diff --git a/msc_tests/MSC_Tests.ttcn b/msc_tests/MSC_Tests.ttcn
index c2d1771..0fad797 100644
--- a/msc_tests/MSC_Tests.ttcn
+++ b/msc_tests/MSC_Tests.ttcn
@@ -702,6 +702,228 @@
 }
 
 
+/* Test IMSI DETACH (MI=IMSI) */
+private function f_tc_imsi_detach_by_imsi(charstring id, BSC_ConnHdlrPars pars) runs on BSC_ConnHdlr {
+	g_pars := pars;
+
+	var MobileIdentityLV mi := valueof(ts_MI_IMSI_LV(g_pars.imsi));
+
+	/* Send BSSAP_Conn_Req with COMPL L3 INFO to MSC */
+	f_bssap_compl_l3(valueof(ts_ML3_MO_MM_IMSI_DET_Ind(mi)));
+
+	/* Send Early Classmark, just for the fun of it? */
+	BSSAP.send(ts_BSSMAP_ClassmarkUpd(g_pars.cm2, g_pars.cm3));
+
+	/* wait for normal teardown */
+	BSSAP.receive(tr_BSSMAP_ClearCommand);
+	BSSAP.send(ts_BSSMAP_ClearComplete);
+	BSSAP.receive(BSSAP_Conn_Prim:MSC_CONN_PRIM_DISC_IND);
+	setverdict(pass);
+}
+testcase TC_imsi_detach_by_imsi() runs on MTC_CT {
+	var BSC_ConnHdlr vc_conn;
+	f_init();
+
+	vc_conn := f_start_handler(refers(f_tc_imsi_detach_by_imsi), testcasename(), 2);
+	vc_conn.done;
+}
+
+/* Test IMSI DETACH (MI=TMSI) */
+private function f_tc_imsi_detach_by_tmsi(charstring id, BSC_ConnHdlrPars pars) runs on BSC_ConnHdlr {
+	g_pars := pars;
+
+	var MobileIdentityLV mi := valueof(ts_MI_TMSI_LV('01020304'O));
+
+	/* Send BSSAP_Conn_Req with COMPL L3 INFO to MSC */
+	f_bssap_compl_l3(valueof(ts_ML3_MO_MM_IMSI_DET_Ind(mi)));
+
+	/* Send Early Classmark, just for the fun of it? */
+	BSSAP.send(ts_BSSMAP_ClassmarkUpd(g_pars.cm2, g_pars.cm3));
+
+	/* wait for normal teardown */
+	BSSAP.receive(tr_BSSMAP_ClearCommand);
+	BSSAP.send(ts_BSSMAP_ClearComplete);
+	BSSAP.receive(BSSAP_Conn_Prim:MSC_CONN_PRIM_DISC_IND);
+	setverdict(pass);
+}
+testcase TC_imsi_detach_by_tmsi() runs on MTC_CT {
+	var BSC_ConnHdlr vc_conn;
+	f_init();
+
+	vc_conn := f_start_handler(refers(f_tc_imsi_detach_by_tmsi), testcasename(), 3);
+	vc_conn.done;
+}
+
+/* Test IMSI DETACH (MI=IMEI), which is illegal */
+private function f_tc_imsi_detach_by_imei(charstring id, BSC_ConnHdlrPars pars) runs on BSC_ConnHdlr {
+	g_pars := pars;
+
+	var MobileIdentityLV mi := valueof(ts_MI_IMEI_LV(g_pars.imsi));
+
+	/* Send BSSAP_Conn_Req with COMPL L3 INFO to MSC */
+	f_bssap_compl_l3(valueof(ts_ML3_MO_MM_IMSI_DET_Ind(mi)));
+
+	/* Send Early Classmark, just for the fun of it? */
+	BSSAP.send(ts_BSSMAP_ClassmarkUpd(g_pars.cm2, g_pars.cm3));
+
+	/* wait for normal teardown */
+	BSSAP.receive(tr_BSSMAP_ClearCommand);
+	BSSAP.send(ts_BSSMAP_ClearComplete);
+	BSSAP.receive(BSSAP_Conn_Prim:MSC_CONN_PRIM_DISC_IND);
+	setverdict(pass);
+}
+testcase TC_imsi_detach_by_imei() runs on MTC_CT {
+	var BSC_ConnHdlr vc_conn;
+	f_init();
+
+	vc_conn := f_start_handler(refers(f_tc_imsi_detach_by_imei), testcasename(), 4);
+	vc_conn.done;
+}
+
+
+/* helper function for an emergency call. caller passes in mobile identity to use */
+private function f_emerg_call(MobileIdentityLV mi) runs on BSC_ConnHdlr {
+
+	var PDU_ML3_MS_NW l3_info := valueof(ts_CM_SERV_REQ('0010'B, mi));
+	f_bssap_compl_l3(l3_info);
+	BSSAP.receive(tr_PDU_DTAP_MT(tr_CM_SERV_ACC));
+
+	var hexstring called := '112'H;
+	var integer tid := 0;
+	var MNCC_PDU mncc;
+	f_create_mncc_expect(hex2str(called));
+
+	BSSAP.send(ts_PDU_DTAP_MO(ts_ML3_MO_CC_EMERG_SETUP(tid)));
+	MNCC.receive(tr_MNCC_SETUP_ind(?, tr_MNCC_number(hex2str(called)))) -> value mncc;
+	/* FIXME: extract call_id */
+
+	/* Call Proceeding */
+	MNCC.send(ts_MNCC_CALL_PROC_req(mncc.u.signal.callref, ts_MNCC_bcap_voice));
+	BSSAP.receive(tr_PDU_DTAP_MT(tr_ML3_MT_CC_CALL_PROC(tid)));
+
+	/* Alerting */
+	MNCC.send(ts_MNCC_ALERT_req(mncc.u.signal.callref));
+	BSSAP.receive(tr_PDU_DTAP_MT(tr_ML3_MT_CC_ALERTING(tid)));
+
+	/* Answer. This causes TCH assignment in case of "late assignment" */
+	MNCC.send(ts_MNCC_SETUP_COMPL_req(mncc.u.signal.callref));
+
+	f_sleep(3.0);
+
+	/* Hangup by "B" side */
+	MNCC.send(ts_MNCC_DISC_req(mncc.u.signal.callref, valueof(ts_MNCC_cause(23))));
+	BSSAP.receive(tr_PDU_DTAP_MT(tr_ML3_MT_CC_DISC(tid)));
+
+	/* Release of call */
+	MNCC.send(ts_MNCC_REL_req(mncc.u.signal.callref, valueof(ts_MNCC_cause(42))));
+	BSSAP.receive(tr_PDU_DTAP_MT(tr_ML3_MT_CC_RELEASE(tid)));
+
+	/* clearing of radio channel */
+	BSSAP.receive(tr_BSSMAP_ClearCommand);
+	BSSAP.send(ts_BSSMAP_ClearComplete);
+	BSSAP.receive(BSSAP_Conn_Prim:MSC_CONN_PRIM_DISC_IND);
+
+	f_sleep(5.0);
+}
+
+/* establish an emergency call by IMEI, no SIM inserted (and hence no IMSI) */
+private function f_tc_emerg_call_imei_reject(charstring id, BSC_ConnHdlrPars pars) runs on BSC_ConnHdlr {
+	g_pars := pars;
+
+	var MobileIdentityLV mi := valueof(ts_MI_IMEI_LV(g_pars.imsi));
+	var PDU_ML3_MS_NW l3_info := valueof(ts_CM_SERV_REQ('0010'B, mi));
+	f_bssap_compl_l3(l3_info);
+	BSSAP.receive(tr_PDU_DTAP_MT(tr_CM_SERV_REJ('05'O)));
+	setverdict(pass);
+}
+testcase TC_emerg_call_imei_reject() runs on MTC_CT {
+	var BSC_ConnHdlr vc_conn;
+	f_init();
+
+	vc_conn := f_start_handler(refers(f_tc_emerg_call_imei_reject), testcasename(), 5);
+	vc_conn.done;
+}
+
+/* establish an emergency call by IMEI, no SIM inserted (and hence no IMSI) */
+private function f_tc_emerg_call_imsi(charstring id, BSC_ConnHdlrPars pars) runs on BSC_ConnHdlr {
+	g_pars := pars;
+	/* First perform location update to ensure subscriber is known */
+	f_perform_lu(false, true, true);
+	/* Then issue emergency call identified by IMSI */
+	f_emerg_call(valueof(ts_MI_IMSI_LV(g_pars.imsi)));
+}
+testcase TC_emerg_call_imsi() runs on MTC_CT {
+	var BSC_ConnHdlr vc_conn;
+	f_init();
+
+	vc_conn := f_start_handler(refers(f_tc_emerg_call_imsi), testcasename(), 6);
+	vc_conn.done;
+}
+
+/* CM Service Request for VGCS -> reject */
+private function f_tc_cm_serv_req_vgcs_reject(charstring id, BSC_ConnHdlrPars pars) runs on BSC_ConnHdlr {
+	g_pars := pars;
+
+	/* First perform location update to ensure subscriber is known */
+	f_perform_lu(false, true, true);
+
+	var MobileIdentityLV mi := valueof(ts_MI_IMSI_LV(g_pars.imsi));
+	var PDU_ML3_MS_NW l3_info := valueof(ts_CM_SERV_REQ('1001'B, mi));
+	f_bssap_compl_l3(l3_info);
+	BSSAP.receive(tr_PDU_DTAP_MT(tr_CM_SERV_REJ(int2oct(32,1))));
+	setverdict(pass);
+}
+testcase TC_cm_serv_req_vgcs_reject() runs on MTC_CT {
+	var BSC_ConnHdlr vc_conn;
+	f_init();
+
+	vc_conn := f_start_handler(refers(f_tc_cm_serv_req_vgcs_reject), testcasename(), 7);
+	vc_conn.done;
+}
+
+/* CM Service Request for VBS -> reject */
+private function f_tc_cm_serv_req_vbs_reject(charstring id, BSC_ConnHdlrPars pars) runs on BSC_ConnHdlr {
+	g_pars := pars;
+
+	/* First perform location update to ensure subscriber is known */
+	f_perform_lu(false, true, true);
+
+	var MobileIdentityLV mi := valueof(ts_MI_IMSI_LV(g_pars.imsi));
+	var PDU_ML3_MS_NW l3_info := valueof(ts_CM_SERV_REQ('1010'B, mi));
+	f_bssap_compl_l3(l3_info);
+	BSSAP.receive(tr_PDU_DTAP_MT(tr_CM_SERV_REJ(int2oct(32,1))));
+	setverdict(pass);
+}
+testcase TC_cm_serv_req_vbs_reject() runs on MTC_CT {
+	var BSC_ConnHdlr vc_conn;
+	f_init();
+
+	vc_conn := f_start_handler(refers(f_tc_cm_serv_req_vbs_reject), testcasename(), 8);
+	vc_conn.done;
+}
+
+/* CM Service Request for LCS -> reject */
+private function f_tc_cm_serv_req_lcs_reject(charstring id, BSC_ConnHdlrPars pars) runs on BSC_ConnHdlr {
+	g_pars := pars;
+
+	/* First perform location update to ensure subscriber is known */
+	f_perform_lu(false, true, true);
+
+	var MobileIdentityLV mi := valueof(ts_MI_IMSI_LV(g_pars.imsi));
+	var PDU_ML3_MS_NW l3_info := valueof(ts_CM_SERV_REQ('1011'B, mi));
+	f_bssap_compl_l3(l3_info);
+	BSSAP.receive(tr_PDU_DTAP_MT(tr_CM_SERV_REJ(int2oct(32,1))));
+	setverdict(pass);
+}
+testcase TC_cm_serv_req_lcs_reject() runs on MTC_CT {
+	var BSC_ConnHdlr vc_conn;
+	f_init();
+
+	vc_conn := f_start_handler(refers(f_tc_cm_serv_req_lcs_reject), testcasename(), 9);
+	vc_conn.done;
+}
+
+
 /* TODO:
    * continue to send repeated MO signalling messages to keep channel open: does MSC tmeout?
    * malformed messages (missing IE, invalid message type): properly rejected?
@@ -711,6 +933,9 @@
    * emergency call
    * IMSI DETACH
    * send new transaction after/during clear (like SMS, ...)
+   * too long L3 INFO in DTAP
+   * too long / padded BSSAP
+   * too long / short TLV values
  */