EAC Decision on Request for Interpretation 2009-03 

(Battery Back Up for Central Count) 

EAC Decision on Request for Interpretation 2008-06 

(Battery Back Up for Central Count) 

2002 VVSS Volume I, Sections 3.2.2.4c, 3.2.2.5 

2005 VVSG Volume I, Version 1.0, Sections 4.1.2.4c (Electrical 

Supply), 4.1.2.5 

(Electrical Power Disturbance) 

Date: 

September 28, 2009 

Question: 

EAC Decision on Request for Interpretation 2008-06 does not address whether provision 

for a graceful shutdown can be done by means of user intervention or whether it has to be 

done by systematic means only. 

In addition, the test sequence requires that the method used to stop the picking of ballots 

rather than allowing the batch to finish scanning and then providing for a graceful 

shutdown. With the speed of the coming generation of central scanners, the time needed 

to complete the input hopper is very short, requiring reasonable backup resources to 

allow for a graceful shutdown. 

Section of Standards or Guidelines: 

2002 VVSS Volume I, Sections 3.2.2.4c, 3.2.2.5 

3.2.2.4c: All systems shall also be capable of operating for a period of at least 2 hours on 

backup power, such that no voting data is lost or corrupted, nor normal operations 

interrupted. When backup power is exhausted the system shall retain the contents of all 

memories intact. 

3.2.2.5: Vote scanning and counting equipment for paper-based systems, and all DRE 

equipment, shall be able to withstand, without disruption of normal operation or loss of 

data: 

a. Surges of 30% dip @10 ms; 

b. Surges of 60% dip @100 ms & 1 sec 

c. Surges of >95% interrupt @5 sec; 

d. Surges of +15% line variations of nominal line voltage; and 
2

e. Electric power increases of 7.5% and reductions of 12.5% of nominal specified power 

supply for a period of up to four hours at each power level. 

2005 VVSG Volume I, Version 1.0, Sections 4.1.2.4c (Electrical Supply), 4.1.2.5 

(Electrical Power Disturbance) 

4.1.2.4c: All voting machines shall also be capable of operating for a period of at least 2 

hours on backup power, such that no voting data is lost or corrupted nor normal 

operations interrupted. When backup power is exhausted the voting machine shall retain 

the contents of all memories intact. 

4.1.2.5: Vote scanning and counting equipment for paper-based voting systems, and all 

DRE voting equipment, shall be able to withstand, without disruption of normal operation 

or loss of data: 

a. Voltage dip of 30% of nominal @10 ms; 

b. Voltage dip of 60% of nominal @100 ms & 1 sec 

c. Voltage dip of >95% interrupt @5 sec 

d. Surges of +15% line variations of nominal line voltage 

e. Electric power increases of 7.5% and reductions of 12.5% of nominal specified power 

supply for a period of up to four hours at each power level 

Discussion: 

The EAC Decision on Request for Interpretation 2008-06 requires a central count system 

to provide for a graceful shutdown to allow switching to an alternate power source. It also 

states that the graceful shutdown shall meet the following requirements: 

1. All ballots shall reside in either the input or output hopper with no ballots in 

process at the end of the shutdown process. 

2. All ballots in the output hopper shall be fully read and saved. 

3. A report, including the final state of all ballots, timestamps and of the final state 

of the unit, shall be printed or saved in a file. The report shall be part of the 

permanent election record and shall be available when power is restored to the 

system. 

4. The system shall be capable of resuming operation from the point it stopped once 

power is restored. 

This new RFI clarifies the issue of whether or not the interpretation provided by RFI 

2008-06 requires the shut down of the central count system to be a systematic (controlled 

by the system) or by user intervention. 

Conclusion: 

The intent of RFI 2008-06 is that the required shut down shall be done in a graceful 

manner to prevent data loss or the necessity of having to re-run the ballots. The method 

of shutdown needs to be clarified. The shut down can be implemented either by means of 

a user controlled intervention or an automatic systematic operation. 

. 
3

The method of notification to the user that the system has lost power and is shutting down 

(systematic) or needs to be shut down (user intervention) is an important attribute for a 

manufacturer to consider. The alert should be easily recognizable and documentation 

should be provided to illustrate the proper course of action that needs to be taken. There 

are many ways for the user to be notified that the system has lost power. However all 

implementations must satisfy the high-level requirements for graceful shut down and 

protection of election data enumerated in the discussion section above. Also, all actions 

taken by the system or the user to initiate the shut down are considered “events” and shall 

be logged per VSS section 2.2.4.1g & i and VVSG section 2.1.4 g & i. 

In addition RFI 2008-06 states that a stipulation of a graceful shut down is that “A report, 

including the final state of all ballots, timestamps and of the final state of the unit, shall 

be printed or saved in a file. The report shall be part of the permanent election record and 

shall be available when power is restored to the system.” This report does not need to be 

a special report created for this instance. Any report currently offered by the EMS is 

acceptable as long as it contains the above mention criteria. 

Applicability: 

Immediate- for all voting system test plans submitted after the date of this document.