Model-checking of a Multi-threaded Operating System ∗