On the Use of a Fault Model to Validate the Completeness of a Set of Properties