Coq for formal method