The Bulletin of Symbolic Logic

Volume 5, Number 3, Sept. 1999

MODELS OF SECOND-ORDER ZERMELO SET THEORY

GABRIEL UZQUIANO

§1. Introduction. In [12], Ernst Zermelo described a succession of models

for theSaxioms of set theory as initial segments of a cumulative hierarchy of
levels α Vα . The recursive definition of the Vα ’s is:
[
V0 = ∅; Vα+1 = P(Vα ); Vë = Vâ for limit ordinals ë.
â<ë

Thus, a little reflection on the axioms of Zermelo-Fraenkel set theory (ZF)

shows that Vù , the first transfinite level of the hierarchy, is a model of all the
axioms of ZF with the exception of the axiom of infinity. And, in general,
one finds that if κ is a strongly inaccessible ordinal, then Vκ is a model of
all of the axioms of ZF.1 (For all these models, we take ∈ to be the standard
element-set relation restricted to the members of the domain.) Doubtless,
when cast as a first-order theory, ZF does not characterize the structures
hVκ , ∈ ∩ (Vκ × Vκ )i for κ a strongly inaccessible ordinal, by the Löwenheim-
Skolem theorem. Still, one of the main achievements of [12] consisted in
establishing that a characterization of these models can be attained when
one ventures into second-order logic. For let second-order ZF be, as usual,
the theory that results from ZF when the axiom schema of replacement is
replaced by its second-order universal closure. Then, it is a remarkable result
due to Zermelo that second-order ZF can only be satisfied in models of the
form hVκ , ∈ ∩ (Vκ × Vκ )i for κ a strongly inaccessible ordinal.2
Now, similarly, if Vë is an initial segment of the cumulative hierarchy
indexed by a limit ordinal ë > ù, then hVë , ∈ ∩ (Vë × Vë )i is a model
of Zermelo set theory, which is the theory whose axioms are all of the

Received September 4, 1998; revised July 15, 1999.

1
An ordinal κ is strongly inaccessible if and only if κ > ù and κ is regular and a strong
limit, that is, if ë < κ, then 2ë < κ.
2
Cf. [12]. Zermelo’s original result is more general. In [12], he allowed for Urelemente,
eschewed the axiom of infinity, and used a second-order version of the axiom of foundation
to establish that the models of his (second-order) version of ZF − Inf are characterized up
to isomorphism by two cardinals, the number of their Urelemente and the height of their
ordinals. In particular, he characterized the heights of his models as ù or the strongly
inaccessible ordinals.
c 1999, Association for Symbolic Logic

1079-8986/99/0503-0001/$2.40

289
290 GABRIEL UZQUIANO

axioms of ZF with the exception of replacement. One may be tempted to

view the axioms of Zermelo set theory as an implicit description of these
structures, and, in fact, as adequate to formalize much of mathematical
practice, since hVù+ù , ∈ ∩ (Vù+ù × Vù+ù )i, the first such model, contains
isomorphic copies of the real and complex numbers, subsets and functions on
the real numbers, and the rest of the objects studied in classical mathematics.
Nevertheless, it is plain, again by the Löwenheim-Skolem theorem, that first-
order Zermelo set theory does not characterize the initial segments of the
cumulative hierarchy indexed by a limit ordinal ë > ù. Still, one may
wonder whether a characterization can be attained when the axiom schema
of separation of Zermelo set theory is replaced by its second-order universal
closure. Are, in particular, the axioms of second-order Zermelo set theory
sufficient to characterize the structures hVë , ∈ ∩ (Vë × Vë )i for ë a limit
ordinal greater than ù? If not, what else is required to obtain a theory
whose axioms are satisfied in all and only those models isomorphic to some
such model?
In this paper, we investigate second-order variants of Zermelo set theory;
we are going to show that what are perhaps the most common formulations
of second-order Zermelo set theory fail to deliver the existence of a vast
array of sets of level ù in the cumulative hierarchy. Moreover, even if the
axiom of infinity is refined to deliver the existence of Vù , which consists of
all the hereditarily finite sets, as an immediate consequence, there will still
be a variety of models of the Zermelo axioms that are not of the desired
form; we shall even establish that there are models of second-order variants
of Zermelo set theory in which the element-set relation is not well-founded.
In the last section of the paper, we will turn to the question of what is
required to characterize the Vë ’s for ë a limit ordinal greater than ù. At
a certain point, we shall consider the addition of a new axiom to second-
order Zermelo set theory. This axiom explicitly incorporates the cumulative
hierarchy view into the theory, and permits us to formulate a second-order
variation on Zermelo set theory that characterizes the structures hVë , ∈ ∩
(Vë × Vë )i for limit ordinals ë > ù.

§2. Axioms of infinity for Zermelo set theory. There are a variety of alter-
native formulations of the axiom of infinity, not all of them interderivable.
The purpose of this section is to review the relative strength of familiar ver-
sions of infinity, and establish the inability of some of these formulations,
modulo the rest of the Zermelo axioms (Z− ), to deliver the existence of Vù ,
the set of all hereditarily finite sets, as a consequence.
Zermelo’s original axiom of infinity asserts the existence of a set which
contains the null set and which contains the unit set of every set it contains:

InfZ ∃y (∅ ∈ y ∧ ∀x (x ∈ y → {x} ∈ y)).

 MODELS OF SECOND-ORDER ZERMELO SET THEORY 291

This axiom yields the existence of the set Z0 = {∅, {∅}, {{∅}}, . . . }, Zer-
melo’s number sequence, as an immediate consequence, and still occurs
in some presentations of standard set theory. Z− + InfZ is the version of
Zermelo set theory whose axiom of infinity is InfZ .
A more standard formulation of the axiom of infinity is:
Inf ∃y (∅ ∈ y ∧ ∀x (x ∈ y → x ∪ {x} ∈ y)).
Inf delivers the existence of ù, the first transfinite (von Neumann) ordinal.
According to von Neumann’s construction of the ordinals, each ordinal α
coincides with the set of its predecessors, { â : â < α }, and < is just the
element-set relation on the ordinals. Thus, ù, the first transfinite ordinal,
is the set of all finite ordinals, and hence it contains 0 and the successor
α ∪ {α} of every finite ordinal α it contains.3 Inf is what is perhaps the
most common version of the axiom of infinity, and I will abbreviate Z− + Inf
as Z, in accordance with the fact that the name Zermelo set theory is most
commonly used to refer to Z− + Inf.
The following sentence is an ostensibly weaker axiom of infinity:
InfDed ∃y ∃f ∃x (Fnc f ∧ x ∈ y ∧ f : y →(1-1) y − {x}).
Not only does InfDed fail to imply either Inf or InfZ (modulo the axioms
of Z− , of course), as we will see in a moment, it can even be shown that no
infinite set is a member of all the models of second-order Z− + InfDed.
InfDed is equivalent, modulo the axioms of Z− , to the assertion that
there exists an ordinary infinite set, a set y which cannot be put in one-
one correspondence with any set of natural numbers less than some natural
number n. This result is due to Russell who proved that the power set
P(P(x)) of the power set P(x) of an infinite set x is Dedekind infinite.4 It
should be noted, however, that, absent choice, not only can it not be proved
that no infinite set is Dedekind finite, it cannot even be proved that there do
not exist infinite sets whose power set is Dedekind finite.5
The other, less common formulation of the axiom of infinity I want to
consider is:
InfNew ∃y (∅ ∈ y ∧ ∀x ∀z (x ∈ y ∧ z ∈ y → x ∪ {z} ∈ y)).
3
It should perhaps be mentioned that if one’s aim were to develop mathematics within
Zermelo set theory, then one would probably use a different construction of the ordinals.
For, after all, in a model of Zermelo set theory like Vù+ù , there are no von Neumann ordinals
equal to or greater than ù + ù, and thus no von Neumann ordinals that can be used, for
example, to count uncountable well-ordered sets in the domain, Vù+ù .
4
If x is infinite, it can be proved that for each natural number n, the set Sn of all subsets
of x of cardinality n is nonempty, and if m 6= n, Sm and Sn are distinct. But then, S0 and
the function that assigns S(n + 1) to Sn and T itself to each subset T of P(x) not of the
form Sn for some n bears witness to the fact that P(P(x)) is Dedekind infinite. This result
is sometimes erroneously attributed to Tarski, but see [3] for a detailed account.
5
Cf. [5, ch. 3].
292 GABRIEL UZQUIANO

It is evident that this axiom of infinity implies the existence of Vù , which

coincides with HF, the set of all hereditarily finite sets, as an immediate
consequence, and even though it is mentioned in the second edition of [6]
and figures as the official axiom infinity in Azriel Levy’s excellent text [7], it
is seldom discussed in standard treatments of set theory.
There are, to be sure, other variations on the axiom of infinity in the
literature, but I am not now concerned to present an exhaustive review. My
aim rather is to point out the existence of important, and often neglected,
differences among what are perhaps the most common versions of the axiom
of infinity.6
The second-order theories Z− + InfDed, Z− + InfZ , Z, and Z− + InfNew
having been set out, the time has come to examine dependencies among them.
It is evident that every theorem of second-order Z− + InfDed, Z− + InfZ and
Z is a theorem of second-order Z− + InfNew, but one might inquire whether
it is the case that every theorem of second-order Z− + InfNew is a theorem
of some of the other variations on Zermelo set theory. There is a certain
set-theoretic construction that will permit us to answer this question in the
negative.7 If x is a set, define the set Mn (x) by the recursion:
[
M0 (x) = x, Mn+1 (x) = Mn (x) ∪ Mn (x) ∪ P(Mn (x)).
Then, the basic closure of x, M (x), is the union
[
M (x) = Mn (x).
n∈ù

If x is a (pure) transitive set, then it is routine to verify that Mn+1 (x) is

just P(Mn (x)), and that M (x) is a (pure) transitive set which is closed
under subsets, and closed under all the Zermelo operations.8 Thus, M (∅)
is Vù , or, equivalently, HF, the set of all hereditarily finite sets, and, in
general, M (x) is the domain of the ⊆-least transitive model of Z− with the
standard element-set relation which is closed under subsets and contains the
set x. As a consequence, hM (Z0 ), ∈ ∩ (M (Z0 ) × M (Z0 ))i and hM (ù), ∈ ∩
(M (ù) × M (ù))i are, respectively, the ⊆-least transitive models of second-
order Z− + InfZ and second-order Z with the standard element-set relation.
Lemma. M (ù) ∩ M (Z0 ) = HF.
6
I have suggested that many theorists overlook important differences among common
versions of the axiom of infinity, but I would not want to suggest that this oversight is too
pervasive. For, as I should emphasize, the relative independence, modulo the axioms of Z− ,
of alternative axioms of infinity is mentioned in [1], and in the second edition of [6]. And
some of the drawbacks at which we shall look in the course of the discussion have been
noticed before in the literature. See for example [4, pp. 110–111] and [9, Appendix B].
7
The construction appears, for example, in [9, p. 175]. I borrow the term basic closure
from Moschovakis.
8
A set is closed under subsets if it contains every subset of each of its members. Proofs of
all these basic facts can be found in [9].
 MODELS OF SECOND-ORDER ZERMELO SET THEORY 293

Proof. That HF ⊆ M (ù) ∩ M (Z0 ) is an immediate consequence of the

fact that both M (ù) and M (Z0 ) contain the null set and are closed under
the power set operation.
To verify the converse inclusion, note first that M0 (Z0 ) ∩ M0 (ù) =
{∅, {∅}}, a member of HF. Suppose now that Mn (Z0 ) ∩ Mn (ù) is an
element of HF. Then Mn+1 (Z0 ) ∩ Mn+1 (ù) = P(Mn (Z0 )) ∩ P(Mn (ù)) =
P(Mn (Z0 ) ∩ Mn (ù)). And since Mn (Z0 ) ∩ Mn (ù) ∈ HF, P(Mn (Z0 ) ∩
Mn (ù)) ∈ HF. ⊣
As an immediate consequence of this lemma, we obtain:
Theorem 1. There is no ⊆-least transitive model of second-order
Z− + InfDed
with the standard element-set relation.
Hence we conclude that there is no infinite set whose existence is a logical
consequence of second-order Z− + InfDed. Two other immediate conse-
quences of the lemma are:
Theorem 2. hM (Z0 ), ∈∩(M (Z0 )×M (Z0 ))i is not a model of second-order
Z,
and
Theorem 3. hM (ù), ∈ ∩ (M (ù) × M (ù))i is not a model of second-order
Z− + InfZ .
Proof of Theorems 2 and 3. Since M (Z0 ) ∩ M (ù) = HF and Z0 ∈
/ HF,
/ M (ù). Likewise, since ù ∈
Z0 ∈ / M (Z0 ).
/ HF, ù ∈ ⊣
The dependencies established in this section may now be summarized in
the following diagram:
Z + InfNew
ւ ց
Z ←−
−
/→ Z + InfZ
ց ւ
Z− + InfDed
In this diagram, “→” abbreviates: “is strictly stronger than,” that is,
“Z− + InfNew → Z” says that every theorem of Z− + InfNew is a theorem
of Z, but that not every theorem of Z is a theorem of Z− + InfNew. “Z ← →
/
Z + InfZ ” indicates both that there are theorems of Z that are not theorems
−

of Z− + InfZ and that there are theorems of Z− + InfZ that are not theorems
of Z.
One moral to be extracted from these results is that neither of what are
perhaps the two most common second-order variants of Zermelo set theory
has the resources necessary to guarantee the existence of sets that appear at
level ù of the cumulative hierarchy, and are thus quite low down in terms
of their cumulative structure—some of these sets are in fact obtainable as
294 GABRIEL UZQUIANO

the range of a ∆0 formula with domain ù, and hence minimal in terms of

complexity, too.

§3. Well-foundedness, cumulative structure, and the Zermelo axioms. The

results of section 2 make plain that, on their more standard formulations,
the Zermelo axioms cannot deliver the existence of all sets of level < ù + ù
in the cumulative hierarchy. One foreseeable reaction to these results is to
take them to rest on a common oversight in the standard formulations of
the axiom of infinity, since, as we have advanced in section 2, InfNew is
a variation on the axiom of infinity that implies the existence of Vù as an
immediate consequence.
The interest of second-order Z− + InfNew is that it is a variant of Zermelo
set theory that guarantees the existence of the first ù + ù levels of the
cumulative hierarchy, and thus the question immediately arises whether this
theory is adequate to characterize the initial segments of the cumulative
hierarchy that are indexed by a limit ordinal ë > ù.
Of course a prerequisite for a (second-order) theory to characterize a
class of initial segments of the cumulative structure is that it be satisfi-
able exclusively in models in which the element-set relation is well-founded.
Since the second-order principle of set-theoretic induction is a theorem of
second-order ZF, we may rest assured that second-order ZF is a candidate
to characterize the initial segments of the cumulative hierarchy that are in-
dexed by some strongly inaccessible ordinal, as in fact it does. But can we,
likewise, rest assured that second-order Z− + InfNew can only be satisfied
in models in which the element-set relation is well-founded? We could, if we
were in a position to derive the second-order principle of set-theoretic in-
duction as a theorem of second-order Z− + InfNew. Curiously, however, the
answer to our question is negative. Not only can the second-order principle
of set-theoretic induction not be derived from the axioms of second-order
Z− + InfNew, one can even make use of the Rieger-Bernays method9 for
showing the independence of the axiom of foundation to construct models
of Z− + InfNew in which the element-set relation is not well-founded.10
One may be surprised to hear that that there are non-well-founded models
of second-order versions of Zermelo set theory. After all, these theories
come equipped with an axiom of regularity or foundation,
Reg ∀x (∃y (y ∈ x) → ∃y (y ∈ x ∧ y ∩ x = ∅)),
which is designed precisely to prevent this situation. It is well-known that in
the context of first-order set theory the axiom of regularity can only prevent
the existence of infinite descending ∈-chains that are first-order definable in
9
Cf. [2] and [10].
10
I am grateful to Vann McGee for asking the question of whether there are non-well-
founded models of second-order variants of Zermelo set theory.
 MODELS OF SECOND-ORDER ZERMELO SET THEORY 295

the model. But the fault for the failure of the axiom of regularity to prevent
the existence of infinite descending ∈-chains that are not definable in the
model is often supposed to lie merely in the fact that the first-order schemata
of separation and replacement are ill-suited to capture the full content of
these axioms.
Much less well-known is the fact that the axiom of regularity fails, even
in the presence of second-order separation, to prevent the existence of non-
well-founded models of several variants of Zermelo set theory:
Theorem 4. There are non-well-founded models of second-order Z− +InfNew.
Proof. To produce a non-well-founded model M of second-order Z− +
InfNew, take the domain of M to be Vù+ù , and let ð be a permutation of
the domain Vù+ù defined by:
ð(x) = {{x}}, if x ∈ {Z0 , {Z0 }, {{Z0 }}, . . . },
[[
ð(Z0 − x) = Z0 − x, if x ∈ Z0 − {∅, {∅}},
ð(Z0 − {∅}) = {Z0 }, and
ð(x) = x otherwise.
An informal, but more intuitive characterization of ð is that it shifts each
term forward two steps in the sequence:
. . . , Z0 − {{{∅}}}, Z0 − {{∅}}, Z0 − {∅}, Z0 , {Z0 }, {{Z0 }}, . . . .
The relation ∈new ⊆ (Vù+ù × Vù+ù ) by which the symbol ∈ is to be inter-
preted in M may then be defined by: x ∈new y if and only if x ∈ ð(y). It is
then immediate that ∈new is not well-founded in M, as Z0 , {Z0 }, {{Z0 }}, . . .
are the members of an an infinite descending ∈new -sequence in the model.
We must now see that M is a model of second-order Z− + InfNew. It
is routine to verify that the truth of the axioms of extensionality, null-set,
pairing, infinity, and second-order separation is unaffected by ð. The axioms
of union, power set, and regularity require more attention and are discussed
here:
Union: Let x be a member of Vù+ù , and note that it is a consequence of
our definition of ð that
∀x (x ∈ Vù+ù → rank(x) ≤ rank(ð(x)) ≤ rank(x) + 2).11

11
As usual, rank(x), the rank of x, is the least ordinal α such that x ⊆ Vα . I should
emphasize that this feature of ð plays an important role in the proof, for, in general, it is
not the case that a one-to-one map of Vù+ù onto Vù+ù induces a model of Z− + InfNew:
A permutation that assigns all the finite Zermelo ordinals to their obvious counterparts in
{Z0 , {Z0 }, {{Z0 }}, . . . } will generate a model in which union fails—consider the union of
Z0 in such a model. Compare with the Rieger-Bernays method for constructing non-well-
founded models of ZF minus regularity.
296 GABRIEL UZQUIANO

Since { ð(y) : y ∈ ð(x) } ⊆ Vrank(x)+2 and Vrank(x)+2 is itself a member of

Vù+ù , { ð(y) : y ∈ ð(x) } ∈ Vù+ù . Hence we can infer that
[
{ ð(y) : y ∈ ð(x) }
is a member of Vù+ù as well. Now, consider the set
[ 
ð−1 { ð(y) : y ∈ ð(x) }
and observe that if z is a member of Vù+ù , then
[ 
z ∈new ð−1 { ð(y) : y ∈ ð(x) }
just in case z ∈ ð(y) for y a member of Vù+ù such that y ∈ ð(x)—just in
case z ∈new y for y a member of Vù+ù such that y ∈new x.
Power: Suppose that x is a member of Vù+ù , and note that ð(x) and
P(ð(x)) are members of Vù+ù . Observe that if y ∈ P(ð(x)), then
rank(ð−1 (y)) ≤ rank(y) ≤ rank(P(ð(x))).
Therefore, since { ð−1 (y) : y ∈ P(ð(x)) } is a member of Vù+ù ,
ð−1 ({ ð−1 (y) : y ∈ P(ð(x)) })
is a member of Vù+ù such that if z is a member of Vù+ù ,
z ∈new ð−1 ({ ð−1 (y) : y ∈ P(ð(x)) })
just in case ð(z) ⊆ ð(x)—just in case
∀w (w ∈new z → w ∈new x),
as desired.
Regularity:
Case 1. Suppose x ∈ {Z0 , {Z0 }, {{Z0 }}, . . . }. Then, {x} is a ∈new -
minimal element of x, since {x} ∈new x, but {{x}} ∈ / new x.
Case 2. Suppose x = Z0 − y with y 6= ∅. If y = {∅}, then Z0 itself is
a ∈new -minimal member of x. Else, if y 6= {∅}, then ∅ is a ∈new -minimal
member of x.
Case 3. Otherwise, ∀y ∈ Vù+ù (y ∈new x ↔ y ∈ x). Let y be a
∈-minimal element of x. If ð(y) = y, then y is a ∈new -minimal mem-
ber of x. Else, if ð(y) 6= y, then we distinguish two subcases: (a) y ∈
{Z0 , {Z0 }, {{Z0 }}, . . . }. If {y} ∈ / x, then done. Otherwise, let z ∈
x ∩ {Z0 , {Z0 }, {{Z0 }}, . . . } such that {z} ∈
/ x—remember that x ∈ Vù+ù ,
and hence cannot contain all the elements of {Z0 , {Z0 }, {{Z0 }}, . . . } as
members. Then, z is a ∈new -minimal element of x. (b) Else, y = Z0 − z for
some z ∈ Z0 with z 6= ∅. If z = {∅}, then if Z0 ∈ x, proceed as in Case 1.
Otherwise, ∅ itself is a ∈new -minimal member of x. ⊣
 MODELS OF SECOND-ORDER ZERMELO SET THEORY 297

Thus we conclude that in the absence of replacement, the usual first-order

version of the axiom of regularity fails to insure that the axioms of second-
order Z− + InfNew are never satisfied in non-well-founded models.12 And
this result carries over to the second-order variants of Zermelo set theory
discussed thus far as well.
Perhaps we should have anticipated this result by reflecting on the fact that
the Zermelo axioms are inadequate to prove that every set has a transitive
closure,13 and this is one of the basic facts used in the standard proof that
the axiom of regularity implies, in the context of second-order set theory,
the second-order principle of set-theoretic induction.
One may well wonder whether amending second-order Z− + InfNew by
adjoining to it an axiom to the effect that every set is contained in some
transitive set would suffice to (i) ensure that the set-theoretic universe is well-
founded, and (ii) characterize the models of the form hVë , ∈ ∩ (Vë × Vë )i
for ë a limit ordinal greater than ù. These questions are not only different,
but require different answers. The answer to question (i) is affirmative,
since the second-order principle of set-theoretic induction is a theorem of
second-order Z− + InfNew+“Every set has a transitive closure.” There is
now a well-known construction of models of set theory that will help us
settle question (ii) in the negative, since it can be used to produce models of
second-order Z− + InfNew+“Every set has a transitive closure” that are not
of the form hVë , ∈ ∩ (Vë × Vë )i for ë a limit ordinal greater than ù: For κ an
infinite cardinal, H (κ) is the collection of all sets x whose transitive closures
contain only sets of cardinality < κ. It is routine to verify that H (κ), for a
cardinal κ > ù, satisfies all the axioms of (second-order) ZF except possibly
power set and replacement. For us, however, the interest of this construction
is that it provides us with a recipe to construct models of Z− +InfNew that are
not of the form hVë , ∈ ∩ (Vë × Vë )i for a limit ordinal ë > ù. In particular,
if κ is a singular strong limit, then hH (κ), ∈ ∩ (H (κ) × H (κ))i is a model
of second-order Z− + InfNew+“Every set has a transitive closure,” which is
not of the form hVë , ∈ ∩ (Vë × Vë )i for ë a limit ordinal greater than ù.
Other models of second-order versions of Zermelo set theory that are not
of the form hVë , ∈ ∩ (Vë × Vë )i for a limit ordinal ë > ù can be obtained
merely by taking the basic closure of a transitive superset of Vù .14 Thus for
example M (Vù ∪ ù + ù), the basic closure of Vù ∪ ù + ù, is the domain of

12
Replacement is not the only axiom whose absence may distort the content of regularity.
It is an old result of Jon Barwise that ZF − Inf cannot insure the existence of the transitive
closure of a set. Part of the interest of Barwise’s result is that it can readily be adapted to
show that all the axioms of second-order ZF − Inf can be verified in a model in which the
extension of the element-set relation is not well-founded.
13
In [4, pp. 110–111], Frank Drake exhibits a model of (second-order) Z in which not
every set has a transitive closure.
14
As defined in section 2.
298 GABRIEL UZQUIANO

another model of second-order Z− +InfNew which contains ù + ù, but not

Vù+ù as a member.

§4. Interpreting second-order Z− + InfNew in second-order Z− + InfZ and

second-order Z. In section 2, we examined dependencies among the second-
order theories Z− + InfDed, Z− + InfZ , Z, and Z− + InfNew to conclude
that there is a sense in which Z− + InfNew is undoubtedly superior to the
two more standard variants of Zermelo set theory Z− + InfZ and Z. Still,
there is another question one may raise in investigating the relative strengths
of Z− + InfNew and the more familiar Z− + InfZ and Z: one may inquire
whether they can be interpreted, or at least relatively interpreted in each
other. If φ is a formula of the language of set theory, let φ M,E be the formula
that results when x ∈ y is replaced by the formula E(x, y) and all quantifiers
are relativized to M(x). As usual, a relative interpretation of a version of
Zermelo set theory, T1 , in another, T2 , consists of two formulas M(x) and
E(x, y) which allow one to prove for each axiom φ of T1 , the sentence φ M,E ,
the interpretation of φ, as a theorem of T2 .
Part of the interest of establishing the interpretability of a theory T1 in
another theory T2 derives from the relative consistency result which imme-
diately follows: If T1 is interpretable in T2 , then proofs of ⊥ in T1 can be
turned into proofs of ⊥ in T2 , and thus the consistency of T2 implies the
consistency of T1 . Yet, the question whether Z− +InfNew can be interpreted
in Z− + InfZ and Z has an added source of interest. There is no doubt that
Z− + InfNew permits the development of a vast part of ordinary mathe-
matics, but, since both Z− + InfZ and Z were revealed to be inadequate to
secure the existence of a vast array of subsets of Vù , one may inquire whether
they are still adequate to formalize mathematical practice. Establishing the
(relative) interpretability of Z− + InfNew in Z− + InfZ and Z will show that,
for the purposes of formalizing mathematical practice at least, Z− + InfNew
is no better than the more standard variants of Zermelo set theory Z− + InfZ
and Z.
We shall see that Z− +InfNew, Z and Z− +InfZ are equi-interpretable, i.e.,
they all can be (relatively) interpreted in each other. This is of course perfectly
compatible with the fact that Z− +InfNew is strictly stronger than both Z and
Z− +InfZ , and can be seen by reflecting on Ackermann’s familiar observation
that there is a model for ZF minus infinity in the natural numbers: m ∈ n if
and only if the coefficient of 2m in the binary representation of n is 1.
Theorem 5. Z− + InfNew is relatively interpretable in Z.

Sketch of proof. To produce a relative interpretation of Z− + InfNew in

Z, define the sequence Mn where n ∈ ù by the recursion:

M0 = ù, Mn+1 = P(Mn ) − FIN(ù),

 MODELS OF SECOND-ORDER ZERMELO SET THEORY 299

with FIN(ù) = { x ⊆ ù : x is finite ∧ x ∈ / ù }. The proviso that x ∈ / ù

is necessary in order to preserve extensionality. Let “M(x)” abbreviate:
“∃n x ∈ Mn ,” and construct a formula “E(x, y)” of the language of Z that
expresses the relation E(x, y): “either x and y are members of ù and the
binary numeral for y contains a 1 at the 2x ’s place, or x ∈ y otherwise.” The
trick is to notice that Ackermann’s coding can be extended to an isomorphism
from hVù+ù , ∈ ∩ (Vù+ù × Vù+ù )i onto hM, Ei. It is then routine to verify
that all the interpretations of axioms of Z− + InfNew are theorems of Z. ⊣
An immediate corollary of this result is that Z− +InfZ can be interpreted in
Z. And a completely parallel construction establishes both that Z− + InfNew
can be interpreted in Z− + InfZ , and that Z itself can be interpreted in
Z− + InfZ . Thus it can be concluded that Z− + InfNew, Z− + InfZ and Z
are equi-interpretable.15
This result provides a comforting response to the question whether Z, or
Z− + InfZ for that matter, are still sufficient for the development of ordinary
mathematics: They still are; Z− + InfNew, a theory suited to describe an
important fragment of the cumulative hierarchy, can be interpreted in both
Z− + InfZ and Z.

§5. Characterizing the Vë ’s for limit ordinals ë > ù. The results of this
paper make plain, I would like to suggest, that what are perhaps the more
familiar versions of second-order Zermelo set theory fail to characterize the
initial segments of the cumulative hierarchy indexed by a limit ordinal ë > ù.
The question now remains of what else exactly is required to characterize
the Vë ’s for limit ordinals ë > ù. The purpose of this section is to answer
this question by producing a variation of second-order Zermelo set theory
whose axioms can only be satisfied in models of the form hVë , ∈ ∩ (Vë × Vë )i
for ë a limit ordinal greater than ù.
The first point to be noticed is that if we take the variables α, â, ã, . . .
to range over (von Neumann) ordinals, then the Vα ’s can be characterized
thus:
x = Vα ↔ ∃f (Fnc f ∧ Dom(f) = α + 1
∧ ∀â ≤ α ∀y (y ∈ f(â) ↔ ∃ë < â (y ⊆ f(ë))) ∧ f(α) = x).
And this immediately suggests a formulation of the axiom of regularity
which can be used to enforce the modern cumulative view of the set-theoretic
universe. This axiom reads:
∀x ∃α ∃y (y = Vα ∧ x ⊆ y).
15
Z, it should be noted, proves relativizations of all the instances of set-theoretic induction
and of the axiom asserting the existence of a transitive superset of a set. And perfectly
analogous results hold when we restrict our attention to first-order formulations of Zermelo
set theory.
300 GABRIEL UZQUIANO

Now consider the theory that results from second-order Z when the axiom
of regularity, Reg, is replaced by the axiom: ∀x ∃α ∃y (y = Vα ∧ x ⊆ y).
Then, the distinctions among the axioms of infinity discussed in section 2
collapse, and the axioms of second order Z + ∀x ∃α ∃y (y = Vα ∧ x ⊆ y)
do characterize the Vë ’s for limit ordinals ë > ù.16
Notice first that the second-order principle of set-theoretic induction,
∀X (∃x Xx → (∃x Xx ∧ ∀y (y ∈ x → ¬Xy))),
is a theorem of the system. (Suppose Xx. Then, ∃α ∃x (Xx ∧ x ⊆ Vα ),
and, by induction on the ordinals,
∃â (∃x (Xx ∧ x ⊆ Vâ ) ∧ ∀ë < â ¬∃x (Xx ∧ x ⊆ Vë )).
Pick such â and x. Then of course, ∀y ∈ x ¬Xy, since, otherwise, there
would be an ordinal ë < â such that Xy ∧ y ⊆ Vë .)
Theorem 6. M is a model of second-order Z + ∀x ∃α ∃y (y = Vα ∧ x ⊆ y)
if and only if M is of the form hVë , ∈ ∩ (Vë × Vë )i for ë a limit ordinal greater
than ù.
Sketch of proof. Suppose M is a model of second-order Z + ∀x ∃α ∃y
(y = Vα ∧ x ⊆ y). By the (second-order) principle of set-theoretic in-
duction and extensionality, the ∈-relation of the model is well-founded and
extensional, and, hence, by the Mostowski isomorphism theorem, M is
isomorphic to a transitive ∈-model. Without loss of generality, let us now
confine attention to transitive ∈-models of Z + ∀x ∃α ∃y (y = Vα ∧ x ⊆ y).
Suppose M is such a model, and let ë be the least von Neumann ordinal not
in the domain. ë is a limit ordinal greater than ù, since the model satisfies
the axiom of infinity and is closed under successor. Show that every member
of Vë is a member of the domain. For every â < ë, â is a member of the
16
Richard Montague devised in [8] a sentence whose models are only initial segments of
the cumulative hierarchy Vα indexed by an arbitrary ordinal α. Not much later, in [11],
Dana Scott exploited that insight to produce an axiomatization of set theory designed to
insure that the set-theoretic universe is arrayed in a cumulative hierarchy of stages or “partial
universes.” Intuitively, a partial universe is a set of sets of rank less than some one ordinal
α, and a partial universe W is earlier than a partial universe V if and only if W ∈ V . The
axioms of the theory are those of extensionality and separation, an axiom of accumulation
according to which the members of a partial universe are the members or subsets of earlier
partial universes, and an axiom of restriction according to which every set is a subset of a
partial universe. From these axioms, Scott is able to deduce that the partial universes are
well-ordered, that the sets are well-founded, and all the usual axioms of set theory other than
infinity, replacement, and choice.
Our new axiom here is, in effect, aimed to achieve the same effect achieved by Scott’s axiom
of restriction: to ensure that every set is a subset of some Vα for some ordinal α. It should
come as no surprise that the second-order theory one obtains from adjoining an axiom of
infinity to the rest of the axioms of the second-order version of Scott’s theory characterizes
the Vë for limit ë > ù. The proof of this fact is entirely analogous to the one to be offered
for the variation on second-order Zermelo set theory under consideration.
 MODELS OF SECOND-ORDER ZERMELO SET THEORY 301

domain, and, since ∀x ∃α ∃y (y = Vα ∧ x ⊆ y), we have that Vâ itself is a

member of the domain. Therefore, since the domain of M is transitive, and
Vë = { Vâ : â < ë }, we conclude that every member of Vë is a member
S

of the domain of M. For the converse inclusion, observe that if x is in the

model, then Vrank(x) is a subset of the domain. But now, since ë is not in
the model, neither are the Vã ’s, for ã > ë, subsets of the domain. And thus,
given that Vrank(x) is included in the domain for each x in it, we conclude
that no set of rank > ë is in the model. ⊣

§6. Conclusion. The axiom of replacement is often regarded a mere clo-

sure postulate on the ordinal levels of the cumulative structure with few or
no applications within the first ù + ù levels of the cumulative hierarchy. The
results of the first part of the paper, however, make plain that replacement
has important applications at remarkably low levels of the cumulative hier-
archy; sometimes, it is even required to ensure that the cumulation of sets
described by standard set theory reaches the level omega in the cumulative
hierarchy.
Another important effect of adjoining the replacement to the Zermelo ax-
ioms is the assurance that the set-theoretic universe is arrayed in a cumulative
structure of levels or stages. The results of this paper indicate that, in the
absence of replacement, the Zermelo axioms are not adequate to describe
the initial segments of the cumulative hierarchy indexed by limit ordinals
ë > ù. To capture the modern cumulative view of the set-theoretic universe,
one could replace the axiom of regularity of second-order Z by the axiom
∀x ∃α ∃y (y = Vα ∧ x ⊆ y), and the result would be an extension of second-
order Z that can only be satisfied in models of the form hVë , ∈ ∩ (Vë × Vë )i
for some limit ordinal ë > ù.
One foreseeable source of discontent with second-order Z+∀x ∃α ∃y (y =
Vα ∧ x ⊆ y) is that, unlike Zermelo-Fraenkel set theory, this theory enforces
the cumulative hierarchy view by brute force, but it is not a natural extension
of the Zermelo axioms. Doubtless, some will suggest that the moral to
be extracted is that replacement may very well be the only natural principle
about sets whose addition to the Zermelo axioms delivers a system of axioms
which contains an implicit description of a cumulative hierarchy of levels or
stages. What is the force of this consideration, however, is a question I shall
not pursue here.17

REFERENCES

[1] Paul Bernays, A system of axiomatic set theory VI, Journal of Symbolic Logic, vol. 13
(1948), pp. 65–79.

17
I would like to thank Michael Glanzberg for helpful comments. Thanks especially to
Vann McGee for providing extensive comments that much improved the paper.
302 GABRIEL UZQUIANO

[2] , A system of axiomatic set theory VII, Journal of Symbolic Logic, vol. 19 (1954),
pp. 81–96.
[3] George Boolos, The advantages of honest toil over theft, Mathematics and mind,
Oxford University Press, 1994.
[4] Frank Drake, Set theory: An introduction to large cardinals, North-Holland, 1974.
[5] Ulrich Felgner, Models of ZF-set theory, Lecture Notes in Mathematics, no. 223,
Springer-Verlag, Berlin, 1971.
[6] Abraham Fraenkel, Yehoshua Bar-Hillel, and Azriel Levy, Foundations of set
theory, North-Holland, 1973.
[7] Azriel Levy, Basic set theory, Springer-Verlag, 1979.
[8] Richard Montague, Set theory and higher-order logic, Formal systems and recursive
functions (J. Crossley and M. Dummett, editors), North-Holland, 1967, pp. 131–148.
[9] Yiannis Moschovakis, Notes on set theory, Springer-Verlag, 1994.
[10] L. Rieger, A contribution to Gödel’s axiomatic set theory, Czechoslovak Mathematical
Journal, vol. 7 (1957), pp. 323–357.
[11] Dana Scott, Axiomatizing set theory, Axiomatic set theory (Thomas Jech, editor),
Proceedings of Symposia in Pure Mathematics, vol. II, American Mathematical Society,
1974, pp. 207–214.
[12] Ernst Zermelo, Über Grenzzahlen und Mengenbereiche: Neue Untersuchungen über
die Grundlagen der Mengenlehre, Fundamenta Mathematicae, vol. 16 (1930), pp. 29– 47.

DEPARTMENT OF PHILOSOPHY
UNIVERSITY OF ROCHESTER
P. O. BOX 270078
ROCHESTER, NEW YORK 14627-0078, USA
E-mail: [email protected]