Three ways formally verified code can go wrong in practice