Spin: Formal verification of multi-threaded code