Formalization of Forcing in Isabelle/ZF

01/27/2020 ∙ by Emmanuel Gunther, et al. ∙ Universidad Nacional de Cordoba 0

We formalize the theory of forcing in the set theory framework of Isabelle/ZF. Under the assumption of the existence of a countable transitive model of ZFC, we construct a proper generic extension and show that the latter also satisfies ZFC. In doing so, we remodularized Paulson's ZF-Constructibility library.



There are no comments yet.


page 1

page 2

page 3

page 4

This week in AI

Get the week's most popular data science and artificial intelligence research sent straight to your inbox every Saturday.

1 Introduction

The present work reports on the third stage of our project of formalizing the theory of forcing and its applications as presented in one of the more important references on the subject, Kunen’s Set Theory [7] (a rewrite of the classical [6]).

We work using the implementation of Zermelo-Fraenkel () set theory Isabelle/ZF by Paulson and Grabczewski [12]. In an early paper [2], we set up the first elements of the countable transitive model (ctm) approach, defining forcing notions, names, generic extensions, and showing the existence of generic filters via the Rasiowa-Sikorski lemma (RSL). Our second (unpublished) technical report [3] advanced by presenting the first accurate formal abstract of the Fundamental Theorems of Forcing, and using them to show that that the axioms apart from Replacement and Infinity hold in all generic extensions.

This paper contains the proof of Fundamental Theorems and complete proofs of the Axioms of Infinity, Replacement, and Choice in all generic extensions. In particular, we were able to fulfill the promised formal abstract for the Forcing Theorems almost to the letter. A requirement for Infinity and the absoluteness of forcing for atomic formulas, we finished the interface between our development and Paulson’s constructibility library [11] which enables us to do well-founded recursion inside transitive models of an appropriate finite fragment of . As a by-product, we honored a long debt: the fact that the generic filter belongs to the extension and . In order to take full advantage of the constructibility library we enhanced it by weakening the assumption of many results and also extended it with stronger results. Finally, our development is now independent of : We modularized RSL in such a way that a version for countable posets does not require choice.

In the course of our work we found it useful to develop Isar methods to automate repetitive tasks. Part of the interface with Paulson’s library consisted in constructing formulas for each relativized concept; and actually Isabelle’s Simplifier can synthesize terms for unbound schematic variables in theorems. The synthesized term, however, is not available outside the theorem; we introduced a method that creates a definition from a schematic goal. The second method is concerned with renaming of formulas: we improved our small library of bounded renamings with a method that given the source and target environments figures out the renaming function and produces the relevant lemmas about it.

The source code of our formalization, written for the 2019 version of Isabelle, can be browsed and downloaded at

Related work

To the best of our knowledge, all of the previous works in formalization of the method of forcing have been done in different variants of type theory, and none of them uses the ctm approach. The most important is the recent one by Han and van Doorn [4, 5], which includes a formalization of the independence of by means the Boolean-valued approach to forcing, using the Lean proof assistant [8].


We assume some familiarity with Isabelle and some terminology of set theory. The current paper is organized as follows. In Sect. 2 we comment briefly on the meta-theoretical implications of using Isabelle/ZF. In Sect. 3 we explain the use of relativized concepts and its importance for the ctm approach. The next sections cover the core of this report: In Sect. 4 we introduce the definition of the formula transformer and reasoning principles about it; in Sect. 5 we present the proofs of the fundamental theorems of forcing. We show in Sect. 6 a concrete poset that leads to a proper extension of the ground model. In Sect. 7 we complete the proof that every axiom and axiom scheme of ZFC is valid in any generic extension. We close the paper by noting the next steps in our project and drawing conclusions from this formalization.

2 Isabelle and (meta)theories

Isabelle [13, 10] is a general proof assistant based on fragment of higher-order logic called Pure. The results presented in this work are theorems of a version of set theory (without the Axiom of Choice, ) called Isabelle/ZF, which is one of the “object logics” that can be defined on top of Pure (which is then used as a language to define rules). Isabelle/ZF defines types i and o for sets and booleans, resp., and the axioms are written down as terms of type o.

More specifically, our results work under the hypothesis of the existence of a ctm of .111By Gödel’s Second incompleteness theorem, one must assume at least the existence of some model of . The countability is only used to prove the existence of generic filters and can be thus replaced in favor of this hypothesis. This hypothesis follows, for instance, from the existence of an inaccessible cardinal. As such, our framework is weaker than those found usually in type theories with universes, but allows us to work “platonistically”— assuming we are in a universe of sets (namely, i) and performing constructions there.

On the downside, our approach is not able to provide us with finitary consistency proofs. It is well known that, for example, the implication can be proved in primitive recursive arithmetic (PRA). To achieve this, however, it would have implied to work focusing on the proof mechanisms and distracting us from our main goal, that is, formalize the ctm approach currently used by many mathematicians.

It should be noted that Pure is a very weak framework and has no induction/recursion capabilities. So the only way to define functions by recursion is inside the object logic. (This works the same for Isabelle/HOL.) For this reason, to define the relation of forcing, we needed to resort to internalized first-order formulas: they form a recursively defined set formula. For example, the predicate of satisfaction sats::iiio (written for a set , and ) had already been defined by recursion in [11].

3 Relativization, absoluteness, and the axioms

The concepts of relativization and absoluteness (due to Gödel, in his proof of the relative consistency of [1]) are both prerequisites and powerful tools in working with transitive models. A class is simply a predicate with at least one free variable . The relativization of a set-theoretic definition (of a relation such as “ is a subset of ” or of a function like ) to a class is obtained by restricting all of its quantifiers to .

The new formula corresponds to what is obtained by defining the concept “inside” . In fact, for a class corresponding to a set (i.e. ), the relativization of a sentence is equivalent to the satisfaction of in the first-order model .

It turns out that many concepts mean the same after relativization to a nonempty transitive class ; formally

When this is the case, we say that the relation defined by is absolute for transitive models.222Absoluteness of functions also requires the relativized definition to behave functionally over . As examples, the relation of inclusion —and actually, any relation defined by a formula (equivalent to one) using only bounded quantifiers and — is absolute for transitive models. On the contrary, this is not the case with the powerset operation.

A benefit of working with transitive models is that many concepts (pairs, unions, and fundamentally ordinals) are uniform across the universe i, a ctm (of an adequate fragment of ) and any of its extensions . For that reason, then one can reason “externally” about absolute concepts, instead of “inside” the model; thus, one has at hand any already proved lemma about the real concept.

Paulson’s formalization [11] of Gödel’s [1] already contains absoluteness results which were crucial to our project; we realized however that they could be refactorized to be more useful. The main objective is to maximize applicability of the relativization machinery by adjusting the hypothesis of a greater part of it early development. Paulson’s architecture had only in mind the consistency of , but, for instance, in order to apply it in the development of forcing, too much is assumed at the beginning; more seriously, some assumptions cannot be regarded as “first-order” (v.g. the Replacement Scheme) because of the occurrence of predicate variables. The version we present of the constructibility library, ZF-Constructible-Trans, weakens the assumptions of many absoluteness theorems to that of a nonempty transitive class; we also include some stronger results such as the relativization of powersets.

Apart from the axiom schemes, the axioms are initially stated as predicates on classes (that is, of type (io)o); this formulation allows a better interaction with ZF-Constructible. The axioms of Pairing, Union, Foundation, Extensionality, and Infinity are relativizations of the respective traditional first-order sentences to the class argument. For the Axiom of Choice we selected a version best suited for the work with transitive models: the relativization of a sentence stating that for every there is surjection from an ordinal onto . Finally, Separation and Replacement were treated separately to effectively obtain first-order versions afterwards. It is to be noted that predicates in Isabelle/ZF are akin to second order variables and thus do not correspond to first-order formulas. For that reason, Separation and Replacement predicate on the satisfaction of a formula . We improved their specification, with respect to our previous [3], by lifting the arity restriction for the parameter ; consequently we get rid of tupling and thus various proofs are now slicker.

A benefit of having class versions of the axioms is that we can apply our synthesis method to obtain their internal, first-order counterparts.For the case of the Pairing Axiom, the statement for classes is the following upairaxCxCyCzC upairCxyz where upair says that z is the unordered pair of x and y, relative to C.

The following schematic lemma synthesizes its internal version,333The use of such schematic goals and the original definition of the collection of lemmas seprules are due to Paulson. schematicgoal ZFpairingauto    upairaxA  A   zfpairunfolding upairaxdef   by rule seprules  simp (the actual formula obtained is Forall(Forall(Exists(upairfm(2,1,0))))) and our synthesize method introduces a new term ZFpairingfm for it. synthesize ZFpairingfm fromschematic ZFpairingauto

4 The definition of

The core of the development is showing the definability of the relation of forcing. As explained in [3, Sect. 8], this comprises the definition of a function that maps the set of internal formulas into itself. It is the very reason of applicability of forcing that the satisfaction of a first-order formula in all of the generic extensions of a ctm can be “controlled” in a definable way from (viz., by satisfaction of the formula ).

In fact, given a forcing notion (i.e. a preorder with a top element) in a ctm , Kunen defines the forcing relation model-theoretically by considering all extensions with generic for . Then two fundamental results are proved, the Truth Lemma and the Definability Lemma; but the proof of the first one is based on the formula that witnesses Definability. To make sense of this in our formalization, we started with the internalized relation and then proved that it is equivalent to the semantic version (“definitionofforces,” in the next section). For that reason, the usual notation of the forcing relation (for a list of “names”), abbreviates in our code the satisfaction by of :   p   env      M pPleqone  env  forces

The definition of proceeds by recursion over the set and its base case, that is, for atomic formulas, is (in)famously the most complicated one. Actually, newcomers can be puzzled by the fact that forcing for atomic formulas is also defined by (mutual) recursion: to know if is forced by (notation: ), one must check if is forced for moving in the transitive closure of . To disentangle this, one must realize that this last recursion must be described syntactically: the definition of for atomic is then an internal definition of the alleged recursion on names.

Our aim was to follow Kunen [7, p. 257], where the following mutual recursion is given:


Note that the definition of is equivalent to require the set

to be dense below .

It was not straightforward to use the recursion machinery of Isabelle/ZF to define and . For this, we defined a relation on 4-tuples of elements of , proved that it is well-founded and, more important, we also proved an induction principle for this relation: lemma forcesinduction  assumes       domain  Q  R444The logical primitives of Pure are , &&&, and (implication, conjunction, and universal quantification, resp.), which operate on the meta-booleans prop.       domain  domain  R  R       Q  shows    Q  R and obtained both functions as cases of a another one, , using a single recursion on . Then we obtained (1) and (2) as our corollaries defforceseq and defforcesmem.

Other approaches, like the one in Neeman [9] (and Kunen’s older [6]), prefer to have a single, more complicated, definition by simple recursion for and then define explicitly. On hindsight, this might have been a little simpler to do, but we preferred to be as faithful to the text as possible concerning this point.

Once and its relativized version were defined, we proceeded to show absoluteness and provided internal definitions for the recursion on names using results in ZF-Constructible. This finished the atomic case of the formula-transformer . The characterization of for negated and universal quantified formulas is given by the following lemmas, respectively: lemma satsforcesNeg  assumes    pP env  listM formula  shows    M pPleqone  env  forcesNeg         qM qP  isleqMleqqp            M qPleqoneenv  forces

lemma satsforcesForall  assumes    pP env  listM formula  shows    MpPleqone  env  forcesForall       xM   M pPleqonex  env  forces

Let us note in passing another improvement over our previous report: we made a couple of new technical results concerning recursive definitions. Paulson proved absoluteness of functions defined by well-founded recursion over a transitive relation. Some of our definitions by recursion (check and forces) do not fit in that scheme. One can replace the relation for its transitive closure in the recursive definition because one can prove, in general, that whenever .

5 The forcing theorems

After the definition of is complete, the proof of the Fundamental Theorems of Forcing is comparatively straightforward, and we were able to follow Kunen very closely. The more involved points of this part of the development were those where we needed to proved that various (dense) subsets of were in ; for this, we had to recourse to several ad-hoc absoluteness lemmas.

The first results concern characterizations of the forcing relation. Two of them are ForcesMember:

p  Membernm env  forcesmempt1t2,

where t1 and t1 are the nth resp. mth elements of env, and ForcesForall:

p  Forall env  xM p   x  env.

Equivalent statements, along with the ones corresponding to ForcesEqual and ForcesNand, appear in Kunen as the inductive definition of the forcing relation [7, Def. IV.2.42].

As with the previous section, the proofs of the forcing theorems have two different flavors: The ones for the atomic formulas proceed by using the principle of forcesinduction, and then an induction on wraps the former with the remaining cases (Nand and Forall).

As an example of the first class, we can take a look at our formalization of [7, Lem. IV.2.40(a)]. Note that the context (a “locale,” in Isabelle terminology, namely forcingdata) of the lemma includes the assumption of P being a forcing notion, and the predicate of being -generic is defined in terms of P:

lemma IV240a  assumes    MgenericG  shows   MMpGforceseqpvalGvalG    MMpGforcesmempvalGvalG Its proof starts by an introduction of forcesinduction; the inductive cases for each atomic type were handled before as separate lemmas (IV240amem and IV240aeq). We illustrate with the statement of the latter. lemma IV240aeq  assumes    MgenericG pG forceseqp    and    IHq  qP  qG  domain  domain          forcesmemq  valG  valG         forcesmemq  valG  valG  shows    valG  valG

Examples of proofs using the second kind of induction include the basic strengtheninglemma and the main results in this section, the lemmas of Density (actually, its nontrivial direction densebelowimpforces) and Truth, which we state next. lemma densitylemma  assumes    pP formula envlistM aritylengthenv  shows    p   env  densebelowqP q   envp lemma truthlemma  assumes     formula MgenericG  shows      env envlistM  aritylengthenv        pG p   env    MG mapvalGenv   From these results, the semantical characterization of the forcing relation (the “definition of [7, IV.2.22]) follows easily: lemma definitionofforces  assumes    pP formula envlistM aritylengthenv  shows    p   env      G MgenericG pG  MG mapvalGenv  

The present statement of the Fundamental Theorems is almost exactly the same of those of [3], with the only modification being the bound on arities and a missing typing constraint. This implied only minor adjustments in the proofs of the satisfaction of axioms.

6 Example of proper extension

Even when the axioms of are proved in the generic extension, one cannot claim that the magic of forcing has taken place unless one is able to provide some proper extension with the same ordinals. After all, one is assuming from starters a model of , and in some trivial cases might end up to be exactly ; this is where proper enters the stage. But, for instance, in the presence of large cardinals, a model might be an end-extension of —this is were we ask the two models to have the same ordinals, the same height.

Three theory files contain the relevant results. Ordinals_In_MG.thy shows, using the closure of under ranks, that and share the same ordinals (actually, ranks of elements of are bounded by the ranks of their names in ): lemma rankval rankvalGx  rankxlemma OrdMGiff  assumes Ord   shows   M    MG To prove these results, we found it useful to formalize induction over the relation ed, which is key to arguments involving names.

Succession_Poset.thy contains our first example of a poset that interprets the locale forcingnotion, essentially the notion for adding one Cohen real. It is the set of all finite binary sequences partially ordered by reverse inclusion. The sufficient condition for a proper extension is that the forcing poset is separative: every element has two incompatible (s) extensions. Here, sequpdfx adds x to the end of the sequence f.

lemma seqspaceseparative  assumes f2  shows sequpdf0 s sequpdf1

We prove in the theory file Proper_Extension.thy that, in general, every separative forcing notion gives rise to a proper extension.

7 The axioms of replacement and choice

In [3] we proved that any generic extension preserves the satisfaction of almost all the axioms, including the separation scheme (we adapted those proofs to the current statement of the axiom schemes). Our proofs that Replacement and choice hold in every generic extension depend on further relativized concepts and closure properties.

7.1 Replacement

The proof of the Replacement Axiom scheme in in Kunen uses the Reflection Principle relativized to . We took an alternative pathway, following Neeman [9]. In his course notes, he uses the relativization of the cumulative hierarchy of sets.

The family of all sets of rank less than is called Vset in Isabelle/ZF. We showed, in the theory file Relative_Univ.thy the following relativization and closure results concerning this function, for a class satisfying the locale Meclose plus the Powerset Axiom and four instances of replacement. lemma Vsetabs  Mi MV Ordi                       isVsetMiV  V  xVseti Mx lemma Vsetclosed  Mi Ordi   MxVseti Mx We also have the basic result lemma MintoVset  assumes Ma  shows iM VM ordinalMi  isVfromM0iV  aV stating that is included in (it’s actually equal).

For the proof of the Replacement Axiom, we assume that is functional in its first two variables when interpreted in and the first ranges over the domain c. Then we show that the collection of all values of the second variable, when the first ranges over c, belongs to : lemma ReplacesatsinMG  assumes    cMG env  listMG      formula arity  2  lengthenv    univalentMG c x v MG xvenv    shows    v xc vMG  MG xvenv    MG From this, the satisfaction of the Replacement Axiom in follows very easily.

The proof of the previous lemma, following Neeman, proceeds as usual by turning an argument concerning elements of to one involving names lying in , and connecting both worlds by using the forcing theorems. In the case at hand, by functionality of we know that for every there exists exactly one such that . Now, given a name for , every name of an element of belongs to , which is easily seen to be in . We will use to be the domain in an application of the Replacement Axiom in . But now, obviously, we have lost functionality since there are many names for a fixed in . To solve this issue, for each we calculate the minimum rank of some such that if there is one, or otherwise. By Replacement in , we can show that the supremum ?sup of these ordinals belongs to and we can construct a ?bigname xVsetsup x    one whose interpretation by (any generic) will include all possible elements as above.

The previous calculation required some absoluteness and closure results regarding the minimum ordinal binder, Least, also denoted , that can be found in the theory file Least.thy.

7.2 Choice

A first important observation is that the proof of in only requires the assumption that satisfies (a finite fragment of) . There is no need to invoke Choice in the metatheory.

Although our previous version of the development used , that was only needed to show the Rasiowa-Sikorski Lemma (RSL) for arbitrary posets. We have modularized the proof of the latter and now the version for countable posets that we use to show the existence of generic filters does not require Choice (as it is well known). We also bundled the full RSL along with our implementation of the principle of dependent choices in an independent branch of the dependency graph, which is the only place where the theory ZF.AC is invoked.

Our statement of the Axiom of Choice is the one preferred for arguments involving transitive classes satisfying :

xM aM fM ordinalMa  surjectionMaxf

The Simplifier is able to show automatically that this statement is equivalent to the next one, in which the real notions of ordinal and surjection appear:

xM aM fM Orda  f  surjax

As with the forcing axioms, the proof of in follows the pattern of Kunen [7, IV.2.27] and is rather straightforward; the only complicated technical point being to show that the relevant name belongs to . We assume that a belongs to and has a name . By in , there is a surjection s from an ordinal () onto . Now

opairnamechecks   one

is a name for a function f with domain such that a is included in its range, and where opairname

is a name for the ordered pair

. From this, in follows easily.

7.3 The main theorem

With all these elements in place, we are able to transcript the main theorem of our formalization: theorem extensionsofctms  assumes     M  nat TranssetM M  ZF  shows     N       M  N  N  nat  TranssetN  N  ZF  MN        Ord    M    N       M  AC  N  ZFC Here, stands for equipotency, nat is the set of natural numbers, and the predicate Transset indicates transitivity; and as usual, AC denotes the Axiom of Choice, and ZF and ZFC the corresponding subsets of formula.

8 Conclusion and future work

We consider that the formalization of the definition of and its recursive characterization of forcing for atomic formulas is a turning point in our project; the reason for this is that all further developments will not involve such a daunting metamathematical component. Even the proofs of the Fundamental Theorems of Forcing turned out to follow rather smoothly after this initial setup was ready, the only complicated affair being to show that various dense sets belong to . Actually, this is a point to be taken care of: For every new concept that is introduced, some lemmas concerning relativization and closure must be proved to be able to synthesize its internal definition. Further automation must be developed for this purpose.

In the course of obtaining internal formulas for the atomic case of forcing, a fruitful discussion concerning complementary perspectives on the role of proof assistants took place. An earlier approach relied more heavily in formula synthesis, thus making the Simplifier an indispensable main character. Following this line was quickier from the coding point of view since few new primitives were introduced and thus fewer lemmas concerning absoluteness and arities. On the downside, processing was a bit slower, the formulas synthesized were gigantic and the process on a whole as more error-prone. In fact, this approach was unsuccessful and we opted for a more detailed engineering, defining all intermediate steps. So the load on the assistant, in this part of the development, balanced from code-production to code-verification.

The next task in our path is pretty clear: To develop the forcing notions to obtain the independence of along with the prerequisite combinatorial results, v.g. the -system lemma. A development of cofinality is under way in a joint work with E. Pacheco Rodríguez, which is needed for a general statement of the latter.

In a second release of ZF-Constructible-Trans, we intend to conform it to the lines of Basic Set Theory (BST) [7, I.3.1] in which elementary results have proofs using alternatively Powerset or Replacement. The interest in this arises because many natural set models (rank-initial segments of the universe or the family of sets of cardinality less than hereditarily) satisfy one of those axioms and not the other. There are also still some older or less significant proofs written in tactical (apply) format; we hope we will find the time to translate them to Isar. Finally, the automation of formula synthesis is on an early stage of development; finishing that module will make writing our proofs of closure under various operations faster, and also turn the set theory libraries more usable to other researchers.