Systems

Why V&V Never Ends — A Structural Reason Drawn from Form-Is-Emptiness

読了 約 27 分
15

日本語で読む

// For readers from philosophyThe différance, wasan, and pure-experience discussion of Part I connects to the systems-design floor. Watch how “externalizing the judging subject” turns out to be an engineering necessity too.
// For SEs, PMs, engineersWhy V&V never ends, explained via Gödel and the Heart Sutra. You can follow this without Part I, but you’ll enjoy it 256× more if you read it.
// The claim of this articleV&V does not end — not because engineers are incompetent.
Not because effort is short, not because test cases are missing.It cannot end in principle. And the reason has been known for 2,500 years.

In Part I we saw that form-is-emptiness, différance, process philosophy, and pure experience converge to one and the same structure under the constraint of cognition-of-difference + symbolization. We further located différance as a Leibnizian operator and form-is-emptiness as the difference operation of wasan.

Now we connect that logic to V&V in systems engineering. The conclusion at the other end is one that — both as engineering and as philosophy — probably requires some resolve.

§1　What is V&V actually doing? — reading it as difference and summation

By the standard definitions of systems engineering (ISO/IEC/IEEE 15288 and the like):

Verification: “Is it built to the requirements?” — conformance to specification
Validation: “Does it serve the intended use and purpose?” — conformance to stakeholder needs

The intuition that “Verification and Validation correspond to necessary and sufficient conditions” is right. But the correspondence is not exact. Put in the language of Part I:

// Seen from the philosophy sideVerification is the “form is emptiness” direction — taking the difference from a concrete implementation (form) toward an abstract specification (emptiness). It corresponds to the wasan difference operator Δ.

Validation is the “emptiness is form” direction — restoring an implementation (form) from abstract requirements (emptiness) and checking alignment with purpose. It corresponds to the wasan summation Σ.

// Seen from the engineering sideVerification is testing — matching the spec against the implementation. Validation is review and user testing — checking “can this really be used?” Everyone does both as a matter of course. So why does it never end?

§2　The ghost named “arbitrary constant C”

As Part I showed, a summation (Σ, emptiness-is-form, Validation) always produces an arbitrary constant.

Σ(emptinessk) = formn + C

What does this C mean?

// What C really isC is “which interpretation of the requirement you choose.”
When you restore an implementation (form) from a requirement written in the spec (emptiness), the interpretation is not uniquely determined.
From a requirement like “ensure security,” which level of encryption you implement is a choice of C.Who decides this C — that is the essential problem of V&V.
// Engineers will recognize thisThe situation where “the requirements are met (Verification OK) but something is off (Validation NG).” That is a mistaken choice of C. When you restored the implementation (form) from the spec (emptiness), you implicitly chose the wrong C.

§3　What happens if you try to close V&V as an axiomatic system?

I tried to rebuild V&V by replacing it with necessary and sufficient conditions and constructing an axiomatic system — and I couldn’t. To make them necessary and sufficient conditions you have to exclude subjectivity and make it objective, but I realized you cannot exclude the in-principle impossibility that arises from subjectivity and from element-wise reduction. So I reached the conclusion that it can only ever be a V&V that internalizes the judging subject.
This is a very important epistemological landing point.

I tried to close V&V formally — to build an inference system V&V ⊢ correctness of the system. It collapsed for two reasons.

Reason ① The demand for objectivity cannot be met

Necessary and sufficient conditions require an observer-independent evaluative axis. But specifications are written in natural language, and their interpretation depends on the judging subject. The very criterion for “meets the requirement” rests on stakeholder intent (emptiness) and cannot be fully formalized. Subjectivity also enters the selection of test items and the judgment of coverage.

// How the philosophy side puts itIn the language of Part I: “meaning can arise only from context (a series of changes over a domain).” The meaning of the evaluative criterion (emptiness) likewise changes with the context (the phase) that interprets it. Change the phase and the same spec means something different — so objectivity cannot be guaranteed.

Reason ② The in-principle impossibility of element-wise reduction

When you split a system into subsystems to do Verification, setting the partition boundary itself involves judgment. And the emergent behavior at integration cannot be predicted from the Verification of the parts — non-additivity.

// Enter GödelThe consistency of a sufficiently complex system cannot be proved from inside that system.
— Gödel’s second incompleteness theorem (1931)

Assume an axiomatic system A that fully formalizes V&V; to prove the consistency of A you need a stronger system A′. This regress does not stop.Only the decision of a judging subject stops it.

// Shop-floor translationYou think “I’ve squashed every bug,” and a new one appears. You “passed every test,” and a problem surfaces after release. This is not a story about bugs or tests — it is the in-principle limit that a system’s completeness cannot be proved from inside the system.

§4　What does “a V&V that internalizes the judging subject” mean?

If it cannot close as a formal axiomatic system, what then? The answer is “a V&V that internalizes the judging subject.” Written formally:

V&V(S, judging subject, context) ⊢ a provisional confirmation of correctness

There are three variables: the system S, the judging subject, and the context.

“Provisional” is the key word.
Change the context and the judgment is updated. This is différantial — isomorphic to the structure in which meaning is forever deferred. V&V is not something that completes in one shot; it keeps running as a dissipative process, updated as the context changes.

“Dissipative process” sounds technical, but it is essentially a bicycle. Stop pedaling and it falls; keep pedaling and it stays upright and moves straight. V&V likewise holds its “correctness” only by being kept running — it is not the kind of thing you can stop and declare “finished.”

// How the philosophy side puts itThis is not a “defeat” of V&V but a more honest formulation. Trying to close it formally pushes the judging subject outside — “who performs the Verification” stops being asked. But real V&V is always executed under the responsibility of a judging subject. Internalizing that subject makes the responsibility visible.
// How the engineering side puts itPassing tests and clearing reviews is not “OK” but “provisionally OK.” Change the context (operating environment, usage conditions, how users use it) and re-verification is needed. That is not a process failure — it is the true shape of V&V.

§5　Therefore, the need to decide goes “outside”

Therefore, the necessity of deciding goes outside.
Yes. This is derived naturally as the logical consequence of the whole dialogue.

A V&V that internalizes the judging subject can include that subject itself among the objects of verification. But a system in which the judging subject verifies itself becomes self-referential and falls into a Gödel-isomorphic infinite regress.

/* Structure of the infinite regress */
Judging subject A verifies system S
  ↓
Who verifies the validity of A's verifying S?
  ↓
A judging subject A′ is required
  ↓
Who verifies the validity of A′?
  ↓
...infinite regress...
  ↓
// Only "a decision from outside" stops this regress

“Going outside” has three senses.

① The logical outside — a meta-level instance

Outside the axiomatic system. The authority that approves the system’s specification, the stakeholders who define the requirements, the higher decision-maker. Each sits outside the system being verified.

② The temporal outside — a future judgment

Outside the present context. The act of “deciding here and now” steps outside the system as a single point on the time axis. V&V does not end — it is cut off here and now.

③ The outside of responsibility — an ethical decision

Outside logic. To render judgment in a domain that cannot be formally proved becomes a matter not of logic but of responsibility.

// It’s all the same structureOnce a system becomes sufficiently complex, it cannot close from inside itself; only when the decision goes outside does it stand up as a system at all.
Context Inside the system What goes outside
Heart Sutra The system of language and concepts Awakening · silence
Différance (Derrida) The chain of signs Undecidability
Gödel A formal axiomatic system The proof of consistency
Dissipative structure The boundary of system and environment The very process that generates the boundary
V&V The verify–validate loop The judging subject’s decision
System partition Consistency of subsystems The integration judgment · architecture decision
// How the philosophy side puts itThis is isomorphic to the Heart Sutra’s “awakening” going outside the linguistic system. The V&V loop cannot have “the correct system” as a terminus for the same reason différance cannot have “the correct meaning” as a terminus.
// How the engineering side puts itThis is the structural ground of leadership in systems engineering. “Someone has to decide” is neither a pep talk nor a rule of thumb. Without a decision from outside the system, the system cannot stand up in principle — it’s that kind of mathematical fact.

§6　Cut the line, by deciding — usually, up front

Here, let me address a discomfort from the systems-engineering trade. “V&V never ends” runs against the floor’s experience — because in practice V&V does end. What ends it is the judging subject’s decision to “cut the line here.”

To be precise, V&V does not close formally or automatically (as the prior sections showed, a Gödel-isomorphic structure blocks a complete proof). But you can — and must — decide the cut (where to stop). Completion criteria, acceptance criteria, scope, schedule — these are the cut, and they are objects the judging subject decides. They are a third object of decision, after the scale Λ and the arbitrary constant C.

And in many cases, the cut is decided at the very start of the project. Defining exit / acceptance criteria up front in the planning phase is the act of settling, before you begin, “what we need to be able to say once it’s done.” So it is not that V&V “never ends” — it ends at a cut decided in advance.

// For SEs and PMsOn the floor, V&V ends. What ends it is your decision to “cut the line here.” The “never ends” of this article means “does not close formally or automatically,” not that the responsibility to decide the cut disappears. Quite the opposite — settling the completion criteria up front and taking them on is the core of the architect’s / PM’s job.

But that cut, too, is provisional (différantial). Change the context — requirements, usage, operating environment — and the cut is redrawn. Settling it up front and redrawing it as conditions move are not contradictory. You settle it so you can move; you move and redraw as you go.

V&V never ends. What ends it is your decision.

// Wrap-up: what to take home

  • Verification can be located as the difference operation Δ (form is emptiness; necessary condition), Validation as the summation Σ (emptiness is form; close to a sufficient condition)
  • The summation’s arbitrary constant C is the mathematical expression of the judging subject’s decision — the restoration from emptiness to form is not unique
  • V&V cannot be closed as a formal axiomatic system — a structure isomorphic to Gödel’s second incompleteness theorem blocks it
  • Therefore V&V internalizes the judging subject and functions as “a provisional confirmation of correctness”
  • What stops the infinite regress of judging subjects is a decision from outside the system — this is the structural ground of leadership
  • This “decision from outside” is not logic; it is taken on as responsibility
  • “Never ends” means does not close formally or automatically. Deciding the cut (completion / acceptance criteria) and ending it is the judging subject’s job, usually decided at the start of the project — and redrawable, provisionally (différantially)

→ The concluding Part III · Scale: Scale as a Degree of Freedom — Whitehead, the renormalization group, and V&V. The judging subject decides more than the arbitrary constant C — we discuss the choice of “scale itself,” which lies just before it.

The three pieces in this series are based on a 16 April 2026 dialogue between Massy and Claude (Anthropic) (CC BY 4.0). Read it together with Part I · Philosophy How to Enjoy ‘Form Is Emptiness’ 256× More. For a more rigorous formalization, see the preprint series.