Proof handling — Coq 8.12.0 documentation

\[\begin{split}\newcommand{\as}{\kw{as}} \newcommand{\Assum}[3]{\kw{Assum}(#1)(#2:#3)} \newcommand{\case}{\kw{case}} \newcommand{\cons}{\textsf{cons}} \newcommand{\consf}{\textsf{consf}} \newcommand{\Def}[4]{\kw{Def}(#1)(#2:=#3:#4)} \newcommand{\emptyf}{\textsf{emptyf}} \newcommand{\End}{\kw{End}} \newcommand{\kwend}{\kw{end}} \newcommand{\even}{\textsf{even}} \newcommand{\evenO}{\textsf{even}_\textsf{O}} \newcommand{\evenS}{\textsf{even}_\textsf{S}} \newcommand{\Fix}{\kw{Fix}} \newcommand{\fix}{\kw{fix}} \newcommand{\for}{\textsf{for}} \newcommand{\forest}{\textsf{forest}} \newcommand{\Functor}{\kw{Functor}} \newcommand{\In}{\kw{in}} \newcommand{\Ind}[4]{\kw{Ind}[#2](#3:=#4)} \newcommand{\ind}[3]{\kw{Ind}~[#1]\left(#2\mathrm{~:=~}#3\right)} \newcommand{\Indp}[5]{\kw{Ind}_{#5}(#1)[#2](#3:=#4)} \newcommand{\Indpstr}[6]{\kw{Ind}_{#5}(#1)[#2](#3:=#4)/{#6}} \newcommand{\injective}{\kw{injective}} \newcommand{\kw}[1]{\textsf{#1}} \newcommand{\length}{\textsf{length}} \newcommand{\letin}[3]{\kw{let}~#1:=#2~\kw{in}~#3} \newcommand{\List}{\textsf{list}} \newcommand{\lra}{\longrightarrow} \newcommand{\Match}{\kw{match}} \newcommand{\Mod}[3]{{\kw{Mod}}({#1}:{#2}\,\zeroone{:={#3}})} \newcommand{\ModA}[2]{{\kw{ModA}}({#1}=={#2})} \newcommand{\ModS}[2]{{\kw{Mod}}({#1}:{#2})} \newcommand{\ModType}[2]{{\kw{ModType}}({#1}:={#2})} \newcommand{\mto}{.\;} \newcommand{\nat}{\textsf{nat}} \newcommand{\Nil}{\textsf{nil}} \newcommand{\nilhl}{\textsf{nil\_hl}} \newcommand{\nO}{\textsf{O}} \newcommand{\node}{\textsf{node}} \newcommand{\nS}{\textsf{S}} \newcommand{\odd}{\textsf{odd}} \newcommand{\oddS}{\textsf{odd}_\textsf{S}} \newcommand{\ovl}[1]{\overline{#1}} \newcommand{\Pair}{\textsf{pair}} \newcommand{\plus}{\mathsf{plus}} \newcommand{\SProp}{\textsf{SProp}} \newcommand{\Prop}{\textsf{Prop}} \newcommand{\return}{\kw{return}} \newcommand{\Set}{\textsf{Set}} \newcommand{\Sort}{\mathcal{S}} \newcommand{\Str}{\textsf{Stream}} \newcommand{\Struct}{\kw{Struct}} \newcommand{\subst}[3]{#1\{#2/#3\}} \newcommand{\tl}{\textsf{tl}} \newcommand{\tree}{\textsf{tree}} \newcommand{\trii}{\triangleright_\iota} \newcommand{\Type}{\textsf{Type}} \newcommand{\WEV}[3]{\mbox{$#1[] \vdash #2 \lra #3$}} \newcommand{\WEVT}[3]{\mbox{$#1[] \vdash #2 \lra$}\\ \mbox{$ #3$}} \newcommand{\WF}[2]{{\mathcal{W\!F}}(#1)[#2]} \newcommand{\WFE}[1]{\WF{E}{#1}} \newcommand{\WFT}[2]{#1[] \vdash {\mathcal{W\!F}}(#2)} \newcommand{\WFTWOLINES}[2]{{\mathcal{W\!F}}\begin{array}{l}(#1)\\\mbox{}[{#2}]\end{array}} \newcommand{\with}{\kw{with}} \newcommand{\WS}[3]{#1[] \vdash #2 <: #3} \newcommand{\WSE}[2]{\WS{E}{#1}{#2}} \newcommand{\WT}[4]{#1[#2] \vdash #3 : #4} \newcommand{\WTE}[3]{\WT{E}{#1}{#2}{#3}} \newcommand{\WTEG}[2]{\WTE{\Gamma}{#1}{#2}} \newcommand{\WTM}[3]{\WT{#1}{}{#2}{#3}} \newcommand{\zeroone}[1]{[{#1}]} \end{split}\]

# Proof handling

In Coq’s proof editing mode all top-level commands documented in Chapter Vernacular commands remain available and the user has access to specialized commands dealing with proof development pragmas documented in this section. They can also use some other specialized commands called tactics. They are the very tools allowing the user to deal with logical reasoning. They are documented in Chapter Tactics.

Coq user interfaces usually have a way of marking whether the user has switched to proof editing mode. For instance, in coqtop the prompt `Coq <` is changed into `ident <` where `ident` is the declared name of the theorem currently edited.

At each stage of a proof development, one has a list of goals to prove. Initially, the list consists only in the theorem itself. After having applied some tactics, the list of goals contains the subgoals generated by the tactics.

To each subgoal is associated a number of hypotheses called the local context of the goal. Initially, the local context contains the local variables and hypotheses of the current section (see Section Assumptions) and the local variables and hypotheses of the theorem statement. It is enriched by the use of certain tactics (see e.g. `intro`).

When a proof is completed, the message `Proof completed` is displayed. One can then register this proof as a defined constant in the environment. Because there exists a correspondence between proofs and terms of λ-calculus, known as the Curry-Howard isomorphism [How80][Bar81][GLT89][Hue89], Coq stores proofs as terms of CIC. Those terms are called proof terms.

Error `No focused proof.`

  Coq raises this error message when one attempts to use a proof editing command out of the proof editing mode.

## Entering and leaving proof editing mode

The proof editing mode is entered by asserting a statement, which typically is the assertion of a theorem using an assertion command like `Theorem`. The list of assertion commands is given in Assertions and proofs. The command `Goal` can also be used.

Command `Goal form`

  This is intended for quick assertion of statements, without knowing in advance which name to give to the assertion, typically for quick testing of the provability of a statement. If the proof of the statement is eventually completed and validated, the statement is then bound to the name `Unnamed_thm` (or a variant of this name not already used for another statement).

Command `Qed`

  This command is available in interactive editing proof mode when the proof is completed. Then `Qed` extracts a proof term from the proof script, switches back to Coq top-level and attaches the extracted proof term to the declared name of the original goal. This name is added to the environment as an opaque constant.

  Error `Attempt to save an incomplete proof.`

  Note

  Sometimes an error occurs when building the proof term, because tactics do not enforce completely the term construction constraints.

  The user should also be aware of the fact that since the proof term is completely rechecked at this point, one may have to wait a while when the proof is large. In some exceptional cases one may even incur a memory overflow.

Command `Defined`

  Same as `Qed`, except the proof is made transparent, which means that its content can be explicitly used for type checking and that it can be unfolded in conversion tactics (see Performing computations, `Opaque`, `Transparent`).

Command `Save ident`

  Saves a completed proof with the name `ident`.

Command `Admitted`

  This command is available in interactive editing mode to give up the current proof and declare the initial goal as an axiom.

Command `Abort`

  This command cancels the current proof development, switching back to the previous proof development, or to the Coq toplevel if no other proof was edited.

  Error `No focused proof (No proof-editing in progress).`
  Variant `Abort ident`

    Aborts the editing of the proof named `ident` (in case you have nested proofs).

    See also

    `Nested Proofs Allowed`

  Variant `Abort All`

    Aborts all current goals.

Command `Proof term`

  This command applies in proof editing mode. It is equivalent to `exact term. Qed.` That is, you have to give the full proof in one gulp, as a proof term (see Section Applying theorems).

  Warning

  Use of this command is discouraged. In particular, it doesn't work in Proof General because it must immediately follow the command that opened proof mode, but Proof General inserts `Unset` `Silent` before it (see Proof General issue #498).

Command `Proof`

  Is a no-op which is useful to delimit the sequence of tactic commands which start a proof, after a `Theorem` command. It is a good practice to use `Proof` as an opening parenthesis, closed in the script with a closing `Qed`.

  See also

  `Proof with`

Command `Proof using ident+`

  This command applies in proof editing mode. It declares the set of section variables (see Assumptions) used by the proof. At `Qed` time, the system will assert that the set of section variables actually used in the proof is a subset of the declared one.

  The set of declared variables is closed under type dependency. For example, if `T` is a variable and `a` is a variable of type `T`, then the commands `Proof using a` and `Proof using T a` are equivalent.

  Variant `Proof using ident+ with tactic`

    Combines in a single line `Proof with` and `Proof using`.

    See also

    Setting implicit automation tactics

  Variant `Proof using All`

    Use all section variables.

  Variant `Proof using Type?`

    Use only section variables occurring in the statement.

  Variant `Proof using Type*`

    The `*` operator computes the forward transitive closure. E.g. if the variable `H` has type `p < 5` then `H` is in `p*` since `p` occurs in the type of `H`. `Type*` is the forward transitive closure of the entire set of section variables occurring in the statement.

  Variant `Proof using -(ident+)`

    Use all section variables except the list of `ident`.

  Variant `Proof using collection1 + collection2`

    Use section variables from the union of both collections. See Name a set of section hypotheses for Proof using to know how to form a named collection.

  Variant `Proof using collection1 - collection2`

    Use section variables which are in the first collection but not in the second one.

  Variant `Proof using collection - (ident+)`

    Use section variables which are in the first collection but not in the list of `ident`.

  Variant `Proof using collection *`

    Use section variables in the forward transitive closure of the collection. The `*` operator binds stronger than `+` and `-`.

### Proof using options

The following options modify the behavior of `Proof using`.

Option `Default Proof Using "collection"`

  Use `collection` as the default `Proof using` value. E.g. `Set Default Proof Using "a b"` will complete all `Proof` commands not followed by a `using` part with `using a b`.

Flag `Suggest Proof Using`

  When `Qed` is performed, suggest a `using` annotation if the user did not provide one.

### Name a set of section hypotheses for `Proof using`

Command `Collection ident := collection`

  This can be used to name a set of section hypotheses, with the purpose of making `Proof using` annotations more compact.

  Example

  Define the collection named `Some` containing `x`, `y` and `z`:

      Collection Some := x y z.

  Define the collection named `Fewer` containing only `x` and `y`:

      Collection Fewer := Some - z

  Define the collection named `Many` containing the set union or set difference of `Fewer` and `Some`:

      Collection Many := Fewer + Some
      Collection Many := Fewer - Some

  Define the collection named `Many` containing the set difference of `Fewer` and the unnamed collection `x y`:

      Collection Many := Fewer - (x y)

Command `Existential num := term`

  This command instantiates an existential variable. `num` is an index in the list of uninstantiated existential variables displayed by `Show Existentials`.

  This command is intended to be used to instantiate existential variables when the proof is completed but some uninstantiated existential variables remain. To instantiate existential variables during proof edition, you should use the tactic `instantiate`.

Command `Grab Existential Variables`

  This command can be run when a proof has no more goal to be solved but has remaining uninstantiated existential variables. It takes every uninstantiated existential variable and turns it into a goal.

### Proof modes

When entering proof mode through commands such as `Goal` and `Proof`, Coq picks by default the `L`tac mode. Nonetheless, there exist other proof modes shipped in the standard Coq installation, and furthermore some plugins define their own proof modes. The default proof mode used when opening a proof can be changed using the following option.

Option `Default Proof Mode string`

  Select the proof mode to use when starting a proof. Depending on the proof mode, various syntactic constructs are allowed when writing an interactive proof. The possible option values are listed below.

  - "Classic": this is the default. It activates the `L`tac language to interact with the proof, and also allows vernacular commands.

  - "Noedit": this proof mode only allows vernacular commands. No tactic language is activated at all. This is the default when the prelude is not loaded, e.g. through the `-noinit` option for `coqc`.

  - "Ltac2": this proof mode is made available when requiring the Ltac2 library, and is set to be the default when it is imported. It allows to use the Ltac2 language, as well as vernacular commands.

  - Some external plugins also define their own proof mode, which can be activated via this command.

## Navigation in the proof tree

Command `Undo`

  This command cancels the effect of the last command. Thus, it backtracks one step.

Variant `Undo num`

  Repeats Undo `num` times.

Variant `Restart`

  This command restores the proof editing process to the original goal.

  Error `No focused proof to restart.`

Command `Focus`

  This focuses the attention on the first subgoal to prove and the printing of the other subgoals is suspended until the focused subgoal is solved or unfocused. This is useful when there are many current subgoals which clutter your screen.

  Deprecated since version 8.8: Prefer the use of bullets or focusing brackets (see below).

Variant `Focus num`

  This focuses the attention on the `num` th subgoal to prove.

  Deprecated since version 8.8: Prefer the use of focusing brackets with a goal selector (see below).

Command `Unfocus`

  This command restores to focus the goal that were suspended by the last `Focus` command.

  Deprecated since version 8.8.

Command `Unfocused`

  Succeeds if the proof is fully unfocused, fails if there are some goals out of focus.

Command `{​}`

  > The command `{` (without a terminating period) focuses on the first goal, much like `Focus` does, however, the subproof can only be unfocused when it has been fully solved ( i.e. when there is no focused goal left). Unfocusing is then handled by `}` (again, without a terminating period). See also an example in the next section.

  > Note that when a focused goal is proved a message is displayed together with a suggestion about the right bullet or `}` to unfocus it or focus the next one.

  > Variant `num: {`

  >   This focuses on the `num`-th subgoal to prove.

  > Variant `[ident]: {`

  >   This focuses on the named goal `ident`.

  >   Note

  >   Goals are just existential variables and existential variables do not get a name by default. You can give a name to a goal by using `refine ?[ident]`. You may also wrap this in an Ltac-definition like:

  >   Ltac name_goal name := refine ?[name].
  >     name_goal is defined

  >   See also

  >   Existential variables

  >   Example

  >   This first example uses the Ltac definition above, and the named goals only serve for documentation.

  >   Goal forall n, n + 0 = n.
  >     1 subgoal ============================ forall n : nat, n + 0 = n
  >   Proof.
  >   induction n; [ name_goal base | name_goal step ].
  >     2 subgoals ============================ 0 + 0 = 0 subgoal 2 is: S n + 0 = S n
  >   [base]: {
  >     1 subgoal ============================ 0 + 0 = 0
  >   reflexivity.
  >     This subproof is complete, but there are some unfocused goals. Try unfocusing with "}". 1 subgoal subgoal 1 is: S n + 0 = S n
  >   }
  >     1 subgoal n : nat IHn : n + 0 = n ============================ S n + 0 = S n
  >   [step]: {
  >     1 subgoal n : nat IHn : n + 0 = n ============================ S n + 0 = S n
  >   simpl.
  >     1 subgoal n : nat IHn : n + 0 = n ============================ S (n + 0) = S n
  >   f_equal.
  >     1 subgoal n : nat IHn : n + 0 = n ============================ n + 0 = n
  >   assumption.
  >     No more subgoals.
  >   } Qed.
  >     No more subgoals.

  >   This can also be a way of focusing on a shelved goal, for instance:

  >   Goal exists n : nat, n = n.
  >     1 subgoal ============================ exists n : nat, n = n
  >   eexists ?[x].
  >     1 focused subgoal (shelved: 1) ============================ ?x = ?x
  >   reflexivity.
  >     All the remaining goals are on the shelf. 1 subgoal subgoal 1 is: nat
  >   [x]: exact 0.
  >     No more subgoals.
  >   Qed.
  > Error `This proof is focused, but cannot be unfocused this way.`

  >   You are trying to use `}` but the current subproof has not been fully solved.

  > Error `No such goal (num).`
  > Error `No such goal (ident).`
  > Error `Brackets do not support multi-goal selectors.`

  >   Brackets are used to focus on a single goal given either by its position or by its name if it has one.

  See also

  The error messages about bullets below.

### Bullets

Alternatively to `{` and `}`, proofs can be structured with bullets. The use of a bullet `b` for the first time focuses on the first goal `g`, the same bullet cannot be used again until the proof of `g` is completed, then it is mandatory to focus the next goal with `b`. The consequence is that `g` and all goals present when `g` was focused are focused with the same bullet `b`. See the example below.

Different bullets can be used to nest levels. The scope of bullet does not go beyond enclosing `{` and `}`, so bullets can be reused as further nesting levels provided they are delimited by these. Bullets are made of repeated `-`, `+` or `*` symbols:

bullet`::=`-+​++​*+

Note again that when a focused goal is proved a message is displayed together with a suggestion about the right bullet or `}` to unfocus it or focus the next one.

Note

In Proof General (`Emacs` interface to Coq), you must use bullets with the priority ordering shown above to have a correct indentation. For example `-` must be the outer bullet and `**` the inner one in the example below.

The following example script illustrates all these features:

Example

Goal (((True /\ True) /\ True) /\ True) /\ True.
  1 subgoal ============================ (((True /\ True) /\ True) /\ True) /\ True
Proof.
split.
  2 subgoals ============================ ((True /\ True) /\ True) /\ True subgoal 2 is: True
- split.
  1 subgoal ============================ ((True /\ True) /\ True) /\ True 2 subgoals ============================ (True /\ True) /\ True subgoal 2 is: True
+ split.
  1 subgoal ============================ (True /\ True) /\ True 2 subgoals ============================ True /\ True subgoal 2 is: True
** { split.
  1 subgoal ============================ True /\ True 1 subgoal ============================ True /\ True 2 subgoals ============================ True subgoal 2 is: True
- trivial.
  1 subgoal ============================ True This subproof is complete, but there are some unfocused goals. Focus next goal with bullet -. 4 subgoals subgoal 1 is: True subgoal 2 is: True subgoal 3 is: True subgoal 4 is: True
- trivial.
  1 subgoal ============================ True This subproof is complete, but there are some unfocused goals. Try unfocusing with "}". 3 subgoals subgoal 1 is: True subgoal 2 is: True subgoal 3 is: True
} ** trivial.
  This subproof is complete, but there are some unfocused goals. Focus next goal with bullet **. 3 subgoals subgoal 1 is: True subgoal 2 is: True subgoal 3 is: True 1 subgoal ============================ True This subproof is complete, but there are some unfocused goals. Focus next goal with bullet +. 2 subgoals subgoal 1 is: True subgoal 2 is: True
+ trivial.
  1 subgoal ============================ True This subproof is complete, but there are some unfocused goals. Focus next goal with bullet -. 1 subgoal subgoal 1 is: True
- assert True.
  1 subgoal ============================ True 2 subgoals ============================ True subgoal 2 is: True
{ trivial. } assumption.
  1 subgoal ============================ True This subproof is complete, but there are some unfocused goals. Try unfocusing with "}". 1 subgoal subgoal 1 is: True 1 subgoal H : True ============================ True No more subgoals.
Qed.

Error `Wrong bullet bullet1: Current bullet bullet2 is not finished.`

  Before using bullet `bullet1` again, you should first finish proving the current focused goal. Note that `bullet1` and `bullet2` may be the same.

Error `Wrong bullet bullet1: Bullet bullet2 is mandatory here.`

  You must put `bullet2` to focus on the next goal. No other bullet is allowed here.

Error `No such goal. Focus next goal with bullet bullet.`

  You tried to apply a tactic but no goals were under focus. Using `bullet` is mandatory here.

Error `No such goal. Try unfocusing with }.`

  You just finished a goal focused by `{`, you must unfocus it with `}`.

### Mandatory Bullets

Using `Default Goal Selector` with the `!` selector forces tactic scripts to keep focus to exactly one goal (e.g. using bullets) or use explicit goal selectors.

### Set Bullet Behavior

Option `Bullet Behavior "None"​"Strict Subproofs"`

  This option controls the bullet behavior and can take two possible values:

  - "None": this makes bullets inactive.

  - "Strict Subproofs": this makes bullets active (this is the default behavior).

## Requesting information

Command `Show`

  This command displays the current goals.

  Error `No focused proof.`
  Variant `Show num`

    Displays only the `num`-th subgoal.

    Error `No such goal.`
  Variant `Show ident`

    Displays the named goal `ident`. This is useful in particular to display a shelved goal but only works if the corresponding existential variable has been named by the user (see Existential variables) as in the following example.

    Example

    Goal exists n, n = 0.
      1 subgoal ============================ exists n : nat, n = 0
    eexists ?[n].
      1 focused subgoal (shelved: 1) ============================ ?n = 0
    Show n.
      subgoal n is: ============================ nat
  Variant `Show Proof Diffs removed??`

    Displays the proof term generated by the tactics that have been applied so far. If the proof is incomplete, the term will contain holes, which correspond to subterms which are still to be constructed. Each hole is an existential variable, which appears as a question mark followed by an identifier.

    Experimental: Specifying “Diffs” highlights the difference between the current and previous proof step. By default, the command shows the output once with additions highlighted. Including “removed” shows the output twice: once showing removals and once showing additions. It does not examine the `Diffs` option. See Showing differences between proof steps.

  Variant `Show Conjectures`

    It prints the list of the names of all the theorems that are currently being proved. As it is possible to start proving a previous lemma during the proof of a theorem, this list may contain several names.

  Variant `Show Intro`

    If the current goal begins by at least one product, this command prints the name of the first product, as it would be generated by an anonymous `intro`. The aim of this command is to ease the writing of more robust scripts. For example, with an appropriate Proof General macro, it is possible to transform any anonymous `intro` into a qualified one such as `intro y13`. In the case of a non-product goal, it prints nothing.

  Variant `Show Intros`

    This command is similar to the previous one, it simulates the naming process of an `intros`.

  Variant `Show Existentials`

    Displays all open goals / existential variables in the current proof along with the type and the context of each variable.

  Variant `Show Match ident`

    This variant displays a template of the Gallina `match` construct with a branch for each constructor of the type `ident`

    Example

    Show Match nat.
      match # with | O => | S x => end
    Error `Unknown inductive type.`
  Variant `Show Universes`

    It displays the set of all universe constraints and its normalized form at the current stage of the proof, useful for debugging universe inconsistencies.

  Variant `Show Goal num at num`

    This command is only available in coqtop. Displays a goal at a proof state using the goal ID number and the proof state ID number. It is primarily for use by tools such as Prooftree that need to fetch goal history in this way. Prooftree is a tool for visualizing a proof as a tree that runs in Proof General.

Command `Guarded`

  Some tactics (e.g. `refine`) allow to build proofs using fixpoint or co-fixpoint constructions. Due to the incremental nature of interactive proof construction, the check of the termination (or guardedness) of the recursive calls in the fixpoint or cofixpoint constructions is postponed to the time of the completion of the proof.

  The command `Guarded` allows checking if the guard condition for fixpoint and cofixpoint is violated at some time of the construction of the proof without having to wait the completion of the proof.

## Showing differences between proof steps

Coq can automatically highlight the differences between successive proof steps and between values in some error messages. Also, as an experimental feature, Coq can also highlight differences between proof steps shown in the `Show Proof` command, but only, for now, when using coqtop and Proof General.

For example, the following screenshots of CoqIDE and coqtop show the application of the same `intros` tactic. The tactic creates two new hypotheses, highlighted in green. The conclusion is entirely in pale green because although it’s changed, no tokens were added to it. The second screenshot uses the "removed" option, so it shows the conclusion a second time with the old text, with deletions marked in red. Also, since the hypotheses are new, no line of old text is shown for them.

This image shows an error message with diff highlighting in CoqIDE:

### How to enable diffs

Option `Diffs "on"​"off"​"removed"`

  The “on” setting highlights added tokens in green, while the “removed” setting additionally reprints items with removed tokens in red. Unchanged tokens in modified items are shown with pale green or red. Diffs in error messages use red and green for the compared values; they appear regardless of the setting. (Colors are user-configurable.)

For coqtop, showing diffs can be enabled when starting coqtop with the `-diffs on|off|removed` command-line option or by setting the `Diffs` option within Coq. You will need to provide the `-color on|auto` command-line option when you start coqtop in either case.

Colors for coqtop can be configured by setting the `COQ_COLORS` environment variable. See section By environment variables. Diffs use the tags `diff.added`, `diff.added.bg`, `diff.removed` and `diff.removed.bg`.

In CoqIDE, diffs should be enabled from the `View` menu. Don’t use the `Set Diffs` command in CoqIDE. You can change the background colors shown for diffs from the `Edit | Preferences | Tags` panel by changing the settings for the `diff.added`, `diff.added.bg`, `diff.removed` and `diff.removed.bg` tags. This panel also lets you control other attributes of the highlights, such as the foreground color, bold, italic, underline and strikeout.

As of June 2019, Proof General can also display Coq-generated proof diffs automatically. Please see the PG documentation section "Showing Proof Diffs") for details.

### How diffs are calculated

Diffs are calculated as follows:

1. Select the old proof state to compare to, which is the proof state before the last tactic that changed the proof. Changes that only affect the view of the proof, such as `all: swap 1 2`, are ignored.

2. For each goal in the new proof state, determine what old goal to compare it to—the one it is derived from or is the same as. Match the hypotheses by name (order is ignored), handling compacted items specially.

3. For each hypothesis and conclusion (the “items”) in each goal, pass them as strings to the lexer to break them into tokens. Then apply the Myers diff algorithm [Mye86] on the tokens and add appropriate highlighting.

Notes:

- Aside from the highlights, output for the "on" option should be identical to the undiffed output.

- Goals completed in the last proof step will not be shown even with the "removed" setting.

This screen shot shows the result of applying a `split` tactic that replaces one goal with 2 goals. Notice that the goal `P 1` is not highlighted at all after the split because it has not changed.

This is how diffs may appear after applying a `intro` tactic that results in compacted hypotheses:

## Controlling the effect of proof editing commands

Option `Hyps Limit num`

  This option controls the maximum number of hypotheses displayed in goals after the application of a tactic. All the hypotheses remain usable in the proof development. When unset, it goes back to the default mode which is to print all available hypotheses.

Flag `Nested Proofs Allowed`

  When turned on (it is off by default), this flag enables support for nested proofs: a new assertion command can be inserted before the current proof is finished, in which case Coq will temporarily switch to the proof of this nested lemma. When the proof of the nested lemma is finished (with `Qed` or `Defined`), its statement will be made available (as if it had been proved before starting the previous proof) and Coq will switch back to the proof of the previous assertion.

## Controlling memory usage

When experiencing high memory usage the following commands can be used to force Coq to optimize some of its internal data structures.

Command `Optimize Proof`

  This command forces Coq to shrink the data structure used to represent the ongoing proof.

Command `Optimize Heap`

  This command forces the OCaml runtime to perform a heap compaction. This is in general an expensive operation. See: OCaml Gc There is also an analogous tactic `optimize_heap`.

Other versions v: 8.12.0

Versions
  dev
  stable
  v8.12
  8.11
  8.10
  8.9
  8.8
  8.7
  8.6
  8.5
  8.4
  8.3
  8.2
  8.1
  8.0

Downloads
  PDF