I've had some fun today. Not sure if this fits into the
CAN bus thread or the 'Features not available in Oz' thread, but given my activity is mainly CAN based, here it is.
I have a Focus EHPAS up on the bench. I planned up and assembled a lab wiring setup on it today - using big yellow 9mm pins from Jaycar for power, and some cheap connectors from Aliexpress for the CAN plug. My first breakthrough is seeing the broadcast messages from just that module - 240. It's only short - and my data says that is mainly about pump status. There's a Jewel on the Instrument Cluster for the EHPAS, so I might experiment with an IC later and fiddle with bits in 240 to trry and turn on that Jewel. At the moment I am doing a full PID sweep on the pump - from 0000 to FFFF, so all 65536 PIDS at 100ms intervals, which should take just under 2 hours. The next is an offset sweep of all FF offset locations - of which I only expect to see a half dozen down the bottom. All the as-built stuff sits down there on other modules.
So in a few hours, I'll be trying to send some fake messages using the 080 address, to see if I can wake it up.
Last week I took a drive the XR4 with the eldest driving while capturing data, and confirmed message 080 is working correctly. The first 2 bytes are definitely Roadspeed, the next two bytes are definitely Steering Rate of Change, and the 5th Byte seems to be a bitwise field that changes when the car turns on - which looks like it will be the bits that turn the EHPAS pump on. Since the ehpas only cares about roadspeed (high pump speed at low rtoadspeed for parking) and steering rate of change (max assist while you're turning) then it is looking very good so far.
Fingers crossed.
I have wired this up in such a way that I can plug it all into the OBD2 port on the Fiesta, to see if the pump will spin up using the messages that are already there.
Lukeyson