Consider the claim:


(C) There is a transitive set $S \in V$ such that the structure $(S, \in)$ is an elementary submodel of $(V, 
\in)$.


Obviously, this claim cannot be a theoreom of ZFC, by Godel's 2nd Incompleteness Theorem. But does (C) follow from ZFC+CON(ZFC)? Or are large cardinals needed to prove (C)? More generally (and vaguely), what is the weakest assumption needed to prove (C)? 



Elementary submodels of V
A cardinal $\delta$ is [correct](http://cantorsattic.info/Correct#Reflection_and_correctness) if the theory $V\_\delta\prec V$ holds, that is, if $V\_\delta$ is an elementary substructure of $V$. This theory is expressible as a scheme in first order logic in the language of set theory augmented by a constant symbol for $\delta$ as the following scheme of statements:


$$\forall \vec a\in V\_\delta\ \ (\ \varphi(\vec a)\quad\iff\quad V\_\delta\models\varphi[\vec a]\ \ ).$$


Note that any set $\langle S,{\in}\rangle$ such as you desire must have the form $S=V\_\delta$ for some $\delta$, since it will the union of the $V\_\alpha$ for $\alpha<\delta$ because by elementarity it will be right about these $V\_\alpha$, and so this is your main case.


The property of being correct is not expressible as a single assertion in ZFC, unless inconsistent, since otherwise there could be no least reflecting cardinal, since if $\delta$ is the least reflecting cardinal and this were expressible, then $V$ would have a reflecting cardinal, but $V\_\delta$ would not. A similar argument applies directly to the existence of a set $\langle S,{\in}\rangle$ as in your question, showing that $S\prec V$ is not expressible as a single assertion in the language of set theory.


Meanwhile, as a scheme, the existence of a reflecting cardinal is equiconsistent with ZFC, and in particular it does not imply Con(ZFC). To see this, observe that if there is a model of ZFC, then by the reflection theorem, we may easily produce models of any given finite subset of the theory. So by compactness the theory $V\_\delta\prec V$ is also consistent. 


One may easily extend this theory to have a unbounded closed proper class $C$ of cardinals $\delta$ for which $V\_\delta\prec V$, a theory known as the [Feferman theory](http://cantorsattic.info/Reflecting#Feferman_theory), and this also is equiconsistent with ZFC, with no increase of consistency strength, by the same argument. Feferman propsed this theory as a natural background set theory in which to undertake category theory, because it provides a robust universe concept (more robust than Grothendieck universes in that the universes all cohere into an elementary chain), but without the large cardinal commitment. 


If one adds to the theory $V\_\delta\prec V$ that $\delta$ is inaccessible, then $\delta$ is a [reflecting](http://cantorsattic.info/Reflecting) cardinal, whose existence is equiconsistent with [Ord is Mahlo](http://cantorsattic.info/ORD_is_Mahlo). 


If one desires a purely first-order concept, expressible as a single property in the language of set theory, then one may restrict to a less severe form of elementarity. For example, a cardinal $\delta$ is [$\Sigma\_2$-correct](http://cantorsattic.info/Reflecting) if $V\_\delta\prec\_{\Sigma\_2} V$, that is, $V\_\delta$ is elementary for formulas of complexity $\Sigma\_2$, and [$\Sigma\_2$-reflecting](http://cantorsattic.info/Reflecting) if $\delta$ is also inaccessible. For example, the $\Sigma\_2$-reflecting cardinals commonly arise in large cardinal arguments, and this is expressible in the language of set theory. More generally, one has the concept of a $\Gamma$-reflecting cardinal for any class $\Gamma$ of formulas, and if these have bounded complexity, then these also will be expressible. 


For many purposes, the $\Sigma\_2$-correct cardinals carry much of the useful power of what you want from $V\_\delta\prec V$, since one of the equivalent formulations is that $\delta$ is $\Sigma\_2$ correct if and only if whenever there is $\theta$ with $V\_\theta\models\sigma$ for any assertion $\sigma$, using parameters in $V\_\delta$, then there is $\theta\lt\delta$ with $V\_\theta\models\sigma$. In other words, any thing that happens in a $V\_\theta$ above $\delta$ also happens below $\delta$. 


