Equivalence class partitioning is a well-established test design technique mandated by safety standards such as ISO~26262 for systematic testing of safety software. In industrial practice, however, its application to legacy undocumented embedded firmware is often hindered by incomplete or outdated functional specifications. This paper proposes a binary-level methodology for inferring output-oriented equivalence classes directly from compiled firmware, without relying on source-level annotations or external documentation. The approach combines control-flow reconstruction and guided symbolic execution to analyze individual functions and group execution paths according to indistinguishable observable behavior, including return values and output parameters. An optional post-processing step produces human-readable representations to support comprehension and documentation. The methodology is evaluated in an industrial automotive context through a practitioner-based study assessing correctness and interpretability. Results indicate strong alignment with expert expectations and a positive perception of readability and usefulness for supporting function understanding and test design. These findings demonstrate the feasibility and practical relevance of binary-level equivalence class inference for systematic testing of legacy undocumented safety-embedded software.

翻译：等价类划分是一种成熟的测试设计技术，被ISO 26262等安全标准强制要求用于安全软件的系统性测试。然而，在工业实践中，该技术应用于遗留的无文档嵌入式固件时常因功能规范不完整或过时而受阻。本文提出了一种二进制级方法，可直接从编译后的固件中推断面向输出的等价类，无需依赖源代码级注释或外部文档。该方法结合了控制流重构与引导式符号执行，用于分析各个函数，并根据不可区分的可观测行为（包括返回值和输出参数）对执行路径进行分组。可选的后处理步骤可生成人类可读的表示形式，以支持理解与文档编制。该方法在工业汽车环境中通过一项从业者研究进行了评估，评估内容涉及正确性与可解释性。结果表明，该方法与专家预期高度一致，且其对支持功能理解与测试设计的可读性和实用性获得了积极评价。这些发现证明了二进制级等价类推断对于系统性测试遗留无文档安全嵌入式软件的可行性及实际意义。