1. Formats of Morse Networks

All CIS Forces - in principle - use the same formats for all Morse Code traffic. Most messages do consist of groups of 5 letters or 5 figures. In tactical networks both are used, in Navy networks nearly all messages are 5-figure-groups ( 1.1. Standard Format for Morse Messages ).
Not all figures are sent as such, but are replaced by letters, because they are shorter in Morse Code. CIS Forces use Cyrillic Morse - adding new Codes to the Latin alphabet
( 1.5. Cyrillic Morse, Cut Numbers and Abbreviations ).
Sometimes two stations exchange seemingly endless rows of letters in Simplex traffic, that are 1.8. Online Encrypted Morse Messages
Important, short instructions are sent on all levels of the CIS Forces, comparable with the Emergency Action Messages of the US Air Force ( 1.9. XXX Strategic Flash Messages ).
There are messages, which are yet not fully understood in its content, one example being the 1.10. RADIOPROGNOZ Messages .
Some ships do transmit Sea State and Weather conditions to their HQ. They are formatted as WMO Buoy Meteorological Data in FM-13 code. 1.11. FM13-Code Meteorological Data

1.1. Standard Format for Morse Messages

In the former Warsaw Pact (WP) Forces every branch had its own "style" to drop a message. When, e.g. the Black Sea Fleet left Odessa, Morse traffic could be traced until the ships arrived in their operating area. The desastrous, because badly prepared, invasion of Czechoslovakia in August 1968 revealed even more weaknesses of the WP communications. Supplies did not arrive in time and sometimes in despair were ordered in plain language, etc.
As a consequence the WP Radio troops in several steps have been reorganised. A very important measure was the introduction of a standardized format for Morse messages. It is still valid for tactical and strategic CIS Military Morse networks .

In its most basic format, a Morse message will contain these elements:
TU5J 162 30 18 1202 162 = 517 = ppppp 5LGx28 azkbz = 667 +
which means:

TU5J	Sender of the message. This is a tactical callsign, it's format is LLLL or FFFF or LFLL or LLFL but not FFLL or LLFF . L = Letter. F= Figure. See Call Signs in Morse Code Networks for their callsigns.
162	Message number, between 1 and 999. Is repeated after the time group.
30	Group count, not consistent. May include procedure groups, traffic mode group and service group.
18	Day
1202	Local time of message preparation (see below).
517	Address, is referred to as ads or message priority code (see below). The address specifies the receiver of the message, may be a command post or a person. Sometimes Z-Codes with trigrams.
ppppp	Procedure group for procedure M-125 (see below).
5ALGx28	Text of 28 accentuated five letter groups (30 minus procedure and service group). All messages are encrypted, no exceptions.
azkbz	Service group, indicating day and group count. See Cyrillic Morse, Cut Numbers and Abbreviations for code.
667	sig (signature) of the sender. Can be a command post or a person. Navy stations sign here with their callsign.
+	ar (end of message). Other endings may be: k, rpt al or rpt QLN (repeat message via landline)

1.2. Preamble Time

The preamble time (message preparation time) can tell more about the Time Zone of the sender. Ukraine and Belorus local time for example is 1 hour later than Moscow time, 4 hours later than Kazakhstan and so on. This and Daylight Saving Time (DST) easely can lead to confusion.
Tom, DL8AAM, therefore offered a very useful compilation in UDXF about the possible origin of a message. Tnx Tom.

PT = Preamble Time and UTC = Time of reception in UTC

PT - UTC = 0 up to 2 h: Sender in Moscow Time Zone or in Ukraine
PT - UTC = 2 up to 3 h: Sender in Moscow Time Zone
PT - UTC = 3 up to 6 h: Sender in Uzbekistan or Kazakhstan or Far East Russia, etc.

and during DST:
PT - UTC = 0 up to 3 h: Sender in Moscow Time Zone or in Ukraine
PT - UTC = 3 up to 4 h: Sender in Moscow Time Zone
PT - UTC = 4 up to 7 h: Sender in Uzbekistan or Kazakhstan or Far East Russia, etc.

1.3. Priority Levels

The former WP (Warsaw Pact) Forces used several priority levels to specify the time between teletype-message preparation and reception, which depended on the length of the message as well.
Priority level "Monument", for example, meant "at once", but a normal message with 300 words/groups arrived only 2 hours later at the addressee.
Some priority levels - wzd, rkt, sml - are used for Morse messages as well and still are alive.
The question remains, how the XXX Strategic Flash Messages will fit into this time sked.

Level	Priority	Abbreviation
Monument (monument) not used in Morse Code	Highest	m
Platinum (pdatina), not used in Morse Code		p
Air (wozduh)		wzd
Gale (chturm), not used in Morse Code		cht
Rocket (paketa)		rkt
Aircraft (samoljot)		sml
Exception (wneocerednaä)		wn
Urgent (srocnaä)		sr
Normal	lowest	--

1.4. Additional Information

The following part is based on information from "SAS und Chiffrierdienste" Website. See here Links . It is not clear, how many of the historical informations still are valid, but I'm convinced, the basic structure still is in use.
Depending of the nature of a message the first few text groups may contain additional information, although they are not easely recognisable.

The first text group can be a procedure group, which describes the treatment of this message, most probably encryption/decryption. Procedure M-125 leads to groups like "11111" or "aaaaa". "11111" probably is used for exercises/training.

The following traffic mode group specifies, how the network is handling messages. Circular traffic results in groups like "55555" or "ddddd".

The decode group specifies the encryption key. In circular traffic this group is looked up in encryption tables, in normal traffic each letter/cipher is sent three times.



Top of page.

1.5. Cyrillic Morse, Cut Numbers and Abbreviations

When we copy Cyrillic Morse traffic most of us will write down Latin letters instead. Being German speaking I will use the substitutions as follows; the complete Russian/Latin/Morse Code Alphabet you find here: Downloads :

Cyrillic Morse Code	"Translation" I use.
- - - -	ch
. - . -	ä
. . - -	ü
- - - .	ö
. . - . .	é

1.6. Cut Numbers

All CIS forces use Cut Numbers in their 5LG messages; long figures are replaced by shorter letters. We can evaluate the final group containing day and group count. Several sets of Cut Numbers are in use, these are the two mostly used:

Figure	1	2	3	4	5	6	7	8	9	0
Set 1	A	B	W	G	D	E	V	Z	I	K
Set2	Ä	W	E	R	T	Y	U	I	O	P

1.7. Special Codes and Abbreviations

CIS Forces use Standard - and special Q and Z-Codes. In many cases "Q" is replaced by "Z", hence "ZSA" means "QSA". Even more confusing the codes may have different meanings dependant of the branch. More than 100 special codes are observed - many of them are understood; you may download my list here: Downloads.
CIS forces use the normal abbreviations, but additionaly there are some, which you may be less familiar with (some kindly have been published by UDXF members):

abs	Station not on duty.
abv	Repeat / I repeat.
ads	Addressee (at command post).
bn	Between
col	Collate.
cor	Correction
corcol	Rus. for group.
gr	Group
guhor	Rus. for: Nothing heard from you.
rk	Always use this frequency.
sig	Signature (of the sender).
sld	Rus. for "sledite": You're listening for my signals.
slv	Rus. for "slezhu": I'm listening for your signals.

1.8. Online Encrypted Morse Messages

Sometimes CIS Forces use Online Encrypted Morse. The plain text is entered manually via a keyboard and will be online encrypted sent away by the modem. This is why these messages are sent at varying speed. A series of dots indicate a completed message. Normally the stations work Simplex.

This following sample shows how RIW transmits an encrypted Morse message to RDND. Other Z-Codes may be used as well in this procedure, ZGR means "I will start Online Encrypted Morse now", and sometimes ZBD or ZBM indicate technical problems.

Frequency kHz	Text	Remarks
11000	RDND de RIW QRR 3 QDW 10388 k	Go to 1386 for online encrypted Morse tfc.
12464	RIW de RDND ok QRR 3 QDW 10388 k	RDND acknowledges.
10388	RDND de RIW ZZD 3 ZNÉ tridewätxtri k	I read you with QSA 3. My authentication is tridewätxtri.
10388	RIW de RDND ZZD 3 ZSL ZNÉ tridewätxtri ZNÉ odindwaodin k	I read you with QSA 3. Confirm your authentication tridewätxtri. My authentication is odindwaodin.
10388	RDND de RIW ZKM? k	Are you ready for Online Encrypted Morse Traffic?
10388	RIW de RDND ZKM k	RDND affirmative
10388	RDND de RIW ZDS gugch ZZT kkvmlllkvmlllvklklvllvkll uwpliasdzhrttzsg...	Machine setting is gugch (normally used), the decryption key is ....... (made up of 25 characters of l, m, k and v), then message follows.

1.9. XXX Strategic Flash Messages

Since many years the Warsaw Pact / Russian / CIS Forces transmit xxx Flash Messages on their strategic and tactical Morse networks, but voice networks, like "The Buzzer", may as well transmit flash messages, . They are the counterpart to the EAM voice messages of the USAF on the HF-GCS network.

xxx Flash Messages are rather short and contain the following elements:
- one or several codewords
- identifiers of sender and addressee(s)
- instructions about who is going to act or react.

xxx Messages are initiated by a high ranking station and are repeated by other NCS (Net Control Stations) within 5 to 20 min after the first transmission. We know that many xxx Messages first are heard on the High Command (VGK) VLF network and then are repeated by the Fleet HQ and by tactical networks. There are, however, Flash Messages being heard first on a Fleet HQ frequency and later on VLF.

There are some examples of a repeated Flash Message:
24.12.2000 1230z: 74148 antimonate 2637 0931 k
24.12.2000 1245z: 61211 antimonate 2637 0931 k
This could indicate, the first addressee 74148 did, for some reasons, not acknowledge the message and therefore a second addressee 61211 was called, or, shortly after 1230z it became clear, a second instance should receive this same message. Both cases suggest the 5-figures-group is the target.

What are these Flash Messages for?
The first step would, of course, be the attempt to correlate the number of messages and the activity of the Navy, e.g. during naval exercises or political tensions. That is true for CIS Navy exercises, but in multinational manouevres I never noted an increase in traffic.

The messages are too short for much information, they are only used to put into force a pre-determined scenario, details of which have been agreed upon in advance or on other comms channels. One good example sometimes can be found with luck: Flash Messages do activate sleeping, tactical networks. These become quite busy with traffic shortly upon reception of a xxx Message, even if you didn't hear them before for many hours.

We only look at a few communication channels of the Navy, but there are many others beyond our technical possibilities. Our findings are very limited therefore, and we even may assume, that xxx Messages don't turn the Navy upside down, there are simply so many of them.
Strategic Flash Messages on the Navy's VLF Network are of great significance, because they are issued by the General Staff/High Command in Moscow. Read more about these transmissions here: The Navy in the Strategic Nuclear Forces

xxx Messages do come in many flavours:
This was a standard Flash Message from RMP on 6873 kHz:
xxx xxx REO REO 90326 brosanje 8616 7037 (repeated) k

- REO is the addressee, in this case a collective callsign belonging to the Baltic Fleet.
- 90326 probably indicates who should act.
- brosanje is the codeword, always a noun.
- 8616 7037 belong to the codeword and this seems to be sort of an "instruction set"
- k indicates an acknowledgment is expected on some channel.

But there are many exceptions:
Virtually any message format is possible, even this one:
xxx xxx IR43 050: P-16606 niöeskaa prowerka atos-838 chawyrin 838 k.
These are operational/service messages.

The codewords podarok and ustrelina are used for a special (yet unknown) purpose:
xxx RDL 52378 podarok 01 1030 175 225 1130 k.
1030 and 1130 suggest time, but that doesn't fit always.

In September 2010 I noted a new format of messages on 12464 kHz, the daytime primary frequency of CIS stations:
xxx RFH77 80744 bartkulowyj 0548 5707 k

Callsigns RMUW and RHQ33 were heard as well with xxx Messages, but this leaves us with the question, who the sender was.

Examples:
This message was broadcast on 18.1 kHz at 12.04.2006 1319z by the General Staff:
xxx xxx RDL RDL 25001 95801 brennyj 5369 1092 k
4 min later, on 11155 kHz, the Northern Fleet HQ RIT in Severomorsk repeats:
xxx xxx RLO RLO 95801 brennyj 5369 1092 k
The "instruction set" did not change, but the message now goes to the collective callsign RLO, which belongs to the Northern Fleet and therefore the group "25001" is void.

Another message on 18.1 kHz at 01.05.2006 0700z issued by the General Staff:
xxx xxx RKS RKS 27342 paraplica 5202 3615 k
5 min later, on 11155 kHz, Northern Fleet HQ RIT repeats:
xxx xxx RKS RKS 27342 paraplica 5202 3615 k

Unit RMGB, most probably a vessel, didn't get it and asks on 12464 kHz:
RCV de RMGB rpt xxx k
Now we know, the message has been disseminated by the Black Sea Fleet HQ RCV as well and it will now repeat the Flash Message for RMGB on the primary 10201 kHz.

Later on RMGB confirms on 12464 kHz:
RCV de RMGB rpt 27342 paraplica 5202 3615 k
RKS is not repeated, because RMGB is part of RKZ.

Flash Messages may contain several codewords:
xxx xxx RDL RDL 63191 83795 waloprowod 8067 4649 taikarpin 7436 4920 baläbus 7969 5452 k

Up to five "instruction sets" I have heard in the same Flash Message.

Some codewords may be used again after years, some can be translated, giving results like "banquet", "youth" or "thread", others cannot.

Only once I heard a codeword, which (possibly) made sense:
The codeword nitka was used October 27th 2004 by Navy HQ Moscow. One week before, during CIS Navy exercises in the North Atlantic, an emergency was noted onboard the Northern Fleet's Aircraft Carrier Admiral Kuznetsov, when a SU-25 UTG aircraft made a hard landing and damaged the superstructure. There was much critisism about these exercises, because for 7 years the carrier was not on sea with its air wing for practice. 2004 the pilots tried to keep in trim by flying from a simulated takeoff and landing pad on the Crimea peninsula. This facility, built by the former Sovjet Union, is named "Nitka". (Source RIA Novosty)

In fact there are even xxx Messages which can be decoded:
31.12.2008, RIT on 7954 kHz sent this message:
xxx xxx xxx RLO RLO weter 2 po belomu morü k (wind 2 over the White Sea)

It seems, that the trigram "xxx" can be used even for weather predictions, if appropiate.

Crimea: Nitka Air Base	Crimea: Nitka Air Base training ramp

1.10. RADIOPROGNOZ Messages

Since late 2006 I observed some messages of unidentified format. Fleet HQs sometimes disseminate a sort of report/outlook to collective callsigns, but do not use their primary frequencies. Messages are broadcasts and end with "+".
RADIOPROGNOZ messages have been heard on these frequencies: 6456, 5753, 7954, 6948 and 6877 kHz.

I don't think these are weather forecasts, because those use the header prognoz or prognoz pogody, gale warnings are chtormowoe preduprevdenie.
The Sovjet Technical Encyclopedia offered the following translation:
Radio Prognoz = Forecast of the Ionosphere (Propagation Forecast)
And this, most probably, is it.

This is an example:
31.12.2008 1000z 7954 kHz

RLO RLO RLO de RIT RIT QTC 106 40 31 1257 106 = radioprognoz =
31127 63003 42222
00001 01218 30080
00002 01218 30090
00005 01218 60014
00006 01218 50010
00102 01218 40090
00001 01824 30070
00002 01824 30080
00005 01824 60012
00006 01824 40010
00102 01824 30090
00022 01218 50012
00022 01824 40011
+

The first row may indicate the region of the forecast,
the second row obviously indicates the period of validity (12...18h or 18...24h),
the third row may indicate forecast values.
What worries me is the fact, that I haven't seen yet forecasts for the period of 0000...1200z, that doesn't make my nice interpretation too convincing....

1.11. FM13-Code Meteorological Data

Some ships do transmit Sea State and Weather conditions to their HQ. They are formatted as WMO Buoy Meteorological Data in FM-13 code. These messages do include a position report in groups 2 and 3.
A message may start like this:
28121 99259 70859 46/// .....

Please note, station identifiers are suppressed.
28121 28th day of the month, at 12 h UTC
99259 25.9° N latitude
70859 85.9° W longitude at globe quadrant:
10 N latitude, E longitude
30 S latitude, E longitude
50 S latitude, W longitude
70 N latitude, W longitude
following meteorological data.

It seems FM-13 coded messages are sent by ships of the Hydrographic Service of the Russian Federation Navy as well as by auxiliary ships escorting a task force. All messages are directed to certain callsigns: 3. Special Purpose Callsigns




Top of Page