This is actually a rare instance of the grain of salt being unnecessary. Depending on the type system, it is possible for it to guarantee that the only source of error be in your specification and not in your implementation.