I finally found the information I need:
http://wiki.mikrotik.com/wiki/Manual:Switch_Chip_Features
The setting for “VLAN Header” is applied on outgoing traffic and untagged incomming traffic is tagged with default VLAN ID.
I needed a while to understand, that the switch layer VLAN settings are independent of the interface VLAN settings. If you put all your ports in a switch group and let the switch layer tag all incomming traffic with a VLAN ID (for example ID99), use secure mode on all ports and on “switch1 cpu” but forget to add a VLAN interface for ID99 to the master port, you locked yourself out of your device. All traffic reaching the router is now tagged as ID99 but the router is ignoring that VLAN.
So long
John