What Justifies Con(ZFC)?

The metalanguage-hierarchy remark observed that asserting "$\mathrm{ZFC}$ has a model" tacitly assumes $\mathrm{Con}(\mathrm{ZFC})$ — the consistency of ZFC — and that this assumption cannot be discharged from within ZFC itself (Gödel's second incompleteness theorem). So what does justify it? This remark takes up that epistemological question.

The headline: nothing proves it, and nothing can non-circularly. The justification is necessarily extra-deductive — a convergence of intuitive, empirical, structural, and (for some) metaphysical considerations.

Why it cannot be a proof

Any justification of $\mathrm{Con}(\mathrm{ZFC})$ runs into a wall:

• $\mathrm{ZFC}⊬\mathrm{Con}(\mathrm{ZFC})$ by Gödel's second incompleteness theorem (assuming ZFC is consistent). The theory cannot certify its own consistency.
• Stronger theories prove it, but only relocate the question. $\mathrm{ZFC}+$ "there is an inaccessible cardinal $\kappa$" proves $\mathrm{Con}(\mathrm{ZFC})$, because $V_{\kappa }$ is then a set model (see the metalanguage hierarchy on strictly stronger metatheories). But this just pushes the burden up: why believe the stronger theory? The regress does not bottom out in a self-justifying proof.
• No ordinal-analytic rescue (unlike PA). For Peano arithmetic, Gentzen's consistency proof reduces $\mathrm{Con}(\mathrm{PA})$ to transfinite induction up to ${\epsilon }_0$ — arguably more evident than PA itself. Full ZFC is far beyond current ordinal analysis; there is no comparable reduction of $\mathrm{Con}(\mathrm{ZFC})$ to a "more obvious" principle. So even the proof-theorist's partial route is unavailable here, and $\mathrm{Con}(\mathrm{ZFC})$ rests on weaker ground than $\mathrm{Con}(\mathrm{PA})$.

Whatever justifies $\mathrm{Con}(\mathrm{ZFC})$ is therefore non-mathematical in the strict deductive sense — a blend of the following.

The four pillars

1. Intrinsic — the iterative conception (usually taken as primary)

The ZFC axioms are not an arbitrary list; they describe a single coherent picture, the cumulative hierarchy $V={\bigcup }_{\alpha }{V}_{\alpha }$ of sets built in well-founded stages (see Axiomatic Set Theory (ZFC)). On this iterative conception, each axiom is seen to hold of the intended structure, and a structure that coheres as a conception is a fortiori consistent. This is Gödel's sense that the axioms "force themselves upon us as being true," and Boolos's defence of the iterative conception. The warrant here is conceptual/intuitive and is prior to any track record.

2. Quasi-empirical — the track record of practice

A century of intense, adversarial use — thousands of mathematicians deriving an enormous body of consequences — has turned up no contradiction. This is the inductive / naturalist pillar (Lakatos's quasi-empiricism, Maddy's naturalism): consistency is treated like a well-corroborated empirical hypothesis. It is genuine evidence — but corroboration, not ground (see the cautionary tale below).

3. Structural — the coherence of consistency strength

The large-cardinal axioms line up in a startlingly linear, well-ordered hierarchy of consistency strength, and natural statements from across mathematics slot into that hierarchy at definite points. This unanticipated coherence (Steel, Maddy) is itself evidence: a latent inconsistency in ZFC would be a strange thing to cohere so neatly with everything calibrated above and below it.

4. Metaphysical — realism

For the set-theoretic platonist, the sets simply exist, the axioms are true of them, and truth entails consistency. Clean — but it trades the consistency question for the existence question, and so persuades only those already inclined to realism.

The empirical pillar and its cautionary tale

The appeal to practice is load-bearing but fallible, and set theory carries the scar that proves it. Frege's system — naive unrestricted comprehension — was used and believed until Russell's paradox ($R=\{x:x\notin x\}$) detonated it (see ZFC § Russell's paradox). The pre-1901 "track record" was clean and meant nothing. That history is exactly why most philosophers do not rest on the empirical pillar alone: the iterative conception matters because it explains why ZFC avoids the paradoxes in a principled way (no universal set; Separation only carves subsets out of existing sets), rather than merely "we have not tripped over a contradiction yet." Empirical success confirms the intuitive picture; it does not replace it.

Revisability: would we just patch it?

A natural reaction to all this: if ZFC turned out inconsistent, we would simply adjust it back to consistency — as the discovery of Russell's paradox led not to despair but to repair (Zermelo's Separation trimmed the paradoxical sets while keeping Cantor's useful core). This is the fallibilist / Lakatosian picture — axioms as revisable conjectures, foundations as self-correcting — and it is largely healthy. Our deepest commitment is arguably not to "ZFC specifically is consistent" but to "some consistent theory in the vicinity captures the iterative conception and preserves ordinary mathematics," with ZFC as a swappable scaffold. Four caveats keep "we'd just patch it" from proving too much.

• Shallow vs. deep inconsistency. Russell's paradox was a local flaw in one axiom (unrestricted comprehension) with a principled fix consonant with a better picture. The confidence that we "could always adjust" relies on any future inconsistency being similarly peripheral. A contradiction derivable from the core — Separation + Power Set + Infinity in a way implicating the iterative conception itself — might admit no graceful trim, threatening the conception rather than just the syntax.
• The patched theory faces the same problem. "Adjust until consistent" presumes a consistent neighbour exists and can be found — but the repaired theory's own $\mathrm{Con}$ is again unprovable from within and not guaranteed (Gödel 2 is indifferent to which theory you pick). You land one rung over, in exactly this remark's situation.
• Optimistic induction, not evidence of consistency. "It would be adjusted" describes the process and reflects a survivorship effect: the surviving theories are merely those not yet refuted. Each repair answers a failure; none guarantees against the next. So this is a reason not to panic, not a reason to believe any current theory consistent.
• Classical explosion makes a contradiction catastrophic but localizable. In classical ZFC an inconsistency proves everything (ex contradictione quodlibet — see paraconsistent logic), so it would be disastrous yet immediately visible: one could trace the offending derivation and see which axiom to cut. That traceability is why repair is feasible. The alternative response — keep the axioms but weaken the logic to a paraconsistent one that tolerates the contradiction — is the branch the paraconsistent program explores.

So "we would just patch it" is the right fallibilist instinct, but it presupposes the flaw is shallow, a consistent neighbour exists, and we would recognize it — none guaranteed — and the patched theory would need the same non-deductive justification all over again.

Bottom line

$\mathrm{Con}(\mathrm{ZFC})$ is justified by a convergence of these strands, not by proof. Empirical practice is one real strand, but the dominant view is that it confirms the iterative conception rather than standing on its own. The buck genuinely stops at informal, fallibilist mathematical judgment — the same "the buck stops at informal reasoning" terminus reached in the metalanguage hierarchy, now cashed out for consistency itself.

Related discussions: The Metalanguage Hierarchy and Semantics in Mathematics (where the tacit $\mathrm{Con}(\mathrm{ZFC})$ assumption arises), Axiomatic Set Theory (ZFC) (the axioms, the cumulative hierarchy, Russell's paradox), and First-Order Logic (Gödel's incompleteness theorems).