In 2007, Alberto Savoia and Bob Evans launched CRAP — Change Risk Anti-Patterns. The starting observation is linguistic: engineers inheriting bad code don’t say “the median cyclomatic complexity is unacceptable.” They say the code is crap. So they coined an acronym that matches the vocabulary of the people who need it, deliberately mildly offensive so it sticks.
The formula, CRAP1:
CRAP1(m) = comp(m)^2 × (1 - cov(m)/100)^3 + comp(m)
comp(m)is cyclomatic complexity;cov(m)is basis-path coverage from automated tests- Above 30, the method is considered CRAPpy
- The point is that it sorts methods by change risk — sort the list, talk about the top of it
The provenance is the interesting part. It wasn’t derived from theory. Savoia had source and JUnit tests for a large set of open-source and commercial Java projects, ranked code with a candidate formula, asked colleagues whether they agreed, and iterated until diminishing returns. The curve is a fit to human judgement — he says so plainly instead of dressing it up as a result.
The reasoning behind the shape: complex code is hard to test, so bad code tends to arrive with few or no tests. The presence of tests implies testability, which correlates with more thoughtful design, and that someone cared enough and had the time. He flags these as reasonable-sounding assumptions rather than proven ones.
He also lists what the metric doesn’t do — coverage without quality, intentionally complex code that beats three simpler methods, and no cohesion or coupling. Calling it “a start” is why it aged better than most complexity scoring. The metric spread anyway: ports to Java, .NET, Ruby, PHP, Maven and Ant, with appearance in Cobertura and Clover.