|
No.
|
Requirement (Appendix of
"DVREC-2 (V5)")
and notes
|
Result
|
|
|
Conditions for voting machines
1 G e n e r a l
|
|
|
(1)
|
1.1 The requirements
for voting machines contained in the Functional
Specification document, the electoral law and this Appendix are mandatory.
- The
agreement with the requirements, defined in the (next) paragraphs in Appendix
of "DVREC-2 (V5)", is
described in the following sections.
|
|
|
(2)
|
1.2 The voting machine shall be constructed in line with the current
general state of technology and be designed
in accordance with recognised rules of technology applied to systems used in
the machine.
For construction and design of the software-updates, see Encl. 1.
|
|
|
(3)
|
1.3 The voting machine shall be designed in such
a way that any unauthorised
alterations of a technical nature will come to notice.
The type, the version number
and the individual identifier (serial) number (ID) of the voting machine
and of the programming/reading unit are given on a type plate.
Every ballot module is identified by the individual
ID-number.
The version numbers of the voting machine, the connection
(communication) board and the five display boards and the ID-numbers of the voting machine and
the installed ballot module can be displayed on, and printed out by, the
voting machine.
This enables the polling staff
to compare the type, the version numbers and the individual ID-numbers with the values given by
the manufacturer in documentation (user manual) or e.g. listed in an
authorized certificate.
These data are stated in section 2.1 of
this Test Report.
|
|
|
(4)
|
1.4 In the case of a processor–controlled
machine, any alteration of the installed
software by an unauthorised person will be detected.
The program version numbers and checksums
of the installed software for the main control board, the connection
(communication) board and the five display boards can be displayed on, and
printed out by, the voting machine.
This enables the polling staff
to compare these program version
numbers and checksums with the
values given by the manufacturer in documentation (user manual) or e.g.
listed in an authorised certificate.
These data are stated in section 2.1 of
this Test Report.
|
|
|
(5)
|
1.5 The relevant statutory procedures for the preparation of a voting machine for
a poll, use at a poll and at the close of a poll shall be capable of being
performed by the voting machine. The
word “poll” is deemed to include more than 1 poll (maximum 5) held
simultaneously.
*) This paragraph is not covered by the order
for testing.
|
*)
|
|
|
2 G e n e r a l c
o n d i t i o n s
concerning the provision of
information by the voting machine
**) The following requirements of this
paragraph were not tested, as the software updates of connection and display
boards do not affect them.
|
**)
|
|
(6)
|
2.1 The information
provided by the voting machine to the user (polling staff and voter)
must be relevant and clear.
|
|
|
(7)
|
2.2 The voting machine must provide the user (polling staff and voter) with information, either on the display screen on the voting machine
or on the Control Unit or
otherwise, on the steps that the
user must or can take in sequence using
the voting machine and about the functions the voting machine is carrying
out pursuant to the actions taken by the user, subject to the condition that
the candidate or referendum choices recorded or vote(s) cast on the machine
by the voter cannot be related to that voter either at the time of voting or
subsequently.
|
|
|
(8)
|
2.3 The voting machine must provide a statement
before polling commences and at close of poll listing the candidates on the
ballot paper, the total number of
votes cast, if any, including any
null votes in the case of multiple polls, on the machine, and other relevant details of the voting
machine and the poll(s) concerned.
|
|
|
|
3 I n s t a l l a t i o n
of a ballot module
**) The following requirements of this
paragraph were not tested, as the software updates of connection and display
boards do not affect them.
3.1 Following the insertion of a programmed
ballot module into the voting machine, the voting machine shall carry out the
following functions in sequence:
|
**)
|
|
(9)
|
- check to ensure that the voting machine is
functioning correctly as defined in the Functional Specification;
|
|
|
(10)
|
- and display and/or print the contents of
the memory of the primary ballot module.
|
|
|
(11)
|
3.2 The insertion of a primary ballot module
shall be controlled by means of a physical key.
|
|
|
(12)
|
The compartment for holding the primary ballot module shall be
provided with a lock.
|
|
|
(13)
|
The machine can only be activated for voting if a module has been
installed and the lock on the ballot module slot is in the closed position.
|
|
|
(14)
|
3.3 A back-up
module shall be installed and retained in the voting machine in accordance
with the Functional Specification.
|
|
|
|
4 D i s p l a y i n g
ballot paper
**) The software updates of connection and
display boards do not affect the following requirements.
|
**)
|
|
(15)
|
The ballot paper displayed
on the voting machine must comply with the Electoral Act, 1992, the Electoral (Amendment) Bill, 2000 and
must be verified by statements printed from the voting machine
before voting commences and at close of poll.
*) This paragraph is not covered by the order
for testing.
|
*)
|
|
|
5 Preparation before the
poll
**) The following requirements of this
paragraph were checked by functional tests only. The software updates of
connection and display boards should not affect them, as the main control
program is not changed.
5.1 A voting machine can only be used for a
poll, after it has carried out or supported the following steps in sequence:
|
**)
|
|
(16)
|
- demonstrated, by way of a printed statement
or on the display screen, that no votes are recorded;
|
|
|
(17)
|
- and checked that the voting machine is
functioning correctly in accordance with the Functional Specification
(Sections 2 and 8).
|
|
|
(18)
|
5.2 Votes shall only be recorded if the key referred to in 3.2. is inserted in the
Control Unit.
|
|
|
(19)
|
Withdrawal of the key from the Control Unit will switch the VM to
standby and prevent votes from being recorded.
|
|
|
|
6 T h e p o l l
**) The following requirements of this
paragraph were checked by functional tests only. The software updates of
connection and display boards should not affect them, as the main control
program is not changed.
|
**)
|
|
(20)
|
6.1 The voting machine shall not record votes,
unless it has been activated.
|
|
|
|
6.2 For the recording of votes, the voting
machine shall carry out or support the following steps in sequence:
|
|
|
(21)
|
- the voting machine is activated for each
elector by the presiding officer or a person authorised by the officer;
|
|
|
(22)
|
- LED on top of each ballot paper column
highlights ballot paper(s) on which voter is entitled to vote;
|
|
|
(23)
|
- LCD opposite each candidate’s details or referendum choice will
display the preferences recorded on each ballot paper presented on voting
machine;
|
|
|
(24)
|
- provision for changing a preference for a
candidate or referendum choice will be provided by pressing the button a
second time beside that candidate’s details or referendum choice;
|
|
|
(25)
|
- a voter will be able to cast his or her
vote when at least one preference has been recorded on a ballot paper and,
where there is more than 1 ballot paper and no preference(s) is/are recorded
on the second or other remaining ballot papers, following a reminder
displayed on the display screen;
|
|
|
(26)
|
- a vote will be recorded, including a null
vote where applicable, in the voting memory of the voting machine, following
the pressing of the “ CAST VOTE(S)” button.
|
|
|
(27)
|
This process shall include a check that the recording of the vote(s)
cast has/have been accomplished
correctly.
*)
This requirement is not covered by the functional tests. The software
updates do not affect this main control program check.
|
*)
|
|
(28)
|
6.3 After each vote is stored, the VM voters
panel shall be deactivated automatically.
The VM will not accept any further votes until a member of the polling
station staff, operating the Control Unit, reactivates the VM.
|
|
|
(29)
|
6.4 Where the voter, who has been permitted to
use the voting machine, does not cast his or her vote, the polling staff can
de-activate the voting machine, without approaching the voting machine
screen, by turning the key mentioned in 5.2.
|
|
|
(30)
|
Any preference(s) entered on the voting machine screen will not be
recorded as a vote. A new activation
is only possible after use of the key mentioned in 5.2.
|
|
|
(31)
|
6.5 Once the voter has pressed the "CAST
VOTE(S)" button, the voting machine shall not provide information about
any preference(s) recorded or vote cast by a voter.
|
|
|
(32)
|
6.6 The number of votes cast, including null
votes in the case of multiple polls,
will be displayed on the Control Unit.
|
|
|
|
7 D i s p l a y i n g
a n d p r i n t i n g
the total number of votes at
close of poll
**) The following requirements of this
paragraph were checked by functional tests only. The software updates of
connection and display boards should not affect them, as the main control
program is not changed.
|
**)
|
|
(33)
|
7.1 The voting machine shall print and display,
where necessary, the total number of
votes cast and, where applicable, the number of null votes.
|
|
|
(34)
|
7.2 Activation of the voting machine for the
display and printing of the information referred to in paragraph 7.1 shall be accomplished by means of
the key referred to in paragraph 5.2.
|
|
|
(35)
|
The back-up module shall be checked to ensure that any existing data
in the module are deleted, before the contents of the primary ballot module
are copied to the back up module.
*)
This requirement is not covered by the functional tests. The software
updates do not affect this main control program check.
|
*)
|
|
(36)
|
Withdrawal of the key from the Control Unit will automatically stop
the printing process.
|
|
|
(37)
|
7.3 After displaying or printing the total
number of votes cast etc, the voting machine can only be re-activated for the
casting of votes after the insertion of a new programmed ballot module.
|
|
|
|
8 R e l i a b i l i t y
and s e c u r i t y of the voting machine
**) Only the indicated requirement in this
paragraph was tested, as the software updates of connection and display
boards do not affect the other requirements.
|
**)
|
|
(38)
|
8.1 A vote recorded in the primary ballot module
must be the vote that the voter has cast.
|
|
|
(39)
|
The voting machine must be capable of recording votes on 5 ballot papers (maximum 140 preferences)
simultaneously as per paragraph 12.
The capacity of the ballot module is set out in paragraph 1.8 of the Functional Specification.
|
|
|
(40)
|
8.2 A cast vote must not be lost by a power
failure, the failing of one component, the effect of environmental conditions
detailed in paragraph 11.1,
through normal use or through failures in the operation of the voting
machine.
|
|
|
(41)
|
8.3 The installed ballot module and its contents
must be fully maintained in case of a power failure, the effect of
environmental conditions as set out in paragraph 11.1, through normal use or through failures in the operation of
the voting machine.
|
|
|
(42)
|
8.4 The functions of the voting machine must be
fully maintained in the event of a power failure, or exposure to the
environmental conditions as detailed in 11.1.
|
|
|
(43)
|
8.5 The storing of votes in the ballot module
must be made in such a way so as to ensure security and continuous
self-checking of all data.
|
|
|
(44)
|
Each vote will be stored twice in each of 2 independent IC’s within
the ballot module i.e. each vote is stored four times in the ballot module.
|
|
|
(45)
|
As each single preference is recorded a checksum (a security code
applied over a number of bytes based upon Hamming Code which is an
international standard) is calculated and stored in RAM.
|
|
|
(46)
|
When the voter presses the “CAST VOTE(S)” button all checksums of all
preferences stored in RAM shall be checked.
|
|
|
(47)
|
As the VM stores preferences, a read back of the last byte of data
written should be made as a further check.
|
|
|
(48)
|
After storing all preferences, the system should check all of these
again and their checksums.
|
|
|
(49)
|
The last step is a check of all preferences stored from all voters.
This sequence is repeated for every voting cycle.
|
|
|
(50)
|
In the event that a discrepancy occurs in the checksums, an error
message is generated.
|
|
|
(51)
|
This message is shown on the voting machine display and on the Control
Unit display enabling the presiding officer to take appropriate action.
|
|
|
(52)
|
8.6 The voting machine should, as far as is
reasonably and technically possible, avoid or restrict the possibilities of
accidental or intentional incorrect use.
Malfunctions of the voting machine during the election come to notice
because of the cyclic internal self-check procedures inherent in the voting
machine.
Some detected bugs were removed in the software updates of connection
and display boards.
This requirement was checked by software tests (Encl. 1) only.
|
OK
|
|
(53)
|
8.7 The votes are stored randomly in the ballot
module and must not be displayed or printed on the voting machine.
|
|
|
|
9 O p e r a b i l i t y
**) The following requirements of this paragraph
were not tested, as the software updates of connection and display boards do
not affect them.
|
**)
|
|
(54)
|
9.1 The voting machine shall be configured so
that a voter can only carry out voting actions on it.
|
|
|
(55)
|
9.2 Voting on the voting machine must be easy to
understand.
|
|
|
(56)
|
9.3 The carrying out of an action by the
presiding officer or by the voter must lead to a visible, audible or tangible
feedback signal within one second.
|
|
|
(57)
|
9.4 When the voter records a preference or casts
a vote by means of the buttons on the voting machine, the following
requirements shall apply to the buttons:
Same
conditions as in the above-mentioned PTB-Test-Report,
dated 2002-01-29.
*) This paragraph is not covered by the order
for testing.
|
*)
|
|
|
10 R e p o r t i n g and s o l u t i o
n of problems
**) Only the indicated requirements of this
paragraph were tested, as the software updates of connection and display
boards do not affect the other requirements.
|
**)
|
|
(58)
|
10.1 The voting machine shall, as far as possible,
be equipped with a diagnostic mechanism so that after each action that has
been performed within the voting machine, the mechanism can detect defects or
incorrect working of the different components of the voting machine and their
associated communication channels.
Some detected bugs were removed in the software updates of connection
and display boards. An unnecessary error message is avoided. These changes
improve the reliability of the voting machine.
This requirement was checked by software tests (Encl. 1) only.
|
|
|
(59)
|
These actions must include the steps that the voter or the polling
staff can perform. The voting machine
must report a defect or incorrect working to the user.
See note on (58).
|
|
|
(60)
|
10.2 The diagnostic mechanism shall not be
accessible to or be capable of being switched off by the user.
|
|
|
(61)
|
10.3 The diagnostic mechanism must provide the
user with messages (text or code)
that support and speed up the trouble shooting procedure.
See note on (58).
|
|
|
(62)
|
10.4 The meaning of the fault messages generated
by the diagnostic mechanism and the actions to be taken with respect to each
fault message must be clearly stated in the voting machine user manual.
|
|
|
|
11 E n v i r o n m e n t a l
c o n d i t i o n s
(derived from [OIML-11], [IEC-60839],
[IEC-60068-2] or as amended, adapted or extended by or under any subsequent
version of these documents or replacement documents)
**) The software updates of connection and
display boards do not affect the following requirements.
|
**)
|
|
(63)
|
11.1 Environmental
conditions referred to in 8.2,
8.3 and 8.4 are:
Same
conditions as in the above-mentioned PTB-Test-Report,
dated 2002-01-29.
*) This paragraph is not covered by the order
for testing.
|
*)
|
|
(64)
|
11.2 The functions of the voting machine will be
maintained after being exposed to the following conditions during storage
(in the packaging):
Same
conditions as in the above-mentioned PTB-Test-Report,
dated 2002-01-29.
*) This paragraph is not covered by the order
for testing.
|
*)
|
|
|
12 C o n d i t i o n s
for the use of voting machines for two
or more polls simultaneously
**) The following requirements of this
paragraph were checked by functional tests only. The software updates of
connection and display boards should not affect them, as the main control
program is not changed.
|
**)
|
|
(65)
|
The voting machines may be used for one, two or more (maximum 5) polls
that are held simultaneously, including an election and a referendum.
|
|
|
(66)
|
The voting machine shall be equipped in such a way that it fulfils the
following requirements:
- the
designation of the selection buttons for each ballot paper is stored in
tabular form in the ballot module;
*)
This requirement is not covered by the functional tests. The software
updates do not affect this main control program feature.
|
*)
|
|
(67)
|
- the
voting machine can be activated for the voter for a maximum of 5 polls;
|
|
|
(68)
|
- the
ballot papers displayed on the voting machine are clearly separated from each
other;
|
|
|
(69)
|
- the voter can record preferences starting on
any ballot paper. The preferences will start from 1 on each ballot paper
(except a referendum ballot paper). The voter may switch between ballot
papers until he/she has finished recording his/her preferences;
|
|
|
(70)
|
- the
cast votes are stored randomly and cannot be displayed or printed on the
voting machine.
*)
This requirement is not covered by the functional tests. The software
updates do not affect this main control program feature.
|
*)
|
|
|
13 D o c u m e n t a t i o n
**) Only the indicated requirements of this
paragraph were tested, as the software updates of connection and display
boards do not affect the other requirements.
|
**)
|
|
|
13.1 The voting machine must be supplied with the
following documentation:
|
|
|
(71)
|
- system documentation;
|
|
|
(72)
|
- development documentation;
See list 1 "Technical documentation of NEDAP" in
the Appendix
of this Test Report.
|
|
|
(73)
|
- test documentation;
See list 2 "Test documentation of NEDAP" in the Appendix of this Test Report.
|
|
|
(74)
|
- a user manual;
|
|
|
(75)
|
- instructions for the voter.
|
|
|
|
13.2 The system
documentation shall describe:
|
|
|
(76)
|
(a) the working
principle of the voting machine and the additional equipment and a
description of the construction (both electronic and mechanical) explained
with:
- construction drawings,
- block diagrams, electronic and wiring diagrams, printed circuit
board layouts.
|
|
|
(77)
|
(b) specifications
of the environmental and operating conditions for normal operation, storage
and transport of the voting machine;
|
|
|
(78)
|
(c) identification
data, including:
- serial, type and ordering numbers,
- production and/or delivery date,
- electrical connection/power supply.
This identification data must also be adequately indicated on the
voting machine and the additional equipment.
This identification data are
indicated on a type plate and on the display or printout of the voting
machine. See notes (3) and (4) on paragraphs 1.3 and 1.4.
|
|
|
|
13.3 The development
documentation must include:
|
|
|
(79)
|
(a) a functional specification of the voting
machine;
|
|
|
(80)
|
(b) the technical design of the voting machine;
|
|
|
(81)
|
(c) listings of the application source codes;
See list 1 “Technical documentation ” No. 2 in the Appendix
of this Test Report.
|
|
|
(82)
|
(d) a quality plan.
|
|
|
|
13.4 The test
documentation must describe
|
|
|
(83)
|
which measurements the manufacturer used at the verification, the
validation and the testing of components of the voting machine (including
software)
and must include at least:
|
|
|
(84)
|
- a test
plan that describes the way in which the functions of the machine are tested;
|
|
|
(85)
|
- software
module test report that describes the results of the module tests;
|
|
|
(86)
|
- software
integration test report(s) that describe the results of the integration
tests;
|
|
|
(87)
|
- software
system test plan and report(s) containing the system test plan (test
specification) and results.
*) The tests because of software updates are
described in an additional NEDAP test report (see list 2 "Test documentation of NEDAP" in the Appendix
of this Test Report). A complete test documentation is not necessary, as some
bugs were removed and the update does not influence the normal operation of
the voting machine; see remarks in Addendum 1 to Software Test Report (Encl.
1)
|
|
|
|
13.5 The user
manual
The user
manual must include:
|
|
|
(88)
|
- instructions
for unpacking, opening, connecting and putting the voting machine into
operation;
|
|
|
(89)
|
- operating
instructions for the adjustment of the voting machine and security and/or
locking;
|
|
|
(90)
|
- operating
instructions for the members of the polling station;
|
|
|
(91)
|
- maintenance
instructions;
|
|
|
(92)
|
- storage
instructions.
|
|
