tempo2 is a new software package for the analysis of pulsar pulse times of arrival. In this paper, we describe in detail the timing model used by tempo2, and discuss limitations on the attainable precision. In addition to the intrinsic slow-down behaviour of the pulsar, tempo2 accounts for the effects of a binary orbital motion, the secular motion of the pulsar or binary system, interstellar, Solar system and ionospheric dispersion, observatory motion (including Earth rotation, precession, nutation, polar motion and orbital motion), tropospheric propagation delay, and gravitational time-dilation due to binary companions and Solar system bodies. We believe that the timing model is accurate in its description of predictable systematic timing effects to better than 1 ns, except in the case of relativistic binary systems where further theoretical development is needed. The largest remaining sources of potential error are measurement error, interstellar scattering, Solar system ephemeris errors, atomic clock instability and gravitational waves.