The price of reliability is the pursuit of the utmost simplicity. It is a price which the very rich may find hard to pay.

There are two ways of constructing a software design: One way is to make it so simple that there are obviously no deficiencies, and the other way is to make it so complicated that there are no obvious deficiencies. The first method is far more difficult.

The job of formal methods is to elucidate the assumptions upon which formal correctness depends.

In the development of the understanding of complex phenomena, the most powerful tool available to the human intellect is abstraction. Abstraction arises from the recognition of similarities between certain objects, situations, or processes in the real world and the decision to concentrate on these similarities and to ignore, for the time being, their differences.

Inside every large program is a small program struggling to get out.

You cannot teach beginners top-down programming, because they don't know which end is up.

The real value of tests is not that they detect bugs in the code but that they detect inadequacies in the methods, concentration, and skills of those who design and produce the code.