diff --git a/simtrace/SIMTRACE_Types.ttcn b/simtrace/SIMTRACE_Types.ttcn
new file mode 100644
index 0000000..7b1c857
--- /dev/null
+++ b/simtrace/SIMTRACE_Types.ttcn
@@ -0,0 +1,356 @@
+module SIMTRACE_Types {
+
+/* TTCN-3 data types with TITAN RAW codec annotations for Osmocom SIMTRACE2
+ * as found in simtrace2.git/host/include/osmocom/simtrace2/simtrace_prot.h
+ *
+ * (C) 2020 by Harald Welte <laforge@gnumonks.org>
+ */
+
+import from General_Types all;
+import from Osmocom_Types all;
+
+type integer u16le_t (0..65535) with { variant "unsigned 16 bit" variant "BYTEORDER(first)" };
+type integer u32le_t (0..4294967295) with { variant "unsigned 32 bit" variant "BYTEORDER(first)" };
+type charstring CHAR32 length (0..32) with { variant "FIELDLENGTH(32)" };
+
+type enumerated SIMTRACE_MsgClassType {
+	/* SIMTRACE_MSGC_GENERIC */
+	SIMTRACE_CMD_DO_ERROR			('0000'H),
+	SIMTRACE_CMD_BD_BOARD_INFO		('0001'H),
+
+	/* SIMTRACE_MSGC_CARDEM */
+	SIMTRACE_MSGT_DT_CEMU_TX_DATA		('0101'H),
+	SIMTRACE_MSGT_DT_CEMU_SET_ATR		('0102'H),
+	SIMTRACE_MSGT_BD_CEMU_STATS		('0103'H),
+	SIMTRACE_MSGT_BD_CEMU_STATUS		('0104'H),
+	SIMTRACE_MSGT_DT_CEMU_CARDINSERT	('0105'H),
+	SIMTRACE_MSGT_DO_CEMU_RX_DATA		('0106'H),
+	SIMTRACE_MSGT_DO_CEMU_PTS		('0107'H),
+	SIMTRACE_MSGT_BD_CEMU_CONFIG		('0108'H),
+
+	/* SIMTRACE_MSGC_MODEM */
+	SIMTRACE_MSGT_DT_MODEM_RESET		('0201'H),
+	SIMTRACE_MSGT_DT_MODEM_SIM_SELECT	('0202'H),
+	SIMTRACE_MSGT_BD_MODEM_STATUS		('0203'H),
+
+	/* SIMTRACE_MSGC_SNIFF */
+	SIMTRACE_MSGT_SNIFF_CHANGE		('0300'H),
+	SIMTRACE_MSGT_SNIFF_FIDI		('0301'H),
+	SIMTRACE_MSGT_SNIFF_ATR			('0302'H),
+	SIMTRACE_MSGT_SNIFF_PPS			('0303'H),
+	SIMTRACE_MSGT_SNIFF_TPDU		('0304'H)
+} with { variant "FIELDLENGTH(16)" variant "BYTEORDER(last)" };
+
+type record SIMTRACE_PDU {
+	SIMTRACE_MsgClassType msg_type,
+	uint8_t		seq_nr,
+	uint8_t		slot_nr,
+	OCT2		reserved,
+	u16le_t		msg_len,
+	SIMTRACE_Payload payload
+  /* payload */
+} with {
+	variant (msg_len) "LENGTHTO(msg_type,seq_nr,slot_nr,reserved,msg_len,payload)"
+	variant (payload) "CROSSTAG(
+		gen_do_error,		msg_type = SIMTRACE_CMD_DO_ERROR;
+		gen_bd_board_info,	msg_type = SIMTRACE_CMD_BD_BOARD_INFO;
+
+		cardem_dt_txdata,	msg_type = SIMTRACE_MSGT_DT_CEMU_TX_DATA;
+		cardem_dt_setatr,	msg_type = SIMTRACE_MSGT_DT_CEMU_SET_ATR;
+		/* FIXME: stats */
+		cardem_bd_status,	msg_type = SIMTRACE_MSGT_BD_CEMU_STATUS;
+		cardem_dt_cardinsert,	msg_type = SIMTRACE_MSGT_DT_CEMU_CARDINSERT;
+		cardem_do_rxdata,	msg_type = SIMTRACE_MSGT_DO_CEMU_RX_DATA;
+		cardem_do_pts,		msg_type = SIMTRACE_MSGT_DO_CEMU_PTS;
+		cardem_bd_config,	msg_type = SIMTRACE_MSGT_BD_CEMU_CONFIG;
+
+		modem_dt_reset,		msg_type = SIMTRACE_MSGT_DT_MODEM_RESET;
+		modem_dt_sim_select,	msg_type = SIMTRACE_MSGT_DT_MODEM_SIM_SELECT;
+		modem_bd_status,	msg_type = SIMTRACE_MSGT_BD_MODEM_STATUS;
+
+		sniff_do_change,	msg_type = SIMTRACE_MSGT_SNIFF_CHANGE;
+		sniff_do_fidi,		msg_type = SIMTRACE_MSGT_SNIFF_FIDI;
+		sniff_do_atr,		msg_type = SIMTRACE_MSGT_SNIFF_ATR;
+		sniff_do_pps,		msg_type = SIMTRACE_MSGT_SNIFF_PPS;
+		sniff_do_tpdu,		msg_type = SIMTRACE_MSGT_SNIFF_TPDU;
+		other,			OTHERWISE;
+			)"
+};
+
+external function enc_SIMTRACE_PDU(in SIMTRACE_PDU pdu) return octetstring
+with { extension "prototype(convert)" extension "encode(RAW)" };
+
+external function dec_SIMTRACE_PDU(in octetstring stream) return SIMTRACE_PDU
+with { extension "prototype(convert)" extension "decode(RAW)" };
+
+type union SIMTRACE_Payload {
+	Generic_DO_Error	gen_do_error,
+	Generic_BD_BoardInfo	gen_bd_board_info,
+
+	CardEmu_DT_TxData	cardem_dt_txdata,
+	CardEmu_DT_SetAtr	cardem_dt_setatr,
+	CardEmu_BD_Status	cardem_bd_status,
+	Cardemu_DT_CardInsert	cardem_dt_cardinsert,
+	CardEmu_DO_RxData	cardem_do_rxdata,
+	CardEmu_DO_Pts		cardem_do_pts,
+	CardEmu_BD_Config	cardem_bd_config,
+
+	Modem_DT_Reset		modem_dt_reset,
+	Modem_DT_SimSelect	modem_dt_sim_select,
+	Modem_BD_Status		modem_bd_status,
+
+	Sniff_DO_Change		sniff_do_change,
+	Sniff_DO_FiDi		sniff_do_fidi,
+	Sniff_DO_Data		sniff_do_atr,
+	Sniff_DO_Data		sniff_do_pps,
+	Sniff_DO_Data		sniff_do_tpdu,
+
+	octetstring		other
+};
+
+/***********************************************************************
+ * GENERIC
+ ***********************************************************************/
+
+/* SIMTRACE_CMD_DO_ERROR */
+type record Generic_DO_Error {
+	uint8_t		severity,
+	uint8_t		subsystem,
+	u16le_t		code,
+	uint8_t		msg_len,
+	charstring	msg
+} with {
+	variant (msg_len) "LENGTHTO(msg)"
+};
+
+type record Generic_Capability_Vendor {
+	/* Can erase a peer SAM3 controller */
+	boolean		sysmo_qmod_erase_peer,
+	/* Can read/write an attached EEPROM */
+	boolean		sysmo_qmod_rw_eeprom,
+	/* can reset an attached USB hub */
+	boolean		sysmo_qmod_reset_hub
+};
+
+type record Generic_Capability {
+	/* compatible with 5V SIM card interface */
+	boolean		cap_volt_5v,
+	/* compatible with 3V SIM card interface */
+	boolean		cap_volt_3v,
+	/* compatible with 1.8V SIM card interface */
+	boolean		cap_volt_1v8,
+	boolean		cap_led_1,
+	boolean		cap_led_2,
+	/* Has Single-Pole Dual-Throw (local/remote SIM) */
+	boolean		cap_spdt,
+	/* Has Bus-Switch (trace / MITM) */
+	boolean		cap_bus_switch,
+	/* Can read VSIM via ADC */
+	boolean		cap_vsim_adc,
+	/* Can read temperature via ADC */
+	boolean		cap_temp_adc,
+	/* Supports DFU for firmware update */
+	boolean		cap_dfu,
+	/* Supports Ctrl EP command for erasing flash / return to SAM-BA */
+	boolean		cap_erase_flash,
+	/* Can read the status of card insert contact */
+	boolean		cap_read_card_det,
+	/* Can control the status of a simulated card insert */
+	boolean		cap_assert_card_det,
+	/* Can toggle the hardware reset of an attached modem */
+	boolean		cap_assert_modem_rst
+};
+
+type record Board_Info_Hardware {
+	CHAR32		manufacturer,
+	CHAR32		model,
+	CHAR32		version
+};
+
+type record Board_Info_Software {
+	CHAR32		provider,
+	CHAR32		name,
+	CHAR32		version,
+	CHAR32		buildhost,
+	OCT4		crc
+};
+
+type record Generic_BD_BoardInfo {
+	Board_Info_Hardware	hardware,
+	Board_Info_Software	software,
+	u32le_t			max_baud_rate,
+	uint8_t			cap_generic_bytes,
+	uint8_t			cap_vendor_bytes,
+	Generic_Capability	cap_generic optional,
+	Generic_Capability_Vendor cap_vendor optional
+} with {
+	variant (cap_generic_bytes) "LENGTHTO(cap_generic)"
+	variant (cap_vendor_bytes) "LENGTHTO(cap_vendor)"
+};
+
+
+/***********************************************************************
+ * CARD EMULATOR / FORWARDER
+ ***********************************************************************/
+
+/* CEMU_USB_MSGT_DT_CARDINSERT */
+type record Cardemu_DT_CardInsert {
+	uint8_t		card_insert
+};
+
+/* CEMU_USB_MSGT_DT_SET_ATR */
+type record CardEmu_DT_SetAtr {
+	uint8_t		atr_len,
+	octetstring	atr
+} with {
+	variant (atr_len) "LENGTHTO(atr)"
+};
+
+type record CardEmu_DataFlags {
+	/* First octet here is last octet of little-endian encoded uint32_t */
+	BIT4		reserved,
+	/* indicates a PB is present and we should continue with RX */
+	boolean 	pb_and_rx,
+	/* indicates a PB is present and we should continue with TX */
+	boolean 	pb_and_tx,
+	/* indicates last part of transmission in this direction */
+	boolean 	final,
+	/* indicates a TPDU header is present in this message */
+	boolean		tpdu_hdr,
+	BIT24		reserved2
+} with { variant "BITORDER(msb)" };
+
+/* CEMU_USB_MSGT_DT_TX_DATA */
+type record CardEmu_DT_TxData {
+	CardEmu_DataFlags flags,
+	u16le_t		data_len,
+	octetstring	data
+} with {
+	variant (data_len) "LENGTHTO(data)"
+};
+
+/* CEMU_USB_MSGT_DO_RX_DATA */
+type record CardEmu_DO_RxData {
+	CardEmu_DataFlags flags,
+	u16le_t		data_len,
+	octetstring	data
+} with {
+	variant (data_len) "LENGTHTO(data)"
+};
+
+type record CardEmu_StatusFlags {
+	/* First octet here is last octet of little-endian encoded uint32_t */
+	BIT3		reserved,
+	boolean		reset_active,
+	boolean		card_insert,
+	boolean		rcemu_active,
+	boolean		clk_active,
+	boolean		vcc_present,
+	BIT24		reserved2
+};
+
+/* CEMU_USB_MSGT_BD_STATUS */
+type record CardEmu_BD_Status {
+	CardEmu_StatusFlags flags,
+	u16le_t		voltage_mv,
+	uint8_t		fi,
+	uint8_t		di,
+	uint8_t		wi,
+	u32le_t		waiting_time
+};
+
+/* CEMU_USB_MSGT_DO_PTS */
+type record CardEmu_DO_Pts {
+	uint8_t		pts_len,
+	OCT6		req,
+	OCT6		resp
+};
+
+type record CardEmu_FeatureFlags {
+	BIT7		reserved,
+	boolean		status_irq,
+	BIT24		reserved2
+};
+
+type record CardEmu_BD_Config {
+	CardEmu_FeatureFlags	features
+};
+
+/***********************************************************************
+ * MODEM CONTROL
+ ***********************************************************************/
+
+type enumerated ModemResetType {
+	MODEM_RESET_RELEASE	(0),
+	MODEM_RESET_ASSERT	(1),
+	MODEM_RESET_PULSE	(2)
+} with { variant "FIELDLENGTH(8)" };
+
+/* SIMTRACE_MSGT_DT_MODEM_RESET */
+type record Modem_DT_Reset {
+	ModemResetType		asserted,
+	u16le_t			pulse_duration_msec
+};
+
+type enumerated SimSelect {
+	SIM_SELECT_LOCAL	(0),
+	SIM_SELECT_REMOTE	(1)
+} with { variant "FIELDLENGTH(8)" };
+
+/* SIMTRACE_MSGT_DT_MODEM_SIM_SELECT */
+type record Modem_DT_SimSelect {
+	SimSelect	sim_select
+};
+
+type record Modem_Status {
+	BIT6		reserved,
+	boolean		card_inserted,
+	boolean		wwan_led
+};
+
+/* SIMTRACE_MSGT_BD_MODEM_STATUS */
+type record Modem_BD_Status {
+	Modem_Status	supported,
+	Modem_Status	status,
+	Modem_Status	changed
+};
+
+/***********************************************************************
+ * SNIFF
+ ***********************************************************************/
+
+type record Sniff_Flags {
+	/* First octet here is last octet of little-endian encoded uint32_t */
+	boolean		error_checksum,
+	boolean		error_malformed,
+	boolean		error_incomplete,
+	boolean		timeout_wt,
+	boolean		reset_deassert,
+	boolean		reset_assert,
+	boolean		card_eject,
+	boolean		card_insert,
+	BIT24		reserved
+};
+
+/* SIMTRACE_MSGT_SNIFF_CHANGE */
+type record Sniff_DO_Change {
+	Sniff_Flags	flags
+};
+
+/* SIMTRACE_MSGT_SNIFF_FIDI */
+type record Sniff_DO_FiDi {
+	uint8_t		fidi
+};
+
+/* SIMTRACE_MSGT_SNIFF_ATR, PPS, TPDU */
+type record Sniff_DO_Data {
+	Sniff_Flags	flags,
+	u16le_t		data_len,
+	octetstring	data
+} with {
+	variant (data_len) "LENGTHTO(data)"
+};
+
+
+
+} with { encode "RAW"; variant "FIELDORDER(msb)" };