3 Hardware Standards

3.1 Scope

This section contains the requirements for the machines and manufactured devices that are part of a voting system. It specifies minimum values for certain performance characteristics; physical characteristics; and design, construction, and maintenance characteristics for the hardware and selected related components of all voting systems, such as:

¨ Ballot printers;

¨ Ballot cards and sheets;

¨ Ballot displays;

¨ Voting devices, including punching and marking devices and DRE recording devices;

¨ Voting booths and enclosures;

¨ Ballot boxes and ballot transfer boxes;

¨ Ballot readers;

¨ Computers used to prepare ballots, program elections, consolidate and report votes, and perform other elections management activities;

¨ Electronic ballot recorders;

¨ Electronic precinct vote control units;

¨ Removable electronic data storage media;

¨ Servers; and

¨ Printers.

This section applies to the combination of software and hardware to accomplish specific performance and system control requirements. Standards that are specific to software alone are provided in Section 4 of the Standards.

3.1.1 Hardware Sources

The requirements of this section apply generally to all hardware used in voting systems, including:

a. Hardware provided by the voting system vendor and its suppliers;

b. Hardware furnished by an external provider (for example, providers of commercial off-the-shelf (COTS) machines and devices) where the hardware may be used in any way during voting system operation; and

c. Hardware provided by the voting jurisdiction.

3.1.2 Organization of this Section

The standards presented in this section are organized as follows:

¨ Performance Requirements: These requirements address the combined operational capabilities of the voting system’s hardware and software across a broad range of parameters;

¨ Physical Requirements: These requirements address the size, weight and transportability of the voting system; and

¨ Design, Construction, and Maintenance Requirements: These requirements address the reliability and durability of materials, product marking, quality of system workmanship, safety, and other attributes to ensure smooth system operation in the voting environment.

3.2 Performance Requirements

The performance requirements address a broad range of parameters, encompassing:

a. Accuracy requirements, where requirements are specified for distinct processing functions of paper-based and DRE systems;

b. Environmental requirements, where no distinction is made between requirements for paper-based and DRE systems, but requirements for precinct and central count are described;

c. Vote data management requirements, where no differentiation is made between requirements for paper-based and DRE systems;

d. Vote recording requirements, where separate and distinct requirements are delineated for paper-based and DRE systems;

e. Conversion requirements, which apply only to paper-based systems;

f. Processing requirements, where separate and distinct requirements are delineated for paper-based and DRE systems; and

g. Reporting requirements, where no distinction is made between requirements for paper-based and DRE systems, but where differences between precinct and central count systems are readily apparent based on differences of their reporting.

The performance requirements include such attributes as ballot reading and handling requirements; system accuracy; memory stability; and the ability to withstand specified environmental conditions. These characteristics also encompass system-wide requirements for shelter, electrical supply, and compatibility with data networks.

Performance requirements for voting systems represent the combined operational capability of both system hardware and software. Accuracy, as measured by data error rate, and operational failure are treated as distinct attributes in performance testing. All systems shall meet the performance requirements under operating conditions and after storage under non-operating conditions.

3.2.1 Accuracy Requirements

Voting system accuracy addresses the accuracy of data for each of the individual ballot positions that could be selected by a voter, including the positions that are not selected. For a voting system, accuracy is defined as the ability of the system to capture, record, store, consolidate and report the specific selections and absence of selections, made by the voter for each ballot position without error. Required accuracy is defined in terms of an error rate that for testing purposes represents the maximum number of errors allowed while processing a specified volume of data. This rate is set at a sufficiently stringent level such that the likelihood of voting system errors affecting the outcome of an election is exceptionally remote even in the closest of elections.

The error rate is defined using a convention that recognizes differences in how vote data is processed by different types of voting systems. Paper-based and DRE systems have different processing steps. Some differences also exist between precinct count and central count systems. Therefore, the acceptable error rate applies separately and distinctly to each of the following functions:

a. For all paper-based systems:

1) Scanning ballot positions on paper ballots to detect selections for individual candidates and contests;

2) Conversion of selections detected on paper ballots into digital data;

b. For all DRE systems:

1) Recording the voter selections of candidates and contests into voting data storage; and

2) Independently from voting data storage, recording voter selections of candidates and contests into ballot image storage.

c. For precinct-count systems (paper-based and DRE):

1) Consolidation of vote selection data from multiple precinct-based systems to generate jurisdiction-wide vote counts, including storage and reporting of the consolidated vote data; and

d. For central-count systems (paper-based and DRE):

1) Consolidation of vote selection data from multiple counting devices to generate jurisdiction-wide vote counts, including storage and reporting of the consolidated vote data.

For testing purposes, the acceptable error rate is defined using two parameters: the desired error rate to be achieved, and the maximum error rate that should be accepted by the test process.

For each processing function indicated above, the system shall achieve a target error rate of no more than one in 10,000,000 ballot positions, with a maximum acceptable error rate in the test process of one in 500,000 ballot positions.

3.2.2 Environmental Requirements

The environmental requirements for voting systems include shelter, space, furnishings and fixtures, supplied energy, environmental control equipment, and external telecommunications services. The TDP supplied by the vendor shall include a statement of all requirements and restrictions regarding environmental protection, electrical service, telecommunications service, and any other facility or resource required for the installation and operation of the system.

3.2.2.1 Shelter Requirements

All precinct count systems shall be designed for storage and operation in any enclosed and habitable facility ordinarily used as a warehouse or polling place, with prominent instructions as to any special storage requirements.

3.2.2.2 Space Requirements

There is no restriction on space allowed for the installation of voting systems, except that the arrangement of these systems shall not impede performance of their duties by polling place officials, or the orderly flow of voters through the polling place.

3.2.2.3 Furnishings and Fixtures

Any furnishings or fixtures provided as a part of voting systems, and any components not a part of the system but that are used to support its storage, transportation, or operation, shall comply with the design and safety requirements of Subsection 3.4.

3.2.2.4 Electrical Supply

Components of voting systems that require an electrical supply shall meet the following standards:

a. Precinct count systems shall operate with the electrical supply ordinarily found in polling places (120vac/60hz/1);

b. Central count systems shall operate with the electrical supply ordinarily found in central tabulation facilities or computer room facilities (120vac/60hz/1, 208vac/60hz/3, or 240vac/60hz/2); and

c. All systems shall also be capable of operating for a period of at least 16 hours on backup power. This capability shall include the provision of all power required to:

1) Activate voting, record votes, and count ballots (in DRE systems);

2) Count ballots (in paper-based systems);

3) Display all system status and error messages; and

4) Maintain the contents of program and data memory.

The backup power capability is not required to provide lighting of the voting area.

3.2.2.5 Environmental Control - Operating Environment

Equipment used for election management activities or vote counting (including both precinct and central count systems) shall be capable of operation in temperatures ranging from 50 to 95 degrees Fahrenheit.

3.2.2.6 Environmental Control - Transit and Storage

Equipment used for vote casting, or for counting votes in a precinct count system, shall meet specific minimum performance standards that simulate exposure to physical shock and vibration associated with handling and transportation by surface and air common carriers, and to temperature conditions associated with delivery and storage in an uncontrolled warehouse environment.

a. High and low storage temperatures ranging from -4 to +140 degrees Fahrenheit, equivalent to MIL-STD-810D, Methods 501.2 and 502.2, Procedure I-Storage;

b. Bench handling equivalent to the procedure of MIL-STD-810D, Method 516.3, Procedure VI;

c. Vibration equivalent to the procedure of MIL-STD-810D, Method 514.3, Category 1- Basic Transportation, Common Carrier; and

d. Uncontrolled humidity equivalent to the procedure of MIL-STD-810D, Method 507.2, Procedure I-Natural Hot-Humid.

3.2.2.7 Data Network Requirements

Voting systems may use a local or remote data network. If such a network is used, then all components of the network shall comply with the telecommunications requirements described in Section 5 of the Standards and the Security requirements described in Section 6.

3.2.3 Election Management System (EMS) Requirements

The EMS requirements address electronic hardware and software used to conduct the pre-voting functions defined in Section 2 with regard to ballot preparation, election programming, ballot and program installation, readiness testing, verification at the polling place, and verification at the central location.

3.2.3.1 Recording Requirements

Voting systems shall accurately record all election management data entered by the user, including election officials or their designees. For recording accuracy, all systems shall:

a. Record every entry made by the user;

b. Add permissible voter selections correctly to the memory components of the device;

c. Verify the correctness of detection of the user selections and the addition of the selections correctly to memory;

d. Add various forms of data entered directly by the election official or designee, such as text, line art, logos, and images.

e. Verify the correctness of detection of data entered directly by the user and the addition of the selections correctly to memory;

f. Preserve the integrity of election management data stored in memory against corruption by stray electromagnetic emissions, and internally generated spurious electrical signals;

g. Corrected data errors shall in these instances be logged by the system.

3.2.3.2 Memory Stability

Electronic system memory devices, used to retain election management data, shall have demonstrated error-free data retention for a period of 22 months.

3.2.4 Vote Recording Requirements

The vote recording requirements address the enclosure, equipment, and supplies used by voters to vote.

3.2.4.1 Common Standards

All systems shall provide voting booths for poll site use. Such booths may be integral to the voting system or supplied as components of the voting system, and shall:

a. Be integral to, or makes provision for, the installation of, the voting device;

b. Ensure by its structure stability against movement or overturning during entry, occupancy, and exit by the voter; and

c. Provide privacy for the voter, and be designed in such a way as to prevent observation of the ballot by any person other than the voter.

3.2.4.2 Paper-Based Recording Standards

The paper-based recording requirements govern:

¨ Ballot cards or sheets, and pages or assemblies of pages containing ballot field identification data;

¨ Punching devices;

¨ Marking devices;

¨ Frames or fixtures to hold the ballot while it is being punched;

¨ Compartments or booths where voters record selections; and

¨ Secure containers for the collection of voted ballots.

3.2.4.2.1 Paper Ballot Standards

Paper ballots used by voting systems shall meet the following standards:

a. Ballot cards or sheets shall meet the specifications stated by the vendor with respect to formulation, size, thickness, color, watermarks, layout, size and style of printing, arrangement of offices, and size and location of punch or mark fields.

b. Punchcard ballots and some marksense ballots may be counted or recounted on various card readers; therefore, card stock, size, opacity, color, field layout, orientation, folding, and bleed-through shall be specified by the vendor, and ballots shall conform to the specifications.

c. Printed or punched timing marks may be used for synchronizing the detection of voting punches or marks, provided that they do not appear in any of the data fields.

3.2.4.2.2 Punching Devices

Punching devices used by voting systems shall:

a. Be suitable for the type of ballot card specified;

b. Facilitate the clear and accurate recording of each vote intended by the voter; and

c. Incorporate features to ensure that the chad (debris) is completely removed, without damage to other parts of the ballot card.

3.2.4.2.3 Marking Devices

Marking devices (such as pens or pencils) used by voting systems shall:

a. Produce readable marked ballots such that the system meets the performance requirements for accuracy specified previously; and

b. Be specified in system documentation that identifies:

1) Specific characteristics of marking devices that affect readability of marked ballots;

2) Performance capabilities with regard to each characteristic; and

3) For marking devices manufactured by multiple external sources, a listing of sources and model numbers that are compatible with the system.

3.2.4.2.4 Frames or Fixtures for Punchcard Ballots

The frame or fixture for punchcards shall:

a. Hold the ballot card securely in its proper location and orientation for voting;

b. When contests are not printed directly on the ballot card or sheet, incorporate an assembly of ballot label pages that identify the offices and issues corresponding to the proper ballot format for the polling place where it is used and that are aligned with the voting fields assigned to them; and

c. Incorporate a template to preclude perforation of the card except in the specified voting fields; a mask to allow punches only in fields designated by the format of the ballot; and a backing plate for the capture and removal of chad. This requirement may be satisfied by equipment of a different design as long it achieves the same result as the Standards with regard to:

1) Positioning the card;

2) Association of ballot label information with corresponding punch fields;

3) Enabling of only those voting fields that correspond to the format of the ballot; and

4) Punching the fields and the positive removal of chad.

3.2.4.2.5 Frames or Fixtures for Printed Ballots

A frame or fixture for printed ballot cards is optional. However, if such a device is provided, it shall:

a. Be of any size and shape consistent with its intended use;

b. Position the card properly;

c. Hold the ballot card securely in its proper location and orientation for voting; and

d. Comply with the requirements for design and construction contained in Section 3.4.

3.2.4.2.6 Ballot Boxes and Ballot Transfer Boxes

Ballot boxes and ballot transfer boxes, which serve as secure containers for the storage and transportation of voted ballots, shall:

a. Be of any size, shape, and weight commensurate with their intended use;

b. Incorporate locks or seals, the specifications of which are described in the system documentation;

c. Provide specific points where ballots are inserted, with all other points on the box constructed in a manner that prevents ballot insertion; and

d. For precinct count systems, contain separate compartments for the segregation of unread ballots, ballots containing write-in votes, or any irregularities that may require special handling or processing. In lieu of compartments, the conversion processing may mark such ballots with an identifying spot or stripe to facilitate manual segregation.

3.2.4.3 DRE Systems Recording Requirements

The DRE systems recording requirements address the detection and recording of votes, including the logic and data processing functions required to determine the validity of voter selections, to accept and record valid selections, and to reject invalid selections. The requirements also address the physical environment in which ballots are cast.

3.2.4.3.1 Activity Indicator

DRE systems shall include an audible or visible activity indicator providing the status of each voting device. This indicator shall:

a. Indicate whether the device has been activated for voting; and

b. Indicate whether the device is in use.

3.2.4.3.2 DRE System Vote Recording

To ensure vote recording accuracy, all DRE systems shall:

a. Contain all mechanical, electromechanical, and electronic components; software; and controls required to detect and record the activation of candidate, contest, and write-in vote selections, made by the voter in the process of casting a ballot;

b. Incorporate multiple memories, both in the voting machine and in its programmable memory device, to detect any discrepancy in the content of individual memories;

c. Provide at least two processes that record the voter’s selections that:

1) Use neither common software nor common storage devices for these processes;

2) Designated one process and associated storage location as the main vote detection, interpretation, processing and reporting path;

3) Use a different process to store ballot images, for which the method of recording may include any appropriate encoding or data compression procedure consistent with the regeneration of an unequivocal record of the ballot as cast by the voter; and

4) Provide a capability to retrieve ballot images in a form readable by humans; and

d. Ensure that all processing and storage protects the integrity of the data and the anonymity of the voter.

3.2.4.3.3 Recording Accuracy

DRE systems shall meet the following requirements for recording accurately each vote and ballot cast:

a. Detect every selection made by the voter;

b. Correctly add permissible selections to the memory components of the device;

c. Verify the correctness of the detection of the voter selections and the addition of the selections to memory;

d. Achieve an error rate not to exceed the requirement indicated in Section 3.2.1;

e. Preserve the integrity of voting data and ballot images (for DRE machines) stored in memory for the official vote count and audit trail purposes against corruption by stray electromagnetic emissions, and internally generated spurious electrical signals; and

f. Maintain a log of corrected data.

3.2.4.3.4 Recording Reliability

Recording reliability refers to the ability of the DRE system to record votes accurately at its maximum rated processing volume for a specified period of time. The DRE system shall record votes reliably in accordance with the requirements of Section 3.4.3.

3.2.5 Paper-based Conversion Requirements

The paper-based conversion requirements address the ability of the system to read the ballot card and to translate its pattern of punches or marks into electronic signals for later processing. These capabilities may be built into the voting system in an integrated fashion, or may be provided by one or more components that are not unique to the system, such as a general-purpose data processing card reader or read head suitably interfaced to the system. These requirements address two major functions: ballot handling and ballot reading.

3.2.5.1 Ballot Handling

Ballot handling consists of a ballot card’s acceptance, movement through the read station, and transfer into a collection station or receptacle.

3.2.5.1.1 Capacity (Central Count)

The capacity to convert the punches or marks on individual ballots into signals is uniquely important to central count systems. The capacity for a central count system shall be documented by the vendor. This documentation shall include the capacity for individual components that impact the overall capacity.

3.2.5.1.2 Exception Handling (Central Count)

This requirement refers to the handling of ballots for a central count system when they are unreadable or when some condition is detected requiring that the cards be segregated from normally processed ballots for human review. In response to an unreadable ballot or a write-in vote all central count paper-based systems shall:

a. Outstack the ballot, or

b. Stop the ballot reader and display a message prompting the election official or designee to remove the ballot, or

c. Mark the ballot with an identifying mark to facilitate its later identification.

Additionally, the system shall provide a capability that can be activated by an authorized election official to identify overvoted ballots. This capability shall perform one of the above actions in response to an overvote.

3.2.5.1.3 Exception Handling (Precinct Count)

This requirement refers to the handling of ballots for a precinct count system when they are unreadable or when some condition is detected requiring that the cards be segregated from normally processed ballots for human review. All paper based precinct count systems shall:

a. In response to an unreadable ballot, return the ballot and provide a message prompting the voter or election official to examine the ballot;

b. In response to a ballot with a write-in vote, segregate the ballot or mark the ballot with an identifying mark to facilitate its later identification;

c. In response to a ballot with an overvote the system shall:

1) Provide a capability to identify an overvoted ballot;

2) Return the ballot;

3) Provide an indication prompting the voter to examine the ballot;

4) Allow the voter to submit the ballot with the overvote; and

5) Provide a means for an authorized election official to deactivate this capability; and

d. In response to a ballot with an undervote the system shall:

1) Provide a capability to identify an undervoted ballot;

2) Return the ballot;

3) Provide an indication prompting the voter to examine the ballot;

4) Allow the voter to submit the ballot with the undervote; and

5) Provide a means for an authorized election official to deactivate this capability.

3.2.5.1.4 Multiple Feed Prevention

Multiple feed refers to the situation arising when a ballot reader attempts to read more than one ballot at a time. The requirements govern the ability of a ballot reader to prevent multiple feed or to detect and provide an alarm indicating multiple feed.

a. If multiple feed is detected, the card reader shall halt in a manner that permits the operator to remove the unread cards causing the error, and reinsert them in the card input hopper.

b. The frequency of multiple feeds with ballots intended for use with the system shall not exceed l in 10,000.

3.2.5.2 Ballot Reading Accuracy

This paper-based system requirement governs the conversion of the physical ballot into electronic data. Reading accuracy for ballot conversion refers to the ability to:

¨ Recognize vote punches or marks, or the absence thereof, for each possible selection on the ballot;

¨ Discriminate between valid punches or marks and extraneous perforations, smudges, and folds; and

¨ Convert the vote punches or marks, or the absence thereof, for each possible selection on the ballot into digital signals.

To ensure accuracy, paper-based systems shall:

a. Detect punches or marks that conform to vendor specifications with an error rate not exceeding the requirement indicated in Section 3.2.1

b. Ignore, and not record, extraneous perforations, smudges, and folds; and

c. Reject ballots that meet all vendor specifications at a rate not to exceed 2 percent.

3.2.6 Processing Requirements

Processing requirements apply to the hardware and software required to accumulate voting data for all candidates and measures within voting machines and polling places, and to consolidate the voting data at a central level or multiple levels. These requirements also address the generation and maintenance of audit records, the detection and disabling of improper use or operation of the system, and the monitoring of overall system status. Separate and distinct requirements for paper-based and DRE voting systems are presented below.

3.2.6.1 Paper-Based System Processing Requirements

The paper-based processing requirements address all mechanical devices, electromechanical devices, electronic devices, and software required to perform the logical and numerical functions of interpreting the electronic image of the voted ballot, and assigning votes to the proper memory registers.

3.2.6.1.1 Processing Accuracy

Processing accuracy refers to the ability of the system to receive electronic signals produced by punches for punchcard systems and vote marks and timing information for marksense systems; perform logical and numerical operations upon these data; and reproduce the contents of memory when required, without error. Specific requirements are detailed below:

a. Processing accuracy shall be measured by vote selection error rate, the ratio of uncorrected vote selection errors to the total number of ballot positions that could be recorded across all ballots when the system is operated at its nominal or design rate of processing,.

b. The vote selection error rate shall include data that denotes ballot style or precinct as well as data denoting a vote in a specific contest or ballot proposition.

c. The vote selection error rate shall include all errors from any source.

d. The vote selection error rate shall not exceed the requirement indicated in Section 3.2.1.

3.2.6.1.2 Memory Stability

Paper-based system memory devices, used to retain control programs and data, shall have demonstrated error-free data retention for a period of 22 months, under the environmental conditions for operation and non-operation (i.e. storage).

3.2.6.2 DRE System Processing Requirements

The DRE system processing requirements address all mechanical devices, electromechanical devices, electronic devices, and software required to process voting data after the polling places are closed.

3.2.6.2.1 Processing Speed

DRE voting systems shall meet the following requirements for processing speed:

a. Operate at a speed sufficient to respond to any operator and voter input without perceptible delay (less than 250 milliseconds);

b. Extract voting data from a voting device by electronic means in a time not to exceed one minute; and

c. If the consolidation of polling place data is done locally, perform this consolidation in a time not to exceed five minutes for each device in the polling place.

3.2.6.2.2 Processing Accuracy

Processing accuracy is defined as the ability of the system to process voting data stored in DRE voting devices, or in removable memory modules installed in such devices. Processing includes all operations to consolidate voting data after the polling places have been closed. DRE voting systems shall:

a. Produce reports that are completely consistent, with no discrepancy among reports of voting device data produced at any level; and

b. Produce consolidated reports containing absentee, provisional, or other voting data that are similarly error-free. Any discrepancy, regardless of source, is resolvable to a procedural error, to the failure of a non-memory device, or to an external cause.

3.2.6.2.3 Memory Stability

DRE system memory devices used to retain control programs and data shall have demonstrated error-free data retention for a period of 22 months. Error-free retention may be achieved by the use of redundant memory elements, provided that the capability for conflict resolution or correction among elements is included.

3.2.7 Reporting Requirements

The reporting requirements govern all mechanical, electromechanical, and electronic devices required for voting systems to print audit record entries and results of the tabulation. These requirements also address data storage media for transportation of data to other sites.

3.2.7.1 Removable Storage Media

In voting systems that use storage media that can be removed from the system and transported to another location for readout and report generation, these media shall use devices with demonstrated error-free retention for a period of 22 months under the environmental conditions for operation and non-operation contained in Section 3.2.2.

Examples of removable storage media include: programmable read-only memory (PROM), random access memory (RAM) with battery backup, magnetic media, or optical media.

3.2.7.2 Printers

All printers used to produce reports of the vote count shall be capable of producing:

a. Alphanumeric headers;

b. Election, office and issue labels; and

c. Alphanumeric entries generated as part of the audit record.

3.2.8 Vote Data Management Requirements

The vote data management requirements for all systems address capabilities that manage, process, and report voting data after the data has been consolidated at the polling place or other intermediate levels. These capabilities allow the system to:

a. Consolidate voting data from polling place data memory or transfer devices;

b. Report polling place summaries; and

c. Process absentee ballots, data entered manually, and administrative ballot definition data.

The requirements address all hardware and software required to generate output reports in the various formats required by the using jurisdiction.

3.2.8.1 Data File Management

All voting systems shall provide the capability to:

a. Integrate voting data files with ballot definition files;

b. Verify file compatibility; and

c. Edit and update files as required.

3.2.8.2 Data Report Generation

All voting systems shall include report generators for producing output reports at the device, polling place, and summary level, with provisions for administrative and judicial subdivisions as required by the using jurisdiction.

3.3 Physical Characteristics

This section covers physical characteristics of all voting systems and components that affect their general utility and suitability for election operations.

3.3.1 Size

There is no numerical limitation on the size of any voting system equipment, but the size of each device should be compatible with its intended use and the location at which the equipment is to be used.

3.3.2 Weight

There is no numerical limitation on the weight of any voting system equipment, but the weight of each device should be compatible with its intended use and the location at which the equipment is to be used.

3.3.3 Transport and Storage of Precinct Systems

All precinct systems shall:

a. Provide a handle or handles to facilitate their handling, transport, and installation; and

b. Be capable of, or be provided with, a protective enclosure rendering them capable of withstanding:

1) Impact, shock and vibration loads accompanying surface and air transportation; and

2) Stacking loads accompanying storage.

3.4 Design, Construction, and Maintenance Characteristics

This section covers voting system materials, construction workmanship, and specific design characteristics important to the successful operation and efficient maintenance of the system.

3.4.1 Materials, Processes, and Parts

The approach to system design is unrestricted, and may incorporate any form or variant of technology capable of meeting the voting systems requirements and standards.

Precinct count systems shall be designed in accordance with best commercial practice for microcomputers, process controllers, and their peripheral components. Central count voting systems and equipment used in a central tabulating environment shall be designed in accordance with best commercial and industrial practice.

a. The frequency of equipment malfunctions and maintenance requirements shall be reduced to the lowest level consistent with cost constraints;

b. Manufacturers shall prepare an approved parts list for submission as a part of the TDP; and

c. No unit submitted for qualification testing and no production unit submitted for sale shall contain parts or components not included in the approved parts list.

3.4.1.1 Ballots

For paper-based voting systems, the vendor shall:

a. For ballots processed by general purpose readers, specify the card or paper stock, punch or mark configurations, and punch or mark field locations complying with industry standards cited by the vendor for information technology supplies and equipment; and

b. For ballots intended for use only with their parent system, specify any required materials and configuration.

3.4.1.2 Punching Stylus

The stylus for use with punchcard systems shall be:

a. Suitable for use with the vote recorder and ballots used by the system;

b. Designed so as to remove chad reliably; and

c. Designed to avoid excessive damage or wear to vote recorder components.

3.4.1.3 Vote Recorder

Vote recorders that use ballots to be processed by general-purpose card readers shall comply with industry standards cited by the vendor for punch configuration and location. Otherwise, they shall produce punched or marked ballot cards in any manner compatible with their parent system.

3.4.2 Durability

All voting systems shall be designed to withstand normal use without deterioration and without excessive maintenance cost for a period of ten years.

3.4.3 Reliability

The reliability of voting system devices shall be measured as mean time between Failure (MTBF) for the system submitted for testing. MBTF is defined as the value of the ratio of operating time to the number of failures which have occurred in the specified time interval. A typical system operations scenario consist of approximately 45 hours of equipment operation, consisting of 30 hours of equipment set-up and readiness testing and 15 hours of elections operations. For the purpose of demonstrating compliance with this requirement, a failure is defined as any event which results in either the:

a. Loss of one or more functions; or

b. Degradation of performance such that the device is unable to perform its intended function for longer than 10 seconds.

The MTBF demonstrated during qualification testing shall be at least 163 hours.

3.4.4 Maintainability

Maintainability represents the ease with which maintenance actions can be performed based on the design characteristics of equipment and software and the processes the vendor and election officials have in place for preventing failures and for reacting to failures. Maintainability includes the ability of equipment and software to self-diagnose problems and make non-technical election workers aware of a problem. Maintainability addresses all scheduled and unscheduled events, which are performed to:

Determine the operational status of the system or a component;
Adjust, align, tune, or service components;
Repair or replace a component having a specified operating life or replacement interval;
Repair or replace a component that exhibits an undesirable predetermined physical condition or performance degradation;
Repair or replace a component that has failed; and
Verify the restoration of a component, or the system, to operational status.

Maintainability shall be determined based on the presence of specific physical attributes that aid system maintenance activities, and the ease with which system maintenance tasks can be performed by the ITA. Although a more quantitative basis for assessing maintainability, such as the mean to repair the system is desirable, the qualification of a system is conducted before it is approved for sale and thus before a broader base of maintenance experience can be obtained.

3.4.4.1 Physical Attributes

The following physical attributes will be examined to assess reliability:

a. Presence of labels and the identification of test points;

b. Provision of built-in test and diagnostic circuitry or physical indicators of condition;

c. Presence of labels and alarms related to failures; and

d. Presence of features that allow non-technicians to perform routine maintenance tasks (such as update of the system database).

3.4.4.2 Additional Attributes

The following additional attributes will be considered to assess system maintainability.

a. Ease of detecting that equipment has failed by a non-technician;

b. Ease of diagnosing problems by a trained technician;

c. Low false alarm rates (i.e., indications of problems that do not exist);

d. Ease of access to components for replacement;

e. Ease with which adjustment and alignment can be performed;

f. Ease with which database updates can be performed by a non-technician; and

g. Adjust, align, tune, or service components.

3.4.5 Availability

The availability of a voting system is defined as the probability that the equipment (and supporting software) needed to perform designated voting functions will respond to operational commands and accomplish the function. The voting system shall meet the availability standard for each of the following voting functions:

a. For all paper-based systems:

1) Recording voter selections (such as by ballot marking or punch);

2) Scanning the punches or marks on paper ballots and converting them into digital data;

b. For all DRE systems:

1) Recording and storing the voter’s ballot selections.

c. For precinct-count systems (paper-based and DRE):

1) Consolidation of vote selection data from multiple precinct-based systems to generate jurisdiction-wide vote counts, including storage and reporting of the consolidated vote data; and

d. For central-count systems (paper-based and DRE):

1) Consolidation of vote selection data from multiple counting devices to generate jurisdiction-wide vote counts, including storage and reporting of the consolidated vote data.

System availability is measured as the ratio of the time during which the system is operational a (up time) to the total time period of operation (up time plus down time). Inherent availability (Ai) is a the fraction of time a system is functional, based upon Mean Time Between Failure (MTBF) and Mean Time to Repair (MTTR), that is:

Ai = (MTBF)/(MTBF + MTTR)

Mean Time to Repair (MTTR) is the average time required to perform a corrective maintenance task during periods of system operation. Corrective maintenance task time is active repair time, plus the time attributable to other factors that could lead to logistic or administrative delays, such as travel notification of qualified maintenance personnel and travel time for such personnel to arrive at the appropriate site.

Corrective maintenance may consist of substitution of the complete device or one of its components, as in the case of precinct count and some central count systems, or it may consist of on-site repair.

The voting system shall achieve at least ninety nine percent availability during normal operation for the functions indicated above. This standard encompasses for each function the combination of all devices and components that support the function, including their MTTR and MTBF attribute.

Vendors shall specify the typical system configuration that is to be used to assess availability, and any assumptions made with regard to any parameters that impact the MTTR. These factors shall include at a minimum:

a. Recommended number and locations of spare devices or components to be kept on hand for repair purposes during periods of system operation;

b. Recommended number and locations of qualified maintenance personnel who need to be available to support repair calls during system operation; and

c. Organizational affiliation (i.e., jurisdiction, vendor) of qualified maintenance personnel.

3.4.6 Environmental Conditions

Environmental conditions applicable to the design and operation of voting systems consist of the following categories:

a. Natural environment, including temperature, humidity, and atmospheric pressure;

b. Induced environment, including proper and improper operation and handling of the system and its components during the election processes;

c. Transportation and storage; and

d. Electromagnetic signal environment, including exposure to and generation of radio frequency energy.

All voting systems shall be designed to withstand the environmental conditions contained in the appropriate test procedures of the Standards. These procedures will be applied to all devices for casting, scanning and counting ballots, except those that constitute COTS devices that have not been modified in any manner to support their use as part of a voting system and that have a documented record of performance under conditions defined in the Standards.

3.4.7 Electrical Power Disturbance

Vote scanning and counting equipment for paper-based systems, and all DRE equipment, shall be able to withstand, without disruption of normal operation or loss of data:

a. Surges of 30% dip @10 ms;

b. Surges of 60% dip @100 ms & 1 sec

c. Surges of >95% interrupt @5 sec;

d. Surges of +15% line variations of nominal line voltage; and

e. Electric power increases of 7.5% and reductions of 12.5% of nominal specified power supply for a period of up to four hours at each power level.

3.4.8 Electromagnetic Radiation

Vote scanning and counting equipment for paper-based systems, and all DRE equipment, shall comply with the Rules and Regulations of the Federal Communications Commission, Part 15, Class B requirements for both radiated and conducted emissions.

3.4.9 Electrostatic Disruption

Vote scanning and counting equipment for paper-based systems, and all DRE equipment, shall be able to withstand ±25 kV air discharge and ±8 kV contact discharge without damage or loss of data. The equipment may reset or have momentary interruption so long as normal operation is resumed without human intervention or loss of data. Loss of data means votes that have been completed and confirmed to the voter.

3.4.10 Electromagnetic Susceptibility

Vote scanning and counting equipment for paper-based systems, and all DRE equipment, shall be able to withstand an electromagnetic field of 10 V/m modulated by a 1 kHz 80% AM modulation over the frequency range of 80 MHz to 1000 MHz, without disruption of normal operation or loss of data.

3.4.11 Electrical Fast Transient

Vote scanning and counting equipment for paper-based systems, and all DRE equipment, shall be able to withstand, without disruption of normal operation or loss of data, electrical fast transients of:

a. 2 kV AC & DC external power lines;

b. +1 kV all external wires >3m no control; and

c. +2 kV all external wires control.

3.4.12 Lightening Surge

Vote scanning and counting equipment for paper-based systems, and all DRE equipment, shall be able to withstand, without disruption of normal operation or loss of data, surges of:

a. +2 kV AC line to line;

b. +2 kV AC line to earth;

c. +.5 kV DC line to line >10m;

d. +.5 kV DC line to earth >10m; and

e. +1 kV I/O sig/control >30m.

3.4.13 Conducted RF Immunity

Vote scanning and counting equipment for paper-based systems, and all DRE equipment, shall be able to withstand, without disruption of normal operation or loss of data, conducted RF energy of:

a. 10V AC & DC power; and

b. 10V, 20 sig/control >3m.

3.4.14 Magnetic Fields Immunity

Vote scanning and counting equipment for paper-based systems, and all DRE equipment, shall be able to withstand, without disruption of normal operation or loss of data, AC magnetic fields of 30 A/m at 60 Hz.

3.4.15 Product Marking

All voting systems shall:

a. Identify all devices by means of a permanently affixed nameplate or label containing the name of the manufacturer or vendor, the name of the device, its part or model number, its revision letter, its serial number, and if applicable, its power requirements;

b. Display on each device a separate data plate containing a schedule for and list of operations required to service or to perform preventive maintenance; and

c. Display advisory caution and warning instructions to ensure safe operation of the equipment and to avoid exposure to hazardous electrical voltages and moving parts at all locations where operation or exposure may occur.

3.4.16 Workmanship

To help ensure proper workmanship, all manufacturers of voting systems shall:

a. Adopt and adhere to practices and procedures to ensure that their products are free from damage or defect that could make them unsatisfactory for their intended purpose; and

b. Ensure that components provided by external suppliers are free from damage or defect that could make them unsatisfactory for their intended purpose.

3.4.17 Safety

All voting systems shall meet the following requirements for safety:

a. All voting systems and their components shall be designed so as to eliminate hazards to personnel, or to the equipment itself.

b. Defects in design and construction that can result in personal injury or equipment damage must be detected and corrected before voting systems and components are placed into service; and

c. Equipment design for personnel safety shall be equal to or better than the appropriate requirements of the Occupational Safety and Health Act (OSHA), as identified in Title 29, part 1910, of the Code of Federal Regulations.

3.4.18 Human Engineering—Controls and Displays

All voting systems and components shall be designed and constructed so as to simplify and facilitate the functions required, and to eliminate the likelihood of erroneous stimuli and responses on the part of the voter or operator. Other specific requirements for controls and displays are described below. In addition, specific functional requirements for system use by individuals with disabilities are described in Section 2.2.7 of the Standards.

All voting systems shall meet the following requirements for controls and displays:

a. In all systems, controls used by the voter or equipment operator shall be conveniently located, shall use designs that are consistent with their functions, and shall be clearly labeled. Instruction plates shall be provided, if they are necessary to avoid ambiguity or incorrect actuation;

b. Information or data displays shall be large enough to be readable by a person with no disabilities and by individuals with disabilities consistent with the requirements defined is Section 2.2.7 of the Standards;

c. Status displays shall meet the same requirements as data displays, and they shall also follow conventional industrial practice with respect to color:

1) Green, blue, or white displays shall be used for indications of normal status;

2) Amber indicators shall be used to indicate warnings or marginal status; and

3) Red indicators shall be used to indicate error conditions or equipment states that may result in damage, or in hazards to personnel; and unless the equipment is designed to halt under conditions of incipient damage or hazard, an audible alarm shall also be provided.

d. Color coding shall be selected so as to assure correct perception by people with color blindness; and shall not be used as the only means of conveying information, indicating an action, prompting a response, or distinguishing a visual element (see Appendix B for suggested references); and

e. The system’s display shall not use flashing or blinking text objects, or other elements having a flash or blink frequency, greater than 2 Hz and lower than 55 Hz.