Trace Refinement Relations Explained

Updated 5 March 2026

Trace refinement relations are formal tools that generalize trace inclusion by relating execution traces of two systems through arbitrary relations.
They provide a flexible semantic framework used in compiler correctness, concurrency, process calculi, and secure compilation by preserving and transforming trace properties.
Algorithmic approaches such as antichain methods and CEGAR-based abstraction refinement enable practical verification of trace properties in complex systems.

Trace refinement relations generalize trace inclusion by relating the execution behaviors (represented as traces) of two systems, programs, or models. By capturing correspondences via arbitrary relations—rather than just equality or inclusion—they provide a unifying and flexible semantic tool across compiler correctness, concurrency, process calculi, verification, secure compilation, and model-based testing. This article surveys formal definitions, property-lifting characterizations, illustrative instances and applications, as well as methodological and computational aspects of trace refinement.

A trace is a (finite or infinite) path of externally observable events generated by a system during execution. Let $L_{\mathsf{src}}$ and $L_{\mathsf{tgt}}$ be source and target languages or models, endowed with trace semantics: $\Traces(L_{\mathsf{src}}) \subseteq \text{paths of } L_{\mathsf{src}}, \qquad \Traces(L_{\mathsf{tgt}}) \subseteq \text{paths of } L_{\mathsf{tgt}}$ A trace relation $R \subseteq \Traces(L_{\mathsf{src}}) \times \Traces(L_{\mathsf{tgt}})$ abstracts the way traces in the source relate to traces in the target.

Given a compiler (or, more generally, a transformation) $\mathit{compile} : L_{\mathsf{src}} \rightharpoonup L_{\mathsf{tgt}}$ , trace-refining compiler correctness is defined as: $CC^R : \forall P \in L_{\mathsf{src}},\quad \Traces(\mathit{compile}(P)) \subseteq \{t_t \mid \exists t_s \in \Traces(P).\, t_s\,R\,t_t\}$ This asserts that every target trace produced by the compiled code must be $R$ -related to some source trace (Abate et al., 2019).

Special cases:

$R =$ equality $\implies$ standard trace inclusion.
$R =$ more general relation $\implies$ flexible expressiveness for abstraction mismatches.

2. Property-Preservation via Existential and Universal Images

Trace-refinement relations induce property transformers:

Given a source property $\Phi_{\mathsf{src}} \subseteq \Traces(L_{\mathsf{src}})$, define

$\tau_R(\Phi_{\mathsf{src}}) = \{ t_t \mid \exists t_s \in \Phi_{\mathsf{src}}.\; t_s\,R\,t_t \}$

This yields the strongest target trace property ensured by a program satisfying $\Phi_{\mathsf{src}}$ .

Given a target property $\Phi_{\mathsf{tgt}} \subseteq \Traces(L_{\mathsf{tgt}})$,

$\sigma_R(\Phi_{\mathsf{tgt}}) = \{ t_s \mid \forall t_t.\; t_s\,R\,t_t \implies t_t \in \Phi_{\mathsf{tgt}} \}$

This gives the weakest source property required to ensure $\Phi_{\mathsf{tgt}}$ holds for the compiled code.

Trinitarian equivalence ((Abate et al., 2019), Theorem 2): $CC^R$ is equivalent to both

For any source property $\Phi_{\mathsf{src}}$ :

$P \models \Phi_{\mathsf{src}} \implies \mathit{compile}(P) \models \tau_R(\Phi_{\mathsf{src}})$

For any target property $\Phi_{\mathsf{tgt}}$ :

$P \models \sigma_R(\Phi_{\mathsf{tgt}}) \implies \mathit{compile}(P) \models \Phi_{\mathsf{tgt}}$

This framework shows that $CC^R$ preserves (via $\tau_R$ ) and reflects (via $\sigma_R$ ) trace properties.

The power of trace-refinement relations is demonstrated by concrete instantiations:

Phenomenon	Trace Relation $R$ (schematic)	Implication
Undefined Behavior	$t_s R t_t \iff t_s = t_t \lor (\exists m \le t_s: t_s = m\,{\sf UB} \land m \le t_t)$	Compiler correctness up to $\mathsf{UB}$ (CompCert)
Resource Exhaustion	$t_s R t_t \iff t_s = t_t \lor (\exists m \le t_s: t_t = m\,{\sf OOM})$	Correctness up to $\mathsf{OOM}$ (CakeML)
Side Channels	$t_s R (t_s', n) \iff t_s = t_s'$	Captures timing-insensitive properties
Abstract-Data Mismatch	$R$ inductively flattens compound source actions to sequences of atomic target ones	Models message or data decomposition mismatches

In all these cases, the appropriate $\tau_R$ and $\sigma_R$ describe the strongest property guaranteed/weakest required, often recovering established correctness concepts (Abate et al., 2019).

Trace-refinement relations generalize beyond pure compiler correctness to robust (secure) settings, quantifying over contexts: $RTC^R = \forall P,\, \forall C_{\mathsf{tgt}},\,\forall t_t \left( t_t \in \Traces(C_{\mathsf{tgt}}[\mathit{compile}(P)]) \implies \exists C_{\mathsf{src}}, t_s : t_s R t_t \land t_s \in \Traces(C_{\mathsf{src}}[P]) \right)$ This definition accounts for security guarantees (e.g., protection under adversarial linking) by universally quantifying over target contexts (Abate et al., 2019). The trinitarian equivalence persists: robust trace property preservation and reflection are characterized by context-closed property transformers $\tau_R$ and $\sigma_R$ .

5. Applications in Process Calculi, Concurrency, and Probabilistic Systems

In process algebras and concurrency,

CSP: Trace-refinement is simply $\operatorname{Trace}(Q) \subseteq \operatorname{Trace}(P)$ , i.e., $Q \sqsubseteq_T P$ (Igried et al., 2017).
Contextual trace refinement for concurrent objects connects linearizability and trace refinement: linearizability implies that any client program's observable traces with a concrete object implementation are matched by those with the abstract one (Dongol et al., 2016, Dongol et al., 2016).

For Markov Decision Processes (MDPs), trace-refinement is defined via probabilistic trace-equivalence under strategies: $\mathcal{M}_1 \sqsubseteq \mathcal{M}_2 \iff \forall \sigma_1\; \exists \sigma_2: \mathcal{M}_1^{\sigma_1} \equiv \mathcal{M}_2^{\sigma_2}$ where $\mathcal{M}^{\sigma}$ denotes the induced Markov chain under strategy $\sigma$ (Fijalkow et al., 2015). Special algorithms and complexity results for probabilistic trace refinement show undecidability in the general case, but tractable subclasses exist.

6. Synthesis, Verification, and Algorithmic Aspects

Algorithmic approaches to trace refinement include:

Antichain algorithms: Efficiently check trace refinement in transition systems by maintaining upward-closed sets of reachable pairs, preventing redundant exploration (Laveaux et al., 2019).
Abstraction refinement: For infinite-state systems, a CEGAR-based method refines abstract state partitions using interpolants, with antichains to avoid redundant checks (Iosif et al., 2014).
Partitioned trace-refinement relations: In Kleene Algebra with Tests, trace-refinement is defined over partitions of KAT expressions, with local hypotheses to correlate events or conditions across programs. Synthesis algorithms (e.g., Knotical) use counterexample-guided, partition-refinement strategies to discover refinement relations (Antonopoulos et al., 2019).

7. Broader Semantics, Model-Based Testing, and Compositionality

Trace-refinement is tightly connected to:

Reactive systems: Property transformers and monotonicity guarantee compositional reasoning; $S \sqsubseteq T \iff \forall Q.\, S(Q) \subseteq T(Q)$ for property transformers $S,T$ (Preoteasa et al., 2014).
Model-based testing and interface automata: Variants of trace-refinement relations (e.g., input-failure refinement, ioco, alternating-trace containment) characterise behavioral conformance under different assumptions about input/output, quiescence, and determinization (Janssen et al., 2019).
Semantics shifting: For concurrency models, transformations (using operators like CSP priority) can reduce more complex semantic refinement notions to trace refinement, preserving equivalence at the level of observable traces (Mestel et al., 2019).

Trace refinement in B/Event-B as implemented in BERT checks trace-by-trace that concrete models preserve abstract execution sequences, including Event-B’s stuttering and skip phenomena (Stock et al., 2022).

Trace-refinement relations provide a unified framework for reasoning about behavioral preservation across program transformations, model abstractions, and diverse computation domains. By abstracting the relationship between traces, they enable fine-grained, property-preserving transformations and compositional verification methodologies throughout formal methods, program analysis, and secure compilation theory (Abate et al., 2019, Dongol et al., 2016, Fijalkow et al., 2015, Iosif et al., 2014, Igried et al., 2017, Preoteasa et al., 2014, Antonopoulos et al., 2019, Laveaux et al., 2019, Janssen et al., 2019, Stock et al., 2022, Dongol et al., 2016, Mestel et al., 2019).