I ended up writing my own for the bespoke language my company uses internally. The lack of tools like java findbugs had been annoying me. Luckily the server si

I ended up writing my own for the bespoke language my company uses internally. The lack of tools like java findbugs had been annoying me. Luckily the server side 'workflow' language, and the client side templates are all written in xml, so its trivial to parse. The first version was painfully slow. The second version tracked the range of possible states as it did a depth first search of the AST, and then stored the requirements of each node of the tree before it moved on to the nodes next sibling or parent. That way if another part of the software later called into an equivalent subtree, I could compare the current range of possible states to the requirements of the first node in the subtree and record any mismatches, then move on. It went from taking over a minute to evaluate a fairly trivial app, to parsing the biggest apps my company has ever shipped in 1-2 seconds. I'm sure the technique is quite common. I wish I could remember if I read about it, or applied it from a different context. In any case the exercise was more useful for learning than as a finished product.