Demo project — fictitious code, with the engine’s reading on every stage and no model drafts or test runs. Nothing you do here is saved. A demo run is never signed. No signed run, no audit pack and no export comes out of this screen — a signature says a named account analysed a named source, and none of that happened here.Nothing here counts against your five free analyses: the demo is the same for every account, and what you change lives in this browser only.Try an example or your own code

AnalyzeDesignTransformationDocumentationTestingEconomicsDelivery

Next: Analyze — Reads the code and signs a run — every other figure starts here. The other tools need a signed run first.

What the marks mean:donestartedout of date

DemoDemo run · unsigned

Demo · Z_MM_PO_APPROVAL — Analyze

23 findings at 26 places in the code, from the engine that ships with this release — and no signed run, because a demo may not produce one.

Clean Core Score

40of 100

Far from clean core· band 5–59

Far from clean core, 5–59
Significant rework, 60–80
Some rework, 81–90
Close to clean core, 91–100

A grade for this one piece of code, higher is better — not a compliance percentage and not an SAP measure. Clean-Core.io's bands, derived from the deductions. How the score is computed

Scored for SAP Cloud ERP Private — the project’s target.

Writes to the program’s own Z/Y tables cost nothing there (on-stack developer extensibility). Under Public Edition rules the same findings give 26: those 2 writes cost 14 points there. Computed from the same findings; only 40 is signed.

Reconstructed· fixed rulesno model involved

Demo — never signed · engine v3.0.19

Z_MM_PO_APPROVAL.abap · 552 lines · catalog 2024.FPS02, SAP release list of 2026-10-01 (25,467 entries) · SAP Cloud ERP Private assumed for the demo

What moves it

100 − 40 for what the code does − 20 for what could not be assessed = 40

Every deduction of the score’s table, the largest first. A line chip opens the source at that line.

Direct writes to SAP standard tables1 finding · EBAN · 20 for the first−20 points
Batch input to transactions1 finding · ME21N · 10 for the first−10 points
File transfers through the SAP GUI1 finding · GUI_UPLOAD · 5 for the first−5 points
Direct reads of SAP standard tables11 findings · EBAN, LFA1, LFM1, CSKS and 5 more · capped at 5+9+9−5 points
Writes to the program’s own Z/Y tables2 findings · ZMM_PO_APPR, ZMM_PO_ATTACH · free in SAP Cloud ERP Private, −14 in Public Edition0 points
What the code does — 100 − 4060 points
Statements the engine could not assessNot determined4 kinds, 7 places: local function-module call (2), include whose source was not uploaded (2), dynamic call or field access (1), classic list output (2) · 5 points per kind. Not defects, and not cleared either.−20 points
Clean Core Score of the demo40 points

· File transfers through the SAP GUI −5, Direct reads of SAP standard tables −5, writes to the program's own Z/Y tables 0

The largest single deduction: direct writes to sap standard tables (EBAN), 20 points. Settling the 7 places that could not be assessed (open questions) can move the score either way — the 20 points come off, findings may come in.

Findings: 23in 26 places; Critical 1 · High 3 · Medium 14 · Low 4 · Info 1Critical 1 · High 3
Clean core levels: A0B5C10D1Unknown 3; 16 of 23 findings · from SAP's catalog, read for SAP Cloud ERP Private · not signed
Recommended route: ABAP Cloud on-stack; Reconstructed· fixed rules· decided in Management
Not determined: 7places, 4 kinds; Open questions for the project: see the list — includes, call targets, ATC results

Look here firstReconstructed· by severity and kind

3 of 23 findings, picked by fixed rules

CriticalDCC-010
Direct write to SAP standard table EBAN
Writes directly to an SAP standard table
Directly modifying standard SAP tables destroys system integrity, invalidates SAP guarantees, and blocks upgrades completely.
```
240  UPDATE eban SET statu = 'H'241    WHERE banfn = p_banfn242      AND bnfpo = p_bnfpo.
```
Successor:API_PURCHASEREQUISITION_SRVImported· Clean-Core.io curated mapping, compiled for 2024.FPS02
HighCCC-024
Legacy batch data communication (BDC) to TCode ME21N
Drives an SAP transaction through batch input
BDC relies on traditional SAP GUI screen flows. These are highly unstable, prone to breaking during upgrades, and do not work in SAP Fiori or Cloud environments.
```
515  CALL TRANSACTION 'ME21N' USING lt_bdc516    MODE 'N'517    UPDATE 'S'
```
No released successor named
HighBCC-016
Direct write to custom table ZMM_PO_APPR
Direct DB access bypasses the application layer and encapsulation: no business object guards the rows it changes. Writing to a table that is not SAP's is not itself a clean core violation, but ABAP Cloud needs the table exposed through a RAP business object or moved side-by-side.
```
353  INSERT zmm_po_appr FROM ls_appr.
```
No released successor named

2 more · swipe

Where in the program

Critical 1
High 3
Medium 14
Low 4
process step

Every finding at its source line, one row per kind; a bigger dot is a more severe finding. Pick a dot to open the source at that line.

1234567891011

Direct write to an SAP standard table

1 finding

Writes to custom tables

2 findings

Batch input to a transaction

1 finding

Direct reads of SAP standard tables

9 findings · 11 places in the code

Calls of classic APIs not released for ABAP Cloud

2 findings

Decision on the server's date or time

1 finding

Explicit transaction control

1 finding · 2 places in the code

File transfer through the SAP GUI

1 finding

Table accesses

3 findings

Security review task

1 finding

Authorization check

1 finding

△ not assessed

△△△△

Columns are the 11 process steps the program runs, numbered left to right as they stand in the code: 1 READ_REQUISITION · 2 CHECK_REQUISITION · 3 CHECK_AUTHORITY · 4 UPLOAD_ATTACHMENT · 5 READ_VENDOR · 6 CHECK_VENDOR · 7 READ_INFO_RECORD · 8 CHECK_PRICE · 9 DECIDE_APPROVAL · 10 NOTIFY_REQUESTER · 11 WRITE_RESULT_LIST. The program runs them in this order: 3 → 1 → 2 → 4 → 5 → 6 → 7 → 8 → 9 → 10 → 11.

Findings by kind (23)

Severity

23 findings

Direct write to an SAP standard table: 1 finding
Line	Severity	What	Level	Successor
	SeverityCritical	WhatEBAN CC-010Direct write to SAP standard table EBAN	Level	SuccessorAPI_PURCHASEREQUISITION_SRVClean-Core.io curated mapping, compiled for 2024.FPS02

Writes to custom tables: 2 findings
Line	Severity	What	Level	Successor
	SeverityHigh	WhatZMM_PO_APPR CC-016Direct write to custom table ZMM_PO_APPR	Level	Successornone named
	SeverityHigh	WhatZMM_PO_ATTACH CC-026Direct write to custom table ZMM_PO_ATTACH	Level	Successornone named

Batch input to a transaction: 1 finding
Line	Severity	What	Level	Successor
	SeverityHigh	WhatME21N CC-024Legacy batch data communication (BDC) to TCode ME21N	Level	Successornone named

Direct reads of SAP standard tables: 9 findings
Line	Severity	What	Level	Successor
+1	SeverityMedium	WhatEBAN CC-001Direct read from SAP standard table EBAN	Level	SuccessorAPI_PURCHASEREQUISITION_SRVClean-Core.io curated mapping, compiled for 2024.FPS02
+1	SeverityMedium	WhatPA0105 CC-018Direct read from SAP standard table PA0105	Level	Successornone named
	SeverityMedium	WhatLFA1 CC-005Direct read from SAP standard table LFA1	Level	SuccessorAPI_BUSINESS_PARTNERClean-Core.io curated mapping, compiled for 2024.FPS02
	SeverityMedium	WhatLFM1 CC-006Direct read from SAP standard table LFM1	Level	SuccessorI_SUPPLIERPURCHASINGORGSAP catalog
	SeverityMedium	WhatCSKS CC-007Direct read from SAP standard table CSKS	Level	SuccessorI_CostCenterClean-Core.io curated mapping, compiled for 2024.FPS02

Calls of classic APIs not released for ABAP Cloud: 2 findings
Line	Severity	What	Level	Successor
	SeverityMedium	WhatSAP_WAPI_CREATE_EVENT CC-021Call of function module SAP_WAPI_CREATE_EVENT, a classic API not released for ABAP cloud	Level	Successornone named
	SeverityMedium	WhatBAPI_PO_CREATE1 CC-023Call of function module BAPI_PO_CREATE1, a classic API not released for ABAP cloud	Level	Successornone named

Decision on the server's date or time: 1 finding
Line	Severity	What	Level	Successor
	SeverityMedium	WhatThe server's date or time decides (sy-datum) CC-008	Level	Successornone named

Explicit transaction control: 1 finding
Line	Severity	What	Level	Successor
+1	SeverityMedium	WhatExplicit transaction boundary (COMMIT WORK) CC-011	Level	Successornone named

File transfer through the SAP GUI: 1 finding
Line	Severity	What	Level	Successor
	SeverityMedium	WhatGUI_UPLOAD CC-004Legacy frontend file upload/download	Level	Successornone named

Table accesses: 3 findings
Severity	What	Level	Successor
SeverityLow	WhatZMM_VEND_BLOCK CC-009Direct read from custom table ZMM_VEND_BLOCK	Level	Successornone named
SeverityLow	WhatZMM_DEPT_HEAD CC-017Direct read from custom table ZMM_DEPT_HEAD	Level	Successornone named
SeverityLow	WhatZMM_NOTIFY_CFG CC-020Direct read from custom table ZMM_NOTIFY_CFG	Level	Successornone named

Security review task: 1 finding
Line	Severity	What	Level	Successor
	SeverityLow	WhatSecurity review: CALL TRANSACTION ME21N without WITH or WITHOUT AUTHORITY-CHECK CC-025	Level	Successornone named

Authorization check: 1 finding
Line	Severity	What	Level	Successor
	SeverityInfo	WhatAuthorization check (AUTHORITY-CHECK) CC-003	Level	Successornone named

Note, not a finding: 2 fields store the server's date or time as a stamp (erdat, erzet) — fine in UTC unless a later step reads them as the local day. Lines 351, 352, 531.

Extensibility route

Reconstructed· fixed rules

Target: RAP Business Object

Confidence65%

Detected 2 write(s) to custom database persistence. In SAP Cloud ERP Private this is on-stack developer extensibility, not a reason to leave the stack: the table is a Dictionary object in the customer namespace and a RAP business object is built on it. Writing to your own table is not a clean core violation — writing to SAP's is. The explicit COMMIT WORK (2×) conflicts with the RAP transaction lifecycle: it has to be removed and the transaction boundary left to the RAP save sequence before the code runs on ABAP Cloud. The 1 direct write(s) to SAP standard tables are not clean core in any edition: each is replaced on-stack by a released write API, a BAPI or a RAP action. The BDC screen automation (1×, from line 515) does not run in ABAP Cloud, and the screens it drives carry no stability contract. It is replaced on-stack by the released API of the same business object; where SAP has released none, by a wrapper around the classic API, released for use in ABAP Cloud, together with an influence request to SAP for a released API. A side-by-side service would need the same released API, so the automation forces no side-by-side split. The frontend file upload (GUI_UPLOAD, from line 129) reads a file from the user's PC: a RAP business object takes a file as a large object (attachment) field from S/4HANA 2022 on, so the upload alone forces no side-by-side split — a side-by-side service needs a requirement the code does not show, such as external users, files arriving from several systems, or a volume the S/4HANA stack should not carry. SAP_WAPI_CREATE_EVENT, BAPI_PO_CREATE1 are classic APIs SAP does not release for ABAP Cloud: on this route their calls are replaced by the released API of the same business object, or kept in classic ABAP behind a wrapper. Part of the program was not read. Include Z_MM_PO_NOTIFY was not uploaded — what it does is not determined. Include Z_MM_PO_LOG was not uploaded — what it does is not determined. Key-user extensibility: 3 of 6 part(s) are key-user candidates (Custom Business Objects (configuration)), each with its limit; 3 stay code, and part of the program was not assessed by the engine. The program splits: only the code part is built.

Nothing the engine found forces it off the stack.

Holds if

SAP Cloud ERP Private selected as the target — where an API is not released, a wrapper plus an influence request to SAP is available.
Direct writes to SAP standard tables are replaced with a released write API, a BAPI or a RAP action. A wrapper may encapsulate an unreleased object for use; it does not make a direct write supported.
The BDC screen automations of this program are not yet replaced; what replaces them is said in the rationale.

Target system: SAP Cloud ERP Private

Decide in Management

Keep, rebuild, move to standard or retire — the program decision is made there.

Not determined

7 places the engine could not assess, in 4 kinds — 20 points of the score.

A result covers what the engine checks, which is not the whole program.

Statements outside the engine’s checks

Nobody has judged these statements either way — they are not defects, and not cleared either.

Outside this analysis

Not assessed: 2 × local function-module call, 2 × include whose source was not uploaded, 1 × dynamic call or field access and 2 × classic list output. A result covers what the engine checks, which is not the whole program.

Local function-module call · 2
Include whose source was not uploaded · 2
Dynamic call or field access · 1
Classic list output · 2

Statements outside this analysis
Line	Construct	Statement
173	ConstructLocal function-module call	StatementCALL FUNCTION 'CONVERT_TO_LOCAL_CURRENCY' EXPORTING date = sy-datum foreign_amount = cv_amount foreign_currency = iv_waers local_currency = 'EUR' IMPORTING l...
363	ConstructInclude whose source was not uploaded	StatementINCLUDE z_mm_po_notify
386	ConstructDynamic call or field access	StatementCALL FUNCTION lv_fm_name EXPORTING iv_banfn = p_banfn iv_message = gv_message EXCEPTIONS OTHERS = 1
396	ConstructInclude whose source was not uploaded	StatementINCLUDE z_mm_po_log
490	ConstructLocal function-module call	StatementCALL FUNCTION 'BAPI_TRANSACTION_COMMIT' EXPORTING wait = abap_true
542	ConstructClassic list output	StatementWRITE: / 'Emergency purchase approval', sy-datum, sy-uzeit
545	ConstructClassic list output	StatementWRITE: / 'Requisition:', p_banfn, p_bnfpo, / 'Vendor: ', gs_lfa1-lifnr, gs_lfa1-name1, / 'Amount EUR: ', gv_amount, / 'Approver: ', gv_approver, / 'Order: ',...

Local function-module call: Only CALL FUNCTION with DESTINATION is assessed, as an RFC. A local call — a BAPI among them — is not looked at, so whether a released API replaces it is unknown.
Include whose source was not uploaded: Include Z_MM_PO_NOTIFY was not uploaded — what it does is not determined. No detector read the statements in it, so nothing found or not found here speaks for them. This project cannot take further includes; an analysis of the program uploaded together with its includes reads them.
Dynamic call or field access: The target is computed at runtime, so static analysis cannot name what is reached. The call may resolve to something the engine would otherwise flag.
Classic list output: WRITE list processing does not exist in ABAP for Cloud Development, but no detector scores it — the classic UI detectors cover dynpro and classic ALV only. Recorded as unassessed rather than scored, because turning it into a finding would re-grade existing analyses.

3 things are not established here, and each names the step that would settle it
Each one is a question, not a result: it names the line and the one step that would settle it.
3 things are not established here, and each names the step that would settle it
A check task is a question, not a result. Each one names what this reading could not establish, the line or the import it stands on, the one step that would settle it, and the sentence Clean-Core.io does not write while it is open. Nothing here was asked of a model.
Include not readL363Z_MM_PO_NOTIFY
Line 363 names the include Z_MM_PO_NOTIFY, and the text of that include is not part of the source this reading holds. Whatever it declares, calls or writes stands outside every figure here.
Next step: Add what Z_MM_PO_NOTIFY does as the answer to the open question "Add the includes", or analyze the program uploaded together with its includes so that Z_MM_PO_NOTIFY is read with the rest.
Not said while this is open: that what this reading found is everything the program does.
Target worked out at run timeL386–L391lv_fm_name
Line 386 in NOTIFY_REQUESTER takes the name of the function module it reaches from lv_fm_name, a value the program works out while it runs. The source names no target for this call.
Next step: Name the function modules lv_fm_name takes at run time, from the values written to it or from a trace of a real run.
Not said while this is open: that the function modules this program reaches are the ones its source spells out.
Include not readL396Z_MM_PO_LOG
Line 396 names the include Z_MM_PO_LOG, and the text of that include is not part of the source this reading holds. Whatever it declares, calls or writes stands outside every figure here.
Next step: Add what Z_MM_PO_LOG does as the answer to the open question "Add the includes", or analyze the program uploaded together with its includes so that Z_MM_PO_LOG is read with the rest.
Not said while this is open: that what this reading found is everything the program does.
These three checks are the ones this product can make on its own: an include it was not given, a call whose target the program works out while it runs, and a usage window shorter than the thirteen months that hold a year-end run. They are not a list of everything worth checking in your code.
Modernisation strategy
The standardisation fit and the recommendation prose come from the narrative. The route on this page does not.
The demo stops where the model begins. The modernisation strategy comes out of a model call in a real run. A demo makes no model call, so there is none here — and writing a convincing one by hand is the one thing this product may never do.

Demo · Z_MM_PO_APPROVAL — Analyze

Clean Core Score

What moves it

Look here firstReconstructed· by severity and kind

Direct write to SAP standard table EBAN

Legacy batch data communication (BDC) to TCode ME21N

Direct write to custom table ZMM_PO_APPR

Where in the program

Findings by kind (23)

Statements outside the engine’s checks

Outside this analysis

3 things are not established here, and each names the step that would settle it

3 things are not established here, and each names the step that would settle it

Modernisation strategy

Language constructs the engine resolved

Coverage Verdict

Statically Identified Constructs (1 findings)

Dynamic CALL FUNCTION / PERFORM

Code inventory and data access

Clean Core Score

What moves it

Direct write to SAP standard table EBAN

Legacy batch data communication (BDC) to TCode ME21N

Direct write to custom table ZMM_PO_APPR

Direct write to an SAP standard table (1)EBAND11/1 with successorScore points: −20

Writes to custom tables (2)ZMM_PO_APPR, ZMM_PO_ATTACHB20/2 with successorScore points: 0

Batch input to a transaction (1)ME21NC10/1 with successorScore points: −10

Direct reads of SAP standard tables (9)EBAN, PA0105, LFA1 and 6 moreC97/9 with successorScore points: −5

Calls of classic APIs not released for ABAP Cloud (2)SAP_WAPI_CREATE_EVENT, BAPI_PO_CREATE1B20/2 with successorScore points: 0

Decision on the server's date or time (1)No object, no clean core level:10/1 with successorScore points: 0

Explicit transaction control (1)Statement, no clean core level:10/1 with successorScore points: 0

File transfer through the SAP GUI (1)GUI_UPLOADB10/1 with successorScore points: −5

Table accesses (3)ZMM_VEND_BLOCK, ZMM_DEPT_HEAD, ZMM_NOTIFY_CFG—30/3 with successorScore points: 0

Security review task (1)No object, no clean core level:10/1 with successorScore points: 0

Authorization check (1)Statement, no clean core level:10/1 with successorScore points: 0

Outside this analysis

3 things are not established here, and each names the step that would settle it

Model summary·Show

Technical detail·Show

Language constructs the engine resolved

Coverage Verdict

Statically Identified Constructs (1 findings)

Dynamic CALL FUNCTION / PERFORM

Code inventory and data access