HT-2021-000363 - [2025] EWHC 532 (TCC)

IBM’s case is that Winsopia used the SLIP trap diagnostic tool to reverse engineer CICS data structures.

SLIP (Serviceability Level Indication Processing) is a diagnostic aid that can be configured to intervene during and interrupt the execution of a program and trigger a specified action, typically, a memory or system dump, enabling the user to have a snapshot of a system state or storage value at the time of the event, a Program Event Recording (“PER”).

The experts agree that PER SLIP traps have a performance impact on the operating system and therefore are used sparingly. Further, as SLIP traps can affect z/OS processing, they are usually set only by the z/OS administrator (systems programmer).

On 29 June 2014, LzLabs opened DR0111, requesting Winsopia to identify the four byte value of a data area created and stored in a register by CICS, at the moment that control is passed to a COBOL program during execution. It was suggested that Winsopia could use SLIP to obtain this information.

Simon Payne of Winsopia carried out the requested task by loading a COBOL program into CICS storage and setting a PER IF SLIP trap to produce a dump at the required offset when executing. Analysis of the dump enabled him to identify the value of the four byte STKLANG field in the register save area at that point and provide the information to LzLabs.

The issues in dispute are:

IBM’s case is that Winsopia’s analysis involved either CICS Transaction Server v5 or Enterprise COBOL v4, and their associated runtimes. Both are ICA Programs. The defendants’ case is that the register save area is an interface; a data area that interacts with the COBOL Language Environment. As such is it not an ICA Program.

Mr Swanson’s evidence is that CICS is responsible for creating the register save area when control is passed from CICS to a COBOL program. Mr Stephens agreed in cross-examination that the data area is populated either by CICS or the Language Environment runtime. As submitted by IBM, both are ICA Programs.

Winsopia used a SLIP trap to produce a dump at the required offset so that it could inspect the register save area and identify the value of the four byte field at a specific point during execution. This interrogated the internal implementation of the operation of the CICS Transaction Server and amounted to reverse engineering. As Mr Stephens agreed in cross-examination, although the format of the register save area is published by IBM, the values that occupy the field in the data area at different times during runtime execution and the purposes served by such values are not publicly documented.

The defendants submit that Winsopia’s activities fell within Article 5(3) of the Software Directive on the ground that the purpose was to observe the input that is passed to the test program from CICS, at the point when the test program receives control, while it is executing. I reject that argument. The investigation went beyond mere observation, study or testing the input and output of the program. It entailed a detailed examination as to how control is passed between CICS and COBOL applications during execution. That concerned expression of the program, rather than its function.

In summary on this issue: