diff --git a/epdg/EPDG_Tests.ttcn b/epdg/EPDG_Tests.ttcn
index bc4219b..1742fd7 100644
--- a/epdg/EPDG_Tests.ttcn
+++ b/epdg/EPDG_Tests.ttcn
@@ -471,6 +471,32 @@
 	}
 }
 
+/* Send PPR as HSS to AAA server, expect back PPA */
+private function f_DIA_SWx_PP(template (present) GenericAVP exp_result_tmpl := tr_AVP_ResultCode(DIAMETER_SUCCESS)) runs on EPDG_ConnHdlr {
+	var PDU_DIAMETER rx_dia;
+	var UINT32 hbh_id := f_rnd_octstring(4);
+	var UINT32 ete_id := f_rnd_octstring(4);
+	var octetstring reason_info := char2oct("test");
+
+	/* Unlike PPR, PPA contains no IMSI. Register ete_id in DIAMETER_Emulation,
+	 * so PPA is forwarded back to us in DIAMETER port instead of MTC_CT.DIAMETER_UNIT.
+	 */
+	f_epdg_connhldr_SWx_expect_eteid(ete_id);
+
+	SWx.send(ts_DIA_SWx_PPR(g_pars.imsi,
+				IPv4,
+				g_pars.apn,
+				hbh_id := hbh_id,
+				ete_id := ete_id));
+
+	alt {
+	[] SWx.receive(tr_DIA_SWx_PPA(exp_result_tmpl, hbh_id := hbh_id, ete_id := ete_id)) -> value rx_dia {}
+	[] SWx.receive(PDU_DIAMETER:?) -> value rx_dia {
+		Misc_Helpers.f_shutdown(__BFILE__, __LINE__, fail, log2str("Unexpected Diameter SWx msg rx: ", rx_dia));
+		}
+	}
+}
+
 /* Send RTR as HSS to AAA server, expect back RTA */
 private function f_DIA_SWx_RT(template (value) CxDx_3GPP_Reason_Code reason_code,
 			      template (present) GenericAVP exp_result_tmpl := tr_AVP_ResultCode(DIAMETER_SUCCESS),
@@ -1138,6 +1164,41 @@
 	setverdict(pass);
 }
 
+/*
+ * 3GPP TS 29.273 8.1.2.3 HSS Initiated Update of User Profile
+ * 3GPP TS 29.273 8.2.2.2 HSS Initiated Update of User Profile Procedure
+ */
+private function f_TC_hss_initiated_update_user_profile(charstring id) runs on EPDG_ConnHdlr {
+	f_initial_attach();
+	/* Procedure should be performed properly: */
+	f_DIA_SWx_PP(tr_AVP_ResultCode(DIAMETER_SUCCESS));
+}
+testcase TC_hss_initiated_update_user_profile() runs on MTC_CT {
+	var EPDG_ConnHdlrPars pars := f_init_pars();
+	var EPDG_ConnHdlr vc_conn;
+	f_init();
+	vc_conn := f_start_handler(refers(f_TC_hss_initiated_update_user_profile), pars);
+	vc_conn.done;
+	setverdict(pass);
+}
+
+/*
+ * Same as TC_hss_initiated_update_user_profile_unknown, but without registering
+ * subscriber first, so expect DIAMETER_ERROR_USER_UNKNOWN in answer.
+ */
+private function f_TC_hss_initiated_update_user_profile_unknown(charstring id) runs on EPDG_ConnHdlr {
+	var DIAMETER_ts29_229_ExperimentalResultcode erc := DIAMETER_ERROR_USER_UNKNOWN;
+	f_DIA_SWx_PP(tr_AVP_ExperimentalResult(vendor_id_3GPP, int2oct(enum2int(erc), 4)));
+}
+testcase TC_hss_initiated_update_user_profile_unknown() runs on MTC_CT {
+	var EPDG_ConnHdlrPars pars := f_init_pars();
+	var EPDG_ConnHdlr vc_conn;
+	f_init();
+	vc_conn := f_start_handler(refers(f_TC_hss_initiated_update_user_profile_unknown), pars);
+	vc_conn.done;
+	setverdict(pass);
+}
+
 private function f_TC_concurrent_ues(charstring id) runs on EPDG_ConnHdlr {
 	COORD.send(COORD_CMD_READY);
 	COORD.receive(COORD_CMD_START);
@@ -1236,6 +1297,8 @@
 	execute ( TC_s2b_CreateSession_rejected() );
 	execute ( TC_hss_initiated_deregister_new_server_assigned() );
 	execute ( TC_hss_initiated_deregister_permanent_termination() );
+	execute ( TC_hss_initiated_update_user_profile() );
+	execute ( TC_hss_initiated_update_user_profile_unknown() );
 	execute ( TC_concurrent_ues2() );
 	execute ( TC_concurrent_ues100() );
 	execute ( TC_upf_echo_req() );