Automated data flow mapping for IBM i/RPG must deliver three things before your team touches a single line of code: actionable dependency graphs, DB2 for i field-level lineage, and exportable artifacts your architects can use for testing and refactoring. A well-scoped proof of concept (POC) confirms all three within weeks. Your immediate next step is to run a fixed-scope POC against a prioritized application slice this quarter, using Golden Path Digital’s IBM i modernization assessment as your starting framework.
A POC should produce three concrete deliverables:
- Parsing coverage report: percentage of RPG, CL, and DDS sources successfully resolved
- Sample dependency graph: program-to-program and program-to-table call relationships for the selected slice
- Field-level lineage export: DB2 column-to-column traceability in JSON or graph format
Pro Tip: Choose your POC slice by finding the intersection of one critical business rule, the DB2 tables it reads and writes, and its external integration points. That combination surfaces the widest range of dependency types in the smallest footprint.
Key Takeaways
| Point | Details |
|---|---|
| Map before you refactor | Dependency graphs and DB2 lineage must exist before any code change to control blast radius. |
| Run a fixed-scope POC | A several-week POC covering 1–3 apps delivers parsing coverage, call graphs, and a remediation plan. |
| Require 85%+ parsing coverage | Vendors must report unresolved references explicitly, not suppress them to inflate coverage scores. |
| Map before applying AI | AI-assisted refactoring requires verified lineage artifacts to avoid generating unvalidatable output. |
| Golden Path Digital | AS/Forward, the IBM i modernization assessment, and QuantaPath AI deliver the mapping-first POC framework. |
Table of Contents
- What does data flow mapping mean for IBM i and RPG codebases?
- Why automated dependency mapping is critical to IBM i modernization
- What capabilities should you require from a mapping tool?
- A six-step methodology for running a mapping project
- How to evaluate vendors and what proof to demand
- What timelines and cost drivers should you plan for?
- What outcomes can you expect from a mapping-first approach?
- Quick checklist to start your POC this quarter
- Why mapping must come before AI in modernization projects
- Golden Path Digital runs fixed-scope POCs for IBM i mapping
- Sources
- FAQ
What does data flow mapping mean for IBM i and RPG codebases?
In the IBM i context, data flow mapping is the automated analysis of how data moves through RPG, CL, and DDS/DB2 artifacts — tracing reads, writes, field transformations, and program calls across your entire codebase. It is not a generic ETL diagram or a cross-cloud data-flow diagram (DFD). The goal is code-level lineage: knowing which program writes to which DB2 table column, which service program calls which subprocedure, and which physical file feeds which logical file view.
Artifacts included in scope:
- RPG source members (OPM, ILE, free-format)
- CL programs and job streams
- Service programs and binding directories
- Physical files, logical files, and DDS definitions
- DDS-to-DB2 mappings and SQL DDL
- Embedded and dynamic SQL statements
- IFS objects and stream file references
Excluded from scope: high-level integration diagrams, unrelated ETL pipelines, and business process modeling artifacts that cannot be resolved to actual source code. Rewriting RPG native I/O to embedded SQL is itself a common modernization step, which is why DDS-to-SQL traceability belongs inside the mapping scope.
| Deliverable | Artifact type |
|---|---|
| Program call graph | RPG source, CL jobs |
| Field-level lineage | DB2 table/column, DDS, SQL DDL |
| Service program boundary map | ILE service programs, binding directories |
| Unresolved reference report | Dynamic SQL, runtime-resolved calls |
| I/O trace summary | Physical/logical files, IFS objects |
Why automated dependency mapping is critical to IBM i modernization
Hidden dependencies are the primary risk in any IBM i modernization project. When your team cannot see which programs share a DB2 table or which CL job triggers a chain of service programs, every change carries an unknown blast radius. Automated mapping makes those dependencies visible before the first refactor, reducing regression risk and shortening the investigation cycle for proposed changes.
Modernization on IBM i is staged: stabilize and document, then expose via APIs, then extend. Skipping the documentation step forces your team to reverse-engineer dependencies under pressure during later phases. One documented case showed a substantial increase in digital sales after a company exposed RPG logic safely via APIs — a result that depends entirely on knowing what that logic does and what it touches before you wrap it.
For regulated environments, the compliance angle is equally direct. HIPAA-covered entities need auditable data lineage to demonstrate where protected health information flows through legacy systems. Mapping produces that evidence without requiring manual documentation sprints.
Modernization use cases that mapping directly unlocks:
- Safe refactoring of RPG business logic without regression
- API extraction from isolated program boundaries
- DB migration from DDS definitions to SQL DDL
- Targeted test generation based on actual I/O paths
What capabilities should you require from a mapping tool?
Require static parsing plus DB2 enrichment plus unresolved-reference visibility plus exportable artifacts. Any tool that delivers only one or two of those four is incomplete for enterprise modernization.
Minimum feature checklist:
- Column-level lineage across DB2 tables and views
- Program-to-program call graphs with service program boundaries
- Dynamic SQL detection and flagging
- Job scheduler ingestion for batch dependency tracing
- IFS scanning for stream file references
- Evidence tracing: which source line produced which lineage assertion
- Read-only, non-destructive operation on an isolated environment
The RPG code analysis capabilities Golden Path Digital publishes describe enterprise parsing that covers these artifact types and positions the resulting dependency graphs as foundational for safer modernization.
| Capability | Why it matters | Expected output |
|---|---|---|
| Call graph | Impact analysis before any change | Mermaid diagram, JSON |
| Field-level lineage | DB migration and test generation | Column-to-column lineage report |
| Unresolved reference report | Surfaces gaps before refactor | Flagged reference list |
| Dynamic SQL detection | Prevents silent lineage breaks | Annotated source listing |
| Audit log | HIPAA/enterprise compliance | Timestamped access log |
Security posture matters as much as parsing depth. The tool must operate read-only, produce audit logs, and support HIPAA-grade access controls for environments handling regulated data.
A six-step methodology for running a mapping project
A repeatable six-step process yields deployable artifacts for both POC and full-scale programs.
- Inventory and governance: Catalog all source libraries, service programs, and job schedules. Establish read-only access and document data classification for regulated fields.
- Source collection: Extract RPG, CL, DDS, and SQL members into a normalized repository. Include IFS objects and binding directories.
- Parse and detect: Run static analysis across all collected sources. Flag unresolved references, dynamic SQL calls, and missing members immediately.
- Enrich with DB2 metadata: Pull live DB2 catalog data to resolve physical/logical file relationships and column-level attributes that source code alone cannot confirm.
- Validate with subject-matter experts: Stage artifact reviews in focused sessions. Present dependency graphs and lineage exports for SME sign-off on high-priority application slices first.
- Produce artifacts and a remediation plan: Deliver call graphs, lineage exports, unresolved-reference reports, and a prioritized remediation backlog in formats your downstream tools can consume.
Pro Tip: Configure your parser to flag every unresolved reference as a visible gap rather than silently skipping it. A POC that surfaces ten unresolved calls is more trustworthy than one that reports clean coverage by ignoring them.
How to evaluate vendors and what proof to demand
Require measurable parsing coverage, proof artifacts, and a short POC that runs against live sources with non-destructive access. A vendor who cannot demonstrate these three things on your actual code is not ready for your program.
Required proof before signing:
- Parsing coverage report showing percentage of members resolved vs. skipped
- Program-to-table mapping sample for a named application
- Dependency graph for a prioritized slice your team can validate
- Evidence of false-positive and false-negative rates on a known codebase
Suggested POC pass/fail criteria:
- Parsing coverage above 85% on submitted sources within the agreed timeframe
- Dependency graph delivered in at least one open format (JSON, Mermaid, or GraphML)
- Unresolved references reported explicitly, not suppressed
- Read-only access confirmed with no writes to production libraries
- Turnaround within four weeks for a slice of 50–100 programs
For vendor vetting questions and reference checks, Golden Path Digital’s RPG modernization services guide covers the evaluation criteria your architecture team should apply.
What timelines and cost drivers should you plan for?
A small POC covering a small number of applications typically completes in several weeks. Enterprise-scale mapping across hundreds of programs runs in months, with schedule driven by source volume, dynamic call complexity, and the availability of SMEs for validation.
| Scope | Typical timeline | Primary cost drivers |
|---|---|---|
| POC (small number of apps) | several weeks | Source collection, SME availability |
| Mid-scale (multiple apps) | several months | Dynamic SQL resolution, validation cycles |
| Enterprise (large number of apps) | several months to a year | Source volume, integration work, audit requirements |
The largest schedule risks are dynamic SQL statements that cannot be resolved statically, missing source members, and SME bottlenecks during validation. Structure your POC as a fixed-scope engagement with defined deliverables rather than time-and-materials. That keeps the budget predictable and forces the vendor to commit to coverage thresholds upfront.
What outcomes can you expect from a mapping-first approach?
A mapping-first approach reduces investigation time for proposed changes, lowers regression risk during refactoring, and produces the lineage artifacts that make DB migration and test generation tractable. Staged modernization with documented logic consistently produces measurable business gains when RPG logic is exposed safely.
KPIs to track after mapping:
- Mean time to impact analysis for a proposed change
- Percentage of test cases generated from lineage artifacts vs. written manually
- Reduction in rollback incidents per release cycle
- Number of unresolved references resolved per validation sprint
The most common limitation is dynamic SQL: calls resolved at runtime cannot be traced statically. Counter this by flagging every dynamic statement in the unresolved-reference report and scheduling targeted SME sessions to document those paths manually. A DDS-to-SQL migration also benefits directly from this process, since column-level lineage reveals which programs depend on a physical file before you convert its definition.
Quick checklist to start your POC this quarter
Your team can be POC-ready within two weeks with the right preparation.
- Confirm read-only access to source libraries and DB2 catalog for the selected application slice.
- Identify and brief two to three SMEs who own the business logic in that slice.
- Obtain legal and security approvals for sharing source members with the mapping vendor.
- Define the prioritized application slice: one business rule, its DB2 tables, and its integration points.
- Agree on artifact formats and acceptance criteria with the vendor before work begins.
- Schedule a mid-POC review at week two to catch access or coverage issues early.
Pro Tip: Send SMEs the dependency graphs and lineage exports before the validation meeting, not during it. Staged artifact review cuts live session time by roughly half and produces better-quality feedback.
Why mapping must come before AI in modernization projects
Golden Path Digital’s methodology puts dependency mapping ahead of any AI-assisted refactoring or test generation for a direct reason: AI models hallucinate when they lack grounded context. A verified call graph and field-level lineage export give the model the structural facts it needs to generate accurate refactoring suggestions or test cases. Without that foundation, AI-assisted modernization produces output your team cannot validate. The RPG code analysis process Golden Path Digital runs is specifically designed to produce that verified foundation before automation is applied.
Golden Path Digital runs fixed-scope POCs for IBM i mapping
Golden Path Digital delivers short, fixed-scope POCs that produce parsing coverage reports, dependency graphs, and remediation plans on a schedule instead of a prayer. AS/Forward handles deep RPG codebase parsing and dependency mapping, giving your team the call graphs and DB2 lineage exports a modernization program requires. Laravel Ascend automates framework upgrades from versions 6 to 11 for teams running parallel modernization tracks. QuantaPath AI applies workflow automation and CRM integration once the mapping foundation is in place.
Start with the IBM i modernization assessment to scope your POC, or go directly to the legacy code modernization framework to see how parsing, mapping, and automation fit together for your program.
Sources
- Modernizing Applications on IBM i: Protecting Your Investment, Driving Innovation – MC Press Online
FAQ
What is data flow mapping for IBM i/RPG?
Data flow mapping for IBM i/RPG is the automated analysis of how data moves through RPG, CL, and DB2 artifacts, producing call graphs, field-level lineage, and unresolved-reference reports your team can use for modernization planning.
How long does a mapping POC take?
A POC covering a small number of applications typically completes in several weeks, depending on source volume, dynamic SQL complexity, and SME availability for validation.
What parsing coverage threshold should you require from a vendor?
Why must mapping come before AI-assisted refactoring?
AI models require verified structural context to generate accurate refactoring suggestions. Without a confirmed dependency graph and lineage export, AI output cannot be validated against the actual system.
How does Golden Path Digital support IBM i mapping projects?
Golden Path Digital runs fixed-scope POCs using AS/Forward for RPG parsing and dependency mapping, delivering coverage reports, call graphs, and remediation plans through its IBM i modernization assessment service.