ControlDTCSetting (0x85)

What is ControlDTCSetting (0x85)?

ControlDTCSetting turns the recording of diagnostic trouble codes on or off. The sub-function byte selects the state: on resumes normal DTC storage, off suspends it for the duration of the session.

A normal exchange:

Direction	Bytes	Meaning
Request	85 02	DTC setting off
Positive response	C5 02	accepted, storage suspended
Negative response	7F 85 7F	serviceNotSupportedInActiveSession

Other typical negative responses are 7F 85 12 (subFunctionNotSupported), 7F 85 13 (incorrectMessageLengthOrInvalidFormat) and 7F 85 22 (conditionsNotCorrect).

Where is it defined?

ISO 14229-1:2020 defines ControlDTCSetting (0x85) in the Diagnostic and communication management functional unit. The standard specifies the on and off sub-functions, the optional DTCSettingControlOptionRecord and the rule that the service is session-dependent, so the setting is tied to the active session and restored on return to the default session. The transport on CAN is ISO 15765-2. The faults themselves are read with ReadDTCInformation (0x19).

What it means in practice

ControlDTCSetting belongs to a tester that is about to do something that would otherwise set faults, so it lives in the extended session and is not meant to be reachable by default. In validation, engineers check:

• the service answers only in the intended session and gives NRC 0x7F in the default session;
• an unknown sub-function gives NRC 0x12 and a wrong length gives NRC 0x13;
• DTC storage resumes on session timeout, session change and reset;
• with storage off, side-effect faults are genuinely suppressed and real monitoring is restored afterwards.

The security-relevant failure is an ECU that leaves DTC storage off after the tester is gone, because a fault that occurs later would then not be recorded. We regularly see this alongside other session-handling bugs where state does not reset on an S3 timeout.

How AutoST tests it

AutoST records ControlDTCSetting during enumeration, including in which sessions it answers and with which negative response codes, and checks that DTC storage returns to on when the session ends. The session-survival check in enumeration surfaces an ECU that keeps the setting off after an S3 timeout or reset, and the DTC-count monitor in the fuzzing engine reads 0x19 so it can tell whether fault storage is behaving as expected during a run.