Comment by Kevin Wilson (Voting System Test Laboratory)

The domain of discourse and consequently core logic does not appear to include the concept of "ballot generation", but only of voting. Consider the case when a ballot is erroneously generated with the same candidate appearing twice in the virtual list of candidates. This is Candidate A and Candidate B who are actually the same person, but due to a ballot generation error appear virtually to be different but not different enough that both are displayed during voting. In the voting portion of the software, the Candidate A appears to the voter, but when counting votes Candidate B is counted. In this situation Candidate A would not appear to have received any votes. Therefore ballot generation errors can cause undetermined errors in core logic regardless of the attempted proof given in 1-8.3. Although this situtation is unlikely in IVVR systems, it is otherwise still possible. In the case of a VVPAT system this error is observable by audit but could still occur if the "image" of the ballot that the counting system has is erroneous compared to the "image" of the ballot that indicates voter intent. Is ballot generation part of "core logic" or could the document specify more clearly that ballot generation "impacts" the "domain of discourse" Furthermore "core logic" as defined in Appendix A does not include ballot generation, but only voting and tabulation.