Abstract: A method and apparatus for monitoring and analysing signal data which uses a network model describing the system under investigation and a runtime agent for acquiring the signal data and accessing the model if an anomaly in the signal data is indicated. The network model describes events of interests and how the events relate to phenomena in the system. The network model is constructed using an object-oriented approach with: observations of the events of interests in the system; situations which describe possible underlying causes of the observations; and relations which specify the logical relationship between the observations and situations. The runtime agent is constructed with an object-oriented approach using observers which monitor the signal data and compute whether an anomaly in the incoming signal data exists. If an anomaly is identified, an "observation" is generated and the network model entered to analyse the observation and estimate a cause of the observation.