Partial-Specifiedness-Aware Well-Behavedness

• Partial-Specifiedness-Aware Well-Behavedness is a framework that defines system correctness under incomplete specifications using structured meta-properties.
• It leverages methods like Partial Quantifier Elimination and partial-state lenses to identify unwanted and missing behaviors in hardware designs and communication protocols.
• The approach ensures modular verification by focusing on localized specification guarantees, promoting scalable test generation and compositional reasoning.

Partial-Specifiedness-Aware Well-Behavedness refers to a family of formal methodologies and meta-properties which recognize and explicitly reason about the ramifications of incomplete behavioral or semantic specifications. Rather than requiring total completeness from specifications, these approaches provide meaningful guarantees of “well-behavedness” or correctness, targeted only at the portions of a system, state space, or participant set for which information is available or intent is declared. The development of partial-specifiedness-aware frameworks has had significant impact in areas including circuit verification, multiparty communication protocols, and bidirectional state transformation, each developing sophisticated notions of “well-behavedness” tailored for partial information and local projection.

1. Motivation and Scope

The notion of partial-specifiedness arises when a system’s specification (Spec) fails to constrain all possible behaviors of an implementation (Impl), either due to engineering trade-offs, modularity, evolving requirements, or inherent undecidability. Such scenarios lead to two primary verification/consistency problems:

• Unwanted Properties: Impl exhibits behaviors that are not prohibited by Spec, but which violate designer intention.
• Missing Desired Properties: Impl omits behaviors that were implicitly intended, but not captured in Spec.

Partial-specifiedness-aware well-behavedness frameworks systematically characterize and algorithmically explore the space of permitted, forbidden, under-specified, and over-specified behaviors, and articulate what it means for a system to be "well-behaved" relative to incomplete or localized requirements (Goldberg, 2020).

The paradigm is realized across a range of domains, including:

• Verification of hardware under incomplete specification (Goldberg, 2020)
• Compositional bidirectional synchronization (partial-state lenses) (Matsuda et al., 8 Jan 2026)
• Asynchronous protocol analysis with partial participant typing (Barbanera et al., 2024)

2. Formalization in Circuit Verification

Partial-specifiedness-aware well-behavedness in hardware design verification is defined with respect to a (possibly incomplete) specification Spec and an implementation Impl:

• Unwanted property: A predicate $Q(X,Z)$ such that $Impl \vDash Q$ and $Spec \wedge \neg Q$ is satisfiable; i.e., Q is allowed by Spec but uniquely realized by Impl (can indicate a bug).
• Missing desired property: A predicate $R(X,Z)$ such that $Impl \not\models R$, $Impl \wedge \neg R$ is satisfiable, and $Spec \wedge R$ is satisfiable; i.e., R is a behavior that Spec permits, but Impl fails to realize—potentially a missing feature (Goldberg, 2020).

An implementation enjoys partial-specifiedness-aware well-behavedness if:

1. No unwanted $Q$ exists (all realized Q are entailed by Spec), and
2. No missing desired $R$ exists (all permissive R in Spec are realized by Impl) (Goldberg, 2020).

Partial Quantifier Elimination (PQE) serves as a foundational tool for systematically identifying both unwanted and missing desired properties. PQE allows elimination of small subformulas from the scope of quantification, facilitating scalable extraction of local properties and counterexamples without incurring intractable full quantifier elimination.

By iterating over circuit substructures (e.g., gates), PQE can generate a structurally complete set of properties revealing precisely where partial specification leaves exposed or untested implementation behavior. This approach has demonstrated efficacy on combinational and sequential circuits of practical scale, outperforming classical stuck-at ATPG for structurally nuanced bugs (Goldberg, 2020).

3. Partial-Specifiedness-Aware Lenses and State-Based Well-Behavedness

The theory of lenses for partially-specified states generalizes classical bidirectional transformations to domains equipped with a notion of “specifiedness.” Central to this theory is the use of i-posets—domains $(S, \leq_P, I_P)$ where states are partially ordered by how much they specify, and $I_P$ marks no-change transitions (Matsuda et al., 8 Jan 2026).

A partial-state lens ($\mathsf{ps}$-lens) between i-posets $P, Q$ is a pair of functions (get/put) compatible with partial specification. Three laws capture partial-specifiedness-aware well-behavedness:

• ps-Consistency (C): User intentions (partial views) are preserved when pushed back.
• ps-Acceptability (A): Pushing back a view identical to the current extract produces no change.
• ps-Stability (S): Once a round-trip is realized, pushing an identical update in a more specified context cannot regress the state (Matsuda et al., 8 Jan 2026).

This framework supports merging of partially specified edits (via domain-specific $\oplus$ operators) and is compositional: composite lenses preserve the (C), (A), (S) laws.

The theory extends classical lenses (for discrete state sets) as a strict generalization, and is applicable to complex data integration problems where updates are partial and intent preservation under concurrency or parallel editing is vital. Explicit construction of i-posets and $\oplus$ is necessary for each domain, and merge failure can signal unresolvable conflicts (Matsuda et al., 8 Jan 2026).

4. Partial Typing and Local Well-Behavedness in Multiparty Protocols

For communicating systems, partial-specifiedness-aware well-behavedness arises in the context of partial typing for asynchronous multiparty sessions. Here, the specification is an asynchronous global type $G$ whose partial projection $G{\downarrow}P$ concerns only a monitored subset $P$ of participants (Barbanera et al., 2024).

The partial typing system provides compositional rules for assigning a partial type to a configuration restricted to $P$, yielding the following meta-properties:

• $P$-lock-freedom: No participant in $P$ can be permanently blocked due to its local protocol.
• $P$-orphan-message-freedom: No message between $P$-participants may remain unconsumed indefinitely.

These properties and their type-theoretic preservation (subject reduction, type soundness) anchor the methodology, allowing rigorous reasoning about protocol correctness and deadlock/orphan-freedom without reasoning about the entire system. This supports modular verification, system decomposition, and the independent evolution of subsystems (Barbanera et al., 2024).

5. Algorithms, Scalability, and Structural Completeness

Circuit Setting

PQE-based methods for partial-specifiedness-aware property discovery operate by:

1. Local extraction: For each small subformula $G$ of an implementation circuit $F$, PQE generates properties $Q$ or, via “perturbed” $G^*$, candidate missing properties.
2. Bug or omission detection: Each $Q$ is tested for unwantedness (is $Q$ consistent with Impl but not implied by Spec?) or falsity (does Impl violate $Q$ but Spec permits $Q$?) via SAT solving.
3. Test generation: Counterexamples to false properties are input patterns breaking untested behaviors, driving high-quality test generation (Goldberg, 2020).

This approach is tractable: cost scales with the size of $G$ (a gate or gate cluster), enabling structural completeness since every local substructure can be analyzed in isolation. For sequential circuits, complexity grows linearly with unroll depth and subcircuit size.

Lens and Multiparty Protocol Settings

For partial-state lenses, composition and merge operations are constructed to guarantee scalability and locality of reasoning, avoiding global state enumeration. For multiparty protocols, the partial projection and partial typing are algorithmically defined via inductive and coinductive rules over bounded global types and finite paths.

6. Illustrative Examples and Case Studies

• Circuit Verification: Using a 2-input OR gate, unwanted properties like $(x_1 \wedge x_2) \to z$ are identified when Spec incompletely prohibits certain outputs (Goldberg, 2020).
• Partially-Specified Lenses: To-do management applications with deletions and concurrent edits are modeled, with duplication lenses and filters showing preservation of partial user intentions and intent-merge compositionality (Matsuda et al., 8 Jan 2026).
• Partial Session Typing: In a distributed social-media example, partial projection extracts user-to-user protocols, omitting server messages, yet ensures lock- and orphan-freedom for user interactions (Barbanera et al., 2024).

These examples demonstrate the breadth and flexibility of partial-specifiedness-aware frameworks and their connection to practical verification and synchronization problems.

7. Limitations and Future Directions

The principal limitations are domain-specific: partial-specifiedness frameworks require explicit construction of partial orders, merge operators, and projection schemes tailored to each datatype or system architecture. Merge operations are inherently partial—conflicting or intersecting updates may cause “put” to fail (for lenses), and complex datatypes (e.g., nested lists) demand nontrivial ordering and duplication operations (Matsuda et al., 8 Jan 2026).

Future work encompasses development of libraries of standard partial-specifiedness-aware artifacts (stateful structures, lenses), front-end tool support, automated extraction of i-poset structures, and exploration of stronger/weaker well-behavedness variants, including harmonization with “silent conflict resolution” schemes from CRDT literature (Matsuda et al., 8 Jan 2026).

Overall, partial-specifiedness-aware well-behavedness provides a unifying conceptual and algorithmic toolkit for modular reasoning, compositional verification, and scalable update propagation in systems with incomplete, evolving, or projected specifications (Goldberg, 2020, Matsuda et al., 8 Jan 2026, Barbanera et al., 2024).