Page 1

Bounds on the OBDD-Size of Integer

Multiplication via Universal Hashing

Philipp Woelfel

Dept. of Computer Science

University Dortmund

D-44221 Dortmund

Germany

phone: +49 231 755-2120

fax: +49 231 755-2047

e-mail: philipp.woelfel@cs.uni-dortmund.de

Abstract

Bryant [5] has shown that any OBDD for the function MULn−1,n, i.e. the middle bit

of the n-bit multiplication, requires at least 2n/8nodes. In this paper a stronger lower

bound of essentially 2n/2/61 is proven by a new technique, using a universal family

of hash functions. As a consequence, one cannot hope anymore to verify e.g. 128-bit

multiplication circuits using OBDD-techniques because the representation of the

middle bit of such a multiplier requires more than 3 · 1017OBDD-nodes. Further,

a first non-trivial upper bound of 7/3 · 24n/3for the OBDD-size of MULn−1,n is

provided.

Key words: OBDDs, integer multiplication, binary decision diagrams, branching

programs, MUL

1Introduction and Results

Ordered Binary Decision Diagrams (short: OBDDs) belong to the most impor-

tant data structures for representing boolean functions. Efficient algorithms

on OBDDs are known for all important operations, as e.g. synthesis operation,

equivalence test, satisfiability test or minimization. Therefore, OBDDs have

found a wide variety of applications, especially in the areas of model checking

and circuit verification.

Preprint submitted to Elsevier Science25 January 2005

Page 2

Definition 1 Let Xn= {x1,...,xn} be a set of Boolean variables.

(1) A variable ordering on Xnis a bijection π : {1,...,n} → Xn, leading to

the ordered list π(1),...,π(n) of the variables.

(2) A π-OBDD on Xnfor a variable ordering π is a directed acyclic graph

with one root and two sinks satisfying the following properties: One sink

is labeled with 0, the other with 1. Each inner node is labeled by a variable

in Xnand has two outgoing edges, one labeled by 0, the other by 1. If

an edge leads from a node labeled by xito a node labeled by xj, then

π−1(xi) < π−1(xj). This means that any path on the graph passes the

nodes in an order respecting the variable ordering π.

(3) The computation path of an input a = (a1,...,an) ∈ {0,1}nis the path

starting at the root and leaving any xinode over the edge labeled by the

value of ai. The OBDD represents a function f : {0,1}n→ {0,1} if for

any a ∈ {0,1}nthe sink reached by the computation path of a is labeled

with f(a).

(4) The size of a π-OBDD is the number of its nodes. The π-OBDD-size of

a Boolean function f (short: π-OBDD(f)) is the size of the minimum

π-OBDD computing f. Finally, the OBDD-size of f (short: OBDD(f))

is the minimum of π-OBDD(f) for all variable orderings π.

For an in-depth discussion of OBDDs and their operations we refer to [14].

OBDDs can be used, e.g. for circuit verification as follows. If one wants to test

a circuit for a function f against its specification (function g), one can use

syntheses operations in order to obtain π-OBDDs for f and g and then check

whether f and g are equal by using the equivalence test. The minimization

algorithm is used to ensure that the OBDDs obtained during such a procedure

are as small as possible.

Although each single operation used in a such a verification procedure is pos-

sible in polynomial (i.e. quadratic or even better) time with respect to the

sizes of the corresponding input OBDDs, the total procedure may be infeasi-

ble because the sizes of the involved OBDDs may grow almost quadratically

with each synthesis operation.

It is not surprising that a lot of research effort has been spent in trying to

verify multiplier circuits using OBDDs. However, it took until 1998 until it

was possible to compute an OBDD for the 16-bit multiplication circuit c6288,

one of the most important ISCAS (International Symposium on Circuits and

Systems) benchmark circuits [18]. The resulting OBDD consisted of more than

40 million nodes, the largest OBDD obtained during the synthesis operations

even had 110 million nodes and the maximum memory requirement was 3,803

megabyte. According to the author’s knowledge, nobody could successfully

compute an OBDD for a larger multiplier circuit, yet.

2

Page 3

These experiences do not necessarily mean that there are no small OBDDs

for e.g. 16- or 32-bit multiplier circuits, because the size of a π-OBDD can

be quite sensitive to the chosen variable ordering π, and finding a variable

ordering leading to small or even minimal π-OBDDs is a hard problem (see

[1,4,12]). Therefore, it is necessary to prove large lower bounds for the OBDD-

size of integer multiplication in order to be sure that verification of multipliers

using OBDDs is infeasible.

There is also a more theoretical motivation for the investigation of the OBDD-

size of multiplication. It can be easily seen that almost all functions require

an exponential number of elements in any realization by networks using only

primitive elements. But this would not be disturbing as long as for all practical

relevant families of functions small representations of a certain kind exist.

Therefore, one is interested in finding exponential lower bounds for the size

of OBDDs (and other representation types) computing important and natural

families of functions.

Definition 2 The Boolean function MULk,n: {0,1}2n→ {0,1} computes the

bit zkof the product (z2n−1...z0) of two integers (yn−1...y0) and (xn−1...x0).

The first step towards bounding the size of OBDDs for integer multiplication

was done by Bryant in 1986 [4]. He showed that for any variable ordering

π, there exists an index k, such that the π-OBDD-size for MULk,nis at least

2n/8. This result, though, would still allow the possibility that one might obtain

polynomial size OBDDs for all functions MULk,nby choosing different variable

orderings for different output bits. In 1991, Bryant found that computing the

middle bit of multiplication (that is MULn−1,n) requires a π-OBDD containing

2n/8nodes for any variable ordering π [5].

Although this proves the exponential size of OBDDs for multiplication, the

bound is - as stated e.g. by Bollig and Wegener in [2] - not satisfactory. This is

because Bryant’s bound would still allow the possibility that one can construct

64-bit multipliers represented by OBDDs containing only 256 nodes while on

the other hand it is widely conjectured that OBDDs computing MULn−1,n

have a size of at least 2n. This would mean that such a multiplier could not

even be realized with millions of nodes. Since one would like to use OBDDs for

realistic applications one is interested in either finding such small constructions

or a better lower bound. The following result, which will be proven in the next

section, provides the second alternative:

Theorem 3 The OBDD-size of MULn−1,nis at least 2⌊n/2⌋/61 − 4.

This bound shows that any OBDD for 64-bit multiplication must be con-

structed of more than 70 million nodes and therefore the representation of

64-bit multipliers using OBDDs requires a huge amount of resources. The ver-

ification of 128-bit multipliers is infeasible because more than 3·1017OBDD-

3

Page 4

nodes would be necessary.

The technique leading to this result is new. It relies on a universal family of

hash functions [16] and makes use of a new lemma showing how such functions

distribute two arbitrary sets over the range. Universal hashing is introduced

in the next section. We remark, that following the conference version [17] of

this paper, quite some progress has been made in proving lower bounds for the

BDD-size of MULn−1,n. E.g., in [2] a lower bound of Ω(2n/4) was proven for

read-once branching programs (improving the earlier 2Ω(√n)bound of Ponzio

[10]) and in [11] super-linear time-space-tradeoffs were shown for even less

restricted BDD-models. However, all these results extend the main proof-idea

of this paper, which builds on universal hashing. Furthermore, the result for

OBDDs presented here is the only one which achieves such a large constant

factors (in the exponent and the coefficient) that it has relevance for the

verification of multiplier circuits of realistic bit-length.

Since it is generally believed that the true bound on the OBDD-size for

MULn−1,nis still larger than 2n/2, it is of interest to have an upper bound,

too. Note that for any Boolean function on m variables, there exists an OBDD

of size2 + o(1)2m/m [3], so a trivial upper bound for OBDD(MULn−1,n) is

roughly 22n/n. The following upper bound, proved in Section 3, is the first

non-trivial one.

??

Theorem 4 The OBDD-size for MULn−1,nis at most 7/3 · 24n/3.

The bound shows that the middle bit of a 16-bit multiplication can be repre-

sented by an OBDD containing less than 6.2 million nodes. Constructions of

OBDDs satisfying this bound can be derived from the proof.

2 The Lower Bound

We first describe a general technique to prove lower bounds for the OBDD-size

of boolean functions. The technique is principally well known (see e.g. [13]) but

we formulate it here in a way which suits our needs best. For a1,...,ai∈ {0,1},

1 ≤ i ≤ n, denote by f|a1,...,aithe subfunction of f that computes f(x1,...,xn),

where for 1 ≤ j ≤ i the j-th input-variable according to π (that is π(j)) is

fixed by the constant aj.

Lemma 5 Let f : {0,1}n→ {0,1} and π be a variable ordering on Xn =

{x1,...,xn} and k ∈ {1,...,n}. Further let T ⊆ Xncontain the first k vari-

ables w.r.t. π, i.e. T = {π(i) | 1 ≤ i ≤ k} and let skbe the number of different

subfunctions f|a1,...,akwhere a1,...,ak∈ {0,1}. Then π-OBDD(f) ≥ 2·sk−1.

4

Page 5

Proof: Let G be an arbitrary π-OBDD for f and assume w.l.o.g. that π(i) =

xifor 1 ≤ i ≤ n. Hence, the variables appear on any computation path in

the order x1,...,xnand T = {x1,...,xk}. For any a = (a1,...,ak) ∈ {0,1}k

let vabe the unique vertex reached by the computation paths starting with

a right after the variable xk has been tested. Denote by V the set of all va

with a ∈ {0,1}k. Obviously, any directed path leading from a vertex va∈ V

to a sink contains only xi-nodes with i > k. Therefore, any assignment b =

(bk+1,...,bn) ∈ {0,1}n−kto these variables defines a unique path from vato

a sink.

Consider now two different assignments a,a′∈ {0,1}k. If va= va′ then f|a=

f|a′ because for all b ∈ {0,1}n−kthe computation paths of ab and a′b reach

the same sink. Therefore |V | ≥ sk. Moreover, no vertex va∈ V lies on the

path from the source to a vertex va′ ∈ V − {va} because then its label would

be a variable xiwith i ≤ k. Hence, we can embed a tree in the subgraph of

G consisting only of the paths from the root to the vertices in V such that

each vertex of the tree has at most 2 children. Since this tree has |V | leafs it

consists of at least 2|V |−1 vertices. Therefore, G has at least 2|V |−1 ≥ 2sk−1

nodes.

2

Before we start proving the lower bound for the OBDD-size of MULn−1,nwe

shall sketch the main idea. Let for a ∈ {0,1}nthe function MULa

{0,1} be defined by MULa

we will show that for any given variable ordering π there exists an integer a

for which the π-OBDD-size of MULa

integer a in such a way that only two bits, aiand aj, were 1 and all other bits

were 0. This way, the product a · x simplified to the sum ai· 2i· x + aj· 2j· x

and lower bounds for the OBDD-size of computing such sums can be obtained

easily, depending on the variable ordering.

k,n: {0,1}n→

k,n(x) = MULk,n(a,x). Similar as in Bryant’s proof

n−1,nis large. However, Bryant chose this

However, our goal is to allow more choices for the integer a and we need

another way to write a · x as the sum of two integers. Consider the set T of

the the first n/2 variables with respect to π and let B be the remaining n/2

variables. We construct two sets M and N of integers in {0,...,2n− 1} in

such a way that M contains the integers p for which all variables in T are

fixed to 0 and N contains the integers q for which all variables in B are fixed

to 0. Clearly, any integer x in {0,...,2n− 1} can be uniquely expressed as

q+p for some p ∈ M and some q ∈ N. Furthermore, q is uniquely determined

by the variables in T and thus determines a unique subfunction g|q, where

g = MULa

it suffices to show that for many different q ∈ N the subfunctions g|q are

different. We do this by determining a constant a and two subsets M′⊆ M

and N′⊆ N with the following property: For any distinct q,q′in N′, there

exists p ∈ M′such that a(p + q) and a(p + q′) differ in the n-th bit. Since q

and q′are determined only by the top variables and p is determined by the

n−1,nfor an appropriately chosen integer a. According to Lemma 5

5