diff --git a/src/Makefile.am b/src/Makefile.am
index 5351d24..1a2ea97 100644
--- a/src/Makefile.am
+++ b/src/Makefile.am
@@ -62,6 +62,7 @@
 	tbf_ul.cpp \
 	tbf_ul_ass_fsm.c \
 	tbf_dl.cpp \
+	tbf_dl_ass_fsm.c \
 	bts.cpp \
 	bts_pch_timer.c \
 	pdch.cpp \
@@ -103,6 +104,7 @@
 	tbf_ul.h \
 	tbf_ul_ass_fsm.h \
 	tbf_dl.h \
+	tbf_dl_ass_fsm.h \
 	bts.h \
 	bts_pch_timer.h \
 	pdch.h \
diff --git a/src/encoding.cpp b/src/encoding.cpp
index 886b25d..d9f4f87 100644
--- a/src/encoding.cpp
+++ b/src/encoding.cpp
@@ -708,11 +708,11 @@
 
 /* Generate Packet Downlink Assignment as per 3GPP TS 44.060, section 11.2.7.
  * NOTE: 'block' is expected to be zero-initialized by the caller. */
-void Encoding::write_packet_downlink_assignment(RlcMacDownlink_t * block,
+void write_packet_downlink_assignment(RlcMacDownlink_t * block,
 	bool old_tfi_is_valid, uint8_t old_tfi, uint8_t old_downlink,
 	const struct gprs_rlcmac_dl_tbf *tbf, uint8_t poll, uint8_t rrbp,
 	uint8_t alpha, uint8_t gamma, int8_t ta_idx,
-	uint8_t ta_ts, bool use_egprs)
+	uint8_t ta_ts, bool use_egprs, uint8_t control_ack)
 {
 	PDA_AdditionsR99_t *pda_r99;
 
@@ -739,7 +739,7 @@
 
 	block->u.Packet_Downlink_Assignment.MAC_MODE            = 0x0;          // Dynamic Allocation
 	block->u.Packet_Downlink_Assignment.RLC_MODE            = RLC_MODE_ACKNOWLEDGED;
-	block->u.Packet_Downlink_Assignment.CONTROL_ACK         = tbf->was_releasing; // NW establishes no new DL TBF for the MS with running timer T3192
+	block->u.Packet_Downlink_Assignment.CONTROL_ACK         = control_ack; // NW establishes no new DL TBF for the MS with running timer T3192
 	block->u.Packet_Downlink_Assignment.TIMESLOT_ALLOCATION = 0;   // timeslot(s)
 	for (tn = 0; tn < 8; tn++) {
 		if (tbf->pdch[tn])
diff --git a/src/encoding.h b/src/encoding.h
index 39f6974..f942fd8 100644
--- a/src/encoding.h
+++ b/src/encoding.h
@@ -63,12 +63,6 @@
 			uint8_t t3142
 		);
 
-	static void write_packet_downlink_assignment(RlcMacDownlink_t * block,
-			bool old_tfi_is_valid, uint8_t old_tfi, uint8_t old_downlink,
-			const struct gprs_rlcmac_dl_tbf *tbf, uint8_t poll, uint8_t rrbp,
-			uint8_t alpha, uint8_t gamma,
-			int8_t ta_idx, uint8_t ta_ts, bool use_egprs);
-
 	static void encode_rbb(const char *show_rbb, uint8_t *rbb);
 
 	static void write_packet_uplink_ack(
@@ -118,6 +112,13 @@
 				    uint8_t rrbp, uint8_t alpha, uint8_t gamma, int8_t ta_idx,
 				    bool use_egprs);
 
+void write_packet_downlink_assignment(RlcMacDownlink_t * block, bool old_tfi_is_valid,
+				      uint8_t old_tfi, uint8_t old_downlink,
+				      const struct gprs_rlcmac_dl_tbf *tbf, uint8_t poll,
+				      uint8_t rrbp, uint8_t alpha, uint8_t gamma,
+				      int8_t ta_idx, uint8_t ta_ts, bool use_egprs,
+				      uint8_t control_ack);
+
 void write_packet_neighbour_cell_data(RlcMacDownlink_t *block,
 		bool tfi_is_dl, uint8_t tfi, uint8_t container_id,
 		uint8_t container_idx, PNCDContainer_t *container);
diff --git a/src/gprs_rlcmac_sched.cpp b/src/gprs_rlcmac_sched.cpp
index e616ae2..18c0763 100644
--- a/src/gprs_rlcmac_sched.cpp
+++ b/src/gprs_rlcmac_sched.cpp
@@ -56,7 +56,7 @@
 			continue;
 		if (ul_tbf->ul_ack_state_is(GPRS_RLCMAC_UL_ACK_SEND_ACK))
 			tbf_cand->ul_ack = ul_tbf;
-		if (ul_tbf->dl_ass_state_is(GPRS_RLCMAC_DL_ASS_SEND_ASS))
+		if (tbf_dl_ass_rts(ul_tbf))
 			tbf_cand->dl_ass = ul_tbf;
 		if (tbf_ul_ass_rts(ul_tbf))
 			tbf_cand->ul_ass = ul_tbf;
@@ -72,7 +72,7 @@
 		/* this trx, this ts */
 		if (!dl_tbf->is_control_ts(pdch->ts_no))
 			continue;
-		if (dl_tbf->dl_ass_state_is(GPRS_RLCMAC_DL_ASS_SEND_ASS))
+		if (tbf_dl_ass_rts(dl_tbf))
 			tbf_cand->dl_ass = dl_tbf;
 		if (tbf_ul_ass_rts(dl_tbf))
 			tbf_cand->ul_ass = dl_tbf;
@@ -171,7 +171,7 @@
 			else if (tbf == tbfs->ul_ass && tbf->direction == GPRS_RLCMAC_DL_TBF)
 				msg = tbf_ul_ass_create_rlcmac_msg(tbfs->ul_ass, fn, ts);
 			else if (tbf == tbfs->dl_ass && tbf->direction == GPRS_RLCMAC_UL_TBF)
-				msg = tbfs->dl_ass->create_dl_ass(fn, ts);
+				msg = tbf_dl_ass_create_rlcmac_msg(tbfs->dl_ass, fn, ts);
 			else if (tbf == tbfs->ul_ack)
 				msg = tbfs->ul_ack->create_ul_ack(fn, ts);
 			else if (tbf == tbfs->nacc) {
@@ -196,7 +196,7 @@
 		 */
 		if (tbfs->dl_ass) {
 			tbf = tbfs->dl_ass;
-			msg = tbfs->dl_ass->create_dl_ass(fn, ts);
+			msg = tbf_dl_ass_create_rlcmac_msg(tbfs->dl_ass, fn, ts);
 		} else if (tbfs->ul_ass) {
 			tbf = tbfs->ul_ass;
 			msg = tbf_ul_ass_create_rlcmac_msg(tbfs->ul_ass, fn, ts);
diff --git a/src/pdch.cpp b/src/pdch.cpp
index 8c61293..17a2d50 100644
--- a/src/pdch.cpp
+++ b/src/pdch.cpp
@@ -352,11 +352,11 @@
 		tbf_free(tbf);
 		return;
 	}
-	if (tbf->dl_ass_state_is(GPRS_RLCMAC_DL_ASS_WAIT_ACK)) {
+	if (tbf->dl_ass_state_is(TBF_DL_ASS_WAIT_ACK)) {
 		LOGPTBF(tbf, LOGL_DEBUG, "[UPLINK] DOWNLINK ASSIGNED\n");
 		/* reset N3105 */
 		tbf->n_reset(N3105);
-		TBF_SET_ASS_STATE_DL(tbf, GPRS_RLCMAC_DL_ASS_NONE);
+		osmo_fsm_inst_dispatch(tbf->dl_ass_fsm.fi, TBF_DL_ASS_EV_RX_ASS_CTRL_ACK, NULL);
 
 		new_tbf = ms_dl_tbf(ms);
 		if (!new_tbf) {
diff --git a/src/tbf.cpp b/src/tbf.cpp
index 37356e3..3c0c530 100644
--- a/src/tbf.cpp
+++ b/src/tbf.cpp
@@ -61,13 +61,6 @@
 
 static void tbf_timer_cb(void *_tbf);
 
-const struct value_string gprs_rlcmac_tbf_dl_ass_state_names[] = {
-	OSMO_VALUE_STRING(GPRS_RLCMAC_DL_ASS_NONE),
-	OSMO_VALUE_STRING(GPRS_RLCMAC_DL_ASS_SEND_ASS),
-	OSMO_VALUE_STRING(GPRS_RLCMAC_DL_ASS_WAIT_ACK),
- 	{ 0, NULL }
-};
-
 const struct value_string gprs_rlcmac_tbf_ul_ack_state_names[] = {
 	OSMO_VALUE_STRING(GPRS_RLCMAC_UL_ACK_NONE),
 	OSMO_VALUE_STRING(GPRS_RLCMAC_UL_ACK_SEND_ACK), /* send acknowledge on next RTS */
@@ -117,14 +110,12 @@
 	control_ts(0xff),
 	fT(0),
 	num_fT_exp(0),
-	was_releasing(0),
 	upgrade_to_multislot(0),
 	bts(bts_),
 	m_tfi(0),
 	m_created_ts(0),
 	m_ctrs(NULL),
 	m_ms(ms),
-	dl_ass_state(GPRS_RLCMAC_DL_ASS_NONE),
 	ul_ack_state(GPRS_RLCMAC_UL_ACK_NONE),
 	m_egprs_enabled(false)
 {
@@ -147,6 +138,9 @@
 	memset(&ul_ass_fsm, 0, sizeof(ul_ass_fsm));
 	ul_ass_fsm.tbf = this;
 	ul_ass_fsm.fi = osmo_fsm_inst_alloc(&tbf_ul_ass_fsm, this, &ul_ass_fsm, LOGL_INFO, NULL);
+	memset(&dl_ass_fsm, 0, sizeof(dl_ass_fsm));
+	dl_ass_fsm.tbf = this;
+	dl_ass_fsm.fi = osmo_fsm_inst_alloc(&tbf_dl_ass_fsm, this, &dl_ass_fsm, LOGL_INFO, NULL);
 
 	m_rlc.init();
 	m_llc.init();
@@ -162,6 +156,8 @@
 
 	osmo_fsm_inst_free(ul_ass_fsm.fi);
 	ul_ass_fsm.fi = NULL;
+	osmo_fsm_inst_free(dl_ass_fsm.fi);
+	dl_ass_fsm.fi = NULL;
 
 	rate_ctr_group_free(m_ctrs);
 }
@@ -576,8 +572,6 @@
 			  chan, new_poll_fn, ts);
 		break;
 	case PDCH_ULC_POLL_DL_ASS:
-		dl_ass_state = GPRS_RLCMAC_DL_ASS_WAIT_ACK;
-
 		LOGPTBFDL(this, LOGL_INFO, "Scheduled DL Assignment polling on %s (FN=%d, TS=%d)\n",
 			  chan, new_poll_fn, ts);
 		break;
@@ -635,14 +629,13 @@
 		}
 		/* Signal timeout to FSM to reschedule UL assignment */
 		osmo_fsm_inst_dispatch(this->ul_ass_fsm.fi, TBF_UL_ASS_EV_ASS_POLL_TIMEOUT, NULL);
-	} else if (dl_ass_state == GPRS_RLCMAC_DL_ASS_WAIT_ACK) {
+	} else if (dl_ass_state_is(TBF_DL_ASS_WAIT_ACK)) {
 		if (!(state_fsm.state_flags & (1 << GPRS_RLCMAC_FLAG_TO_DL_ASS))) {
 			LOGPTBF(this, LOGL_NOTICE,
 				"Timeout for polling PACKET CONTROL ACK for PACKET DOWNLINK ASSIGNMENT: %s\n",
 				tbf_rlcmac_diag(this));
 			state_fsm.state_flags |= (1 << GPRS_RLCMAC_FLAG_TO_DL_ASS);
 		}
-		dl_ass_state = GPRS_RLCMAC_DL_ASS_NONE;
 		bts_do_rate_ctr_inc(bts, CTR_RLC_ASS_TIMEDOUT);
 		bts_do_rate_ctr_inc(bts, CTR_PDA_POLL_TIMEDOUT);
 		if (n_inc(N3105)) {
@@ -651,8 +644,8 @@
 			bts_do_rate_ctr_inc(bts, CTR_PDA_POLL_FAILED);
 			return;
 		}
-		/* reschedule DL assignment */
-		dl_ass_state = GPRS_RLCMAC_DL_ASS_SEND_ASS;
+		/* Signal timeout to FSM to reschedule DL assignment */
+		osmo_fsm_inst_dispatch(this->dl_ass_fsm.fi, TBF_DL_ASS_EV_ASS_POLL_TIMEOUT, NULL);
 	} else if (m_ms->nacc && m_ms->nacc->fi->state == NACC_ST_WAIT_CELL_CHG_CONTINUE_ACK &&
 		   m_ms->nacc->continue_poll_fn == poll_fn && m_ms->nacc->continue_poll_ts == pdch->ts_no) {
 		/* Timeout waiting for CTRL ACK acking Pkt Cell Change Continue */
@@ -794,103 +787,6 @@
 	}
 }
 
-struct msgb *gprs_rlcmac_tbf::create_dl_ass(uint32_t fn, uint8_t ts)
-{
-	struct msgb *msg;
-	struct gprs_rlcmac_dl_tbf *new_dl_tbf = NULL;
-	RlcMacDownlink_t *mac_control_block = NULL;
-	const int poll_ass_dl = 1;
-	unsigned int rrbp = 0;
-	uint32_t new_poll_fn = 0;
-	int rc;
-	bool old_tfi_is_valid = is_tfi_assigned();
-
-	/* We only use this function in control TS (PACCH) so that MS can always answer the poll */
-	OSMO_ASSERT(is_control_ts(ts));
-
-	if (ul_ass_state_is(TBF_UL_ASS_WAIT_ACK))
-	{
-		LOGPTBF(this, LOGL_DEBUG,
-			  "Polling is already scheduled, so we must wait for the uplink assignment...\n");
-		return NULL;
-	}
-	rc = check_polling(fn, ts, &new_poll_fn, &rrbp);
-	if (rc < 0)
-		return NULL;
-
-	/* on uplink TBF we get the downlink TBF to be assigned. */
-	if (direction == GPRS_RLCMAC_UL_TBF) {
-		gprs_rlcmac_ul_tbf *ul_tbf = as_ul_tbf(this);
-
-		/* be sure to check first, if contention resolution is done,
-		 * otherwise we cannot send the assignment yet (3GPP TS 44.060 sec 7.1.3.1) */
-		if (!ul_tbf->m_contention_resolution_done) {
-			LOGPTBF(this, LOGL_DEBUG,
-				"Cannot assign DL TBF now, because contention resolution is not finished.\n");
-			return NULL;
-		}
-	}
-
-	if (ms())
-		new_dl_tbf = ms_dl_tbf(ms());
-
-	if (!new_dl_tbf) {
-		LOGPTBFDL(this, LOGL_ERROR,
-			  "We have a schedule for downlink assignment, but there is no downlink TBF\n");
-		dl_ass_state = GPRS_RLCMAC_DL_ASS_NONE;
-		return NULL;
-	}
-
-	if (new_dl_tbf == as_dl_tbf(this))
-		LOGPTBF(this, LOGL_DEBUG, "New and old TBF are the same.\n");
-
-	if (old_tfi_is_valid && !new_dl_tbf->is_tlli_valid()) {
-		LOGPTBF(this, LOGL_ERROR,
-			  "The old TFI is not assigned and there is no TLLI. New TBF %s\n",
-			  new_dl_tbf->name());
-		dl_ass_state = GPRS_RLCMAC_DL_ASS_NONE;
-		return NULL;
-	}
-
-	new_dl_tbf->was_releasing = was_releasing;
-	msg = msgb_alloc(GSM_MACBLOCK_LEN, "rlcmac_dl_ass");
-	if (!msg)
-		return NULL;
-
-	/* Initialize a bit vector that uses allocated msgb as the data buffer.
-	 * Old G++ does not support non-trivial designated initializers. Sigh. */
-	struct bitvec bv = { };
-	bv.data = msgb_put(msg, GSM_MACBLOCK_LEN);
-	bv.data_len = GSM_MACBLOCK_LEN;
-	bitvec_unhex(&bv, DUMMY_VEC);
-
-	LOGPTBF(new_dl_tbf, LOGL_INFO, "start Packet Downlink Assignment (PACCH)\n");
-	mac_control_block = (RlcMacDownlink_t *)talloc_zero(tall_pcu_ctx, RlcMacDownlink_t);
-	Encoding::write_packet_downlink_assignment(mac_control_block,
-		old_tfi_is_valid, m_tfi, (direction == GPRS_RLCMAC_DL_TBF),
-		new_dl_tbf, poll_ass_dl, rrbp,
-		bts_get_ms_pwr_alpha(new_dl_tbf->bts), the_pcu->vty.gamma, -1, 0,
-		is_egprs_enabled());
-	LOGP(DTBF, LOGL_DEBUG, "+++++++++++++++++++++++++ TX : Packet Downlink Assignment +++++++++++++++++++++++++\n");
-	rc = encode_gsm_rlcmac_downlink(&bv, mac_control_block);
-	if (rc < 0) {
-		LOGP(DTBF, LOGL_ERROR, "Encoding of Packet Downlink Ass failed (%d)\n", rc);
-		goto free_ret;
-	}
-	LOGP(DTBF, LOGL_DEBUG, "------------------------- TX : Packet Downlink Assignment -------------------------\n");
-	bts_do_rate_ctr_inc(bts, CTR_PKT_DL_ASSIGNMENT);
-
-	set_polling(new_poll_fn, ts, PDCH_ULC_POLL_DL_ASS);
-
-	talloc_free(mac_control_block);
-	return msg;
-
-free_ret:
-	talloc_free(mac_control_block);
-	msgb_free(msg);
-	return NULL;
-}
-
 int gprs_rlcmac_tbf::establish_dl_tbf_on_pacch()
 {
 	struct gprs_rlcmac_dl_tbf *new_tbf = NULL;
@@ -939,6 +835,7 @@
 
 	osmo_fsm_inst_update_id(tbf->state_fsm.fi, buf);
 	osmo_fsm_inst_update_id(tbf->ul_ass_fsm.fi, buf);
+	osmo_fsm_inst_update_id(tbf->dl_ass_fsm.fi, buf);
 }
 
 void gprs_rlcmac_tbf::rotate_in_list()
@@ -1007,6 +904,11 @@
 	return tbf->ul_ass_fsm.fi;
 }
 
+struct osmo_fsm_inst *tbf_dl_ass_fi(const struct gprs_rlcmac_tbf *tbf)
+{
+	return tbf->dl_ass_fsm.fi;
+}
+
 enum gprs_rlcmac_tbf_direction tbf_direction(const struct gprs_rlcmac_tbf *tbf)
 {
 	return tbf->direction;
@@ -1086,6 +988,11 @@
 	tbf->poll_timeout(pdch, poll_fn, reason);
 }
 
+bool tbf_is_control_ts(const struct gprs_rlcmac_tbf *tbf, uint8_t ts)
+{
+	return tbf->is_control_ts(ts);
+}
+
 const char* tbf_rlcmac_diag(const struct gprs_rlcmac_tbf *tbf)
 {
 	static char buf[256];
diff --git a/src/tbf.h b/src/tbf.h
index 45f3a4e..15b7de3 100644
--- a/src/tbf.h
+++ b/src/tbf.h
@@ -49,6 +49,7 @@
 #include <pdch_ul_controller.h>
 #include <tbf_fsm.h>
 #include <tbf_ul_ass_fsm.h>
+#include <tbf_dl_ass_fsm.h>
 #ifdef __cplusplus
 }
 #endif
@@ -57,14 +58,6 @@
  * TBF instance
  */
 
-enum gprs_rlcmac_tbf_dl_ass_state {
-	GPRS_RLCMAC_DL_ASS_NONE = 0,
-	GPRS_RLCMAC_DL_ASS_SEND_ASS, /* send downlink assignment on next RTS */
-	GPRS_RLCMAC_DL_ASS_WAIT_ACK, /* wait for PACKET CONTROL ACK */
-};
-
-extern const struct value_string gprs_rlcmac_tbf_dl_ass_state_names[];
-
 enum gprs_rlcmac_tbf_ul_ack_state {
 	GPRS_RLCMAC_UL_ACK_NONE = 0,
 	GPRS_RLCMAC_UL_ACK_SEND_ACK, /* send acknowledge on next RTS */
@@ -142,8 +135,6 @@
 #define GPRS_RLCMAC_FLAG_TO_MASK	0xf0 /* timeout bits */
 
 #define T_START(tbf, t, T, r, f) tbf->t_start(t, T, r, f, __FILE__, __LINE__)
-
-#define TBF_SET_ASS_STATE_DL(t, st) do { t->set_ass_state_dl(st, __FILE__, __LINE__); } while(0)
 #define TBF_SET_ACK_STATE(t, st) do { t->set_ack_state(st, __FILE__, __LINE__); } while(0)
 
 #ifdef __cplusplus
@@ -153,6 +144,7 @@
 const char *tbf_name(const struct gprs_rlcmac_tbf *tbf);
 enum tbf_fsm_states tbf_state(const struct gprs_rlcmac_tbf *tbf);
 struct osmo_fsm_inst *tbf_ul_ass_fi(const struct gprs_rlcmac_tbf *tbf);
+struct osmo_fsm_inst *tbf_dl_ass_fi(const struct gprs_rlcmac_tbf *tbf);
 enum gprs_rlcmac_tbf_direction tbf_direction(const struct gprs_rlcmac_tbf *tbf);
 void tbf_set_ms(struct gprs_rlcmac_tbf *tbf, struct GprsMs *ms);
 struct llist_head *tbf_ms_list(struct gprs_rlcmac_tbf *tbf);
@@ -173,6 +165,7 @@
 void tbf_poll_timeout(struct gprs_rlcmac_tbf *tbf, struct gprs_rlcmac_pdch *pdch, uint32_t poll_fn, enum pdch_ulc_tbf_poll_reason reason);
 void tbf_update_state_fsm_name(struct gprs_rlcmac_tbf *tbf);
 const char* tbf_rlcmac_diag(const struct gprs_rlcmac_tbf *tbf);
+bool tbf_is_control_ts(const struct gprs_rlcmac_tbf *tbf, uint8_t ts);
 #ifdef __cplusplus
 }
 #endif
@@ -188,10 +181,9 @@
 	int setup(int8_t use_trx, bool single_slot);
 	bool state_is(enum tbf_fsm_states rhs) const;
 	bool state_is_not(enum tbf_fsm_states rhs) const;
-	bool dl_ass_state_is(enum gprs_rlcmac_tbf_dl_ass_state rhs) const;
+	bool dl_ass_state_is(enum tbf_dl_ass_fsm_states rhs) const;
 	bool ul_ass_state_is(enum tbf_ul_ass_fsm_states rhs) const;
 	bool ul_ack_state_is(enum gprs_rlcmac_tbf_ul_ack_state rhs) const;
-	void set_ass_state_dl(enum gprs_rlcmac_tbf_dl_ass_state new_state, const char *file, int line);
 	void set_ack_state(enum gprs_rlcmac_tbf_ul_ack_state new_state, const char *file, int line);
 	void poll_sched_set(const char *file, int line);
 	void poll_sched_unset(const char *file, int line);
@@ -274,10 +266,6 @@
 		Meas();
 	} meas;
 
-	/* Remember if the tbf was in wait_release state when we want to
-	 * schedule a new dl assignment */
-	uint8_t was_releasing;
-
 	/* Can/should we upgrade this tbf to use multiple slots? */
 	uint8_t upgrade_to_multislot;
 
@@ -294,6 +282,7 @@
 	struct rate_ctr_group *m_ctrs;
 	struct tbf_fsm_ctx state_fsm;
 	struct tbf_ul_ass_fsm_ctx ul_ass_fsm;
+	struct tbf_ul_ass_fsm_ctx dl_ass_fsm;
 
 	struct llist_item m_ms_list;
 	struct llist_item m_trx_list;
@@ -307,7 +296,6 @@
 	struct GprsMs *m_ms;
 private:
 	void enable_egprs();
-	enum gprs_rlcmac_tbf_dl_ass_state dl_ass_state;
 	enum gprs_rlcmac_tbf_ul_ack_state ul_ack_state;
 	bool m_egprs_enabled;
 	struct osmo_timer_list Tarr[T_MAX];
@@ -320,9 +308,9 @@
 	return tbf_state(this) == rhs;
 }
 
-inline bool gprs_rlcmac_tbf::dl_ass_state_is(enum gprs_rlcmac_tbf_dl_ass_state rhs) const
+inline bool gprs_rlcmac_tbf::dl_ass_state_is(enum tbf_dl_ass_fsm_states rhs) const
 {
-	return dl_ass_state == rhs;
+	return tbf_dl_ass_fi(this)->state == rhs;
 }
 
 inline bool gprs_rlcmac_tbf::ul_ass_state_is(enum tbf_ul_ass_fsm_states rhs) const
@@ -346,15 +334,6 @@
 	return osmo_fsm_inst_state_name(state_fsm.fi);
 }
 
-inline void gprs_rlcmac_tbf::set_ass_state_dl(enum gprs_rlcmac_tbf_dl_ass_state new_state, const char *file, int line)
-{
-	LOGPSRC(DTBF, LOGL_DEBUG, file, line, "%s changes DL ASS state from %s to %s\n",
-		tbf_name(this),
-		get_value_string(gprs_rlcmac_tbf_dl_ass_state_names, dl_ass_state),
-		get_value_string(gprs_rlcmac_tbf_dl_ass_state_names, new_state));
-	dl_ass_state = new_state;
-}
-
 inline void gprs_rlcmac_tbf::set_ack_state(enum gprs_rlcmac_tbf_ul_ack_state new_state, const char *file, int line)
 {
 	LOGPSRC(DTBF, LOGL_DEBUG, file, line, "%s changes UL ACK state from %s to %s\n",
diff --git a/src/tbf_dl.cpp b/src/tbf_dl.cpp
index 9e06917..01cd173 100644
--- a/src/tbf_dl.cpp
+++ b/src/tbf_dl.cpp
@@ -607,8 +607,7 @@
 	/* check for downlink tbf:  */
 	if (old_tbf) {
 		LOGPTBFDL(this, LOGL_DEBUG, "Send dowlink assignment on PACCH, because %s exists\n", old_tbf->name());
-		TBF_SET_ASS_STATE_DL(old_tbf, GPRS_RLCMAC_DL_ASS_SEND_ASS);
-		old_tbf->was_releasing = old_tbf->state_is(TBF_ST_WAIT_RELEASE);
+		osmo_fsm_inst_dispatch(old_tbf->dl_ass_fsm.fi, TBF_DL_ASS_EV_SCHED_ASS, NULL);
 
 		/* change state */
 		osmo_fsm_inst_dispatch(this->state_fsm.fi, TBF_EV_ASSIGN_ADD_PACCH, NULL);
@@ -618,7 +617,6 @@
 	} else {
 		LOGPTBFDL(this, LOGL_DEBUG, "Send dowlink assignment on PCH, no TBF exist (IMSI=%s)\n",
 			  imsi());
-		was_releasing = state_is(TBF_ST_WAIT_RELEASE);
 
 		/* change state */
 		osmo_fsm_inst_dispatch(this->state_fsm.fi, TBF_EV_ASSIGN_ADD_CCCH, NULL);
diff --git a/src/tbf_dl_ass_fsm.c b/src/tbf_dl_ass_fsm.c
new file mode 100644
index 0000000..8085fbd
--- /dev/null
+++ b/src/tbf_dl_ass_fsm.c
@@ -0,0 +1,273 @@
+/* tbf_dl_ass_fsm.c
+ *
+ * Copyright (C) 2021 by sysmocom - s.f.m.c. GmbH <info@sysmocom.de>
+ * Author: Pau Espin Pedrol <pespin@sysmocom.de>
+ *
+ * This program is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU General Public License
+ * as published by the Free Software Foundation; either version 2
+ * of the License, or (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program; if not, write to the Free Software
+ * Foundation, Inc., 59 Temple Place - Suite 330, Boston, MA  02111-1307, USA.
+ */
+
+#include <unistd.h>
+
+#include <talloc.h>
+
+#include <osmocom/core/bitvec.h>
+
+#include <tbf_dl_ass_fsm.h>
+#include <gprs_rlcmac.h>
+#include <gprs_debug.h>
+#include <gprs_ms.h>
+#include <encoding.h>
+#include <bts.h>
+#include <tbf.h>
+#include <tbf_ul.h>
+
+#define X(s) (1 << (s))
+
+const struct osmo_tdef_state_timeout tbf_dl_ass_fsm_timeouts[32] = {
+	[TBF_DL_ASS_NONE] = {},
+	[TBF_DL_ASS_SEND_ASS] = {},
+	[TBF_DL_ASS_WAIT_ACK] = {},
+};
+
+const struct value_string tbf_dl_ass_fsm_event_names[] = {
+	{ TBF_DL_ASS_EV_SCHED_ASS, "SCHED_ASS" },
+	{ TBF_DL_ASS_EV_CREATE_RLCMAC_MSG, "CREATE_RLCMAC_MSG" },
+	{ TBF_DL_ASS_EV_RX_ASS_CTRL_ACK, "RX_ASS_CTRL_ACK" },
+	{ TBF_DL_ASS_EV_ASS_POLL_TIMEOUT, "ASS_POLL_TIMEOUT" },
+	{ 0, NULL }
+};
+
+struct msgb *create_packet_dl_assign(const struct tbf_dl_ass_fsm_ctx *ctx,
+				     const struct tbf_dl_ass_ev_create_rlcmac_msg_ctx *d)
+{
+	struct msgb *msg;
+	struct gprs_rlcmac_dl_tbf *new_dl_tbf = NULL;
+	RlcMacDownlink_t *mac_control_block = NULL;
+	struct GprsMs *ms = tbf_ms(ctx->tbf);
+	const int poll_ass_dl = 1;
+	unsigned int rrbp = 0;
+	uint32_t new_poll_fn = 0;
+	int rc;
+	bool old_tfi_is_valid = tbf_is_tfi_assigned(ctx->tbf);
+
+	/* We only use this function in control TS (PACCH) so that MS can always answer the poll */
+	OSMO_ASSERT(tbf_is_control_ts(ctx->tbf, d->ts));
+
+	if (tbf_ul_ass_fi(ctx->tbf)->state == TBF_UL_ASS_WAIT_ACK)
+	{
+		LOGPTBF(ctx->tbf, LOGL_DEBUG,
+			  "Polling is already scheduled, so we must wait for the uplink assignment...\n");
+		// FIXME: call tbf_dl_ass_fsm_state_chg(ctx->fi, TBF_DL_ASS_NONE); ?
+		return NULL;
+	}
+	rc = tbf_check_polling(ctx->tbf, d->fn, d->ts, &new_poll_fn, &rrbp);
+	if (rc < 0)
+		return NULL;
+
+	/* on uplink TBF we get the downlink TBF to be assigned. */
+	if (tbf_direction(ctx->tbf) == GPRS_RLCMAC_UL_TBF) {
+		struct gprs_rlcmac_ul_tbf *ul_tbf = as_ul_tbf(ctx->tbf);
+
+		/* be sure to check first, if contention resolution is done,
+		 * otherwise we cannot send the assignment yet (3GPP TS 44.060 sec 7.1.3.1) */
+		if (!ul_tbf_contention_resolution_done(ul_tbf)) {
+			LOGPTBF(ctx->tbf, LOGL_DEBUG,
+				"Cannot assign DL TBF now, because contention resolution is not finished.\n");
+			// FIXME: call tbf_dl_ass_fsm_state_chg(ctx->fi, TBF_DL_ASS_NONE); ?
+			return NULL;
+		}
+	}
+
+	new_dl_tbf = ms_dl_tbf(ms);
+	if (!new_dl_tbf) {
+		LOGPTBF(ctx->tbf, LOGL_ERROR,
+			  "We have a schedule for downlink assignment, but there is no downlink TBF\n");
+		tbf_dl_ass_fsm_state_chg(ctx->fi, TBF_DL_ASS_NONE);
+		return NULL;
+	}
+
+	if (new_dl_tbf == as_dl_tbf(ctx->tbf))
+		LOGPTBF(ctx->tbf, LOGL_DEBUG, "New and old TBF are the same.\n");
+
+	if (old_tfi_is_valid && ms_tlli(ms) == GSM_RESERVED_TMSI) {
+		LOGPTBF(ctx->tbf, LOGL_ERROR,
+			  "The old TFI is not assigned and there is no TLLI. New TBF %s\n",
+			  tbf_name((struct gprs_rlcmac_tbf *)new_dl_tbf));
+		tbf_dl_ass_fsm_state_chg(ctx->fi, TBF_DL_ASS_NONE);
+		return NULL;
+	}
+
+	msg = msgb_alloc(GSM_MACBLOCK_LEN, "rlcmac_dl_ass");
+	if (!msg)
+		return NULL;
+
+	/* Initialize a bit vector that uses allocated msgb as the data buffer. */
+	struct bitvec bv = {
+		.data = msgb_put(msg, GSM_MACBLOCK_LEN),
+		.data_len = GSM_MACBLOCK_LEN,
+	};
+	bitvec_unhex(&bv, DUMMY_VEC);
+
+	LOGPTBF((struct gprs_rlcmac_tbf *)new_dl_tbf, LOGL_INFO, "start Packet Downlink Assignment (PACCH)\n");
+	mac_control_block = (RlcMacDownlink_t *)talloc_zero(ctx->tbf, RlcMacDownlink_t);
+	write_packet_downlink_assignment(mac_control_block, old_tfi_is_valid,
+		tbf_tfi(ctx->tbf), (tbf_direction(ctx->tbf) == GPRS_RLCMAC_DL_TBF),
+		new_dl_tbf, poll_ass_dl, rrbp,
+		bts_get_ms_pwr_alpha(ms->bts), the_pcu->vty.gamma, -1, 0,
+		tbf_is_egprs_enabled(ctx->tbf), tbf_state(ctx->tbf) == TBF_ST_WAIT_RELEASE);
+	LOGP(DTBF, LOGL_DEBUG, "+++++++++++++++++++++++++ TX : Packet Downlink Assignment +++++++++++++++++++++++++\n");
+	rc = encode_gsm_rlcmac_downlink(&bv, mac_control_block);
+	if (rc < 0) {
+		LOGP(DTBF, LOGL_ERROR, "Encoding of Packet Downlink Ass failed (%d)\n", rc);
+		goto free_ret;
+	}
+	LOGP(DTBF, LOGL_DEBUG, "------------------------- TX : Packet Downlink Assignment -------------------------\n");
+	bts_do_rate_ctr_inc(ms->bts, CTR_PKT_DL_ASSIGNMENT);
+
+	tbf_set_polling(ctx->tbf, new_poll_fn, d->ts, PDCH_ULC_POLL_DL_ASS);
+
+	talloc_free(mac_control_block);
+	return msg;
+
+free_ret:
+	talloc_free(mac_control_block);
+	msgb_free(msg);
+	return NULL;
+}
+
+static void st_none_on_enter(struct osmo_fsm_inst *fi, uint32_t prev_state)
+{
+}
+
+static void st_none(struct osmo_fsm_inst *fi, uint32_t event, void *data)
+{
+	switch (event) {
+	case TBF_DL_ASS_EV_SCHED_ASS:
+		tbf_dl_ass_fsm_state_chg(fi, TBF_DL_ASS_SEND_ASS);
+		break;
+	default:
+		OSMO_ASSERT(0);
+	}
+}
+
+static void st_send_ass(struct osmo_fsm_inst *fi, uint32_t event, void *data)
+{
+	struct tbf_dl_ass_fsm_ctx *ctx = (struct tbf_dl_ass_fsm_ctx *)fi->priv;
+	struct tbf_dl_ass_ev_create_rlcmac_msg_ctx *data_ctx;
+
+	switch (event) {
+	case TBF_DL_ASS_EV_CREATE_RLCMAC_MSG:
+		data_ctx = (struct tbf_dl_ass_ev_create_rlcmac_msg_ctx *)data;
+		data_ctx->msg = create_packet_dl_assign(ctx, data_ctx);
+		if (!data_ctx->msg)
+			return;
+		tbf_dl_ass_fsm_state_chg(fi, TBF_DL_ASS_WAIT_ACK);
+		break;
+	default:
+		OSMO_ASSERT(0);
+	}
+}
+
+static void st_wait_ack(struct osmo_fsm_inst *fi, uint32_t event, void *data)
+{
+	switch (event) {
+	case TBF_DL_ASS_EV_RX_ASS_CTRL_ACK:
+		tbf_dl_ass_fsm_state_chg(fi, TBF_DL_ASS_NONE);
+		break;
+	case TBF_DL_ASS_EV_ASS_POLL_TIMEOUT:
+		/* Reschedule Pkt Dl Ass */
+		tbf_dl_ass_fsm_state_chg(fi, TBF_DL_ASS_SEND_ASS);
+		break;
+	default:
+		OSMO_ASSERT(0);
+	}
+}
+
+static int tbf_dl_ass_fsm_timer_cb(struct osmo_fsm_inst *fi)
+{
+	struct tbf_dl_ass_fsm_ctx *ctx = (struct tbf_dl_ass_fsm_ctx *)fi->priv;
+	switch (fi->T) {
+	case -2000:
+		tbf_free(ctx->tbf);
+		break;
+	default:
+		OSMO_ASSERT(0);
+	}
+	return 0;
+}
+
+static struct osmo_fsm_state tbf_dl_ass_fsm_states[] = {
+	[TBF_DL_ASS_NONE] = {
+		.in_event_mask =
+			X(TBF_DL_ASS_EV_SCHED_ASS),
+		.out_state_mask =
+			X(TBF_DL_ASS_SEND_ASS),
+		.name = "NONE",
+		.action = st_none,
+		.onenter = st_none_on_enter,
+	},
+	[TBF_DL_ASS_SEND_ASS] = {
+		.in_event_mask = X(TBF_DL_ASS_EV_CREATE_RLCMAC_MSG),
+		.out_state_mask = X(TBF_DL_ASS_WAIT_ACK),
+		.name = "SEND_ASS",
+		.action = st_send_ass,
+	},
+	[TBF_DL_ASS_WAIT_ACK] = {
+		.in_event_mask =
+			X(TBF_DL_ASS_EV_RX_ASS_CTRL_ACK) |
+			X(TBF_DL_ASS_EV_ASS_POLL_TIMEOUT),
+		.out_state_mask =
+			X(TBF_DL_ASS_NONE) |
+			X(TBF_DL_ASS_SEND_ASS),
+		.name = "WAIT_ACK",
+		.action = st_wait_ack,
+	},
+};
+
+struct osmo_fsm tbf_dl_ass_fsm = {
+	.name = "DL_ASS_TBF",
+	.states = tbf_dl_ass_fsm_states,
+	.num_states = ARRAY_SIZE(tbf_dl_ass_fsm_states),
+	.timer_cb = tbf_dl_ass_fsm_timer_cb,
+	.log_subsys = DTBF,
+	.event_names = tbf_dl_ass_fsm_event_names,
+};
+
+static __attribute__((constructor)) void tbf_dl_ass_fsm_init(void)
+{
+	OSMO_ASSERT(osmo_fsm_register(&tbf_dl_ass_fsm) == 0);
+}
+
+
+struct msgb *tbf_dl_ass_create_rlcmac_msg(const struct gprs_rlcmac_tbf* tbf, uint32_t fn, uint8_t ts)
+{
+	int rc;
+	struct tbf_dl_ass_ev_create_rlcmac_msg_ctx data_ctx = {
+		.fn = fn,
+		.ts = ts,
+		.msg = NULL,
+	};
+
+	rc = osmo_fsm_inst_dispatch(tbf_dl_ass_fi(tbf), TBF_DL_ASS_EV_CREATE_RLCMAC_MSG, &data_ctx);
+	if (rc != 0 || !data_ctx.msg)
+		return NULL;
+	return data_ctx.msg;
+}
+
+bool tbf_dl_ass_rts(const struct gprs_rlcmac_tbf* tbf)
+{
+	struct osmo_fsm_inst *fi = tbf_dl_ass_fi(tbf);
+	return fi->state == TBF_DL_ASS_SEND_ASS;
+}
diff --git a/src/tbf_dl_ass_fsm.h b/src/tbf_dl_ass_fsm.h
new file mode 100644
index 0000000..94c9062
--- /dev/null
+++ b/src/tbf_dl_ass_fsm.h
@@ -0,0 +1,69 @@
+/* tbf_dl_ass_fsm.h
+ *
+ * Copyright (C) 2021 by sysmocom - s.f.m.c. GmbH <info@sysmocom.de>
+ * Author: Pau Espin Pedrol <pespin@sysmocom.de>
+ *
+ * This program is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU General Public License
+ * as published by the Free Software Foundation; either version 2
+ * of the License, or (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program; if not, write to the Free Software
+ * Foundation, Inc., 59 Temple Place - Suite 330, Boston, MA  02111-1307, USA.
+ */
+#pragma once
+
+#include <osmocom/core/fsm.h>
+#include <osmocom/core/tdef.h>
+
+#include <gprs_pcu.h>
+
+struct gprs_rlcmac_tbf;
+
+enum tbf_dl_ass_fsm_event {
+	TBF_DL_ASS_EV_SCHED_ASS, /* Tx Uplink Assignment is pending */
+	TBF_DL_ASS_EV_CREATE_RLCMAC_MSG, /* Scheduler wants to gen+Tx the Ass (rej): data=tbf_dl_ass_ev_create_rlcmac_msg_ctx */
+	TBF_DL_ASS_EV_RX_ASS_CTRL_ACK, /* Received CTRL ACK answering poll set on Pkt Dl Ass */
+	TBF_DL_ASS_EV_ASS_POLL_TIMEOUT, /* Pdch Ul Controller signals timeout for poll set on Pkt Dl Ass */
+};
+
+enum tbf_dl_ass_fsm_states {
+	TBF_DL_ASS_NONE = 0,
+	TBF_DL_ASS_SEND_ASS, /* send downlink assignment on next RTS */
+	TBF_DL_ASS_WAIT_ACK, /* wait for PACKET CONTROL ACK */
+};
+
+struct tbf_dl_ass_fsm_ctx {
+	struct osmo_fsm_inst *fi;
+	struct gprs_rlcmac_tbf* tbf; /* back pointer */
+};
+
+extern const struct osmo_tdef_state_timeout tbf_dl_ass_fsm_timeouts[32];
+/* Transition to a state, using the T timer defined in tbf_dl_ass_fsm_timeouts.
+ * The actual timeout value is in turn obtained from conn->T_defs.
+ * Assumes local variable fi exists. */
+#define tbf_dl_ass_fsm_state_chg(fi, NEXT_STATE) \
+	osmo_tdef_fsm_inst_state_chg(fi, NEXT_STATE, \
+				     tbf_dl_ass_fsm_timeouts, \
+				     the_pcu->T_defs, \
+				     -1)
+
+extern struct osmo_fsm tbf_dl_ass_fsm;
+
+
+/* passed as data in TBF_DL_ASS_EV_CREATE_RLCMAC_MSG */
+struct tbf_dl_ass_ev_create_rlcmac_msg_ctx {
+	uint32_t fn; /* FN where the created DL ctrl block is to be sent */
+	uint8_t ts; /* TS where the created DL ctrl block is to be sent */
+	struct msgb *msg; /* to be filled by FSM during event processing */
+};
+
+
+struct msgb *tbf_dl_ass_create_rlcmac_msg(const struct gprs_rlcmac_tbf* tbf, uint32_t fn, uint8_t ts);
+bool tbf_dl_ass_rts(const struct gprs_rlcmac_tbf* tbf);
diff --git a/src/tbf_ul.cpp b/src/tbf_ul.cpp
index eb2c720..31bb273 100644
--- a/src/tbf_ul.cpp
+++ b/src/tbf_ul.cpp
@@ -839,3 +839,9 @@
 {
 	tbf->usf_timeout();
 }
+
+
+bool ul_tbf_contention_resolution_done(const struct gprs_rlcmac_ul_tbf *tbf)
+{
+	return tbf->m_contention_resolution_done;
+}
diff --git a/src/tbf_ul.h b/src/tbf_ul.h
index d5cfbd5..826062f 100644
--- a/src/tbf_ul.h
+++ b/src/tbf_ul.h
@@ -137,6 +137,7 @@
 void set_tbf_ta(struct gprs_rlcmac_ul_tbf *tbf, uint8_t ta);
 struct gprs_rlcmac_ul_tbf *as_ul_tbf(struct gprs_rlcmac_tbf *tbf);
 void tbf_usf_timeout(struct gprs_rlcmac_ul_tbf *tbf);
+bool ul_tbf_contention_resolution_done(const struct gprs_rlcmac_ul_tbf *tbf);
 
 #define LOGPTBFUL(tbf, level, fmt, args...) LOGP(DTBFUL, level, "%s " fmt, tbf_name(tbf), ## args)
 #ifdef __cplusplus