Structural coverage criteria for Lustre/Scade programs

摘要

Lustre is a data-flow synchronous language, on which is based the Scade tool-suite, widely used for specifying and programming critical reactive applications in the areas of avionics, energy or transport. Therefore, testing Lustre programs, that is, generating test data and assessing the achieved test coverage, is a major issue. Usual control-flow-based test coverage criteria (statement coverage, branch coverage, etc.) are not relevant for Lustre programs. In this paper, a new hierarchy of adequacy criteria tailored to the Lustre language is presented. These criteria are denned on operator networks, which are usual models for Lustre programs. The criteria satisfaction measure is automated in Lustructu, a non-intrusive tool (no instrumentation of the code), based on the symbolic computation of path activation conditions. The applicability and the relevance of the criteria are assessed on a case study.