In the IT World we have had, over time, many examples of correct models but incorrect implementations.
An example? You think about implementing Wep key-based authentication in Wifi solutions. The reference mathematical model is correct but the implementation of the RC4 cipher is incorrect (see IV attack).