- Subroutines may not be well documented
- User must understand documentation
- Many subroutines: takes time to become familiar with the collection
- User may rewrite subroutine rather than reusing it
- User might make mistakes, e.g. wrong type of units of argument

* Constructive proof:* given a theorem * &forall x &exist y P(x,y) *,
prove it by constructing a * y * that satisfies the theorem.

* specification &rarr theorem &rarr proof &rarr program *