Appendix B


NOTE:  References to Appendices as used in this section refer to the 2002 FEC Voting System Standards, not the Appendices contained within this ITB.   For more detailed information, refer to the complete listing of standards at           Time, Sequence, and Preservation of Audit Records 

The timing and sequence of audit record entries is as important as the data contained in the record. All voting systems shall meet the following requirements for time, sequence and preservation of audit records: 

a.       Except where noted, systems shall provide the capability to create and maintain a real-time audit record. This capability records and provides the operator or precinct official with continuous updates on machine status. This information allows effective operator identification of an error condition requiring intervention, and contributes to the reconstruction of election-related events necessary for recounts or litigation.

b.       All systems shall include a real-time clock as part of the system’s hardware. The system shall maintain an absolute record of the time and date or a record relative to some event whose time and data are known and recorded.

c.       All audit record entries shall include the time-and-date stamp.

d.       The audit record shall be active whenever the system is in an operating mode. This record shall be available at all times, though it need not be continually visible.

e.       The generation of audit record entries shall not be terminated or altered by program control, or by the intervention of any person. The physical security and integrity of the record shall be maintained at all times.

f.         Once the system has been activated for any function, the system shall preserve the contents of the audit record during any interruption of power to the system until processing and data reporting have been completed.

g.       The system shall be capable of printing a copy of the audit record. A separate printer is not required for the audit record, and the record may be produced on the standard system printer if all the following conditions are met:

1)       The generation of audit trail records does not interfere with the production of output reports;

2)       The entries can be identified so as to facilitate their recognition, segregation, and retention; and

The audit record entries are kept physically secure.

2.2.7     Accessibility 

The Standards provide requirements for voting systems to meet the accessibility needs of a broad range of voters with disabilities.  To do so, it is anticipated that a vendor will have to either configure all of the system’s voting stations to meet the accessibility specifications or will have to design a unique station that conforms to the accessibility requirements and is part of the overall voting system configuration.  Efforts to meet the accessibility requirements shall not violate the privacy, secrecy, and integrity demands of the Standards.

 2.2.71   Common Standards 

To facilitate accessibility, all voting systems shall be capable of meeting the following conditions, as illustrated in Figures 2-1 through 2-4: 

a.       Where clear floor space only allows forward approach to an object, the maximum high forward reach allowed shall be 48inches.  The minimum low forward reach is 15 inches.

b.       Where forward reach is over an obstruction with knee space below, the maximum level forward reach is 25 inches.  When the obstruction is less than 20 inches deep, the maximum high forward reach is 48 inches.  When the obstruction projects 20 to 25 inches, the maximum high forward reach is 44 inches.

c.       The position of any operable control is determined with respect to a vertical plane that is 48 inches in length, centered on the operable control, and at the maximum protrusion of the product within the 48-inch length;

d.       Where any operable control is 10 inches or less behind the reference plane, have a height that is between 15 inches and 54 inches above the floor;

e.       Where any operable control is more than 10 inches and not more than 24 inches behind the reference plane, have a height between 15 inches and 46 inches above the floor; and

f.         Have operable controls that are not more than 24 inches behind the reference plane.

Figure 2-1

Figure 2-1

Figure 2-2

Figure 2-2



Figure 2-3

Figure 2-3


Figure 2-4

Figure 2-4  DRE Standards 

DRE voting systems shall provide, as part of their configuration, the capability to provide access to voters with a broad range of disabilities. This capability shall:

a.       Not require, the voter to bring their own assistive technology to a polling place;

b.       Provide audio information and stimulus that:

1)       Communicates to the voter the complete content of the ballot;

2)       Provides instruction to the voter in operation of the voting device;

3)       Provides instruction so that the voter has the same vote capabilities and options as those provided by the system to individuals who are not using audio technology;

4)       For a system that supports write-in voting, enables the voter to review the voter’s write-in input, edit that input, and confirm that the edits meet the voter’s intent;

5)       Enables the voter to request repetition of any information provided by the system;

6)       Supports the use of headphones provided by the system that may be discarded after each use;

7)       Provides the audio signal through an industry standard connector for private listening using a 1/8 inch stereo headphone jack to allow individual voters to supply personal headsets; and

8)       Provides a volume control with an adjustable amplification up to a maximum of 105 dB that automatically resets to the default for each voter;

c.       Provide, in conformance with FCC Part 68, a wireless coupling for assistive devices used by people who are hard of hearing when a system utilizes a telephone style handset to provide audio information;

d.       Meet the requirements of ANSI C63.19-2001 Category 4 to avoid electromagnetic interference with assistive hearing devices;

e.       For electronic image displays, permit the voter to:

1)       Adjust the contrast settings;

2)       Adjust color settings, when color is used; and

3)       Adjust the size of the text so that the height of capital letters varies over a range of 3 to 6.3 millimeters;

f.         For a device with touchscreen or contact-sensitive controls, provide an input method using mechanically operated controls or keys that shall:

1)       Be tactilely discernible without activating the controls or keys;

2)       Be operatable with one hand and not require tight grasping, pinching, or twisting of the wrist;

3)       Require a force less than 5 lbs (22.2 N) to operate; and

4)       Provide no key repeat function;

g.       For a system that requires a response by a voter in a specific period of time, alert the voter before this time period has expired and allow the voter additional time to indicate that more time is needed;

h.       For a system that provides sound cues as a method to alert the voter about a certain condition, such as the occurrence of an error, or a confirmation, the tone shall be accompanied by a visual cue for users who cannot hear the audio prompt; and

i.         Provide a secondary means of voter identification or authentication when the primary means of doing so uses biometric measures that require a voter to possess particular biological characteristics.

2.4.3 Casting a Ballot 

Some required capabilities for casting a ballot are common to all systems. Others are specific to individual voting technologies or intended use. Systems must provide additional functional capabilities that enable accessibility to disabled voters as defined in Section 2.2.7 of the Standards. Common Standards 

To facilitate casting a ballot, all systems shall:

a.       Provide text that is at least 3 millimeters high and provide the capability to adjust or magnify the text to an apparent size of 6.3 millimeters;

b.       Protect the secrecy of the vote such that the system cannot reveal any information about how a particular voter voted, except as otherwise required by individual State law;

c.       Record the selection and non-selection of individual vote choices for each contest and ballot measure;

d.       Record the voter’s selection of candidates whose names do not appear on the ballot, if permitted under State law, and record as many write-in votes as the number of candidates the voter is allowed to select;

e.       In the event of a failure of the main power supply external to the voting system, provide the capability for any voter who is voting at the time to complete casting a ballot, allow for the graceful shutdown of the voting system without loss or degradation of the voting and audit data, and allow voters to resume voting once the voting system has reverted to back-up power; and

f.         Provide the capability for voters to continue casting ballots in the event of a failure of a telecommunications connection within the polling place or between the polling place and any other location. Paper-Based Systems Standards 

The standards for casting a ballot for paper-based systems consist of common standards and additional standards that apply to precinct count paper-based systems. All Paper-Based Systems 

All paper-based systems shall:

a.       Allow the voter to easily identify the voting field that is associated with each candidate or ballot measure response;

b.       Allow the voter to punch or mark the ballot to register a vote;

c.       Allow either the voter or the appropriate election official to place the voted ballot into the ballot counting device (for precinct count systems) or into a secure receptacle (for central count systems); and

d.       Protect the secrecy of the vote throughout the process. Precinct Count Paper-Based Systems 

In addition to the above requirements, all paper-based precinct count systems shall:

a.       Provide feedback to the voter that identifies specific contests or ballot issues for which an overvote or undervote is detected;

b.       Allow the voter, at the voter’s choice, to vote a new ballot or submit the ballot ‘as is’ without correction; and

c.       Allow an authorized election official to turn off the capabilities defined in ‘a’ and ‘b’ above. DRE Systems Standards 

In addition to the above common requirements, DRE systems shall:

a.       Prohibit the voter from accessing or viewing any information on the display screen that has not been authorized by election officials and preprogrammed into the voting system (i.e., no potential for display of external information or linking to other information sources);

b.       Enable the voter to easily identify the selection button or switch, or the active area of the ballot display that is associated with each candidate or ballot measure response;

c.       Allow the voter to select his or her preferences on the ballot in any legal number and combination;

d.       Indicate that a selection has been made or canceled;

e.       Indicate to the voter when no selection, or an insufficient number of selections, has been made in a contest;

f.         Prevent the voter from overvoting;

g.       Notify the voter when the selection of candidates and measures is completed;

h.       Allow the voter, before the ballot is cast, to review his or her choices and, if the voter desires, to delete or change his or her choices before the ballot is cast;

i.         For electronic image displays, prompt the voter to confirm the voter's choices before casting his or her ballot, signifying to the voter that casting the ballot is irrevocable and directing the voter to confirm the voter’s intention to cast the ballot;

j.         Notify the voter after the vote has been stored successfully that the ballot has been cast;

k.       Notify the voter that the ballot has not been cast successfully if it is not stored successfully, including storage of the ballot image, and provide clear instruction as to the steps the voter should take to cast his or her ballot should this event occur;

l.         Provide sufficient computational performance to provide responses back to each voter entry in no more than three seconds;

m.     Ensure that the votes stored accurately represent the actual votes cast;

n.       Prevent modification of the voter’s vote after the ballot is cast;

o.       Provide a capability to retrieve ballot images in a form readable by humans (in accordance with the requirements of Section and;

p.       Increment the proper ballot position registers or counters;

q.       Protect the secrecy of the vote throughout the voting process;

r.        Prohibit access to voted ballots until after the close of polls;

s.       Provide the ability for election officials to submit test ballots for use in verifying the end-to-end integrity of the system; and

t.    Isolate test ballots such that they are accounted for accurately in vote counts and are not reflect in official vote counts for specific candidates or measures.

3.2.1 Accuracy Requirements 

Voting system accuracy addresses the accuracy of data for each of the individual ballot positions that could be selected by a voter, including the positions that are not selected. For a voting system, accuracy is defined as the ability of the system to capture, record, store, consolidate and report the specific selections and absence of selections, made by the voter for each ballot position without error. Required accuracy is defined in terms of an error rate that for testing purposes represents the maximum number of errors allowed while processing a specified volume of data. This rate is set at a sufficiently stringent level such that the likelihood of voting system errors affecting the outcome of an election is exceptionally remote even in the closest of elections. 

The error rate is defined using a convention that recognizes differences in how vote data is processed by different types of voting systems. Paper-based and DRE systems have different processing steps. Some differences also exist between precinct count and central count systems. Therefore, the acceptable error rate applies separately and distinctly to each of the following functions: 

a.       For all paper-based systems:

1)       Scanning ballot positions on paper ballots to detect selections for individual candidates and contests;

2)       Conversion of selections detected on paper ballots into digital data;

b.       For all DRE systems:

1)       Recording the voter selections of candidates and contests into voting data storage; and

2)       Independently from voting data storage, recording voter selections of candidates and contests into ballot image storage.

c.       For precinct-count systems (paper-based and DRE): 

Consolidation of vote selection data from multiple precinct-based systems to generate jurisdiction-wide vote counts, including storage and reporting of the consolidated vote data; and

d.       For central-count systems (paper-based and DRE): 

Consolidation of vote selection data from multiple counting devices to generate jurisdiction-wide vote counts, including storage and reporting of the consolidated vote data.

For testing purposes, the acceptable error rate is defined using two parameters: the desired error rate to be achieved, and the maximum error rate that should be accepted by the test process.  

For each processing function indicated above, the system shall achieve a target error rate of no more than one in 10,000,000 ballot positions, with a maximum acceptable error rate in the test process of one in 500,000 ballot positions.

3.4.9 Human Engineering—Controls and Displays 

All voting systems and components shall be designed and constructed so as to simplify and facilitate the functions required, and to eliminate the likelihood of erroneous stimuli and responses on the part of the voter or operator.  Other specific requirements for controls and displays are described below.  In addition, specific functional requirements for system use by voters with disabilities are described in Section 2.2.7 of the Standards.  Appendix C provides additional advisory guidance on the application of human engineering principles to the interface between the voter and the voting system.

All voting systems shall meet the following requirements for controls and displays: 

a.       In all systems, controls used by the voter or equipment operator shall be conveniently located, shall use designs that are consistent with their functions, and shall be clearly labeled. Instruction plates shall be provided, if they are necessary to avoid ambiguity or incorrect actuation;

b.       Information or data displays shall be large enough to be readable by voters and operators with no disabilities and by voters with disabilities consistent with the requirements defined is Section 2.2.7 of the Standards;

c.       Status displays shall meet the same requirements as data displays, and they shall also follow conventional industrial practice with respect to color:

1)       Green, blue, or white displays shall be used for indications of normal status;

2)       Amber indicators shall be used to indicate warnings or marginal status; and

3)       Red indicators shall be used to indicate error conditions or equipment states that may result in damage, or in hazards to personnel; and unless the equipment is designed to halt under conditions of incipient damage or hazard, an audible alarm shall also be provided.

d.       Color coding shall be selected so as to assure correct perception by voters and operators with color blindness; and shall not be used as the only means of conveying information, indicating an action, prompting a response, or distinguishing a visual element (see Appendix B for suggested references); and

e.       The system’s display shall not use flashing or blinking text objects, or other elements having a flash or blink frequency, greater than 2 Hz and lower than 55 Hz.