Implement simple integer-based constraint for overall "strength"

Here's the code I am using at the moment, which is a simple port of the Drupal.evaluatePasswordStrength function from user.js to PHP:

<?php
function mymodule_password_strength($password, $username) {
  $weaknesses = 0; 
  $strength = 100;

  $hasLowercase = preg_match('/[a-z]+/', $password);
  $hasUppercase = preg_match('/[A-Z]+/', $password);
  $hasNumbers = preg_match('/[0-9]+/', $password);
  $hasPunctuation = preg_match('/[^a-zA-Z0-9]+/', $password);

  // Lose 5 points for every character less than 6, plus a 30 point penalty.
  if (strlen($password) < 6) {
    $strength -= ((6 - strlen($password)) * 5) + 30;
  }

  // Count weaknesses.
  if (!$hasLowercase) {
    $weaknesses++;
  }
  if (!$hasUppercase) {
    $weaknesses++;
  }
  if (!$hasNumbers) {
    $weaknesses++;
  }
  if (!$hasPunctuation) {
    $weaknesses++;
  }

  // Apply penalty for each weakness (balanced against length penalty).
  switch ($weaknesses) {
    case 1:
      $strength -= 12.5;
      break;

    case 2:
      $strength -= 25;
      break;

    case 3:
      $strength -= 40;
      break;

    case 4:
      $strength -= 40;
      break;
  }

  // Check if password is the same as the username.
  if ($password !== '' && strtolower($password) === strtolower($username)) {
    // Passwords the same as username are always very weak.
    $strength = 5;
  }

  return $strength;
  
}
?>

This has the advantage that we it's easy to integrate with the Drupal JS. I'd like to see something more mathematically rigorous but haven't had the time to investigate possible algos.

minor edit