Legacy codebase spec extraction

Don’t rewrite legacy code until you know what it does.

PYD ENTERPRISES reverse-engineers undocumented business rules, data models and OpenAPI 3.1 specs from legacy COBOL, Java and .NET codebases in days.

Start 14-day trial Book technical walkthrough

100% air-gapped VPC
Zero code egress
OpenAPI 3.1 & DMN
SOC 2 Type II

pyd scan ./LOANSYS --profile zos-enterprise

VPC · us-east-private

Lines parsed

Rules extracted

Open findings

Try it on a real routine

1988 COBOL in. Decision tables out.

Click a rule to see the exact lines it came from, or change the inputs and watch the decision fire. Note R6: the ELSE branch charges unknown tier codes.

Open the full sandbox

DDAFEE01.cblIBM Enterprise COBOL · 1988

1      *================================================================*
2      * PROGRAM: DDAFEE01   MONTHLY MAINTENANCE FEE ASSESSMENT          *
3      * WRITTEN: 1988-03-14   LAST CHANGE: 2004-11-02 (CR 4471)         *
4      *================================================================*
5       01  WS-ACCT-REC.
6           05  WS-ACCT-TIER         PIC X(01).
7               88  TIER-BASIC                 VALUE 'B'.
8               88  TIER-PLUS                  VALUE 'P'.
9               88  TIER-PREMIER               VALUE 'R'.
10           05  WS-AVG-BAL           PIC S9(9)V99 COMP-3.
11           05  WS-DIRECT-DEP-CNT    PIC 9(03)    COMP-3.
12           05  WS-CUST-AGE          PIC 9(03).
13       01  WS-FEE-AMT               PIC S9(5)V99 COMP-3.
14 
15       2000-ASSESS-FEE.
16           MOVE ZERO TO WS-FEE-AMT
17           PERFORM 2100-BASE-FEE THRU 2100-EXIT
18           IF WS-CUST-AGE >= 65
19              MOVE ZERO TO WS-FEE-AMT
20           END-IF.
21       2100-BASE-FEE.
22           IF TIER-BASIC
23              IF WS-AVG-BAL < 1500.00
24                 MOVE 12.00 TO WS-FEE-AMT
25              END-IF
26           ELSE
27              IF TIER-PLUS
28                 IF WS-AVG-BAL < 5000.00
29                    AND WS-DIRECT-DEP-CNT = ZERO
30                    MOVE 18.00 TO WS-FEE-AMT
31                 END-IF
32              ELSE
33                 IF WS-AVG-BAL < 25000.00
34                    MOVE 30.00 TO WS-FEE-AMT
35                 END-IF
36              END-IF
37           END-IF.
38       2100-EXIT.
39           EXIT.

Decision: Maintenance fee · hit policy FIRST

7 rules · 4 inputs

#	Age	Tier	Avg balance	Dir. dep.	Fee
R1	>= 65	-	-	-	0.00
R2	< 65	"B"	< 1500.00	-	12.00
R3	< 65	"B"	>= 1500.00	-	0.00
R4	< 65	"P"	< 5000.00	0	18.00
R5	< 65	"P"	-	-	0.00
R6	< 65	not("B","P")	< 25000.00	-	30.00
R7	< 65	not("B","P")	>= 25000.00	-	0.00

R6 · SOURCE LINES 32 TO 35

The ELSE branch. Any tier code other than B or P lands here, including invalid codes. Flagged for analyst review.

Account tierAverage balance 8,200.00Direct depositsCustomer age

FIRES R6

$30.00

The legacy modernization problem

Modernization fails in discovery, not in coding.

The people who wrote your interest accrual or your rating engine retired years ago. The only complete documentation is the code. Reading two million lines by hand takes a team of consultants most of a year, and the edge cases they miss surface in production, after cutover.

lines of COBOL estimated in daily production use worldwide: 800B+; lines of COBOL estimated in daily production use worldwide; Vanson Bourne survey for Micro Focus, February 2022 (estimate range 775 to 850 billion)
accumulated software technical debt in the United States: $1.52T; accumulated software technical debt in the United States; CISQ, The Cost of Poor Software Quality in the US: A 2022 Report
of the US federal FY2015 IT budget went to operating and maintaining existing systems: ~75%; of the US federal FY2015 IT budget went to operating and maintaining existing systems; US GAO, GAO-16-468, Federal Agencies Need to Address Aging Legacy Systems (May 2016)
combined FCA and PRA fine on TSB over its 2018 core platform migration: £48.65M; combined FCA and PRA fine on TSB over its 2018 core platform migration; UK FCA and PRA final notices, 20 December 2022

How it works

From PDS export to OpenAPI in four steps.

STEP 01install.sh

1# signed images, moved across the air gap on approved media
2docker load -i pyd-2026.11.tar
3helm install pyd ./pyd-2026.11.tgz \
4  --namespace modernization \
5  --set license.offlineKey=/secrets/cs-ent.key \
6  --set network.egress=deny-all
7# pyd-api      1/1   Running
8# pyd-parser   8/8   Running

Deterministic AST vs. LLM wrappers

Generic AI guesses mainframe logic. PYD ENTERPRISES compiles it.

Paste fifty thousand lines of COBOL into a chat model and it will describe REDEFINES overlays, 88-level condition names and EXEC CICS commands with confidence and without offsets. PYD ENTERPRISES builds the exact AST, storage layout and control-flow graph first, then classifies rules on top of that.

Explore the multi-language parsers

CUSTMAST.cpyCOBOL

       01  CM-RECORD.
           05  CM-KEY              PIC X(10).
           05  CM-TYPE             PIC X(01).
           05  CM-DETAIL           PIC X(40).
           05  CM-PERSONAL REDEFINES CM-DETAIL.
               10  CM-DOB          PIC 9(08).
               10  CM-INCOME       PIC S9(9)V99 COMP-3.
               10  FILLER          PIC X(26).
           05  CM-BUSINESS REDEFINES CM-DETAIL.
               10  CM-EIN          PIC 9(09).
               10  CM-REVENUE      PIC S9(13)V99 COMP-3.
               10  FILLER          PIC X(23).

RESOLVED LAYOUT · 51 BYTES2 variants

field	off	len
CM-KEYchar(10)	0	10
CM-TYPEdiscriminator	10	1
CM-DOBdate yyyymmdd · when TYPE='P'	11	8
CM-INCOMEdecimal(11,2) packed	19	6
CM-EINchar(9) · when TYPE='B'	11	9
CM-REVENUEdecimal(15,2) packed	20	8

The platform

Six engines. One symbol graph.

Every output, from a DMN row to an OpenAPI property, carries a pointer back to the file and line range it came from.

COBOL, CICS & JCL parser

Copybook expansion, REDEFINES, OCCURS DEPENDING ON, COMP-3, BMS maps and JCL dataset lineage.

Business rules to DMN 1.5

Calculation formulas and policy branches lifted out of procedural glue into decision tables your analysts can sign.

OpenAPI 3.1 synthesizer

COMMAREAs, EJB remotes and WCF contracts become typed REST and AsyncAPI specs.

  /loans/{id}/accrual:
    get: # LNINQ01 COMMAREA
      operationId: getAccrual

Behavioral test generation

Boundary fixtures from real branches prove the new service matches the old one.

balance=1499.99 → R2 pass
balance=1500.00 → R3 pass
age=65 → R1 pass

Java EE, EJB & Struts

Session beans, Struts actions, Spring XML and SOAP contracts, mapped to service boundaries.

PL/SQL & T-SQL logic

Stored procedures, triggers and cursors traced to every table they mutate.

PKG_LOAN.POST_PAYMENT→LOAN_BAL→TRG_BAL_AUDIT→GL_ENTRY

Supported legacy stack

Built for the code nobody wants to read.

Seventeen dialects and runtimes at launch, parsed by purpose-built front ends rather than one generic grammar.

Mainframe

IBM Enterprise COBOL
Micro Focus COBOL
CICS (BMS maps)
JCL & PROCs
VSAM (KSDS, ESDS, RRDS)
IMS DB / DL/I
DB2 for z/OS embedded SQL

Java

Java EE / EJB 2.x and 3.x
Apache Struts 1.x / 2.x
Spring XML & AOP
SOAP / WSDL / JAX-WS

.NET

Visual Basic 6 & COM
ASP.NET WebForms
WCF services

Database

Oracle PL/SQL
Microsoft T-SQL
Informix 4GL

Security & privacy

Your core banking logic never leaves the building.

Air-gapped executionSigned images and offline license keys. Runs with egress denied; nothing phones home.
Zero code egressSource, ASTs and extracted rules stay on your disks. PYD ENTERPRISES never receives them.
No model trainingYour code is never used to train any model, ours or anyone else's.
FIPS 140-2 validated cryptoData at rest and in transit inside the cluster uses validated modules.
SOC 2 Type II and ISO 27001Reports available under NDA from the trust center.

Read the security architecture

“We extracted thirty-five years of undocumented lending calculation rules from 1.5 million lines of COBOL, and not one byte left our data center.”

Chief Enterprise Architect · Tier 2 US commercial bank

“PYD ENTERPRISES gave us OpenAPI specs and DMN tables in week two of discovery. We priced the build phase from a rule inventory instead of a guess.”

Core modernization practice lead · Global systems integrator

Read customer stories

FAQ

Questions architects ask first.

More detail in the glossary and the DMN guide.

How does PYD ENTERPRISES handle complex COBOL REDEFINES and pointer arithmetic?

The COBOL front end builds a byte-accurate storage layout for every 01 level, including REDEFINES overlays, OCCURS DEPENDING ON tables and COMP, COMP-3 and DISPLAY usages. Every data reference resolves to an offset and length, so when two names alias the same bytes the symbol graph records both and the rule extractor follows writes through either name. SET ADDRESS OF and LINKAGE SECTION pointers are tracked as typed references; anything that cannot be resolved statically is flagged for review rather than guessed.

Can PYD ENTERPRISES run completely offline without internet access?

Yes. PYD ENTERPRISES ships as signed container images and a Helm chart that install inside your data center or private VPC. Licenses are offline keys, parser updates arrive as signed bundles you move across the air gap, and there are no telemetry or license-check calls. Security teams typically verify this with egress-deny network policies before the first scan.

What formats does PYD ENTERPRISES export?

OpenAPI 3.1 (YAML or JSON), AsyncAPI 2.6, DMN 1.5 XML that imports into Camunda and other DMN engines, JSON Schema 2020-12 data contracts, Postman 2.1 collections, ER and sequence diagrams as Mermaid or PlantUML, and equivalence test fixtures as JSON. Every exported rule links back to the exact source file and line range it came from.

How does it differ from generative AI coding assistants?

Assistants predict plausible text from a context window. PYD ENTERPRISES compiles the code: it parses every program into an AST, resolves every symbol, builds control-flow and data-flow graphs across programs, and only then applies semantic classification to separate business rules from plumbing. Language models are used, if you enable them, to name and describe rules that the deterministic engine has already found and located, never to decide what the code does.

How long does it take to analyze 1M lines of code?

Parsing and symbol resolution for 1 million lines typically complete in about an hour on a single 32-vCPU node. Rule extraction, lineage and spec synthesis add a few hours. Most of a two to three week Discovery Scan is spent with your analysts reviewing and signing off extracted rules, not waiting on compute.

How do Systems Integrators partner with PYD ENTERPRISES?

Through the Global SI Partner license: unlimited scans across client engagements, white-label deliverable reports, a partner enablement sandbox and parser customization for client-specific dialects. Partners typically run PYD ENTERPRISES in the first two weeks of a discovery phase and price the rest of the program from the extracted rule inventory.

Stop spending six months reading legacy code by hand.

Run PYD ENTERPRISES on 100,000 lines of COBOL or Java in your private VPC and review OpenAPI specs and DMN tables tomorrow.

Start 14-day trial Schedule a technical walkthrough