Verification of an Implementation of Tomasulo's Algorithm by Compositional Model Checking