The steering system of the Kia Soul is an Electric Power Assisted Steering (EPAS) system. The steering column contains a high current DC motor, as well as a torque sensor. The torque sensor measures the direction and amount of force on the steering wheel and outputs an Analog signal to the EPAS microprocessor. The microprocessor then controls the motor to "assist" the vehicle steering.

Below is a simple wiring diagram showing the connection between the the EPAS microprocessor and the torque sensor.

The EPAS motor can be controlled by removing the torque sensor input to the EPAS microprocessor and injecting spoofed torques. However, because the microprocessor uses the feedback from the torque sensor for its internal control loop, a new control loop must be created. This control loop will accept steering angle as its input. Steering angle data is available on the private Kia CAN bus.

The image below shows a high level system of control after we create a system for spoofing torques.

The Kia ECU implements fault detection on the torque sensor by detecting discontinuities in the analog signals coming from the sensors. If any discontinuities appear the car will go into a fault state, with the symptom of disabling the power steering. To overcome this, the new torque spoofing microprocessor will interpolate between the torque sensor values and the spoofed values before sensing spoofed signals.

A relay is used to switch the input of the EPAS microprocessor from the stock torque sensors and the spoofed torques.

The new PolySync throttle/steering shield is undergoing testing and validation. Board designs and schematics will be available as soon at the boards are thoroughly proven.

Part	Price
[[Arduino Uno	https://www.arduino.cc/en/Main/arduinoBoardUno]]
[[PolySync Steering/Throttle Shield R0	http://www.oscc.io]]

1. Print the enclosure if you haven't yet.
2. Screw the Arduino Uno to the enclosure.
3. Press the sensor interface board onto the Arduino.

The wiring harness for the torque sensor can be easily spliced onto in order to inject spoofed torque signals to the EPAS microcontroller. The image below shows the high current motor and the connector coming from the torque sensor. There are redundant torque sensors (2) and we need to splice into both signals and spoof both.

1. Cut the blue and green wires coming from the torque sensors.
2. Splice matching color wires onto the 4 new wire ends to lengthen each wire.
3. Connect the four wires to the EPAS microprocessor.

• Green from the APS goes to SIG IN A.
• Blue from the APS goes to SIG IN B.
• Remaining green goes to SIG OUT A.
• Remaining blue goes to SIG OUT B.

2. Power the unit with the emergency stop power bus.
3. Wire the module to the Control CAN bus.

• Torque Sensor Response

The Open Source Car Control Project has specific safety features that are incorporated into the embedded source code. These are mostly in the form of software diagnostics that check to see if the various hardware components in the system are working correctly. The steering module contains software diagnostics that can disable the OSCC steering module and return control to the driver in the event of any perceived failure.

The OSCC modules are not automotive-grade hardware. The automotive safety specification (ISO 26262) allows for the use of of software diagnostics to determine that the hardware is still functioning correctly. By testing the inputs and outputs of the OSCC steering module, the diagnostic can detect operational faults and disable the steering module to return control to the driver.

• DAC = Digital-to-Analog Converter
• Inside the microprocessor, there is no method or means to determine that a DAC is working correctly
• In order to prove the DAC is working correctly, the OSCC DAC output is wired into a "feedback" Analog-to-Digital Converter (ADC) so the output voltage can be checked. Each DAC is wired into an existing spare ADC on the OSCC board.

• The DAC Diagnostic software uses the following process-flow:
• The diagnostic runs periodically, approximately every 250ms or every 5th iteration of the steering control loop
• Read the value written to the DAC via the feedback ADC
• Compare the values read from the ADC to the original values written to the DAC
• If the values from the ADC are within range (currently 96mV) of the DAC output, then the DAC and the ADC can be considered as working correctly
• If the values read from the ADC are not within range, then there is something wrong and the DAC Diagnostic software disables the control immediately

• The values read from the ADC must be sufficiently delayed from the original write to the DAC because of the time that it takes for each of the hardware units to execute
• The DAC takes 4.5 uS to generate the output voltage after the value is written to the DAC register
• The ADC takes 260 uS when the read on the ADC register occurs
  • The read of the ADC register is a synchronous read
  • The majority of the delay associated with executing the diagnostics is waiting for analog reads to complete
  • It is important to understand that there can be issues associated with voltage stabilization that can cause delays in determining when to read the ADC register
  • Because there is plenty of time available in the current steering control loop, the feedback ADC is being read at the end of the loop