Mutation analysis is usually used to provide an indication of the fault detection ability of a test set. It is mainly used for unit testing evaluation, but has also been extended for integration testing evaluation. This paper describes adaptation of mutation analysis to the Lustre programming language, including both unit and integration testing. This paper focuses on the fault model, which has been extended since our previous works. Validation of the fault model is presented.

LUTESS is a test data generator dedicated to synchronous software validation. The tool produces test with respect to an environment description. To check if this description is really as expected, we use mutation analysis. The key point of the approach is to select a subset of mutants which characterizes some kind of "interesting situations" that are supposed to be often produced thanks to environment description. Intuitively, if preselected mutants are killed "very often" during tests, environment description is as expected (with respect to these "interesting situations").

Reactive systems used in safety-critical domains demand high level of confidence. The development of these systems, which are submitted to several normative recommendations, is complex and expensive. Reactive systems can be developed by using the data-flow approach: many languages support this approach such as MATLAB/SlMULINK, LUSTRE/SCADE. This paper concentrates on the LUSTRE/SCADE language, especially the description of reactive system environment properties in this language. The description of environment properties, which is important for the validation (the proof and the test) of reactive systems, is not easy. Hence, we would like to use the mutation technique to consolidate this difficult task: we use the LESAR model-checking tool to detect equivalent mutants and some test case generators such as GATEL or LUTESS tools to kill non-equivalent mutants.