title: Why dynamic analysis can not cover all the execution path of a program?
body: <p>I am new in program analysis area and after reading some materials in this area, I have some questions which I can not find the corresponding answers..</p>
  
  <p>See, if I implement a tool :  symbolic execution + concrete execution
  just like <a href="http://research.microsoft.com/en-us/um/people/pg/public_psfiles/pldi2005.pdf" rel="nofollow">DART</a></p>
  
  <p>then I think it should cover all the execution path while keeping the dynamic analysis features..</p>
  
  <p>I am told that dynamic analysis can not cover all the execution path, but basically why? I think techniques like DART is quite mature now...</p>
  
  <p>Others, like model checking, theoretically guarantee 100% code coverage...am I right?</p>
  
  <p>Could anyone give me some help?  Thank you!</p>