simply use the name of the onchange function as 5th parameter:

compare:

    $sock = new xmlrpc_client($this->OPENERP_SERVER.'object');
    $msg = new xmlrpcmsg('execute');
    $msg->addParam(new xmlrpcval($this->OpenERP_DB, "string"));
    $msg->addParam(new xmlrpcval($this->OpenERP_UserID, "int"));
    $msg->addParam(new xmlrpcval($this->OpenERP_Pass, "string"));
    $msg->addParam(new xmlrpcval($model, "string"));
    $msg->addParam(new xmlrpcval("search", "string"));

read, write or create would be other examples of a 5th param. So can your onchange or any other function name.

Actually, read, write or create are also simply just functions on your model, inherited from osv.osv.

    $sock = new xmlrpc_client($this->OPENERP_SERVER.'object');
    $msg = new xmlrpcmsg('execute');
    $msg->addParam(new xmlrpcval($this->OpenERP_DB, "string"));
    $msg->addParam(new xmlrpcval($this->OpenERP_UserID, "int"));
    $msg->addParam(new xmlrpcval($this->OpenERP_Pass, "string"));
    $msg->addParam(new xmlrpcval($model, "string"));
    $msg->addParam(new xmlrpcval("onchange_function", "string"));

Don't forget to add your params to the onchange_function next, just like search, read, create or write params.

    $msg->addParam(new xmlrpcval($params, "array"));

hth, dieck