When Normal Moves: The Overton Window Through the Lens of ANF

 Political Normality, Hidden Degradation, and the Drivers of Change

Igor Trubin | October 2026

Introduction: Is Normality a Political Concept?

Recently, while discussing my ongoing book project on the Area of Normal Functioning (ANF) with my friend Eric, an unexpected question emerged: Can the concept of normality also be applied to politics?

After years of studying normal functioning in industrial robotics, computer performance, and more recently human and organizational systems, I had not seriously considered political science as another possible application of ANF.

Eric introduced me to the Overton Window, a concept developed by Joseph P. Overton in the 1990s. It describes the range of political ideas and policies that are considered acceptable or politically feasible at a particular time.

The boundaries of this window are not fixed. They may shift, expand, or contract as public attitudes and social expectations evolve.

That immediately reminded me of ANF.

Our subsequent discussions raised two additional questions:

• What happens when the boundaries of normality change in a way that conceals a gradual deterioration in system performance or behavior?

• Can we identify the independent factors—or drivers—associated with such changes and use them to forecast future shifts?

These questions connect political normality with my earlier work on statistical exception detection, trend analysis, and business-driver modeling.

This article explores those connections as possible directions for further research.

1. The Overton Window: Political Normality Is Dynamic

The Overton Window describes the range of policy ideas that political decision-makers can support without unacceptable political risk.

An idea considered politically impossible today may eventually become mainstream. Conversely, a previously acceptable policy may move outside the range of politically feasible options.

The window may move in different directions, and its width may change.

This resembles the basic idea behind the Area of Normal Functioning.

In ANF, normality is not necessarily a fixed condition. It is a region whose boundaries may evolve as system behavior, workload, environment, or other operating conditions change.

The important question is therefore not only what is normal today, but how the boundaries of normality change over time.

However, an important distinction must be recognized.

The Overton Window concerns political acceptability and feasibility, while ANF was originally developed to describe the operating conditions under which a technical system functions normally.

These ideas are related but not identical. Their connection requires careful investigation rather than a simple transfer of terminology.

2. Similar Concepts in Other Disciplines

Eric also shared three interesting analogies from ecology, psychology, and safety engineering.

Shifting Baseline Syndrome — Ecology

In 1995, Daniel Pauly described how successive generations of fisheries researchers could accept increasingly depleted fish populations as their normal reference conditions.

Each generation begins with a different baseline, potentially losing sight of earlier environmental conditions.

As a result, long-term degradation may become less visible.

Adaptation-Level Theory — Psychology

Harry Helson's Adaptation-Level Theory describes how human judgments depend on reference levels shaped by previous experiences.

Something initially perceived as unusual may eventually become ordinary as people adapt.

The reference point used to define normality changes.

Normalization of Deviance — Safety Engineering

Diane Vaughan's research on the 1986 Space Shuttle Challenger disaster examined how repeated departures from established standards could gradually become accepted within an organization.

When deviations repeatedly occur without immediate failure, they may begin to appear safe or routine.

Eventually, exceptional behavior can become standard practice even when the underlying risk remains.

These examples illustrate different mechanisms through which normality changes:

• In ecology, the historical baseline changes.

• In psychology, the perceptual reference level changes.

• In organizations, the boundaries of tolerated behavior change.

• In politics, the boundaries of acceptable policies and practices change.

The common feature is a moving reference point.

Could these processes be studied through a common analytical framework?

3. From the Overton Window to Political ANF

In my earlier research, the Area of Normal Functioning was represented as a region bounded by lower and upper limits.

For a measurable variable X:

ANF_X(t) = [L_X(t), U_X(t)]

Here, L and U represent the lower and upper boundaries of normal functioning at time t.

Rather than being fixed thresholds, these boundaries can be estimated from observations and updated as the system evolves.

In subsequent work on the Statistical Exception and Trend Detection System (SETDS), related methods were used to detect exceptions, identify trends and change points, and distinguish isolated anomalies from persistent changes in system behavior.

Could a similar approach help study political normality?

Consider a specific political issue whose policy alternatives can reasonably be represented along a numerical scale.

Repeated surveys might allow researchers to estimate the range of positions considered acceptable at different times.

A preliminary representation could be:

ANF_P(t) = [L_P(t), U_P(t)]

where the boundaries describe an estimated range of political acceptability for issue P.

This is a proposed adaptation of ANF, not an established political-science measurement method.

Its practical usefulness depends on the data, the definition of acceptability, and whether an interval is an adequate representation.

Importantly, political scientists have already developed quantitative approaches to policy acceptability.

For example, Matthew Jenkins and Daniel Gomez, in Unveiling the Multidimensional Nature of Policy Acceptability: A Cross-National Approach (first published in 2025), distinguish political, affective, and deliberative dimensions of policy acceptability.

Such work could provide a valuable measurement foundation for investigating how acceptance changes over time.

ANF's potential contribution would not be to invent a measurement of political acceptability, but to investigate its changing boundaries, exceptions, structural transitions, and possible future trajectories.

4. Detecting Changes in Political Normality

In computer performance monitoring, a system may remain within a relatively stable operating region for an extended period.

Then something changes.

A new workload, software release, hardware modification, or environmental condition may produce a gradual trend or a sudden shift.

SETDS and IT-Control Charts were developed to identify statistical exceptions and changing behavior in such data.

Political processes may exhibit analogous statistical patterns.

Imagine repeated surveys concerning the public acceptability of AI-assisted government services.

Initially, acceptance is limited. Over several years, it may increase gradually or change abruptly following technological or institutional developments.

The data could reveal several distinct phenomena:

Stable periods: Public attitudes fluctuate within a relatively consistent range.

Exceptions: Individual observations differ significantly from the established statistical pattern.

Trends: Acceptance increases or decreases persistently.

Change points: The statistical properties of the time series change.

Boundary migration: The estimated region of acceptable positions moves.

Boundary expansion or contraction: The range of politically acceptable alternatives becomes wider or narrower.

These processes resemble those investigated in technical performance analysis.

There is also a connection to Punctuated Equilibrium Theory, associated with Frank Baumgartner and Bryan Jones, which examines periods of relative policy stability interrupted by substantial change.

ANF might complement such research through explicit estimation and monitoring of dynamic boundaries.

5. When the New Normal Hides Degradation

This connection leads to a particularly important question, extending far beyond politics:

What happens when a system adapts to deteriorating conditions and begins treating them as normal?

Consider a computer application whose response time gradually increases.

An adaptive statistical monitoring system may detect the trend and eventually establish a new baseline.

The application could then appear statistically stable again.

However, its response time may now exceed the service level required by the business.

In other words, the system has established a new statistical normal without necessarily restoring acceptable performance.

The same problem can arise elsewhere.

In ecology, the baseline used to evaluate environmental conditions may gradually shift toward a degraded state.

In organizational management, recurring procedural violations may become tolerated because they have not yet produced visible consequences.

In politics, repeated behavior may become increasingly familiar or accepted even when its relationship to established institutional standards has not changed.

This suggests the importance of distinguishing two kinds of boundaries.

Observed ANF

The region estimated from the system's actual measured behavior.

It describes what is statistically typical under observed conditions.

Reference operating limits

The region defined by independent requirements, safety criteria, experimental results, service-level objectives, or other externally justified standards.

These limits describe what the system is expected or required to achieve.

Unlike the observed ANF, reference limits should not automatically move merely because the observed behavior changes.

They may themselves require revision, but such revision should be based on independent justification.

The difference between these regions can provide useful evidence of possible degradation.

It is important to emphasize that a moving ANF does not by itself prove deterioration. A shift may reflect adaptation, improvement, environmental change, or a new operating mode.

Degradation requires an independent definition of what constitutes an undesirable outcome.

This leads to a potentially general principle:

Statistical stability is not the same as healthy functioning.

I believe this distinction may be relevant to many dynamic systems within the broader scope of ANF.

6. Why Normality Changes: From SETDS to Model Factory

So far, we have considered how to identify changes in normal behavior and how to distinguish adaptation from possible degradation.

But another question remains:

Why do the boundaries of normality move?

This question brings us back to an important component of my earlier SETDS research.

In a 2018 blog post on anomaly and novelty detection, I described three related levels of SETDS.

The first detects statistical anomalies and outliers.

The second uses trend and change-point analysis to identify persistent changes that may indicate a new operating regime.

The third relates the observed performance data to external demand indicators, or business drivers, to develop statistically supported forecasting models.

I implemented this modeling direction in an approach called Model Factory.

Related methods are also described in my work on computer resource modeling, including US Patent 10,437,697, Systems and Methods for Modeling Computer Resource Metrics, on which I am a co-inventor.

That patent describes automated construction and evaluation of regression models connecting resource utilization with business transaction volumes, including statistical diagnostics, model selection, and forecasting.

The key methodological principle is that the behavior of a system should be analyzed in relation to measurable external demand rather than exclusively as an isolated time series.

Could this idea be extended beyond computer systems?

Political normality and independent drivers

Suppose we observe a persistent change in public acceptance of a particular policy.

Instead of merely noting that acceptance changed around a certain historical event, we could examine whether the change is statistically associated with independently measured factors, such as:

• economic conditions;

• adoption of relevant technologies;

• levels of institutional trust;

• changes in demographic composition;

• exposure to information or public discussion.

The purpose would be to identify measurable relationships and determine whether they improve explanation and forecasting.

For example, the adoption of AI-assisted government services might be examined alongside measurements of technological familiarity, direct experience with such services, and institutional trust.

The selected drivers would need to be defined and measured independently of the outcome under investigation.

Statistical validation would be essential.

It would include examining model fit, stability, time lags, competing explanations, and forecasting performance using observations not employed in model construction.

And an important limitation remains:

Statistical correlation does not automatically establish causation.

Political processes are complex, and relationships may be affected by hidden variables, feedback effects, and changing measurement conditions.

Nevertheless, driver-based modeling could provide a more systematic approach than simply associating observed changes with historical events.

7. A Driver-Conditioned ANF

The preceding discussion suggests a further possibility.

In the simplest representation, ANF depends on time:

ANF_X(t) = [L_X(t), U_X(t)]

But some boundaries may also depend on external operating conditions.

We could therefore explore a conditional representation:

ANF_X(t | B(t))

where B(t) is a vector of measured external drivers.

This notation means that the estimated normal region for X depends on the values of relevant drivers at time t.

For example, normal computer CPU utilization may depend on transaction demand.

Normal physiological measurements may depend on activity level, age, and environmental conditions.

Normal organizational workload may depend on staffing, incoming demand, and operational complexity.

Likewise, observed political attitudes might depend on economic conditions, technology adoption, and other measurable factors.

A useful model could distinguish between changes explained by measured drivers and changes that remain unexpected even after accounting for those drivers.

However, two different modeling tasks must be kept separate:

1. Explaining or forecasting the observed value of a metric using independent drivers.

2. Estimating whether the boundaries of its normal operating region also change with those drivers.

The first is closely related to established Model Factory methods.

The second is a proposed ANF extension requiring additional mathematical formulation and experimental verification.

Together, they offer a possible path from exception detection to more explanatory and predictive modeling of dynamic normality.

8. What If There Is No Single Political Normal?

Political normality introduces another challenge: different groups may have different definitions of what is acceptable.

A single average can conceal substantial differences among populations.

Consequently, a political ANF may need to be multidimensional or represented by several distinct regions.

Relevant dimensions might include:

• political issue;

• population group;

• geographic region;

• type of acceptability;

• time and external conditions.

For strongly polarized or multimodal distributions, one interval with lower and upper boundaries may be misleading.

In my earlier work on exception-based modeling, the normal functioning region could be represented in a multidimensional space, with different projections used for analysis.

That perspective may be useful here as well.

The challenge is not necessarily to find one universal political norm, but to characterize the structure and evolution of multiple observed normal regions.

9. Testing Political ANF with Real Data

Fortunately, political science provides historical datasets that could support exploratory experiments.

One possibility is Bright Line Watch, which publishes surveys of experts and the public concerning democratic principles and institutional performance.

A research experiment could be organized into five stages.

Stage 1 — Measurement

Choose a clearly defined indicator measured consistently across time. Determine whether it represents acceptability, preference, institutional performance, or another construct.

Stage 2 — Dynamic ANF estimation

Construct the time series, estimate the normal operating region, and detect exceptions, trends, and change points.

Stage 3 — Degradation assessment

Compare the observed ANF with independently defined criteria or preserved historical reference conditions where justified.

This step is essential when the research question concerns possible deterioration rather than merely statistical change.

Stage 4 — Driver analysis

Identify independently measured candidate drivers and test their statistical relationships with the observed metric or ANF boundaries.

Model Factory principles could guide automated model selection, validation, and forecasting.

Stage 5 — Evaluation

Compare the results against conventional statistical methods and existing political-science interpretations.

Account for uncertainty, survey sampling, question wording, time-series dependence, and possible feedback between variables.

An important practical limitation is that some political surveys are conducted only periodically. Their sampling frequency may be insufficient to identify short-lived exceptions or accurately estimate certain change points.

Such an experiment would not establish a universal theory of political normality.

It could, however, help determine whether ANF and SETDS offer a useful complementary perspective.

10. What This Means for the ANF Book

My ongoing book project explores extending the Area of Normal Functioning from its origins in industrial robotics to technical, AI, biological, human, organizational, and other dynamic systems.

Political normality was not part of my original plan.

Yet the discussion with Eric has suggested several broader research directions.

The first is the relationship between adaptation and degradation.

A dynamic system may adjust to changing conditions and establish a new stable operating region. But adaptation alone does not guarantee that the new state is desirable or safe.

The second is the relationship between normality and its drivers.

Understanding how a system changes is only part of the problem. Identifying the independent factors associated with its behavior may help explain those changes and forecast future developments.

These topics are sufficiently general to deserve separate treatment in the book, extending beyond politics.

For now, political ANF remains an exploratory concept. Its scientific usefulness must be established through careful definitions, appropriate measurements, and empirical comparison with existing methods.

But the discussion raises three questions that seem increasingly central to the broader ANF project:

How do we detect when normality changes?

How do we recognize when a new normal conceals degradation?

And can we identify the drivers that explain and help predict those changes?

These questions connect industrial robotics, computing, organizational management, human behavior, and now political science.

They also bring me back to a possible title for the book:

Everything Is Normal… Until It Isn't.

Perhaps the most intriguing possibility is that the system may continue to appear normal—even after it has begun moving toward failure.

---

References and Further Reading

1. Mackinac Center for Public Policy. The Overton Window of Political Possibility.

2. Pauly, D. (1995). Anecdotes and the Shifting Baseline Syndrome of Fisheries. Trends in Ecology & Evolution, 10(10), 430.

3. Helson, H. (1948). Adaptation-Level as a Basis for a Quantitative Theory of Frames of Reference. Psychological Review, 55(6), 297–313.

4. Vaughan, D. (1996). The Challenger Launch Decision: Risky Technology, Culture, and Deviance at NASA. University of Chicago Press.

5. Baumgartner, F. R., & Jones, B. D. (1993). Agendas and Instability in American Politics. University of Chicago Press.

6. Jenkins, M., & Gomez, D. (2025, online; 2026 journal issue). Unveiling the Multidimensional Nature of Policy Acceptability: A Cross-National Approach. Policy Studies Journal, 54(1).

7. Helmke, G., & Rath, J. (2025). Defining and Measuring Democratic Norms. Annual Review of Political Science, 28, 233–251.

8. Trubin, I. (2018). Anomaly Detection vs. Novelty Detection: SETDS Method Detects and Separates Both. System Management by Exception.

9. Trubin, I., Schutt, M., & Robinson, J. (2019). Systems and Methods for Modeling Computer Resource Metrics. US Patent 10,437,697.

10. Trubin, I. (2026). Starting a Book Project: The Area of Normal Functioning.

Building the Area of Normal Functioning: From Industrial Robotics to Continuous Performance Testing

 By Igor Trubin

Can Normal Functioning Be Determined Experimentally?

In my recent work on the Area of Normal Functioning (ANF), I have focused primarily on statistical methods for identifying and tracking the boundaries of normal system behavior.

However, revisiting my earlier research in industrial robotics led me to another approach: ANF boundaries can also be determined experimentally.

This is not a new engineering practice. Engineers have been testing operational limits of technical systems for decades. What may be new is interpreting these experiments as a systematic way of constructing and maintaining the Area of Normal Functioning.

Even more interestingly, combining experimental testing with statistical monitoring creates an opportunity for continuously evolving ANF models.

1. The Original Idea: Experimental ANF in Industrial Robotics

During my early research with industrial robots, I investigated how a robotic gripper could reliably grasp an object even when the object's actual position differed from its expected position.

The traditional approach assumed that an object should be positioned accurately enough for successful grasping.

But what happens if it is displaced?

I investigated this question experimentally using a real industrial robot.

Starting from the ideal object position, I manually introduced positional deviations and attempted to grasp the object. By progressively increasing these deviations in different directions, I could identify the region within which the grasping operation remained successful.

Beyond certain limits, grasping failed.

The resulting region represented what I now describe as an Area of Normal Functioning for the robot-object interaction.

Importantly, the boundaries were not obtained by analyzing historical operational statistics. They were established through controlled experiments.

The approach could also accommodate several dimensions, including positional displacement, orientation, and other relevant conditions.

This was an early example of constructing an ANF directly from a system's observed capabilities.

2. The Same Principle Applies to Computer Systems

Now consider a modern computing application.

Its performance depends on multiple factors:

• Workload intensity and transaction arrival rates

• Number of concurrent users

• CPU, memory, storage, and network resources

• Application and infrastructure configuration

• Response-time and throughput requirements

For a particular system configuration, there is a range of workloads within which the application functions acceptably.

As the workload increases, the system may eventually violate response-time requirements, experience unacceptable error rates, or become unstable.

This is exactly what conventional load and stress testing investigates.

A load test can establish the workload range within which the application meets its operational objectives. A stress test can explore the limits beyond that range and reveal failure modes.

Why not interpret these experiments as constructing the Area of Normal Functioning?

For example, imagine an application with a response-time objective of less than 500 milliseconds at a specified percentile.

A series of load tests might establish that this objective is consistently met for workloads between 100 and 1,200 transactions per second.

Beyond that range, performance becomes unacceptable under the tested conditions.

The experimentally established workload interval can then be represented as:

ANF = [100, 1200] transactions/second

This interval is illustrative, and its validity depends on the test configuration, workload mix, performance objectives, and measurement uncertainty.

It is important to recognize that this example describes ANF in the workload dimension. The corresponding acceptable region in response-time, resource-utilization, and other dimensions may have a different shape.

In general, ANF is better understood as a multidimensional region than as a single interval.

3. Rebuilding ANF After Application Releases and Infrastructure Changes

Modern IT organizations routinely perform performance testing after significant changes, including:

• Application releases

• Hardware upgrades

• Infrastructure migrations

• Database configuration changes

• Cloud instance resizing

• Major architecture modifications

These tests usually answer familiar questions:

Did performance improve or deteriorate? Can the application handle the expected workload? Did the change introduce a regression?

But the same test results could answer a broader question:

How has the Area of Normal Functioning changed?

Suppose an application upgrade increases its sustainable transaction rate from 1,200 to 1,600 transactions per second while preserving the required response time.

Conventionally, we report a performance improvement.

From the ANF perspective, we can describe this as an expansion of the operating region.

Alternatively, an inefficient application release might reduce sustainable throughput from 1,200 to 900 transactions per second.

This is not merely a performance regression. It is a contraction of ANF.

Such changes could be tracked across application versions, hardware generations, or infrastructure configurations.

The resulting history would describe how the system's operating capabilities evolve over time.

4. What Happens Between Performance Tests?

Experimental determination of ANF is valuable, but it has a practical limitation.

We cannot continuously stress every production system to its operational limits.

Even when load tests are performed regularly, system behavior may change between experiments.

Workload composition may evolve. Infrastructure may experience degradation. Resource contention may increase. Seasonal demand patterns may emerge.

This is where my Statistical Exception and Trend Detection System (SETDS) becomes particularly relevant.

SETDS uses statistical analysis to identify exceptions, trends, and changes in system behavior.

Instead of experimentally pushing the system toward failure, SETDS observes its actual operating behavior and evaluates how that behavior changes.

For a measured performance metric X, the statistically estimated ANF can be represented by time-dependent boundaries:

ANF_X(t) = [L_X(t), U_X(t)]

Here L and U represent the lower and upper boundaries of the normal operating region estimated from historical observations.

These boundaries can change as the system evolves.

The key idea is to combine two complementary approaches:

Experimental ANF construction: Establish or validate acceptable operating limits using controlled performance testing.

Statistical ANF monitoring: Use SETDS to estimate normal operating patterns, detect exceptions, identify changes, and forecast the evolution of those patterns between experiments.

An important distinction must be maintained: a statistically normal operating region is not necessarily the complete region of acceptable operation.

For instance, an application may normally operate at 30–50% CPU utilization while its experimentally validated capacity allows substantially higher utilization without violating performance requirements.

Comparing these two regions could reveal unused capacity, emerging risks, and changes in operational headroom.

5. From Periodic Testing to Continuous ANF Reconstruction

There is another interesting possibility.

Some modern systems undergo automated performance testing continuously, particularly as part of software development and continuous integration processes.

My colleagues and I explored a related approach in our ICPE 2022 paper:

"Change Point Detection for MongoDB Time Series Performance Regression."

The research investigated performance measurements from automated tests triggered by changes to the MongoDB software repository.

We developed and evaluated a hybrid change-point detection approach that included the Perfomalist method and machine-learning techniques.

The objective was to identify significant performance changes without relying solely on manual analysis or fixed thresholds.

The reported change-point detection accuracy was 83%.

At the time, we described the problem primarily in terms of identifying performance regressions.

But now I see an opportunity to reinterpret and extend this work within the ANF framework.

Every automated performance test contributes evidence about a system's behavior under particular conditions.

When tests cover a sufficiently broad and controlled range of workloads, their results can contribute to reconstructing the ANF boundaries.

Meanwhile, change-point detection can identify moments when the previously established ANF model may no longer be valid.

For example:

1. A new software commit triggers automated performance tests.

2. Performance metrics are collected and compared with historical results.

3. SETDS or another change-point detection method identifies a significant behavioral change.

4. The system evaluates whether the change affects ANF boundaries.

5. If sufficient experimental evidence exists, the ANF model is updated; otherwise, additional targeted testing is initiated.

Thus, continuous performance testing could evolve from a mechanism for detecting regressions into a mechanism for continuous ANF reconstruction.

A single regression or change point would not necessarily establish a new boundary. It would provide evidence that a boundary may have changed and could trigger further validation.

This distinction is essential for making the approach scientifically sound.

6. ANF as a Multidimensional, Evolving Model

Another lesson from my robotics research is that normal functioning is rarely one-dimensional.

For robotic grasping, the successful operating region may depend on displacement along multiple axes, orientation, and grasping conditions.

For computer systems, the region may depend on workload, response time, resource availability, application configuration, and many other factors.

We can represent this more generally as:

ANF(t) = {x : the system satisfies defined functioning criteria under conditions x at time t}

The vector x describes the relevant operating conditions and system measurements.

Experimental testing samples this multidimensional space and helps identify the boundaries separating acceptable and unacceptable functioning.

Statistical monitoring examines system behavior within that space over time.

The combined approach makes it possible to investigate not only whether a metric is abnormal, but also:

• Whether the ANF region is expanding or contracting

• Whether its center is moving

• Whether its shape is changing

• Whether previously normal behavior is approaching a validated failure boundary

• Whether a structural change requires a new experimental assessment

In earlier work, I explored multidimensional performance models using a data-cube representation, with different projections producing control charts and other operational views.

The ANF concept offers a way to connect that work with experimentally established operating regions and their evolution.

7. Toward a Closed-Loop ANF Management Process

Combining experimental and statistical approaches suggests a practical ANF management lifecycle.

Step 1 — Construct: Establish operating boundaries through controlled experiments, including load, stress, and other relevant tests.

Step 2 — Monitor: Use SETDS to observe actual operational behavior and estimate statistical ANF boundaries.

Step 3 — Detect: Identify exceptions, trends, and change points that may indicate changes in the system's functioning.

Step 4 — Predict: Forecast whether system behavior is approaching a statistical or experimentally validated boundary.

Step 5 — Validate and Rebuild: Perform new experiments when necessary to verify or reconstruct ANF boundaries following significant changes.

This creates a feedback loop in which experimental testing and statistical monitoring reinforce one another.

The same principle may apply well beyond IT systems, including manufacturing, robotics, transportation, and other adaptive technical systems.

8. Conclusion: A Different Interpretation of Familiar Engineering Practices

The central idea is straightforward.

Performance testing determines what a system can do. Statistical monitoring describes what the system normally does and how that behavior changes. ANF provides a framework for connecting the two.

The individual methods are not new.

Robotic experiments, load testing, statistical process control, and change-point detection have long histories.

The proposed contribution is to integrate them into a common model of normal functioning, where the operating region itself becomes an object of measurement, analysis, forecasting, and reconstruction.

Looking back at my early industrial robotics experiments, I find it interesting that the same fundamental question remains relevant decades later:

How far can a system deviate from its expected operating conditions while still functioning successfully?

Today, with automated performance testing, statistical monitoring, and advanced analytics, we have the opportunity to answer that question continuously.

That may be an important next step in developing the Area of Normal Functioning framework.

---

References

1. Trubin, I. — 1986. Issledovanie protsessov zakhvatyvaniya obektov manipulirovaniya promyshlennym robotom [Research of Industrial Robot Grasping Processes]. Ph.D. dissertation (in Russian).

2. Leznik, M., Iqbal, M. S., Trubin, I., Lochner, A., Jamshidi, P., and Bauer, A. (2022). Change Point Detection for MongoDB Time Series Performance Regression. Companion of the ACM/SPEC International Conference on Performance Engineering (ICPE '22), pp. 45–48. https://doi.org/10.1145/3491204.3527488

3. Trubin, I. — Exception Based Modeling and Forecasting. CMG, 2008.

4. Perfomalist — Statistical exception, trend, and change-point analysis. https://perfomalist.com

Managing by Exception: Extending the Area of Normal Functioning to Corporate Teams

Exploring how ANF and SETDS can complement Agile, Kanban, and established management practices through statistical analysis and capacity forecasting

Introduction: From Technical Systems to Human Organizations

Throughout my career in IT Performance and Capacity Management, I have worked on a recurring problem: how to identify meaningful changes in complex systems without overwhelming administrators with unnecessary information.

This problem led me to develop the Statistical Exception and Trend Detection System (SETDS), along with methods for exception detection, change-point analysis, trend recognition, and forecasting.

The underlying management principle was relatively simple:

Do not intervene merely because something changes. Intervene when the change is meaningful.

This principle became central to my approach to Exception-Based Management.

More recently, while developing the broader concept of the Area of Normal Functioning (ANF), I began considering whether the same statistical principles could help us better understand corporate teams and organizational workloads.

What if we treated a team's workload as a dynamic system with its own normal operating range?

Could we distinguish ordinary fluctuations from meaningful structural changes? Could we anticipate emerging capacity problems? And could we reduce unnecessary managerial intervention while preserving team autonomy?

Initially, these possibilities appeared to offer a substantially different approach to organizational management.

However, examining established management frameworks reveals an important fact: many of these ideas already have significant precedents.

Agile emphasizes self-management and adaptation. Kanban provides quantitative flow metrics and forecasting. Statistical Process Control distinguishes common variation from exceptional conditions. PRINCE2 explicitly incorporates management by exception.

This raises a more interesting research question.

Rather than attempting to replace these approaches, could ANF provide an additional analytical framework that integrates statistical exception detection, structural change recognition, business-demand modeling, and proactive capacity forecasting?

I believe this possibility deserves further investigation.

1. Not Every Change Requires Management Intervention

Consider a software engineering team.

During one week, the team completes 25 tasks. During another, it completes only 19.

A manager looking at a conventional productivity dashboard might immediately question the decline.

But is there really a problem?

Perhaps the second week involved more complex tasks, unexpected technical difficulties, or necessary architectural improvements.

A single measurement rarely tells the whole story.

In technical systems, distinguishing normal variation from meaningful change has been studied for decades.

Statistical Process Control (SPC), originating in Walter Shewhart's pioneering work, introduced the distinction between common-cause and special-cause variation.

Thomas Nolan and Lloyd Provost, in their 1990 article Understanding Variation, emphasized the importance of this distinction for management decisions. They also explained why unnecessary adjustments to stable processes can actually increase variation.

The same principle applies to corporate teams.

Not every temporary decline in output represents a productivity problem. Not every increase in workload means that a team is approaching exhaustion.

We need to understand behavior over time.

This is where the ANF concept becomes relevant.

Instead of comparing every measurement against a fixed target or simple historical average, we can estimate a range of normal functioning based on observed behavior.

Suppose a team historically completes between 18 and 28 comparable work items per week.

Completing 19 items may be entirely consistent with normal variation.

A sustained decline to 12 items, however, could indicate a meaningful change requiring investigation.

The management principle becomes:

Normal variation should generally be tolerated. Meaningful deviations should be investigated, not automatically punished or corrected.

This is not a new management philosophy. What interests me is whether ANF and SETDS could provide an integrated statistical mechanism for implementing it.

2. What Existing Management Frameworks Already Offer

Before discussing the potential contribution of ANF, it is important to recognize the existing approaches.

Agile and Scrum: Autonomy and Adaptation

Agile principles emphasize sustainable development, teamwork, and responsiveness to change.

Scrum builds on transparency, inspection, and adaptation. It also recognizes teams as self-managing.

This philosophy is compatible with the objectives of ANF-based management.

Both approaches recognize that continuous external intervention is not necessarily productive.

However, Scrum does not prescribe a particular statistical method for calculating normal workload boundaries, detecting structural changes, or forecasting when team capacity constraints may emerge.

Such analytical methods could complement Scrum without changing its underlying philosophy.

Kanban: Managing the Flow of Work

Kanban is particularly relevant to the proposed application.

The May 2025 Kanban Guide identifies four fundamental flow metrics:

• Work in Progress (WIP).

• Throughput.

• Work Item Age.

• Cycle Time.

Kanban also supports probabilistic Service Level Expectations based on historical observations.

These metrics already provide valuable information about workload, predictability, and bottlenecks.

Furthermore, tools such as Jira include control charts displaying cycle times, rolling averages, and variability.

Therefore, introducing statistical charts into team management is not, by itself, a new contribution.

The research opportunity lies in investigating whether ANF/SETDS could add value through the integration of change-point detection, dynamically estimated operating boundaries, and forecasting of future operational constraints.

PRINCE2: Management by Exception

Another particularly relevant predecessor is PRINCE2.

Its Manage by Exception principle allows authority to be delegated within agreed tolerances.

When a project is expected to exceed these tolerances, the appropriate management level becomes involved.

This is conceptually close to the approach I have described as Exception-Based Management.

PRINCE2 also recognizes the importance of forecasting potential tolerance breaches before they occur.

An important distinction, however, is that project management tolerances are generally defined according to agreed objectives and constraints.

The ANF concept introduces a different type of boundary: one statistically estimated from observed system behavior.

These two types of boundaries should not be confused.

Statistical ANF boundaries describe what has historically occurred. Management tolerances describe what is considered acceptable.

Combining these perspectives could provide useful additional information for management decisions.

Statistical Process Control: A Common Foundation

Perhaps the closest methodological predecessor is Statistical Process Control.

SPC already provides methods for recognizing significant deviations from stable process behavior.

My SETDS work belongs to this broader tradition of statistical performance analysis, with particular emphasis on exceptions, change points, trends, and forecasting.

The proposed organizational application should therefore be understood as an extension and integration of established statistical ideas rather than a claim that statistical management itself is new.

The central research question is whether this particular combination can provide useful capabilities beyond those already available in conventional management analytics.

A Note About Terminology

There is also a terminology issue worth clarifying.

I have used Exception-Based Management to describe my management approach. However, Scrum.org already uses the abbreviation EBM for its distinct Evidence-Based Management framework.

Although the concepts are related through their reliance on information for management decisions, they are not the same methodology.

To avoid confusion, I will use ANF-based management or the full phrase Exception-Based Management when discussing my proposed approach.

3. From Reactive Management to Dynamic ANF Analysis

Having recognized these predecessors, we can formulate the proposed ANF application more precisely.

I envision it as an analytical layer that could complement existing organizational management frameworks.

Its potential value would come from combining four capabilities.

First: Estimating the Area of Normal Functioning.

Historical observations can be used to estimate a typical range of operating behavior.

Depending on the analytical method, boundaries might be represented by statistical control limits or distribution quantiles, such as P05 and P95, with P50 representing the median.

These methods have different statistical interpretations and should not be treated as interchangeable.

The purpose is to understand expected variation rather than using a single fixed target as the only acceptable value.

Second: Detecting meaningful changes.

A team may experience an abrupt shift following a product launch, organizational restructuring, or significant change in business demand.

Change-point analysis could help identify when the underlying behavior has changed.

The normal operating range may then need to be reassessed.

Third: Recognizing developing trends.

Not all important changes happen suddenly.

Incoming work, cycle time, or backlog may increase gradually while individual measurements remain within their historical ranges.

Trend analysis can help distinguish persistent movement from short-term fluctuations.

Fourth: Forecasting future constraints.

When a persistent trend is identified, forecasting methods may estimate when an operational threshold will be approached or crossed.

This is an extension of the time-to-threshold forecasting approach I have used in technical Capacity Management.

Together, these capabilities could support a more proactive form of workload analysis.

Importantly, none of these techniques individually constitutes a new invention in organizational management.

The proposed contribution lies in their integration through ANF and SETDS, and in evaluating whether that integration improves management decisions.

3.1. A Practical Illustration: IT-Control Chart of a Team's Weekly Workload

To illustrate this idea, I created a hypothetical example using synthetic workload observations for a software engineering team.

The example covers 60 weeks: 52 observed weeks and an eight-week forecasting horizon.

Rather than using completed story points as a proxy for workload, I use estimated effort-hours associated with incoming work.

This distinction is important.

Completed story points describe delivery estimates, not necessarily incoming demand, actual employee working hours, or sustainable team capacity.

Estimated effort-hours are also imperfect measurements, but they allow us to illustrate how changing demand might be compared with a separately estimated processing-capacity limit.

Figure 1. ANF-based IT-Control Chart of a hypothetical software engineering team's weekly incoming workload. The chart shows observed demand (black), retrospectively estimated statistical ANF boundaries (P05 in blue, P50 in green, P95 in red), a shaded normal-functioning range, a simulated change in operating conditions, and a linear forecast. The orange dashed line represents an independently assumed processing-capacity limit of 185 estimated effort-hours per week. All observations are synthetic.

Figure 1. ANF-based IT-Control Chart of a hypothetical software engineering team's weekly incoming workload. The chart shows observed demand (black), retrospectively estimated statistical ANF boundaries (P05 in blue, P50 in green, P95 in red), a shaded normal-functioning range, a simulated change in operating conditions, and a linear forecast. The orange dashed line represents an independently assumed processing-capacity limit of 185 estimated effort-hours per week. All observations are synthetic.

The chart illustrates three periods.

Period 1: Normal Functioning (Weeks 1–20)

During the initial period, incoming workload fluctuates around a relatively stable level.

The retrospective statistical baseline is:

• Lower ANF boundary (P05): approximately 127.5 effort-hours per week.

• Median (P50): approximately 133.8 effort-hours per week.

• Upper ANF boundary (P95): approximately 140.4 effort-hours per week.

Most observations remain within the estimated normal-functioning range.

This variation does not necessarily require corrective intervention.

The team can continue operating autonomously while managers maintain regular communication, support, and oversight.

Period 2: A New Operating Regime (Weeks 21–40)

Beginning around Week 21, the synthetic example introduces an increase in incoming demand.

This represents a hypothetical business event, such as a product launch or the acquisition of additional customers.

The team begins operating at a higher workload level.

Using a sample from the new regime (Weeks 24–39), the retrospectively estimated ANF becomes:

• P05: approximately 143.4 effort-hours per week.

• P50: approximately 150.7 effort-hours per week.

• P95: approximately 160.2 effort-hours per week.

This illustrates an important feature of dynamic systems: their normal operating conditions can change.

However, we must distinguish a statistically established new baseline from a healthy or sustainable one.

A manager should investigate whether the team has adapted successfully through automation, process improvements, or additional resources—or whether it is absorbing the extra demand through excessive effort.

The statistical change does not answer that question by itself.

Period 3: Increasing Demand and Capacity Forecasting (Weeks 41–60)

After Week 40, the synthetic workload begins increasing more rapidly.

Several observations exceed the previously estimated upper ANF boundary.

The repeated deviations suggest that the earlier operating regime may no longer adequately describe current conditions.

For illustration, I fitted a simple linear trend to the observations from Weeks 41–52.

The resulting trend increases by approximately 1.84 estimated effort-hours per week.

If that trend continues without intervention, the forecast reaches the assumed processing-capacity threshold of 185 effort-hours per week around Week 57.

This is a conceptual example of Time-to-Threshold Forecasting applied to an organizational system.

Instead of waiting until backlogs accumulate or delivery deadlines are missed, management could investigate the trend and consider adjusting priorities, improving processes, or increasing available resources.

However, several methodological limitations must be emphasized.

First, the change in demand was deliberately introduced into the synthetic dataset. It was not independently discovered by SETDS.

Second, the ANF boundaries are empirical percentiles calculated retrospectively from selected operating periods. They are not classical Shewhart control limits, nor do individual percentile exceedances automatically establish statistical significance.

Third, the forecast is a simple linear regression extrapolation. It does not include uncertainty intervals, future changes in demand, or the effects of management intervention.

Finally, the 185-hour threshold is an assumed operational planning limit. It is not a medically or psychologically defined burnout threshold.

What Does This Example Demonstrate?

Despite its simplified nature, the example illustrates three different analytical questions:

Normal variation: Is the observed workload consistent with an established operating regime?

Structural change: Has the behavior of the system changed enough to justify reassessing its statistical baseline?

Future constraints: Does the developing trend suggest that operational demand may exceed available processing capacity?

The example also highlights why analyzing incoming workload alone is insufficient.

A practical organizational application would need to examine incoming demand together with completed throughput, backlog, cycle time, available resources, and relevant quality indicators.

The real opportunity for ANF-based management is to integrate these perspectives, not to replace them with a single workload chart.

4. Connecting Business Demand to Team Capacity

Another possible extension comes directly from my earlier work in IT Capacity Management.

In technical systems, resource requirements often depend on measurable business drivers.

For example, we may model how transaction volume affects CPU utilization, memory consumption, or response time.

The objective is to establish empirical relationships between business activity and technical resource demand.

A similar approach could be investigated for corporate teams.

Consider a customer onboarding department.

Its workload may depend on several factors:

• Number of new customers.

• Complexity of onboarding requirements.

• Number of products or services involved.

• Amount of manual processing.

• Availability of automation.

• Experience and skills of the team.

Suppose historical observations suggest that onboarding ten additional customers is associated with approximately 15 extra hours of team effort under comparable conditions.

Such a relationship could help estimate future resource requirements.

However, organizational systems are more complex than technical infrastructure.

The relationship may change when new software is introduced, employees gain experience, processes are redesigned, or customer requirements become more complicated.

Therefore, a useful model should not assume that historical relationships remain constant indefinitely.

This is where change-point detection and dynamic model reassessment could become particularly valuable.

Instead of relying on a permanently fixed relationship between business demand and team effort, we could investigate how that relationship evolves.

I see this as a possible continuation of my earlier exception-based capacity modeling work.

The objective would not be to mechanically determine how many employees a company must hire.

It would be to provide quantitative evidence to support resource planning and managerial judgment.

5. The Human Difference: Statistical Normality Is Not Sustainability

At this point, an essential distinction must be made.

Corporate teams are not server clusters.

Although statistical methods may be applied to observable organizational behavior, people cannot be managed as interchangeable technical resources.

Human performance depends on motivation, skills, fatigue, interpersonal relationships, organizational culture, and many other factors.

A team might maintain high output because its members have become more experienced and efficient.

The same output might also be sustained through excessive overtime and growing exhaustion.

Operational statistics alone may not distinguish these situations.

An additional problem arises when historical behavior itself is unhealthy.

Imagine a department whose employees have consistently worked excessive hours for several years.

A statistical model might identify this workload as normal because it has become the established operating pattern.

But statistically normal does not necessarily mean healthy, desirable, or sustainable.

This distinction is fundamental to extending ANF into human systems.

I would therefore separate two types of boundaries.

Statistical ANF boundaries describe the range of observed behavior under a particular operating regime.

Organizational sustainability boundaries represent conditions considered acceptable based on available resources, operational goals, working conditions, employee feedback, and relevant research.

These boundaries are not necessarily identical.

This also connects ANF to existing research in organizational psychology.

For example, Job Demands–Resources (JD-R) theory examines relationships among workplace demands, available resources, burnout, and engagement.

Similarly, the SPACE framework for developer productivity emphasizes that productivity cannot be represented adequately by a single metric. It includes dimensions such as satisfaction, well-being, performance, communication, and efficiency.

These frameworks provide perspectives that a purely statistical ANF model would not capture on its own.

A meaningful organizational application should therefore complement established human-centered research.

It should also prioritize team-level measurements where practical, protect employee privacy, and avoid turning exception detection into individual surveillance.

6. A Different Role for the Manager

What would this mean for a corporate manager?

I do not believe the goal should be automated management in which statistical models decide when human intervention is permitted.

A manager has responsibilities that cannot be reduced to quantitative monitoring.

These include coaching, resolving conflicts, supporting professional development, understanding employee concerns, and creating an effective working environment.

However, statistical analysis could help managers devote less attention to routine fluctuations and more attention to meaningful issues.

Three activities become particularly important.

Understanding Exceptions

When a significant deviation occurs, the first response should be investigation rather than blame.

Is the change caused by business demand, staffing, task complexity, process inefficiency, or an improvement in productivity?

An exception should initiate a question, not automatically trigger a corrective action.

Anticipating Constraints

Trend analysis and forecasting could help identify emerging problems before they become operational crises.

If incoming demand consistently grows faster than throughput, a manager may have time to adjust priorities or request additional resources.

Supporting Adaptation

When structural changes occur, teams may need to adapt.

Management should help determine whether the team can establish a sustainable new operating regime or whether the organization must change its expectations, resources, or processes.

In this interpretation, Exception-Based Management is not about reducing leadership to statistical alerts.

It is about using statistical evidence to support better judgment while preserving team autonomy.

7. Toward an Integrated Organizational ANF Framework

The organizational extension of ANF remains a research proposal.

My previous work provides a technical foundation in statistical exception detection, change-point analysis, trend recognition, and capacity forecasting.

The next challenge is to investigate whether combining these methods adds practical value to existing organizational management approaches.

A possible framework could contain five stages.

Stage 1 — Select meaningful operational measurements.

Use existing team-level information such as incoming demand, throughput, backlog, cycle time, and available processing capacity.

Avoid treating a single productivity metric as a complete description of team performance.

Stage 2 — Establish a statistical ANF.

Estimate expected operating behavior from historical observations, taking into account staffing changes, work complexity, seasonality, and other relevant conditions.

Stage 3 — Detect exceptions and structural changes.

Apply statistical methods to distinguish ordinary variation from potentially significant changes in system behavior.

Investigate whether a detected change represents improvement, deterioration, or adaptation to new conditions.

Stage 4 — Forecast operational constraints.

Analyze developing trends and estimate when relevant planning limits might be approached.

Keep these limits distinct from the statistical ANF boundaries.

Stage 5 — Support decisions and evaluate outcomes.

Combine statistical evidence with managerial experience, employee feedback, and organizational context.

Measure whether the approach improves the quality or timeliness of decisions.

The final stage is particularly important.

It would not be sufficient to demonstrate that an ANF model produces visually interesting charts.

A meaningful study should compare its results with existing methods.

For example, we could evaluate conventional fixed thresholds, established SPC techniques, Kanban-based flow analysis, and an integrated ANF/SETDS implementation using identical datasets.

Potential evaluation criteria could include detection delay, false-alert frequency, forecast accuracy, and the usefulness of the resulting information for management decisions.

Only such comparisons could establish whether the proposed integration offers measurable advantages.

8. What Might Be the Actual Contribution of ANF?

After examining existing management practices, I would formulate the research opportunity more carefully than I initially did.

Management by exception is not new.

Statistical control charts are not new.

Agile autonomy, Kanban flow metrics, and workload forecasting are not new either.

However, these concepts are frequently implemented in different contexts and for different purposes.

The possibility I would like to investigate is whether an ANF-based analytical layer can bring together:

1. Statistical estimation of normal operating behavior.

2. Detection of meaningful exceptions and structural changes.

3. Recognition of evolving workload trends.

4. Modeling relationships between business demand and operational capacity.

5. Forecasting the time remaining before relevant constraints may be reached.

The specific contribution would depend on the methods implemented and their demonstrated performance compared with existing alternatives.

The central hypothesis is that integrating these analytical capabilities could improve the recognition of meaningful workload changes and provide earlier, more actionable information for management decisions.

This remains a research hypothesis, not an empirically validated conclusion.

The broader significance may lie in exploring how methods developed for technical performance management can be adapted to more complex organizational systems without ignoring their human characteristics.

Conclusion: ANF as a Complement to Existing Management Practices

My work on the Area of Normal Functioning began long before its recent applications to IT performance analysis.

The original concept emerged from my research into robotic grasping and passive adaptation.

Later, my work on SETDS and IT-Control Charts provided statistical approaches for examining normal behavior, detecting exceptions, identifying structural changes, and analyzing trends in technical systems.

Today, I am exploring whether this accumulated experience can contribute to understanding human and organizational systems.

Reviewing existing management practices shows that many of the underlying ideas already have well-established foundations.

Rather than diminishing the relevance of ANF, I believe this provides a more meaningful direction for further work.

ANF does not need to replace Agile, Kanban, PRINCE2, or Statistical Process Control.

It may instead provide a complementary analytical perspective, particularly where operating conditions change over time and future capacity constraints are important.

The objective is not to turn people into measurable components of a mechanical system.

It is to help leaders distinguish routine variation from meaningful change, recognize emerging constraints, and support organizational adaptation.

The principle remains consistent with my earlier technical work:

Do not react to every fluctuation. Understand what is normal, recognize when conditions meaningfully change, and anticipate future constraints before they become serious problems.

Whether an integrated ANF approach can improve corporate workload management remains an open research question.

But it is one I believe is worth investigating.

---

References and Further Reading

1. Nolan, T. W., & Provost, L. P. (1990). Understanding Variation. Quality Progress, 23(5), 70–78. American Society for Quality.

2. Schwaber, K., & Sutherland, J. (2020). The Scrum Guide. Official Scrum Guide.

3. Kanban Guides. (2025). The Kanban Guide. Official Guide.

4. Atlassian. View and Understand the Control Chart. Jira Software Documentation.

5. PRINCE2. Understanding Tolerances in PRINCE2 Project Management. PRINCE2 Resource.

6. Scrum.org. (2024). Evidence-Based Management Guide. Official Guide.

7. Forsgren, N., Storey, M.-A., Maddila, C., Zimmermann, T., Houck, B., & Butler, J. (2021). The SPACE of Developer Productivity: There's More to It Than You Think. ACM Queue, 19(1). DOI: 10.1145/3454122.3454124.

8. Bakker, A. B., Demerouti, E., & Sanz-Vergel, A. (2023). Job Demands–Resources Theory: Ten Years Later. Annual Review of Organizational Psychology and Organizational Behavior, 10, 25–53. DOI: 10.1146/annurev-orgpsych-120920-053933.

---

This article is part of my ongoing research and book project on the Area of Normal Functioning (ANF), exploring its applications across technical, AI, human, and hybrid systems.

Applying the Area of Normal Functioning (ANF) to Pharmaceutical Safety Data (#ANF #Pharmacovigilance #OpenFDA #AI #DataScience #ChangePointDetection #HealthcareAI #Pharma)

One of the goals of the Area of Normal Functioning (ANF) project is to test whether the same general framework can be applied across very different dynamic systems.

So far, I have been looking at ANF in technical systems, human behavior, sports and other time-dependent data. A natural next question is whether ANF can also be useful in pharmaceutical data.

A particularly interesting opportunity is pharmacovigilance — the analysis of adverse-event reports collected over time.

The basic idea is simple.

For a particular drug, we can construct a monthly time series of adverse-event reports and ask:

What does the normal reporting pattern look like, and when does that pattern change?

Instead of considering only whether a value is “high” or “low,” ANF attempts to characterize the range in which the system normally functions and then detect:

• excursions outside that range;
• persistent shifts;
• change points;
• new operating regimes;
• trends that may eventually move the system outside its established ANF.

A promising first example is montelukast, marketed as Singulair.

The FDA has documented a history of neuropsychiatric safety concerns associated with montelukast. It issued communications beginning in 2008 and later required a boxed warning in 2020. This gives us something especially useful for methodological validation: known historical events that can be compared with change points detected independently from the data.

The proposed experiment would use monthly adverse-event data from the FDA Adverse Event Reporting System, available through openFDA.

Rather than analyze only the total number of reports, I would like to construct at least three related time series:

1. total monthly montelukast adverse-event reports;
2. monthly montelukast reports involving selected neuropsychiatric events;
3. the ratio of neuropsychiatric reports to all montelukast reports.

The third series may be particularly useful because it can partially separate a change in the composition of reports from a general increase or decrease in overall reporting volume.

The main research question would be:

Can ANF and change-point analysis identify a structural change in montelukast adverse-event reporting without being told in advance when FDA communications occurred?

A strong version of the experiment would establish the initial ANF using only data available before 2008 and then process later observations sequentially.

That would let us ask a more interesting question:

At what point would the method first have indicated that the reporting process was no longer behaving within its previously established Area of Normal Functioning?

Detected change points could then be compared with known external events such as the 2008 FDA communication and the 2020 boxed warning.

It is important to be careful about interpretation. FAERS reports do not establish causality or true incidence rates. An increase in reports can result from many factors, including publicity, regulatory attention and stimulated reporting.

Therefore, the purpose of ANF would not be to conclude that a drug caused a particular effect.

The more defensible interpretation is:

ANF detects a change in the normal behavior of the pharmacovigilance reporting system.

Understanding why that change occurred is a separate analytical step.

This distinction is actually one of the reasons the example is interesting. ANF is designed to detect when a dynamic system moves into a different state, without assuming in advance what caused the transition.

If the experiment works well, I would next apply the same methodology to other known pharmaceutical events, such as the withdrawal of ranitidine and historical safety concerns around rosiglitazone.

Together, these examples could help determine whether ANF can provide a useful general framework for monitoring pharmaceutical and healthcare data in addition to technical and human systems.

Can AI Systems Have an Area of Normal Functioning?

A synthetic TTFT experiment using dynamic ANF boundaries

As I continue developing the concept of the Area of Normal Functioning (ANF), I have been looking for new types of systems where the idea could be useful.

Artificial Intelligence - and particularly Large Language Model (LLM) services - provides an interesting case.

An AI system is still a system performing work. It receives a workload, consumes computational resources, produces results, and has measurable performance characteristics. That immediately raises a question:

Can we define an Area of Normal Functioning for an AI service?

I believe we can. 

Measuring the Performance of an LLM

Consider a user sending a request to an LLM. One particularly useful performance metric is Time to First Token (TTFT) - the time between submitting a request and receiving the beginning of the response.

For request i, we can write:

TTFT_i = t_{first token} - t_request

TTFT is affected by many factors, including workload, prompt size, concurrent requests, model characteristics, and available computing resources. Therefore, it should not be expected to remain constant.

Instead of asking whether TTFT is below some fixed threshold, ANF suggests another question: What range of TTFT values represents normal functioning of this particular AI system under its current operating conditions?

A Synthetic Experiment

To explore this idea, I generated a synthetic dataset representing 600 sequential requests to an LLM service. The simulated workload includes prompt and output token counts, changing levels of concurrent requests, an initially stable operating period, gradually increasing workload, a temporary overload period, and recovery into a somewhat different operating regime.

The TTFT itself was modeled conceptually as:

TTFT_i = f(P_i, C_i) + ε_i

where Pᵢ is prompt size, Cᵢ is concurrent workload, and εᵢ represents normal random variability.

The objective was not to reproduce any particular commercial AI system. The dataset is deliberately synthetic so that the behavior of the system is known and the ANF concept can be demonstrated clearly.

Building the AI Area of Normal Functioning

For this initial experiment I used moving percentiles to describe the current operating region. For a rolling window of recent observations, the center line is:

CL(t) = P₅₀(TTFT)

The lower and upper boundaries are:

LCL(t) = P₀₅(TTFT)

UCL(t) = P₉₅(TTFT)

Thus, the Area of Normal Functioning is:

ANF(t) = [P₀₅(t), P₉₅(t)]

The important point is that these boundaries are not fixed. They move as the behavior of the system changes.

Figure 1. Synthetic LLM service TTFT with a dynamic Area of Normal Functioning (P05-P95).

In the figure, the actual series represents TTFT; P50 describes the center of normal functioning; P05 and P95 form the lower and upper ANF boundaries; and the shaded region represents the Area of Normal Functioning.

The result is similar in spirit to the IT-Control Charts I have used for many years in computer performance analysis, but here the monitored object is an AI service.

Something Interesting Happens

During the first part of the experiment, TTFT fluctuates around a relatively stable level. As workload increases, however, both TTFT and its ANF begin moving upward. Eventually the simulated service enters an overloaded state. Its TTFT becomes substantially higher, but after enough observations the ANF itself adapts to this new operating regime.

An individual observation above the current upper boundary can be represented as:

TTFT_t > UCL(t)

Such an observation may be an exception. Persistent movement of the entire ANF, however, can indicate something different: a change in the functioning of the system itself.

Exception  ->  Trend  ->  Change Point  ->  New ANF

From Detection to Prediction

The idea becomes even more interesting when trend analysis is added. Suppose the current TTFT trend can be approximated locally by:

TTFT_pred(t) = a + bt

where b > 0 indicates increasing response latency.

If the current upper ANF boundary is UCL, the estimated crossing time is:

t_cross = (UCL - a) / b

The corresponding time remaining before the forecasted ANF boundary crossing is:

TimeToANF = t_cross - t_now

This changes the question from “Has AI performance become abnormal?” to the more useful proactive question: “How long do we have before AI performance is expected to leave its current Area of Normal Functioning?”

This connects ANF directly with proactive performance and capacity management.

Beyond TTFT

TTFT is only the first example. An AI service has many possible performance dimensions. A conceptual multidimensional formulation is:

ANF_AI = f(TTFT, TPOT, Tokens/sec, QueueTime, TokenCount, Errors, ResourceUsage, ...)

Ultimately, an AI system may have a multidimensional Area of Normal Functioning rather than an ANF based on only one metric.

Even more interestingly, these dimensions are related. A TTFT that is unusual for a small prompt may be perfectly reasonable for a much larger request or under substantially greater concurrency. A more advanced formulation could therefore be conditional:

ANF = P(Performance | Workload, Model, Configuration)

In other words: What is normal performance for this AI system under these particular operating conditions? That is a much more interesting problem than simply comparing every request with a fixed threshold.

Why I Find This Interesting

ANF originated in my earlier work with technical systems. I am now exploring whether the same fundamental idea can describe normal functioning, adaptation, and change across very different kinds of systems.

AI creates an especially interesting bridge. It is clearly a technical computing system, making it suitable for traditional performance engineering. At the same time, modern AI increasingly interacts with people and becomes part of larger human-technical systems.

For now, this experiment is intentionally simple: one AI performance metric, synthetic data, and one-dimensional ANF analysis.

The logical next step is to repeat the experiment using real measurements from an LLM service. If the approach continues to work, ANF may provide a unified way to describe not only whether an AI system is functioning normally, but also how its normal state changes - and when it is about to leave it.

Note: This blog example uses synthetic data as a proof of concept. A future academic version should validate the method using measured LLM-serving telemetry and compare ANF-based detection with fixed SLOs and other adaptive baselines.

A YouTube Example of ANF: When “Typical Performance” Becomes a Normal Functioning Band

Sometimes the best examples of an idea appear in places where you do not expect them.

Recently, while looking at analytics for one of the videos on my YouTube channel @iTrubin, I noticed something that immediately reminded me of work I started more than twenty years ago.

YouTube now shows a “Typical performance” band around a video’s actual performance.

In the example below, the blue line shows the actual number of engaged views, while the gray area shows the range YouTube considers typical.

That immediately looked familiar to me.

This idea goes back to my SETDS work

In 2002, I published my first paper on SETDS — Statistical Exception and Trend Detection System at CMG’2002. That paper received the Best Paper Award.

The central idea was simple: a raw number by itself is often not very meaningful. What matters is whether that number is inside or outside the expected range of behavior.

This is how I approached IT performance data at the time.

Instead of asking:

“Is this value high or low?”

the more useful question was:

“Is this value normal for this system, at this time, under these conditions?”

That idea later became part of what I now describe more broadly as the Area of Normal Functioning — ANF.

And then I saw YouTube doing something very similar

I started my YouTube channel back in 2009. At that time, this kind of “typical performance” band was not part of YouTube Analytics.

Today it is.

YouTube compares the current behavior of a video with a range based on historical performance and presents that expected range visually.

For example, in the case shown here:

• Engaged views: 44
• Typical range: 10–50

and:

• Views: 99
• Typical range: 20–100

The raw values are useful, of course. But the ranges are much more informative.

Forty-four engaged views by itself tells me almost nothing.

Forty-four engaged views inside a typical range of 10–50 tells me that the video is performing toward the upper end of what is normal for this channel and this type of content.

That is a much richer interpretation.

Collective of Customers / Viewers as an ANF example. YouTube Analytics compares actual video performance with a “Typical performance” range. The example is based on analytics from my YouTube channel, @iTrubin.

Why I see this as an ANF example

What makes this particularly interesting to me is that the expected range is produced not by one viewer, but by the behavior of a collective.

A large number of viewers interact with content over time. Their combined behavior creates a statistical pattern.

That pattern becomes the “normal” or expected range.

So in this case:

the collective of viewers creates the Area of Normal Functioning, and the individual video is evaluated against it.

This is exactly the kind of extension of ANF that I find interesting.

Originally, I used similar ideas for computer systems and performance data.

Now the same way of thinking can be applied to:

• customers,
• viewers,
• users,
• athletes,
• teams,
• organizations,
• and many other dynamic systems.

One important clarification

I am not suggesting that YouTube copied SETDS or used my work directly.

I did not patent SETDS, and I have no evidence of any connection.

What I find much more interesting is that similar analytical ideas appeared independently in commercial tools years later.

Over time, I have seen other products introduce concepts that looked familiar to me as well, and I have written about some of them on this blog.

For me, that is actually encouraging.

When the same basic concept keeps reappearing independently in different fields, it may be a sign that the underlying principle is useful and general.

From anomaly detection to normal functioning

My original SETDS work was mostly about finding exceptions, trends, and changes.

But over time, I became increasingly interested in the opposite side of the same problem:

What does normal behavior look like?

And more importantly:

How wide is the normal range, how does it change over time, and what happens when the system begins to move outside it?

That is one reason I now use the broader ANF concept.

The YouTube “Typical performance” band is a simple and very practical illustration of that idea.

It tells the creator:

“Here is where your content normally operates. Now let us see where this particular video falls relative to that area.”

That is ANF thinking in a very accessible form.

Final thought

The concept of an Area of Normal Functioning is not new in my work. I first introduced ОНФ/ANF decades ago in my PhD research on robotic grasping and passive adaptation.

Later, SETDS brought a related idea into statistical analysis of dynamic computer systems: instead of judging a measurement in isolation, define the expected range of behavior and detect meaningful departures from it.

What interests me now is how these lines of work come back together.

Seeing YouTube use a “Typical performance” band is interesting not because I believe there is any direct connection to my earlier work, but because it demonstrates how naturally the same principle appears in another domain.

Whether we are looking at a robotic grasp, a computer system, an athlete, a customer population, or millions of viewers, the underlying question is remarkably similar:

What is the Area of Normal Functioning for this system — and when does its behavior meaningfully move beyond it?

That is the broader idea I am now trying to develop with ANF.