One important quantitative property of CPS (Cyber-Physical Systems) software
is its heap bound for which a precise analysis result needs to combine shape
analysis and numeric reasoning. In this paper, we present a framework for
statically finding symbolic heap bounds of CPS software. The basic idea is to
separate numeric reasoning from shape analysis by first constructing an ASTG
(Abstract State Transition Graph) and then extracting a pure numeric
representation which can be analyzed for the heap bounds. A quantitative
shape analysis method based on symbolic execution is defined in the framework
to generate the ASTG. The numeric representation is extracted based on
program slicing technique and inputted into an abstract interpretation tool
for computing the heap bounds. We take list manipulating programs as an
example to explain how to instantiate the framework for important data
structures and to exhibit its practicability. A novel list abstraction method
is also presented to support the instantiation of the framework.