RomRaider

Any company which produces an OBD scan tool can join the Equipment and Tools Institute (http://www.etools.org) scan tool vertical group for $7500 and gain access the its TEK-NET Library. That's a set of CDROMs which contain data from car manufacturers about their proprietary data streams. Subaru has supplied ETI with information about its SSM data streams.

Several scan tool companies have implemented that Subaru information into their products. One example is at http://www.obd-2.com/subarpid.htm. Another, more interesting example, is at http://www.autoenginuity.com/Subaru-All-Systems-List.html. This page is interesting because it appears the supported parameters are listed in the same order as they appear in the 'supported parameters' bit string returned after an SSM ECU Init command.

I've created a text file from that page and arbitrarily segmented some of the 'new' stuff and have attached it below. The description 'Preparatory' appears often and seems to mean 'Reserved.'

For reference, I've attached a text file describing the SSM protocol that's been floating around since OpenECU began.

If you open this file in an editor side-by-side with the file in the first post, you find remarkable agreement. I think there are only a couple of discrepancies between this file and the new list in the first post.

Collecting ECU Init strings from various models can help resolve where the new parameters are in the bit string. Tribeca has VVL and the 2008 STI has exhaust AVCS. But some parameters like:
Turbine Revolution Speed
Competition Mode Switch
Competition Mode Lamp
may not be resolved until somebody hooks up RomRaider to a WRC car.

Nice job Jon! I had messed with looking for unknown SSM parameters before by writing a program to analyze the ECU init response against the known SSM parameters. Plugging in your additional descriptions for a USDM 07 STi, I get previously unknown parameters (I omitted the ? parameters - there are still quite a few of those):

I'm guessing with your list, that the bit position for some of the new parameters must be a guess since you really could only be sure if another known parameter happens to occupy one of the bit positions for that byte. Otherwise, by strictly the order of the list, there could be any number of unknowns in-between the new parameters?

I was also able to determine the VVL mode for the impreza 2.5i which should be useful.

Looking at the list again, the new parameters which we know the byte and bit position for certain:

These we don't know for certain the byte and/or bit position. We could make an educated guess with some of them, but the only way to verify would be to know that a particular ECU supports the parameter (and also enabled as indicated in ECU init string) or to verify in IDA (if it is obvious/can be determined easily):

We should look at the ECU init string for the 2007 Legacy GT, because I have service manual pages (attached) which show which parameters ought to be present. I've also attached the 2007 5AT automatic transmission parameters, since many of the "new" parameters appear AT related. I don't know whether TCU parameters would show up in the ECU's string.

I changed the output so that unconfirmed new parameter positions begin with "?" and marked as "unknown bit". Here's the 07 LGT:

Byte 09 (F3) [Engine Load (Relative)(7), Coolant Temperature(6), A/F Correction #1(5), A/F Learning #1(4), A/F Correction #2(3), A/F Learning #2(2), Manifold Absolute Pressure(1), Engine Speed(0)]
Engine Load (Relative) 7
Coolant Temperature 6
A/F Correction #1 5
A/F Learning #1 4
Manifold Absolute Pressure 1
Engine Speed 0

Byte 10 (FA) [Vehicle Speed(7), Ignition Total Timing(6), Intake Air Temperature(5), Mass Airflow(4), Throttle Opening Angle(3), Front O2 Sensor #1(2), Rear O2 Sensor(1), Front O2 Sensor #2(0)]
Vehicle Speed 7
Ignition Total Timing 6
Intake Air Temperature 5
Mass Airflow 4
Throttle Opening Angle 3
Rear O2 Sensor 1

Byte 11 (C9) [Battery Voltage(7), Mass Airflow Sensor Voltage(6), Throttle Sensor Voltage(5), Differential Pressure Sensor Voltage(4), Fuel Injector #1 Pulse Width(3), Fuel Injector #2 Pulse Width(2), Knock Correction Advance(1), Atmospheric Pressure(0)]
Battery Voltage 7
Mass Airflow Sensor Voltage 6
Fuel Injector #1 Pulse Width 3
Atmospheric Pressure 0

Byte 12 (8E) [Manifold Relative Pressure(7), Pressure Differential Sensor(6), Fuel Tank Pressure(5), CO Adjustment(4), Learned Ignition Timing(3), Accelerator Pedal Angle(2), Fuel Temperature(1), Front O2 Heater Current #1(0)]
Manifold Relative Pressure 7
Learned Ignition Timing 3
Accelerator Pedal Angle 2
Fuel Temperature 1

Byte 13 (B) [Rear O2 Heater Current(7), Front O2 Heater Current #2(6), Fuel Level(5), *Radiator Fan Control(4), Primary Wastegate Duty Cycle(3), Secondary Wastegate Duty Cycle(2), CPC Valve Duty Ratio(1), Tumble Valve Position Sensor Right(0)]
Primary Wastegate Duty Cycle 3
CPC Valve Duty Ratio 1
Tumble Valve Position Sensor Right 0

Byte 14 (81) [Tumble Valve Position Sensor Left(7), Idle Speed Control Valve Duty Ratio(6), A/F Lean Correction(5), A/F Heater Duty(4), Idle Speed Control Valve Step(3), Number of Exh. Gas Recirc. Steps(2), Alternator Duty(1), Fuel Pump Duty(0)]
Tumble Valve Position Sensor Left 7
Fuel Pump Duty 0

Byte 15 (FE) [Intake VVT Advance Angle Right(7), Intake VVT Advance Angle Left(6), Intake OCV Duty Right(5), Intake OCV Duty Left(4), Intake OCV Current Right(3), Intake OCV Current Left(2), A/F Sensor #1 Current(1), A/F Sensor #2 Current(0)]
Intake VVT Advance Angle Right 7
Intake VVT Advance Angle Left 6
Intake OCV Duty Right 5
Intake OCV Duty Left 4
Intake OCV Current Right 3
Intake OCV Current Left 2
A/F Sensor #1 Current 1

Byte 16 (AC) [A/F Sensor #1 Resistance(7), A/F Sensor #2 Resistance(6), A/F Sensor #1(5), A/F Sensor #2(4), A/F Correction #3(3), A/F Learning #3(2), Rear O2 Heater Voltage(1), A/F Adjustment Voltage(0)]
A/F Sensor #1 Resistance 7
A/F Sensor #1 5
A/F Correction #3 3
A/F Learning #3 2

Byte 17 (0) [*Front Wheel Speed(7), *ATF Temperature(6), Gear Position(5), ?Line Pressure Duty Ratio(4), *Lock Up Duty Ratio(3), *Transfer Duty Ratio(2), *Throttle Sensor Power(1), [b]*Turbine Revolution Speed(0)[/b]]

Byte 18 (0) [*Brake Clutch Duty Ratio(7), *Rear Wheel Speed(6), *Manifold Pressure Voltage(5), A/F Sensor #1 Heater Current(4), A/F Sensor #2 Heater Current(3), *Lateral G Sensor(2), *ATF Temperature(1), *Low Clutch Duty(0)]

Byte 19 (0) [*High Clutch Duty(7), *L&R B Duty(6), *ATF Temperature 2(5), *Voltage C - Diff. Switch(4), *AT Turbine Speed 1(3), *AT Turbine Speed 2(2), ?A/F Heater Current 1(1), ?A/F Heater Current 2(0)]

Byte 20 (66) [?Check Status(7), AT Vehicle ID(6), Test Mode Connector(5), Read Memory Connector(4), ?Preparatory(3), ?Clear Memory Terminal(2), ?(1), ?(0)]
AT Vehicle ID 6
Test Mode Connector 5
UNKNOWN BIT 2
UNKNOWN BIT 1

Byte 21 (CE) [Neutral Position Switch(7), Idle Switch(6), ?Preparatory(5), Intercooler AutoWash Switch(4), Ignition Switch(3), Power Steering Switch(2), Air Conditioning Switch(1), ?Preparatory(0)]
Neutral Position Switch 7
Idle Switch 6
Ignition Switch 3
Power Steering Switch 2
Air Conditioning Switch 1

Byte 22 (54) [Handle Switch(7), Starter Switch(6), Front O2 Rich Signal(5), Rear O2 Rich Signal(4), Front o2 #2 Rich Signal(3), Knock Signal #1(2), Knock Signal #2(1), Electrical Load Signal(0)]
Starter Switch 6
Rear O2 Rich Signal 4
Knock Signal #1 2

Byte 23 (F9) [Crank Position Sensor(7), Cam Position Sensor(6), Defogger Switch(5), Blower Switch(4), Interior Light Switch(3), Wiper Switch(2), Air-Con Lock Signal(1), Air-Con Mid Pressure Switch(0)]
Crank Position Sensor 7
Cam Position Sensor 6
Defogger Switch 5
Blower Switch 4
Interior Light Switch 3
Air-Con Mid Pressure Switch 0

Byte 24 (B1) [Air-Con Compressor Signal(7), Radiator Fan Relay #3(6), Radiator Fan Relay #1(5), Radiator Fan Relay #2(4), Fuel Pump Relay(3), Intercooler Auto-Wash Relay(2), CPC Solenoid Valve(1), Blow-by Leak Connector(0)]
Air-Con Compressor Signal 7
Radiator Fan Relay #1 5
Radiator Fan Relay #2 4
Blow-by Leak Connector 0

Byte 25 (E4) [PCV Solenoid Valve(7), TGV Output(6), TGV Drive(5), Variable Intake Air Solenoid(4), Pressure Sources Change(3), Vent Solenoid Valve(2), P/S Solenoid Valve(1), Assist Air Solenoid Valve(0)]
PCV Solenoid Valve 7
TGV Output 6
TGV Drive 5
Vent Solenoid Valve 2

Byte 26 (0) [Tank Sensor Control Valve(7), Relief Valve Solenoid 1(6), Relief Valve Solenoid 2(5), TCS Relief Valve Solenoid(4), Ex. Gas Positive Pressure(3), Ex. Gas Negative Pressure(2), Intake Air Solenoid(1), Muffler Control(0)]

Byte 27 (1F) [?Preparatory(7), ?Eng. Oil Pressure Switch 1(6), ?Eng. Oil Pressure Switch 2(5), ?Preparatory(4), Retard Signal From AT(3), Fuel cut Signal from AT(2), VDC Ban of Torque Down(1), Request Torque Dwon VDC(0)]
UNKNOWN BIT 4
Retard Signal From AT 3
Fuel cut Signal from AT 2
VDC Ban of Torque Down 1
Request Torque Dwon VDC 0

Byte 28 (20) [Torque Control Signal #1(7), Torque Control Signal #2(6), Torque Permission Signal(5), EAM Signal(4), AT coop. lock up signal(3), AT coop. lean burn signal(2), AT coop. rich spike signal(1), AET signal(0)]
Torque Permission Signal 5

Byte 29 (0) [?Tip Mode Switch(7), ?Cruise Control Signal(6), ?ABS Signal(5), ?Down Switch(4), ?Stop Lamp Switch(3), ?Shift Up Switch(2), ?Kick Down Switch(1), ?FWD Switch(0)]

Byte 30 (0) [?Power Switch(7), ?Hold Switch(6), ?1st Range(5), ?2nd Range(4), ?3rd Range(3), ?D Range(2), ?R Range(1), ?N/P Range(0)]

Byte 31 (0) [?4th Range(7), ?Tip Solenoid(6), ?Torque Control Output 1(5), ?Torque Control Output 2(4), ?2-4B Timing Solenoid(3), ?L/C Timing Solenoid(2), ?Shift Solenoid 2(1), ?Shift Solenoid 1(0)]

Byte 32 (0) [?Shift Output 4(7), ?Shift Output 3(6), ?Shift Output 2(5), ?Shift Output 1(4), ?Diagnosis Lamp(3), ?Rear Differential Oil Temp Switch(2), ?ATF Temperature Lamp(1), ?Shift Lock Solenoid(0)]

Byte 33 (0) [?Economic Mode Switch(7), ?Power Mode Lamp(6), ?P Range(5), ?Torque Down Prohibit Signal(4), ?P/N Signal(3), ?TCS Switch(2), ?Hold Lamp(1), ?N Range(0)]

Byte 34 (DC) [?Preparatory(7), ?4WD Judgement(6), ?Inhibitor Switch 1(5), ?Inhibitor Switch 2(4), ?Inhibitor Switch 3(3), ?Inhibitor Switch 4(2), ?Inhibitor Switch 3 Monitor(1), ?Back Lamp Relay(0)]
UNKNOWN BIT 7
UNKNOWN BIT 6
UNKNOWN BIT 4
UNKNOWN BIT 3
UNKNOWN BIT 2

Byte 35 (0) [?AT Ignition Power Supply Relay(7), ?Preparatory(6), ?Main CPU Writing Permission(5), ?Sub CPU Writing Permission(4), ?H and LR/C Oil Pressure Switch(3), ?D/C Oil Pressure Switch(2), ?Fr/B Oil Pressure Switch(1), ?I/C Oil Pressure Switch(0)]

Byte 36 (0) [?LC/B Oil Pressure Switch(7), ?Unit Identification Signal(6), ?(5), ?(4), ?(3), ?(2), ?(1), ?(0)]

Byte 37 (5D) [?(7), ?(6), ?(5), ?(4), ?(3), ?(2), ?(1), ?(0)]
UNKNOWN BIT 6
UNKNOWN BIT 4
UNKNOWN BIT 3
UNKNOWN BIT 2
UNKNOWN BIT 0

Byte 38 (1F) [?(7), ?(6), ?(5), ?(4), ?(3), ?(2), ?(1), ?(0)]
UNKNOWN BIT 4
UNKNOWN BIT 3
UNKNOWN BIT 2
UNKNOWN BIT 1
UNKNOWN BIT 0

Byte 39 (30) [?Preparatory(7), ?Throttle Sensor Closed V(6), Throttle Motor Duty(5), Throttle Motor Voltage(4), ?Preparatory(3), ?(2), ?(1), ?(0)]
Throttle Motor Duty 5
Throttle Motor Voltage 4

Byte 40 (80) [?(7), ?(6), ?(5), ?(4), ?(3), ?(2), ?(1), ?(0)]
UNKNOWN BIT 7

Byte 41 (F0) [Sub Throttle Sensor(7), Main Throttle Sensor(6), Sub Accelerator Sensor(5), Main Accelerator Sensor(4), Brake Booster Pressure(3), Fuel Pressure (High)(2), Exhaust Gas Temperature(1), ?Exhaust Gas Temperature 2(0)]
Sub Throttle Sensor 7
Main Throttle Sensor 6
Sub Accelerator Sensor 5
Main Accelerator Sensor 4

Byte 42 (E6) [Cold Start Injector(7), SCV Step(6), Memorized Cruise Speed(5), A/F Correction #3(4), A/F Learning #3(3), ?Fuel Level Resistance(2), ?(1), ?(0)]
Cold Start Injector 7
SCV Step 6
Memorized Cruise Speed 5
UNKNOWN BIT 2
UNKNOWN BIT 1

Byte 43 (0) [?Odometer(7), ?Fuel Pressure(6), ?Preparatory(5), ?Oil Temperature(4), ?OSV Duty R(3), ?OSV Duty L(2), ?OSV Current R(1), ?OSV Current L(0)]

Byte 44 (0) [Exhaust VVT Advance Angle Right(7), Exhaust VVT Advance Angle Left(6), Exhaust OCV Duty Right(5), Exhaust OCV Duty Left(4), Exhaust OCV Current Right(3), Exhaust OCV Current Left(2), ?VVL Lift Mode(1), (0)]

Byte 45 (43) [?Idle Switch(7), ETC Motor Relay(6), ?Injector Driver Relay(5), ?Accelerator Opening Angle Full Open Flag(4), ?Throttle Valve Opening Angle Full Open Flag(3), ?Preparatory(2), ?(1), ?(0)]
ETC Motor Relay 6
UNKNOWN BIT 1
UNKNOWN BIT 0

Byte 46 (FB) [Clutch Switch(7), Stop Light Switch(6), Set/Coast Switch(5), Resume/Accelerate Switch(4), Brake Switch(3), ?Inhibitor Switch(2), Accelerator Switch(1), ?Main Switch Judgement Holding Flag(0)]
Clutch Switch 7
Stop Light Switch 6
Set/Coast Switch 5
Resume/Accelerate Switch 4
Brake Switch 3
Accelerator Switch 1
UNKNOWN BIT 0

Byte 47 (0) [?(7), ?(6), ?(5), ?(4), ?(3), ?(2), ?(1), ?(0)]

Byte 48 (F5) [?LC/B Solenoid(7), ?LU and FWD/B Solenoid(6), ?(5), ?(4), ?(3), ?(2), ?(1), ?(0)]
UNKNOWN BIT 7
UNKNOWN BIT 6
UNKNOWN BIT 5
UNKNOWN BIT 4
UNKNOWN BIT 2
UNKNOWN BIT 0

Byte 49 (C1) [?Center Differential Lamp 1(7), ?Center Differential Lamp 2(6), ?Center Differential Lamp 3(5), ?Center Differential Lamp 4(4), ?Center Differential Lamp 5(3), ?Center Differential Lamp 6(2), ?(1), ?(0)]
UNKNOWN BIT 7
UNKNOWN BIT 6
UNKNOWN BIT 0

Byte 50 (86) [?H&LR/C Solenoid Current(7), ?D/C Solenoid Current(6), ?F/B Solenoid Current(5), ?I/C Solenoid Current(4), ?P/L Solenoid Current(3), ?L/U Solenoid Current(2), ?4WD Solenoid Current(1), ?Yaw Rate & G Sensor Ref. Current(0)]
UNKNOWN BIT 7
UNKNOWN BIT 2
UNKNOWN BIT 1

Byte 51 (0) [?H&LR/C Solenoid Pressure(7), ?D/C Solenoid Pressure(6), ?F/B Solenoid Pressure(5), ?I/C Solenoid Pressure(4), ?P/L Solenoid Pressure(3), ?L/U Solenoid Pressure(2), ?4WD Solenoid Pressure(1), ?Yaw Rate & G Sensor Ref. V(0)]

Byte 52 (0) [?FR Wheel Speed(7), ?FL Wheel Speed(6), ?RR Wheel Speed(5), ?RL Wheel Speed(4), ?Preparatory(3), ?(2), ?(1), ?(0)]

Byte 53 (0) [?(7), ?(6), ?(5), ?(4), ?(3), ?(2), ?(1), ?(0)]

Byte 54 (1) [?Parking Switch(7), ?Center Differential Relay(6), ?Competition Mode Switch(5), ?Competition Mode Lamp(4), ?Preparatory(3), ?Cancel SW(2), ?(1), ?(0)]
UNKNOWN BIT 0

Byte 55 (FD) [?(7), ?(6), ?(5), ?(4), ?(3), ?(2), ?(1), ?(0)]
UNKNOWN BIT 7
UNKNOWN BIT 6
UNKNOWN BIT 5
UNKNOWN BIT 4
UNKNOWN BIT 3
UNKNOWN BIT 2
UNKNOWN BIT 0

Byte 56 (F1) [Roughness Monitor Cylinder #1(7), Roughness Monitor Cylinder #2(6), Roughness Monitor Cylinder #3(5), Roughness Monitor Cylinder #4(4), ?Roughness Monitor Cylinder #5(3), ?Roughness Monitor Cylinder #6(2), ?Preparatory(1), ?(0)]
Roughness Monitor Cylinder #1 7
Roughness Monitor Cylinder #2 6
Roughness Monitor Cylinder #3 5
Roughness Monitor Cylinder #4 4
UNKNOWN BIT 0

Byte 57 (80) [?(7), ?(6), ?(5), ?(4), ?(3), ?(2), ?(1), ?(0)]
UNKNOWN BIT 7

Byte 58 (0) [?(7), ?(6), ?(5), ?(4), ?(3), ?(2), ?(1), ?(0)]

Byte 59 (81) [?(7), ?(6), ?(5), ?(4), ?(3), ?(2), ?(1), ?(0)]
UNKNOWN BIT 7
UNKNOWN BIT 0

Byte 60 (80) [?(7), ?(6), ?(5), ?(4), ?(3), ?(2), ?(1), ?(0)]
UNKNOWN BIT 7

I also just highlighted the parameter names in bold listed in the 07 LGT SSM document you posted that were new. Doesn't add up for some of them based on the ecu init string.

I updated the 07 LGT listing - it appears that the canbus ECUs have a longer init string - 104 bytes (I had assumed the 07 LGT was 56 bytes before without looking at it). My wife and I recently bought an 09 FXT it is also 104 bytes. Although, only bytes 57-60 have a value other than zero.

***********************************************************

2009 Forester XT:

Byte 09 (F3) [Engine Load (Relative)(7), Coolant Temperature(6), A/F Correction #1(5), A/F Learning #1(4), A/F Correction #2(3), A/F Learning #2(2), Manifold Absolute Pressure(1), Engine Speed(0)]
Engine Load (Relative) 7
Coolant Temperature 6
A/F Correction #1 5
A/F Learning #1 4
Manifold Absolute Pressure 1
Engine Speed 0

Byte 10 (FA) [Vehicle Speed(7), Ignition Total Timing(6), Intake Air Temperature(5), Mass Airflow(4), Throttle Opening Angle(3), Front O2 Sensor #1(2), Rear O2 Sensor(1), Front O2 Sensor #2(0)]
Vehicle Speed 7
Ignition Total Timing 6
Intake Air Temperature 5
Mass Airflow 4
Throttle Opening Angle 3
Rear O2 Sensor 1

Byte 11 (C9) [Battery Voltage(7), Mass Airflow Sensor Voltage(6), Throttle Sensor Voltage(5), Differential Pressure Sensor Voltage(4), Fuel Injector #1 Pulse Width(3), Fuel Injector #2 Pulse Width(2), Knock Correction Advance(1), Atmospheric Pressure(0)]
Battery Voltage 7
Mass Airflow Sensor Voltage 6
Fuel Injector #1 Pulse Width 3
Atmospheric Pressure 0

Byte 12 (8E) [Manifold Relative Pressure(7), Pressure Differential Sensor(6), Fuel Tank Pressure(5), CO Adjustment(4), Learned Ignition Timing(3), Accelerator Pedal Angle(2), Fuel Temperature(1), Front O2 Heater Current #1(0)]
Manifold Relative Pressure 7
Learned Ignition Timing 3
Accelerator Pedal Angle 2
Fuel Temperature 1

Byte 13 (B) [Rear O2 Heater Current(7), Front O2 Heater Current #2(6), Fuel Level(5), *Radiator Fan Control(4), Primary Wastegate Duty Cycle(3), Secondary Wastegate Duty Cycle(2), CPC Valve Duty Ratio(1), Tumble Valve Position Sensor Right(0)]
Primary Wastegate Duty Cycle 3
CPC Valve Duty Ratio 1
Tumble Valve Position Sensor Right 0

Byte 14 (81) [Tumble Valve Position Sensor Left(7), Idle Speed Control Valve Duty Ratio(6), A/F Lean Correction(5), A/F Heater Duty(4), Idle Speed Control Valve Step(3), Number of Exh. Gas Recirc. Steps(2), Alternator Duty(1), Fuel Pump Duty(0)]
Tumble Valve Position Sensor Left 7
Fuel Pump Duty 0

Byte 15 (FE) [Intake VVT Advance Angle Right(7), Intake VVT Advance Angle Left(6), Intake OCV Duty Right(5), Intake OCV Duty Left(4), Intake OCV Current Right(3), Intake OCV Current Left(2), A/F Sensor #1 Current(1), A/F Sensor #2 Current(0)]
Intake VVT Advance Angle Right 7
Intake VVT Advance Angle Left 6
Intake OCV Duty Right 5
Intake OCV Duty Left 4
Intake OCV Current Right 3
Intake OCV Current Left 2
A/F Sensor #1 Current 1

Byte 16 (AC) [A/F Sensor #1 Resistance(7), A/F Sensor #2 Resistance(6), A/F Sensor #1(5), A/F Sensor #2(4), A/F Correction #3(3), A/F Learning #3(2), Rear O2 Heater Voltage(1), A/F Adjustment Voltage(0)]
A/F Sensor #1 Resistance 7
A/F Sensor #1 5
A/F Correction #3 3
A/F Learning #3 2

Byte 17 (0) [*Front Wheel Speed(7), *ATF Temperature(6), Gear Position(5), ?Line Pressure Duty Ratio(4), *Lock Up Duty Ratio(3), *Transfer Duty Ratio(2), *Throttle Sensor Power(1), *Turbine Revolution Speed(0)]

Byte 18 (0) [*Brake Clutch Duty Ratio(7), *Rear Wheel Speed(6), *Manifold Pressure Voltage(5), A/F Sensor #1 Heater Current(4), A/F Sensor #2 Heater Current(3), *Lateral G Sensor(2), *ATF Temperature(1), *Low Clutch Duty(0)]

Byte 19 (0) [*High Clutch Duty(7), *L&R B Duty(6), *ATF Temperature 2(5), *Voltage C - Diff. Switch(4), *AT Turbine Speed 1(3), *AT Turbine Speed 2(2), ?A/F Heater Current 1(1), ?A/F Heater Current 2(0)]

Byte 20 (66) [?Check Status(7), AT Vehicle ID(6), Test Mode Connector(5), Read Memory Connector(4), ?Preparatory(3), ?Clear Memory Terminal(2), ?(1), ?(0)]
AT Vehicle ID 6
Test Mode Connector 5
UNKNOWN BIT 2
UNKNOWN BIT 1

Byte 21 (CE) [Neutral Position Switch(7), Idle Switch(6), ?Preparatory(5), Intercooler AutoWash Switch(4), Ignition Switch(3), Power Steering Switch(2), Air Conditioning Switch(1), ?Preparatory(0)]
Neutral Position Switch 7
Idle Switch 6
Ignition Switch 3
Power Steering Switch 2
Air Conditioning Switch 1

Byte 22 (54) [Handle Switch(7), Starter Switch(6), Front O2 Rich Signal(5), Rear O2 Rich Signal(4), Front o2 #2 Rich Signal(3), Knock Signal #1(2), Knock Signal #2(1), Electrical Load Signal(0)]
Starter Switch 6
Rear O2 Rich Signal 4
Knock Signal #1 2

Byte 23 (F9) [Crank Position Sensor(7), Cam Position Sensor(6), Defogger Switch(5), Blower Switch(4), Interior Light Switch(3), Wiper Switch(2), Air-Con Lock Signal(1), Air-Con Mid Pressure Switch(0)]
Crank Position Sensor 7
Cam Position Sensor 6
Defogger Switch 5
Blower Switch 4
Interior Light Switch 3
Air-Con Mid Pressure Switch 0

Byte 24 (B1) [Air-Con Compressor Signal(7), Radiator Fan Relay #3(6), Radiator Fan Relay #1(5), Radiator Fan Relay #2(4), Fuel Pump Relay(3), Intercooler Auto-Wash Relay(2), CPC Solenoid Valve(1), Blow-by Leak Connector(0)]
Air-Con Compressor Signal 7
Radiator Fan Relay #1 5
Radiator Fan Relay #2 4
Blow-by Leak Connector 0

Byte 25 (E4) [PCV Solenoid Valve(7), TGV Output(6), TGV Drive(5), Variable Intake Air Solenoid(4), Pressure Sources Change(3), Vent Solenoid Valve(2), P/S Solenoid Valve(1), Assist Air Solenoid Valve(0)]
PCV Solenoid Valve 7
TGV Output 6
TGV Drive 5
Vent Solenoid Valve 2

Byte 26 (0) [Tank Sensor Control Valve(7), Relief Valve Solenoid 1(6), Relief Valve Solenoid 2(5), TCS Relief Valve Solenoid(4), Ex. Gas Positive Pressure(3), Ex. Gas Negative Pressure(2), Intake Air Solenoid(1), Muffler Control(0)]

Byte 27 (1F) [?Preparatory(7), ?Eng. Oil Pressure Switch 1(6), ?Eng. Oil Pressure Switch 2(5), ?Preparatory(4), Retard Signal From AT(3), Fuel cut Signal from AT(2), VDC Ban of Torque Down(1), Request Torque Dwon VDC(0)]
UNKNOWN BIT 4
Retard Signal From AT 3
Fuel cut Signal from AT 2
VDC Ban of Torque Down 1
Request Torque Dwon VDC 0

Byte 28 (20) [Torque Control Signal #1(7), Torque Control Signal #2(6), Torque Permission Signal(5), EAM Signal(4), AT coop. lock up signal(3), AT coop. lean burn signal(2), AT coop. rich spike signal(1), AET signal(0)]
Torque Permission Signal 5

Byte 29 (0) [?Tip Mode Switch(7), ?Cruise Control Signal(6), ?ABS Signal(5), ?Down Switch(4), ?Stop Lamp Switch(3), ?Shift Up Switch(2), ?Kick Down Switch(1), ?FWD Switch(0)]

Byte 30 (0) [?Power Switch(7), ?Hold Switch(6), ?1st Range(5), ?2nd Range(4), ?3rd Range(3), ?D Range(2), ?R Range(1), ?N/P Range(0)]

Byte 31 (0) [?4th Range(7), ?Tip Solenoid(6), ?Torque Control Output 1(5), ?Torque Control Output 2(4), ?2-4B Timing Solenoid(3), ?L/C Timing Solenoid(2), ?Shift Solenoid 2(1), ?Shift Solenoid 1(0)]

Byte 32 (0) [?Shift Output 4(7), ?Shift Output 3(6), ?Shift Output 2(5), ?Shift Output 1(4), ?Diagnosis Lamp(3), ?Rear Differential Oil Temp Switch(2), ?ATF Temperature Lamp(1), ?Shift Lock Solenoid(0)]

Byte 33 (0) [?Economic Mode Switch(7), ?Power Mode Lamp(6), ?P Range(5), ?Torque Down Prohibit Signal(4), ?P/N Signal(3), ?TCS Switch(2), ?Hold Lamp(1), ?N Range(0)]

Byte 34 (DC) [?Preparatory(7), ?4WD Judgement(6), ?Inhibitor Switch 1(5), ?Inhibitor Switch 2(4), ?Inhibitor Switch 3(3), ?Inhibitor Switch 4(2), ?Inhibitor Switch 3 Monitor(1), ?Back Lamp Relay(0)]
UNKNOWN BIT 7
UNKNOWN BIT 6
UNKNOWN BIT 4
UNKNOWN BIT 3
UNKNOWN BIT 2

Byte 35 (0) [?AT Ignition Power Supply Relay(7), ?Preparatory(6), ?Main CPU Writing Permission(5), ?Sub CPU Writing Permission(4), ?H and LR/C Oil Pressure Switch(3), ?D/C Oil Pressure Switch(2), ?Fr/B Oil Pressure Switch(1), ?I/C Oil Pressure Switch(0)]

Byte 36 (0) [?LC/B Oil Pressure Switch(7), ?Unit Identification Signal(6), ?(5), ?(4), ?(3), ?(2), ?(1), ?(0)]

Byte 37 (5D) [?(7), ?(6), ?(5), ?(4), ?(3), ?(2), ?(1), ?(0)]
UNKNOWN BIT 6
UNKNOWN BIT 4
UNKNOWN BIT 3
UNKNOWN BIT 2
UNKNOWN BIT 0

Byte 38 (1F) [?(7), ?(6), ?(5), ?(4), ?(3), ?(2), ?(1), ?(0)]
UNKNOWN BIT 4
UNKNOWN BIT 3
UNKNOWN BIT 2
UNKNOWN BIT 1
UNKNOWN BIT 0

Byte 39 (30) [?Preparatory(7), ?Throttle Sensor Closed V(6), Throttle Motor Duty(5), Throttle Motor Voltage(4), ?Preparatory(3), ?(2), ?(1), ?(0)]
Throttle Motor Duty 5
Throttle Motor Voltage 4

Byte 40 (80) [?(7), ?(6), ?(5), ?(4), ?(3), ?(2), ?(1), ?(0)]
UNKNOWN BIT 7

Byte 41 (F0) [Sub Throttle Sensor(7), Main Throttle Sensor(6), Sub Accelerator Sensor(5), Main Accelerator Sensor(4), Brake Booster Pressure(3), Fuel Pressure (High)(2), Exhaust Gas Temperature(1), ?Exhaust Gas Temperature 2(0)]
Sub Throttle Sensor 7
Main Throttle Sensor 6
Sub Accelerator Sensor 5
Main Accelerator Sensor 4

Byte 42 (E6) [Cold Start Injector(7), SCV Step(6), Memorized Cruise Speed(5), A/F Correction #3(4), A/F Learning #3(3), ?Fuel Level Resistance(2), ?(1), ?(0)]
Cold Start Injector 7
SCV Step 6
Memorized Cruise Speed 5
UNKNOWN BIT 2
UNKNOWN BIT 1

Byte 43 (0) [?Odometer(7), ?Fuel Pressure(6), ?Preparatory(5), ?Oil Temperature(4), ?OSV Duty R(3), ?OSV Duty L(2), ?OSV Current R(1), ?OSV Current L(0)]

Byte 44 (0) [Exhaust VVT Advance Angle Right(7), Exhaust VVT Advance Angle Left(6), Exhaust OCV Duty Right(5), Exhaust OCV Duty Left(4), Exhaust OCV Current Right(3), Exhaust OCV Current Left(2), ?VVL Lift Mode(1), (0)]

Byte 45 (43) [?Idle Switch(7), ETC Motor Relay(6), ?Injector Driver Relay(5), ?Accelerator Opening Angle Full Open Flag(4), ?Throttle Valve Opening Angle Full Open Flag(3), ?Preparatory(2), ?(1), ?(0)]
ETC Motor Relay 6
UNKNOWN BIT 1
UNKNOWN BIT 0

Byte 46 (FB) [Clutch Switch(7), Stop Light Switch(6), Set/Coast Switch(5), Resume/Accelerate Switch(4), Brake Switch(3), ?Inhibitor Switch(2), Accelerator Switch(1), ?Main Switch Judgement Holding Flag(0)]
Clutch Switch 7
Stop Light Switch 6
Set/Coast Switch 5
Resume/Accelerate Switch 4
Brake Switch 3
Accelerator Switch 1
UNKNOWN BIT 0

Byte 47 (0) [?(7), ?(6), ?(5), ?(4), ?(3), ?(2), ?(1), ?(0)]

Byte 48 (F5) [?LC/B Solenoid(7), ?LU and FWD/B Solenoid(6), ?(5), ?(4), ?(3), ?(2), ?(1), ?(0)]
UNKNOWN BIT 7
UNKNOWN BIT 6
UNKNOWN BIT 5
UNKNOWN BIT 4
UNKNOWN BIT 2
UNKNOWN BIT 0

Byte 49 (C1) [?Center Differential Lamp 1(7), ?Center Differential Lamp 2(6), ?Center Differential Lamp 3(5), ?Center Differential Lamp 4(4), ?Center Differential Lamp 5(3), ?Center Differential Lamp 6(2), ?(1), ?(0)]
UNKNOWN BIT 7
UNKNOWN BIT 6
UNKNOWN BIT 0

Byte 50 (86) [?H&LR/C Solenoid Current(7), ?D/C Solenoid Current(6), ?F/B Solenoid Current(5), ?I/C Solenoid Current(4), ?P/L Solenoid Current(3), ?L/U Solenoid Current(2), ?4WD Solenoid Current(1), ?Yaw Rate & G Sensor Ref. Current(0)]
UNKNOWN BIT 7
UNKNOWN BIT 2
UNKNOWN BIT 1

Byte 51 (0) [?H&LR/C Solenoid Pressure(7), ?D/C Solenoid Pressure(6), ?F/B Solenoid Pressure(5), ?I/C Solenoid Pressure(4), ?P/L Solenoid Pressure(3), ?L/U Solenoid Pressure(2), ?4WD Solenoid Pressure(1), ?Yaw Rate & G Sensor Ref. V(0)]

Byte 52 (0) [?FR Wheel Speed(7), ?FL Wheel Speed(6), ?RR Wheel Speed(5), ?RL Wheel Speed(4), ?Preparatory(3), ?(2), ?(1), ?(0)]

Byte 53 (0) [?(7), ?(6), ?(5), ?(4), ?(3), ?(2), ?(1), ?(0)]

Byte 54 (1) [?Parking Switch(7), ?Center Differential Relay(6), ?Competition Mode Switch(5), ?Competition Mode Lamp(4), ?Preparatory(3), ?Cancel SW(2), ?(1), ?(0)]
UNKNOWN BIT 0

Byte 55 (FD) [?(7), ?(6), ?(5), ?(4), ?(3), ?(2), ?(1), ?(0)]
UNKNOWN BIT 7
UNKNOWN BIT 6
UNKNOWN BIT 5
UNKNOWN BIT 4
UNKNOWN BIT 3
UNKNOWN BIT 2
UNKNOWN BIT 0

Byte 56 (F1) [Roughness Monitor Cylinder #1(7), Roughness Monitor Cylinder #2(6), Roughness Monitor Cylinder #3(5), Roughness Monitor Cylinder #4(4), ?Roughness Monitor Cylinder #5(3), ?Roughness Monitor Cylinder #6(2), ?Preparatory(1), ?(0)]
Roughness Monitor Cylinder #1 7
Roughness Monitor Cylinder #2 6
Roughness Monitor Cylinder #3 5
Roughness Monitor Cylinder #4 4
UNKNOWN BIT 0

Byte 57 (80) [?(7), ?(6), ?(5), ?(4), ?(3), ?(2), ?(1), ?(0)]
UNKNOWN BIT 7

Byte 58 (0) [?(7), ?(6), ?(5), ?(4), ?(3), ?(2), ?(1), ?(0)]

Byte 59 (81) [?(7), ?(6), ?(5), ?(4), ?(3), ?(2), ?(1), ?(0)]
UNKNOWN BIT 7
UNKNOWN BIT 0

Byte 60 (80) [?(7), ?(6), ?(5), ?(4), ?(3), ?(2), ?(1), ?(0)]
UNKNOWN BIT 7

Byte 61 (0) [?(7), ?(6), ?(5), ?(4), ?(3), ?(2), ?(1), ?(0)]

Byte 62 (0) [?(7), ?(6), ?(5), ?(4), ?(3), ?(2), ?(1), ?(0)]

Byte 63 (0) [?(7), ?(6), ?(5), ?(4), ?(3), ?(2), ?(1), ?(0)]

Byte 64 (0) [?(7), ?(6), ?(5), ?(4), ?(3), ?(2), ?(1), ?(0)]

Byte 65 (0) [?(7), ?(6), ?(5), ?(4), ?(3), ?(2), ?(1), ?(0)]

Byte 66 (0) [?(7), ?(6), ?(5), ?(4), ?(3), ?(2), ?(1), ?(0)]

Byte 67 (0) [?(7), ?(6), ?(5), ?(4), ?(3), ?(2), ?(1), ?(0)]

Byte 68 (0) [?(7), ?(6), ?(5), ?(4), ?(3), ?(2), ?(1), ?(0)]

Byte 69 (0) [?(7), ?(6), ?(5), ?(4), ?(3), ?(2), ?(1), ?(0)]

Byte 70 (0) [?(7), ?(6), ?(5), ?(4), ?(3), ?(2), ?(1), ?(0)]

Byte 71 (0) [?(7), ?(6), ?(5), ?(4), ?(3), ?(2), ?(1), ?(0)]

Byte 72 (0) [?(7), ?(6), ?(5), ?(4), ?(3), ?(2), ?(1), ?(0)]

Byte 73 (0) [?(7), ?(6), ?(5), ?(4), ?(3), ?(2), ?(1), ?(0)]

Byte 74 (0) [?(7), ?(6), ?(5), ?(4), ?(3), ?(2), ?(1), ?(0)]

Byte 75 (0) [?(7), ?(6), ?(5), ?(4), ?(3), ?(2), ?(1), ?(0)]

Byte 76 (0) [?(7), ?(6), ?(5), ?(4), ?(3), ?(2), ?(1), ?(0)]

Byte 77 (0) [?(7), ?(6), ?(5), ?(4), ?(3), ?(2), ?(1), ?(0)]

Byte 78 (0) [?(7), ?(6), ?(5), ?(4), ?(3), ?(2), ?(1), ?(0)]

Byte 79 (0) [?(7), ?(6), ?(5), ?(4), ?(3), ?(2), ?(1), ?(0)]

Byte 80 (0) [?(7), ?(6), ?(5), ?(4), ?(3), ?(2), ?(1), ?(0)]

Byte 81 (0) [?(7), ?(6), ?(5), ?(4), ?(3), ?(2), ?(1), ?(0)]

Byte 82 (0) [?(7), ?(6), ?(5), ?(4), ?(3), ?(2), ?(1), ?(0)]

Byte 83 (0) [?(7), ?(6), ?(5), ?(4), ?(3), ?(2), ?(1), ?(0)]

Byte 84 (0) [?(7), ?(6), ?(5), ?(4), ?(3), ?(2), ?(1), ?(0)]

Byte 85 (0) [?(7), ?(6), ?(5), ?(4), ?(3), ?(2), ?(1), ?(0)]

Byte 86 (0) [?(7), ?(6), ?(5), ?(4), ?(3), ?(2), ?(1), ?(0)]

Byte 87 (0) [?(7), ?(6), ?(5), ?(4), ?(3), ?(2), ?(1), ?(0)]

Byte 88 (0) [?(7), ?(6), ?(5), ?(4), ?(3), ?(2), ?(1), ?(0)]

Byte 89 (0) [?(7), ?(6), ?(5), ?(4), ?(3), ?(2), ?(1), ?(0)]

Byte 90 (0) [?(7), ?(6), ?(5), ?(4), ?(3), ?(2), ?(1), ?(0)]

Byte 91 (0) [?(7), ?(6), ?(5), ?(4), ?(3), ?(2), ?(1), ?(0)]

Byte 92 (0) [?(7), ?(6), ?(5), ?(4), ?(3), ?(2), ?(1), ?(0)]

Byte 93 (0) [?(7), ?(6), ?(5), ?(4), ?(3), ?(2), ?(1), ?(0)]

Byte 94 (0) [?(7), ?(6), ?(5), ?(4), ?(3), ?(2), ?(1), ?(0)]

Byte 95 (0) [?(7), ?(6), ?(5), ?(4), ?(3), ?(2), ?(1), ?(0)]

Byte 96 (0) [?(7), ?(6), ?(5), ?(4), ?(3), ?(2), ?(1), ?(0)]

Byte 97 (0) [?(7), ?(6), ?(5), ?(4), ?(3), ?(2), ?(1), ?(0)]

Byte 98 (0) [?(7), ?(6), ?(5), ?(4), ?(3), ?(2), ?(1), ?(0)]

Byte 99 (0) [?(7), ?(6), ?(5), ?(4), ?(3), ?(2), ?(1), ?(0)]

Byte 100 (0) [?(7), ?(6), ?(5), ?(4), ?(3), ?(2), ?(1), ?(0)]

Byte 101 (0) [?(7), ?(6), ?(5), ?(4), ?(3), ?(2), ?(1), ?(0)]

Byte 102 (0) [?(7), ?(6), ?(5), ?(4), ?(3), ?(2), ?(1), ?(0)]

Byte 103 (0) [?(7), ?(6), ?(5), ?(4), ?(3), ?(2), ?(1), ?(0)]

Byte 104 (0) [?(7), ?(6), ?(5), ?(4), ?(3), ?(2), ?(1), ?(0)]

Here's are similar documents to what Jon [in CT] posted from the 07 FXT service manual.

If it would help, I could try to get the init string from our 07 FXT 4EAT.

dm

Wouldn't hurt.