LCF theorem prover