diff --git a/msc/BSC_ConnectionHandler.ttcn b/msc/BSC_ConnectionHandler.ttcn
index 73368a2..733daab 100644
--- a/msc/BSC_ConnectionHandler.ttcn
+++ b/msc/BSC_ConnectionHandler.ttcn
@@ -25,6 +25,7 @@
 import from MobileL3_CommonIE_Types all;
 import from MobileL3_MM_Types all;
 import from MobileL3_CC_Types all;
+import from MobileL3_SMS_Types all;
 import from L3_Templates all;
 import from L3_Common all;
 
@@ -186,7 +187,8 @@
 type enumerated EstablishType {
 	EST_TYPE_MO_CALL,
 	EST_TYPE_EMERG_CALL,
-	EST_TYPE_PAG_RESP
+	EST_TYPE_PAG_RESP,
+	EST_TYPE_MO_SMS
 };
 
 /* helper function to fully establish a dedicated channel */
@@ -212,6 +214,9 @@
 	case (EST_TYPE_PAG_RESP) {
 		l3_info := valueof(ts_PAG_RESP(mi));
 		}
+	case (EST_TYPE_MO_SMS) {
+		l3_info := valueof(ts_CM_SERV_REQ(CM_TYPE_MO_SMS, mi));
+		}
 	}
 
 	/* Send BSSAP_Conn_Req with COMPL L3 INFO to MSC */
@@ -742,6 +747,146 @@
 	}
 }
 
+type record SmsParametersTp {
+	OCT1		msg_ref,
+	TP_DA		da,
+	OCT1		pid,
+	OCT1		dcs,
+	integer		udl,
+	octetstring	ud
+}
+type record SmsParametersRp {
+	OCT1		msg_ref,
+	RP_NumberingPlan_and_NumberDigits orig optional,
+	RP_NumberingPlan_and_NumberDigits dest optional
+}
+type record SmsParameters {
+	SmsParametersTp tp,
+	SmsParametersRp rp,
+	uint3_t		tid,
+	OCT1		dlci,
+	uint7_t		exp_rp_err optional
+}
+
+template (value) TP_DA ts_TP_DA(BIT4 npl, BIT3 ton, hexstring addr) := {
+	tP_DA_NoPad := {
+		tP_LengthIndicator := 0, /* overwritten */
+		tP_NumberingPlanID := npl,
+		tP_TypeOfNumber := ton,
+		tp_Spare := '0'B,
+		tP_DAValue := addr
+	}
+}
+
+template (value) SmsParameters t_SmsPars(hexstring tp_daddr := '12345'H) := {
+	tp := {
+		msg_ref := '23'O,
+		da := ts_TP_DA('0000'B, '000'B, tp_daddr),
+		pid := '00'O,
+		dcs := '00'O,
+		udl := 0,
+		ud := ''O
+	},
+	rp := {
+		msg_ref := '42'O,
+		orig := omit,
+		dest := { '0000'B, '000'B, '0'B, '98765'H }
+	},
+	tid := 0,
+	dlci := '03'O,
+	exp_rp_err := omit
+}
+
+private altstep as_other_sms() runs on BSC_ConnHdlr {
+	[] BSSAP.receive(tr_PDU_DTAP_MT(tr_ML3_MT_SMS(?, ?, ?), ?)) {
+		setverdict(fail, "Unexpected SMS related PDU from MSC");
+		self.stop;
+	}
+}
+
+/* Submit a MO-SMS over an already existing (and authenticated, ...) DTAP connection */
+function f_mo_sms(inout SmsParameters spars)
+runs on BSC_ConnHdlr {
+	var template (value) TPDU_RP_DATA_MS_SGSN tp_mo;
+	var template (value) RPDU_MS_SGSN rp_mo;
+	var template (value) PDU_ML3_MS_NW l3_mo;
+
+	var template TPDU_RP_DATA_SGSN_MS tp_mt;
+	var template RPDU_SGSN_MS rp_mt;
+	var template PDU_ML3_NW_MS l3_mt;
+
+	var default d := activate(as_other_sms());
+
+	tp_mo := ts_SMS_SUBMIT(spars.tp.msg_ref, spars.tp.da, spars.tp.pid, spars.tp.dcs,
+				 spars.tp.udl, spars.tp.ud);
+	rp_mo := ts_RP_DATA_MO(spars.rp.msg_ref, spars.rp.orig, spars.rp.dest, tp_mo);
+	l3_mo := ts_ML3_MO_SMS(spars.tid, c_TIF_ORIG, ts_CP_DATA_MO(rp_mo));
+	BSSAP.send(ts_PDU_DTAP_MO(l3_mo, spars.dlci, true));
+	/* receive CP-ACK for CP-DATA above */
+	BSSAP.receive(tr_PDU_DTAP_MT(tr_ML3_MT_SMS(spars.tid, c_TIF_REPL, tr_CP_ACK_MT), spars.dlci));
+
+	if (ispresent(spars.exp_rp_err)) {
+		/* expect an RP-ERROR message from MSC with given cause */
+		rp_mt := tr_RP_ERROR_MT(spars.rp.msg_ref, spars.exp_rp_err);
+		l3_mt := tr_ML3_MT_SMS(spars.tid, c_TIF_REPL, tr_CP_DATA_MT(rp_mt));
+		BSSAP.receive(tr_PDU_DTAP_MT(l3_mt, spars.dlci));
+		/* send CP-ACK for CP-DATA just received */
+		l3_mo := ts_ML3_MO_SMS(spars.tid, c_TIF_ORIG, ts_CP_ACK_MO);
+		BSSAP.send(ts_PDU_DTAP_MO(l3_mo, spars.dlci, true));
+	} else {
+		/* expect RP-ACK for RP-DATA */
+		rp_mt := tr_RP_ACK_MT(spars.rp.msg_ref);
+		l3_mt := tr_ML3_MT_SMS(spars.tid, c_TIF_REPL, tr_CP_DATA_MT(rp_mt));
+		BSSAP.receive(tr_PDU_DTAP_MT(l3_mt, spars.dlci));
+		/* send CP-ACO for CP-DATA just received */
+		l3_mo := ts_ML3_MO_SMS(spars.tid, c_TIF_ORIG, ts_CP_ACK_MO);
+		BSSAP.send(ts_PDU_DTAP_MO(l3_mo, spars.dlci, true));
+	}
+	deactivate(d);
+	setverdict(pass);
+}
+
+/* receive MT-SMS delivered from the MSC/SMSC over an already existing DTAP connection */
+function f_mt_sms(inout SmsParameters spars)
+runs on BSC_ConnHdlr {
+	var template (value) TPDU_RP_DATA_MS_SGSN tp_mo;
+	var template (value) RPDU_MS_SGSN rp_mo;
+	var template (value) PDU_ML3_MS_NW l3_mo;
+
+	var template TPDU_RP_DATA_SGSN_MS tp_mt;
+	var template RPDU_SGSN_MS rp_mt;
+	var template PDU_ML3_NW_MS l3_mt;
+
+	var PDU_DTAP_MT dtap_mt;
+
+	var default d := activate(as_other_sms());
+
+	/* Expect CP-DATA(RP-DATA(SMS-DELIVER)) */
+	tp_mt := tr_SMS_DELIVER(?, spars.tp.ud, spars.tp.pid, spars.tp.dcs, ?);
+	rp_mt := tr_RP_DATA_MT(?, ?, omit, tp_mt);
+	l3_mt := tr_ML3_MT_SMS(?, c_TIF_ORIG, tr_CP_DATA_MT(rp_mt));
+	BSSAP.receive(tr_PDU_DTAP_MT(l3_mt, spars.dlci)) -> value dtap_mt;
+	/* Extract relevant identifiers */
+	spars.tid := bit2int(dtap_mt.dtap.tiOrSkip.transactionId.tio);
+	spars.rp.msg_ref := dtap_mt.dtap.msgs.sms.cP_DATA.cP_User_Data.cP_RPDU.rP_DATA_SGSN_MS.rP_MessageReference;
+
+	/* send CP-ACK for CP-DATA just received */
+	l3_mo := ts_ML3_MO_SMS(spars.tid, c_TIF_REPL, ts_CP_ACK_MO);
+	BSSAP.send(ts_PDU_DTAP_MO(l3_mo, spars.dlci, true));
+
+	/* send RP-ACK for RP-DATA */
+	rp_mo := ts_RP_ACK_MO(spars.rp.msg_ref);
+	l3_mo := ts_ML3_MO_SMS(spars.tid, c_TIF_REPL, ts_CP_DATA_MO(rp_mo));
+	BSSAP.send(ts_PDU_DTAP_MO(l3_mo, spars.dlci, true));
+
+	/* expect CP-ACK for CP-DATA(RP-ACK) just sent */
+	l3_mt := tr_ML3_MT_SMS(spars.tid, c_TIF_REPL, tr_CP_ACK_MT);
+	BSSAP.receive(tr_PDU_DTAP_MT(l3_mt, spars.dlci));
+
+	deactivate(d);
+	setverdict(pass);
+}
+
 
 
 
diff --git a/msc/MSC_Tests.ttcn b/msc/MSC_Tests.ttcn
index 503f98b..b5108c7 100644
--- a/msc/MSC_Tests.ttcn
+++ b/msc/MSC_Tests.ttcn
@@ -1815,6 +1815,77 @@
 	setverdict(pass);
 }
 
+/* LU followed by MO SMS */
+private function f_tc_lu_and_mo_sms(charstring id, BSC_ConnHdlrPars pars) runs on BSC_ConnHdlr {
+	var SmsParameters spars := valueof(t_SmsPars);
+
+	f_init_handler(pars);
+
+	/* Perform location update and call */
+	f_perform_lu();
+
+	f_establish_fully(EST_TYPE_MO_SMS);
+
+	//spars.exp_rp_err := 96; /* invalid mandatory information */
+	f_mo_sms(spars);
+
+	f_expect_clear();
+}
+testcase TC_lu_and_mo_sms() runs on MTC_CT {
+	var BSC_ConnHdlr vc_conn;
+	f_init();
+	vc_conn := f_start_handler(refers(f_tc_lu_and_mo_sms), 42);
+	vc_conn.done;
+}
+
+private function f_vty_sms_send(charstring imsi, charstring msisdn, charstring text)
+runs on MTC_CT {
+	f_vty_transceive(MSCVTY, "subscriber imsi "&imsi&" sms sender msisdn "&msisdn&" send "&text);
+}
+
+/* LU followed by MT SMS */
+private function f_tc_lu_and_mt_sms(charstring id, BSC_ConnHdlrPars pars) runs on BSC_ConnHdlr {
+	var SmsParameters spars := valueof(t_SmsPars);
+	var OCT4 tmsi;
+
+	f_init_handler(pars);
+
+	/* Perform location update and call */
+	f_perform_lu();
+
+	/* register an 'expect' for given IMSI (+TMSI) */
+	if (isvalue(g_pars.tmsi)) {
+		tmsi := g_pars.tmsi;
+	} else {
+		tmsi := 'FFFFFFFF'O;
+	}
+	f_bssmap_register_imsi(g_pars.imsi, tmsi);
+
+	/* FIXME: actually cause MSC to send a SMS via VTY or SMPP */
+
+	/* MSC->BSC: expect PAGING from MSC */
+	BSSAP.receive(tr_BSSMAP_Paging(g_pars.imsi));
+	/* Establish DTAP / BSSAP / SCCP connection */
+	f_establish_fully(EST_TYPE_PAG_RESP);
+
+	spars.tp.ud := 'C8329BFD064D9B53'O;
+	f_mt_sms(spars);
+
+	f_expect_clear();
+}
+testcase TC_lu_and_mt_sms() runs on MTC_CT {
+	var BSC_ConnHdlrPars pars;
+	var BSC_ConnHdlr vc_conn;
+	f_init();
+	pars := f_init_pars(43);
+	vc_conn := f_start_handler_with_pars(refers(f_tc_lu_and_mt_sms), pars);
+	f_sleep(2.0);
+	f_vty_sms_send(hex2str(pars.imsi), "2342", "Hello SMS");
+	vc_conn.done;
+}
+
+
+
 /* TODO:
    * continue to send repeated MO signalling messages to keep channel open: does MSC tmeout?
    * malformed messages (missing IE, invalid message type): properly rejected?
@@ -1876,6 +1947,9 @@
 
 	execute( TC_lu_and_mt_call() );
 
+	execute( TC_lu_and_mo_sms() );
+	execute( TC_lu_and_mt_sms() );
+
 	/* Run this last: at the time of writing this test crashes the MSC */
 	execute( TC_lu_imsi_auth_tmsi_encr_3_1_log_msc_debug() );
 }