system f formalization implementation writeing