diff --git a/library/L3_Templates.ttcn b/library/L3_Templates.ttcn
index ca81b72..db514a4 100644
--- a/library/L3_Templates.ttcn
+++ b/library/L3_Templates.ttcn
@@ -361,6 +361,29 @@
 					ts_ML3_MO_MM_ID_Rsp(valueof(ts_MI_IMEI_LV(imei)));
 
 
+template (value) MobileStationClassmark1_V ts_CM1(BIT1 a5_1_unavail := '0'B, BIT2 rev := '10'B) := {
+	rf_PowerCapability := '010'B,
+	a5_1 := a5_1_unavail,
+	esind := '1'B,
+	revisionLevel := rev,
+	spare1_1 := '0'B
+}
+
+template PDU_ML3_MS_NW ts_ML3_MO_MM_IMSI_DET_Ind(MobileIdentityLV mi,
+						 template MobileStationClassmark1_V cm1 := ts_CM1)
+modifies ts_ML3_MO := {
+	msgs := {
+		mm := {
+			imsiDetachIndication := {
+				messageType := '000001'B,
+				nsd := '00'B,
+				mobileStationClassmark1 := cm1,
+				mobileIdentityLV := mi
+			}
+		}
+	}
+}
+
 template PDU_ML3_MS_NW ts_ML3_MO_CC(integer tid) := {
 	discriminator := '0011'B,
 	tiOrSkip := {
@@ -440,6 +463,30 @@
 	}
 }
 
+template PDU_ML3_MS_NW ts_ML3_MO_CC_EMERG_SETUP(integer tid, template BearerCapability_TLV bcap := ts_Bcap_voice) := {
+	discriminator := '0011'B,
+	tiOrSkip := {
+		transactionId := {
+			tio := int2bit(tid, 3),
+			tiFlag := '0'B,
+			tIExtension := omit
+		}
+	},
+	msgs := {
+		cc := {
+			emergencySetup := {
+				messageType := '001110'B,
+				nsd := '00'B,
+				bearerCapability := bcap,
+				streamIdentifier := omit,
+				supportedCodecs := omit,
+				emergencyCategory := omit
+			}
+		}
+	}
+}
+
+
 template PDU_ML3_NW_MS tr_ML3_MT_CC_CALL_PROC(integer tid) := {
 	discriminator := '0011'B,
 	tiOrSkip := {
diff --git a/msc_tests/BSC_ConnectionHandler.ttcn b/msc_tests/BSC_ConnectionHandler.ttcn
index 0fb1702..69854e3 100644
--- a/msc_tests/BSC_ConnectionHandler.ttcn
+++ b/msc_tests/BSC_ConnectionHandler.ttcn
@@ -80,14 +80,6 @@
 	bssap := bssap
 };
 
-template (value) MobileStationClassmark1_V ts_CM1(BIT1 a5_1_unavail := '0'B, BIT2 rev := '10'B) := {
-	rf_PowerCapability := '010'B,
-	a5_1 := a5_1_unavail,
-	esind := '1'B,
-	revisionLevel := rev,
-	spare1_1 := '0'B
-}
-
 /* Encode 'l3' and ask BSSMAP_Emulation to create new connection with COMPL L3 INFO */
 function f_bssap_compl_l3(PDU_ML3_MS_NW l3)
 runs on BSC_ConnHdlr {
diff --git a/msc_tests/MSC_Tests.ttcn b/msc_tests/MSC_Tests.ttcn
index c2d1771..0fad797 100644
--- a/msc_tests/MSC_Tests.ttcn
+++ b/msc_tests/MSC_Tests.ttcn
@@ -702,6 +702,228 @@
 }
 
 
+/* Test IMSI DETACH (MI=IMSI) */
+private function f_tc_imsi_detach_by_imsi(charstring id, BSC_ConnHdlrPars pars) runs on BSC_ConnHdlr {
+	g_pars := pars;
+
+	var MobileIdentityLV mi := valueof(ts_MI_IMSI_LV(g_pars.imsi));
+
+	/* Send BSSAP_Conn_Req with COMPL L3 INFO to MSC */
+	f_bssap_compl_l3(valueof(ts_ML3_MO_MM_IMSI_DET_Ind(mi)));
+
+	/* Send Early Classmark, just for the fun of it? */
+	BSSAP.send(ts_BSSMAP_ClassmarkUpd(g_pars.cm2, g_pars.cm3));
+
+	/* wait for normal teardown */
+	BSSAP.receive(tr_BSSMAP_ClearCommand);
+	BSSAP.send(ts_BSSMAP_ClearComplete);
+	BSSAP.receive(BSSAP_Conn_Prim:MSC_CONN_PRIM_DISC_IND);
+	setverdict(pass);
+}
+testcase TC_imsi_detach_by_imsi() runs on MTC_CT {
+	var BSC_ConnHdlr vc_conn;
+	f_init();
+
+	vc_conn := f_start_handler(refers(f_tc_imsi_detach_by_imsi), testcasename(), 2);
+	vc_conn.done;
+}
+
+/* Test IMSI DETACH (MI=TMSI) */
+private function f_tc_imsi_detach_by_tmsi(charstring id, BSC_ConnHdlrPars pars) runs on BSC_ConnHdlr {
+	g_pars := pars;
+
+	var MobileIdentityLV mi := valueof(ts_MI_TMSI_LV('01020304'O));
+
+	/* Send BSSAP_Conn_Req with COMPL L3 INFO to MSC */
+	f_bssap_compl_l3(valueof(ts_ML3_MO_MM_IMSI_DET_Ind(mi)));
+
+	/* Send Early Classmark, just for the fun of it? */
+	BSSAP.send(ts_BSSMAP_ClassmarkUpd(g_pars.cm2, g_pars.cm3));
+
+	/* wait for normal teardown */
+	BSSAP.receive(tr_BSSMAP_ClearCommand);
+	BSSAP.send(ts_BSSMAP_ClearComplete);
+	BSSAP.receive(BSSAP_Conn_Prim:MSC_CONN_PRIM_DISC_IND);
+	setverdict(pass);
+}
+testcase TC_imsi_detach_by_tmsi() runs on MTC_CT {
+	var BSC_ConnHdlr vc_conn;
+	f_init();
+
+	vc_conn := f_start_handler(refers(f_tc_imsi_detach_by_tmsi), testcasename(), 3);
+	vc_conn.done;
+}
+
+/* Test IMSI DETACH (MI=IMEI), which is illegal */
+private function f_tc_imsi_detach_by_imei(charstring id, BSC_ConnHdlrPars pars) runs on BSC_ConnHdlr {
+	g_pars := pars;
+
+	var MobileIdentityLV mi := valueof(ts_MI_IMEI_LV(g_pars.imsi));
+
+	/* Send BSSAP_Conn_Req with COMPL L3 INFO to MSC */
+	f_bssap_compl_l3(valueof(ts_ML3_MO_MM_IMSI_DET_Ind(mi)));
+
+	/* Send Early Classmark, just for the fun of it? */
+	BSSAP.send(ts_BSSMAP_ClassmarkUpd(g_pars.cm2, g_pars.cm3));
+
+	/* wait for normal teardown */
+	BSSAP.receive(tr_BSSMAP_ClearCommand);
+	BSSAP.send(ts_BSSMAP_ClearComplete);
+	BSSAP.receive(BSSAP_Conn_Prim:MSC_CONN_PRIM_DISC_IND);
+	setverdict(pass);
+}
+testcase TC_imsi_detach_by_imei() runs on MTC_CT {
+	var BSC_ConnHdlr vc_conn;
+	f_init();
+
+	vc_conn := f_start_handler(refers(f_tc_imsi_detach_by_imei), testcasename(), 4);
+	vc_conn.done;
+}
+
+
+/* helper function for an emergency call. caller passes in mobile identity to use */
+private function f_emerg_call(MobileIdentityLV mi) runs on BSC_ConnHdlr {
+
+	var PDU_ML3_MS_NW l3_info := valueof(ts_CM_SERV_REQ('0010'B, mi));
+	f_bssap_compl_l3(l3_info);
+	BSSAP.receive(tr_PDU_DTAP_MT(tr_CM_SERV_ACC));
+
+	var hexstring called := '112'H;
+	var integer tid := 0;
+	var MNCC_PDU mncc;
+	f_create_mncc_expect(hex2str(called));
+
+	BSSAP.send(ts_PDU_DTAP_MO(ts_ML3_MO_CC_EMERG_SETUP(tid)));
+	MNCC.receive(tr_MNCC_SETUP_ind(?, tr_MNCC_number(hex2str(called)))) -> value mncc;
+	/* FIXME: extract call_id */
+
+	/* Call Proceeding */
+	MNCC.send(ts_MNCC_CALL_PROC_req(mncc.u.signal.callref, ts_MNCC_bcap_voice));
+	BSSAP.receive(tr_PDU_DTAP_MT(tr_ML3_MT_CC_CALL_PROC(tid)));
+
+	/* Alerting */
+	MNCC.send(ts_MNCC_ALERT_req(mncc.u.signal.callref));
+	BSSAP.receive(tr_PDU_DTAP_MT(tr_ML3_MT_CC_ALERTING(tid)));
+
+	/* Answer. This causes TCH assignment in case of "late assignment" */
+	MNCC.send(ts_MNCC_SETUP_COMPL_req(mncc.u.signal.callref));
+
+	f_sleep(3.0);
+
+	/* Hangup by "B" side */
+	MNCC.send(ts_MNCC_DISC_req(mncc.u.signal.callref, valueof(ts_MNCC_cause(23))));
+	BSSAP.receive(tr_PDU_DTAP_MT(tr_ML3_MT_CC_DISC(tid)));
+
+	/* Release of call */
+	MNCC.send(ts_MNCC_REL_req(mncc.u.signal.callref, valueof(ts_MNCC_cause(42))));
+	BSSAP.receive(tr_PDU_DTAP_MT(tr_ML3_MT_CC_RELEASE(tid)));
+
+	/* clearing of radio channel */
+	BSSAP.receive(tr_BSSMAP_ClearCommand);
+	BSSAP.send(ts_BSSMAP_ClearComplete);
+	BSSAP.receive(BSSAP_Conn_Prim:MSC_CONN_PRIM_DISC_IND);
+
+	f_sleep(5.0);
+}
+
+/* establish an emergency call by IMEI, no SIM inserted (and hence no IMSI) */
+private function f_tc_emerg_call_imei_reject(charstring id, BSC_ConnHdlrPars pars) runs on BSC_ConnHdlr {
+	g_pars := pars;
+
+	var MobileIdentityLV mi := valueof(ts_MI_IMEI_LV(g_pars.imsi));
+	var PDU_ML3_MS_NW l3_info := valueof(ts_CM_SERV_REQ('0010'B, mi));
+	f_bssap_compl_l3(l3_info);
+	BSSAP.receive(tr_PDU_DTAP_MT(tr_CM_SERV_REJ('05'O)));
+	setverdict(pass);
+}
+testcase TC_emerg_call_imei_reject() runs on MTC_CT {
+	var BSC_ConnHdlr vc_conn;
+	f_init();
+
+	vc_conn := f_start_handler(refers(f_tc_emerg_call_imei_reject), testcasename(), 5);
+	vc_conn.done;
+}
+
+/* establish an emergency call by IMEI, no SIM inserted (and hence no IMSI) */
+private function f_tc_emerg_call_imsi(charstring id, BSC_ConnHdlrPars pars) runs on BSC_ConnHdlr {
+	g_pars := pars;
+	/* First perform location update to ensure subscriber is known */
+	f_perform_lu(false, true, true);
+	/* Then issue emergency call identified by IMSI */
+	f_emerg_call(valueof(ts_MI_IMSI_LV(g_pars.imsi)));
+}
+testcase TC_emerg_call_imsi() runs on MTC_CT {
+	var BSC_ConnHdlr vc_conn;
+	f_init();
+
+	vc_conn := f_start_handler(refers(f_tc_emerg_call_imsi), testcasename(), 6);
+	vc_conn.done;
+}
+
+/* CM Service Request for VGCS -> reject */
+private function f_tc_cm_serv_req_vgcs_reject(charstring id, BSC_ConnHdlrPars pars) runs on BSC_ConnHdlr {
+	g_pars := pars;
+
+	/* First perform location update to ensure subscriber is known */
+	f_perform_lu(false, true, true);
+
+	var MobileIdentityLV mi := valueof(ts_MI_IMSI_LV(g_pars.imsi));
+	var PDU_ML3_MS_NW l3_info := valueof(ts_CM_SERV_REQ('1001'B, mi));
+	f_bssap_compl_l3(l3_info);
+	BSSAP.receive(tr_PDU_DTAP_MT(tr_CM_SERV_REJ(int2oct(32,1))));
+	setverdict(pass);
+}
+testcase TC_cm_serv_req_vgcs_reject() runs on MTC_CT {
+	var BSC_ConnHdlr vc_conn;
+	f_init();
+
+	vc_conn := f_start_handler(refers(f_tc_cm_serv_req_vgcs_reject), testcasename(), 7);
+	vc_conn.done;
+}
+
+/* CM Service Request for VBS -> reject */
+private function f_tc_cm_serv_req_vbs_reject(charstring id, BSC_ConnHdlrPars pars) runs on BSC_ConnHdlr {
+	g_pars := pars;
+
+	/* First perform location update to ensure subscriber is known */
+	f_perform_lu(false, true, true);
+
+	var MobileIdentityLV mi := valueof(ts_MI_IMSI_LV(g_pars.imsi));
+	var PDU_ML3_MS_NW l3_info := valueof(ts_CM_SERV_REQ('1010'B, mi));
+	f_bssap_compl_l3(l3_info);
+	BSSAP.receive(tr_PDU_DTAP_MT(tr_CM_SERV_REJ(int2oct(32,1))));
+	setverdict(pass);
+}
+testcase TC_cm_serv_req_vbs_reject() runs on MTC_CT {
+	var BSC_ConnHdlr vc_conn;
+	f_init();
+
+	vc_conn := f_start_handler(refers(f_tc_cm_serv_req_vbs_reject), testcasename(), 8);
+	vc_conn.done;
+}
+
+/* CM Service Request for LCS -> reject */
+private function f_tc_cm_serv_req_lcs_reject(charstring id, BSC_ConnHdlrPars pars) runs on BSC_ConnHdlr {
+	g_pars := pars;
+
+	/* First perform location update to ensure subscriber is known */
+	f_perform_lu(false, true, true);
+
+	var MobileIdentityLV mi := valueof(ts_MI_IMSI_LV(g_pars.imsi));
+	var PDU_ML3_MS_NW l3_info := valueof(ts_CM_SERV_REQ('1011'B, mi));
+	f_bssap_compl_l3(l3_info);
+	BSSAP.receive(tr_PDU_DTAP_MT(tr_CM_SERV_REJ(int2oct(32,1))));
+	setverdict(pass);
+}
+testcase TC_cm_serv_req_lcs_reject() runs on MTC_CT {
+	var BSC_ConnHdlr vc_conn;
+	f_init();
+
+	vc_conn := f_start_handler(refers(f_tc_cm_serv_req_lcs_reject), testcasename(), 9);
+	vc_conn.done;
+}
+
+
 /* TODO:
    * continue to send repeated MO signalling messages to keep channel open: does MSC tmeout?
    * malformed messages (missing IE, invalid message type): properly rejected?
@@ -711,6 +933,9 @@
    * emergency call
    * IMSI DETACH
    * send new transaction after/during clear (like SMS, ...)
+   * too long L3 INFO in DTAP
+   * too long / padded BSSAP
+   * too long / short TLV values
  */