Cyclomatic complexity is a metric in software engineering that helps determine the complexity and, thus, the likelyhood of errors and the maintainability of code. Cyclomatic complexity is also referred to as the McCabe metric.
1. Determining the cyclomatic complexity
This metric indicates how many linearly independent paths there are through a program graph. A path is linearly independent if it contains at least one new edge (line in Fig. 1).
In the following example, there are four linearly independent paths.
These paths are indicated by the Arabic numerals on the edges (lines) of the program graph:
- 2– 7
- 1 – 4 – 6 – 9 – 10
- 1 – 4 – 6 – 9 – 8 – 9 -10
- 1 – 3 – 5 – 9 – 10
In other words, the numbers indicate the traversed edges in each case.
Manufacturers do not determine this metric by hand rather they use a tool such as:
- Eclipse for Java
- Visual Studio
- FXCop
- etc.
2. Target values for cyclomatic complexity
In the above example, there are four independent paths. That would be a low level of complexity and, thus, a low probability of an error. The following areas are often distinguished:
- 1-10: Not complex, low risk of error
- 11-20: Medium complexity, moderate risk of error
- 21-50: High complexity, high probability of error
- > 50: Untestable system, very high probability of error
Manufacturers should determine the cyclomatic complexity per component or method to identify the “hot spots” where refactoring is most needed.
3. Regulatory background
There is no legal requirement to determine cyclomatic complexity. However, this McCabe metric is often considered to be state of the art.
The software standard IEC 62304 is decisive for medical devices. Chapter 5.5.3 requires that acceptance criteria be defined for software units and compliance with them be verified. One way to determine such acceptance criteria is to use software metrics. Cyclomatic complexity is a very meaningful metric for this purpose.
The decision to determine the McCabe number is made by the manufacturers either in a standard operation procedures or in a product- or project-specific development plans.
Read the article on development process versus development plans to determine which criteria you can use to divide requirements between the two document types.
Cyclomatic complexity is just one of many metrics. But the information it provides is a helpful heuristic for understanding the quality of a software development. Not determining this metric is also a statement.
Find out how to develop and verify your software units quickly and in compliance with standards in the compact seminar “Medical Software”.
Change history:
- 2024-09-19: Article fundamentally revised
- 2015-09-14: First version of article published
