Formal verification of distributed mutual-exclusion circuits