Chapter 6: General Core Requirements

Applies To: Voting system

Test Reference: Part 3: 4.3 “Verification of Design Requirements”, 4.5.2 “Security”

Source: New requirement

Applies To: Voting system

Test Reference: Part 3: 4.6 ”Logic Verification”

DISCUSSION

The key word in this requirement is "verifiably." If a voting system is designed in such a way that it cannot be shown to count votes correctly despite full access to its designs, source code, etc., then it does not satisfy this requirement.

Source: New requirement

Applies To: Voting system

Test Reference: Part 3: 4.2 “Physical Configuration Audit”

DISCUSSION

All voting systems must be capable of election definition, vote collection, counting and reporting. To accomplish this requires at least one EMS and at least one vote-capture device.

Source: Clarification of [VSS2002]

Applies To: Paper-based device

Test Reference: Part 3: 4.3 “Verification of Design Requirements”

DISCUSSION

See also Requirement Part 2:4.5.4.2-B.

Source: [VSS2002] I.3.2.4.2.1

Applies To: MMPB

Test Reference: Part 3: 4.3 “Verification of Design Requirements”

Source: [VSS2002] I.3.2.4.2.5

Applies To: Paper-based device

Test Reference: Part 3: 4.3 “Verification of Design Requirements”

DISCUSSION

Requirement Part 1: 6.1-F.B should be understood in the context of Requirement Part 1:7.5.3-A.18, Requirement Part 1: 7.7.3-A and Requirement Part 1: 7.7.3-B. The differing options in how to handle separable ballots mean that separate compartments might not be required.

Source: [VSS2002] I.3.2.4.2.6

Applies To: Vote-capture device Λ Programmed device

Test Reference: Part 3: 4.3 “Verification of Design Requirements”

DISCUSSION

Polls-closed could be broken down into pre-voting and post-voting states as in Part 1: 8.2 “Vote-Capture Device State Model (informative)” or further divided into separate states for not-yet-tested, testing, ready/not ready (broken), and reporting.

Source: Clarified from [VSS2002] I.2.5.1.c and I.3.2.4.3.1

Applies To: Precinct tabulator, Vote-capture device

Test Reference: Part 3: 4.3 “Verification of Design Requirements”

Source: [VSS2002] I.3.2.2.1 / [VVSG2005] I.4.1.2.1

Applies To: In-person voting, Absentee voting, Review-required ballots, Write-ins, Split precincts, Straight party voting, Cross-party endorsement, Ballot rotation, Primary elections, Closed primaries, Open primaries, Provisional-challenged ballots, Cumulative voting, N-of-M voting, Ranked order voting

Test Reference: Part 3: 4.2 “Physical Configuration Audit”

DISCUSSION

If the voting system requires that absentee ballots be counted manually, then it does not conform to the absentee voting class. However, it may conform to the review-required ballots class.

If the voting system requires the allocation of write-in votes to specific candidates to be performed manually, then it does not conform to the write-ins class. However, it may conform to the review-required ballots class.

If the voting system requires that provisional/challenged ballots be counted manually, then it does not conform to the provisional-challenged ballots class. However, it may conform to the review-required ballots class.

Source: Conformance ramifications of system/device relationship

Applies To: Voting device

Test Reference: Part 3: 5.3.2 “Critical values”

Source: Revised from [VSS2002] I.3.4.3 / [VVSG2005] I.4.3.3

Applies To: Voting system

Test Reference: Part 3: 4.3 “Verification of Design Requirements”

Source: [VSS2002] I.2.2.4.1.a / [VVSG2005] I.2.1.4.a

Applies To: Voting system

Test Reference: Part 3: 4.3 “Verification of Design Requirements”

Source: [VSS2002] I.2.2.4.1.e / [VVSG2005] I.2.1.4.e

Applies To: Voting system

Test Reference: Part 3: 4.6 “Logic Verification”

Source: Formalization of general requirements

Applies To: Voting system

Test Reference: Part 3: 5.3.4 “Accuracy”

DISCUSSION

For the definition of report total error rate, see Requirement Part 3: 5.3.4-B.
This benchmark is derived from the "maximum acceptable error rate" used as the lower test benchmark in [VVSG2005]. That benchmark was defined as a ballot position error rate of 2×10−6 (1 / 500 000).

Given that there is no "typical" ratio of votes to ballot positions with such diversity among the many jurisdictions, it is nevertheless necessary to base the benchmark on some rough estimates in order that it may be in the correct order of magnitude, albeit not optimal for every case. The rough estimates are as follows. In a presidential election, there will be approximately 20 contests with a vote for 1 on each ballot with an average of 4 candidates, including the write-in position, per contest. (Some states will have fewer contests and some more. A few contests, like President, would have 8–13 candidates; most have 3 candidates including the Write-in, and a few have 2 candidates.) The estimated ratio of votes to ballot positions is thus ¼.

For paper-based tabulators, this general requirement is elaborated in Part 1: 7.7.5 “Accuracy”.

Source: Generalized and clarified from [VSS2002] I.3.2.1 / [VVSG2005] I.4.1.1

Applies To: Paper-based device Λ Tabulator, EBM

Test Reference: Part 3: 5.3.5 “Misfeed rate”

DISCUSSION

Multiple feeds, misfeeds (jams), and rejections of ballots that meet all manufacturer specifications are all treated collectively as "misfeeds" for benchmarking purposes; i.e., only a single count is maintained.

Source: Merge of [VSS2002] I.3.2.5.1.4.b and I.3.2.5.2.c, reset benchmark

Applies To: Electronic device

Test Reference: Part 3: 3.1 “Inspection”

DISCUSSION

It is assumed that the AC power necessary to operate the voting system will be derived from the existing power distribution system of the facility housing the polling place. This single-phase power may be a leg of a 120/240 V single phase system, or a leg of a 120/208 V three-phase system, at a frequency of 60 Hz, according to the limits defined in [ANSI06], and premises wiring compliant with the [NFPA05], in particular its grounding requirements.

Source: [NFPA05]

Applies To: Electronic device

Test Reference: Part 3: 3.1 “Inspection”

DISCUSSION

Communications (upon closing of the poll) between the polling place and the central tabulator is expected to be provided exclusively by the landline network of the telephone service provider connected to the facility housing the polling place. The use of cell phone communications is specifically prohibited.

Source: New requirement

Applies To: Electronic device

Test Reference: Part 3: 5.1.1.2-A

DISCUSSION

The power distribution system of the polling place can be expected to be affected by several types of disturbances, ranging from very brief surges (microseconds) to longer durations (milliseconds) and ultimately the possibility of a long-term outage. These are addressed in the following requirements: A.1, A.2, A.3, and A.4.

NOTE: There are several scenarios of accidental conditions that can produce voltages far in excess of the deviations implied by [ANSI06] or [ITIC00], such as loss of a neutral conductor, commingling of distribution systems with low-voltage conductors (knocked down poles, falling tree limbs). Such an event will produce in the building massive failures of equipment other than voting systems, and be obvious to the officials conducting the polling. Hardware failure of the voting system can be expected. Fortunately, the occurrence of such events is quite rare, albeit not impossible, so that such a extreme stress should not be included in the EMC requirements nor in the regimen of national certification testing – provided that the failure mode would not result in a safety hazard.

Source: [ANSI06], [IEEE02a], [ITIC00]

Applies To: Electronic device

Test Reference: Part 3: 5.1.1.2-A.1

DISCUSSION

The so-called “Combination Wave” has been accepted by industry as representative of surges that might occur in low-voltage AC power systems and be imposed on connected loads.

Source: [IEEE02a]

Applies To: Electronic device

Test Reference: Part 3: 5.1.1.2-A.2

DISCUSSION

This test waveform, proposed by IEEE since 1980 [IEEE80] as a “Standard Waveform,” and more recently adopted by the IEC [ISO06c] represents common disturbances on AC power lines but it was not included in previous versions of the VVSG. It originates during disturbances of power flow within the building, an occurrence more frequent than lightning surges. It is less likely than the Combination Wave to produce hardware destruction, but high levels still can produce hardware failure.

The “Power Quality” literature [Grebe96] and some standards [IEEE91] also cite “Decaying Ring Waves” or “Damped Oscillatory Waves” with lower frequencies but lesser amplitudes typically associated with the switching of power-factor correction capacitors. These can be significant for surge-protective device survival and possibly disruption of the operation of switched-mode power supplies. However, inclusion of the Combination Wave, the Ring Wave, and the Swells in these immunity criteria should be sufficient to ensure immunity against these lower frequency and lower amplitude decaying ring waves.

Source: [IEEE02a]

Applies To: Electronic device

Test Reference: Part 3: 5.1.1.2-A.3

DISCUSSION

While the fast transients involved in this immunity requirement do not propagate very far and are not expected to travel from the energy supply provider, they can be induced within a facility if cable runs are exposed to switching disturbances in other load circuits. Unlike the preceding two disturbances that are deemed to represent possibly destructive surges, the Electrical Fast Transient (EFT) Burst has been developed to demonstrate equipment immunity to these non-destructive but disruptive transients. Their repetitive profile increases the probability that a disruption might occur when the logic circuits go through a transition. It is important to recognize that this test, which does not represent the actual environment, is one of interference immunity, not a test of withstanding energy stress.

Source: [IEEE02a]

Applies To: Electronic device

Test Reference: Part 3: 5.1.1.2-A.4

DISCUSSION

Because the VVSG stipulates a two-hour back up, generally implemented by a floating battery pack, sag immunity is inherently ensured. However, the floating battery, unless buffered by a switch-mode power supply with inherent cut-off in case of a large swell, might not ensure inherent immunity against swells (short duration system overvoltages). The Information Technology industry has adopted a recommendation that IT equipment should be capable to operate correctly for swells reaching 120 % of the nominal system voltage with duration ranging from 3 ms to 0.5 s and permanent overvoltages up to 110 % of nominal system voltage.

Source: [ITIC00]

Applies To: Electronic device

Test Reference: Part 3: 5.1.1.2-B

DISCUSSION

Voting equipment, by being connected to the outside service provider via premises wiring, can be exposed to a variety of electromagnetic disturbances. These have been classified as lightning-induced, power-fault induced, power contact, Electrical Fast Transient (EFT), and presence of steady-state induced voltage. Within a complex voting system installed in a polling place, there is also a possibility that the various pieces of equipment can be exposed to emissions from other piece of connected equipment. In the context of the VVSG compatibility, not only must the voting system equipment be immune to these disturbances, but also the public switched telephone network must be protected against harm originating from customer premises equipment, in this context the voting system equipment. Protection of the network is discussed in the Part 1: 6.3.5 “Electromagnetic Compatibility (EMC) emission limits”. Immunity to disturbances impinging on the voting system telephone port is addressed in the following requirements: B.1, B.2, B.3, B.4, B.5, and B.6.

Source: [Telcordia06]

Applies To: Electronic device

Test Reference: Part 3: 5.1.1.2-B.1

DISCUSSION

This requirement is an issue of inherent compatibility among the diverse elements of a voting system, not compatibility with the polling place environment or subscriber equipment other than those making up the voting system. It is understood and implemented that security requirements dictate that the voting system outgoing communications be provided by a dedicated landline telephone service excluding other subscriber terminal equipment otherwise used by entities occupying the facility when telephone communication with central tabulators is established.

Source: [Telcordia06], [ANSI02]

Applies To: Electronic device

Test Reference: Part 3: 5.1.1.2-B.2

DISCUSSION

Lightning events (direct flashes to the network or voltages induced in the network by nearby flashes to earth) can be at the origin of voltage surges or current surges impinging upon the interface of the premises wiring with the landline network. The provision of surge protection in the Network Interface Device (primary protection NID) is not universally provided, especially in dense urban locations, therefore the immunity level of the telephone port should be demonstrated as required by the Telcordia Generic Requirements.

Source: [Telcordia06]

Applies To: Electronic device

Test Reference: Part 3: 5.1.1.2-B.3

DISCUSSION

For overhead telephone landline cables that share the pole with power distribution cables (medium-voltage as well as low-voltage), as well as direct burial of adjacent telephone and power cables, large power system faults can induce significant voltages and the resulting currents in the telephone network.

Source: [Telcordia06]

Applies To: Electronic device

Test Reference: Part 3: 5.1.1.2-B.4

DISCUSSION

Outside of the polling place building, accidental contact between the telephone network cables and power distribution cables (sharing poles for overhead, or sharing trenches for underground) can inject substantial 60 Hz current and voltages into the telephone network. Within the polling place facility, while not at high probability, instances have been noted whereby contractors working in a facility can provoke a similar injection of 60 Hz current or voltage into the premises telephone wiring. The 600 V level cited in the above requirement is associated with an accidental contact with primary power lines, promptly cleared by the power system protection, while the 277 V level is associated with an accidental contact with low-voltage distribution system that might not be cleared by the power system protection.

Source: [Telcordia06]

Applies To: Electronic device

Test Reference: Part 3: 5.1.1.2-B.5

DISCUSSION

Electrical Fast Transient bursts emulate the interference associated with electromagnetic coupling between the premises wiring of the telephone service and the premises wiring of the power distribution system in which switching surges can occur. Because these switching surges are random events, the occurrence of interference varies with the timing of their occurrence with respect to the transitions of the circuits. It is important to recognize that this requirement deals with interference immunity, not with withstanding energy stress. Immunity against such high-frequency coupling has been added to the requirements listed by [Telcordia06], effective January 1, 2008.

Source: [Telcordia06], [ISO04b]

Applies To: Electronic device

Test Reference: Part 3: 5.1.1.2-B.6

DISCUSSION

Voting systems interfacing with the telephone service provider plant can be subject to the interfering effects of steady-state voltages induced from nearby power lines. Through electromagnetic coupling, normal operating currents on these power lines can induce common-mode (longitudinal) voltages and currents in the outside cable plant. The 60 Hz and 180 Hz components of the induced voltage spectrum can interfere with signaling and supervisory functions for data transmission from a polling place toward a central tabulator. Higher frequencies can produce audible noise in voice-band transmission.

Source: [Telcordia06]

Applies To: Electronic device

Test Reference: Part 3: 5.1.1.2-C

DISCUSSION

A voting system that is powered via its power port to the power distribution system of the facility and to the telephone service provider via its telephone port can experience a potentially damaging stress between the two ports during the expected operation of the telephone network interface device in the event of a surge occurring in the telephone system. Because the level of potential differences during a surge event is principally the result of the local configuration of the premises wiring and grounding systems, and thus beyond the control of the local polling entity, inherent immunity of the voting system can be achieved by incorporating a surge reference equalizer that provides the necessary bonding between the input power port and telephone port during a surge event.

Source: [IEEE02], [IEEE05]

Applies To: Electronic device

Test Reference: Part 3: 5.1.1.3-A

DISCUSSION

The proliferation of portable transmitters (cellular telephones and personal communications systems) used by the general population and the common communications transmitters used by security, public safety, amateur radio, and other services increases the likelihood that the voting equipment covered in the VVSG will be exposed to the radiated electromagnetic fields from these devices. Also, other wireless devices (wireless local area networks, etc.), communications and broadcast transmitters may be operating in the vicinity and need to be considered. Since it may be impractical to eliminate nearby radio-frequency sources, voting systems must demonstrate immunity to these signals in order to operate to a high standard of reliability. This requirement is intended to ensure intrinsic immunity to the electromagnetic environment.

Source: [ANSI97], [ISO06a], [ISO06d]

Applies To: Electronic device

Test Reference: Part 3: 5.1.1.3-B

DISCUSSION

The dominant coupling mechanism of radiated electromagnetic fields to equipment electronics at frequencies below 80 MHz is considered to be through currents induced on interconnecting cables. At these frequencies, the wavelengths are such that typical circuit components are electrically very small and thus inefficient in coupling energy directly from the radiated electromagnetic fields. The interconnecting cables, on the other hand, tend to be on the order of the signal wavelengths and may act as efficient and possibly resonant antennas. Thus, the radiated electromagnetic fields will efficiently induce currents on these cables that are connected directly to the equipment electronics.

Source: [ANSI97], [ISO06b]

Applies To: Electronic device

Test Reference: Part 3: 5.1.1.3-C

DISCUSSION

Electrostatic discharge events can originate from direct contact between an “intruder” (person or object) charged at a potential different from that of the units of the voting system, or from an approaching person about to touch the equipment – an “air discharge.” The resulting discharge current can induce disturbances in the circuits of the equipment.

Note: The immunity addressed in this section is concerned with normal operations and procedures at the polling place. It does not include immunity to electrostatic discharges that might occur when service personnel open the enclosure and handle internal components.

Source: [ANSI93], [ISO01]

Applies To: Electronic device

Test Reference: Part 3: 5.1.2.1 “Conducted emissions limits”

DISCUSSION

The normal operation of an electronic system can produce disturbances that will travel upstream an affect the power supply system of the polling place, creating a potential deviation from the expected electromagnetic compatibility of the system. The issue is whether these actual disturbances (after possible mitigation means incorporated in the equipment) reach a significant level to exceed stipulated limits, which include the following categories:

1. Harmonic emissions associated with the load current drawn by the voting system. However, given the low values of the current drawn by the voting system, these emissions do not represent a significant issue, as explained in [IEEE92]. They are only mentioned here for the sake of completeness in reciting the range of disturbances and therefore do not require testing.
2. High-frequency conducted emissions (distinct from the harmonic spectrum) into the power cord by coupling from high-frequency switching or data transmission inherent to the system operation. These are addressed in the mandatory certification requirements of [FCC07], Class B.

Source: [IEEE92], [FCC07]

Applies To: Electronic device

Test Reference: Part 3: 5.1.2.1-A

DISCUSSION

Regulatory emission limits requirements for protecting the network (public switched telephone network) from harm via customer premises equipment are contained in the source documents [Telcordia06], [ANSI02], [FCC07a] and compliance to these documents is considered mandatory for offering the equipment on the market.

Source: [Telcordia06], [ANSI02], [FCC07a]

Applies To: Electronic device

Test Reference: Part 3: 5.1.3.2-A

DISCUSSION

Excessive leakage current is objectionable for two reasons:

1. For a branch circuit or wall receptacle that could be provided with a GFCI (depending upon the wiring practice applied at the particular polling place), leakage current above the GFCI built-in trip point would cause the GFCI to trip and therefore disable the operation of the system.
2. Should the power cord lose the connection to the equipment grounding conductor of the receptacle, a personnel hazard would occur. (Note the prohibition of “cheater” adapters in the discussion of general requirements for the polling place.)

This requirement is related to safety considerations as discussed in Part 1: 3.2.8.2 “Safety” – in particular the requirement to have the voting system comply with [UL05].

Note: According to [NFPA05], a bond between the equipment grounding conductor and the neutral conductor is prohibited downstream from the entrance service panel. GFCIs are designed to trip if such a prohibited bond is detected by the GFCI.

Source: [UL06], [NFPA05]

Applies To: Electronic device

Test Reference: Part 3: 5.1.2.2-A

DISCUSSION

Electronic equipment in general and modern high-speed digital electronic circuits in particular have the potential to produce unintentional radiated and conducted radio-frequency emissions over wide frequency ranges. These unintentional signals can interfere with the normal operation of other equipment, especially radio receivers, in close proximity. The requirements of [FCC07] and [ANSI06a] are intended to minimize this possible interference and control the level of unwanted radio-frequency signals in the environment.

Source: [FCC07]

Applies To: Electronic device

Test Reference: Part 3:5.1.3.1-A

DISCUSSION

Dielectric withstand requirements stipulated by industry-consensus telephone requirements as a condition for connecting equipment to their network involve the insulation and leakage current limits between elements of the voting system hardware, including the following:

1. Network and device or accessible circuitry which might in turn connect to the user;
2. Network and hazardous power system; and
3. Power equipment.

Source: [Telcordia06]

Applies To: Programmed device

Test Reference: Part 3: 4.5.1 “Workmanship”

DISCUSSION

The intent of this requirement is clarified in Part 1: 6.4.1.5 “Structured programming” with discussion and examples of specific programming languages.

By excluding border logic, this requirement allows the use of assembly language for hardware-related segments, such as device controllers and handler programs. It also allows the use of an externally-imposed language for interacting with an Application Program Interface (API) or database query engine. However, the special code should be insulated from the bulk of the code, e.g. by wrapping it in callable units expressed in the prevailing language, to minimize the number of places that special code appears. C.f. [MIRA04] Rule 2.1: "Assembly language shall be encapsulated and isolated."

Acceptable programming languages are also constrained by Requirement Part 1: 6.4.1.7-A.3 and Requirement Part 1: 6.4.1.7-A.4, which effectively prohibit the invention of new languages.

Source: [VVSG2005] I.5.2.1, I.5.2.4 and II.5.4.1

Test Reference: Part 3: 4.5.1 “Workmanship”

DISCUSSION

For example, C99 [ISO99] does not support block-structured exception handling, but the construct can be retrofitted using (e.g.) [Sourceforge00] or another COTS package.

The use of non-COTS extension packages or manufacturer-specific code for this purpose is not acceptable, as it would place an unreasonable burden on the test lab to verify the soundness of an unproven extension (effectively a new programming language). The package must have a proven track record of performance supporting the assertion that it would be stable and suitable for use in voting systems, just as the compiler or interpreter for the base programming language must.

Source: Tightening of [VVSG2005] I.5.2.4 and II.5.4.1

Applies To: Programmed device

Test Reference: Part 3: 4.5.1 “Workmanship”

DISCUSSION

Coding conventions that are excessively specialized or simply inadequate may be rejected on the grounds that they do not enhance one or more of workmanship, security, integrity, testability, and maintainability.

See the discussion for Requirement Part 1: 6.4.1.2-A regarding border logic.

Source: Rewrite of [VSS2002] I.4.2.6

Test Reference: Part 3: 4.5.1 “Workmanship”

DISCUSSION

This requirement attempts to clarify the "published, reviewed, and industry-accepted" language appearing in previous iterations of the VVSG, but the intent of the requirement is unchanged.
Following are examples of published coding conventions (links valid as of 2007-02). These are only examples and are not necessarily the best available for the purpose.

1. Ada: Christine Ausnit-Hood, Kent A. Johnson, Robert G. Pettit, IV, and Steven B. Opdahl, Eds., Ada 95 Quality and Style, Lecture Notes in Computer Science #1344, Springer-Verlag, 1995-06. Content available at http://www.iste.uni-stuttgart.de/ps/ada-doc/style_guide/cover.html and elsewhere.
2. C++: Mats Henricson and Erik Nyquist, Industrial Strength C++, Prentice-Hall, 1997. Content available at http://hem.passagen.se/erinyq/industrial/.
3. C#: "Design Guidelines for Class Library Developers," Microsoft. http://www.msdn.microsoft.com/library/default.asp?url=/library/en-us/cpgenref/html/cpconnetframeworkdesignguidelines.asp.
4. Java: "Code Conventions for the Java™ Programming Language," Sun Microsystems. http://java.sun.com/docs/codeconv/.

Source: Clarification of [VSS2002] I.4.2.6

Test Reference: Part 3: 4.5.1 “Workmanship”

DISCUSSION

This requirement attempts to clarify the "published, reviewed, and industry-accepted" language appearing in previous iterations of the VVSG, but the intent of the requirement is unchanged.

Coding conventions evolve, and it is desirable for voting systems to be aligned with modern practices. If the "three year rule" was satisfied at the time that a system was first submitted for testing, it is considered satisfied for the purpose of subsequent reassessments of that system. However, new systems must meet the three year rule as of the time that they are first submitted for testing, even if they reuse parts of older systems.

Source: Clarification of [VSS2002] I.4.2.6

Applies To: Programmed device

Test Reference: Part 3: 4.5.1 “Workmanship”

DISCUSSION

See module. The modularity rules described here apply to the component submodules of a library.

Source: Extracted and revised from [VSS2002] I.4.2.3

Test Reference: Part 3: 4.5.1 “Workmanship”

DISCUSSION

In practice, some additional modules (such as library modules) may be needed to compile the module under test, but the modular construction allows the supporting modules to be replaced by special test versions that support test objectives.

Source: Extracted and revised from [VSS2002] I.4.2.3.a

Test Reference: Part 3: 4.5.1 “Workmanship”

Source: Revision of [VSS2002] II.5.4.2.i, as revised by Section 6.6.4.2, Paragraph i of [P1583] and subsequent issues^[5]

Test Reference: Part 3: 4.5.1 “Workmanship”

DISCUSSION

"Lines," in this context, are defined as executable statements or flow control statements with suitable formatting.

Source: Revision of [VSS2002] II.5.4.2.i, as revised by Section 6.6.4.2, Paragraph i of [P1583]^[5]

Applies To: Programmed device

Test Reference: Part 3: 4.5.1 “Workmanship”

DISCUSSION

See Part 1: 6.4.1.5 “Structured programming”.

Source: Extension of [VVSG2005] requirements for structured programming

Test Reference: Part 3: 4.5.1 “Workmanship”

DISCUSSION

For example, if an application written in C99 [ISO99] + cexcept [Sourceforge00] used the malloc function of libc, which returns a null pointer in case of failure instead of throwing an exception, the malloc function would need to be wrapped. Here is one possible implementation:

void *checkedMalloc (size_t size) {

	void *ptr = malloc (size);

	if (!ptr)

		Throw bad_alloc;

	return ptr;

}

#define malloc checkedMalloc

Wrapping legacy functions avoids the need to check for errors after every invocation, which both obfuscates the application logic and creates a high likelihood that some or many possible errors will not be checked for. In C++, it would be preferable to use one of the newer mechanisms that already throw exceptions on failure and avoi