Klocwork's complexity index quantifies the risk associated with developing and maintaining overly complex source code. Assessing risk due to complexity permits you to:
- Reduce the cost of testing and inspection regimens.
- Assess overall code quality and reliability.
- Provide additional information for estimating development and future maintenance efforts.
How complexity is measured
The index is a statistical measure calculated using key complexity characteristics, which predict the magnitude of risk. These characteristics are:
- Number of independent paths
A large number of paths indicates potential testability issues or a high degree of branching, both of which are associated with latent faults.
- Maximum nesting level
A high degree of nesting is often associated with a large state space and cognitive overload. Changes to code in this condition are often precarious.
- File includes
An inordinate number of includes indicates a significant potential for dependency-related issues, such as type and macro evolution, declarations and order-of-events.
- Number of operands
A large number of operands hinder correctness when updating or modifying software because of improper parameter manipulation and symbol referencing, misinterpretation of complex statements, incorrect coding of constants, etc. Number of operands also indicates overall size, which predicts general faults, assuming constant fault density.
- Number of functions
The number of functions indicates overall size, which, as with number of operands, predicts faults. A large number accompanied by low cohesion (a measure of the relatedness of source code) may indicate poor programming practices such as strong coupling.
Each of these characteristics is scaled according to its tolerable frequency (many more operands, for example, are tolerable than include files) and summed into an overall complexity risk probability.
Application
The Klocwork complexity risk index is reported at the file-level with ID = 34 and Metric Code = “Risk”. Calculated probabilities below .1 are considered low; those above .3, high. As with all metrics, the reporting threshold is adjustable.
