Type-driven design in automotive C: how much of my code is manual type checking?