Thursday, June 11, 2026

Expanding the Area of Normal Functioning: From Technical Systems to Human Behavior

How a concept from engineering, anomaly detection, change detection, and trend detection may help us understand comfort zones, growth, organizations, and social change.

In my previous post (From Robot Grasping to Performance Anomaly Detection: Area of Normal Functioning and Exception Value), I introduced the idea of the Area of Normal Functioning, or ANF, as a way to describe the range within which a system operates normally.

My original interest in this idea came from technical domains. Earlier in my career, I applied similar thinking to robotics and assembly tasks. More recently, I have been using related concepts in IT Capacity Management, performance analysis, statistical pattern recognition, anomaly detection, change detection, and trend detection for dynamic systems. In these fields, we constantly ask questions such as:

When is a system behaving normally?

When is a deviation still acceptable?

When does a change become an anomaly?

When is a trend meaningful rather than just random variation?

When should we react?

These questions are familiar to engineers, performance analysts, and people working with complex systems. But I believe the same questions are not limited to technology. They also appear in human life, organizations, psychology, sociology, and even personal development.

That is why I now see ANF not only as a technical concept, but as a broader cross-disciplinary framework.

The Comfort Zone as a Human ANF

In psychology and sociology, we often hear the phrase comfort zone. Usually it describes the range of situations, behaviors, and environments where a person feels safe, competent, and in control.

This is very close to the idea of an Area of Normal Functioning.

A person has their own ANF. Inside it, they can operate effectively. They understand the rules. They know how to respond. They feel enough confidence and stability to function.

Outside this area, things become more difficult. A person may experience stress, uncertainty, fear, resistance, or even growth. Sometimes leaving the ANF is necessary. Sometimes it is dangerous. Sometimes it is exactly where learning begins.

This makes the concept more interesting. In technical systems, we often want to detect and avoid abnormal behavior. We also want to detect meaningful changes and emerging trends before they become serious problems. In human systems, however, moving outside the normal zone can be both a risk and an opportunity.

Normal Does Not Mean Ideal

One important point is that “normal” does not always mean “good.”

A machine can function normally but inefficiently. An organization can operate normally but still be outdated. A person can live inside a familiar behavioral pattern that is stable but limiting.

This is why I prefer the term Area of Normal Functioning rather than simply “normal state.” ANF is not a single point. It is a range. It has boundaries. It can expand, shrink, shift, or become distorted.

For example, an employee may function normally under a certain level of pressure. But if pressure increases beyond their ANF, performance may decline. Another person may need a higher level of challenge to stay engaged. The “normal area” is not the same for everyone.

The same is true for teams and organizations. A startup, a government agency, a hospital, and an IT operations team may all have very different ANFs. Their normal functioning depends on history, culture, expectations, constraints, and environment.

Anomaly, Change, and Trend Detection in Human and Social Systems

In IT performance analysis, anomaly detection is a practical necessity. We monitor metrics, define baselines, detect deviations, and decide whether the deviation requires action. But this is only part of the picture.

Sometimes the important signal is not a sudden anomaly, but a change point: a moment when the system begins to behave differently from before. In other cases, the important signal is a trend: a gradual movement in one direction that may not look dramatic today, but may become very important over time.

This distinction matters in human and social systems too.

A sudden change in behavior can be a warning sign. It can also be a breakthrough. A person who becomes quieter may be struggling, or simply reflecting. A team that starts challenging old assumptions may be in conflict, or may be moving toward innovation.

A gradual trend can be even harder to notice. A person may slowly lose motivation. A team may slowly become less open. An organization may slowly normalize inefficiency. Society may slowly redefine what is acceptable or unacceptable.

None of these patterns are always good or bad by themselves. Their meaning depends on context, direction, speed, and consequences.

This is where ANF could become useful as a thinking framework rather than only a mathematical tool.

Instead of asking only, “Is this normal or abnormal?” we can ask:

What is the current Area of Normal Functioning?

What are its boundaries?

Is the system experiencing a sudden anomaly, a structural change, or a gradual trend?

Who defines the normal boundaries?

Are these boundaries healthy or unhealthy?

Is the system being pushed outside its ANF?

Is the ANF expanding through adaptation, shifting because of change, or collapsing under stress?

These questions can apply to machines, people, organizations, and societies.

Growth as Expansion of ANF

In personal development, growth is often described as “getting out of your comfort zone.” I think this phrase is useful, but incomplete.

The goal is not simply to leave the comfort zone. The goal is to expand the Area of Normal Functioning.

When we learn a new skill, speak in public, move to a new country, change careers, or take on a new role, we are initially outside our established ANF. The situation feels uncomfortable because our normal patterns are no longer enough.

But with repetition, support, feedback, and adaptation, the new behavior can become part of our normal functioning. What was once difficult becomes manageable. What was once stressful becomes familiar. The ANF expands.

This also explains why growth must be managed carefully. If the challenge is too small, there is no expansion. If the challenge is too large, the system may break down. Effective growth happens near the boundary of the current ANF — not too far inside it, and not too far outside it.

From this perspective, personal growth can be viewed as a positive form of change detection: we notice when old patterns are no longer enough, and we intentionally develop new patterns until they become part of our expanded normal functioning.

Organizations Have ANF Too

Organizations also have Areas of Normal Functioning.

A company has normal ways of making decisions. A team has normal communication patterns. A culture has normal expectations. A profession has normal standards of behavior.

When external conditions change — new technology, market disruption, leadership change, economic pressure — the organization may be pushed outside its ANF. Some organizations adapt and expand. Others resist. Some become unstable. Some fail.

This is why change management is difficult. People often do not resist change simply because they are conservative or irrational. They resist because the proposed change may push them outside their established ANF without enough support, explanation, or time to adapt.

Trend detection is also important here. Organizations rarely become ineffective overnight. Often, performance, culture, or innovation capacity declines gradually. By the time the problem becomes obvious, the trend has already been active for a long time.

Understanding the ANF of an organization could help leaders design better transitions. Instead of forcing change mechanically, they could ask: what is the current normal functioning of this organization, how is it changing, and how can we expand it safely?

Why This Matters to Me Now

At this stage of my career, I am becoming increasingly interested in connecting my technical work with a broader human and organizational context.

My professional background is in IT Capacity Management, performance analysis, anomaly detection, change detection, trend detection, and statistical pattern recognition. I also developed Perfomalist.com as a practical tool for performance anomaly and change-point detection. But I now see this work as part of a bigger idea.

The same pattern appears again and again:

A system has a normal range.

The normal range has boundaries.

Change creates deviations.

Some deviations are noise.

Some deviations are warnings.

Some deviations indicate structural change.

Some trends reveal gradual movement toward a new normal.

Some deviations are opportunities for growth.

The challenge is to understand the difference.

This is the direction I would like to explore further — in writing, speaking, teaching, and possibly in a future book. My goal is to develop ANF as a universal framework that can connect technical systems, human behavior, organizations, and social change.

Toward a Universal Framework

The Area of Normal Functioning is still an evolving idea. I do not claim that it is a finished theory. But I believe it can become a useful bridge between disciplines.

Engineers, psychologists, sociologists, managers, educators, and leaders all deal with systems that function within boundaries. They all deal with change, adaptation, stress, stability, abnormal behavior, and emerging trends.

The language may be different, but the underlying questions are often the same:

What does normal functioning mean here?

How do we know when normal functioning has changed?

How do we distinguish noise, anomaly, trend, and meaningful transformation?

What happens when the system moves beyond its normal area?

Those questions may be technical. They may be personal. They may be organizational. They may even be philosophical.

For me, this is what makes ANF worth exploring further.

It started as a technical concept. But perhaps its larger value is helping us understand how systems — including human systems — survive, adapt, change, and grow.



Monday, May 18, 2026

From Robot Grasping to Performance Anomaly Detection: Area of Normal Functioning and Exception Value

Many years ago, my PhD dissertation focused on industrial robot grasping processes and assembly accuracy using passive, sensorless adaptation. The practical problem was simple to describe but difficult to solve: how can a robot successfully grasp or assemble an object when there are inevitable errors in the object’s initial position, orientation, and geometry?

The main idea of that research was to calculate a set of initial conditions under which the grasping or assembly process would still succeed. I called this region the Area of Normal FunctioningANF; in Russian, Область Нормального Функционирования — ОНФ.

In other words, ANF defined the “safe” or “normal” area of operation. If the initial coordinates of the object were inside this area, then passive mechanical adaptation could compensate for small errors and the operation would be successful. If the initial coordinates were outside this area, the process would likely fail.

Looking back, this idea has an interesting connection to my later work in IT performance anomaly detection. In my current research, I use the concept of Exception ValueEV — as the area between statistical limits and the actual observed values of system performance variables.

The domains are very different: one is industrial robotics, the other is IT system performance management. But the underlying idea is surprisingly similar.

In robotic grasping and assembly, the question was:

How far can the object’s actual position deviate from the ideal position while the robot operation still succeeds?

In performance anomaly detection, the question becomes:

How far can the actual value of a performance variable deviate from its statistically expected range before we should treat it as an exception?

In both cases, the main focus is not only the ideal or expected value. The more important question is the boundary between normal and abnormal functioning.

For industrial robots, ANF described the range of physical coordinates where passive adaptation was still able to correct errors. For performance data, EV describes the area where actual behavior moves beyond normal statistical expectations.

This connection is especially interesting because both ideas are based on “management by exception.” We do not need to react to every small deviation. We need to understand when a deviation becomes meaningful — when it leaves the normal functioning area.

Modern robotics research continues to explore related ideas under different terminology: passive compliance, compliant grasping, remote center compliance, sensorless robotic assembly, peg-in-hole insertion, and adaptive manipulation. Many recent methods also use sensors, machine learning, and vision systems. However, the older idea of defining a normal operating region remains relevant: successful automation depends not only on control algorithms, but also on understanding the tolerance zone where the process can still function correctly.

That is why I now see ANF as an early conceptual predecessor of my later EV work. ANF was about the boundary of successful physical operation. EV is about the boundary of normal statistical behavior.

Different fields. Different data. Same engineering mindset:

define the normal area, measure the deviation, and focus attention on meaningful exceptions.


 “conceptual comparison” table


Saturday, April 25, 2026

From AIOps to Agentic Systems: Why Monitoring Is Not Enough (and Never Was)

For years, the industry has been obsessed with observability.

Dashboards. Alerts. Correlations.
Then came AIOps — promising intelligence on top.

But let’s be honest:

Most AIOps tools today are still just better dashboards.

They detect problems.
Sometimes they explain them.
But very rarely do they fix anything.


The Missing Step: Action

Across my (with Capital One and 2 other co-authors) patent family:

  • US10437697 (2016)
  • US11243863 (2019)
  • US12007869 (2021)

there is a deliberate progression:

[Workload] → [Model] → [Insight] → [Action]

Most systems today stop here:

[Workload] → [Model] → [Insight] ❌

The real value starts here:

[Workload] → [Model] → [Insight] → [Action] ✅

Step 1 — Modeling the System (US10437697)

The first patent introduced a core idea:

Model how business activity (transactions) drives system resources (CPU, memory, I/O).

Not thresholds.
Not heuristics.
But statistical relationships.

Transactions ───► CPU / Memory / I/O
(modeled mathematically)

This was already a shift from traditional monitoring.


Step 2 — Adding Context (US11243863)

The second patent introduced interaction types:

Different workloads behave differently — so model them separately.

Mobile ─┐
Web ├──► Separate models ───► Better decisions
ATM ┘

This aligns with what the industry now calls:

  • service-level observability
  • topology-aware analysis

Step 3 — Acting on the Model (US12007869)

This is the key leap.

The latest patent moves beyond analysis:

Use the models to automatically reconfigure the system.

Before:
Workload ───► Overloaded Node

After:
Workload ───► Optimal Node
(automatically reassigned)

Or more formally:

[Model] → Decision → Remap workloads → Optimize system

This is no longer monitoring.

This is autonomous control.


Why This Matters Now (Agentic AI)

Everyone is talking about:

  • AI agents
  • autonomous systems
  • self-healing infrastructure

But here’s the uncomfortable truth:

You can’t have agentic systems without reliable system models.

LLMs don’t understand system dynamics.
They generate text — not operational decisions.

What you need is:

Statistical Models (US10437697)
+ Context Segmentation (US11243863)
+ Autonomous Action (US12007869)

Which leads to:

→ Agentic AIOps

The Real Gap in AIOps Today

Platforms like:

  • Datadog
  • Dynatrace
  • New Relic

are very good at:

✔ Detecting anomalies
✔ Explaining root causes

But still weak at:

❌ Acting autonomously
❌ Continuously optimizing systems


My Take (Provocative Version)

AIOps without action is just observability with better marketing.

The real transition is:

Monitoring → AIOps → Autonomous Systems → Agentic AI Ops

And the key step is exactly what US12007869 enables:

Systems that don’t just understand —
but act based on that understanding.


Final Thought

If your system still depends on humans to:

  • interpret alerts
  • decide what to do
  • execute changes

Then it’s not AIOps.

It’s just monitoring — with extra steps.

______________

Reference:

My CMG presentation about the subject: https://cmg.org/wp-content/plugins/s2member-files/proceedings/2017/362_Trubin.pdf



___________________________________________

Disclaimer:  this post is written with ChartGPT's help. 

One of most recent parent with Capital One (2021 US12007869) is about Autonomous / AI ops (AIOps)

The following patent family:
PatentLevelWhat it protects
2016 (10437697)    Foundation    `Build + validate statistical models
2019 (11243863)    Structured    Segment system into interaction types
2021 (12007869)        Adaptive    Dynamically reconfigure system using models

This progression covers:

✔ Observability / APM tools 

  • Modeling + correlation (Patent 1)

✔ Capacity planning systems

  • Segmented workload modeling (Patent 2)

✔ Autonomous / AI ops (AIOps)

  • Self-optimizing infrastructure (Patent 3)

👉 You effectively moved toward:

self-driving infrastructure based on statistical modeling

Those patents map very directly to modern AIOps, especially the parts around business/workload demand → resource utilization → model scoring → automated load-balancing/remapping.

Core patent family vs AIOps platform features

Patent conceptPlain-English meaningModern AIOps equivalent
Interaction / transaction volume by typeBusiness workload demand, e.g. mobile banking, ATM, web trafficService traffic, request rate, user actions, business events
Device/resource utilizationCPU, memory, disk, network usageInfrastructure + APM telemetry
Statistical / regression / multivariate modelsModel relationship between workload and resource consumptionML baselines, anomaly models, predictive analytics
Diagnostic scoring: R², RMSE, strengthDecide which models are reliableConfidence/scoring of anomalies, correlations, RCA evidence
Filtering weak modelsKeep only useful modelsNoise reduction / alert suppression
ForecastsPredict future demand/resource pressureBottleneck prediction, capacity forecasting
Remapping devices to interaction typesUse model output to change workload placementAutomated remediation, scaling, routing, load balancing

The  strongest overlap is not generic “anomaly detection.” It is business-demand-aware resource modeling that can drive infrastructure decisions.



Friday, April 24, 2026

"Automated Detection of Performance Regressions Using Statistical Process Control Techniques"

Exploring ICPE’12 — A Precedent I Didn’t Expect

I recently came across an interesting paper from ICPE 2012 where my earlier work was cited. It’s always a bit surreal to see your ideas show up in academic research years later—especially in a context that closely aligns with what you’ve been working on.

The Paper

Automated detection of performance regressions using statistical process control techniques

Thanh H.D. Nguyen, Bram Adams, Zhen Ming Jiang, Ahmed E. Hassan
Published by ACM, April 2012

What caught my attention was their discussion of using control charts to detect performance regressions—an approach very close to what I explored back in 2005.

The Connection

In the paper, the authors reference my work:

Trubin et al. [18] proposed the use of control charts for in-field monitoring of software systems where performance counters fluctuate according to input load. Control charts can automatically learn when deviations exceed control limits and alert operators.

They go on to build upon this idea, applying control charts not just to live systems, but to performance regression testing.

Key Idea: Control Charts for Regression Detection

The core concept is elegant:

  • Use historical baseline runs (previous software versions) to establish control limits
  • Compare new test runs against those limits
  • Measure a violation ratio—how often metrics fall outside expected bounds
  • A higher ratio indicates a higher probability of regression

This aligns closely with the fundamental principle I worked on: detecting anomalies not by fixed thresholds, but by statistically learned behavior.

The Real Challenge

The authors correctly highlight a critical difficulty:

We want to detect deviations in the system (the process), not deviations caused by input variability (the load).

This is the central problem in performance analysis—and one that still trips up many modern monitoring systems.

They also point out two assumptions required for traditional control charts:

  1. Stable (non-varying) input
  2. Normally distributed output

In real-world systems, both assumptions are often violated.

Their Solution: Preprocessing

To address this, they introduce preprocessing steps:

  • Scaling – normalizing data to reduce input-driven variance
  • Filtering – cleaning noise before applying control charts

This is a practical adaptation, though it also highlights the limitations of applying classical statistical techniques directly to complex software systems.

Looking Back

For reference, the cited work is:

[18] I. Trubin. Capturing workload pathology by statistical exception detection system.
Computer Measurement Group (CMG), 2005.

It’s interesting to see how the idea of statistical exception detection—especially under variable workloads—continues to evolve and reappear in different forms.

Final Thoughts

What I find most encouraging is that the core idea still holds:

Performance anomalies should be detected relative to expected behavior, not absolute thresholds.

Whether you call it control charts, anomaly detection, or change point analysis—the principle remains the same.

And it’s a good reminder: sometimes ideas don’t just age… they propagate.




Friday, January 2, 2026

My next patent application is officially published: "SYSTEMS AND METHODS FOR PROACTIVE WORKLOAD MANAGEMENT"