RAMSHEEP

What is RAMSHEEP?

RAMSHEEP is a decision-making framework for assessing a system, installation or design choice as a whole, on the technical performance requirements Reliability, Availability, Maintainability and Safety (RAMS) as well as on the broader aspects Health, Environment, Economics and Politics (HEEP). The framework comes from Dutch systems engineering practice in civil infrastructure, where Rijkswaterstaat also writes it as RAMSSHEEP, with an extra S for Security. In IT/OT environments it is a practical tool for making choices about redundancy, maintenance, safety and cost transparent and defensible.

🧠 Where does RAMSHEEP come from?

The core, RAMS, is a reliability engineering concept that in Europe is most firmly anchored in the railway sector. The European standard EN 50126 describes how you specify and demonstrate reliability, availability, maintainability and safety over the whole life cycle of a railway system. The current edition dates from 2017 and has two parts: part 1 (the generic RAMS process) and part 2 (the systems approach to safety); the 1999 edition has been withdrawn. EN 50126 prescribes a process, not concrete targets: those are for the client to set.

In the Netherlands, Rijkswaterstaat, the national agency for roads and waterways, adopted RAMS for infrastructure. It has worked according to systems engineering since 2007, and in 2010 it published the Leidraad RAMS (RAMS guideline, “steering on system performance”), which makes RAMS applicable to bridges, locks, tunnels and roads across the entire life cycle, from design to operation. Together with the rail infrastructure manager ProRail and industry associations, Rijkswaterstaat works with a shared systems engineering guideline for the civil engineering sector.

Because technical performance alone is not enough to justify public money, more letters were added. Rijkswaterstaat itself calls RAMSSHEEP a mnemonic for nine performance categories. Outside Rijkswaterstaat you will also find the form RAMSHEEP with a single S, in which security has no letter of its own. In IT/OT projects it is wise to always weigh security as a separate criterion, because otherwise cyber threats fall between safety and politics.

🔧 What do the RAMS letters mean?

The four RAMS aspects are the technical performance requirements of a system. They are measurable and closely interrelated.

Availability follows directly from reliability and maintainability: A = MTBF / (MTBF + MTTR). A controller with an MTBF of 50,000 hours and an MTTR of 4 hours thus reaches roughly 99.992% availability. Halving the MTTR through better diagnostics or spare parts gains as much as doubling the MTBF.

🌍 What do the HEEP aspects add?

The HEEP letters (and, at Rijkswaterstaat, the extra S) look beyond technology at the impact on people, surroundings, budget and governance.

🔄 Why combine RAMS and HEEP?

Technically, a solution can be reliable and safe (RAMS) but still be unacceptably expensive, environmentally harmful or politically unworkable (HEEP). Conversely, a cheap solution may look attractive on paper while turning out far more expensive over a twenty-year life because of failures and maintenance. RAMSHEEP forces you to put all relevant interests side by side transparently and to record the trade-off, which also supports sound governance.

This fits asset management according to ISO 55000, in which you balance performance, risk and cost over the whole life cycle. RAMSHEEP provides the categories in which you formulate requirements and compare alternatives.

📊 Which availability values are common?

Availability is the RAMS aspect that most often appears in contracts and service levels. A small difference in percentage means a large difference in downtime per year (based on 8,760 hours):

Note that higher availability is not the same as higher safety. A safety function must go to a safe state on a fault, even at the expense of availability. That is why RAMSHEEP weighs the two aspects separately.

🧭 How do you use RAMSHEEP in practice?

Rijkswaterstaat uses a performance-based risk analysis in four steps: define functions and functional requirements, set performance requirements, map risks and current performance, and choose measures based on performance, risk and cost. For an IT/OT project, a RAMSHEEP assessment looks like this:

1. Define functions and criteria - which function must the system deliver, and which RAMSHEEP aspects matter for it? Record weighting factors, for example Safety and Availability weighing more heavily than Economics.
2. Quantify where possible - MTBF, MTTR, availability percentage, CO₂ emissions, life-cycle costs. Score qualitative aspects such as public support on a fixed scale.
3. Map failure causes - Rijkswaterstaat distinguishes hardware failure, software failure, human action (such as a maintenance error) and external causes (such as a ship colliding with a bridge). Methods such as FMEA, HAZOP and bowtie help here.
4. Assess alternatives - compare architectures A, B and C against all criteria and make the trade-offs explicit.
5. Choose and document measures - a measure can be implemented immediately, later or not at all if its effect is too small for the cost.
6. Review periodically - legislation, risks, costs and technology change; link the review to lifecycle management and change management.

🏭 What does a RAMSHEEP assessment look like in a SCADA environment?

Choice: an active-active redundant SCADA cluster or a single server with backup, for example for a pumping station or treatment plant in the water sector.

• Reliability/Availability - active-active scores higher: one server can fail without loss of monitoring.
• Maintainability - active-active enables patching and maintenance without standstill.
• Safety - better monitoring reduces the chance that operators miss a deviation, but actual process safety belongs to the SIS or local protection, not to SCADA.
• Security - two servers means two systems to harden and monitor.
• Health/Environment - more hardware uses more energy and cooling.
• Economics - higher CAPEX/OPEX for duplicated hardware and licences, against lower costs from outages.
• Politics - a drinking water company or water board falls under the Dutch Cybersecurity Act, which requires a duty of care and business continuity.

Decision: active-active, with optimisations to limit energy use and cost, recorded in a RAMSHEEP analysis that immediately shows during an audit or a board question why this choice was made.

🔐 How does RAMSHEEP relate to functional safety and cybersecurity?

RAMSHEEP is a decision framework, not a replacement for specialist standards. Each letter points to the standard that provides the depth:

• Safety - functional safety according to IEC 61508 (SIL 1 to 4) or, for machinery, ISO 13849 (PL a to e). The RAMSHEEP analysis determines which safety level is needed; the standard determines how you demonstrate it.
• Security - IEC 62443 for industrial automation, with a risk assessment per zone. In essential sectors, NIS2 and the Cybersecurity Act come on top.
• Reliability and Maintainability - predictive maintenance raises the MTBF and lowers the MTTR, which feeds directly into availability.

This prevents safety and security from being decided in silos, even though in OT they often affect the same components.

❓ Frequently asked questions

What does RAMSHEEP stand for?

RAMSHEEP stands for Reliability, Availability, Maintainability, Safety, Health, Environment, Economics and Politics. Rijkswaterstaat uses the variant RAMSSHEEP, with an extra S for Security. Together these letters form a checklist of performance categories for infrastructure and technical systems.

What is the difference between RAMS and RAMSHEEP?

RAMS covers only the four technical performance requirements: reliability, availability, maintainability and safety. RAMSHEEP adds health, environment, economics and politics, so societal and financial impact also count in the trade-off. For railways, RAMS is standardised in EN 50126; the extension became common in the Dutch civil engineering sector.

Is RAMSHEEP a standard?

RAMSHEEP is not a formal standard but a mnemonic and decision framework from systems engineering practice. The RAMS part is standardised in EN 50126 for railways. Rijkswaterstaat describes its approach in the Leidraad RAMS guideline from 2010.

How do you calculate availability in a RAMS analysis?

You calculate availability as A = MTBF / (MTBF + MTTR). A system with an MTBF of 10,000 hours and an MTTR of 2 hours has an availability of about 99.98%. In a RAMS analysis, shortening the repair time is often cheaper than increasing reliability.

Can RAMSHEEP be used for IT/OT projects?

Yes, RAMSHEEP works well for IT/OT projects such as choosing redundant servers, network architectures or replacing obsolete control systems. The framework makes you weigh security, energy use, cost and legal requirements such as NIS2 alongside uptime and safety. That makes an investment decision easier to explain to management and regulators.

Who uses RAMSSHEEP in the Netherlands?

In the Netherlands, RAMSSHEEP is mainly used by Rijkswaterstaat and the engineering firms and contractors working for it, in performance-based risk analyses for bridges, locks, tunnels and roads. ProRail applies RAMS to the railway according to EN 50126. RAMSSHEEP has also been studied as a basis for risk-based maintenance of primary flood defences.

📌 In summary

RAMSHEEP is an integrated decision framework that links technical reliability, availability, maintainability and safety (RAMS) to health, environment, economics and politics (HEEP). Rooted in the railway standard EN 50126 and Rijkswaterstaat’s RAMS guideline, it helps you make transparent, defensible choices about redundancy, maintenance, safety, security and cost in complex OT systems and infrastructure projects.