Cyclomatic Complexity

Also Known As

TL;DR

Explanation

Defined by Thomas McCabe in 1976, cyclomatic complexity measures the number of independent paths through a piece of code. Each decision point (if, elseif, for, while, foreach, case, catch, ||, &&, ?:) adds 1 to the base score of 1. A score of 1–5 is simple, 6–10 is moderate, 11–20 is complex, 20+ is very high risk. High cyclomatic complexity correlates with higher defect density and lower testability — you need at least one test per path to achieve full branch coverage.

Common Misconception

Why It Matters

Common Mistakes

• Not measuring cyclomatic complexity as part of CI — it only gets addressed when someone notices, not systematically.
• Reducing complexity by extracting private methods but keeping the same logic — the extracted methods just shift the score.
• Targeting zero complexity — some decision logic is inherently complex; the goal is appropriate decomposition.
• Confusing cyclomatic complexity with cognitive complexity — cyclomatic counts branches, cognitive accounts for nesting depth.

Code Examples

// CC = 8 (one path per branch)
function classify(int $score): string {
    if ($score >= 90) {
        return 'A';
    } elseif ($score >= 80) {
        return 'B';
    } elseif ($score >= 70) {
        return 'C';
    } elseif ($score >= 60) {
        return 'D';
    } else {
        return 'F';
    }
}

// CC = 2 — data-driven, trivially testable
function classify(int $score): string {
    return match(true) {
        $score >= 90 => 'A',
        $score >= 80 => 'B',
        $score >= 70 => 'C',
        $score >= 60 => 'D',
        default      => 'F',
    };
}

References

• ↗ https://en.wikipedia.org/wiki/Cyclomatic_complexity

Tags

Related Terms