JP3877154B2 - Voting data generation method, electronic voting apparatus, and electronic voting program - Google Patents

Description

[0001]
BACKGROUND OF THE INVENTION
The present invention relates to an electronic voting system for voting by using an information processing apparatus in public office elections in Japan and overseas.
[0002]
[Prior art]
With the progress of information technology (IT) in recent years, technical development of an electronic voting system is being carried out for the purpose of turning IT into elections. According to the “Election System Study Group Report Using Electronic Equipment” and the “Interim Report” published on the Ministry of Internal Affairs and Communications website,
[Stage 1] The stage in which an elector voted using an electronic voting machine at a designated polling place (voting without using a network),
[Stage 2] Stages where voting is possible at polling places other than the designated polling place (network voting using a dedicated line),
[Stage 3] Voting using a personal computer terminal (network voting using a public line) without voting at a polling place,
It is expected to go through these three stages. The current electronic voting system is still in the first stage in Japan and other countries, with the exception of some pilot elections. The second stage and the third stage have problems in network security problems, personal authentication methods, etc., and there is no prospect for practical use.
[0003]
According to the above document, the first stage of electronic voting is:
1) Touch panel method
2) Numeric keypad / keyboard system
3) Button system
4) Mark sheet method
5) Punch card method
It is classified into either.
The above 4) to 5) are to obtain an electronic vote by optically reading a mark or perforation on a ballot made by a voter, which is similar to Japan's symbolic voting. . In 4) to 5), since the physical votes remain on the paper medium, it is easy to verify the counting results, but on the other hand, it is difficult to cope with reading errors at the time of counting due to mark mistakes or punching mistakes. Have. In order to solve such a problem, Japanese Patent No. 2669471 discloses 4) In the case of invalid voting, a voting paper of a mark sheet type is optically read by an OMR (Optical Mark Reader) or the like to determine the validity / invalidity of voting. Discloses a technique for voting again. This technique provides an effective means for mark mistakes that can be read by OMR, such as an error in a portion to be marked, but for mark mistakes that cannot be read by OMR, such as poor fill. There are still challenges. 5) There is no effective method for reading punching errors even for punch card systems, which can cause serious troubles as revealed in the US presidential election in 2000, and is still unreliable. The technology to be established is not disclosed.
[0004]
On the other hand, in the above 1) to 3), the contents of the vote are directly recorded on an electromagnetic recording medium floppy (registered trademark) disk (hereinafter referred to as FD), IC card, MO, CD, memory card without going through a paper medium. It is possible to record the original voting record by recording it on a hard disk or the like, which is called the direct recording method or DRE method (DRE: Direct Recording Electronic Voting), and unless there is a program error or machine failure, It is said that accuracy can be guaranteed with high accuracy. Prior to the IT revolution, a method of 1) to 3) that generates a recording original on a paper medium has been disclosed in Japanese Patent Application Laid-Open No. 57-199083. Is not seen so much because it does not fit the trend of the times because it does not have the possibility of networking after the second stage mentioned above, and the direct recording method has become the mainstream for technological development in countries around the world. Yes.
[0005]
The electronic voting of 1) to 3) by the direct recording method described above is
(1) Paperless is possible
(2) Elimination of invalid / questionnaires
(3) Easy to handle people with disabilities
And so on. In particular, as an invention from the viewpoints of (1) and (2), Japanese Patent No. 2747171 relating to 1) a touch panel system is known. On the other hand, the invention from the viewpoint of the above (3) includes unpublished inventions (Japanese Patent Application Nos. 2001-112491, 2001-19194, 2001-24946, and 2001-2001) filed by the present applicant. 53972, Japanese Patent Application No. 2001-260619, etc.). According to these inventions, according to barrier-free technology, when electors use electronic devices to select candidates, the methods 1) to 3) are selected according to the type of physical disability of the voter. It is possible to vote at.
[0006]
By the way, the various inventions related to electronic voting described above could not be implemented at the time of filing due to the regulation of Japanese law. However, the law was revised after that, and the election of the Public Office Election Law was made so that the election of members of the local public assembly and the head of the local public organization can be voted using the electromagnetic record-type voting machine (electronic voting machine) according to the regulations. Legislation that stipulates special provisions, “Act on voting methods using electromagnetic record-type voting machines related to elections of members of parliament and heads of local governments” (Electromagnetic Record Voting Law), February 1, 2002 The first stage of implementation became possible. As a result, when electronic voting is introduced in Japan, the electronic voting system is technically used in order to ensure reliability and safety so that election affairs can be executed fairly, properly, and without any hindrance. The Ministry of Internal Affairs and Communications presented “Technical Requirements and Explanations for Electronic Voting System” that stipulates the conditions that should be met, and more specific level of technical development based on this development guideline has been actively conducted by domestic manufacturers. I came. In response to the revision of the law, local governments have also become active, and the “New” Literature such as the “Marketing Electronic Voting Introduction Study Group Report” and the “Tokyo Metropolitan Electronic Voting System Study Group Report” in Tokyo, which is conducting detailed studies for implementation, have been released.
[0007]
In the direct recording method described above, the voting content is recorded on an electromagnetic recording medium instead of a paper medium. However, as described in the above document, voting is performed on one recording medium. There are a method of recording the vote data of each voter and a method of recording the vote data of a plurality of (or all) voters on one recording medium.
For example, as disclosed in JP-A-2000-48094, the former uses, for example, an IC card (voting card) as a recording medium, stores voting data in a form that is not linked to individual voters, and collects the IC card itself. It is. Since the voting data is physically stored separately, it is similar to the current paper voting method, but it is necessary to prepare as many media as the number of voters. There is a problem of cost and labor.
The latter is a method of collectively storing voting data in an electromagnetic recording medium attached to a voting terminal device or the like, as described in Japanese Patent Application No. 2002-111872 filed by the present applicant. Although it is necessary to consider that this method does not allow voting data to be associated with the voter from the polling place and the vote order, it is superior to the former in terms of cost and the like. As a means for eliminating the association between voters and voting data, which is a problem of this method, as mentioned in the detailed description of the invention of the above-mentioned application by the applicant, a method of recording voting data in random locations There is.
[0008]
FIG. 21 is a conceptual diagram for explaining the prior art of such random recording. The voting data 407 saved as one file on the original recording medium 408 (electromagnetic recording medium used as a voting recording original) shows a state in which voting results of a plurality of voters are formed. For example, a candidate record selected by a voter who voted third among a plurality of voters who voted by a voting apparatus equipped with the original recording medium 408 is displayed at the top level indicating the head area of the file. (That is, a set of data including candidate names, election types, and the like) is written. A candidate record selected and confirmed by the voter who voted first is written in the next area of the file, and a candidate selected and confirmed by the voter who voted second in the next area. Similarly, the records and the subsequent areas are recorded at random positions such as fifth, fourth, sixth, eighth, seventh, tenth, and so on. Needless to say, these recordings do not include information regarding the recording time or information unique to the voter. In this way, the results of voting by multiple voters are recorded in a random location on one file on the recording medium each time a vote is made, thereby easily severing the link between the voter and the voting data. The voter estimation in time series is to be excluded.
[0009]
[Problems to be solved by the invention]
However, the conventional random recording method described above has the following problems. FIG. 66 is a diagram for explaining the conventional voting data recording method in more detail. When actual file recording is performed, first, an empty area of a predetermined size is secured in block units (illustrated as “blank”), and random recording is performed within the block. Then, as a result of the voting result being written to that block, if there is no free space, a new free space is secured in units of blocks, and the blank area in the block is filled in similarly. Random recording is performed. For example, as shown in the figure, first, an empty area block 1 of a size capable of recording the voting results for five voters is secured, and the voting result of the first voter (illustrated as “voting data 1”) Is recorded in one of the five free areas in block 1, for example, in the second stage area from the top. Next, the voting result of the second voter (illustrated as “voting data 2”) is recorded in one of the remaining four free areas in block 1, for example, the third level area. Then, the vote result of the third voter (illustrated as “voting data 3”) is recorded in one of the remaining three free areas in the block 1, for example, the first stage area. Hereinafter, similarly, the fourth and fifth voters are recorded (illustrated as “voting data 4” and “voting data 5”), and when block 1 has no free space, block 2 is newly created. . Similarly, in block 2, the voting results of the sixth to tenth voters (“voting data 6” to “voting data 10”) are recorded at random positions.
[0010]
The problem with this method is that “the last voter's vote data may be identified” when counting votes. That is, in the figure, the eleventh voter in the block 3 is the last voter in the voting apparatus equipped with the electromagnetic recording medium, and the unit block of recording is every five people. Since the remaining four in the block 3 are free areas, it is specified that the data in the area where only data exists is that of the last voter.
Of course, the block here is merely a concept in data processing, and it is impossible to know that the unit block is every five people when the vote data 407 is analyzed at the time of counting votes. Therefore, if the unit block size is unknown, the eleventh voter is not identified as the last voter. For example, as shown in the figure as block 1 '(dash) and block 2' (dash), if 6 voters are unit blocks, the eleventh voter is in block 2 '. This is because the last voter included cannot specify which of the five data in the block 2 '.
However, the size of such a unit block is artificially determined as one of instructions to the information processing apparatus, and is at least known to the program developer. Therefore, even if confidentiality is imposed on the programmer, information may be leaked to the voter or an unauthorized third party due to unexpected factors. Regardless of whether or not such a confidential leak actually occurs, unless the possibility that the secret of voting is not protected in principle is excluded, the elector cannot make an election with peace of mind. In the first place, the secrecy of voting is related to the foundation of the election as stipulated in the Constitution. Therefore, if the possibility of tracking the voter remains, the reliability of the electronic voting system must be maintained. It is impossible to establish.
[0011]
Further, the conventional random recording has a problem that handling of the empty area in the block at the time of counting votes is troublesome in operation. In other words, the empty area present in the last block is in a zero (NULL) state in which no data exists, but this is not negligible at the time of voting, as in the case of conventional handling of wood dust inside the ballot box in self-form voting. Therefore, the existence of such zero data is not preferable in performing data processing for aggregation.
[0012]
The present invention has been made in view of the above situation, and in a direct-recording electronic voting apparatus that records the voting results of a plurality of voters on a single recording medium, any person can identify a voter from voting data. It is an object of the present invention to provide a voting data generation method, an electronic voting apparatus, and an electronic voting program that are impossible in principle and have sufficient security for confidentiality of voting.
[0013]
[Means for Solving the Problems]
In order to solve the above-mentioned problems, the present invention comprises the following means 1) to 11).
That is,
1) A voting data generation method for generating voting data by recording voting results by a plurality of electors on a single electromagnetic recording medium when voting by electronic voting,
Creating a plurality of files on the electromagnetic recording medium;
Randomly distributing the voting results to the created file;
Sequentially recording the sorted voting results for each of the files;
Recording the time information at which the recording was performed;
A voting data generation method characterized by comprising:
2) The voting data generation method according to 1), further comprising a step of deleting the time information.
3) The voting according to 1) or 2), wherein the step of performing the sequential recording does not provide an unrecorded interval area in the recording area of the electromagnetic recording medium, and records so as to fill the interval area. Data generation method.
4) In an electronic voting apparatus that generates voting data by recording voting results by a plurality of electors on a single electromagnetic recording medium at the time of voting by electronic voting,
Prior to the start of voting, file creation means for creating a plurality of files on the electromagnetic recording medium;
An identification code recording means for recording an identification code in the created file;
Informing means for informing the elector of information on the candidates for the election after the start of voting;
Input means for accepting a selection input operation of the candidate by the elector;
Temporary storage means for temporarily storing record data of candidates selected by the elector by the notification means and the input means;
A file selection means for selecting a file for recording the record from among the plurality of files when the elector confirms the record stored in the temporary storage means;
Writing means for sequentially writing the records stored in the temporary storage means for the selected file;
Writing means for writing time information at which the recording was performed;
An electronic voting apparatus comprising:
5) The electronic voting apparatus according to 4), further comprising means for deleting the time information.
6) The recording means for performing the sequential recording performs recording so as not to provide an unrecorded interval area in the recording area of the electromagnetic recording medium, and fills the interval area. Electronic voting device.
7) In an electronic voting program for controlling an electronic voting apparatus that generates voting data by recording voting results by a plurality of electors on a single electromagnetic recording medium at the time of voting by electronic voting,
Creating a plurality of files on the electromagnetic recording medium prior to starting voting;
Randomly selecting any of the files each time the voter voted;
Sequentially recording information of the storage means temporarily storing the vote result of the elector for the selected file;
Recording the time information at which the recording was performed;
An electronic voting program characterized by comprising:
8) The electronic voting program according to 7), further comprising a step of deleting the time information.
9) The electronic recording according to 7) or 8), wherein the sequential recording step performs recording so as not to provide an unrecorded interval area in a recording area of the electromagnetic recording medium, but to fill the interval area. Voting program.
10) In an electronic voting program for controlling an electronic voting apparatus that generates voting data by recording voting results by a plurality of electors on a single electromagnetic recording medium at the time of voting by electronic voting,
A first step of creating a number N of files for storing the voting data in the electromagnetic recording medium before starting voting for all the electors;
A second step of assigning a file name including an index of 0 to N-1 to each of the files;
After the start of voting by the elector, the information on the candidate for the election is output to the notifying means for notifying the elector, and the record of the candidate selected and input by the elector is stored in the temporary storage means. A third step of accumulation;
A fourth step of generating a random number when the elector confirms the candidate record in the temporary storage means; and
A fifth step of calculating a remainder value K obtained by dividing the generated random number value by the number N of the files;
A sixth step of opening a file whose index included in the file name is K;
A seventh step of adding the candidate records stored in the temporary storage means to the data on the file without any gaps on the opened file; and
When the writing of the file is finished, an eighth step of closing the file;
A ninth step of correcting the time information of the closed file to a fixed value;
An electronic voting program characterized by comprising:
11) The electronic voting program according to 10), which includes a loop process for continuing the processes of the third step to the ninth step until voting by all the electors is completed.
[0014]
DETAILED DESCRIPTION OF THE INVENTION
Hereinafter, the present invention will be described with reference to preferred examples. FIG. 1 is a conceptual diagram showing a voting data generation method applied to this embodiment. This figure shows a plurality of files (illustrated as voting data files 407a, 407b,... 407n) created on an electromagnetic recording medium such as an FD, a memory card, and a hard disk. It shows how the results of voting by the voter are recorded.
In an electromagnetic recording medium, N files having a zero file size (voting data files 407a, 407b˜, etc.) are used before starting voting, for example, when performing “zero vote confirmation” for confirming that no data exists on the medium. 407n) is generated. And when voting is started, every time a voter confirms voting, any one of N files is randomly selected, opened, and recorded, so that each file is randomly selected. Record in a distributed manner. For example, the voting data 1 having the voting result of the first elector is written in the voting data file 407a, and the voting data 2 having the voting result of the second elector is written in the voting data file 407b. The recording file is selected using a pseudo random number or the like generated by the information processing apparatus so that it is uniformly selected.
In each file, the voting data is written sequentially according to the temporal order. For example, as shown in the figure, the voting data 1, the voting data 3, and the voting data 4 having the voting results of the first, third, and fourth electors are sequentially written in the voting data file 407a. . Therefore, it is not necessary to secure a blank area, which was necessary in the conventional method of random recording in one file. As a matter of course, the update date of the file is deleted, or only the unique vote date information is set for voting, and the recording order cannot be traced.
[0015]
FIG. 2 is a flowchart of a voting data generation method applied to this embodiment. First, in step H1, N voting data storage files are created on an electromagnetic recording medium. Here, N is a natural number of 2 or more, and is a preset fixed value. For example, N = 10 is set. In order to identify N files, a numerical value of 0 to (N-1) is added to the file name. For example, VTP %%%%%%%% (N-1) .vot or VTS %%%%%%%% (N-1) .vot. However, %%%%%%%% is a numerical value (voting machine serial number 203a in an embodiment to be described later) for identifying an information processing apparatus in which the electromagnetic recording medium is mounted, and “.vot” is voting data. The extension “VTP” and “VTS” for identifying the above means the original (Primary Voting data) and the copy (Secondary Voting data), respectively. These files are empty files that have not been recorded yet as described above.
After these voting data files are ready, the voting of the first voter is started (step H2). During voting, the names of candidates for election are displayed to each voter and an input operation of the voter is accepted (step H3). In the conditional branch of step H4, when an input for confirming the candidate selected by the voter is made and the voting result is stored in a storage area such as a cache ("YES" in step H4), the process proceeds to step H5, Generate random numbers of arbitrary digits.
Then, a remainder K obtained by dividing the random value A by the number N of files, that is,
A numerical value K ranging from 0 to N-1 is obtained by K = A (mod N) (step H6). In step H7, the Kth file among the N files, that is, a file whose file name is VTP %%%%%%%% K.vot is opened. In step H8, the voting result in the cache is written on the file. Since the recording at this time is performed in the form of being added to the voting data file so far, no blank area is generated. When the writing of the file is completed, the file is closed after checking that the file has been normally written (step H9). In step H10, the time information is deleted by correcting the file update date and time to an arbitrary fixed value. In this way, the processing from Steps H3 to H10 is continued until voting by all the electors is completed (“NO” in Step H11).
[0016]
Hereinafter, the case where it applies to the system of the 1st step in the spread stage of an electronic voting system is demonstrated more concretely.
FIG. 3 is a diagram illustrating an example of the overall configuration of an electronic voting system using the electronic voting apparatus 203 according to the embodiment of the present invention. The electronic voting system shown in the figure is managed by an election management organization such as an election management committee or a central election management committee. It is roughly divided into an election data creation system 100, a polling place system 200, and a vote opening place system 300. Composed. Note that there are a plurality of election data creation systems 100 for each local government throughout the country, and a polling place system 200 is a system that is installed in each vote district for each election data creation system 100. A plurality of 300 are installed for each voted section. Therefore, there are a plurality of election data creation systems 100, a plurality of polling place systems 200, and a plurality of vote offices, but in the figure, for the sake of simplicity, one election data creation system 100, two polling place systems 200 are provided. Only two ticket office systems 300 are shown.
[0017]
The election data creation system 100 includes an election data management creation machine 101 and an election data media copy machine 102. The election data management and creation machine 101 includes an election type 402 (a type of election such as a single-candidate candidate election and a non-restrained list type proportional representative election), a card authentication key (hereinafter also referred to as an authentication key) 403, and a vote. Management of the program 404, update / deletion of candidate name / party registration, etc., and creation of candidate data 401 composed of a candidate screen and election data, for electronic voting devices and voting card issuance described later It is a subsystem that creates an election data master 400 for a machine and a voting data collection / aggregation machine in advance before voting.
In particular, when registering a candidate name / party name, data such as the candidate's name, affiliated political party, reading pseudonym, career, and pledge are stored in text format data in storage means (not shown) such as a hard disk or memory. To store. These data are also used to provide audio guidance for visually impaired people, such as ADPCM (Adaptive Differential Pulse Code Modulation) and MP3 (MP3: MPEG-1 / Audio Layer3, MPEG: Motion Picture Experts Group). ) Etc., and stored as audio data in an appropriate compression format. Furthermore, image information such as a candidate's face photograph and poster is stored as image data in an appropriate compression format such as JPEG (Joint Photographic Experts Group). The election data management creation machine 101 can be realized by a PC (Personal Computer).
[0018]
In the election data master 400 created by the election data management creation machine 101, a voting program 404, candidate data 401, and a card authentication key 403 are recorded. In this embodiment, the card authentication key 403 is a key for authenticating reading of the IC card. The election data master 400 is usually created as a single medium, tested by a test device possessed by an election management organization (hereinafter also referred to as election management committee, selection), and when approved, the election data media copier 102. It is transferred to.
[0019]
The election data media copying machine 102 is a device for copying the data of the election data master 400 that has been tested and approved by the selection to a plurality of media. The media created by the election data media copying machine 102 are a recording medium (copying recording medium) 409 distributed to an electronic voting apparatus 203 constituting a polling place system 200, which will be described later, and a ballot card issuing machine at the polling place. Is a recording medium (ticketing machine medium) 202 to be distributed.
[0020]
The voting program 404, the candidate data 401, and the card authentication key 403 are copied from the election data master 400 and recorded on the copy recording medium 409. An original recording medium 408 is prepared separately from the copying recording medium 409, and is distributed to the electronic voting apparatus 203 in an empty state in which no data is recorded on the original recording medium 408. The voting program 404 is an application program for executing voting control and voting data recording management using the candidate data 401 including the screen and voice guidance and the card authentication key 403 in the electronic voting device 203. The card authentication key 403 is data for performing voting card initialization and voting card validity authentication.
[0021]
In the ticket machine medium 202 built in the voting card ticket machine 201 in advance, the type of election 402 and the card authentication key 403 are copied and recorded from the election data master 400 by the election data media copying machine. The ticket issuing medium 202 is a recording medium necessary for starting the voting card ticketing machine 201. As the medium, an FD, an IC card, or the like is used.
[0022]
The polling place system 200 includes a voting card ticketing machine 201 and an electronic voting device 203. The voting card ticketing machine 201 is contrasted with an admission ticket (mainly a postcard mailed to the elector) distributed in advance to the elector's list created based on the Basic Resident Register or the abstract. This is a device for issuing a voting card 406 according to the described elector characteristics (types of obstacles) after confirming the identity. The voting card 406 can store a large amount of information by using, for example, an IC card. The voting card 406 includes a card issuance date, an elector characteristic ID 2021 that indicates the type of an elector's obstacle, a language classification, an election ID that indicates the type of election, a voting type, as illustrated in FIG. Such data is stored.
[0023]
The voting card ticketing machine 201 has a function of issuing an operation card 405 owned and managed by the voting manager. The voting manager uses the voting card ticketing machine 201 and uses a unique polling place ID 4055 (hereinafter also referred to as a management ID) created using the voting card authentication key 403 as an operation card (hereinafter also referred to as an administrator card) 405. To record. The operation card 405 records a polling place ID 4055 generated by using a card authentication key 403 common to all polling places generated by the election management committee. The operation card 405 is realized by an IC card or the like, and the polling place ID 4055 needs to have a different unique value for each polling place. When the operation card 405 is inserted into the electronic voting apparatus 203, the card authentication key 403 on the copy recording medium 409 attached to the electronic voting apparatus 203 is used to authenticate the reading of the operation card 405, and the polling place ID 4055. Read. The read polling place ID 4055 is stored in the RAM 453 (disk memory or the like) of the electronic voting apparatus 203. In this way, the polling place ID unique to the polling place is propagated from the voting card ticketing machine 201 to the electronic voting device 203, and the electronic voting device 203 is ready to accept the voting card 406 from the elector. At this time, since the polling place ID (management ID) is recorded and issued on the voting card 406, the voting cards other than the voting card 406 issued by the voting card issuing machine 201 in this polling place are different polling places. Since it has an ID, it will not be accepted.
[0024]
In the voting card 406, in addition to the polling place ID 4055, information that allows the elector to select the input / output means is recorded in the voting card ticket issuing machine 201. For example, an elector characteristic ID 2021 indicating that the person is visually impaired at a polling place is recorded in the voter card 406 of the elector who has a description of the visually impaired in the electoral characteristic column of the admission ticket, and is loaned to the elector. Is done. When the elector inserts the voting card 406 into the electronic voting device 203, the voting mode for visually impaired persons is entered, and an appropriate display input mode is selected. In order to protect the secrets of voting as stipulated in Article 15 of the Constitution, the voting card 406 preferably does not store personal information that can identify the elector who uses the card. Therefore, when using a card on which personal information such as a basic resident register card is recorded as a voting card, it is necessary to restrict reading of the personal information by the electronic voting device 203.
[0025]
A plurality of electronic voting devices 203 are installed at a polling place, and are devices for accepting votes by electors. When the electronic voting device 203 is installed at the polling place, no data relating to the election is stored, and the electronic voting device 203 is in an empty ballot box. A function as an electronic voting device can be achieved only after the data transfer related to the implementation election is completed from the election data system 100 to the electronic voting device 203. That is, the voting program 404, the candidate data 401, and the card authentication key 403 are transferred from the election data media copying machine 102 by the portable recording medium 409, and are transferred to the storage means (RAM 453 described later) of the electronic voting device 203. To be recorded.
[0026]
In addition, after the voting ends, the electronic voting apparatus 203 has all the voting data 407 that records the voting contents of the elector and all the elections existing inside the electronic voting apparatus 203 such as an electronic voting program (hereinafter also referred to as a voting program) 404. This data is automatically deleted from the RAM 453 when the power is turned off because the storage means uses a volatile memory. Then, a portable recording medium such as a memory card (that is, the original recording medium 408 and the copying recording medium 409) is sent to the ticket office system 300. In this way, it is possible to extremely reduce the risk of unauthorized operation by a third party by placing data and software related to the election in the electronic voting device 203 only during the voting time.
[0027]
The electronic voting device 203 reads the polling place ID 4055, which is an identification code issued by the voting card issuing machine 201, by the operation card (administrator card) 405 prior to the start of voting before the voting start time on the voting day. It has a function of storing in the electronic voting apparatus. The electronic voting device 203 has a function of reading a voting card 406 issued by the voting card issuing machine 201 to a voter who has confirmed the identity (hereinafter also referred to as an elector or a voter) after the voting start time. Have The voting card 406 records the same voting place ID as that recorded on the operation card 405 described above in the same voting place, and when the voter inserts the voting card 406 into the electronic voting device 203. After authentication of data reading by the authentication key 403 is successful, the authenticity of the inserted voting card is determined by reading the polling place ID recorded on the card and comparing it with the polling place ID inside the electronic voting device. To do. In addition to the polling place ID 4055, the electronic balloting device 203 reads the ballot 406 corresponding to the above-mentioned elector characteristic ID 2021 and the type of election that can be voted (illustrated as the type of election 402 in FIG. 3). A voting flag 2022 indicating the right is recorded. These data are sequentially read after collation of the polling place ID 4055 is successful.
[0028]
In the present embodiment, each of the plurality of electronic voting devices 203 in the polling place system 200 is configured to have an electromagnetic recording medium that can record the voting data 407. In this system, a local area network (LAN) is constructed, data of each electronic voting device 203 is transmitted online to one server, and the server records voting data 407 on a portable electromagnetic recording medium. It is good also as a structure.
[0029]
The ticket office system 300 includes a data collection / aggregation machine 301 and a printer for printing the aggregation results.
The voting data collection / aggregation machine 301 is installed at a plurality of polling stations and collects the voting data 407 of the electronic voting device 203 and the voting device serial number 203s (serial number given at the time of manufacturing each electronic voting device), It is an apparatus for associating both and storing them in storage means (not shown). In this embodiment, as a method for collecting the voting data 407, a physical transport unit using a portable original recording medium 408 is used. As another embodiment of the present invention, the polling place system 200 and the vote opening place system 300 are network-connected by an electric communication line, and data recorded in the electromagnetic recording media 408 and 409 are read out and transmitted over the network. It is also possible to configure. When such a hybrid network type system that uses both an electromagnetic recording medium and a network is adopted, continuous connection is not required, and data transmission can be performed collectively after the polling station is closed. It is possible to further increase security in
[0030]
Hereinafter, details of hardware and software constituting the electronic voting apparatus shown in FIG. 3 will be described with reference to FIG. 4 and subsequent drawings.
FIG. 4 is a perspective view showing an example of the exterior of the electronic voting apparatus 203 applied to this embodiment. The electronic voting device 203 includes a liquid crystal display device 20311 (hereinafter also referred to as an LCD; LCD: Liquid Crystal Display) and a touch panel 20313, a touch panel control board (not shown), an inverter board 20312 (to be described later), and a display unit 2031 that includes a casing. Have. The LCD 20311 visually notifies the voter of information related to the vote. The size of the LCD 20311 in this embodiment is 15 inches, and has a size and resolution (1024 × 768 pixels) sufficient to display a screen that is easy for anyone to see.
[0031]
The touch panel 20313 is a transparent film type resistive tablet that is arranged on the upper surface of the LCD and can input coordinates by touching with a finger or a stylus pen. The touch panel 20313 has a resolution (4096 × 4096 pixels) equal to or higher than that of the LCD, and when an operation button displayed on the LCD by a GUI (Graphical User Interface) is pressed from the touch panel, Reliable identification is possible. In addition, a voting card recording / reading unit 2032 (hereinafter also referred to as a card recording / reading unit, a card reader / writer, or a card R / W) that reads the voting card 406 is provided. Further, a speaker (voice output means) 2033 for performing voice voting operation guidance is provided.
[0032]
The electronic voting apparatus 203 has a front door 2030 that can be opened and closed by a padlock key 2030a managed by a voting manager at a polling place. Inside the front door 2030, as will be described later, a slot for inserting a recording medium (original recording medium 408, copying recording medium 409) for recording voting data 407, voting log 4075, and the like is stored. The front door 2030 is locked with the padlock 2030a to prevent unauthorized removal from the media by a third party. Further, the front door 2030 is provided with a sensor 20310 that can electrically detect the open / closed state. During the voting, when the front door 2030 is opened, it is detected as an abnormality and the operation of the status indicator lamp 20301 is performed. Displayed on the indicator lamp 20301b.
[0033]
The display unit 2031 including the LCD and the touch panel is configured to have a 15-degree inclination with respect to the horizontal plane in order to realize a height and shape that can be easily used by anyone. When installed on a table for self-form voting, the angle is set so that it is easy for a standing voter to see and can prevent snooping on the back of the voter.
[0034]
In the electronic voting apparatus 203, the size of the exterior part excluding the status indicator lamp 20301 is 350 mm in width × 350 mm in depth × 190 mm in height, and can be stacked in five stages when stored in a storage box (not shown). It can also be installed on a writing table that has been used in self-form voting. Moreover, since the weight of the electronic voting apparatus 203 is about 8 kg, it can be transported by one person alone, and is a weight that does not interfere with election affairs such as transportation to a polling place or installation.
[0035]
FIG. 5 is a perspective view showing an example of the exterior of the electronic voting apparatus 203 applied to the present embodiment. The housing unit of the display unit 2031 further includes a mechanism capable of adjusting the tilt of the display surface, and further includes a support mechanism (not shown) that is stable when operating the touch panel. It is preferable to adopt a barrier-free specification so that it is easy to operate even in a seated state. However, the angle of the display surface is not necessarily configured to be adjustable to an arbitrary angle. This figure is a perspective view when the display surface is arranged at 90 degrees (perpendicular) to the installation surface. As shown in FIGS. 4 and 5, the inclination of the display unit may actually be allowed to be selected by the voter from only two types of 15 degrees or 90 degrees with respect to the horizontal plane (installation plane). This has been revealed by field trials for disabled persons nationwide. Therefore, by omitting an adjustment mechanism for other angles, the manufacturing cost of a support mechanism (not shown) can be reduced. When using the display unit in an upright position, install it in an appropriate orientation, such as by turning the wall of the polling place behind so that the secrets of voting will not be leaked due to sneak peeking at the back when voting. Is preferred.
[0036]
FIG. 6 is a top view showing an example of the exterior of the electronic voting apparatus 203 applied to the present embodiment. The top view of the electronic voting apparatus 203 shown in the figure illustrates a state in which the display unit 2031 is tilted (that is, a state at 15 degrees from the horizontal plane). The electronic voting device 203 has a lock bracket 2030b. The lock bracket 2030b has a hole through which a shackle portion of a key such as a padlock 2030a can pass, and the diameter of the hole is large enough to allow the shackle portion of the key to be inserted and removed sufficiently, and the front door 2032 is locked. The size is such that no looseness occurs.
Further, the electronic voting apparatus 203 has a pen holder 2031b for holding a stylus pen 2031a. The stylus pen 2031a used for the touch panel input operation of the electronic voting device 203 is used selectively by the voter instead of touching the touch panel with a finger, and can be any pen-shaped article with a moderately sharp point. Anything can be used.
[0037]
The electronic voting device 203 has a slide cover 2035. In the figure, a state in which only half of the slide cover 2035 is opened is shown. A state indicator lamp cable 20301d for connecting the status indicator lamp 20301 to hardware inside the electronic voting apparatus is provided inside the slide cover. The status indicator cable 20301d passes through the inside of the pole 20301c (shown in FIG. 7) and is connected to the rear portion of the main body by a connector. This status indicator light cable 20301d is connected to a mother board 450 and a DC power source 20315 inside the electronic voting device, which will be described later, and displays the voting operation and the power state by the lighting state of the lamp. Can be visually monitored.
[0038]
Although not shown in FIG. 6, a plurality of terminals for connecting a barrier-free option related to display or input are arranged inside the slide cover. For example, it has a motor function disorder push switch terminal 2037 used in a voting mode performed by a motor function disorder push switch 20371 that can be used on a scan input screen in which candidate selection items move cyclically. In addition, a visually impaired person dedicated keyboard terminal 2038 for connecting a visually impaired person dedicated keyboard 20381 on which a tactile recognition pin display and a blind person keyboard are arranged, which can be used by an elector who is difficult to visually recognize a candidate screen display. Have Furthermore, a headphone terminal 2039 and the like for connecting a headphone 2091 with volume adjustment used in a voting mode in which voting is performed only by voice without using the display unit 2031 are arranged.
[0039]
FIG. 7 is a front view showing an example of the exterior of the electronic voting apparatus 203 applied to this embodiment. The status indicator lamp 20301 included in the electronic voting apparatus 203 includes a power indicator lamp 20301a, an operation indicator lamp 20301b, and a pole 20301c. The power indicator lamp 20301a is composed of LED (Light-Emitting Diode) of a color (for example, red) different from that of the operation indicator lamp, and the AC power source 20316 and the DC power source 20315 ( For power failure, a confirmation display of the power supply driving state such as an internal battery built in the electronic voting apparatus or an external battery connected to the electronic voting apparatus is performed. For example, when the LED is off, the AC power supply is being driven, when the LED is blinking, the AC power is not supplied, and no external battery is connected (while the internal battery is being driven), the LED is on, the AC power is not being supplied, and the external battery is being connected. By defining, a voting witness or the like away from the electronic voting device can always visually monitor the power supply state. The operation indicator lamp 20301b is composed of an LED having a color (for example, green) different from that of the power indicator lamp described above, and performs a voting status confirmation display according to three states of off, flashing, and on.
[0040]
For example, the electronic voting device defines whether the LED lighting state is voting, the LED off state is waiting for voting, the LED blinking state is an error occurrence, etc. It is possible to monitor from a position away from 203. As an example of the error occurrence, when the front door opening / closing sensor 20310 detects that the front door 2032 storing a recording medium for recording voting data, a power switch, etc. is opened during voting, a voting card reading error, which will be described later, is detected. The case where it generate | occur | produces is mentioned. The pole 20301c is a telescopic four-stage pole, and has a structure in which two colors of LEDs (green and red) are attached to the tip. In this embodiment, the maximum length is about 110 cm, and the height when installed on the table (75 cm height) is higher than the average height of the voters, It is set so that the voting manager and voting witnesses can easily monitor.
[0041]
The electronic voting device 203 has a voting confirmation LED 2034. The voting confirmation LED 2034 is a display LED indicating that the voting confirmation of the voting data 407 is completed when the voting data 407 and the voting log 4075 are normally recorded on the original recording medium 408 after the candidate selection confirmation by the elector It is. However, the voting is established when the voting data 407 and the voting log 4075 are recorded and confirmed in the original recording medium 408, as will be described later. In addition, the voting confirmation LED 2034 also has a function of clarifying whether or not voting is completed when an unexpected failure occurs during the voting operation.
[0042]
The electronic voting device 203 has a card insertion guide LED 2032a. The card insertion guide LED 2032a is a lamp for clearly indicating the insertion slot of the card recording / reading means 2032 to the voter. In the card insertion guide LED 2032a, the lighting state indicates that the voting card 406 (or the operation card 405) is inserted, and the blinking state indicates that the voting card 406 (or the operation card 405) is not inserted or is waiting to be removed.
The electronic voting apparatus 203 includes a power lamp 20308 (hereinafter also referred to as an AC input confirmation LED). The power lamp 20308 is a green LED for monitoring whether or not AC 100 V (50/60 Hz), which is a commercial power source, is input.
[0043]
FIG. 8 is a front view showing an example of the exterior of the electronic voting apparatus 203 applied to this embodiment (when the front door is open). Stored inside the front door 2032 are an original recording medium slot 20303, a copying recording medium slot 20304, and a power switch 2032. At the time of voting, since the voting manager locks the front door 2032 with a small padlock 2030a on the lock bracket 2030b, it is prohibited for a third party to touch the inside of the front door illegally. Although not shown in the drawing, a front door opening / closing sensor 20310 (shown in FIG. 10) is also stored, and functions as a double key for monitoring unexpected unlocking of the front door.
[0044]
The original recording medium 408 installed in the original recording medium slot 20303 refers to a recording medium on which voting data 407 is first recorded by an elector after confirmation of candidate selection. Normally, after the voting data is recorded, a voting log 4075 is also recorded. The original recording medium 408 sent to the polling place is generally a blank medium on which no data is recorded, and the voting data needs to be “zero vote”. The copy recording medium 409 installed in the copy recording medium slot 20304 is a medium on which the same data is copied and recorded after the voting data is recorded on the original recording medium 408 as a backup of the original recording medium 408. . The copy recording medium sent to the polling place may be supplied with data such as a voting program 404 for starting up the electronic voting device 203, candidate data 401, a voting card authentication key 403, and the like. Various recording media such as FD and rewritable compact discs (CD-RW: Compact Disk Rewritable) can be recognized as these recording media (an electronic method, a magnetic method, and others cannot be recognized by human perception). In this embodiment, it is a non-volatile memory that does not require a mechanical unit, although it is possible to use a recording medium that is produced by a method and used for information processing by an electronic computer. By using a compact flash memory card (registered trademark: hereinafter referred to as a CF memory card), the cause of failure is eliminated.
[0045]
These CF memory cards are inserted into the original recording medium slot 20303 and the copying recording medium slot 20304 using a CF memory card adapter (memory card socket). As the memory card socket, a CF / Type 1 dedicated PCMCIA (PCMCIA: Personal Computer Memory Card International Association) interface card can be used. The original recording medium slot 20303 and the copying recording medium slot 20304 are double push button type (to the media socket), that is, the media detaching operation becomes effective by the first pushing operation of the media detaching lever, and the media is pushed by the second pushing. Is configured to be removable, so that a memory card attached can be easily removed.
[0046]
The power switch 2032 is a switch for turning on / off the AC 100 V commercial power supply of the electronic voting apparatus 203. The actual input state of the power supply voltage can be confirmed with the power lamp 20308 or the power indicator 20301a.
[0047]
FIG. 9 is a rear view showing an example of the exterior of the electronic voting apparatus 203 applied to the present embodiment. The electronic voting apparatus 203 includes a volume 2033a, a power cable, an external display terminal 20302, and the like. The volume 2033a is used for adjusting the volume of the speaker 2033 described above. The reason why the volume 2033a is arranged on the back side of the apparatus is to prevent the elector from performing the volume operation during the voting. On the other hand, the reason why it is not arranged inside the locked front door 2032 is to allow the voting witness to make adjustments as needed without interrupting the voting program when necessary. When an elector who performs voting by voice guidance uses the barrier-free headphones 20391 without using the display unit 2031, the speaker volume is increased when the barrier-free headphones 20391 are connected to the headphone terminal 2039. Disconnected automatically. The headphone volume is adjusted using the attached volume control function.
[0048]
The electronic voting device 203 has an external display terminal 20302. For example, a head-mounted display that is a visual display worn on the head can be connected to the external display terminal 20302. This is used instead of the display unit 2031 by an elector who is difficult to get up, or who is difficult to keep the display unit 2031 in sight, such as an involuntary campaigner with involuntary movement. can do.
[0049]
FIG. 10 is a diagram illustrating an example of a hardware configuration inside the electronic voting apparatus 203 applied to the present embodiment. The motherboard 450 has a CPU 451 (CPU: Central Processing Unit), a ROM 452 (ROM: Read Only Memory), a RAM 453 (RAM: Random Access Memory), a bus and a connector for connecting various devices on the board. ing.
The ROM 452 is a read-only memory that stores a BIOS (BIOS: Basic Input / Output System) that is basic software for controlling data transfer between the OS and hardware. The RAM 453 is a volatile main memory, and functions as a RAM disk that temporarily stores data such as the voting program 404 and the candidate data 401 loaded from the copy recording medium 409 only during voting.
[0050]
A silicon disk 454 (silicon disk) is a disk memory using a CF memory card, and is connected to the mother board 450 through an IDE standard (IDE: Integrated Device Electronics) interface. The silicon disk 454 stores an OS 411 (OS: Operating System) and various drivers, and functions as a system disk. Unlike a hard disk (HD: Hard Disk) which is a commonly used system disk, there is no physical drive part such as a magnetic head, so the failure rate is low and high-speed access is possible. Hereinafter, the silicon disk 454 is also referred to as a system disk 454.
[0051]
A VRAM 456 and an LCD 20311 are connected to the mother board 450 by LVDS (LVDS: Low Voltage Differential Signaling image information general-purpose interface standard with high speed and low power consumption). The LCD 20311 is a TFT liquid crystal (TFT: Thin Film Transistor) with a diagonal size of 15 inches (38.1 cm), a color screen with a resolution of 1024 × 768 pixels, RGB 64 gradations of 260,000 colors, and a brightness of 170 cd. Can be displayed.
[0052]
The touch panel 20313, which is a transparent tablet placed on the LCD 20311, is connected to the motherboard 450 according to the RS-232 standard (standard interface for serial data transmission), has a diagonal size of 15 inches, and a resolution of 1024 × 1024. Has pixel performance. As a detection method of the input operation of the touch panel 20313, it is preferable to use a resistance film method that is excellent in environmental resistance against water and dust. The resistance film method is to electrically detect that an electrode (transparent conductive substrate) provided between two pieces of glass is energized by pressing a finger or a stylus pen.
[0053]
The card reader / writer 2032 is an apparatus for reading or writing an IC card, which is an example of the voting card 406 or the operation card 405 applied to the present embodiment, and is connected to the motherboard 450 via an RS-232 interface. The card reader / writer 2032 automatically carries in and discharges the voting card 406 or the operation card 405. The card transport speed is about 200 millimeters per second and the transport time is 1/4 second.
[0054]
The speaker 2033 is for voice guidance, and corresponds to both non-disabled persons and persons with impaired motor function. It is arranged near the card insertion slot of the electronic voting device 203.
The volume adjustment volume 2033a adjusts the speaker volume. Does not affect the headphone volume.
[0055]
A CF memory card, which is an example of an original recording medium 408 or a copying recording medium 409 applied to the present embodiment, is mounted on a CF memory adapter and connected to the motherboard 450 through a PCMCIA interface. Voting data and a voting log are recorded on the original recording medium 408, and backup recording of the original data is performed on the copying recording medium 409. These media packages are printed on the “original” or “secondary” to prevent confusion.
[0056]
The status indicator lamp 20301 is composed of two color lamps, an operation indicator lamp 20301b which is a green LED and a power indicator lamp 20301a which is a red LED. The operation indicator lamp 20301b is connected to the mother board 450 through a GPIO standard (GPIO: General Purpose Input / Output) interface, and performs confirmation display of the voting state. The display of the operation indicator lamp 20301b is expressed using three states of lighting, extinguishing, and blinking of the lamp. For example, the lighting is defined as voting, the lighting is waiting for voting, and blinking is defined as an error occurrence.
[0057]
On the other hand, the power indicator lamp 20301a is connected to a direct current power source (also referred to as a DC power source) 20315, and performs a confirmation display of the power supply driving state. Similarly, the power indicator 20301a can be expressed using the above three states. For example, “OFF” indicates that AC power supply (also referred to as AC power supply) is being driven, “flashing” indicates that AC power supply is not being supplied, and external battery 20316 is not connected (that is, internal battery 20314 is being driven), It is defined that the external battery 20316 is being connected. Note that the external battery 20316 is a battery connected to the outside of the electronic voting device 203 by a dedicated connector, and enables voting during a long-term power outage. As an example, a vehicle-mounted battery is mentioned.
[0058]
The voting confirmation LED 2034 notifies the elector that the voting confirmation of the voting data is completed when the voting data 407 and the voting log 4075 are normally recorded on the original recording medium 408 after the candidate selection by the elector is confirmed. Display LED. The voting confirmation LED 2034 is connected to the motherboard 450 through a GPIO interface. When the voting confirmation LED 2034 is in the lit holding state, it is defined that the voting data is normally recorded on the original recording medium, and when the voting data is in the unlit state, the voting card is extracted. Since the voting confirmation LED 2034 is turned on and off by hardware control, even if an unexpected failure such as a hang-up caused by software occurs during the voting operation, the lighting state is saved, and voting is performed when an error occurs. It is possible to clarify whether it has been completed or not.
[0059]
As described above, the electronic voting apparatus 203 applied to the present embodiment is provided with a display function for indicating an operation state in addition to the screen display by the LCD 20311 for the vote manager and the operator. Since these display states are latched by GPIO, even if the voting program 404 is stopped, the information is saved if the power supply is energized and the circuit is operating.
[0060]
A plurality of card guide LEDs 2032a are arranged at the card insertion port of the card reader / writer 2032 and are used for guiding the elector to insert or withdraw the voting card 406 and the operation card 405. The card guide LED 2032a is connected in parallel with the motherboard 450 through a GPIO interface. In the card guide LED 2032a, the lighting state indicates that an IC card is being inserted, and the blinking state indicates an IC card insertion waiting state.
[0061]
The power supply LED 20308 (also referred to as an AC input confirmation LED) is an LED for monitoring that an AC power supply (for a commercial AC power supply in Japan, AC 100V, frequency 50 Hz or 60 Hz) is supplied. . The power LED 20308 is connected to the DC power supply 20315 through the GPIO interface, and monitors the voltage of the AC power input to the DC power supply 20315. The power LED 20308 indicates that the lighting state is when the AC power is supplied, and the lighting state is when the AC power is off.
[0062]
A junction board 455 (also referred to as a junction board) is connected to the mother board 450 through an RS-232 interface. The junction board is a dedicated board that performs communication control and data communication by connecting a barrier-free dedicated keyboard, headphones, a push switch, or the like on the board. On the junction board 455, a push switch terminal 2037 for motor function disorder, a dedicated keyboard terminal 2038 for a visually impaired person, and a headphone terminal 2039 are arranged, and an optional device compatible with barrier-free can be connected. Connected to the push switch terminal 2037 for motor function disorder is a 3.5φ make contact type push switch that is an input device for electors with motor function disorders, which is difficult to input with the touch panel 20313 of the electronic voting device 203. Is done.
[0063]
The elector can use the push switch to vote according to a scan screen (a voting screen in which selection items are automatically and sequentially switched). The dedicated keyboard terminal 2038 for visually-impaired persons and the headphone terminal 2039 are respectively connected to a dedicated keyboard 2081 for visually-impaired persons and headphones 20391 with volume control. An elector who has a visual disability can perform voice voting by using both a dedicated keyboard 20381 that can be input on a desk or hand and a headphone 20391 with volume control for voice voting guidance. Voice voting keyboard for visually impaired people (also used for people with motor disabilities) is composed of six function keys (○, ×, ←, →, △, flat buttons) with braille, up, down, left, right Both have a 26 mm pitch. When the headphone 20391 with volume adjustment is connected to the headphone terminal 2039 on the junction board 455, the connection to the speaker 2033 is automatically disconnected.
[0064]
A CLOCK 457 (also referred to as a built-in clock) is a clock module mounted on the mother board 450. The time information by CLOCK 457 is used, for example, when creating a voting log 4075 in which an operation state including a voting operation is recorded as a voting audit record (audit trail).
[0065]
FIG. 11 is a diagram illustrating an example of a data structure inside the RAM 453 inside the electronic voting apparatus 203 applied to the present embodiment. The RAM 453 has a voting program area 404b for temporarily storing the voting program 404 while voting is being performed. The voting program 404 is copied from the election data master 400 to the copy recording medium 409 and distributed to the polling place system 200 in the election data media copying machine 102 in the election data creation system 100. When the copy recording medium 409 is loaded into the electronic voting apparatus 203 via the copy recording medium slot 20303, the voting program 404 is loaded into the voting program area 404 b on the RAM 453 by the program loader 436.
[0066]
The RAM 453 has a candidate data area 401 b for storing candidate data 401.
The RAM 453 has an authentication key area 403b for storing an authentication key 403 for reading the voting card 406 and the operation card 405.
The RAM 453 has a polling place ID area 4055b for storing a polling place ID that is a random number issued by the ticket issuing machine 201.
The RAM 453 has a voting data area 407b for temporarily storing the voting data 407 until the voting data 407 by the elector is recorded on the original recording medium 408 and the copying recording medium 409 and collation is performed. This cache area does not exist at a fixed address. It is appropriately allocated to a free address.
[0067]
The RAM 453 has a voting log area 4075b for storing the voting log 4075.
The RAM 453 has a local disk area 4075b for copying and storing an OS 411 and a driver, a voting program 404, candidate data 401, and the like recorded on a system disk to be described later.
[0068]
FIG. 12 is a diagram showing an example of a data structure inside the silicon disk 454 used as a system disk inside the electronic voting apparatus 203 applied to the present embodiment.
The silicon disk 454 has an area for storing the program loader 436. The program loader 436 is a program for loading the voting program 404 from the copy recording medium 409.
The silicon disk 454 has an area for storing the voting device serial number recording unit 203s.
[0069]
The silicon disk 454 has an area for storing the I / O control unit 412. The I / O control unit 412 is a program for performing control to continuously input or output data bit by bit when data is input / output.
The silicon disk 454 has an area for storing the window control unit 413. The window control unit 413 is a program for managing a display portion divided by a frame or the like in a screen displayed on the touch panel LCD 2031 or the like.
The silicon disk 454 has an area for storing the file control unit 414. The file control unit 414 is a program for performing file maintenance such as file registration, addition, modification, and deletion, and file protection that restricts access to a specific file.
[0070]
The silicon disk 454 has an area for storing the card control unit 415. The card control unit 415 is a program for controlling carry-in, carry-out, reading and writing of the voting card 406 or the operation card 405 issued by the card ticket issuing machine 201.
The silicon disk 454 has an area for storing the touch panel control unit 416. The touch panel control unit 416 is a program for controlling input from the touch panel on the touch panel 20313.
The silicon disk 454 has an area for storing the junction board controller 418. The junction box control unit 418 is a program for controlling various external input / output devices connected to the electronic voting device 203 through the barrier-free input / output device connection terminals 2037, 2038, 2039, and 20302.
[0071]
The silicon disk 454 has an area for storing the OS 411. The OS 411 is not particularly limited, but, for example, Windows (registered trademark) NT embedded, which is an OS made by Microsoft Corporation, can be used. The OS 411 is an embedded OS specialized for device control, and can operate even in the absence of an external input device such as a mouse or a keyboard. The OS and other system disks recorded on the silicon disk can be copied to the local disk area 454b of the RAM 453 for operation.
[0072]
The silicon disk 454 is written with the necessary program data and the electronic voting device serial number recording unit 203s which is a unique device management serial number at the time of shipment from the factory, and is then subjected to write filter processing to become a read-only memory (ROM). . With this process, the system disk cannot be rewritten by the electronic voting device 203.
[0073]
FIG. 13 is a diagram showing an example of the structure of the voting program 404 loaded from the copying recording medium 409 and stored in the RAM 453 inside the electronic voting apparatus 203 applied to this embodiment.
The voting program 404 has a card reading unit 431. The card reading unit 431 is a program for controlling reading of data recorded on the card after the voting card 406 or the operation card 405 provided in the form of an IC card or the like is carried into the card record reading unit 2032 It is.
[0074]
The voting program 404 includes a candidate data reading unit 432. The candidate data reading unit 432 is a program for controlling electronic reading of a database (described later with reference to FIGS. 14 to 20) constituting the candidate data 415 stored on the RAM 453.
The voting program 404 has a voting screen creation unit 433. The voting screen creation unit 433 is a program for controlling creation of a screen displayed on the LCD 20311 when an elector votes. Candidate information or layout information necessary for screen creation is read from a database (described later, a fixed screen layout table 401d in FIG. 18 and a voting screen layout table 401e in FIG. 19) included in the candidate data 401. .
[0075]
The voting program 404 has a voting data recording unit 434. The voting data recording unit 434 is a program for controlling recording of voting data 407 (voting result) of an elector on a portable electromagnetic recording medium. That is, the voting data recording unit 434 records the voting data 407 read into the voting data area 407 b of the RAM 453 on the original recording medium 408, then compares the voting data 407 with the RAM 453, and further copies to the copying recording medium 409. . When the voting data is stored in the two recording media of the original and the duplicate, the file is opened, the data is written, the file is closed, the cache is ejected, and the recording is determined independently for each medium. Thus, by eliminating the active state of the two recording media at the same time, the data of any one of the recording media can be secured in the event of a failure.
[0076]
The voting program 404 has a voting control unit 435. The voting control unit 435 is a program for controlling switching of voting screens when an elector performs a voting operation. The voting screen includes a candidate selection screen (shown in FIG. 43) for displaying a list of candidates that can vote, and a candidate confirmation screen (in FIG. 52) for displaying the candidates temporarily selected by the elector and confirming the voting intention. Etc.).
When Windows (registered trademark) is used as the OS 411, the voting program 404 is Visual Basic (Visual Basic) which is a simple programming language that depends on the OS 411. ^TM ) Is convenient to create.
[0077]
The voting program 404 is an application program supplied via an electromagnetic recording medium (copying recording medium 409), and cannot be resident in the electronic voting device 203. Newly loaded onto the disk 453. The supply form of the voting program 404 is an appropriate compressed format file. When loading from an electromagnetic recording medium, the program loader 436 checks the validity of the program by checking the validity of the program. The correctness is confirmed by calculating and comparing error detection codes. After loading the program, further error detection is performed by checking the CRC check during compression / decompression processing.
[0078]
FIG. 14 is a diagram showing an example of the structure of candidate data 401 stored in the RAM 453 inside the electronic voting apparatus 203 applied to this embodiment. The candidate data 401 is composed of six types of tables that exist as text format files. That is, first, candidate tables 401a1 to 401an existing for each election ID for identifying the type of implementation election, second political party table 401b, third polling place group table 401c, fourth fixed screen layout table 401d, Fifth, voting screen layout tables 401e1 to 401en existing for each election ID, and sixth, a display message table 401f) have a relational database (RDB: Relational Data Base) structure associated with each other.
[0079]
Furthermore, there are image files (candidate image data and political party image data) and audio files (voice guide data, etc.) which are binary format files referenced from these tables. These are related by referring to the relative position (path) of the file from each table. As a binary file reference method, an audio or image file existing in a directory specified in advance can be referred to by specifying a file name in the field portion of the table. File management by directory uses the function of the OS, which is basic software.
[0080]
FIG. 15 is a diagram illustrating an example of a candidate table 401a1 (for election ID = 1) constituting candidate data 401 applied to the present embodiment. The polling place table 401c is configured as a table having fields such as a candidate ID 401a1a for identifying a candidate, a candidacy notification name 401a1b, a candidate name furigana 401a1c, a birthplace 401a1d, a political party ID 401a1e for identifying a political party to which it belongs. For example, in the record whose candidate ID 401a1a field value is “00001”, the candidate notification name is “Takayoshi Kido”, candidate name furigana 401a1c “Kidaka Takayoshi”, birthplace 401a1d “Yamaguchi Prefecture”, political party ID 401a1e “002” Is stored.
[0081]
Also, another reading of the candidate name is registered in the candidate table 401a1. In the conventional self-form voting, it is only necessary to copy the registered name of the candidate posted on the table of the polling place on the ballot, and it was possible to vote without knowing the reading of the actual candidate name. . For example, if the registered name of the candidate is “Taro Kono”, even if you forgot or do not know whether the reading pseudonym is “Taro Kono” or “Taro Kawano”, the ballot will contain “Taro Kono” It was possible to vote simply by copying. However, when entering the initials of the candidate, there is a possibility that a restriction may occur that the search cannot be performed unless the reading kana is known. In order to avoid such restrictions, in this embodiment, another reading pseudonym of the name of the candidate who is easily mistaken is prepared, and in the above example, either “ko” or “ka” is selected. Also, the candidate “Taro Kono” is displayed. That is, according to the present embodiment, it is possible to search for any reading pseudonym that is likely to be mistaken by simultaneously recording various readings of the candidate as candidate data.
[0082]
FIG. 16 is a diagram illustrating an example of a political party table 401b constituting candidate data 401 applied to the present embodiment. The political party table 401b has fields such as a political party ID, a language ID, and a political party name. For example, a record whose political party ID field value is “002” means that the political party name is “Choshu Party”, and the above-mentioned Takashi Kido belongs to the Choshu Party. The party ID field is called a primary key in the database technology, and is related to the party ID field in FIG.
[0083]
FIG. 17 is a diagram illustrating an example of a polling place group table 401c constituting candidate data 401 applied to the present embodiment. The polling place group table 401c has fields such as an election ID and an election name for identifying an election type, an election district ID and an election district name for identifying an election district, and the like. In the election ID field, when the voting program 404 reads a voteable election ID value recorded on the voting card 406, only a necessary election ID record is extracted and used.
[0084]
FIG. 18 is a diagram illustrating an example of a fixed screen layout table 401d constituting candidate data 401 applied to the present embodiment. The fixed screen layout table is a table for defining a common screen layout irrespective of the type of election. The fixed screen layout table 401d has a field of an elector characteristic ID 2021 for identifying the type of physical obstacle of the elector (voter). In the record for each elector characteristic ID, the screen ID for identifying the type of the display screen, the function ID for identifying the function of the screen, the front color and the background color for defining the display color, the font of the display character, the size, and the display are displayed. It has fields for storing layout data such as the horizontal coordinate and vertical coordinate of the object. The screen ID field is a field for defining a basic layout of a common screen composed of a small number, rather than creating a completely different screen depending on the type of election (that is, election ID) each time. Variations based on this common basic layout are realized in fields that define colors, sizes, coordinates, alignment information, and the like.
[0085]
The basic layout according to this embodiment includes a single-page candidate selection screen, a candidate confirmation screen, a candidate selection method confirmation screen, a candidate number input screen, a candidate selection page guidance screen, an abstention confirmation screen, and a multi-page candidate. Seven layouts of selection screens are sufficient. For example, the candidate selection screen in the single entry candidate election and the political party selection screen in the restricted list type proportional representative election can be created by using the same screen ID. In this way, by sharing a small number of fixed screens, it becomes very easy to create a candidate screen, and it is possible to reduce the burden of office work for creating candidate data by selection.
[0086]
FIG. 19 is a diagram showing an example of a voting screen layout table 401e1 (for election ID = 1) that constitutes candidate data 401 applied to the present embodiment. The voting screen layout database 401e1 is a table for defining different screen layouts according to the type of election, the number of candidates to be displayed on the screen, or the value of the elector characteristic ID. The voting screen layout table has fields such as an elector characteristic ID, a screen ID, a function ID, a foreground color, a background color, a size, a horizontal coordinate, and a vertical coordinate. The table selects a necessary voting screen layout table based on an executable election ID recorded on the voting card 406, and further defines a screen layout suitable for each obstacle of the constituency based on the elector characteristic ID. .
[0087]
FIG. 20 is a diagram illustrating an example of the display message table 401f constituting the candidate data 401 applied to the present embodiment. The display message table 401f defines character strings that are not stored in the candidate table 401a1, the political party table 401b, or the polling place group table 401c, and should be displayed on the screen. For example, when the record of the message ID “00001” is referred to by the voting program 404, a message “Please insert a voting card” is displayed on the screen, and the voting card 406 is displayed to the elector on the electronic voting device 203. Can be urged to insert.
[0088]
FIG. 21 is a diagram showing an example of the data structure of the original recording medium 408 stored in the electronic voting apparatus 203 applied to this embodiment. The original recording medium 408 refers to a recording medium on which voting data 407 is recorded for the first time after confirmation of candidate selection by an elector. In this embodiment, the voting log 4075 is also recorded after the voting data is recorded. The original recording medium 408 sent to the polling place is generally a blank medium on which no data is recorded, and the voting data needs to be “zero vote”. The voting data is recorded in a random order in order to keep the voting secret. For example, the voting data 2 area for storing the voting data 407 of the second voter is allocated to the area adjacent to the voting data 8 area for storing the voting data 407 of the eighth voter. At that time, as already described with reference to FIG. 1, a plurality of files are secured, and voting data and voting logs are randomly allocated to the respective files.
[0089]
FIG. 22 is a diagram showing an example of the data structure of the copy recording medium 409 stored in the electronic voting apparatus 203 applied to this embodiment. The copy recording medium 409 has an area for storing a voting program 404 distributed from selection, candidate data 401, and a card authentication key 403. As described above, these are copied to the RAM 453 of the electronic voting apparatus for use, but the data is stored thereafter. Then, a copy of the voting data 407 on the original recording medium is recorded in such a form that it is appended to them.
[0090]
By the way, the original recording medium 408 and the copying recording medium 409 having the data structures shown in FIGS. 21 and 22 have human perception when recording information on which candidate has been selected by the elector in electronic voting. Therefore, it is recorded in an unrecognizable manner and has a form different from that of a conventional ballot. A recording medium for recording a vote in electronic voting is a recording medium on which vote information by an elector is recorded electronically, magnetically, or by other methods, and information processing by a computer is possible.
[0091]
Specific examples of the recording medium include a CF card with a built-in flash memory. A multimedia card (registered trademark) such as an SD memory card, smart media (registered trademark), or memory stick may be used as a memory card of another standard. A memory card is lighter than a hard disk or the like, and is strong against vibration, so it has excellent data transport and storage, and is inexpensive. Of course, it is needless to say that an FD, an optical disk (CD, DVD), a magneto-optical disk (MO), or the like can be used as an electromagnetic recording medium.
[0092]
In this embodiment, two memory cards (original recording medium 408 and copying recording medium 409) are used for one electronic voting apparatus as recording media for recording the data shown in FIGS. To do. In this embodiment, these serve as a carrier when carrying data necessary for the election from the election data creation system 100 to the electronic voting device 203 of the polling place system 200 before the election. During voting, it is mounted on the electronic voting device 203 and has a function as an alternative to the conventional ballot, that is, a function for reliably recording and holding candidate names voted by the elector as electromagnetic data.
[0093]
And after voting, it has a function as a carrier at the time of conveying the voting data 407 from the polling place system 200 to the vote opening place system 300. In the case where the law is revised in the future, when the present invention is implemented as a network type system, the electromagnetic recording media 408 and 409 are the election data creation system 100, polling place system 200, and vote opening place system 300. The base has a function of temporarily recording and storing data in the base before performing network transmission. Compared to a network type system that does not use an electromagnetic recording medium in the present invention, the risk of data loss due to a network failure is extremely low.
[0094]
FIG. 23 is a diagram illustrating an example of a data structure of the voting card 406 or the operation card 405 inserted into the electronic voting apparatus 203 applied to the present embodiment. The voting card 406 or the operation card 405 stores a card authentication key 403 that is a key for authenticating access to data recorded on the card, and the authentication is successful by the card authentication key stored in the RAM 453 of the electronic voting device 203. It is configured so that internal data can be read and written only in the case of The following data is recorded inside the voting card 406 or the operation card 405. That is, a municipality ID, an elector characteristic ID 2021 indicating the type of disability of the elector, a language classification that distinguishes the language type displayed by the electronic voting device 203, a polling place ID that is an ID unique to the polling place, and a designated vote Voting type that identifies voting at a place, absentee voting or circuit voting, the date of ticketing issued by the card-issuing machine 201, the number of possible elections, which is the number of elections when multiple elections are held on the same day, Data such as a voting flag 2022 for identifying whether each of the elections (election ID = 1, 2 to m, illustrated as n) has a voting right or not issued is stored.
[0095]
The electoral characteristic ID is recorded when the poll attendant issues a ballot card based on the description in the electoral characteristic column of the admission ticket that is created based on the electoral list and mailed to the elector in advance. The For example, for an elector who has a description of a visually impaired person in the elector characteristics column, an elector characteristic ID = 01 indicating that he is a visually impaired person is recorded in the voting card 406. When the elector inserts the voting card 406 into the electronic voting device 203, the voting program 404 reads the elector characteristic ID 2021 and refers to the corresponding candidate data 401 from the database, thereby enabling the visually impaired person Voting can be performed in the display input mode.
[0096]
Note that the media of the voting card 406 or the operation card 405 in which data is recorded uses an IC card, so that more information can be set and data access rights can be set or data can be set compared to other recording cards. It can be safely stored by encrypting itself with TDES (TDES: Triple Data Encryption Standard) or the like. Of course, a magnetic card can be used instead of the IC card, and an optical recording medium can also be used. It is also possible to use irreversible recording of a computer generated hologram (CGH) and a hybrid card of an IC card. It is also possible to perform recording on a liquid crystal recording medium known as electronic paper. Or you may use the OMR system (OMR: Optical Mark Reader) which optically reads the character or barcode recorded on the printing medium by paper.
[0097]
In the voting card 406, in order to protect the secrets of the voting stipulated in Article 15 of the Constitution, no personal information that can identify the elector who uses the voting card 406 is recorded. Therefore, when a card on which personal information such as a basic resident register card (also referred to as a resident card or a resident card card) is used as a voting card, the voting data generated by the electronic voting device 203 is personal information. It is necessary to have a function that guarantees that it will not be read.
[0098]
FIG. 24 is a diagram showing an example of the data structure of the voting flag 2022 recorded on the voting card 406 applied to the present embodiment. The voting flag 2022 is an identifier (token) indicating whether or not the voting right exists, and conventionally, double voting has been prevented by a value indicating whether or not voting is possible. However, such a conventional token has a problem in that it is difficult to deal with a voting card reading error. That is, when an elector selects a candidate and touches the confirmation button, and the voting data is recorded on the original recording medium 408, but a write error occurs when the voted flag is recorded on the voting card, It is difficult to immediately determine whether or not the vote is confirmed.
[0099]
Therefore, in the present invention, the use of a voted flag as a voting flag is abolished, and only two types are available: a voting enabled state and a card not issued. That is, whether or not voting has been completed is determined not by the voting card 406 but by hardware by the voting confirmation LED 2034. Then, as a measure for preventing double voting, after confirming a voting flag, the voting card is initialized and ejected inside the electronic voting device, making it non-reusable. The vote flag 2022a of the election ID = 1 is “Possible to vote”, the vote flag 2022b of the election ID = 3 is “Not issued”, and the vote flag 2022c of the election ID = 3 is “ "Can vote" is recorded. When the card reading unit 431 (detailed in FIG. 25) of the voting program 404 reads these pieces of information, it is determined that the elections that the elector can vote are election ID = 1 and election ID = 3. The candidate data reading unit 432 extracts candidate data 401 corresponding to these election IDs from each table of the database, and the voting screen creation unit 433 determines a screen layout corresponding to the number of candidates, A candidate selection screen as shown in FIG. 43 is displayed.
[0100]
The voting card 406 according to the present invention issues a ticket to an elector who has the voting right. In order to eliminate fraudulent voting, the voting card 406 is used to check the voting right based on the information recorded in the voting card after the ticket is issued. Not used for. The electronic voting device 203 displays information about the right to vote as much as possible when a failure occurs.
[0101]
Data stored in the voting card 406 or the operation card 405 shown in FIGS. 23 and 24 is recorded as a 7-bit ASCII code (ASCII: American Standard Code for Information Interchange). For example, when the elector characteristic ID 2021 is recorded as the ASCII code “30”, the elector characteristic ID 2021 illustrated in FIG. 59 means “00”, that is, a non-disabled person. The voting flag 2022 indicates whether or not voting is possible. If it is defined that 0 in a decimal number is not issued and 1 is in a votable state, for example, the ASCII code is elected. The vote flag “31” for ID1 means that a vote is possible. The data on the voting card is composed of data of 256 bytes in total.
[0102]
FIG. 25 is a flowchart showing an example of the processing flow of the card reading unit 431 constituting the voting program 404 applied to this embodiment. The computer program realized by this flowchart is a subroutine program that performs reading processing of the IC card that is the voting card 406 or the operation card 405. In the initial state of this routine, the card guide LED 2032a disposed in the vicinity of the card recording / reading means 2032 (card reader / writer) of the electronic voting device 203 is blinking (step A1).
[0103]
And it has the step which confirms whether the IC card was inserted in the card reader / writer 2032 (step A2). When the voter inserts the voting card 406 into the electronic voting device 203 and it is confirmed that the IC card is present in the card reader / writer 2032 (“YES” in step A3), in the next step A4, the electronic voting device 203 A card authentication key 403 that is a code common to all polling stations is transmitted from the electronic voting device 203 to the IC chip on the voting card 406. The card authentication key recorded in advance on the chip is collated to authenticate the access authority to the card data.If the two authentication keys match and the authentication is successful ("YES" in step A5), the next step Then, the card type is read (step A6).
[0104]
When the authentication is rejected (“NO” in step A5), the electronic voting device 203 displays an error occurrence screen (step A23), and the voting card 406 is ejected from the reader / writer 2032 (step A24). The discharged card is collected by an attendant at the polling place. When the card is the voting card 406, the voter receives an appropriate measure such as a card reissue. The occurrence of an error is visually notified by a status display lamp 20301 (also called a status display lamp or a warning lamp) to a voting witness who monitors the state of voting from a place away from the electronic voting device 203 in the polling place. Is done.
[0105]
When the card authentication in step A5 in FIG. 25 is successful (“YES” in step A5), the card type reading process is performed in step A6. There are two types of cards that can be read: a voting card and an operation card, and an identification code (shown as “card type ID” in FIG. 23) recorded in a predetermined card type recording area in the card is read.
[0106]
In the following, the flow in the case where it is read that the card is the voting card 406 in the step of reading the card type ID in FIG. 25 (“YES” in step A7) will be described. When it is read that the type of the inserted card is the voting card 406, a reading process of a polling place ID (also referred to as management identification ID, management ID, or random number) 4055 is performed in step A8. When the read polling place ID matches the polling place ID stored in advance in the RAM 453 of the electronic voting apparatus 203 (“YES” in step A9), the next step (A10) for confirming the next voting right. Move. In the next step, the voting flag 2022 shown in FIG. 23 is read (step A10).
[0107]
The voting flag 2022 is a code for identifying whether or not the voter has the right to vote in the election (when multiple elections are held on the same day). For example, it can be defined that “0” is an unissued ticket and “1” is a voteable state. When the voting flag 2022 is normally read (“YES” in step A11), the voting flag 2022 is “1” voting possible, that is, the voter has not voted for the election. When read, the process proceeds to the next step (A13) that defines the voting mode. In step A13, when the voting card 406 is issued by the card issuing machine 201, a code (elector) indicating the physical obstacle characteristic of the voter (elector) recorded on the voting card 406 based on the elector list The characteristic ID 2021 (shown in FIG. 59) is read.
[0108]
In other words, the elector characteristic ID is input means (a touch panel 20313, a dedicated keyboard 2081 for visually impaired persons, a push switch 20371 for motor function disorder, etc.) and a display means (by a voter using the electronic voting device 203). LCD 20311, head mounted display, braille display, voice guide, etc.). In the step indicating the conditional branch for the value of the elector characteristic ID 2022 (step A14), if the elector characteristic ID is 00, that is, a non-disability (healthy person), the touch panel 20313 is selected as the input means, and the LCD 20311 is selected as the display means. Then, it is confirmed whether it can be used (step S15a).
[0109]
If the elector characteristic ID is 02, that is, a visually impaired person, in step A15c, the visually impaired person dedicated keyboard 20381 is selected as the input means and the volume-adjusted headphones 20391 are selected as the display means. As described above, when it is checked whether or not the input / output device corresponding to the voter's elector characteristic ID recorded in the voting card 406 is usable, in the next step A16, the voting card 406 is initialized. . This step is a step of deleting all data by reformatting the data recording area of the voting card in order to prevent double voting by reusing the used voting card. Thus, the card reading routine in the case where it is read that the card is a voting card 406 in steps A4 to A5 of card type reading ends.
[0110]
Next, in steps A4 to A5 of card type reading in FIG. 25, it is read that the card inserted into the electronic voting device 203 is not the voting card 406 (“NO” in step A5, operation card (also called administrator card). ) 405 will be described, and this processing is preferably performed using the operation card 405 issued by the card issuing machine 201 before the voting start time on the voting date.
[0111]
First, when the card type ID is the operation card 405, the polling place ID 4055 is read in step A18. When the polling place ID is read (“YES” in step A19), the polling place ID 4055 is stored in the address of the polling place ID area 4055b of the RAM 453 of the electronic voting device 203 (step A20). Then, a screen for notifying the voting manager that the polling place ID has been registered in the electronic voting device is displayed (step A21), and the operation card is discharged (A22). Thereafter, the electronic voting apparatus 203 can accept only the voting card 406 in which the polling place ID is recorded. Therefore, it is impossible to vote with a card issued by a card issuing machine at another polling place or a card forged or altered.
[0112]
FIG. 26 is a flowchart illustrating an example of a processing flow of the voting control unit 435 constituting the voting program 404 applied to the present embodiment. The voting control unit 435 is a subroutine program that displays a list of candidates for the elector after reading the voting card and displays a screen for prompting selection of the candidates. First, in step E0a, the number of candidates corresponding to the election ID specifying the type of election, that is, the total number of records specified by the candidate ID is read from the candidate table 401a constituting the candidate data 401, Store in the RAM 453.
[0113]
Next, in step E0b, the setting of the maximum number of buttons with candidate names displayed on one screen is read. The number of buttons displayed on a single screen is a numerical value set in advance when the candidate data 401 is created by the election data management creation machine 101 in the election data creation system 100. Specifically, the size, position, and character of the button in the voting screen layout database 401e (shown in FIG. 19) in the candidate data 401 by dedicated software (screen editor) possessed by the election data management creation machine 101. The screen layout such as size is set. As a general rule, from the viewpoint of fairness, it is desirable for candidates to display all members on one screen as much as possible (see FIG. 43).
[0114]
However, in the case of an election in which there are more than 50 candidates, there may be a case where it cannot be displayed on one screen. This is because there is an upper limit on the number of buttons that can be displayed based on the balance between the display area of the display screen (LCD 20311) and the area of the button with the name of the candidate. For example, FIG. 45 shows an example in which buttons for 28 people are arranged in a 15-inch display area. However, if the number of buttons is increased further, the character size becomes smaller and it becomes difficult to see. Or inconveniences such as pressing mistakes due to the proximity of adjacent buttons. Therefore, in such a case, a technique for dividing a candidate into a plurality of pages or scrolling the candidate is disclosed.
[0115]
However, such a method causes an unfairness problem due to the pages to be posted. In order to avoid this, Japanese Patent Laid-Open No. 7-57021 discloses a technique for randomizing the order of candidates displayed on a plurality of pages using random numbers. However, this public technology also has a problem that it is difficult to reflect the display order designated by the affiliated party that has a plurality of candidates, as is often seen in conventional public office elections. Therefore, in this embodiment, when candidates cannot be displayed as a list on a single screen, the search is performed using the initials of the candidates rather than dividing the pages.
[0116]
The number of candidate buttons read in step E0b in FIG. 26 is a numerical value set in advance by the election data creation system 100 for the reason described above. Then, in step E0c, the number of candidate buttons that can be displayed on this one screen is compared with the number of candidates who have run for election. If the number of candidate buttons that can be displayed on one screen is the same as or larger than the number of candidates for the election (“YES” in step E0c), the process moves to the next step and displays on one screen. The candidate selection screen voting control unit 435A, which is a voting mode for displaying all candidates, is processed (described in detail in FIG. 27), and when the processing ends, the routine of the voting control unit 435 is exited.
[0117]
On the other hand, if the number of candidate buttons that can be displayed on one screen is smaller than the number of candidates who candidate in the election (“NO” in step E0c), the initials of the candidates are searched. The initial selection screen voting control unit 435B, which is a voting form for displaying the relevant candidate, is processed (described in detail in FIGS. 28 to 33), and when the processing ends, the routine of the voting control unit 435 is exited. As will be described later with reference to FIG. 45, in the case of a general N-inch display, assuming that the aspect ratio is 4: 3, the number of candidates of Int (0.29N) × Int (0.85N) User button can be displayed. However, Int () represents the maximum integer not exceeding the numerical value in (). Then, when the number of candidate buttons calculated in this way is less than the number of candidates, the display is switched to the initial character selection screen as shown in FIG. 46 in step E0c. Also good.
[0118]
FIG. 27 is a flowchart illustrating an example of the processing flow of the candidate selection screen voting control unit 435A in the voting control unit 435 constituting the voting program 404 applied to the present embodiment. This subroutine program is a program that is executed when all of the candidates for the election can be displayed on a single screen. First, in step E1, it is confirmed whether or not there is a setting for displaying the candidate display order at random. The random display of candidates is an option that can be set from the viewpoint of fairness, and is a setting that changes the display order each time a vote card is inserted by an elector and a voting operation is executed. If there are two or more candidates from the same party on the screen and the display order is specified, the candidate order of only different parties is changed while maintaining the order in the party. It is possible.
[0119]
If there is such a random display setting (“YES” in step E1), the process moves to step E2, and the record order randomization process of the candidate data 401 is performed. Although various embodiments are possible for the randomizing process, for example, the following is performed. That is, the remainder obtained by dividing the number of voters for this election (that is, the number of votes shown in FIG. 41) by the number of candidates is calculated, and this number of candidates is calculated from the top record in the candidate table 401a. It moves to the last and makes this the candidate table 401a in this voter's vote for this election. When such processing in step E2 is completed, the process proceeds to next step E3.
[0120]
On the other hand, when there is no such random display setting (“NO” in step E1), step E2 is skipped and the process proceeds to step E3. In step E3, the setting of the direction in which the candidate buttons are arranged is checked. After this step, a screen transition process is performed in step E4, and a candidate selection screen (shown in FIGS. 43 to 45) is displayed in step E5. When the candidate selection screen is displayed, in step E6, the candidate selection guidance voice is reproduced only once from the common voice data (shown in FIG. 14) linked to the display message table 401f. For example, for the candidate selection screen shown in FIG. 43, once touch the guidance voice “Please touch the name of the candidate you want to vote. If you want to end the vote halfway, please touch“ Do not vote ”” once. Just play. In the conditional branch of step E7, the voter inputs a touch panel input or a barrier-free option input device (motor function failure push switch 20371, dedicated keyboard 2081 for the visually impaired) to the candidate button displayed on the screen. When the input operation is detected ("YES" in step E7), the process proceeds to the next step.
[0121]
If the voting operation method is an elector who uses automatic scan voting (elector with the elector characteristic ID = 05 shown in FIG. 59), the switch must be pressed while the cursor moves to the button. To move to the next step. In step E8, the color of the input button and the character color are changed to those when the cursor is lit, and the apparatus is on standby for a certain time (about 0.2 seconds). Then, assuming that the touched button has been selected and input, in step E9, the candidate associated with the selected button is stored as a candidate to vote. In step E10, if the candidate selection guidance sound is being reproduced, the reproduction is stopped and the process proceeds to a transition step for confirming the selected candidate.
[0122]
In step E11, a transition process for transitioning to the screen is performed. In step E12, a candidate confirmation screen is displayed (shown in FIG. 52). When the screen is displayed, the candidate confirmation guidance sound for displaying the selected candidate is reproduced only once in step E13. For example, a guidance voice of “Please check. If you like, please touch ○. In step E14, the voter performs the following operation. That is, in order to vote for the selected candidate, the voter performs an input operation using a touch panel input or an input device with a barrier-free option (motor function impairment push switch 20371, visually impaired person dedicated keyboard 20381, etc.). If “○ Vote” is selected (“YES” in step E14), the button color and the character color input in step E15 are changed to those when the cursor is lit, and lighted for a certain time (about 0.2 seconds). Wait. In step E16, if the candidate selection guidance sound is being reproduced, the reproduction is stopped and the routine is exited (shown as “RETURN”).
[0123]
On the other hand, in order to vote for the selected candidate, the voter performs an input operation using a touch panel input or an input device with a barrier-free option (motor function impairment push switch 20371, a visually impaired person dedicated keyboard 20381, etc.). When “× change” is selected (“NO” in step E14 and “YES” in step E17), after the button input in step E18 is lit and waits for a certain period of time, the guidance voice is stopped in step E19. And it returns to step E5 and displays a candidate selection screen. The candidate confirmation screen is continuously displayed until the voter selects any button ("NO" in step E17).
[0124]
On the other hand, in the conditional branch of step E7, the input of the candidate button was not detected (“NO” in step E7), and the abstention button (shown as a “do not vote” button in FIGS. 43 to 45) was input. Is detected (“YES” in step E20), in step E21, the input button is lit for a certain period of time, and in step E22, the abstention is stored in the RAM 453. Then, the guidance voice is stopped in step E22, the screen transition process is performed in step E24, the abstention confirmation screen (shown in FIG. 53) is displayed in step E25, and the guidance voice is reproduced (step E26). For example, the guidance voice “Please confirm. If it is OK, touch“ X ”. When it is detected in the conditional branch of step E27 that “no voting” is input (“YES” in step E27), the button input in step E28 is lit for a certain period of time and waits. Is stopped and this routine is exited (shown as “RETURN”).
[0125]
On the other hand, in the conditional branch of step E27, if the “○ Do not vote” button is not input (“NO” in step E27), but the input of the “× Change” button is detected (“YES” in step E30). The button input in step E31 is lit for a predetermined time and waits. After the guidance voice is stopped in step E32, the process returns to step E5 to display the candidate selection screen. The display of the abstention confirmation screen is continuously displayed until an input of any of the buttons “○ Do not vote” or “× Change” is detected (“NO” in step E30). In this example, if the voter's intention is not abstention and he wants to start the ballot for the unavoidable reason, he / she will be notified to the vote witness or the ballot manager and the ballot card will be reissued. Configured to receive. In such a case, a procedure for deleting the abstention vote at the time of voting is necessary. However, in order to prevent double voting by reusing the same voting card, it is preferable to take such an operation method.
[0126]
FIG. 28 is a flowchart (1/5) showing an example of the processing flow of the initial letter selection screen voting control unit 435B in the voting control unit 435 constituting the voting program 404 applied to this embodiment. This subroutine program is a program that is executed in order to make a vote by selecting an initial character when all candidates who have run for election cannot be displayed on a single screen. First, in step F1, a list of initials to be displayed on the screen is acquired. The initial characters displayed on the screen are hiragana hiragana (or katakana) characters, and muddy, semi-voiced and other characters are not displayed (a display example is shown in FIG. 46). The muddy sound and semi-voiced sound are displayed in association with the clear sound. For example, for the “ka” button, “ka” and “ga” are associated. The “ha” button associates “ha”, “ba”, and “pa”. Further, other associations may be performed. For example, “旧” and “ゑ”, which are hiragana hiragana characters, may be associated with “i” and “e”, respectively. In this way, in step F1, a list in which muffled sounds, semi-turbid sounds, and the like are associated with 50 clear sounds is acquired.
[0127]
Next, in step F2, the candidate table 401a is searched for the presence or absence of a candidate having the corresponding initial for each of the Japanese syllabary list. If there is a corresponding candidate in the conditional branch in step F3 (“YES” in step F3), a setting is made to display the corresponding kana character button. For example, for the Japanese syllabary list “sa”, in the candidate table 401a1 illustrated in FIG. 15, “Takamori Saigo” with candidate ID = 00003 and “Ryoma Sakamoto” with candidate ID = 00005 are associated. In addition, if there are other candidates that start with the “z” of muddy sound, they are associated together.
[0128]
On the other hand, if there is no corresponding candidate in the conditional branch in step F3 (“NO” in step F3), the button is not displayed (display example is shown in FIG. 47). In addition, it is possible not to hide the button completely, but to select a non-selectable button that is displayed in a lighter density. Therefore, it is preferable not to display. This search is continued for all kana characters in the Japanese syllabary list ("NO" in step F6). When the search for candidates is completed (“YES” in step F6), the initial letter selection screen is displayed in step F8 by the screen transition process in step F7. The initial letter selection screen is, for example, a screen illustrated in FIGS. 46 and 47. When the initial character selection screen is displayed, the candidate selection guidance sound is reproduced only once in step F9. For example, “Touch the acronym of the candidate you want to vote for. If you want to end the vote halfway, touch“ Do not vote ”. Is played.
[0129]
In the conditional branch of step F10, the voter inputs touch panel input or barrier-free option input devices (motor function disorder push switch 20371, dedicated keyboard 2081 for visually impaired persons) to the initial button displayed on the screen. When the input operation is detected (“YES” in step F10), the process proceeds to the next step F11. If the voting operation method is an elector who uses automatic scan voting (elector with the elector characteristic ID = 05 shown in FIG. 59), the switch must be pressed while the cursor moves to the button. To move to Step F11.
[0130]
In step F11, the color of the input button and the character color are changed to those when the cursor is lit, and the apparatus is on standby for a certain time (about 0.2 seconds). In step F12, if the guidance voice is still being reproduced, the reproduction is stopped. Next, in step F13, candidates that read the clear sound, muddy sound, semi-voiced sound, etc. associated with the input acronym button as acronyms are extracted from the head of the candidate table 401a, and the initial candidate candidates are extracted. Create a list. For example, if it is detected on the initial character selection screen (FIG. 46 or FIG. 47) that “O” is input, “Toshimichi Okubo”, “Shigenobu Otsuki”, “Soji Okita”, “ A candidate record “Masujiro Omura” is extracted and created as an initial candidate list. When the creation of the initial candidate list in step F13 is completed, the process proceeds to the subsequent step (shown as 3 in FIGS. 28 and 29).
[0131]
On the other hand, in the conditional branch of Step F10, input to the initial button is not detected (“NO” in Step F10), and input of the abstention button (shown as “Do not vote” button in FIG. 46 or FIG. 47) is input in Step F14. When it is detected (“YES” in step F14), the input button is lit for a predetermined time in step F15, and in step F16, the abstention is stored in the RAM 453. Then, the guidance voice is stopped in step F17, the screen transition process is performed in step F18, and the process proceeds to the subsequent step (shown as 4 in FIGS. 28 and 30).
[0132]
FIG. 29 is a flowchart (2/5) showing an example of the processing flow of the initial letter selection screen voting control unit 435B in the voting control unit 435 constituting the voting program 404 applied to this embodiment. This is a step subsequent to step F13 in the case where initial input is detected in step F10 in FIG. In step F19, it is confirmed whether or not there is a setting for displaying the candidate display order at random. As described above, the random display of candidates is a setting for changing the display order each time a voting card is inserted by an elector and a voting operation is executed, and can be set from the viewpoint of fairness. Is optional.
[0133]
If there are two or more candidates from the same party on the screen and the display order is specified, the candidate order of only different parties is changed while maintaining the order in the party. It is possible. If there is such a random display setting (“YES” in step F19), the process moves to step F20, and the record order randomization process of the candidate data 401 is performed. Although various embodiments are possible for the randomizing process, for example, the following is performed. That is, the remainder obtained by dividing the number of voters for this election (that is, the number of votes shown in FIG. 41) by the number of candidates is calculated, and this number of candidates is calculated from the top record in the candidate table 401a. It moves to the last and makes this the candidate table 401a in this voter's vote for this election. When such processing in step F20 ends, the process proceeds to next step F21.
[0134]
On the other hand, if there is no such random display setting (“NO” in step F19), step F20 is skipped and the process proceeds to step F21. In step F21, refer to the setting of the maximum number of candidate buttons that can be displayed on the initial candidate selection screen (shown in FIG. 48), which is stored in the voting screen layout table 401e constituting the database of candidate data 401. To do. In the conditional branch of step F22, when the setting of the maximum number of buttons in the voting screen layout table 401e is equal to or greater than the total number of candidate lists having the initials that have been detected (“YES” in step F22), the next step Move on to F23. On the other hand, in the conditional branch of step F22, when the setting of the maximum number of buttons is equal to or less than the total number of candidate lists having the initials for which input has been detected (“NO” in step F22), the subsequent steps (FIG. 29 and FIG. 29) 31 (illustrated as 9 in FIG. 31).
[0135]
First, the flow after Step F23 will be described. In step F23, the setting of the direction in which the candidate buttons are sorted is checked. After this step, screen transition processing is performed in step F24, and an initial corresponding candidate selection screen is displayed in step F25. FIG. 48 shows an initial corresponding candidate selection screen when the initial “O” is selected. When the initial candidate selection screen is displayed, in step F26, the candidate selection guidance voice is reproduced only once from the common voice data (shown in FIG. 14) linked to the display message table 401f. For example, for the initial candidate selection screen shown in FIG. 48, touch “Name of candidate to vote for. To reselect initial, touch“ Reselect initial ””. When the voting is ended halfway, the guidance voice “Please touch“ Do not vote ”” is played only once. In the conditional branch of step F27, the voter inputs a touch panel input or a barrier-free option input device (motor function failure push switch 20371, dedicated keyboard 2081 for the visually impaired) to the candidate button displayed on the screen. When the input operation is detected ("YES" in step F27), the process proceeds to the next step.
[0136]
If the voting operation method is an elector who uses automatic scan voting (elector with the elector characteristic ID = 05 shown in FIG. 59), the switch must be pressed while the cursor moves to the button. To move to the next step. In step F28, the color of the input button and the character color are changed to those when the cursor is lit, and the apparatus is on standby for a certain period of time. Then, assuming that the touched button has been selected and input, in step F29, the candidate associated with the selected button is stored on the RAM 453 as a candidate for voting. In step F30, if the candidate selection guidance sound is being reproduced, the reproduction is stopped, and the process proceeds to the steps after confirming the selected candidate. In step F31, a transition process for transitioning to the screen is performed.
[0137]
In step F38 illustrated in FIG. 30, a candidate confirmation screen is displayed (illustrated in FIG. 52). When the screen is displayed, the candidate confirmation guidance sound for displaying the selected candidate is reproduced only once in step F39. For example, a guidance voice of “Please check. If you like, please touch ○. In step F40, the voter performs the following operation. That is, in order to vote for the selected candidate, the voter performs an input operation using touch panel input or an input device with a barrier-free option (motor function impairment push switch 20371, visually impaired person dedicated keyboard 20381, etc.). If “○ vote” is selected (“YES” in step F40), the color of the button and the character color input in step F41 are changed to those when the cursor is lit, and the apparatus is on standby for a certain period of time. If the candidate selection guidance sound is being reproduced in step F42, the reproduction is stopped and the routine is exited (shown as “RETURN”).
[138]
On the other hand, in order to vote for the selected candidate, the voter performs an input operation using a touch panel input or an input device with a barrier-free option (motor function impairment push switch 20371, a visually impaired person dedicated keyboard 20381, etc.). When “X change” is selected (“NO” in step F40 and “YES” in step F43), after the button input in step F44 is lit and waits for a certain period of time, the guidance voice is stopped in step F45. Then, the process returns to step F25 in FIG. 29 (shown as 8 in FIGS. 29 and 30), and the initial corresponding candidate selection screen is displayed. The candidate confirmation screen is continuously displayed until the voter selects any button (“NO” in step F43).
[0139]
On the other hand, in the conditional branch of step F27 in FIG. 29, the input of the candidate button is not detected (“NO” in step F27), and in the conditional branch of step F32, the initial character selection redo button (“initial character in FIG. When an input of “Reselect” is shown (“YES” in step F32), the process returns to step F8 shown in FIG. 28 (shown as (7) in FIG. 29 and FIG. 28), and the initial selection screen (Shown in FIG. 46 or 47) is displayed again.
[0140]
On the other hand, in the conditional branch of step F32, the input of the initial character selection redo button (shown as “reselect initial” button in FIG. 48) is not detected (“NO” in step F32), and the abstention button in step F33 When an input (shown as a “don't vote” button in FIG. 48) is detected (“YES” in step F33), the input button is lit for a certain period of time in step F34, and in RAM F453 that the abstention has been made in step F35. Remember. In step F36, the guidance voice is stopped, and screen transition processing is performed in step F37. The subsequent steps are performed from the end point 4 in FIG. 30 (shown as 4 in FIGS. 29 and 30). That is, the abstention confirmation screen (shown in FIG. 53) is displayed in step F46, and the guidance voice is reproduced (step F47). For example, the guidance voice “Please confirm. If it is OK, touch“ X ”.
[0141]
Next, in the conditional branching of step F48, when it is detected that “○ Do not vote” is input (“YES” in step F48), the button input in step F49 is lit for a certain period of time and waits. The reproduction of the guidance voice is stopped and the routine is exited (shown as “RETURN”). On the other hand, in the conditional branch of step F48, when the “○ Do not vote” button is not input (“NO” in step F48), but the input of the “× Change” button is detected (“YES” in step F51). The button input in step F52 is lit for a certain period of time, and after the guidance voice is stopped in step F53, the process returns to step F8 in FIG. 47) is displayed.
The display of the abstention confirmation screen is continuously displayed until the input of any one of the buttons “○ Do not vote” or “× Change” is detected (“NO” in step F51).
[0142]
On the other hand, in the conditional branch of step F22 shown in FIG. 29, when the setting of the maximum number of candidate buttons in the voting screen layout table 401e is equal to or less than the total number of initial candidate candidates having the initial letter from which the input has been detected. (“NO” in step F22), a series of steps shown in FIGS. 31 to 32 is executed (shown as 9 in FIGS. 29 and 31).
[0143]
FIG. 31 is a flowchart (4/5) showing an example of the processing flow of the initial letter selection screen voting control unit 435B in the voting control unit 435 constituting the voting program 404 applied to this embodiment. In the following steps, there are many candidates having the same initial letter (including clear sound, muddy sound, semi-voiced sound, etc.), and the maximum number of candidate buttons that can be displayed on one screen (for example, 15 inches in this embodiment) This is a voting screen that divides and displays a plurality of pages when the number of LCD displays exceeds about 28). In step F54, the number of pages is calculated and stored from the number of initial candidate candidates corresponding to the initial that has been detected and the maximum number of candidate buttons that can be displayed on one screen.
[0144]
That is, the number in the initial candidate list corresponding to the initial character that has been detected by the input is divided by the number of candidate buttons preset by the voting screen layout table 401e in the candidate data 401, and a numerical value obtained by raising the remainder is obtained. calculate. Then, this numerical value is stored in the RAM 453 as the number of pages. Next, in the conditional branch of step F55, it is confirmed whether or not there is a setting for displaying a guidance screen for notifying a voter that there are a plurality of candidate selection screens corresponding to the input initial. If there is such a guidance screen display setting (“YES” in step F55), screen transition processing is performed in step F56, and a guidance screen for informing the presence of a plurality of pages is displayed (step F57).
[0145]
An example of such a screen is shown in FIG. In the figure, a screen that guides the voter that the candidate corresponding to the input initial is divided into three pages and displayed before the candidate button is displayed. When this screen is displayed, the guidance voice is reproduced in step F58. For example, a guidance voice message such as “There are three pages of candidate names in total. Press the“ next page button ”at the top of the screen to find candidates” is reproduced. When the input of the “next page” button is detected in the conditional branch of step F59 (“YES” in step F59), the process proceeds to the next step F60, and after the input button is lit, in step F61, Stop the guidance sound.
[0146]
On the other hand, the multi-page guidance screen is continuously displayed until the “next page” button is input, and the guidance sound is repeatedly reproduced. On the other hand, when there is no setting for executing the guidance screen display in the conditional branch of step F55 (NO in step F55), the above steps F56 to F61 are skipped, and the process proceeds to step F62. In step F62, the numerical value 1 is substituted into the variable n for storing the page number, and the number of pages is set to one page. Next, in step F63, after confirming the sorting order of the display of candidates, the process proceeds to the next step for defining candidates to be displayed on the screen. That is, in step F64, from the candidate list corresponding to the input initial, the current page number is n, and ((n-1) × (number of candidate buttons) +1) th candidate ( The n × (number of candidate buttons)) candidate is extracted. However, if the current page number n is the last page, only the last candidate in the candidate list is extracted.
[0147]
Next, the following settings are made regarding the display of the “previous page” button or the “next page” button used to move the screen of a plurality of pages. That is, if the page number n = 1 (first page) in the conditional branch of step F65 (“YES” in step F65), the “previous page” button is set not to be displayed in step F66. . On the other hand, if the page number n is not 1 in the conditional branch in step F65 (“NO” in step F65), the process proceeds to the next conditional branch in step F67, and if page number n = total number of pages (in step F67). “YES”), the “next page” button is hidden. If the page number n is neither the first page nor the last page (“NO” in step F67), the process proceeds to step F69 for screen transition. The subsequent steps are performed in the steps illustrated in FIG.
[0148]
FIG. 32 is a flowchart (5/5) showing an example of the processing flow of the initial letter selection screen voting control unit 435B in the voting control unit 435 constituting the voting program 404 applied to this embodiment. Below, the continuation of the step of the voting control process when the candidate corresponding to the inputted initial letter covers a plurality of pages will be described. First, in step F70, a multiple page selection screen for initial candidates is displayed (shown in FIG. 49). When the screen display is executed, the candidate selection guidance voice is reproduced only once from the common voice data (shown in FIG. 14) linked to the display message table 401f in step F71.
[0149]
For example, for the initial candidate candidate multiple page selection screen shown in FIG. 49, “Please touch the name of the candidate you want to vote. If there is no candidate to vote, the“ Previous page ”button or the“ Next page ”button. Touch to find a candidate. To reselect the initial letter, touch “Reselect initial letter”. When the voting is ended halfway, a guidance voice such as “Please touch“ Do not vote ”” is reproduced only once. In the conditional branch of step F72, the voter inputs a touch panel input or a barrier-free option input device (motor function failure push switch 20371, dedicated keyboard 2081 for the visually impaired) to the candidate button displayed on the screen. When the input of the candidate button is detected (“YES” in step F72), the process proceeds to the next step.
[0150]
If the voting operation method is an elector who uses automatic scan voting (elector with the elector characteristic ID = 05 shown in FIG. 59), the switch is pressed while the cursor moves to the candidate button. To move to the next step. In step F73, the color of the input candidate button and the character color of the candidate name are changed to those when the cursor is lit, and the apparatus is on standby for a certain time. Then, assuming that the touched button has been selected and input, in step F74, the candidate associated with the selected button is stored on the RAM 453 as a candidate for voting. In step F75, if the candidate selection guidance sound is being reproduced, the reproduction is stopped, and the process proceeds to the steps after confirming the selected candidate.
[0151]
In step F76, a transition process for transitioning to the screen is performed. In step F38 shown in FIG. 30 connected at the end point 5, a candidate confirmation screen is displayed (shown in FIG. 52). When the screen is displayed, the candidate confirmation guidance sound for displaying the selected candidate is reproduced only once in step F39. For example, a guidance voice of “Please check. If you like, please touch ○. In step F40, the voter performs the following operation. That is, in order to vote for the selected candidate, the voter performs an input operation using touch panel input or an input device with a barrier-free option (motor function impairment push switch 20371, visually impaired person dedicated keyboard 20381, etc.). If “○ vote” is selected (“YES” in step F40), the color of the button and the character color input in step F41 are changed to those when the cursor is lit, and the apparatus is on standby for a certain period of time. If the candidate selection guidance sound is being reproduced in step F42, the reproduction is stopped and the routine is exited (shown as “RETURN”).
[0152]
On the other hand, in order to vote for the selected candidate, the voter performs an input operation using a touch panel input or an input device with a barrier-free option (motor function impairment push switch 20371, a visually impaired person dedicated keyboard 20381, etc.). When “X change” is selected (“NO” in step F40 and “YES” in step F43), after the button input in step F44 is lit and waits for a certain period of time, the guidance voice is stopped in step F45. Then, the process returns to step F25 in FIG. 29 (shown as 8 in FIGS. 29 and 30), and the initial corresponding candidate selection screen is displayed. The candidate confirmation screen is continuously displayed until the voter selects any button (“NO” in step F43).
[0153]
On the other hand, in the conditional branch of step F27 in FIG. 29, the input of the candidate button is not detected (“NO” in step F27), and in the conditional branch of step F32, the initial character selection redo button (“initial character in FIG. When the input of “reselect” is shown (“YES” in step F32), the process returns to step F8 shown in FIG. 28 (shown as 7 in FIGS. 29 and 28), and the initial letter selection screen (see FIG. 29). 46 or FIG. 47) is displayed again.
[0154]
On the other hand, in the conditional branch of step F72, when the input to the candidate button displayed on the screen is not detected ("NO" in step F72), the input of the "previous page" button is detected (" YES "), after turning on the" Previous Page "button in Step F78, n-1 is substituted into the page number variable n in Step F79. When the decrement is completed for the number of pages, the process returns to step F64 in FIG. 31 connected at the end point 11 to perform candidate extraction processing. That is, in step F64, from the candidate list corresponding to the input initial, the current page number is n, and ((n-1) × (number of candidate buttons) +1) th candidate ( The n × (number of candidate buttons)) candidate is extracted. However, if the current page number n is the last page, only the last candidate in the candidate list is extracted.
[0155]
On the other hand, in the conditional branch of step F77, when the input of the “next page” button is detected (“YES” in step F80) without detecting the input of the “previous page” button (“NO” in step F77). In step F81, after the “next page” button is turned on, n + 1 is substituted into the page number variable n in step F81. When the increment of the number of pages is completed, the process returns to step F64 of FIG. 31 connected at the end point 11, and the candidate extraction process described above is performed.
[0156]
On the other hand, in the conditional branch of step F80, when the input of the “next page” button is not detected (“NO” in step F80) and the input of the “reselect initial” button is detected (“ YES "), the process moves to step F8 of FIG. 28 connected at the end point 7, and the initial letter selection screen is displayed.
[0157]
On the other hand, in the conditional branch of step F83, when the input of the “reselect initial” button is not detected (“NO” in step F83) and the input of the “do not vote” button is detected (“ YES "), in step F85, the input button is lit for a certain period of time, and in step F86, the abstention is stored in the RAM 453. Then, the guidance voice is stopped in step F87, and screen transition processing is performed in step F88. The subsequent steps are performed from the end point 4 in FIG. 30 (shown as 4 in FIGS. 32 and 30). Note that the display of the initial candidate candidate multiple page selection screen (shown in FIG. 49) in step F70 is continuously displayed until an input of any button is detected (“NO” in step F84).
[0158]
FIG. 33 is a flowchart showing an example of the processing flow of the voting data recording unit 434 constituting the voting program 404 applied to this embodiment. The voting program 404 records the voting data 407 and the voting log 4075 in duplicate on the two recording media of the original and the duplicate, and when recording, the two media are accessed independently so that even when a failure occurs, It is preferable to design such that any voting data is secured. The voter operates a screen (one example is shown in FIGS. 41 to 53) displayed on the LCD 20311 by the voting screen creation unit 433 of the voting program 404, and determines a candidate to vote (see FIG. 53). When a “vote” button (shown) is pressed and the contents of the vote are internally stored in the RAM 453, a subroutine of the vote data recording unit 434 is called, and a vote data recording process including the following steps is started. The
[0159]
That is, in step D1, a voting log storage file on the original recording medium 408 is opened, and in step D2, a voting start log is recorded on the original recording medium. The voting start log is a character string such as “start recording on original”. When the recording of the voting start log is completed, the file is closed (step D3), and in the next step D4, a file for storing voting data on the original recording medium 408 is opened.
[0160]
In step D5, the contents of the vote internally stored in the RAM 453 are written into the file opened on the original recording medium. Writing is performed at high speed using a cache area (not shown) in the RAM 453. When the writing is completed, the file is closed, and a file having voting data is generated (step D6). Further, in steps D7 to D9, a voting end log (for example, a character string such as “end recording on original”) is also written on the original recording medium 408. When the writing of the voting data 407 and the voting log 4075 to the original recording medium 408 is completed, the process proceeds to the next step after waiting for the cache to be discharged (dumped) in step D10.
[0161]
Steps D11 to D18 are steps for collating (verifying) the voting data 407 recorded on the original recording medium 408 first. That is, in step D11, the voting data storage file of the original recording medium 408 (the file that has been closed in step D6) is opened, and in step D12, the voting data 407 in the file is read. In step D13, the read voting data 407 is stored in a work area (not shown) of the RAM 453, and is compared and verified with voting data stored in a memory space managed by the voting program 404. In the conditional branch of step D14, when the collation is normal (“YES” in step D14), the process proceeds to the next step D15.
[0162]
If the collation is not normally performed, processing for prohibiting writing to the original recording medium 408 is performed, and an error screen (illustrated in FIG. 57) indicating that a voting data write failure has occurred is output to the LCD 20311. In addition, a blinking signal is output to the operation indicator light 20301b. Such a case occurs when the original recording medium is defective. When such a writing error occurs, it is preferable to use an operation mode in which the use of the original recording medium is prohibited and only the copying recording medium 409 is used at the time of counting votes. At this time, only the data recorded on the copy recording medium 409 before the voting in which this error occurs is valid. The voter is informed of the fatal error occurrence screen as shown in Fig. 57, and the polling staff (voting manager or voting witness) confirms the screen and reissues the voting card. Then, the electronic voting device different from the electronic voting device in which the error occurs is re-voted. In steps D15 to D18 after successful verification, verification of the voting log recorded on the original recording medium 408 is performed in the same process.
[0163]
In the conditional branch of step D18, when the collation of the voting log is normally performed (“YES” in step D18), the voting data 407 and the voting log 4075 are reliably recorded on the original recording medium. And the legal vote is finalized. When the voting is confirmed, in order to notify the voter that the voting is confirmed, in step D19, output is made via GPIO to the board on which the voting confirmation LED 2034 is arranged, and the voting confirmation LED 2034 is turned on. The lighting state is maintained until the voting card 406 is ejected and removed by a voter. Even when the system is down before the voting card is discharged, the lighting state is stored with a high probability. Also, in the conditional branch of step D18, when the voting log is not normally collated (“NO” in step D18), processing for prohibiting writing to the original recording medium 408 is performed, and the voting data An error screen (shown in FIG. 57) indicating that a writing failure has occurred is output to the LCD 20311 and a blinking signal is output to the operation indicator lamp 20301b. Thereafter, the same operation form as described above is taken, and re-voting is performed.
[0164]
Next, in steps D20 to D33, the voting data 407 is copied to the copy recording medium 409. The voting data 407 is duplicated by recording the voting data on the RAM 453, which is confirmed to match the voting data recorded on the original recording medium 407, on the copying recording medium 409. Therefore, when recording on a copy recording medium, file access to the original recording medium 408 is not performed, and processes that may cause a failure are eliminated as much as possible.
[0165]
In step D20, the voting log storage file on the copying recording medium 409 is opened, and in step D21, the voting start log is recorded on the copying recording medium. The voting start log is a character string such as “start recording on duplicate”. When the recording of the voting start log is completed, the file is closed (step D22), and in the next step D23, a file for storing voting data on the copy recording medium 409 is opened. In step D24, the contents of the vote stored in the RAM 453 are written into the file opened on the copy recording medium. Writing is performed at high speed using a cache area (not shown) in the RAM 453. When the writing is completed, the file is closed, and a file having a duplicate of voting data is generated (step D25). Further, in steps D26 to D28, a voting end log (for example, a character string such as “end recording on duplicate”) is also written on the recording medium 408 for copying. When the writing of the voting data 407 and the voting log 4075 to the copying recording medium 409 is completed, the process proceeds to the next step after waiting for the discharge of the cache (dump) in step D29.
[0166]
Steps D30 to D33 are steps in which the voting data 407 recorded on the copy recording medium 409 is verified. That is, in step D30, the voting data storage file of the copy recording medium 409 (the file that has been closed in step D25) is opened, and in step D31, the voting data 407 in the file is read. In step D32, the read voting data 407 is stored in a work area (not shown) of the RAM 453, and is compared and collated with voting data stored in a memory space managed by the voting program 404. In the conditional branch of step D33, when the collation is normal (“YES” in step D33), the process proceeds to the next step D34.
[0167]
If the collation is not normally performed, a process for prohibiting writing to the duplicate recording medium 409 is performed, and an error screen (shown in FIG. 56) indicating that a failure has occurred at the time of creating a copy is output to the LCD 20311. At the same time, a blinking signal is output to the operation indicator lamp 20301b. Such a case occurs when the voting data is normally written on the original recording medium, but the copying recording medium is defective. When such a writing error occurs, the use of the electronic voting apparatus is prohibited, and at the time of voting, the use of the copy recording medium is prohibited and only the original recording medium 408 is used. It is preferable to take At this time, only the data recorded on the original recording medium 408 before the voting in which this error occurs is valid. Then, the voter is notified of a copy creation error screen as shown in FIG. 56, and a polling staff member (a voting manager or a voting witness) confirms the screen to confirm the vote. Tell the voters that they are.
[0168]
In steps D34 to D37 after the collation is successful, collation of the voting log 4075 recorded on the copy recording medium 409 is performed in the same process. When a failure occurs, it is preferable to be able to confirm which voting data 407 is normal as described above. This confirmation is displayed on the electronic voting device as much as possible. However, depending on the degree of failure, it may be necessary to examine the data in the recording medium. Since such scrutiny is performed at a ticketing office, it is necessary to take measures to enclose the envelope in advance by having the voter in the event of a failure perform a self-written ballot in advance.
[0169]
FIG. 34 is a diagram illustrating an example of a hardware configuration of a card-issuing machine that issues an operation card applied to the present embodiment. The hardware configuration of the card issuing machine 201 can be realized by a personal computer (PC) having a general processing speed. The ticket issuing card reader / writer 2012 that issues the operation card 405 and the voting card 406 is an IC card reader / writer in this embodiment, and can be connected to the PC main body by a USB interface (USB: Universal Serial Bus) or the like.
[0170]
Further, FD can be used for the card issuing machine medium 202 that stores the card authentication key 403 distributed from the selection and the type of election election 402 at the polling place. Further, the random number generator 20120 does not need to be connected in particular when the random number is generated by software. Only used when generating physical random numbers to be described later. An HDD (HDD: Hard Disk Drive) stores data such as an OS, a ticketing program 504, which will be described later, and an electoral list. The ticket issuing machine display 2011 may use any type of cathode ray tube (CRT) or liquid crystal (LCD). As the input device, a keyboard and a mouse can be used.
[0171]
FIG. 35 is a diagram illustrating an example of a software configuration of a card-issuing machine that issues an operation card 405 applied to the present embodiment. The ticketing program 504 includes a ticketing machine media reading unit 531, a card reading unit 532, a polling place ID generation unit 533, a ticketing data recording unit 534, and a ticketing control unit 535.
The card reading unit 532 controls reading of a card inserted into the card ticket issuing machine 201.
The polling place ID generation unit 533 generates a polling place ID that is an identification number unique to the polling place.
[0172]
The ticketing data recording unit 534 records the data shown in FIG. 23 on the voting card 406 or the operation card 405. In particular, in the case of an operation mode in which the card authentication key 403 is distributed without being recorded on the IC card distributed from the selection, the ticket issuing data recording unit 534 has a function of recording the card authentication key on the IC card.
The ticket issuing control unit 535 controls the screen displayed on the ticket issuing machine display 2011.
[0173]
FIG. 36 is a diagram showing an example of the data structure of the ticket issuer media applied to the present embodiment.
The ticket-issuing machine medium 202 stores a card authentication key 403, an implementation election type 402, and a ticketing program 504.
[0174]
FIG. 37 is a diagram showing types of elections 402 stored in the ticket machine media applied to this embodiment. In the election election type 402 distributed from the selection, the ID of the election to be conducted at the polling place where the card issuing machine 201 is installed is recorded. It shows that an election with election ID = 1 and election ID = 3 must be held. These election IDs are referred to when the voting card 406 is issued, and a voting flag is set in the voting flags 2022a and 2022c of the voting card shown in FIG.
[0175]
FIG. 38 is a flowchart illustrating an example of the polling place ID generation unit 533 constituting the ticketing program applied to the present embodiment. In step S2301, random number data is input in real time. This may be input from the outside, or may be input generated by calculation inside the card ticket issuing machine 201. The input random number is taken into the RAM 20118 (S2302). When the voting manager performs an appropriate key input with the keyboard, data between predetermined addresses on the RAM 201018 is cut out and stored in the manager ID (voting place ID) buffer (S2305), and preparation for writing to the operation card is made. If it can, the buffer value is output (S2306) and the polling place ID 4055 is determined.
[0176]
FIG. 39 and FIG. 40 are flowcharts showing the flow of the operation method of the electronic voting system using the operation card 405 and the voting card 406 applied to this embodiment. The operation method of the electronic voting system applied to the present embodiment is an election data creation system that creates election data (candidate data 4015, etc.) prior to the election date (voting date) during an electronic voting election. 100, an electronic voting device 203 that accepts voting by an elector (voter) using data transferred from the election data creation system installed at each polling place on the election date, and an electronic voting device 203 Is related to a method of operating an electronic voting system including a polling place system 200 including a card-issuing machine 201 that issues a card (voting card 406 or operation card 405). The management method includes the following steps as shown in FIGS.
[0177]
That is, as shown in FIG. 39, first, before the voting start time on the voting day, the election data creation system 100 previously generates a card authentication key 403 related to authentication of reading of the card (voting card 406 or operation card 405). Step S1801 is performed. As a specific embodiment of the card authentication key 403, when an IC card is used as a card, there are a decryption key, a password, and the like for reading data that is encrypted and recorded in the IC chip. These are realized by arbitrary numerical values or combinations of character strings.
[0178]
It has step S1802 which inputs the authentication key 403 common in all the polling places produced by the election data generation system 100 with respect to the electronic voting apparatus 203 and the card-issuing machine 201. FIG. For example, the card authentication key 403 is recorded on a portable recording medium such as an FD or a memory card, transferred to each polling place, and authenticated on the RAM 453 inside the electronic voting device 203 and the RAM 2011 inside the card ticket issuing machine 201. The key 403 is stored. In this way, the card authentication key 403 to be distributed to each polling place is shared, and the voting program 404 and candidate data 401 are also shared, so that the recording medium 409 for copying the same content is distributed. It is possible to minimize the occurrence of human error when delivering media to each polling place.
[0179]
The card issuing machine 201 installed at each polling place generates a management identification code 4055 (also called polling place ID, management ID, and polling place ID) unique to the polling place before the voting start time on the voting day. S1803. The polling place ID 4055 can be implemented by an arbitrary numeric string or character string generated using random numbers or any combination thereof. Since the management identification code 4055 is a code that differs for each polling place in principle, it is also referred to as a polling place ID.
[0180]
Using the card issuing machine 201, the card authentication key 403 is applied to the operation card 405, which is an IC card managed and owned by the voting manager (different from the staff of the election management committee that issued the card authentication key 403) at each polling place. And polling place ID 4055 are recorded. As another embodiment, the present invention does not record the card authentication key 403 on the media at each polling place as described above, but the operation card is generated when the election data creation system 100 generates the authentication key 403. It is also possible to record on blank media for 405 and distribute it to the voting managers at each polling place. In this case, at the polling place, only the polling place ID 4055 is recorded for the operation card 405 in which the card authentication key 403 is recorded in advance.
[0181]
The operation card 405 in which the card authentication key 403 and the polling place ID 4055 are recorded has a step S1805 in which the vote manager of the polling place takes out the card issuing machine 201 and transfers it to the electronic voting device 203 in the same polling place.
The operation card 405 is inserted into the voting card record reading means 2032 of the electronic voting device 203 (step S1805a), and the card authentication key 403 recorded on the operational card 405 and the card authentication recorded on the RAM 453 of the electronic voting device 203 are displayed. It has step S1806 which collates with a key. For example, the electronic voting device 203 transmits an authentication key 403 to the IC chip of the operation card, and determines whether or not the password for reading the IC chip can be released. Alternatively, if the data in the IC chip is not plaintext but ciphertext, it is determined whether or not decryption is possible.
[0182]
In the conditional branch of step S1807, only when the collation is normally performed (“YES” in step S1807), the card type (ID of voting card or operation card) recorded on the card is read (step S1808). If the card type is the operation card (“YES” in step S1808a), the process proceeds to the next step.
The electronic voting apparatus 203 includes step S1809 for reading the management identification code 4055 recorded on the operation card 405. If it is read normally (“YES” in step S1810), it is stored and accumulated in the RAM 453 of the electronic voting device (step S1811), and a card insertion waiting screen is displayed on the LCD screen 2031 (step S1812). The electronic voting device is ready to vote.
[0183]
In this manner, the management identification code 4055 generated by the card ticketing machine 201 on the day of the voting date is transmitted to each electronic voting device installed in the same polling place as the card ticketing machine 201. Through these series of steps, the card issuing machine 201 in the polling place and the (usually a plurality of) electronic voting devices 203 are managed with the same management identification code 4055 (voting place ID). Only the voting card 406 having can be accepted.
[0184]
The series of steps described above is a step for making the electronic voting device 203 ready to start voting, and is therefore preferably performed before the voting start time on the voting date. Before performing this step, no person can start voting from the installation of the electronic voting device the day before the voting day to the day of the voting day. As described above, the operation method of the electronic voting system using the operation card is not only a simple method, but also has the effect of not only reducing the cost of special security, but also ensuring the transparency of the election operation.
[0185]
These operations are not necessarily performed by the vote manager. For example, a voting card 406 issued to an elector who first visited a polling place is used in place of an operation card, and voting from the ticket issuing machine 201 to the electronic voting device 203 in the presence of a voting manager. It is also possible to operate so as to propagate the place ID. In such a case, there is no need for an operation card, and the operation form is such that the polling place ID (management identification code) is propagated only by the voting card.
[0186]
Of the above steps, if the verification of the card authentication key 403 has failed (“NO” in step S1807), or if the card type is not the operation card 405 (“NO” in step 1808a), or a management identification code (voting) If the location ID) cannot be read normally ("NO" in step S1810), the operation card 405 is ejected by the card ejection process in step S1813, and the electronic voting apparatus displays a card insertion wait screen (FIG. 41). Is displayed).
[0187]
Next, steps after the voting start time will be described with reference to FIG. First, on the electronic voting apparatus 203 storing the management identification ID 4055, a card insertion waiting screen as shown in FIG. 41 is displayed (step S1901).
In FIG. 40, an elector (voting person) who has confirmed the identity of the polling place staff by comparing it with the electoral list at the polling place is used by the card-issuing machine 201 to share all polling places. Step S1902 for issuing the voting card 406 in which the authentication key 403 and the management identification code 4055 unique to the polling place are recorded. The voting card 406 is an activator that, when inserted into the electronic voting device 203, makes the electronic voting device 203 ready to vote. The voting card is illustrated in FIG. 23 in addition to the management identification code (voting place ID) 4055. The elector characteristic ID 2021 (input / output means code that can be selected depending on the type of disability of the elector), the voting flag 2022 for identifying whether the vote can be voted or not issued for the election ID to be executed are recorded. .
[0188]
There is a step S1903 in which the elector is personally transferred from the ticketing machine 201 to the electronic voting device 203, and the elector inserts the voting card 406 into the electronic voting device 203. That is, the elector receives the voting card 406 issued at the polling place from the voting manager, then goes to the electronic voting device 203 installed in the polling place and inserts it into the voting card record reading means 2022. The voting card is mechanically taken into the electronic voting device 203 by the card transport mechanism.
[0189]
The electronic voting device 203 has step S1904 for reading the voting card 406 using the authentication key 203 stored on the RAM 453 and collating the authentication key. This is a step in which the card control unit 415 of the voting program 404 determines whether or not data can be read prior to data reading. If they are verified (“YES” in step S1905), the process proceeds to the next step. If the collation cannot be performed normally (“NO” in step S1905), the voting card is ejected from the voting card record reading unit 2022 (step S1914), and the process returns to step S1901 in the voting card input waiting state.
[0190]
If the verification of the card authentication key is successful, a card type reading step is included. That is, a code for identifying whether the inserted card is a voting card or an operation card is read (step S1906). This is illustrated in FIG. 23 as the card type. If the card type is a voting card (“YES” in step S1907), the process proceeds to the next step. If the card type is an operational card or the identification code cannot be read normally (“NO” in step S1907), the process returns to step S1901 through a card ejection process (step S1914).
[0191]
Next, it has step S1908 which reads the management identification code 4055 of the voting card 406 in FIG. If it is read normally ("YES" in step S1908a), the process proceeds to the next step. If reading fails, the process returns to step 1901 through step S1914 of the card ejection process.
[0192]
Next, the management identification code 4055 read from the voting card 406 is collated with the management identification code 4055 stored in advance in the RAM 453 of the electronic voting apparatus 203 (S1909). This is a step of checking the validity of whether or not the voting card 406 inserted into the electronic voting device 203 is a card that has been issued by the ticketing machine 201 of the polling place where the electronic voting device is installed. is there. If a card issued by a ticketing machine other than the polling place is used, those voting cards will not be accepted in step S1914 of the card discharge process. It is also extremely difficult to forge a voting card. Since the management ID recorded on the voting card is issued on the day of voting, it is virtually impossible to manufacture a counterfeit card prior to the voting date. Further, on the voting day, the voting card is read-protected by the authentication key, and the data is initialized after the voting is finished as described above. Therefore, it is extremely difficult to steal the management ID. . In this way, the risk of illegal voting due to abuse of the voting card can be virtually eliminated.
[0193]
Finally, only when the verification of the management identification code 4055 is successful (“YES” in step S1910), the election information recorded on the voting card is read (step S1911), and the read election candidate is selected. A possible screen is displayed (step S1912), and the electronic voting apparatus 203 includes a step S1913 in which an elector starts a voting operation. The elector performs a vote by selecting and operating a candidate selection screen displayed on the touch panel LCD 2031 by a voting program 404 operating inside the electronic voting apparatus 203.
[0194]
FIG. 41 is a diagram showing an example of a voting card input waiting screen displayed on the LCD 20311 of the electronic voting apparatus 203 applied to this embodiment. The guidance “Please insert a voting card” is provided by text and voice, and the position of the card record reading means 2032 of the electronic voting device 203 and the direction of insertion of the voting card 406 are displayed in an animation so that the elector can easily understand. . The number of votes voted by the electronic voting device 203 is displayed as the number of votes in the lower right corner of the screen. The first voter confirms that this display is zero (zero vote confirmation), and starts voting. The voting card input waiting screen is created by the voting screen creation unit 433 in the voting program 404 with reference to the fixed screen layout table 401d and the display message table 401f in the candidate data 401 and displayed on the LCD 20311.
[0195]
FIG. 42 is a diagram showing an example of a voting card removal waiting screen displayed on the LCD 20311 of the electronic voting apparatus 203 applied to this embodiment. When the voting is completed and the voting card 406 is automatically ejected from the card record reading means 2032, the voting is completed for the elector who made the voting. Remove the voting card and return the voting card to the staff. Is provided by text and voice. The voting card sampling waiting screen is created by the voting screen creation unit 433 in the voting program 404 with reference to the fixed screen layout table 401 d and the display message table 401 f in the candidate data 401 and displayed on the LCD 20311.
[0196]
FIG. 43 is a diagram illustrating an example of a candidate selection screen of the electronic voting apparatus 203 applied to the present embodiment. With this screen, a list of candidates for election is displayed on the LCD 20311 as candidate buttons that can be input on the touch panel 20313.
[0197]
FIG. 44 is a diagram showing an example of a candidate selection screen (when a button is pressed) of the electronic voting apparatus 203 applied to this embodiment. With this screen, the candidate button selected by the voter touching the touch panel 20313 is highlighted on the LCD 20311 to notify the voter that the input has been made.
[0198]
FIG. 45 is a diagram showing an example of a candidate selection screen (28 names display) of the electronic voting apparatus 203 applied to this embodiment. With this screen, 28 candidate buttons are displayed on a single screen. The button size is horizontal width a = 69 mm and vertical width b = 18 mm, and four buttons are displayed on the LCD 20311 in the horizontal direction and seven buttons in the vertical direction. This button size is empirically required, but the average sighting elector can visually recognize the letters on the button, and a general finger size elector can press it. The size is not inconvenient.
[0199]
Election names, display messages, etc. are displayed, but if these are not displayed and only the candidate buttons are displayed, a maximum of 48 candidate buttons will be displayed in the case of a 15-inch display. Can do. In the case of a general N-inch display, assuming that the aspect ratio is 4: 3, the number of candidate buttons of Int (20 N / a) × Int (15 N / b) can be displayed. However, Int () represents the maximum integer not exceeding the numerical value in (). For example, in the case of an N = 21 inch LCD, 102 (= 6 horizontal × 17 vertical) candidate buttons can be displayed. When the number of candidate buttons calculated in this way is exceeded, the display is switched to the initial letter selection screen as shown in FIG. It should be noted that the size of the button and the calculation formula do not depart from the scope of the present invention even if there is a slight change in numerical values.
[0200]
FIG. 46 is a diagram showing an example of an initial letter selection screen of the electronic voting apparatus 203 applied to this embodiment. This screen can provide a fair selection screen by initial selection when the number of candidates cannot be displayed on a single page.
[0201]
FIG. 47 is a diagram illustrating an example of an initial character selection screen (display of only a candidate) of the electronic voting apparatus 203 applied to the present embodiment. With this screen, only the initials of the candidates who have run as candidates are notified to the voter.
[0202]
FIG. 48 is a diagram showing an example of the initial candidate selection screen (when “O” is selected) of the electronic voting apparatus 203 applied to the present embodiment. With this screen, a list of candidates corresponding to the selected initial is displayed on a single page.
[0203]
FIG. 49 is a diagram showing an example of the initial page candidate candidate multiple page selection screen of the electronic voting apparatus 203 applied to this embodiment. With such a screen, a list of candidates corresponding to the selected initial is displayed over a plurality of pages.
[0204]
FIG. 50 is a diagram illustrating an example of a multiple selection page guidance screen of the electronic voting apparatus 203 applied to the present embodiment. This screen alerts the voter that there are multiple pages of candidate screens.
[0205]
FIG. 51 is a diagram showing an example of a voting progress screen of the electronic voting apparatus 203 applied to this embodiment. With this screen, instead of using the touch panel 20313, an operation assistant (assistant) of an elector who performs voting using a barrier-free input device (a push switch for motor function disorder, a dedicated keyboard for the visually impaired, etc.) On the other hand, the progress status of the voting operation is notified.
[0206]
FIG. 52 is a diagram showing an example of a candidate confirmation screen of the electronic voting apparatus 203 applied to this embodiment. On this screen, the candidate temporarily selected by the voter is enlarged and displayed, and the intention to vote is confirmed.
[0207]
FIG. 53 is a diagram showing an example of the abstention confirmation screen of the electronic voting apparatus 203 applied to this embodiment. This screen confirms the voter's intention to abstain from voting (including the intention to re-vote).
[0208]
FIG. 54 is a diagram showing an example of an election end screen of the electronic voting apparatus 203 applied to this embodiment. This screen notifies the voter that one election has been completed when a plurality of elections are held.
[0209]
FIG. 55 is a diagram showing an example of an election end confirmation screen of the electronic voting apparatus 203 applied to this embodiment. This screen notifies the voter that the voting data 407 and the voting log 4075 have been correctly recorded on the original recording medium 408.
[0210]
FIG. 56 is a diagram showing an example of a screen for informing the electronic voting apparatus 203 applied to the present embodiment of the occurrence of a recording failure in the copy recording medium 409. This screen causes an error in writing to the copy recording medium 409, and confirms that the original recording medium 408 has been recorded correctly to the voting staff (voting witness or vote manager) or the elector. Inform. In this case, the clerk confirms the screen display and informs the elector that the vote has been confirmed. Then, since it is difficult to immediately determine whether the cause of the writing error is a defect in the copy recording medium 409 or the electronic voting apparatus 203 itself, the failure occurred within the voting time. Take measures to stop using electronic voting devices. When counting votes, the original recording medium 408 is used, and voting up to voting when an error occurs is validated. On the other hand, the copy recording medium 409 is not used for counting votes.
[0211]
FIG. 57 is a diagram illustrating an example of a screen for notifying that a fatal error has occurred in the electronic voting apparatus 203 applied to the present embodiment. A fatal error refers to, for example, a case where a write error has occurred in the original recording medium 408. In such a case, an attendant at the polling place (voting witness or voting manager) confirms the screen display, reissues the voting card 406, and votes with an electronic voting device different from the electronic voting device. I will let you. When counting votes, the original recording medium 408 is not used, and only the copying recording medium 409 is used. This is because voting data is recorded on the original recording medium 408 before the failure occurs, but these may not be recorded normally. Since data at the time of error occurrence is not recorded on the copy recording medium 409, the data from the previous voter at the time of error occurrence is counted as a valid vote.
[0212]
FIG. 58 is a diagram showing an example of a card authentication key 403 applied to the present embodiment. The card authentication key 403 is a key for accessing the data of the IC card, and is realized as a string of numbers or characters. In the operation method of the electronic voting system applied to the present embodiment, the card authentication key 403 is created by selection, and the same card authentication key is distributed to all polling stations. As a form of distribution of the card authentication key 403, there is a method of distributing the card authentication key 403 to a polling place after inputting the card authentication key 403 into an IC card (voting card 406 or operation card) in advance. Alternatively, the card authentication key 403 may be distributed to a polling place using a recording medium different from the IC card, and the card authentication key 403 may be introduced into the IC card at the polling place.
[0213]
FIG. 59 is a diagram showing an example of input / output means defined by the elector characteristic ID 2021 that defines the voting mode applied to this embodiment. The first column is a numerical value indicating the elector characteristic ID 2021, and the second column is a specific example of the corresponding elector characteristic. Electoral characteristics are non-disability, visual impairment, hearing impairment, limb disability, internal disability, and any combination thereof. Then, as shown in the columns of the fourth column and the fifth column in FIG. 18, the notifying unit 20305 and the input unit 20306 to be used are different depending on the weight of the obstacle class for the same elector characteristics. For example, for an elector who is a non-disabled person (healthy person) whose elector characteristic ID 2021 is “00”, a voting screen for healthy persons is displayed on the LCD 2031 of the electronic voting device 203, and the touch panel is used as the input means 20306. An LCD is used as the notification means 20305.
[0214]
Further, the elector of the visually handicapped person (sixth grade) whose elector characteristic ID 2021 in FIG. 59 is “01” (the visual acuity of one eye measured by the universal visual acuity table is 0.02 or less and the visual acuity of the other eye is 0.6). For the following, the visual acuity of both eyes exceeds 0.2), a voting screen for weakly sighted person is displayed on the display unit 2031 of the electronic voting device 203, and the touch panel 20313 is used as the input means 20306. An LCD 20311 is used as the notification unit 20305.
[0215]
On the other hand, a voter who is a visually impaired person (first grade) whose elector characteristic ID 2021 is “02” (those whose visual acuity of both eyes is 0.01 or less) is voted on the LCD 20311 of the electronic voting apparatus 203. As an input means 20306, a progress screen (screen displaying only the progress of voting without displaying the contents of voting such as the name of the candidate, etc., shown in FIG. 51) is displayed to prevent the secret of the voting secret from being leaked to the assistant. Uses a voice guide by a headphone 20391 with volume adjustment and a speaker 2033 as a dedicated keyboard 20381 for visually impaired persons and a notification means 20305. Furthermore, the elector of the visually impaired person (deafblind person) whose elector characteristic ID 2021 is “03” (the sum of visual acuity of both eyes is 0.01 or less and the hearing level of both ears is 100 decibels or more respectively) ) Is displayed on the LCD 20311 of the electronic voting device 203 by displaying a voting progress screen (screen displaying only the voting progress status without displaying the voting contents such as the candidate name, etc., as shown in FIG. 51). The secret of voting for the person is prevented from leaking, and a dedicated keyboard 20181 for the visually impaired is used as the input means 20306, and a kana character pin display (or Braille display) is used as the notification means 20305.
[0216]
For the elector of the physically handicapped person (upper limb amputation or upper limb dysfunction) whose elector characteristic ID 2021 is “04”, the same voting screen as the healthy person is displayed on the LCD 2031 of the electronic voting device 203, As the input means 20306, a keyboard (not shown) for a physically handicapped person or a foot switch that can be input with a foot, and an LCD as an informing means 20305 are used. On the other hand, for the elector of the physically handicapped person (systemic movement or functional disorder) whose elector characteristic ID 2021 is “05”, the voting progress screen (candidate name, etc.) is displayed on the display unit 2031 of the electronic voting device 203. A screen displaying only the progress of voting without displaying the voting contents (shown in FIG. 51) is displayed to prevent the secret of the voting secret from being leaked to the assistant, and even if there is an involuntary movement as the input means 20306 A head-mounted display, which is a spectacle-type display device that is used by being fixed to the head as the push switch 20371 for motor function disorder and the notification means 20305 that can be input, is connected to the head-free display terminal 20302 for barrier-free use.
[0217]
The screen displayed on the head-mounted display used by the elector with the elector characteristic ID = 05 uses a scan input screen in which selectable items (that is, reverse display portions in FIG. 53) are automatically and sequentially switched at regular time intervals. . Further, for the elector with an internal disability (obfuscated) whose elector characteristic ID 2021 is “06”, a voting screen for healthy persons is displayed on the display unit 2031 of the electronic voting device 203, and a touch panel, An LCD is used as the notification means 20305, but the progress of the screen and the voice guide are reproduced slowly. In this way, by assigning an elector characteristic ID to all obstacles and defining the input means 20306 and the notification means 20305, it becomes possible to provide a vote mode for all the electors. The device 203 can be barrier-free (universal design). Note that what kind of notification means and input means are suitable for actual voting has been empirically clarified by a simulated voting experiment conducted for disabled persons and elderly persons nationwide.
[0218]
Hereinafter, with reference to FIGS. 60 to 62, an example of a flow from notification by a candidate for election to voting by an elector and counting of votes by a voting manager will be described. FIG. 60 is a flowchart showing a voting preparation flow of the electronic voting apparatus 203 applied to this embodiment. On the day of the voting day, the voting manager confirms that the electronic voting device is turned off in step S201, and then the electronic voting device is started up. Done.
[0219]
1) Sending the voting program 404, candidate data 401, and card authentication key 403 to the polling place
After the election data master 400 created in advance in step S204a has been inspected and approved by the election management committee (step S204b), a memory serving as a copy recording medium 409 for the electronic voting device 203 by the election data media copying machine 102 It is duplicated on the card (step S204c) and sent to each polling place together with the original recording medium 408. Therefore, the data such as the card authentication key 403 is common at all polling stations. Usually, sending is done by the day before the voting date.
[0220]
2) Creating operational cards
The voting manager uses the voting card ticketing machine 201 to create an operation card 405 to which a unique polling place ID is assigned. The polling place ID is a numerical value uniquely generated using, for example, a random number, and in principle, the polling place ID is different for each polling place.
[0221]
3) Install the voting program, candidate data, and card authentication key before the election starts
The voting manager holding the key of the padlock 2030a and the operation card 405 (IC card) unlocks the front door 2030, and attaches the original recording medium 408 and the copying recording medium 409 to the electronic voting apparatus 203 (step S203). , S204), the voting program 404, the candidate data 401, and the card authentication key 403 are installed from the copy recording medium 409 (step S210).
[0222]
4) Recording medium installed
The original recording medium 408 and the copying recording medium 409 are normally mounted at the time of a preliminary operation check on the day before the voting date, and are locked and managed by the padlock 2030a. In this way, both the person who selects the card that issued the card authentication key 403 and the vote manager of the polling place that issued the polling place ID are involved in security, and the transparency of election management can be improved.
[0223]
Next, a voting example of a single election (single entry type) will be described with reference to FIG. In actual elections, there are elections where multiple candidates are selected from the candidate list, as in the national review of the Supreme Court Judge, but here we will explain only the single-line election where a single candidate is selected. FIG. 61 is a flowchart showing an example of a single election (single entry) voting flow according to the operation method of the electronic voting system applied to this embodiment.
[0224]
1) Confirm “zero vote”
The first elector at the polling place confirms the “zero vote” by the zero vote confirmation function in the presence of the vote manager and the voting witness (step S702). The zero vote confirmation function is a function that displays, for example, the number of votes recorded on the original recording medium 408 of the electronic voting apparatus, that is, the number of voting data 407, as the number of votes on the card insertion waiting screen.
Note that the “zero” vote confirmation is established when the authentication of the operation card 405 is completed (“OK” in step S705).
[0225]
2) Start of electronic voting device
After confirming the “zero vote”, the voting manager performs a voting start procedure using the operation card, and activates the voting card input waiting function (step S709). That is, the polling place ID 4055 is stored on the RAM 453 of the electronic voting apparatus, and the voting card 406 can be accepted. The start of voting is established when the operation card 405 is removed from the electronic voting device 203.
[0226]
3) Start of voting
In the voting card input waiting function (step S709), the elector inserts the voting card 406 issued by the card issuing machine 201 into the electronic voting device 203 (step S710), and uses the card authentication key 403 to enter the voting card. 406 is read, and the polling place ID 4055 recorded on the voting card 406 is compared with the polling place ID 4055 on the RAM 453 of the electronic voting device. The electronic voting is performed only when the voting right (that is, the voting flag 2022) recorded on the voting card 406 is read and the voting right information (that is, the voting flag 2022 is “votable”) can be confirmed only when the collation is successfully performed. The device capability is activated (“OK” in step S711). Simultaneously with the confirmation, the data area of the voting card 406 is initialized and all data is deleted (step S712). The reason for initializing the voting card is to completely cut off the fear of illegal voting due to the reuse of the card. The start of voting is established when the voting card is initialized.
[0227]
4) Selection of candidates
In the candidate selection function (step S713) for displaying a screen as shown in FIG. 43 on the LCD screen, the elector selects a candidate by touching the candidate name with a finger or a stylus pen (step S714). .
[0228]
5) Confirmation of candidate selection
With the candidate confirmation function for displaying a screen as shown in FIG. 52 on the screen of the LCD 20311 (step S715), the elector confirms by touching the confirmation button with a finger or a stylus pen (step S716).
[0229]
6) Voting data recording on original recording media
As a result of the confirmation in 5), the voting data 407 is first recorded on the original recording medium 408 (step S717). Subsequently, the voting log 4075 is recorded on the original recording medium 408 (step S717a).
[0230]
7) Confirm the vote and turn on the vote confirmation LED
After the voting data 407 and the voting log 4075 are recorded on the original recording medium 408, the voting confirmation LED 2034 is turned on (step S718). The voting is confirmed when the voting data 407 and the voting log 4075 are recorded and confirmed on the original recording medium 408 (step S718).
[0231]
8) Backup recording of voting data on a recording medium for copying
Next, the same voting data 407 and voting log 4075 are recorded on the copy recording medium 409 for backup (steps S719 and S720). In this embodiment, the vote data 407 is not encrypted. In the future, when voting data 407 is transmitted over the network, a common key encryption such as DES encryption (DES: Data Encryption Standard) or a public key encryption such as RSA encryption (RSA: Rivest-Shamir-Adleman) is used. The voting data 407 may be encrypted and decrypted when the vote is opened.
[0232]
9) End of voting
At the same time that the voting card 406 is discharged (step S721), the voting card removal waiting function (step S722) that displays a screen as shown in FIG. Is extracted (step S723). Note that voting ends when the voting card 406 is discharged.
[0233]
10) Turn off the voting confirmation LED
When the voting card is extracted, the voting data voting confirmation LED 2034 is turned off (step S724).
[0234]
11) Prevention of double voting
Since the voting card 406 that has been voted and discharged is initialized, even if the voting card is inserted again, it is determined that voting has been completed ("NO" in step S711), and double voting is prevented.
[0235]
12) Voting after the second
The above 3) to 10) are repeated.
[0236]
13) Reissue of voting card
1. Insert a successfully issued voting card.
2. A reading error or initialization writing error by the electronic voting device 203 occurs.
3. Obviously no unauthorized operation.
4). Collect voting cards and prohibit reuse of voting cards.
5). Reissue the voting card to the elector.
[0237]
FIG. 62 is a flowchart showing the flow of the end of electronic voting by the operation method of the electronic voting system applied to the present embodiment.
Hereinafter, the flow of termination will be described in order.
1) Closing of polling place
The voting manager who holds the key of the padlock 2030a and the operation card 405 (IC card) performs a polling place closing process and a voting end process in the presence of a voting witness (steps S801 to S813).
2) Removal of original recording medium and copying recording medium in which voting data is recorded The voting manager uses the front door 2032 of the electronic voting apparatus 203 storing the original recording medium 408 and the copying recording medium 409. The power is turned off by the power switch 2032 of the electronic voting apparatus. Thereafter, the original recording medium 408 and the copying recording medium 409 are taken out (steps S814 and S815).
3) Sending voting data
The original recording medium 408 and the copying recording medium 409 are stored in the storing box (step S816), and are sent to the counting place after locking.
[0238]
FIG. 63 is a flowchart showing an example of the flow of processing when a recoverable error occurs in the electronic voting system applied to this embodiment. Here, the error means an error that can be detected by the voting program 404 and assumed in advance at the time of manufacture. “Errors” are classified into the following two categories.
1. Recoverable error that can be recovered by retrying
2. Unrecoverable “unrecoverable error”
[0239]
“Recoverable errors”
Bad connection of barrier-free equipment
When voting card related defects
It is a failure that occurs. In particular,
1. Reading errors due to incorrect insertion of voting cards in the front and back, up / down direction, and inserted voting cards. If the card itself is defective, there is no means to confirm the right to vote, so a separate operational arrangement is required.
2. Connection failure or disconnection of barrier-free devices (dedicated keyboard 20181 for the visually impaired, headphone 20391, and push switch 20371 for motor function impairment).
Etc. are considered. When a recoverable error occurs, basically, it is performed according to the screen display function, and is recovered by reconnecting the barrier-free device or reinserting the voting card 406. If the symptom does not improve as a result, the error is treated as an unrecoverable error.
[0240]
"Unrecoverable error"
The voting program cannot perform further voting operations
Is output when it is determined.
The voting manager must deal with the items displayed on the screen and stop using the electronic voting apparatus.
[0241]
In step S101, a voter (elector) inserts a voting card 406. Next, in the conditional branch of step S102, the voting right of the voter recorded on the voting card is confirmed, and if there is no voting right recorded on the voting card, that is, already initialized or not issued ( After “voted (initialized)” in step S102), the process proceeds to step S105, and the type of error that can be recovered (that is, voted) is displayed on the LCD 20311 of the electronic voting device 203, and then the voting card in step S106. 406 is discharged. When the voting card 406 is ejected, the voter and the voting assistant confirm the error content displayed on the LCD 20311 in step S107. In this case, the LCD 20311 displays that the voting card has already been voted.
[0242]
After confirming the error contents, in step S108, when the voter removes the discharged voting card, the LCD 20311 enters a voting card insertion waiting state (shown in FIG. 41) in step S109. And in step S110, the recovery process from the error by a voter and / or a vote assistant is performed. Specifically, when it is confirmed by the voter's self-report and the witness testimony that the voter has not actually finished voting using the vote card 406, the vote card issuing machine 201 The voting card 406 is reissued. In step S111, the voter re-inserts the reissued voting card 406 and redoes the voting.
[0243]
If a reading error of the voting card 406 occurs in the conditional branch of step S102 ("card identification is impossible" in step S102), the type of error that can be recovered (that is, card identification is impossible) in step S105. After displaying on the LCD 20311 of the electronic voting apparatus 203, the voting card 406 is discharged in step S106. When the voting card 406 is discharged, the voter and the voting assistant confirm the error content displayed on the LCD 20311. In this case, the LCD 20311 displays that the inserted card could not be recognized. After confirming the error contents, when the voter removes the discharged card in step S108, the LCD 20311 enters a voting card insertion waiting state (shown in FIG. 41) in step S109. And in step S110, the recovery process from the error by a voter and / or a vote assistant is performed. Specifically, the voting card 406 is reissued by the voting card issuing machine 201. In step S111, the voter re-inserts the reissued voting card 406 and redoes the voting.
[0244]
In the conditional branch of step S102, when the voting right of the voting card 406 is confirmed (“voting is possible” in step S102), the elector characteristic 2021 is read in step S103, and whether or not the elector characteristic ID = 00. I.e., whether to use the barrier-free I / O option. If the elector characteristic ID is not 00 (“YES” in step S103), it is confirmed in step S104 whether an input / output device (illustrated in FIG. 59) corresponding to the elector characteristic ID is connected. If the input / output device corresponding to the read elector characteristic ID is not connected in the conditional branch in step S104 (“NO” in step S104), the type of recoverable error (that is, the input / output device is determined in step S105). (Not connected) is displayed on the LCD 20311, and the voting card 406 is discharged in step S106.
[0245]
When the voting card 406 is ejected, the voter and the voting assistant confirm the error content displayed on the LCD 20311 in step S107. In this case, the LCD 20311 displays that the headphones 20391 voting card has already been voted. After confirming the error content, in step S108, if the voter removes the vote card 406 that has been discharged, the LCD 20311 enters a wait state for inserting a vote card (shown in FIG. 41) in step S109. And in step S110, the recovery process from the error by a voter and / or a vote assistant is performed. In step S111, the voter re-inserts the reissued voting card 406 and redoes the voting.
[0246]
If the input / output device corresponding to the read elector characteristic ID is normally connected in the conditional branch of step S104 ("YES" in step S104), the voting card 406 is initialized in step S112. . In the next step S113, a candidate selection screen is displayed on the LCD 20311, and the voter performs a voting operation. It is assumed that, for example, the plug of the headphone 20391 is disconnected from the headphone terminal 2039 during the voting operation (“NO” in step S114). In that case, a display indicating that the headphone terminal 2039 is not connected is displayed on the LCD 20311 by the recoverable error display function in step S115. In step S116, recovery processing from an error by a voter and / or voting assistant, that is, connection of a headphone terminal is performed. If the connection is successful, the screen returns to the candidate selection screen, and the voter continues voting in step S117.
[0247]
FIG. 64 is a diagram showing an example of a voting log in which an operation history of the electronic voting apparatus 203 applied to the present embodiment is recorded. The voting log 4075 is a record of all operation histories performed by the electronic voting program 404 of the electronic voting apparatus 203 as time series data. The time information is represented by year, month, day, hour, minute, second as shown in the “time” column of FIG. 64, and the processing corresponding to each time is represented by the “function classification” column. Stored in the “Process” column. For example, the process (layout setting: candidate button etc.) in the record (row) in which the function classification column is “candidate selection” is the candidate selection screen ( Details of the creation process (shown in FIG. 37) are sequentially recorded. When an error occurs during voting, the cause of the failure can be grasped by analyzing the voting log 4075. These data are text files in an appropriate format such as CSV format (CSV: Comma Separated Value (format): file format in which items are separated by commas) on the original recording medium 408 and the copying recording medium 409. Saved as
[0248]
FIG. 65 is a sequence diagram showing an example of a flow from voting to end by the electronic voting apparatus 203 applied to the present embodiment. First, the screen shown in FIG. 41 is displayed by the voting card insertion waiting function of the voting program 404. Next, the elector inserts the voting card 406 into the card R / W 2032. When the voting program 404 detects that a voting card is inserted, it transmits a card authentication key 403. The card R / W writes the card authentication key 403 into the recording unit of the IC card, and returns a return value from the IC card, that is, a code indicating whether access is possible, to the voting program. If access is possible, the voting program 404 reads the card type ID (shown in FIG. 23), which is a code for identifying the voting card 406 or the operation card 405.
[0249]
When it is read from the card R / W 2032 that the card type ID is the voting card 406, the elector characteristic ID 2021 and the voting flag 2022 are read from the voting card 406. When these data are stored in the RAM 453, the voting program 404 opens a file for writing the voting log 4075 on the original recording medium 408, and writes a log relating to the voting card insertion process (in FIG. 65, All logs are illustrated as voting log 4075). When the log recording is completed and the file is closed, the voting program 404 discharges the cache existing in the cache area on the RAM 453. When the discharge of the cache is completed, a file for writing the voting log 4075 is opened on the copy recording medium 409, and a log having the same content as that recorded on the original recording medium 408 is written. When the writing of the voting log 4075 to the copy recording medium 409 is completed, the file is closed and the cache is discharged.
[0250]
Next, the voting program 404 outputs a lighting signal to the GPIO interface of the operation indicator lamp 20301b. When the operation indicator lamp 20301b is turned on, the vote manager and the voting witness are notified that the vote has started. The voter performs a voting operation by touching the touch panel 20313 in accordance with a candidate selection screen (illustrated in FIG. 43), a candidate confirmation screen (illustrated in FIG. 52), etc. displayed on the LCD 20311. In a series of voting operations, all operation records of the electronic voting device 203 such as screen switching and touch panel operations are recorded in the form of a voting log shown in FIG. 64 with respect to the original recording medium 408 and the copying recording medium 409. , Recording and discharging of the cache are performed. If the voter touches “I will vote” on the vote intention confirmation image (illustrated in FIG. 52), the vote data recording unit 434 of the vote program 404 selects the vote data 407 on the RAM 453 of the selected candidate. Is written to the original recording medium 408.
[0251]
After the cache on the RAM 453 is discharged, the file of the voting data 407 created on the original recording medium 408 is opened and read again on the RAM, and the comparison and verification (verification) are performed. It is confirmed that it was done. Then, the voting log is written into the original recording medium 408. Although not shown in the figure, also in writing the voting log, after the cache is discharged, the generated voting log file is read and verified.
[0252]
Next, when the writing of the voting data 407 and the voting log 4075 to the original recording medium 408 is finished, the voting program 404 turns on the voting confirmation LED 2034 for informing the voter that the voting is confirmed. A signal is output to the GPIO port.
[0253]
Next, when the voting confirmation 2034 is turned on, the voting program 404 copies the voting data 407 and the voting log 4075 to the copy recording medium 409. That is, the voting program 404 opens a file on the copy recording medium 409 and closes the file after the voting data 407 stored in the RAM 453 is written. Then, after the discharge of the cache on the RAM 453 is completed, the file is opened again, read into the RAM, and after the file is closed, the data on the RAM is compared and verified. The duplication of the voting log 4075 is similarly recorded and discharged.
[0254]
Next, when the recording of the voting data 407 and the voting log 4075 is completed on the original recording medium 408 and the copying recording medium 409, the voting program 404 causes the voting program 406 to be ejected to the card R / W. An instruction is sent. When the voting card is mechanically discharged by the transport mechanism, the voting program 404 records a log on the original recording medium 408 and the copying recording medium 409. At this time, as with the processing up to now, each time the writing to each recording medium is completed and the file is closed, the cache is discharged, and then the file is opened and the written data is verified. Done.
[0255]
Next, when the voter ejects the voting card discharged from the card R / W 2032, the voting program 404 outputs an instruction to turn off the signals output to the voting confirmation LED 2034 and the operation indicator light 20301 b. . When the operation indicator lamp 20301b is turned off, the vote manager and the voting witness are notified that the voting is completed. Similarly, a voting log 4075 for these processes is also recorded on the original recording medium 408 and the copying recording medium 409.
[0256]
The present embodiment is not limited to the non-network type first stage electronic voting system of the above embodiment, but records voting data in the second stage and third stage network type electronic voting systems. It can also be applied.
[0257]
【The invention's effect】
As described above in detail, the present invention is a direct recording type electronic voting apparatus that records voting data of a plurality of voters on a single recording medium, and voting results are randomly assigned to a plurality of files. For example, the voting data generation method, the electronic voting apparatus, and the electronic voting program can be provided in which the secret of the voting can be ensured and zero data is not generated.
[Brief description of the drawings]
FIG. 1 is a diagram illustrating a voting data generation method applied to the present embodiment.
FIG. 2 is a flowchart showing a voting data generation method applied to this embodiment.
FIG. 3 is a diagram illustrating an example of an overall configuration of an electronic voting system using an electronic voting apparatus according to an embodiment of the present invention.
FIG. 4 is a perspective view showing an example of an exterior of an electronic voting apparatus applied to this embodiment.
FIG. 5 is a perspective view showing another example of the exterior of the electronic voting apparatus applied to the embodiment.
FIG. 6 is a top view showing an example of an exterior of an electronic voting apparatus applied to the present embodiment.
FIG. 7 is a front view showing an example of an exterior of an electronic voting apparatus applied to the present embodiment.
FIG. 8 is a front view (when the front door is open) showing an example of the exterior of the electronic voting apparatus applied to the embodiment.
FIG. 9 is a rear view showing an example of an exterior of an electronic voting apparatus applied to the present embodiment.
FIG. 10 is a diagram illustrating an example of a hardware configuration inside the electronic voting apparatus applied to the embodiment.
FIG. 11 is a diagram illustrating an example of a data structure of a RAM inside the electronic voting apparatus applied to the embodiment.
FIG. 12 is a diagram showing an example of a data structure inside a silicon disk applied to the embodiment.
FIG. 13 is a diagram showing an example of the structure of an electronic voting program applied to this embodiment.
FIG. 14 is a diagram illustrating an example of the structure of candidate data applied to the embodiment.
FIG. 15 is a diagram showing an example of a candidate table (for election ID = 1) constituting candidate data applied to the embodiment.
FIG. 16 is a diagram showing an example of a political party table constituting candidate data applied to the embodiment.
FIG. 17 is a diagram showing an example of a polling place group table constituting candidate data applied to the embodiment.
FIG. 18 is a diagram showing an example of a fixed screen layout table constituting candidate data applied to the embodiment.
FIG. 19 is a diagram showing an example of a voting screen layout table (for election ID = 1) constituting candidate data applied to the present embodiment.
FIG. 20 is a diagram showing an example of a display message table constituting candidate data applied to the embodiment.
FIG. 21 is a diagram showing an example of the data structure of an original recording medium stored in the electronic voting apparatus applied to the embodiment.
FIG. 22 is a diagram showing an example of the data structure of a recording medium for copying stored in the electronic voting apparatus applied to this embodiment.
FIG. 23 is a diagram illustrating an example of a data structure of a voting card or an operation card inserted into the electronic voting apparatus applied to the embodiment.
FIG. 24 is a diagram showing an example of a data structure of a voting flag recorded on a voting card applied to the embodiment.
FIG. 25 is a flowchart showing an example of a processing flow of a card reading unit constituting a voting program applied to the embodiment.
FIG. 26 is a flowchart illustrating an example of a process flow of a voting control unit configuring a voting program applied to the embodiment.
FIG. 27 is a flowchart illustrating an example of a process flow of a candidate selection screen voting control unit in a voting control unit configuring a voting program applied to the embodiment.
FIG. 28 is a flowchart (1/5) showing an example of a process flow of an initial letter selection screen voting control unit in a voting control unit constituting a voting program applied to this embodiment.
FIG. 29 is a flowchart (2/5) illustrating an example of a process flow of an initial letter selection screen voting control unit in a voting control unit configuring a voting program applied to the embodiment.
FIG. 30 is a flowchart (3/5) illustrating an example of a process flow of an initial character selection screen voting control unit in a voting control unit configuring a voting program applied to the embodiment.
FIG. 31 is a flowchart (4/5) illustrating an example of a process flow of an initial character selection screen voting control unit in a voting control unit configuring a voting program applied to the embodiment;
FIG. 32 is a flowchart (5/5) showing an example of a process flow of an initial letter selection screen voting control unit in a voting control unit constituting a voting program applied to the embodiment.
FIG. 33 is a flowchart showing an example of a process flow of a voting data recording unit constituting a voting program applied to the embodiment.
FIG. 34 is a diagram illustrating an example of a hardware configuration of a card-issuing machine that issues an operation card applied to this embodiment.
FIG. 35 is a diagram illustrating an example of a software configuration of a card-issuing machine that issues an operation card applied to this embodiment.
FIG. 36 is a diagram showing an example of the data structure of the ticket issuer medium applied to the embodiment.
FIG. 37 is a diagram showing types of elections stored in the ticket issuer media applied to the embodiment.
FIG. 38 is a flowchart showing an example of a polling place ID generation unit constituting a ticketing program applied to the present embodiment.
FIG. 39 is a first half flowchart showing a flow of an operation method of an electronic voting system using an operation card and a voting card applied to this embodiment.
FIG. 40 is a second half flowchart showing the flow of the operation method of the electronic voting system using the operation card and the voting card applied to the embodiment.
FIG. 41 is a diagram showing an example of a voting card input waiting screen displayed on the LCD of the electronic voting apparatus applied to the embodiment.
FIG. 42 is a diagram showing an example of a voting card removal waiting screen displayed on the LCD of the electronic voting apparatus applied to the embodiment.
FIG. 43 is a diagram illustrating an example of a candidate selection screen of the electronic voting apparatus applied to the embodiment.
FIG. 44 is a diagram illustrating an example of a candidate selection screen (when a button is pressed) of the electronic voting apparatus applied to the embodiment.
FIG. 45 is a diagram showing an example of a candidate selection screen (28 names display) of the electronic voting apparatus applied to this embodiment.
FIG. 46 is a diagram showing an example of an initial letter selection screen of the electronic voting apparatus applied to the embodiment.
FIG. 47 is a diagram illustrating an example of an initial letter selection screen (display of only a candidate) of the electronic voting apparatus applied to the embodiment.
FIG. 48 is a diagram illustrating an example of an initial matching candidate selection screen (when “O” is selected) of the electronic voting apparatus applied to the embodiment;
FIG. 49 is a diagram showing an example of an initial corresponding candidate multiple page selection screen of the electronic voting apparatus applied to the embodiment.
FIG. 50 is a diagram illustrating an example of a multiple selection page guidance screen of the electronic voting apparatus applied to the embodiment.
FIG. 51 is a diagram showing an example of a voting progress screen of the electronic voting apparatus applied to the embodiment.
FIG. 52 is a diagram showing an example of a candidate confirmation screen of the electronic voting apparatus applied to the embodiment.
FIG. 53 is a diagram showing an example of an abstention confirmation screen of the electronic voting apparatus applied to the embodiment.
FIG. 54 is a diagram showing an example of an election end screen of the electronic voting apparatus applied to this embodiment.
FIG. 55 is a diagram showing an example of an election end confirmation screen of the electronic voting apparatus applied to the embodiment.
FIG. 56 is a diagram showing an example of a screen for notifying the occurrence of a recording failure in the copy recording medium of the electronic voting apparatus applied to the embodiment.
FIG. 57 is a diagram showing an example of a screen for notifying that a fatal error has occurred in the electronic voting apparatus applied to the embodiment.
FIG. 58 is a diagram showing an example of a card authentication key applied to this embodiment.
FIG. 59 is a diagram illustrating an example of an elector characteristic ID that defines a voting mode applied to the embodiment;
FIG. 60 is a flowchart showing a voting preparation flow of the electronic voting apparatus applied to the embodiment.
FIG. 61 is a flowchart showing an example of a single election (single entry) voting flow according to the method of operating an electronic voting system applied to the embodiment;
FIG. 62 is a flowchart showing an end flow of the electronic voting apparatus according to the operation method of the electronic voting system applied to the embodiment.
FIG. 63 is a flowchart illustrating an example of a processing flow when a recoverable error occurs according to the operation method of the electronic voting system applied to the embodiment.
FIG. 64 is a diagram showing an example of a voting log that records an operation history of the electronic voting apparatus applied to the embodiment.
FIG. 65 is a sequence diagram showing an example of a flow from voting to end by the electronic voting apparatus applied to the embodiment.
FIG. 66 is a diagram illustrating a conventional method for generating voting data.
[Explanation of symbols]
100 Election data creation system
101 Election data management creation machine
102 Election Data Media Copier
200 polling place system
201 Voting card ticketing machine (card ticketing machine)
202 Ticketing Machine Media
203 Electronic voting device
300 Ticking office system
301 Voting data collection / aggregation machine
400 Election Data Master
401 Candidate data
401a1 Candidate table
401b Political party table
401c Polling place group table
401d Fixed screen layout table
401e1 Voting screen layout table
401f Display message table
402 Types of elections (election type data)
403 Card authentication key (authentication key)
404 Electronic voting program (voting program)
405 Operation card (administrator card)
406 voting card
407 voting data
408 Original recording medium (original)
409 Recording media for copying (duplicate, copying, copying)
411 Operating System (OS)
412 Serial I / O control unit
413 Window control unit
414 File control unit
415 Card control unit
416 Touch panel control program
417 Printer control program
418 Junction box control program
431 Card reader
432 Election data reading part
433 Voting screen creation part
434 Voting data recording unit
435 Voting control unit
436 Loading program (program loader)
450 Motherboard
451 CPU
452 ROM
453 RAM (RAM disk)
454 Silicon disk (system disk)
454b Local disk space
455 junction board
456 VRAM (video RAM)
457 CLOCK (built-in quartz watch)
504 Ticketing program
531 Ticketing Machine Media Reading Unit
532 card reader
533 polling place ID generation part
534 Ticketing data recording part
535 Ticketing Control Unit
2011 Ticketing machine display
2012 Ticketing machine card reader / writer
2021 Electoral characteristic ID (disability characteristic)
2022 Vote flag
2030 Front door
2030a padlock
2030b Lock bracket
2031 Display unit
2031a Stylus pen
2031b pen holder
2032 Card record reading means (card reader / writer, card R / W)
2032a Card guide LED (Card insertion guide LED)
2033 Speaker
2033a volume
2034 Voting confirmation LED (voting confirmation LED)
2035 slide cover
2036 LCD angle adjustment arm
2037 Push switch terminal for motor function disorder
2038 Keyboard terminal for the visually impaired
2039 Headphone jack
4055 polling place ID (management ID, management identification ID, management identification code, random number)
4075 Vote Log
2011 CPU (ticketing machine)
201618 RAM (ticketing machine)
201119 HDD (ticketing machine)
20120 random number generator
20301 Status indicator
20301a Power indicator
20301b Operation indicator
20301c Paul
20301d Status indicator cable
20302 External display terminal
20303 Slot for original recording medium
20304 Slot for recording medium for copying
20305 Notification means
20306 input means
20307 Silicon disk storage
20308 Power LED (AC power supply monitoring LED)
20310 Front door open / close sensor
20311 LCD (Liquid Crystal Display)
20312 inverter
20313 touch panel
20314 Built-in battery (internal battery)
20315 DC power supply (DC power supply)
20316 AC power supply (AC power supply)
20371 Push switch for motor function disorder
20381 Keyboard for the visually impaired
20391 Headphones with volume control (headphones)

Claims (11)

A voting data generation method for generating voting data by recording voting results of a plurality of electors on a single electromagnetic recording medium when voting by electronic voting,
Creating a plurality of files on the electromagnetic recording medium;
Randomly distributing the voting results to the created file;
Sequentially recording the sorted voting results for each of the files;
Recording the time information at which the recording was performed;
A voting data generation method characterized by comprising: The voting data generation method according to claim 1, further comprising a step of erasing the time information. 3. The voting data generation according to claim 1, wherein in the step of sequentially recording, recording is performed so as to fill the interval area without providing an unrecorded interval area in the recording area of the electromagnetic recording medium. Method. In an electronic voting apparatus that generates voting data by recording the voting results of a plurality of electors on a single electromagnetic recording medium when voting by electronic voting,
Prior to the start of voting, file creation means for creating a plurality of files on the electromagnetic recording medium;
An identification code recording means for recording an identification code in the created file;
Informing means for informing the elector of information on the candidates for the election after the start of voting;
Input means for accepting a selection input operation of the candidate by the elector;
Temporary storage means for temporarily storing record data of candidates selected by the elector by the notification means and the input means;
A file selection means for selecting a file for recording the record from among the plurality of files when the elector confirms the record stored in the temporary storage means;
Writing means for sequentially writing the records stored in the temporary storage means for the selected file;
Writing means for writing time information at which the recording was performed;
An electronic voting apparatus comprising: 5. The electronic voting apparatus according to claim 4, further comprising means for deleting the time information. 6. The electronic voting according to claim 4, wherein the recording means for performing the sequential recording performs recording so as not to provide an unrecorded interval area in the recording area of the electromagnetic recording medium, but to fill the interval area. apparatus. In an electronic voting program for controlling an electronic voting apparatus that generates voting data by recording voting results of a plurality of electors on a single electromagnetic recording medium when voting by electronic voting,
Creating a plurality of files on the electromagnetic recording medium prior to starting voting;
Randomly selecting any of the files each time the voter voted;
Sequentially recording information of the storage means temporarily storing the vote result of the elector for the selected file;
Recording the time information at which the recording was performed;
An electronic voting program characterized by comprising: The electronic voting program according to claim 7, further comprising a step of deleting the time information. 9. The electronic voting program according to claim 7, wherein the sequential recording step performs recording so as to fill the interval area without providing an unrecorded interval area in a recording area of the electromagnetic recording medium. . In an electronic voting program for controlling an electronic voting apparatus that generates voting data by recording voting results of a plurality of electors on a single electromagnetic recording medium when voting by electronic voting,
A first step of creating a number N of files for storing the voting data in the electromagnetic recording medium before starting voting for all the electors;
A second step of assigning a file name including an index of 0 to N-1 to each of the files;
After the start of voting by the elector, the information on the candidate for the election is output to the notifying means for notifying the elector, and the record of the candidate selected and input by the elector is stored in the temporary storage means. A third step of accumulation;
A fourth step of generating a random number when the elector confirms the candidate record in the temporary storage means; and
A fifth step of calculating a remainder value K obtained by dividing the generated random number value by the number N of the files;
A sixth step of opening a file whose index included in the file name is K;
A seventh step of adding the candidate records stored in the temporary storage means to the data on the file without any gaps on the opened file; and
When the writing of the file is finished, an eighth step of closing the file;
A ninth step of correcting the time information of the closed file to a fixed value;
An electronic voting program characterized by comprising: 11. The electronic voting program according to claim 10, further comprising a loop process for continuing the processes of the third to ninth steps until voting by all the electors is completed.

Images