IEC 61508 requires that any tool used in the development of a safety-critical system be qualified. The standard defines two qualification levels: T1 and T2. Most teams are aware of this requirement. Fewer understand what it actually demands, what it prevents, and why T2 qualification from an NRTL like TUV Rheinland is a different category of assurance than what most safety tools can provide.
T2 Tool Qualification means an independent auditor has verified that the tool actively reveals defects that would otherwise go undetected. Not just that it doesn’t introduce errors. That it finds them.
| T1 qualification | T2 qualification | |
|---|---|---|
| What it confirms | The tool doesn’t introduce errors into the safety case | The tool actively reveals defects in the safety case |
| What the assessor knows | Tool output is unlikely to corrupt your work | Tool output can be trusted as a defect-detection mechanism |
| Who validates | Can be done through documented evidence and argument | Requires independent NRTL audit |
| What it changes | Tool is assumed benign | Tool becomes part of the safety argument |
| ASAP status | Included by default | Qualified by both TUV Rheinland and HORIBA MIRA |
What the standard actually requires
IEC 61508, Part 6 (Annex C) specifies the tool qualification framework. The two categories reflect the different ways a tool can contribute to safety failures:
T1 failure mode: The tool introduces errors. A calculation tool that produces incorrect results. A documentation tool that corrupts data. A code generator that introduces faults not present in the source model. T1 qualification establishes that none of these failure modes are present.
T2 failure mode: The tool fails to detect errors that already exist. A test tool that misses defects. An analysis tool that reports coverage it hasn’t actually achieved. A requirements tool that allows traceability gaps to go unnoticed. T2 qualification establishes that the tool’s detection capability works correctly under the conditions it will be used.
T2 qualification doesn’t replace engineering judgment. It establishes that the toolset supporting that judgment is itself reliable.
Why this matters to an assessor
When an assessor reviews a safety case built with a T2-qualified toolset, they’re starting from a different premise than when reviewing a case built with unqualified tools.
Without tool qualification, the assessor has to treat the tool’s output as potentially untrustworthy. They examine the methodology more carefully. They look for evidence that the traceability chains are actually correct, not just that the tool says they are. They may request proof that the tool itself hasn’t introduced errors into the data.
With T2 qualification from an NRTL, that skepticism is already addressed. An independent body — not the tool vendor — has audited the platform against the IEC 61508 requirements and confirmed that it reveals defects without introducing errors. The assessor’s “can I trust this?” question is answered before they open the file.
One assessor reviewing ASAP output didn’t ask follow-up questions. Just asked for the output. That result comes from the combination of structural traceability and pre-qualified tooling — the assessor’s starting posture is confidence, not skepticism.
What NRTL means
NRTL stands for Nationally Recognized Testing Laboratory. In the US context, NRTLs are organizations accredited by OSHA to perform independent safety testing and certification against national and international standards. TUV Rheinland and HORIBA MIRA are both NRTLs recognized for functional safety work under IEC 61508.
The NRTL designation matters because it establishes independence. A qualification performed by the tool vendor, or by a lab with a commercial relationship to the vendor, doesn’t carry the same weight as an independent audit. NRTL status means the auditing body has no financial stake in the outcome.
ASAP holds T2 Tool Qualification from both TUV Rheinland and HORIBA MIRA. Two independent NRTLs, each having audited the platform separately and reached the same conclusion. It’s the only NRTL-qualified toolset for the full safety lifecycle.
What T2 qualification changes for your team
Assessment preparation time drops. When the toolset is pre-qualified, teams don’t have to prepare tool qualification arguments as part of each project’s safety plan. The qualification exists. The documentation is done. That’s typically several weeks of work that doesn’t have to happen.
The assessor’s first concern is resolved before the review begins. Assessment cycles are extended by follow-up questions. The most common first round of questions involves documentation structure and tool reliability. T2 qualification removes the second category before it can be asked.
Safety arguments are built on a defensible foundation. A safety case is an argument. Arguments depend on the reliability of the evidence they’re built on. When the toolset generating your traceability, your reliability calculations, and your documentation is independently verified to reveal defects without introducing errors, the evidentiary foundation of your argument is solid.
Teams can demonstrate due diligence to customers and partners. For teams supplying safety-critical components to OEMs or enterprise customers, T2 qualification is increasingly part of the supplier evaluation process. It’s evidence that the safety process was built on verified tooling, not just internally asserted.
T2 qualification in context: what it doesn’t replace
T2 Tool Qualification doesn’t substitute for engineering judgment. A T2-qualified platform doesn’t automatically produce a correct safety case. It ensures that the platform won’t hide errors and won’t introduce new ones. The engineering decisions — hazard analysis, risk assessment, architecture selection, safety function design — still require qualified safety engineers making defensible technical arguments.
What T2 qualification does is remove a category of risk from the safety process: the risk that your tooling was secretly wrong. That risk isn’t large in well-maintained tools, but it’s also not zero. Independent qualification closes it.
FAQ: T2 Tool Qualification
What is T2 Tool Qualification under IEC 61508?
IEC 61508 Part 6 defines two tool qualification categories. T1 confirms a tool doesn’t introduce errors into the safety case. T2 goes further: it confirms the tool actively reveals defects that would otherwise go undetected. T2 qualification requires an independent audit, typically by an NRTL, against the IEC 61508 requirements for the tool’s category of use.
What is the difference between T1 and T2 tool qualification?
T1 addresses tools that could corrupt safety data — it establishes that the tool is benign. T2 addresses tools that are supposed to detect problems — it establishes that the detection actually works. A test coverage tool needs T2 because you’re relying on it to find defects. A text editor needs T1 because you’re just relying on it not to corrupt files.
Why does TUV Rheinland T2 qualification matter specifically?
TUV Rheinland is a Nationally Recognized Testing Laboratory (NRTL) — an independent body accredited to audit against IEC 61508. Qualification by an NRTL carries more weight than vendor-provided or self-asserted qualification because the auditing body has no financial stake in the outcome. ASAP holds T2 from both TUV Rheinland and HORIBA MIRA, two independent NRTLs.
How does T2 qualification change the assessment process?
The assessor’s starting posture changes. Without T2 qualification, an assessor has to examine tool reliability as part of the review. With T2, that question is pre-answered by an independent audit. The assessor focuses on the safety case itself rather than the tooling that produced it. This typically reduces the number of follow-up questions and accelerates the review cycle.
Does ASAP’s T2 qualification cover the full safety lifecycle?
Yes. ASAP is the only NRTL-qualified toolset for the full safety lifecycle. The T2 qualifications from TUV Rheinland and HORIBA MIRA cover the platform’s use across hazard analysis, requirements, reliability modeling, documentation generation, and traceability — not just a single module.
This post covers general functional safety engineering principles and is for educational purposes only. It is not engineering advice. Consult a qualified functional safety professional and your applicable standards body before making safety-critical design decisions.
ASAP is the only NRTL-qualified toolset for the full functional safety lifecycle. If T2 qualification is part of your next assessment requirement, see what that looks like in practice.