It is said in TLA+ documentation that the theory underlying the system is ZF. But technically speaking
it is not true because Hilbert's epsilon (the CHOOSE construct) is used and this implies an extra axiom
over ZF or ZFC namely the transfinite axiom.
http://plato.stanford.edu/entries/epsilon-calculus/
http://us.metamath.org/downloads/megillaward2005he.pdf
--
FL