diff --git a/Makefile b/Makefile
index a12a504..074e151 100644
--- a/Makefile
+++ b/Makefile
@@ -1,4 +1,4 @@
-SUBDIRS=bsc bsc-nat bts ggsn_tests hlr lapdm mgw msc pcu selftest sgsn sip sysinfo
+SUBDIRS=bsc bsc-nat bts ggsn_tests hlr lapdm mgw msc pcu sccp selftest sgsn sip sysinfo
 
 NPROC=$(shell nproc 2>/dev/null)
 ifeq ($(NPROC),)
diff --git a/bsc/BSC_Tests.ttcn b/bsc/BSC_Tests.ttcn
index d71d3dc..9412251 100644
--- a/bsc/BSC_Tests.ttcn
+++ b/bsc/BSC_Tests.ttcn
@@ -46,6 +46,7 @@
 import from L3_Templates all;
 import from GSM_RR_Types all;
 
+import from SCCP_Templates all;
 import from BSSMAP_Templates all;
 
 const integer NUM_BTS := 3;
diff --git a/bsc/gen_links.sh b/bsc/gen_links.sh
index a6a1b0a..3e27cb1 100755
--- a/bsc/gen_links.sh
+++ b/bsc/gen_links.sh
@@ -67,7 +67,7 @@
 gen_links $DIR $FILES
 
 DIR=../library
-FILES="General_Types.ttcn Osmocom_Types.ttcn GSM_Types.ttcn Osmocom_VTY_Functions.ttcn Native_Functions.ttcn Native_FunctionDefs.cc IPA_Types.ttcn IPA_CodecPort.ttcn IPA_CodecPort_CtrlFunct.ttcn IPA_CodecPort_CtrlFunctDef.cc IPA_Emulation.ttcnpp L3_Templates.ttcn BSSMAP_Templates.ttcn BSSMAP_Emulation.ttcn RLCMAC_CSN1_Types.ttcn GSM_RR_Types.ttcn RSL_Types.ttcn RSL_Emulation.ttcn MGCP_Emulation.ttcn MGCP_Types.ttcn MGCP_Templates.ttcn MGCP_CodecPort.ttcn MGCP_CodecPort_CtrlFunct.ttcn MGCP_CodecPort_CtrlFunctDef.cc BSSAP_CodecPort.ttcn BSSAP_Adapter.ttcn Osmocom_CTRL_Types.ttcn Osmocom_CTRL_Functions.ttcn Osmocom_CTRL_Adapter.ttcn RTP_CodecPort.ttcn RTP_CodecPort_CtrlFunct.ttcn RTP_CodecPort_CtrlFunctDef.cc RTP_Emulation.ttcn IuUP_Types.ttcn IuUP_EncDec.cc IuUP_Emulation.ttcn "
+FILES="General_Types.ttcn Osmocom_Types.ttcn GSM_Types.ttcn Osmocom_VTY_Functions.ttcn Native_Functions.ttcn Native_FunctionDefs.cc IPA_Types.ttcn IPA_CodecPort.ttcn IPA_CodecPort_CtrlFunct.ttcn IPA_CodecPort_CtrlFunctDef.cc IPA_Emulation.ttcnpp L3_Templates.ttcn BSSMAP_Templates.ttcn BSSMAP_Emulation.ttcn RLCMAC_CSN1_Types.ttcn GSM_RR_Types.ttcn RSL_Types.ttcn RSL_Emulation.ttcn MGCP_Emulation.ttcn MGCP_Types.ttcn MGCP_Templates.ttcn MGCP_CodecPort.ttcn MGCP_CodecPort_CtrlFunct.ttcn MGCP_CodecPort_CtrlFunctDef.cc BSSAP_CodecPort.ttcn BSSAP_Adapter.ttcn Osmocom_CTRL_Types.ttcn Osmocom_CTRL_Functions.ttcn Osmocom_CTRL_Adapter.ttcn RTP_CodecPort.ttcn RTP_CodecPort_CtrlFunct.ttcn RTP_CodecPort_CtrlFunctDef.cc RTP_Emulation.ttcn IuUP_Types.ttcn IuUP_EncDec.cc IuUP_Emulation.ttcn SCCP_Templates.ttcn"
 gen_links $DIR $FILES
 
 ignore_pp_results
diff --git a/library/BSSAP_Adapter.ttcn b/library/BSSAP_Adapter.ttcn
index b29d03f..ada66d2 100644
--- a/library/BSSAP_Adapter.ttcn
+++ b/library/BSSAP_Adapter.ttcn
@@ -18,6 +18,7 @@
 import from SCCP_Types all;
 import from SCCPasp_Types all;
 import from SCCP_Emulation all;
+import from SCCP_Templates all;
 
 import from SCTPasp_Types all;
 import from SCTPasp_PortType all;
@@ -59,20 +60,6 @@
 	integer rctx
 };
 
-/* construct a SCCP_PAR_Address with just PC + SSN and no GT */
-template (value) SCCP_PAR_Address ts_SccpAddr_PC_SSN(integer pc, integer ssn, octetstring sio,
-							charstring sccp_srv_type) := {
-	addressIndicator := {
-		pointCodeIndic := '1'B,
-		ssnIndicator := '1'B,
-		globalTitleIndic := '0000'B,
-		routingIndicator := '1'B
-	},
-	signPointCode := SCCP_SPC_int2bit(pc, sccp_srv_type, sio),
-	subsystemNumber := ssn,
-	globalTitle := omit
-}
-
 private function init_pars(inout BSSAP_Adapter ba, in BSSAP_Configuration cfg) {
 	ba.sccp_pars := {
 		sio := {
diff --git a/library/SCCP_Templates.ttcn b/library/SCCP_Templates.ttcn
new file mode 100644
index 0000000..f4019b8
--- /dev/null
+++ b/library/SCCP_Templates.ttcn
@@ -0,0 +1,47 @@
+/* (C) 2018 by sysmocom s.f.m.c. GmbH <info@sysmocom.de>
+ * All Rights Reserved
+ *
+ * Released under the terms of GNU General Public License, Version 2 or
+ * (at your option) any later version.
+ */
+
+module SCCP_Templates {
+
+import from SCCP_Types all;
+import from SCCPasp_Types all;
+import from SCCP_Emulation all;
+
+/* construct a SCCP_PAR_Address with just PC + SSN and no GT */
+template (value) SCCP_PAR_Address ts_SccpAddr_PC_SSN(integer pc, integer ssn, octetstring sio,
+							charstring sccp_srv_type) := {
+	addressIndicator := {
+		pointCodeIndic := '1'B,
+		ssnIndicator := '1'B,
+		globalTitleIndic := '0000'B,
+		routingIndicator := '1'B
+	},
+	signPointCode := SCCP_SPC_int2bit(pc, sccp_srv_type, sio),
+	subsystemNumber := ssn,
+	globalTitle := omit
+}
+
+/* construct a SCCP_PAR_Address with only GT */
+template (value) SCCP_PAR_Address ts_SccpAddr_GT(hexstring global_address) := {
+	addressIndicator := {
+		pointCodeIndic := '0'B,
+		ssnIndicator := '0'B,
+		globalTitleIndic := '0001'B, // NAI only
+		routingIndicator := cg_route_on_GT // route on GT
+	},
+	signPointCode := omit,
+	subsystemNumber := omit,
+	globalTitle := {
+		gti0001 := {
+			natureOfAddress := '0000011'B,
+			oddeven := '0'B,
+			globalTitleAddress := global_address
+		}
+	}
+}
+
+}
diff --git a/msc/MSC_Tests.ttcn b/msc/MSC_Tests.ttcn
index 63cab84..1427fd0 100644
--- a/msc/MSC_Tests.ttcn
+++ b/msc/MSC_Tests.ttcn
@@ -51,6 +51,8 @@
 import from SMPP_Templates all;
 import from SMPP_Emulation all;
 
+import from SCCP_Templates all;
+
 import from SS_Types all;
 import from SS_Templates all;
 import from USSD_Helpers all;
diff --git a/msc/gen_links.sh b/msc/gen_links.sh
index 8b40268..d8a7d22 100755
--- a/msc/gen_links.sh
+++ b/msc/gen_links.sh
@@ -90,7 +90,7 @@
 FILES+="RTP_CodecPort.ttcn RTP_CodecPort_CtrlFunctDef.cc "
 FILES+="MGCP_CodecPort.ttcn MGCP_CodecPort_CtrlFunctDef.cc "
 FILES+="SMPP_CodecPort.ttcn SMPP_CodecPort_CtrlFunct.ttcn SMPP_CodecPort_CtrlFunctDef.cc SMPP_Emulation.ttcn SMPP_Templates.ttcn "
-FILES+="SS_Templates.ttcn "
+FILES+="SS_Templates.ttcn SCCP_Templates.ttcn"
 gen_links $DIR $FILES
 
 ignore_pp_results
diff --git a/sccp/SCCP_Tests.cfg b/sccp/SCCP_Tests.cfg
new file mode 100644
index 0000000..4b7e742
--- /dev/null
+++ b/sccp/SCCP_Tests.cfg
@@ -0,0 +1,19 @@
+[ORDERED_INCLUDE]
+# Common configuration, shared between test suites
+"../Common.cfg"
+# testsuite specific configuration, not expected to change
+"./SCCP_Tests.default"
+
+# Local configuration below
+
+[LOGGING]
+
+[TESTPORT_PARAMETERS]
+
+[MODULE_PARAMETERS]
+
+[MAIN_CONTROLLER]
+
+[EXECUTE]
+SCCP_Tests.control
+#SCCP_Tests.TC_routing_global_title_crash
diff --git a/sccp/SCCP_Tests.default b/sccp/SCCP_Tests.default
new file mode 100644
index 0000000..7d16e5b
--- /dev/null
+++ b/sccp/SCCP_Tests.default
@@ -0,0 +1,41 @@
+[LOGGING]
+FileMask := LOG_ALL | TTCN_MATCHING | DEBUG_ENCDEC;
+
+BSSAP.FileMask := LOG_NOTHING;
+"SCCP_Test_M3UA".FileMask := ERROR | WARNING;
+"SCCP_Test_SCCP".FileMask := ERROR | WARNING;
+"IPA-CTRL-IPA".FileMask := ERROR | WARNING;
+mtc.FileMask := ERROR | WARNING;
+
+[TESTPORT_PARAMETERS]
+*.SCCP_DEMO_USER_VTY.CTRL_MODE := "client"
+*.SCCP_DEMO_USER_VTY.CTRL_HOSTNAME := "127.0.0.1"
+*.SCCP_DEMO_USER_VTY.CTRL_PORTNUM := "2325"
+*.SCCP_DEMO_USER_VTY.CTRL_LOGIN_SKIPPED := "yes"
+*.SCCP_DEMO_USER_VTY.CTRL_DETECT_SERVER_DISCONNECTED := "yes"
+*.SCCP_DEMO_USER_VTY.CTRL_READMODE := "buffered"
+*.SCCP_DEMO_USER_VTY.CTRL_CLIENT_CLEANUP_LINEFEED := "yes"
+*.SCCP_DEMO_USER_VTY.PROMPT1 := "sccp-demo-user> "
+
+[MODULE_PARAMETERS]
+M3UA_Emulation.tsp_logVerbose := true;
+M3UA_Emulation.tsp_SCTP_Server_Mode := true;
+M3UA_Emulation.tsp_M3UA_Server_Mode := true;
+SCCP_Tests.sccp_cfg := {
+	{
+			sccp_service_type := "mtp3_itu",
+			sctp_addr := { 2905, "127.0.0.1", 2905, "127.0.0.2" },
+			own_pc := 185,
+			own_ssn := 254,
+			peer_pc := 23,
+			peer_ssn := 254,
+			sio := '83'O,
+			rctx := 0
+	}
+};
+
+Osmocom_VTY_Functions.mp_prompt_prefix := "sccp-demo-user";
+
+[MAIN_CONTROLLER]
+
+[EXECUTE]
diff --git a/sccp/SCCP_Tests.ttcn b/sccp/SCCP_Tests.ttcn
new file mode 100644
index 0000000..ea2522a
--- /dev/null
+++ b/sccp/SCCP_Tests.ttcn
@@ -0,0 +1,153 @@
+/* (C) 2018 by sysmocom s.f.m.c. GmbH <info@sysmocom.de>
+ * Author: Stefan Sperling <ssperling@sysmocom.de>
+ * All Rights Reserved
+ *
+ * Released under the terms of GNU General Public License, Version 2 or
+ * (at your option) any later version.
+ */
+
+module SCCP_Tests {
+
+import from M3UA_Emulation all;
+
+import from SCCPasp_Types all;
+import from SCCP_Types all;
+import from SCCP_Emulation all;
+import from SCCP_Templates all;
+
+import from SCTPasp_PortType all;
+
+import from Osmocom_CTRL_Adapter all;
+
+import from TELNETasp_PortType all;
+import from Osmocom_VTY_Functions all;
+
+type component system_CT {
+     port SCTPasp_PT sctp;
+};
+
+type component MTC_CT extends CTRL_Adapter_CT {
+	/* VTY to sccp_demo_user (not used yet) */
+	port TELNETasp_PT SCCP_DEMO_USER_VTY;
+
+	/* SCCP protocol runs on top of M3UA Emulation.
+	 * "System Under Test" is libosmo-sccp's sccp_demo_user example program. */
+	var SCCP_CT vc_SCCP_A;
+	var M3UA_CT vc_M3UA;
+	port SCCPasp_PT A_PORT;
+}
+
+type record SCCP_Configuration {
+	charstring sccp_service_type,
+	SCTP_Association_Address sctp_addr,
+	integer own_pc,
+	integer own_ssn,
+	integer peer_pc,
+	integer peer_ssn,
+	octetstring sio,
+	integer rctx
+};
+
+type record of SCCP_Configuration SCCP_Configurations;
+modulepar {
+	SCCP_Configurations sccp_cfg;
+}
+
+function f_init(SCCP_Configuration cfg) runs on MTC_CT {
+	var MSC_SCCP_MTP3_parameters v_param := {
+		sio := {
+			ni := substr(oct2bit(cfg.sio),0,2),
+			prio := substr(oct2bit(cfg.sio),2,2),
+			si := substr(oct2bit(cfg.sio),4,4)
+		},
+		opc := cfg.own_pc,
+		dpc := cfg.peer_pc,
+		sls := 0,
+		sccp_serviceType := cfg.sccp_service_type,
+		ssn := cfg.own_ssn
+	};
+
+	map(self:SCCP_DEMO_USER_VTY, system:SCCP_DEMO_USER_VTY);
+	f_vty_set_prompts(SCCP_DEMO_USER_VTY);
+	f_vty_transceive(SCCP_DEMO_USER_VTY, "enable");
+
+	/* Create and connect test components for an SCCP connection with M3UA beneath. */
+	vc_SCCP_A := SCCP_CT.create;
+	vc_M3UA := M3UA_CT.create;
+	connect(self:A_PORT, vc_SCCP_A:SCCP_SP_PORT);
+	connect(vc_M3UA:MTP3_SP_PORT, vc_SCCP_A:MTP3_SCCP_PORT);
+	map(vc_M3UA:SCTP_PORT, system:sctp);
+
+	vc_M3UA.start(f_M3UA_Emulation(cfg.sctp_addr));
+	vc_SCCP_A.start(SCCPStart(v_param));
+}
+
+function f_cleanup() runs on MTC_CT {
+	all component.stop;
+	unmap(vc_M3UA:SCTP_PORT, system:sctp);
+	disconnect(vc_M3UA:MTP3_SP_PORT, vc_SCCP_A:MTP3_SCCP_PORT);
+	disconnect(self:A_PORT, vc_SCCP_A:SCCP_SP_PORT);
+	self.stop
+}
+
+/*
+ * libosmo-sccp does not support Global Title address as a routing indicator.
+ * But sccp_demo_user should not crash if such a message is received (see OS#2666).
+ */
+testcase TC_routing_global_title_crash() runs on MTC_CT system system_CT {
+	timer TL_timer:= 10.0; /* twice the sccp_demo_user connection attempt interval */
+	var SCCP_PAR_Address v_CallingAddress;
+	var SCCP_PAR_Address v_CalledAddress;
+	var octetstring vl_userdata :='12345678901234567890'O;
+	var ASP_SCCP_N_UNITDATA_ind vl_N_UNITDATA_ind;
+
+	f_init(sccp_cfg[0]);
+
+	/* Called address with routing indicator set to Global Title Address. This used to trigger the crash. */
+	v_CalledAddress := valueof(ts_SccpAddr_GT('012345'H));
+
+	v_CallingAddress := valueof(ts_SccpAddr_PC_SSN(sccp_cfg[0].own_pc, sccp_cfg[0].own_ssn,
+						       sccp_cfg[0].sio, sccp_cfg[0].sccp_service_type));
+	A_PORT.send(t_ASP_N_UNITDATA_req(v_CalledAddress, v_CallingAddress, '00000001'B /* sequence control */,
+					 '00000001'B /* return option */, vl_userdata, omit));
+
+	/*
+	 * Start a timeout within which our DATA packet will be sent out.
+	 * The M3UA Emulation layer has buffered the packet and is going
+	 * to send it when the sccp_demo_user SCCP client connects.
+	 *
+	 * libosmo-sccp will echo the packet back at us in an SCCP UDTS packet.
+	 * However, the current M3UA Emulation implementation will discard this
+	 * response because it arrives on a separate SCTP association and the
+	 * emulation only supports one association at a time.
+	 *
+	 * As a workaround, we wait for a fixed amount of time and then issue
+	 * another command to the VTY of sccp_demo_user. If sccp_demo_user
+	 * has crashed, this will result in a test failure.
+	 */
+	TL_timer.start;
+	alt {
+		[] A_PORT.receive(tr_ASP_N_UNITDATA_ind) -> value vl_N_UNITDATA_ind {
+			log("Received data from SCCP client.");
+			repeat;
+		}
+
+		[] TL_timer.timeout {
+			log("Timeout....");
+		}
+	}
+	TL_timer.stop;
+
+	/* Check that the VTY is still active (implying that the process hasn't crashed). */
+	f_vty_transceive_ret(SCCP_DEMO_USER_VTY, "?");
+	setverdict(pass);
+
+	f_cleanup();
+}
+
+control {
+	execute( TC_routing_global_title_crash() );
+}
+
+
+}
diff --git a/sccp/gen_links.sh b/sccp/gen_links.sh
new file mode 100755
index 0000000..faf347c
--- /dev/null
+++ b/sccp/gen_links.sh
@@ -0,0 +1,62 @@
+#!/bin/bash
+
+BASEDIR=../deps
+
+. ../gen_links.sh.inc
+
+DIR=$BASEDIR/titan.TestPorts.UNIX_DOMAIN_SOCKETasp/src
+FILES="UD_PT.cc  UD_PT.hh  UD_PortType.ttcn  UD_Types.ttcn"
+gen_links $DIR $FILES
+
+DIR=$BASEDIR/titan.Libraries.TCCUsefulFunctions/src
+FILES="TCCInterface_Functions.ttcn TCCConversion_Functions.ttcn TCCConversion.cc TCCInterface.cc TCCInterface_ip.h"
+FILES+=" TCCEncoding_Functions.ttcn TCCEncoding.cc " # GSM 7-bit coding
+gen_links $DIR $FILES
+
+DIR=$BASEDIR/titan.TestPorts.Common_Components.Socket-API/src
+FILES="Socket_API_Definitions.ttcn"
+gen_links $DIR $FILES
+
+# Required by MGCP and IPA
+DIR=$BASEDIR/titan.TestPorts.IPL4asp/src
+FILES="IPL4asp_Functions.ttcn  IPL4asp_PT.cc  IPL4asp_PT.hh IPL4asp_PortType.ttcn  IPL4asp_Types.ttcn  IPL4asp_discovery.cc IPL4asp_protocol_L234.hh"
+gen_links $DIR $FILES
+
+# required by M3UA_Emulation
+DIR=$BASEDIR/titan.ProtocolModules.M3UA/src
+FILES="M3UA_Types.ttcn"
+gen_links $DIR $FILES
+
+# required by M3UA_Emulation
+DIR=$BASEDIR/titan.TestPorts.SCTPasp/src
+FILES="SCTPasp_PT.cc  SCTPasp_PT.hh  SCTPasp_PortType.ttcn  SCTPasp_Types.ttcn"
+gen_links $DIR $FILES
+
+# required by M3UA Emulation
+DIR=$BASEDIR/titan.TestPorts.MTP3asp/src
+FILES="MTP3asp_PortType.ttcn  MTP3asp_Types.ttcn"
+gen_links $DIR $FILES
+
+# required by SCCP Emulation
+DIR=$BASEDIR/titan.ProtocolEmulations.M3UA/src
+FILES="M3UA_Emulation.ttcn"
+gen_links $DIR $FILES
+
+DIR=$BASEDIR/titan.ProtocolEmulations.SCCP/src
+FILES="SCCP_Emulation.ttcn  SCCP_EncDec.cc  SCCP_Mapping.ttcnpp  SCCP_Types.ttcn  SCCPasp_Types.ttcn"
+gen_links $DIR $FILES
+
+DIR=$BASEDIR/titan.TestPorts.TELNETasp/src
+FILES="TELNETasp_PT.cc  TELNETasp_PT.hh  TELNETasp_PortType.ttcn"
+gen_links $DIR $FILES
+
+
+DIR=../library
+FILES="General_Types.ttcn GSM_Types.ttcn Osmocom_Types.ttcn "
+FILES+="Osmocom_VTY_Functions.ttcn Native_Functions.ttcn Native_FunctionDefs.cc "
+FILES+="IPA_Types.ttcn IPA_Emulation.ttcnpp IPA_CodecPort.ttcn IPA_CodecPort_CtrlFunct.ttcn IPA_CodecPort_CtrlFunctDef.cc "
+FILES+="Osmocom_CTRL_Types.ttcn Osmocom_CTRL_Functions.ttcn Osmocom_CTRL_Adapter.ttcn "
+FILES+="SCCP_Templates.ttcn "
+gen_links $DIR $FILES
+
+ignore_pp_results
diff --git a/sccp/regen_makefile.sh b/sccp/regen_makefile.sh
new file mode 100755
index 0000000..fc9e6d2
--- /dev/null
+++ b/sccp/regen_makefile.sh
@@ -0,0 +1,7 @@
+#!/bin/sh
+
+FILES="*.ttcn *.ttcnpp SCCP_EncDec.cc  SCTPasp_PT.cc  TCCConversion.cc TCCInterface.cc UD_PT.cc IPL4asp_PT.cc IPL4asp_discovery.cc IPA_CodecPort_CtrlFunctDef.cc TELNETasp_PT.cc Native_FunctionDefs.cc TCCEncoding.cc "
+
+export CPPFLAGS_TTCN3="-DIPA_EMULATION_SCCP -DUSE_MTP3_DISTRIBUTOR"
+
+../regen-makefile.sh SCCP_Tests.ttcn $FILES