# Analysis of ZEVS messages

Russia uses radiocommunications in the ELF band to send messages to it’s  nuclear submarine fleet. This transmitter it called ZEVS, the frequency is 82Hz (yes: hertz, not kilohertz, not megahertz). For more info see here: http://www.vlf.it/zevs/zevs.htm

I’ve installed a grabber on the KLUBNL.PL page showing the spectrum around 82Hz. It is available here: https://klubnl.pl/wpr/index.php/klubnl-pl-grabbers/grabber-zevs-82hz/

This grabber calculates the spectrum in 80-84Hz every 60 seconds, and makes spectrograms out of it. The files with the spectrum information are not deleted, so out out of coincidence i have a history of data from 25 August 2021 until now (around 10 June 2022).

And since i have this data, it would be nice to do an analysis how the messages to the submarine fleet look like, and how often are they transmitted.

#### WHAT is ZEVS

ZEVS is a transmitter located on the Kola penisula in Russia. It transmits around 82Hz. For more info see here: http://www.vlf.it/zevs/zevs.htm

Radio waves can enter a conductor into a depth which is proportional to the wavelength (the “skin effect”). At a frequency of 82Hz the wavelength is around 3500km, so electromagnetic waves of this frequency can penetrate deeply into even a good conductor. An example of such well conducting medium is ocean saltwater, where the russian nuclear fleet is hidden.

#### How does the ZEVS transmission look like

ZEVS uses MFSK modulation (multiple frequency shift keying). The messages are transmitted as 4 minute symbols on the following frequencies around 82Hz every 0.2Hz: 80.8Hz, 81.0Hz, 81.2Hz, 81.4Hz, 81.6Hz, 81.8Hz, 82.0Hz, 82.2Hz, 82.4Hz, 82.6Hz, 82.8Hz, 83.0Hz, 83.2Hz. The symbol time is 4 minutes.

A typical message starts with a signal at 82.0Hz which lasts at least 4 minutes (the symbol time). Then usually 7 symbols are transmitted (with a frequency other than 82.0Hz).  Then a 82.0Hz signal is transmitted for a duration of at leat one symbol time (usually longer). After this another message may be transmitted.

The transmission speed is very low. One symbol takes 4 minutes, so the transmission speed is 0.00416 baud. One symbol can have 12 possible values (frequencies), so the resulting transmission speed is 0.05 bit/s.

With this low transmission speed, only short messages are possible, like “go to the surface and start radio contact” (transmission on higher frequencies, possibly via satellite) etc.

#### Analysing ZEVS messages

Grabber ZEVS uses vtnspec from the excellent vlfrx-tools software package. My scripts produce a file containing the amplitude and phase of signals at 80-84Hz. These files are produced every 60 seconds, and are not deleted afterwards, so i have a dataset from 25 August 2021 (when the grabber was started).

I’ve published the analysis software on github: https://github.com/sq5bpf/zevs-analysis , and the raw dataset on  https://klubnl.pl/zevs/ .

The file names are named after the unix time (seconds since January 1st 1970). Every file has 4 columns, we will use the 1st (frequency) and the 4th (RMS signal magnitude). Below is an example fragment of such file:

```80.00000800 2.080809e-05 -6.614392e-06 1.543902e-05
80.01667460 -9.690319e-07 -1.231563e-05 8.735385e-06
80.03334120 -1.651825e-05 -1.124793e-05 1.413097e-05
80.05000780 3.791154e-05 4.053642e-05 3.924593e-05
80.06667440 -1.471637e-05 5.985279e-06 1.123377e-05
80.08334100 -9.629256e-06 -3.050421e-05 2.261890e-05
80.10000760 2.780673e-05 -5.441355e-05 4.320908e-05
80.11667420 1.100251e-05 -1.696162e-05 1.429601e-05
80.13334080 -9.189010e-06 9.730371e-06 9.463563e-06
80.15000740 -1.405457e-05 1.576747e-05 1.493560e-05
80.16667400 1.738760e-05 -1.409283e-05 1.582618e-05
80.18334060 -1.262028e-05 1.509170e-05 1.391098e-05
80.20000720 8.167513e-06 -4.741268e-06 6.677870e-06```

The script parse_zevsdir.py parses these files and for each file shows the strongest frequency among the ZEVS frequencies (80.8Hz, 81.0Hz, 81.2Hz, 81.4Hz, 81.6Hz, 81.8Hz, 82.0Hz, 82.2Hz, 82.4Hz, 82.6Hz, 82.8Hz, 83.0Hz, 83.2Hz). The output columns are: unix time, frequency, frequency number, ratio between the magnitude of the signal at this frequency and average magnitude of the signals at all ZEVS frequencies. Below is a sample fragment of the zevs_freqs_sort.txt file produced by this software:

```1632377640 82.0 6 3.995966126481902
1632377700 82.0 6 4.556940016791662
1632377760 82.0 6 4.633025466806067
1632377820 82.0 6 3.3868055060207185
1632377880 82.0 6 4.740975119809921
1632377940 82.0 6 5.11617772048708
1632378000 81.8 5 4.459848476522538
1632378060 81.8 5 4.015745251712207
1632378120 81.8 5 4.694808175258413
1632378180 81.8 5 4.106103048877824
1632378240 81.0 1 3.5646719240089353
1632378300 81.0 1 3.615036406798705
1632378360 81.0 1 4.2008744417491215
1632378420 81.0 1 5.590069419164877
1632378480 82.2 7 3.146938764362389
1632378540 82.2 7 4.295193254532285
1632378600 82.2 7 4.868673065778755
1632378660 82.2 7 4.732058527394183
1632378720 80.8 0 4.15435113800186
1632378780 80.8 0 4.522000216433235```

The second script find_zevs_transmissions.py looks for a message sequence in this data. The sequence is: 82.0Hz , a message consisting of frequencies other than 82.0Hz, 82.0Hz. The result has the following columns: UTC time, number of symbols in the message, the symbol frequencies, a text representation of this message (each frequency is represented by one letter), the number of times this message appeared. Below is a sample fragment of the zevs_messages.txt file produced by this software:

```2021-08-26 04:08:00+00:00 | 7 tones: [81.8, 81.8, 81.8, 80.8, 81.8, 81.8, 81.8] fffAfff ( 1 )
2021-08-26 04:40:00+00:00 | 7 tones: [82.4, 81.6, 81.4, 80.8, 82.4, 81.6, 81.4] IEdAIEd ( 1 )
2021-08-27 06:04:00+00:00 | 7 tones: [81.4, 82.6, 82.6, 80.8, 81.4, 82.6, 82.6] djjAdjj ( 1 )
2021-08-27 06:36:00+00:00 | 7 tones: [82.6, 82.8, 81.0, 80.8, 82.6, 82.8, 81.0] jKbAjKb ( 1 )
2021-08-27 11:52:00+00:00 | 7 tones: [81.0, 81.0, 82.8, 80.8, 81.0, 81.0, 82.8] bbKAbbK ( 2 )
2021-08-27 22:48:00+00:00 | 7 tones: [82.2, 82.2, 81.0, 80.8, 82.2, 82.2, 81.0] hhbAhhb ( 1 )
2021-08-28 03:32:00+00:00 | 7 tones: [82.4, 81.0, 82.6, 80.8, 82.4, 81.0, 82.6] IbjAIbj ( 1 )
2021-08-29 05:16:00+00:00 | 7 tones: [81.6, 81.4, 81.8, 80.8, 81.6, 81.4, 81.8] EdfAEdf ( 1 )
2021-08-30 04:28:00+00:00 | 7 tones: [82.8, 81.0, 81.0, 80.8, 82.8, 81.0, 81.0] KbbAKbb ( 1 )
2021-08-31 03:48:00+00:00 | 7 tones: [81.0, 81.4, 82.8, 80.8, 81.0, 81.4, 82.8] bdKAbdK ( 1 )
2021-09-01 05:40:00+00:00 | 7 tones: [81.2, 83.0, 82.6, 80.8, 81.2, 83.0, 82.6] CljAClj ( 1 )
2021-09-10 07:28:00+00:00 | 7 tones: [82.4, 81.6, 81.0, 80.8, 82.4, 81.6, 81.0] IEbAIEb ( 1 )
2021-09-11 03:20:00+00:00 | 7 tones: [82.8, 83.0, 82.6, 80.8, 82.8, 83.0, 82.6] KljAKlj ( 1 )```

Using this software we can automatically find all of the times when a message was transmitted, the message contents, and generate spectrograms of all messages. The spectrograms can be used to assess different types of ZEVS messages.

#### ZEVS message types

The most common message starts with 82.0Hz (one symbol time – 4 minutes), then 7 symbols with frequencies other than 82.0Hz, and then 82.0Hz again usually for much longer than one symbol time (much more than 4 minutes). This type of message is the most frequent:

Often the 82.0Hz is transmitted for much longer, sometimes many hours. The rest of the message structure is the same (82.0Hz, 7 symbols, 82.0Hz):

In many systems using MFSK there is an additional tone transmitted if the previous tone would be repeated (this is called the repeat tone). In case of ZEVS this is not used, and we can see one frequency repeating for the duration of two or even three symbol times. Below we can see three consecutive symbols with the same frequency:

The messages can be sent immediately one after the other. In this case we see the 82.0Hz carrier, 7 symbols, short 82.0Hz carrier, another 7 symbols and 82.0Hz carrier:

In some cases the 82.0Hz carrier between the messages is shortened to one symbol time. Below is an example of 3 messages being sent one after the other: long 82.0Hz carrier, 7 symbol message, 82.0Hz carrier with a length of 2 symbols, a second 7 symbol message, 82.0Hz carrier with a length of 1 symbol, a third 7 symbol message, and a long 82.0Hz carrier:

Sometimes there are messages which have a different number of symbols than 7. Below a message with a 82.0Hz carrier, 2 symbols, 82.0Hz (1 symbol length), 7 symbols, and a 82.0Hz carrier.  This shows that there are other valid message structures besides the 82.0Hz, 7 symbol message, 82.0Hz type. I don’t know it this is one message, or two messages (a 2 symbol message, and a 7 symbol message):

There are also messages which don’t end with 82.0Hz. Below one 82.0Hz symbol, then a 4 symbol message, a long period of silence, and then a normal message (one 82.0Hz symbol, 7 symbol message, long 82.0Hz carrier). I don’t know if the first 4-symbol message is a valid message, maybe the propagation was suddenly worse and I didn’t receive all of it (doesn’t seem so), or maybe the message was cancelled mid-transmission, or maybe this is a valid message, and i can’t rely on the ending 82.0Hz carrier (in this case my software needs to be corrected):

The second message can also be different than 7 symbols. Below we have a 82.0Hz carrier, a 7 symbol message, one 82.0Hz symbol, 8 well visible symbols, 2 less visible symbols at 80.8Hz (I’m not sure if this isn’t interference), and a 82.0Hz carrier:

I’ve also seen the frequency jump to a frequency not normally used. Below we have a short jump at the beginning of the fourth symbol. I don’t know if this is very strong and short interference, a different encoding or operator error, some different message, or a means to cancel the message mid-transmission:

#### How often are the same messages transmitted

The messages should be encrypted, so should seem random to an external observer. In my analysis a single message doesn’t repeat more than 3 times, with most of them are unique. Out of 401 detected messages 316 are unique.

#### Summary

I’ve published a dataset from a period of 9 months (with approximately 2 months of breaks) from an ELF receiver monitoring ZEVS at 80.0-84.0Hz. I have also published (simple) software to automatically analyze this data:

• automatically find the ZEVS transmit frequency
• automatically find the ZEVS messages
• analyze and visualize this data
• automatically generate spectrograms of these messages, to assess the performance of this software

I hope that other may be published from  hobbyists, geophysical monitoring stations etc, so that we can compare results.

By publishing this i hope for some peer review. I hope that others will critically analyze this data and software, and will try to take the analysis further, or try to invalidate it.  The algorithms used are quite naive, the spectrum could be glanced over by a human to see if there aren’t some completely different message types which were not caught by this software.

EDIT 20220705: during further work i have found that some information contained here is either imprecise (for example information that the 7-symbol message repeats 3 of the symbols, so the message is  82.0Hz, A, B, C, 80.8Hz, A, B, C, 82.0Hz) or needs to be further extended  (for example a description of the MSK transmissions on 80.8Hz is missing). After this work is done i hope to publish a revised and complete description of ZEVS.

If you use this work, or have any comments, please send me an email

Author: Jacek Lipkowski SQ5BPF  < sq5bpf (at) lipkowski.org >