MDD-based Verification of Car Manufacturing Data

Rudiger Berndt Peter BazanComputer Networks and Communication Systems

Friedrich-Alexander University of Erlangen-NurembergErlangen, Germany

{berndt, peter.bazan, hielscher}@informatik.uni-erlangen.de

Kai-Steffen Hielscher

Abstract—In order to satisfy the growing demand for indi-vidualization within the automotive sector, the concept of masscustomization has been continuously evolving over the pastyears. As a consequence, the complexity within the underlyingdata structures has been steadily increasing. In this article weintroduce an approach of how to ensure consistency within carmanufacturing data with the help of a Multi-Valued DecisionDiagram (MDD). The data basis of the car manufacturingapplication is not derived from higher level models andtherefore lacks structural information. For large real worldapplications, the corresponding MDD cannot be constructeddue to memory limitations even if well-known dynamic variablereordering techniques are used. Therefore, a combination ofthree dynamic variable reordering approaches and the sortingof the sequence of data compilation are introduced. Using thisalgorithm, the decision diagram can now be constructed witha low memory consumption in reasonable time.

Keywords-multi-valued decision diagram; product configura-tion; car manufacturing; verification; variable ordering;

I. INTRODUCTION

Car manufacturing can be characterized as the serial pro-duction of objects that consist of numerous composite parts.The importance of mass-customization—which combinesboth, the benefits of mass production along with possibilitiesto customize products—has continuously evolved due to thegrowing demand for individualization and thus customersatisfaction. This in turn results in an increasing complexitywithin the involved processes, information and data. Duringthe stages of the product development cycle of cars, arich variety of data and information emerges. Herlyn [1]introduces product description layers to represent differentperspectives on products with a wide diversity of variance.Data and information which are involved in the productlayer constitute the basis for the communication betweencompany and customers. It carries information about theproduct range, the respective derivates as well as all availableequipment options. The configuration of a product is obtainedby specifying its attributes like, for example, the size or color.Thus each product configuration, i.e. customer order, containsa fixed number of attributes which unambiguously describesthe set of features of a product. The product configurationdata also incorporate a set of constraints which are used toexpress that certain attribute combinations are not valid, for

example due to technical or legal restrictions.The technical information, also bill of materials (BOM),

contains information about the parts, sub-assemblies and theirmutual structural relationships and serves as the fundamentfor the planning of logistical and manufacturing processes.Each part may be connected to a constraint to control thenecessity for manufacture with respect to a given customerorder.

In order to ensure consistency with regard to the constraintswithin the configuration data and the constraints within theBOM, we developed a verification method based upon thecomplete set of valid product configurations which has beenencoded by using a Multi-Valued Decision Diagram.

The size of the resulting MDD structure depends onthe variable ordering, i.e. the arrangement of layers withinthe diagram. Static optimization approaches use heuristicsor information about the model structure to find a goodordering of the variables a priori. In contrast to that, dynamicapproaches use reordering mechanisms while the constructionis in progress. This in turn allows to alter the arrangementof layers and to influence the size of the resulting structure.

MDDs are used in different fields of application includingmodel-checking, performance analysis or hardware andsoftware design verification. In performance evaluation, acompact representation of the state space of Markoviansystems can often be achieved using MDDs. Markov models,among others, are derived from higher level descriptionsof the system and the contained structural informationcan give hints about an optimized variable order a priori.The data basis of the car manufacturing application lacksthis structural information. Even when using well-knowndynamic reordering approaches, the MDD for the presentedapplication cannot be constructed. This has already beenstated by other authors, for example in [2]. Therefore, a newalgorithm, which combines different reordering techniques ofthe variables as well as the sequence of constraint compilation,has been developed.

The outline of the paper is as follows. In the followingsection we will discuss related work. In section III, we willintroduce the involved information and data within the carmanufacturing domain. There, we provide an explanation ofthe underlying configuration data, first (III-A). Afterwards,

2011 Third International Conference on Computational Intelligence, Modelling & Simulation

978-0-7695-4562-2/11 $26.00 © 2011 IEEE

DOI 10.1109/CIMSim.2011.40

187

a description of the technical information (BOM) is given(III-B). We let this section be finished by a small introductoryexample (III-C). The following section IV deals with theverification approach. There, first the rules of consistencyare stated (IV-A). Afterwards, we continue by explaining theapproach of how to encode the set of valid configurations(IV-B). Before describing the actual verification approach,the subsequent section deals with the problem of memoryconsumption and variable order of the MDD structure (IV-C).Thereafter, the verification method is described and the resultsare presented. Finally, in section V, we will draw a conclusionand provide an outlook on further research activities.

II. RELATED WORK

The problem of ensuring consistent automotive configu-ration data is addressed in [3]. It contains a comprehensiveoverview of the respective application domain and a formal-ization of the relevant information. The authors introduce aconsistency tool, BIS, which is able to detect inconsistencieswithin a set of Boolean constraints. Furthermore, a modifica-tion of the SAT-solver technique is introduced which fits therequirements of the application field. Approaches to detectchanges within the set of required parts, induced for exampledue to changes of the product or productive environment, aredescribed as well. In [4], a method to solve the problem ofinteractive configuration is presented. The authors describe atwo-phase approach in order to avoid time-consuming searcheffort in the configuration process. The offline phase yieldsa pre-compiled binary decision diagram that represents thespace of solutions, i.e. valid configurations, and constitutesthe basis for the online phase where the actual configuration,i.e. the assignment of values to variables, takes place. Doingso allows for moving the computational effort to the offlinephase.

In [5], an overview of AND/OR multi-valued decisiondiagrams as a compiled data structure for constraint networksis given. Decision diagrams in general and especially theproblem of optimal orders within the set of variables arecovered in many scientific articles. Finding an optimal orderfor binary or multi-valued decision diagrams is known tobe NP-complete [6]. A survey of static variable orders, i.e.heuristic techniques to establish a good variable arrangementprior to the actual state space exploration, is presented in [7].SMART, for example, is a tool using static variable orderingtechniques presented in [8].

Dynamic variable ordering is achieved by swapping twoadjacent variables in a decision diagram. Algorithms thatrestrict successive swaps to a window of a maximal and aminimal level are presented in [9] and [10]. By performingall variable permutations on this window, a local optimizationis achieved. The window is then moved over the levels of thewhole decision diagram. The sifting algorithm [11] widensthe window without increasing the computational effort, butonly moves one variable up or down, respectively. Beside

these two basic techniques, many other algorithms havebeen proposed. Freely distributed software packages withimplemented variable ordering algorithms are for examplethe Colorado University Decision Diagram Package (CUDD)[12] and JINC [13].

III. MANUFACTURING DATA

The following section introduces the information and datawithin our manufacturing domain. In order to handle masscustomization and variance within the involved informationand processes, attributes to encode product configurationsare used. We provide an introduction to this concept first.

A. Product Configuration Data

The configuration of a product is encoded by a set ofdistinct attributes. Due to the fact that subsets of attributesencode similar features—e.g. the color can either be blue,red or green—a partition on the set of attributes is induced.First we denote the terms attribute, feature and configurationas follows.

Let the finite, non-empty set of distinct symbols A :={a1, . . . , an} be referred to as the set of attributes. Moreover,let a partition F := {F1, . . . , Fm} of A be given. F isreferred to as the set of features. For a given A and F wedenote

W := F1 × · · · × Fm (1)

as the set of configurations. The total number of configura-tions is therefore given by

|W | :=∏

1≤i≤m

|Fi|. (2)

Next, we introduce the idea of constraints which are used,on the one hand, to restrict the set of product configurationswithin the configuration data and, on the other hand, to restrictthe necessity of parts and material for the manufacturingprocess (see section III-B). Restrictions to the set of productconfigurations are imposed, among others, due to technical,legal or marketing conditions like, for example, a specialdiesel engine that cannot be combined with automatic gearor extra requirements within certain countries. We introducethe term constraint as follows. A constraint is a m-tuplec := (P1, . . . , Pm), Pi ⊆ Fi, which induces the set W (c) :=P1 × · · · × Pm.

In the context of product configuration data, constraints areused to encode the set of restricted product configurations,i.e. combinations of attributes that are not available dueto certain conditions. From now on we denote the set ofrestrictive constraints within the product configuration dataas R := {c1, . . . , ck}. For a given W and R, the set

W (R) := W \⋃

1≤i≤k

W (ci) (3)

can be derived, which henceforth will be referred to as theset of valid configurations. Each ci ∈ R induces a set of

188

Table IFEATURES AND ATTRIBUTES

Feature Attribute Denotation

FC (Color)CR RedCG GreenCB Blue

FS (Steering Arrangement)SL LeftSR Right

FM (Modes of Drive)MF FrontMR RearM4 4-wheel

FA (Automatic Start-Stop)AN NoAY Yes

FP (Power Steering)PE ElectronicPV VacuumPN No

invalid configurations that are subtracted from the set of allpossible product configurations W (equation 1).

B. Technical Information

According to the product description layers which aredescribed in [1], the so-called bill of materials (BOM)contains the data and information about the parts whichare used for the manufacture. In our application domain theparts for all possible product configurations are contained.Any part may be connected to a constraint which states theset of product configurations where this part is mandatoryfor manufacture. A part is necessary for the manufacture ofall product configurations when no constraint is specified.The set of required parts can be determined by a resolvingprocedure which compares a given product configurationwith the constraints of the BOM.

Let a configuration w ∈ W be given. A part within theBOM is determined to be necessary, iff

w ∈W (bi), (4)

where bi denotes the constraint of the according part. Thiscalculation is carried out with respect to all parts that areconnected to a constraint. The resulting set of parts thenconstitutes the bill of materials for the respective productconfiguration.

C. Introductory Example

Table I illustrates an exemplary set of attributes A and itspartition F .

Furthermore, let R be given as shown in Table II.Constraint c2, for example, states that SR, AY and

PE cannot be combined due to legal conditions—thus allconfigurations which contain this combination are invalid.

We now state a constraint of the BOM by

b = ({CG}, FS , FM , {AY }, FP ).

Table IIRESTRICTIVE CONSTRAINTS

R

c1 (FC , FS , FM , {AY }, {PV })c2 (FC , {SR}, FM , {AY }, {PE})c3 (FC , {SL}, {MF,MR}, {AN}, {PE})c4 ({CG}, {SR}, {M4}, FA, {PV })

Let this constraint be connected to a green button whichcontrols the Automatic Start-Stop functionality. The rulestates that all configurations that contain the combination ofCG and AY are equipped with the according part.

IV. VERIFICATION METHOD

In the previous section, the relevant data and a commoncontrol paradigm for mass customization—i.e. constraints—of our application domain has been introduced. Inconsisten-cies within the information may emerge, on the one hand, dueto the application of simultaneous engineering approachesduring the product development cycle and, on the other hand,due to the fact that the relevant data are contained in differentsystems. The application of the following rules helps to detectinconsistencies within the involved data.

A. Rules of Consistency

First we need to ensure that the restrictive rules aremutually consistent, or in other words, the set of validconfigurations is not empty. This is expressed by thefollowing formula

W (R) 6= ∅. (5)

The next rule checks the set B of constraints within the BOMand the constraints of the configuration data, respectively.Let a constraint bi ∈ B and the set of restrictive constraintsR be given. bi is said to be consistent with R, iff

∃w ∈W (R) : w ∈W (bi), i.e. (6)W (R) ∩W (bi) 6= ∅. (7)

This means that at least one valid configuration is availablewhich utilizes the according part.

In the following section we introduce the approach ofhow to verify these rules by using a Multi-Valued DecisionDiagram.

B. MDD Construction

In computer science, Binary Decision Diagrams (BDDs)are used to represent Boolean functions. In contrast to that,Multi-Valued Decision Diagrams (MDDs)—as an extensionto BDDs—are used to represent multiple valued functions.The behavior of such functions can be mapped to a directedacyclic graph (DAG) where each node is labeled by amultiple-valued variable. The number of the outgoing edgesand thus the number of the child nodes depends on thecardinality of the respective variable. Each edge that is

189

�� �� ��

�� ��

�� �� �

� �

� � �

Figure 1. MDD encoding of W

�� �� ��

�� ��

�� �� ��

��

�� �� ��

��

��

��

�� �� �

�

�

�� �� �

�

��

�� ��

�

��

�

�

� �

Figure 2. MDD encoding of c1, c2, c3 and c4

connecting a variable with a child node then representsa decision and thus an assignment of a value to thecorresponding variable. An MDD is called ordered if everyvariable within all paths that start from the root node appearsin the same order. It is called reduced if no equivalent sub-graphs are contained (ROMDD). For the sake of brevity wehenceforth simply use MDD instead of ROMDD.

Next we describe the approach of encoding the set of validconfigurations by using an MDD. In order to encode W (R),all restricted product configurations have to be subtractedfrom W [Fig. 1]. Each layer of the diagram represents afeature Fi ∈ F . Each Fi contains all corresponding attributes.A terminal node and the edges from attributes of the lowestlayer to this node have been omitted for simplicity. An edgeconnects an attribute of the upper layer with a node on thelower layer and hence encodes all combinations—Cartesianproduct—of the attribute and the attributes of the node. Thisin turn means that each path of the structure—from the toplayer to the bottom layer—yields one element of W .

All constraints of R are constructed in a similar way, wherethe layers represent the sets P1, . . . , Pm [Fig. 2]. Based uponthe representations of W and c1, . . . , ck we now graduallyapply a minus operation to calculate W (R). A pre-conditionfor the application of the operation is that the orders of thelayers coincide. During the successive subtraction of ci ∈ R,the constraints are verified with respect to self-consistencyby checking whether the resulting set is empty after eachsubtraction step (equation 5).

In Fig. 3, the representation of W (R) of the introductoryexample is given. While applying the minus operation, someof the nodes are duplicated in order to encode the valid paths.

�� �� ��

�� ��

�� �� � �� �� �

�� ��

�� �� �

� �

� � � � �

� �

� � �

� � � �

Figure 3. Initially ordered MDD encoding W (R)

Table IIICAR CONFIGURATION EXAMPLES

Example |F| |A| |R| |B|Small 86 500 203 —

Large 173 1012 3140 20780

Now we will study the applicability of the approach bymeans of two real world examples of the automotive domain[Table III]. The large example has been obtained from a carmanufacturer and contains the original product configurationdata (i.e. A,F and R) and the complete BOM with respectto a current model of the corresponding enterprise. For thefirst test runs and the development of dynamic optimizationapproaches, the cardinality of the original sets has beenreduced, i.e. the small example.

All computations were done with an Intel i3-370M 2.4 GHznotebook equipped with 8 GB main memory. With the initialordering of the variables, the small example needed 333 MBof main memory for the final MDD. During the computation,the size of the MDD exceeded 500 MB. The configurationencoding of the large real-world example exceeded 8 GB ofmain memory after having compiled 220 constraints. Bothexamples led to exponentially growing memory consumption.This is why dynamic reordering was implemented to alterthe variable ordering and to keep the size of the resultingstructure small. This approach is described in the next section.

C. Variable Ordering

It is well known that the variable order within an MDDcan have a huge impact on its size. This is why we willstudy whether dynamic reordering has a positive impact onthe size of the MDD during the construction with respect tothe car configuration problem.

At first, we want to note that theoretically all permutationsof variable orders can be achieved by simply combiningelementary swap operations. For our small example this willresult in 86! (more than 10130) possibilities; much too manyin practice.

For the first optimization algorithm we choose some of thepossibilities by restricting the permutations to a small rangeof affected variables. This local window is then moved overthe complete range of variables. By increasing the window

190

size, more permutations are reached to the disadvantage ofthe computational costs.

The second optimization algorithm omits some of thepermutations. Therefore the window size can be extendedwithout increasing the computational effort.

The sifting approach is then chosen as third algorithm. Bymoving only one variable up and down, the computationaleffort can be kept constant even though the window size isincreased.

Our approach combines these three optimization techniquesinto one algorithm called Opt.

For the following considerations we introduce the termsscope and distance. For each constraint, we identify the setof features, where attributes are omitted. We henceforth referto this set as the constraint’s scope

scope(c) := {Fi | Fi 6= Pi, 1 ≤ i ≤ m}. (8)

The scope of c2 (Table II), for example, is given by{FS , FA, FP }.

Furthermore let F ⊆ F and l(F ) ⊆ {1, . . . ,m} be theset of indices of layers to which the respective features aremapped within the decision diagram. For a given variableordering and a constraint, the following distance can becalculated

d(c) := max (l (scope (c)))−min (l (scope (c))) . (9)

This metric therefore determines the maximum distancebetween the layers with respect to a given constraint and avariable ordering. Now we define a partial order on the set ofconstraints by sorting them in an ascending order accordingto their distance. This sorting (Sort) is carried out after eachreordering of the variables, because hereby the distance ischanged.

The behavior of the reordering of the variables combinedwith the sorted sequence of constraint compilation is shownin Fig. 4 as OptSort. The maximum memory consumptionof intermediate MDDs for the algorithm with sorting is lessthan that of the original optimization algorithm, and only11 minutes are needed compared to 18 minutes withoutsorting. By using the dynamic reordering approach in thesmall example, memory consumption can be reduced byabout 1000 times compared to the initial order (∼ 300 MB).

In Fig. 6, the result of the reordering procedure of theintroductory example is presented where the total numberof nodes is reduced by 2 and the total number of elementswithin the nodes is reduced by 6.

Now we apply the new combined optimization approach tothe large real-world example. With the utilization of only oneof the described algorithms, it was impossible to constructthe MDD. By using our combined approach, the optimizationrun is done in 571 minutes and the resulting MDD fits in163 MB main memory (Optimization Run in Fig. 5). Withthe computed new variable order, the constraints can beread again for the construction of the MDD in under 14

���

���

���

���

���

�������������

��� ��

� ��

���

���

���

���

� �� ��� ��� ���

�������������

����������� ������������� ����

Figure 4. Size of the MDD for the small real-world example

����

����

����

����

����

����

�������������

���� ������

���������

�������

�����

�

���

���

���

���

� ��� ���� ���� ���� ���� ����

�������������

����������� ������������� ����

Figure 5. Size of the MDD for the large real-world example

�� �� ��

�� �� �� ��

�� � �

�� ��

�

��

� � � � � �

����

�� �

�

��

Figure 6. Reordered MDD encoding W (R)

minutes (OptSort in Fig. 5). Without optimizing the constraintcompilation sequence, it is not possible to construct theMDD even though optimized variable ordering has beenused (OptNoSort in Fig. 5). Without doing any optimizationor sorting, only 109 constraints can be subtracted from theset of all product configurations W (NoOptNoSort in Fig. 5).Subsequently, no further constraint can be processed becauseof the lack of main memory.

191

�� �� ��

��

�� ��

�� ��

�

� �

� � �

�� ��

�� �� ��

�� �

��

��

� �

�� �

� ����

����

� �

�

��

�

�� �� ��

��

� �

�� �� ��

�

Figure 7. Intersection of W (R) and b of the introductory example

D. Results

The verification method basically implements equation7 and checks whether the intersection of W (R) and allbi ∈ B is empty. The constraints within the BOM needto be represented as decision diagrams with the samevariable ordering that is contained in W (R), cf. constructionphase (equation 3), where the constraints of the productconfiguration data are subtracted from W . The intersectionoperation is then carried out for each bi ∈ B and the resultingset yields all valid configurations, where the correspondingpart is necessary for the manufacturing process. In Fig. 7,the intersection of the introductory example is illustrated.

In the large automotive example, we verified a set of 20780constraints of the BOM and found 1276 empty intersections.An empty intersection shows that the constraint (BOM) isnot consistent with the set of restricting constraints R. Thismeans that the according part will never be equipped duringthe manufacturing of any valid configuration. The reason forthis can either be erroneous constraints within R or an errorwithin the constraint bi of the respective part.

V. CONCLUSION & FUTURE WORK

In this paper, we described an approach of combin-ing known optimization techniques—regarding dynamicreordering of MDDs—to a new algorithm together withthe utilization of sorted sequences of constraint compilation.

We showed by hand of two real-world examples from theautomotive application domain that variable reordering isrequired to achieve a practicable size of the MDD. Duringoptimization, the sorting of the constraints was a crucialfactor to keep the MDD size low, and after the optimizationit was needed for the reconstruction of the MDD evenwith optimized variable ordering. We demonstrated the

applicability of such reduced MDDs to verify the consistencyof both, the restrictive constraints as well as the constraintswithin the BOM.

Besides the configuration data and the BOM, furtherinformation products are involved within the car man-ufacturing domain. For example a process plan whichdescribes the assembly process and incorporates, amongothers, information about the workstations, the work methods,timing issues, handling gear. The contained atomic processsteps are—like the parts within the BOM—connected toconstraints. Therefore, the introduced verification approachcan be adapted to ensure consistency within this information,too.

In addition to that, part types are introduced within theprocess of assessment of demand of material to ensure thecorrect delivery of parts during the manufacturing process.Each part type contains a subset of the parts of the BOM—like, for example, all available steering wheels—and any validproduct configuration is said to be equipped with exactlyone of the corresponding parts (100%-rule). Therefore, theconstraints of the part type and the constraints of thecorresponding parts can be compared and checked withrespect to self-consistency, first. Second, the constraint of apart type can be checked regarding the restrictive constraintswithin the product configuration data and the 100%-rule.

At the moment, we adopted dynamic variable reorderingtechniques. Static reordering can reduce the size of anMDD right from the beginning. For structured models, goodinitial values can be found. Unlike the MDDs constructedfrom, for example, queuing networks or Petri nets, theMDDs encoding of the car manufacturing problems are notgenerated from high level descriptions. The lack of structuralinformation makes it difficult to find good static variableordering algorithms.

REFERENCES

[1] W. J. Herlyn, Zur Problematik der Abbildung variantenre-icher Erzeugnisse in der Automobilindustrie, ser. Fortschritts-Berichte VDI. VDI-Verlag, 1990, vol. 16, no. 52.

[2] T. Hadzic, J. N. Hooker, B. O’sullivan, and P. Tiedemann,“Approximate compilation of constraints into multivalueddecision diagrams,” in Principles and Practice of ConstraintProgramming, 2008, pp. 448–462.

[3] C. Sinz, A. Kaiser, and W. Kuchlin, “Formal methods forthe validation of automotive product configuration data,”Artificial Intelligence for Engineering Design, Analysis andManufacturing, vol. 17, p. 2003, 2003.

[4] T. Hadzic, S. Subbarayan, R. M. Jensen, H. R. Andersen,J. Møller, and H. Hulgaard, “Fast backtrack-free product con-figuration using a precompiled solution space representation,”in PETO Conference, DTU-TRYK, 2004, pp. 131–138.

[5] R. Mateescu and R. Dechter, “And/or multi-valued decisiondiagrams for constraint networks,” in Proceedings of theThirteenth International Conference on Principles and Practiceof Constraint Programming. Springer, 2007, pp. 498–513.

192

[6] B. Bollig and I. Wegener, “Improving the VariableOrdering of OBDDs Is NP-Complete,” IEEE Trans. Comput.,vol. 45, pp. 993–1002, September 1996. [Online]. Available:http://dx.doi.org/10.1109/12.537122

[7] M. Rice and S. Kulhari, “A Survey of Static VariableOrdering Heuristics for Efficient BDD/MDD Construction,”University of California, Tech. Rep., 2008. [Online]. Available:http://www.cs.ucr.edu/ skulhari/StaticHeuristics.pdf

[8] R. I. Siminiceanu and G. Ciardo, “New metrics for staticvariable ordering in decision diagrams,” in TACAS, ser. LNCS,vol. 3920:90104. Springer, 2006, pp. 328–342.

[9] M. Fujita, Y. Matsunaga, and T. Kakuda, “On variable orderingof binary decision diagrams for the application of multi-levellogic synthesis,” in Design Automation. EDAC., Proceedingsof the European Conference on, feb 1991, pp. 50 –54.

[10] N. Ishiura, H. Sawada, and S. Yajima, “Minimization ofbinary decision diagrams based on exchanges of variables,” inComputer-Aided Design, 1991. ICCAD-91. Digest of TechnicalPapers., 1991 IEEE International Conference on, nov 1991,pp. 472 –475.

[11] R. Rudell, “Dynamic variable ordering for ordered binarydecision diagrams,” in Proceedings of the 1993 IEEE/ACMinternational conference on Computer-aided design, ser.ICCAD ’93. Los Alamitos, CA, USA: IEEE ComputerSociety Press, 1993, pp. 42–47. [Online]. Available:http://portal.acm.org/citation.cfm?id=259794.259802

[12] F. Somenzi, CUDD: Colorado University Decision DiagramPackage Release 2.4.2, User’s Manual and Programmer’sManual, Department of Electrical, Computer, and EnergyEngineering, University of Colorado at Boulder, 2009.

[13] J. Ossowski and C. Baier, “A uniform framework forweighted decision diagrams and its implementation,”Int. J. Softw. Tools Technol. Transf., vol. 10,pp. 425–441, September 2008. [Online]. Available:http://portal.acm.org/citation.cfm?id=1416588.1416590

193