Etienne Kneuss has posted about a dataflow type analysis tools he's created that models code as control flow graphs.

It will assign types and let them flow through control structures. When reaching stability, it will check that the operations done of the values are sound type-wise. It will also do some structural checks.

There's some more technical details here and a presentation here but if you want to get at the code, you can grab it off of the project's github page.