The job of formal methods is to elucidate the assumptions upon which formal correctness depends.

I was eventually persuaded of the need to design programming notations so as to maximize the number of errors which cannot be made, or if made, can be reliably detected at compile time.

The price of reliability is the pursuit of the utmost simplicity. It is a price which the very rich may find hard to pay.

The job of formal methods is to elucidate the assumptions upon which formal correctness depends.

Some problems are better evaded than solved.

You cannot teach beginners top-down programming, because they don't know which end is up.

The unavoidable price of reliability is simplicity.