ReadDTCInformation (0x19)

What is ReadDTCInformation (0x19)?

ReadDTCInformation reads the fault memory of an ECU. The sub-function byte selects the report type, which decides what the ECU returns: a count, a filtered list of DTCs, a snapshot (freeze frame) or extended data for one DTC.

A normal exchange:

Direction	Bytes	Meaning
Request	19 02 FF	reportDTCByStatusMask, mask 0xFF
Positive response	59 02 FF 01 23 45 2F ...	status availability mask, then DTC 0x012345 with status 0x2F
Negative response	7F 19 12	subFunctionNotSupported

Other typical negative responses are 7F 19 13 (incorrectMessageLengthOrInvalidFormat, missing status mask) and 7F 19 31 (requestOutOfRange, unknown DTC number for a snapshot request).

Where is it defined?

ISO 14229-1:2020 defines ReadDTCInformation (0x19) in the Stored data transmission functional unit, with the full list of report-type sub-functions, the three-byte DTC format and the eight status bits. DTC numbering and the relationship to OBD trouble codes are described in companion standards, but the UDS service and its status mask are in ISO 14229-1. The transport on CAN is ISO 15765-2, so a long DTC list arrives as a multi-frame message.

What it means in practice

Fault memory is read on nearly every diagnostic session, and the service is normally available in the default session because it only reads. In validation, engineers check:

• the supported sub-functions match the specification, and unknown ones give NRC 0x12;
• a request missing the status mask gives NRC 0x13;
• the status availability mask and the per-DTC status bits are consistent;
• snapshot and extended-data requests for an unknown DTC give NRC 0x31;
• reading DTCs does not change the stored faults.

During security testing, DTC behaviour is also a signal. A fuzzing run that makes the DTC count jump has probably hit a fault path worth reporting, so the service doubles as a monitor.

How AutoST tests it

AutoST reads DTC information during enumeration, so the result records whether fault memory is readable and in which session. In the fuzzing engine an optional DTC-count monitor reads 0x19 between iterations and flags any change in the trouble-code count during a run, which turns a growing fault memory into a signal that a fuzzed payload reached a fault path. The change is recorded alongside the exact payload.