first user's height (the ES-CS20M also gets sex and birth date) and a weight. The weight is last_known_weight, otherwise the middle of weight_range when that range lies between 20 and 250 kg and spans no more than 100 kg, otherwise 70 kg.

The guest profile goes to the scale on every weigh-in, whoever steps on, also in a household with several users. It uses the guest slot, so profiles the Renpho app saved on the scale stay as they are. ble-scale-sync never logs the profile.

R-MSC04 (MorphoScan Nova)

The scale sends its results about 15 seconds after the weight settles, so the connection stays open for up to 30 seconds after that. If ble-scale-sync connects after the weight has settled, it takes the weight from the results frame. That fails while the scale still holds undelivered weigh-ins. Open the Renpho app once to sync them.

The scale computes body fat, skeletal muscle and visceral fat for the guest profile. Those figures are only logged unless you set rmsc04_profile_byte. The weigh-in gets the BMI estimate, or none with estimate_body_composition: false for the user.

The scale's ten segment impedances (trunk, both arms and both legs at 20 and 100 kHz) are exported as diagnostic values with every weigh-in that has a body fat value. In Home Assistant they are diagnostic sensors and start disabled.

Use the scale's own body fat

Experimental. The Renpho app writes your profile to the scale on every connection, and one byte of it makes the scale compute for you. You set that byte as rmsc04_profile_byte.

1. Turn on Android's Bluetooth HCI snoop log and weigh in with the Renpho app.

2. Find a write to characteristic 0x2A11 that starts with 55 aa b2 00 09.

3. Take its 12th byte:

   55 aa b2 00 09 <seq> <slot> <height> <height> <weight> <weight> <BYTE> <xx> <xx> <checksum>

4. Set it as two hex digits in quotes:

   ble:
     rmsc04_profile_byte: '5a' # replace with your byte, in quotes

5. Make the first user in config.yaml the person you captured, with the same height, gender and birth_date as in the Renpho app.

The scale's body fat, skeletal muscle and visceral fat are then exported for a weigh-in when all of these hold:

• the scale reported body fat and BMI;
• the profile with your byte was written in the same connection, and the scale acknowledged it before it reported the measurement complete;
• the weigh-in was matched to a user with the first user's height, sex and birth date;
• the scale's BMI fits the height that was sent.

The normal log then says:

Renpho R-MSC04: using the scale's body fat, skeletal muscle and visceral fat, computed for the profile sent with ble.rmsc04_profile_byte (#434)

Otherwise it gives the reason and the estimate goes out. Water, bone and muscle mass are derived from the scale's body fat. BMI, BMR, metabolic age and physique rating are calculated by ble-scale-sync. The skeletal muscle percentage is exported as the scale reports it, between 10 and 90 % only.

Limits:

• The byte can change with your age and your Renpho profile. Capture it again after your birthday or after you change your profile in the Renpho app.
• is_athlete does not change the scale's figures; the athlete setting is not sent.
• The byte is personal. Do not paste it into an issue. The setup wizard hides it when it lists changes.

Report results on #434.

ES-CS20M on service 0x1A10

Units that also have the characteristics AE01 and AE02 get the clock, the guest profile and a command to keep their display unit every time the scale switches on during a connection. Units without them get the command to show kg.

After a weigh-in the scale sends the weight, the resistance it measured (0 in socks) and a BMI and body fat it computed for the guest profile. ble-scale-sync uses the weight and the resistance and computes body composition for the matched user. The scale's own BMI and body fat are not used. The connection stays up until the scale switches off, 30 seconds after the result at most.

With runtime.debug: true every frame the scale sends is logged raw, including its reply to the profile.

Troubleshooting

The R-MSC04 gets weight but no body composition from the scale

Without rmsc04_profile_byte that is expected. See Use the scale's own body fat. With it, the normal log line Renpho R-MSC04: the scale's body fat, skeletal muscle and visceral fat are not used for this weigh-in names the reason.

The R-MSC04 drops the connection a few seconds in

On Linux the kernel likely refuses the scale's request for a slower connection, because BlueZ has loaded the scale's own preferred connection settings into it. The scale then hangs up about 5.5 seconds after connecting, and the weigh-in gets the settled weight but no body composition from the scale. The first weigh-in after a reboot can still work. Debug mode logs when the connection ended, and sudo btmon during a weigh-in shows LE Remote Connection Parameter Request Negative Reply before the scale disconnects.

To stop BlueZ from loading those settings, start it without its GAP plugin. A Docker container uses the host's BlueZ, so change the host.

1. Run sudo systemctl edit bluetooth.

2. Add these lines. If systemctl cat bluetooth shows another path or more options for bluetoothd, keep them and add -P gap.

   [Service]
   ExecStart=
   ExecStart=/usr/libexec/bluetooth/bluetoothd -P gap

3. Reboot. The kernel keeps the scale's old settings until then.

The next weigh-in logs a line that starts with Renpho R-MSC04: body composition received. Without the plugin, BlueZ takes the names of Bluetooth LE devices only from their advertisements. To undo it, remove those lines with sudo systemctl edit bluetooth and reboot. If the scale still hangs up, open an issue with the debug log of one weigh-in.

These steps do not cover Home Assistant OS, which ships its own BlueZ. An ESPHome proxy may avoid the drop, because its ESP32 connects with its own Bluetooth stack, not the host's. That is not yet tested with the R-MSC04.

The R-MSC04 connects again about 30 seconds after a weigh-in

With the host's own Bluetooth adapter, the next scan after scan_cooldown can find the scale still advertising and connect again. The scale hangs up without a reading, nothing is exported, and the log shows Scale disconnected before reading completed. To skip that connection, wait longer after a reading:

runtime:
  scan_cooldown: 60 # add-on: scan_cooldown

The log then shows Waiting 60s before next scan... after a reading. If the extra connection still happens, post the debug log of one weigh-in on #434.

An ES-CS20M connects but sends no weight

Check that the log says Matched adapter: ES-CS20M. A broadcast-only ES-CS20M or one on the QN protocol is covered in QN scales. Otherwise open an issue with the debug log of one weigh-in.