LCL and UCL are actually pretty easy to calculate. They are 3 standard deviations from the mean. So you need the mean, first.
Here are the formulas
Mean
Sum(I=1 to n, Metric[I]) / Sum(I=1 to n, size of Item[I])
Upper Control Limit (UCL)
Mean + 3*Sqrt( Mean / Average item size)
Lower Control Limit (LCL)
Mean - 3*Sqrt( Mean / Maximum item size)
LCL is never allowed to be less than zero
“Maximum item size” makes LCL more sensitive
v
However, LCL, UCL and mean are only meaningful for something that is repeatable. They come from manufacturing, where you're making more of the same thing day after day. The subject area is called 'statistical process control'. So, in software, for example, one use is looking at inspections. Organizations that do software inspections tend to do a lot of them, and the process is (at least in theory) repeatable. So you can plot a series of inspections and calculate the mean - say the average defects per thousand lines of code, or defects per standard page. Or anything else related to the inspection that you think is important enough to plot. And then you can calculate UCL and LCL.
Here are a couple of references to using UCL and LCL to plot inspection data:
Robert Ebenau,
“Predictive Quality Control with Software Inspections”, CrossTalk, Vol 7, Issue 6, June, 1994. Also in David Wheeler, Bill Brykczynski, Reginald Meeson, Software Inspection - An Industry Best Practice, IEEE Computer Society Press, 1996.
Susan Strauss, Robert Ebenau, Software Inspection Process, McGraw-Hill, 1994.
The reason we use UCL and LCL is that statistically, there should be only 3 out of a thousand observations that are outside the limits shown by UCL and LCL, i.e. 3 out of a thousand would be either higher than the UCL or lower than the LCL. So in data that is naturally variable, it gives you a way to see which observations are within the normal range of variation and which are so far out that it's at least possible that something unusual (and therefore interesting) might have been happening - and could be analyzed and fixed.
There isn't a lot we do in software that is truly repeatable - someone is doing exactly the same process day after day.
One book on software measurement that has a statistical process control point of view is