# The Axiom of Multiple Choice and Models for Constructive Set Theory

## Abstract

We propose an extension of Aczel’s constructive set theory **CZF** by an axiom for inductive types and a choice principle, and show that this extension has the following properties: it is interpretable in Martin-Löf’s type theory (hence acceptable from a constructive and generalised-predicative standpoint). In addition, it is strong enough to prove the Set Compactness Theorem and the results in formal topology which make use of this theorem. Moreover, it is stable under the standard constructions from algebraic set theory, namely exact completion, realizability models, forcing as well as more general sheaf extensions. As a result, methods from our earlier work can be applied to show that this extension satisfies various derived rules, such as a derived compactness rule for Cantor space and a derived continuity rule for Baire space. Finally, we show that this extension is robust in the sense that it is also reflected by the model constructions from algebraic set theory just mentioned.

## 1Introduction

There is a distinctive stance in the philosophy of mathematics which is usually called “generalised predicativity”. It is characterised by the fact that it does not accept non-constructive and impredicative arguments, but it does allow for the existence of a wide variety of inductively defined sets. Martin-Löf’s type theory [12] expresses this stance in its purest form. For the development of mathematics, however, this system has certain drawbacks: the type-theoretic formalism is involved and requires considerable time to get accustomed to, and the lack of extensionality leads to difficult conceptual problems. Aczel’s interpretation of his constructive set theory **CZF** in Martin-Löf’s type theory [1] overcomes both problems: the language of set theory is known to any mathematician and **CZF** incorporates the axiom of extensionality. For this reason, **CZF** has become the standard reference for a set-theoretic system expressing the “generalised-predicative stance”.

It turns out, however, that **CZF** is not quite strong enough to formalise all the mathematics which one would like to be able to formalise in it: there are results, in particular in formal topology, which can be proved in type theory and are perfectly acceptable from a generalised-predicative perspective, but which go beyond **CZF**. There seem to be essentially two reasons for this: first of all, type theory incorporates the “type-theoretic axiom of choice” and secondly, Martin-Löf type theory usually includes W-types which allow one to prove the existence of more inductively defined sets than can be justified in **CZF** alone. To address this, we will suggest in this paper an extension of which includes a form of choice and W-types, so that in it one can develop formal topology, while at the same time having good model-theoretic properties.

Let us take the second point first. Already in 1986, Peter Aczel suggested what he called the Regular Extension Axiom **(REA)** to address this issue [3]. The main application of **(REA)** is that it allows one to prove the “Set Compactness Theorem”, which is important in formal topology (see [4]), but not provable in **CZF** proper. Here we suggest to take the axiom **(WS)** instead: for every function the associated W-type is a set. (This is not the place to review the basics of W-types, something which we have already done on several occasions: see, for example, [10].) One advantage of this axiom over **(REA)** is that it directly mirrors the type theory. In addition, **(WS)** is easy to formulate in the categorical framework of algebraic set theory, so that one may use this extensive machinery to establish its basic preservation properties (such as stability under exact completion, realizability and sheaves), whereas for **(REA)** such a formulation does not seem to be possible. It has been claimed, quite plausibly, that **(REA)** has similar stability properties, but we have never seen a proof of this claim.

As for the lack of choice in **CZF**, the axiom which would most directly mirror the type theory would be the “presentation axiom”, which says that the category of sets has enough projectives. The problem with this axiom, however, is that is not stable under taking sheaves. Precisely for this reason, Erik Palmgren together with the second author introduced in [14] an axiom called the Axiom of Multiple Choice **(AMC)**, which is implied by the existence of enough projectives and is stable under sheaves. This axiom (which we will discuss towards the end of this paper) is a bit involved and it turns out that on almost all occasions where one would like to use this axiom a slightly weaker and simpler principle suffices. This weaker principle is:

For any set there is a

setof surjections onto such that for any surjection onto there is an and a function such that .

It is *this* axiom which we will call **(AMC)** in this paper, whereas we will refer to the original formulation in [14] as “strong **(AMC)**”. (Independently from us, Thomas Streicher hit upon the same principle in [16], where it was called TTCA; on the nLab, http://ncatlab.org, the principle is called WISC.)

To explain the name “Axiom of Multiple Choice”, we remark that for a surjection , a *choice function* is a section of . On the other hand, a *multi-valued choice function* is a function , defined on a cover of , for which . Our axiom provides a (necessarily nonempty) family of domains sufficient to find such a multi-valued choice function for any surjection .

So this is our proposal: extend the theory **CZF** with the combination of **(WS)** and **(AMC)**. The resulting theory has the following properties:

It is validated by Aczel’s interpretation in Martin-Löf’s type theory (with one universe closed under W-types) and therefore acceptable from a generalised-predicative perspective.

The theory is strong enough to prove the Set Compactness Theorem and to develop that part of formal topology which relies on this result.

The theory is stable under the key constructions from algebraic set theory, such as exact completion, realizability and sheaves.

It is the purpose of this paper to prove these facts. As a result, **CZF** + **(WS)** + **(AMC)** will be the first (and so far only) theory for which the combination of these properties has been proved. And as a consequence of stability, the methods from [11] are applicable to it and one can show:

The theory satisfies various derived rules, such as the derived Fan Rule and the derived Bar Induction Rule.

Moreover, we will show that the theory has a certain robustness about it. Indeed, assuming that the ground model for **CZF** satisfies **(AMC)** and **(WS)**, it is impossible to use the standard model-theoretic techniques to prove independence of **(AMC)** and **(WS)** from **CZF**. To express this more formally, let us say that an axiom in the language of is *reflected* by sheaf extensions (for example), if for any **CZF**-model , the axiom holds in as soon as it holds in some sheaf extension of . Then as a fourth property of our theory **CZF** + **(WS)** + **(AMC)** we have

The theory is reflected by the model constructions of exact completion, realizability and sheaves.

It should be noted that establishing the first property for **CZF** + **(WS)** + **(AMC)** is quite easy, because stronger axioms are verified by the type-theoretic interpretation: **(REA)** can be interpreted (that was the main result of [3]) and **(REA)** implies **(WS)** (see [6]), while **(AMC)** is an obvious consequence of the presentation axiom which is validated by the type-theoretic interpretation (see [2]). Therefore it remains to establish the other properties in the list.

The contents of this paper are therefore as follows. First, we will show in Section 2 that the Set Compactness Theorem follows from the combination of **(WS)** and **(AMC)**. Then we will proceed to show that these axioms are stable under and reflected by exact completion (Section 3), realizability (Section 4) and sheaves (Section 5). Throughout these sections we assume familiarity with the framework for algebraic set theory developed in [8]. Finally, in Section 6 we will discuss the relation of our present version of **(AMC)** with the earlier and stronger formulation from [14] and with Aczel’s Regular Extension Axiom.

## 2The Set Compactness Theorem

The purpose of this section is to prove that, in **CZF**, the combination of **(WS)** and **(AMC)** implies the Set Compactness Theorem. To state this Set Compactness Theorem, we need to review the basics of the theory of inductive definitions in **CZF**, which will be our metatheory in this section.

Within **CZF** one can prove that for every subclass of there is a least -closed subclass of containing (see [6]); it is denoted by . The Set Compactness Theorem is the combination of the following two statements:

is a set whenever is.

There is a set of subsets of such that for each class and each there is a set such that and .

As said, the Set Compactness Theorem is not provable in **CZF** proper, but we will show in this section that it becomes provable when we extend **CZF** with **(WS)** and **(AMC)**.

To prove the result it will be convenient to introduce the notion of a *collection square*. In the definition we write for any function and each ,

as is customary in categorical logic.

Observe that can be rephrased as: any map fits into a collection square In fact, **(AMC)** implies that this property holds for any map.

Note that for the strong version of **(AMC)**, this is really Proposition 4.6 in [14].

Let be any function. **(AMC)** implies that:

We may now apply the collection axiom to this statement: this gives us a surjection together with, for every , an inhabited collection such that:

Let . Then clearly:

So set and let be the projection on the first coordinate and . All the required verifications are now very easy and left to the reader.

Let be a set and be an inductive definition on . Our aim is to construct a set of subsets of such that for each class and each there is a set such that and .

Write and consider the map given by projection onto the first two coordinates. By composing this map with the sum inclusion , we obtain a map we call .

**(AMC)** implies that fits into a collection square with a small map on the left, as in: We take the W-type associated to and, because **(WS)** holds, is a set. We wish to regard certain elements of as *proofs*.

To identify these, define a map assigning to every element of its *conclusion* by case distinction, as follows:

In addition, define inductively the function assigning to every element of its *set of assumptions* as follows:

Finally, call an element *well-formed*, if implies that for all the conclusion of is (the map is the composite along the top in diagram ); call it a *proof*, if it and all its subtrees are well-formed. Because the collection of subtrees of some tree in a W-type is a set (see the proof of Theorem 6.13 in [7]), the collection of proofs is a set by bounded separation.

The proof will be finished once we show that:

Because from this expression it follows by bounded separation that is a set whenever is; in addition, it implies that the set is as required by the second half of the Set Compactness Theorem.

In other words, we have to show that

is -closed, contains and is contained in every -closed subclass of which contains . To see that contains , note that an element with and the empty function is a proof whose sole assumption is and whose conclusion is . To see that it is -closed, let and suppose that

in other words, that

Now we use the collection square property to obtain a with and a map such that for all , is a proof with . Hence is a proof with assumptions contained in and conclusion and therefore , as desired.

It remains to show that contains every -closed subclass containing . To this purpose, we prove the following statement by induction:

For all , if is a proof and , then .

So let be a proof such that . For every , is a proof with , so we have by induction hypothesis. Now we make a case distinction as to whether belongs to or :

If , then is a proof whose sole assumption is and whose conclusion is . Then it follows from that . Hence , as desired.

In case , we have to show and for that it suffices to show that for all , since is -closed. But for every , there is a with and, since is well-formed, .

This completes the proof.

## 3Stability under exact completion

In the following sections we will show that **(AMC)** and **(WS)** are stable under exact completion, realizability, presheaves and sheaves, respectively. We will do this in the setting of algebraic set theory as developed in our papers [7] and to that purpose, we reformulate **(AMC)** in categorical terms.

In categorical terms the axiom now reads:

- Axiom of Multiple Choice (AMC):
For any small map , there is a cover such that fits into a collection square in which all maps are small:

We now proceed to show this axiom is stable under exact completion. We work in the setting of [7] and use the same notation and terminology. In particular, will be a category with display maps and will be its bounded exact completion as discussed in [7]. If we say that **(AMC)** holds in , then we will mean that **(AMC)** holds with the phrase “small map” replaced by “display map”.

We begin by stating two lemmas about collection squares:

Recall from Theorem 5.2 in [7] that has the following properties:

is full and faithful,

is covering, i.e., every object in is covered by one in the image of

**y**,preserves and reflects pullbacks,

preserves and reflects covers.

From items 3 and 4 it follows that preserves and reflects covering squares.

To show that preserves collection squares, suppose that we have a collection square in , a map and a cover . Using item 2, we find a cover and a cover . Then we may apply the collection square property in to obtain a diagram of the desired shape.

To see that reflects collection squares, suppose that is a collection square in . Then, if is any map and is a cover in , this is preserved by , so that we obtain a map and a covering square By covering with an object , sticking the pullback square to the left of the previous diagram and reflecting back along , we obtain a diagram of the desired form in .

Covering squares compose (Lemma 2.4.2 in [7]), so the outer square is covering. From now on, we reason in the internal logic. Assume that left square is a collection square. Suppose and . Since is a cover, we find a such that , and because the square on the left is collection, we find an element together with a map such that the following diagram commutes: Since , this yields the desired result. The case where the right square is a collection square is very similar, but easier.

Suppose that **(AMC)** holds in and is a small map in . By definition this means that is covered by a map of the form with display in . Since is display in and **(AMC)** holds in , we may cover by a map in which fits in a collection square in which all maps are display. That the same holds for in now follows from and .

We will now show that **(AMC)** is also reflected by exact completions.

An easy argument using the internal logic.

Suppose that **(AMC)** holds in and is a small map in . This means that there is a cover in such that fits into the right hand side of a collection square in which all maps are small. We construct a diagram

as follows. First we construct the bottom and left faces using Lemma 5.6 in [7], so that both are covering and the maps and are both small. Then the right face is constructed by pullback and since preserves pullbacks, we may assume that the result is an object of the form and the map is (; in particular, it is small. To finish the construction of the cube, we have to find a map : but that we obtain from the universal property of . Note that it follows from Lemma 2.11 in [7] that this map is also small. By the previous lemma, we now know that the front face of the cube is a collection square in which all maps are small. Since collection squares, small maps and pullbacks are reflected by **y**, we have shown that **(AMC)** is reflected by exact completion.

Note that in [7] we were unable to show that the axioms **(S)** and **(WS)** are stable under exact completion. In the presence of **(AMC)**, however, we can.

Relative to **(AMC)** the exponentiation axiom is equivalent to fullness (see [10]), so this follows from the stability of the fullness axiom under exact completion (Proposition 6.25 in [7]).

The proof of Theorem 6.18 in [7] implies that the functor preserves W-types. It also preserves smallness and if is a class of small maps, it will reflect smallness as well (see [7]). Hence it follows that exact completions of categories with small maps reflect **(WS)**.

It also follows that W-types for maps of the form with a display map in are small in . The proof of the stability of **(AMC)** under exact completion implies that for every small map in there is a cover such that fits into a collection square with such a map on the left. It is a consequence of the proof of Proposition 6.16 in [7] that the W-type associated to is small and a consequence of Proposition 4.4 in [13] that the W-type associated to is small.

## 4Stability under realizability

In this section we show that the axiom of multiple choice is stable under realizability. Recall from [9] that the realizability category over a predicative category of small maps is constructed as the exact completion of the category of *assemblies*. Within the category of assemblies we identified a class of maps, which was not quite a class of small maps. In a predicative setting the correct description of these *display maps* (as we called them) is a bit involved, but for the full subcategory of *partitioned assemblies* the description is quite simple: a map of partitioned assemblies is small, if the underlying map in is small. Many questions about assemblies can be reduced to (simpler) questions about the partitioned assemblies: essentially this is because the inclusion of partitioned assemblies in assemblies is full, preserves finite limits and is *covering* (i.e., every assembly is covered by a partitioned assembly). Moreover, every display map between assemblies is covered by a display map between partitioned assemblies. For more details, we refer to [9].

We show that **(AMC)** holds in the category of assemblies over a predicative category of classes , provided that it holds in . The result will then follow from above.

Suppose is a display map of assemblies. We want to show that is covered by a map which fits into a collection square in which all maps are display. Without loss of generality, we may assume that is a display map of partitioned assemblies . For such a map, the underlying map in is small. We may therefore use the axiom of multiple choice in to obtain a diagram of the form in which the square on the left is a collection square in which all maps are small and the one on the right is a covering square. We obtain a similar diagram in the category of (partitioned) assemblies by defining by , and similarly and . It is clear that both squares are covering, so it remains to check that the one on the left is a collection square.

So suppose we have a map and a cover

in the category of assemblies. Without loss of generality, we may assume that both and are partitioned assemblies and is the partitioned assembly with . Define

and consider the diagram with . By definition of , the map is a cover, so we may apply the collection square property in to obtain a map and a covering square of the form Writing and , we obtain a similar covering diagram in the category of assemblies:

The map is a cover, essentially because is.

The map is tracked, because the realizer of an element in is the pairing of the realizers of its images and . From the latter, one can compute the second component of . One may now compute the realizer of by applying this to the realizer of (by definition of ).

The square is a quasi-pullback, with the surjectivity of the unique map to the pullback being realized by the identity.

This concludes the proof.

Again, we are able to show that **(AMC)** is also reflected by realizability.

By it is sufficient to prove that the axiom of multiple choice holds in whenever it holds in. Recall that there are two functors and , with sending an object to the pair and sending an object to . Both and preserve small maps, pullbacks, covers and (hence) covering squares. In addition, , so it suffices to show that preserves collection squares.

Let be a collection square in and suppose we are given a map and a cover in . By putting , and and using the collection square property of the figure above, we obtain a diagram in of the following form:

where the left face is a pullback and the face at the back is covering. By applying to this diagram we obtain the desired result.

In [9] we were unable to show that the axioms **(S)** and **(WS)** are stable under realizability. This was because we were unable to show that they were stable under exact completion. But as that was our only obstacle, we now have:

Since both **(S)** and **(WS)** are inherited by the category of assemblies (Propositions 20 and 21 in [9]), this follows from and , respectively.

It follows immediately from the description of W-types in the category of assemblies (see [9]) that preserves W-types. As reflects smallness, it follows that the axiom **(WS)** is reflected by realizability.

## 5Stability under sheaves

In this section we will show that **(AMC)** is preserved and reflected by sheaf extensions. Theorem 4.21 in [10] shows that **(WS)** is preserved by sheaf extensions in the presence of strong **(AMC)**, but it is not hard to see that the same argument shows that **(WS)** is preserved with our present version of **(AMC)**; that it is also reflected will be below. We will use notation and terminology from [10]. In particular, is a predicative category with small maps satisfying the fullness axiom **(F)** and is an internal site in which has a presentation and whose codomain map is small. We will write for the forgetful functor and for its left adjoint, which sends a pair to the following sum of representables:

In other words,

Given two objects and in and a pair of maps and such that commutes, we obtain a map of presheaves sending a pair to . In fact, every map is of this form. Finally, we will write for the sheafification functor and for the composition of and .

Note that for strong **(AMC)** this was proved in Section 10 of [14].

In this proof we assume that the underlying category has chosen pullbacks, something we may do without loss of generality. Consider a map

of sheaves in which is small. Since by definition every small map is covered by one of this form, it suffices to show that for every such map there is a cover such that pulling back the map along that cover gives a map which is the right edge in a collection square in which all maps are small.

Using **(AMC)** in , we know that there is a cover in such that fits into a collection square in which all maps are small: Now we make a host of definitions. Define . Furthermore, we define an object fibred over : consists of pairs with a map in with codomain and a map assigning to every a sieve , where denotes the following pullback in : We also define an object fibred over , with the fibre over consisting of pairs and . We obtain a commuting square as follows: in which all maps are small and is a cover.

We apply **(AMC)** again, but now to . Strictly speaking, one would obtain a cover such that fits into the right-hand side of a collection square in which all maps are small. We claim that we may assume, without loss of generality, that , so that already fits into the right-hand side of a collection square. Its proof is a bit of a distraction from the main thread of the argument, so probably best skipped on a first reading.

**Proof of the claim.** Applying **(AMC)** to yields a diagram in which the left square is collection and the right one a pullback. By applying the collection axiom to the small map and the cover , we obtain a diagram of the form in which is a cover, the two rightmost squares are pullbacks and is a small cover. The idea is to replace with their pullbacks along . Call these , respectively. Crucially, and are then defined in the same way from and as and are defined from and .

We pull back the collection square on along and obtain a new collection square on , in which all maps are still small:

By the universal property of we obtain a map making the diagram

commute. Note that this map is small, because all others in the front of the cube are. Since the left and right faces of the cube are pullbacks and the back is covering, the front of the cube is covering as well. Therefore not only the square on is a collection square, but also the pasting of that square with the front of the cube (by ). As a result, we have in which the first and third square (from the left) are collection squares in which all maps are small. This proves the claim.

So from now on we work under the assumption that and is the right-hand edge of a collection square. The result is a diagram of the following shape: where the first and third square (from the left) are collection squares. Note that all maps in this diagram except for and are small. For convenience, we write and observe that is epi.

We wish to construct a diagram of the following shape in presheaves: Understanding the right square should present no problems: but note that it is a pullback with a cover at the bottom. The remainder of the proof explains the left square and shows that its sheafification is a collection square in the category of sheaves. That would complete the proof.

Every element determines an element . We put and . Note that this turns into a cover. Similarly, every determines an element . We put , , and , where and are the legs of the pullback square in . Note that this makes the map from to the inscribed pullback of the left square locally surjective; hence its sheafification is covering.

In order to show that the sheafification of the left square is a collection square, suppose that we have a map and a cover of sheaves. Let be the pullback in presheaves of along and cover using the counit . Writing , this means that we have a commuting square of presheaves in which the vertical arrows are locally surjective and the top arrow is of the form . Finally, let be the pullback of along the unique map making

commute.

Since is locally surjective, the same applies to . Reasoning in the internal logic, this means that the following statement holds:

Using the collection square property, we find for every an element with together with a function such that:

Again using the collection square property, we find for every an element with and a function such that

(Remember .) Therefore we obtain a diagram of the following shape in :

with

the obvious projections and . We now obtain a diagram of presheaves of the shape

with . In this diagram, the square on the left is a pullback square computed in the customary manner with , and the unique map filling the diagram is given by .

We now show that the sheafification of the square at the back is covering. First observe that is a cover, since is. Therefore we only need to show that the square at the back is “locally” a quasi-pullback. To that end, suppose we have an element in and element , where is the projection obtained as in If , then we find a with . Writing , we find for every an element with . Projecting to yields and projecting to yields . This shows that the square at the back is “locally” covering. (We have used here that every element in an object of the form is a restriction of one of the form and that it therefore suffices for proving that a map is locally surjective to show that every element of the form is “locally hit” by .)

To complete the proof we need to show that factors through . But to define a map is, by the adjunction, the same thing as to give a map , which we can do by sending to . To show that , it suffices to calculate:

This completes the proof.

We will finish this section by showing that **(AMC)** and **(WS)** are reflected by taking sheaves over an internal Grothendieck site , provided every covering sieve is inhabited. Our argument relies on ; that in turn relies on two lemmas.

: Suppose and agree on a common refinement and belongs both to and . We know that there is a sieve covering which refines and and on which and agree. Pulling back this sieve along we find a sieve covering . Then and agree on all elements of the from with .

: Put

We need to show that is covering. For this purpose, pick and . Then and therefore there is a covering sieve on such that for every we have . In particular, covers . But then covers and covers , both times by local character.

Note that if is one compatible family from over and is another, then they agree on a common refinement iff we have for every . This is an immediate consequence of the previous proposition and the fact that every cover is inhabited.

If is a compatible family on , then the collection of compatible families which agree with it on a common refinement is in bijective correspondence with the set

For if belongs to a compatible family which agrees with on a common refinement, and we have maps in with , and , then

by the the remark we made at the end of the previous paragraph.

Conversely, if is a basic covering sieve with this property and , then we can pull back along ; this yields a covering sieve and since covering sieves are inhabited, this means there is a such that . So we may put

which does not depend on the choice of by the assumption on . This yields a compatible family which is equivalent to . Moreover, this construction is clearly inverse to the operation of dropping the from the . So we conclude that equivalence classes of compatible families are small, because they are in bijective correspondence with the set above.

Assume is an internal Grothendieck site in in which both and every covering sieve are inhabited. From the latter assumption it follows that every constant presheaf is separated, so is obtained by quotienting the compatible families over the constant presheaf over ; since the equivalence classes are small by the previous lemma, this implies that the object of compatible families over the constant presheaf on is small whenever is. Since the constant families on some object (i.e., those for which is the maximal sieve on ) can be identified by a bounded formula, will then be small as well.

It is not hard to see that preserves W-types in the sense that

Therefore the statement follows from .

For once we reason internally. Assume is a small site in which both and every covering sieve are inhabited. Let be a small object in . Consider , the constant presheaf over . This presheaf is separated and hence a dense subobject of its sheafification . For an element , we will write if it belongs to this subobject.

We first apply in the category of sheaves to ; concretely this means that there is diagram in the category of sheaves in which the square on the left is a collection square. By replacing, if necessary, the category of sheaves over by its slice over (which is also a category of sheaves), we may assume that . Therefore the diagram above reduces to For the moment, fix a pair and . Write

and let be the map sending to . Since the square above is covering and every covering sieve is inhabited, this map is surjective.

We now use fullness in to find a small collection such that:

For every element the map is still surjective.

For every small , if is surjective, then there is an element such that .

(Strictly speaking we also need to use the collection axiom to justify writing these small collections as a function of : see below.) We claim that

is a set of surjections onto as in the statement of .

To see this, let be an arbitrary surjection. The map is still a surjection, but then in the category of sheaves. Therefore in the category of sheaves there exists a surjection and a map fitting into a covering square As is epi and both and every covering sieve are inhabited, we can find elements and . Put and

The proof will be finished once we show that is surjective.

So let . Since is surjective and every cover is inhabited, this means that there is a pair such that . Since and lies dense in , we find with

Therefore and .

## 6Relation of AMC to other axioms

It will be the aim of this section to compare our version of **(AMC)** to other axioms which have appeared in the literature, including the principle called the axiom of multiple choice in [14] and its reformulation in [15]. Throughout this section, our metatheory will be **CZF**.

Before we compare our axiom to the principles in [14] and [15], we need to make a definition.

Consider:

The axiom of multiple choice according to [14]: for every set there is an inhabited collection family together with surjections .

A strengthened version of the above: for every set there exist an inhabited collection family and surjections such that each surjection is refined by a map over .

The axiom of multiple choice as reformulated in [15]: every set is a member of a collection family.

(1) (3): simply add the set to the collection family.

(3) (2): if is a collection family containing , then let be the collection of all surjections .

(2) (1) is obvious.

We will call any of these equivalent principles *strong (AMC)*. As the name suggests, it implies our present version of

**(AMC)**.

Suppose is a set and is an inhabited set of surjections as in version 2 of strong **(AMC)**. We claim that is also a set of surjections witnessing **(AMC)** in the sense of this paper. To show this, let be any surjection. Since is inhabited, we can pick an element and construct the pullback: Using the property of , we find a and a surjection factoring through . Therefore factors through .

We expect the converse to be unprovable in **CZF**. However, there is an axiom scheme suggested by Peter Aczel in [5] which implies that our present version of **(AMC)** and strong **(AMC)** are equivalent. This axiom scheme is:

- The Relation Reflection Scheme (RRS):
Suppose are classes and is a total relation. Then there is for every subset a subset with such that .

Our proof of this fact relies on the following lemma:

First use collection to find a set such that

Then put , which is a set by the union and replacement axioms.

Fix a set . We define a relation by putting

iff for every and every surjection there are , and fitting into a commutative diagram as follows:

It follows from **(AMC)** that is total: for if is any set of surjections onto , then **(AMC)** implies that for every there is a set of surjections onto such that any such is refined by one in this set. By applying the previous lemma to this statement, we find for every a set of surjections with this property. We find our desired as .

By applying **(RRS)** to , we obtain a set such that and . Put . It is straightforward to check that is a set of surjections witnessing strong **(AMC)**.

Note that the following was shown in [14]:

We expect this theorem to fail if one replaces strong **(AMC)** with our present version of **(AMC)**. (In fact, this is the only application of strong **(AMC)** we are aware of that probably cannot be proved using our weaker version.) We do not consider this a serious drawback of our present version of **(AMC)** or our proposal to extend **CZF** with **(WS)** and this axiom, because the main (and, so far, only) application of **(REA)** is the Set Compactness Theorem, which, as we showed in Section 2, *is* provable using **(WS)** and the present version of **(AMC)**.

### Footnotes

- ILLC, Universiteit van Amsterdam, P.O. Box 94242, 1090 GE Amsterdam. E-mail: B.vandenBerg3@uva.nl. The first author was supported by the Netherlands Organisation for Scientific Research while working on the research reported here.
- Radboud Universiteit Nijmegen, Institute for Mathematics, Astrophysics, and Particle Physics, Heyendaalseweg 135, 6525 AJ Nijmegen, the Netherlands. E-mail: i.moerdijk@math.ru.nl.

### References

**The type theoretic interpretation of constructive set theory.**

P. Aczel. In*Logic Colloquium ’77 (Proc. Conf., Wrocław, 1977)*, volume 96 of*Stud. Logic Foundations Math.*, pages 55–66. North-Holland, Amsterdam, 1978.**The type theoretic interpretation of constructive set theory: choice principles.**

P. Aczel. In*The L. E. J. Brouwer Centenary Symposium (Noordwijkerhout, 1981)*, volume 110 of*Stud. Logic Found. Math.*, pages 1–40. North-Holland Publishing Co., Amsterdam, 1982.**The type theoretic interpretation of constructive set theory: inductive definitions.**

P. Aczel. In*Logic, methodology and philosophy of science, VII (Salzburg, 1983)*, volume 114 of*Stud. Logic Found. Math.*, pages 17–49. North-Holland Publishing Co., Amsterdam, 1986.**Aspects of general topology in constructive set theory.**

P. Aczel.*Ann. Pure Appl. Logic*, 137(1-3):3–29, 2006.**The relation reflection scheme.**

P. Aczel.*MLQ Math. Log. Q.*, 54(1):5–11, 2008.**Notes on constructive set theory.**

P. Aczel and M. Rathjen. Technical Report No. 40, Institut Mittag-Leffler, 2000/2001.**Aspects of predicative algebraic set theory I: Exact Completion.**

B. van den Berg and I. Moerdijk.*Ann. Pure Appl. Logic*, 156(1), 2008.**A unified approach to algebraic set theory.**

B. van den Berg and I. Moerdijk. In*Logic Colloquim 2006*, Lecture Notes in Logic, pages 18–37. Cambridge University Press, Cambridge, 2009.**Aspects of predicative algebraic set theory, II: realizability.**

B. van den Berg and I. Moerdijk.*Theoret. Comput. Sci.*, 412(20):1916–1940, 2011.**Aspects of predicative algebraic set theory III: sheaves.**

B. van den Berg and I. Moerdijk.*Proc. Lond. Math. Soc. (3)*, 105(5):1076–1122, 2012.**Derived rules for predicative set theory: an application of sheaves.**

B. van den Berg and I. Moerdijk.*Ann. Pure Appl. Logic*, 163(10):1367–1383, 2012.*Intuitionistic type theory*, volume 1 of*Studies in Proof Theory. Lecture Notes*.

P. Martin-Löf. Bibliopolis, Naples, 1984.**Wellfounded trees in categories.**

I. Moerdijk and E. Palmgren.*Ann. Pure Appl. Logic*, 104(1-3):189–218, 2000.**Type theories, toposes and constructive set theory: predicative aspects of AST.**

I. Moerdijk and E. Palmgren.*Ann. Pure Appl. Logic*, 114(1-3):155–201, 2002.**Choice principles in constructive and classical set theories.**

M. Rathjen. In*Logic Colloquium ’02*, volume 27 of*Lect. Notes Log.*, pages 299–326. Assoc. Symbol. Logic, La Jolla, CA, 2006.**Realizability models for CZF+ Pow.**

T. Streicher. Unpublished note available from the author’s homepage, March 2005.