Every number in your report is traceable to a published method.

01Sampling distributions

Duration uncertainty is captured as a three-point estimate (minimum a, most likely m, maximum b) on each activity, and each discrete risk carries its own three-point impact range. Seven distributions are available (triangular, Trigen P10–P90, Beta-PERT, uniform, normal, lognormal, discrete); the default is triangular, the workhorse of practical QSRA because its parameters are exactly the three numbers a workshop can estimate.

Triangular

Sampled by the closed-form inverse CDF, so it is exact under both random and stratified (LHS) sampling. With F_c = (m−a)/(b−a) and u ~ U(0,1):

Trigen (P10–P90)

Workshop estimates are rarely absolute limits — "best case minus 10%" usually means a P10, not a floor. Trigen treats the entered min/max as the 10th and 90th percentiles and solves for the true triangular limits (a, b) such that F(min)=0.10 and F(max)=0.90 — the solver iterates the closed-form triangular CDF tails to convergence (verified to 4 decimal places) and is cached per unique triple. This reproduces Pertmaster's Trigen behaviour and widens the tails honestly instead of clipping them.

Beta-PERT

The PERT distribution is a Beta distribution rescaled to [a, b] with shape parameters derived from the mode, giving a smoother, less tail-heavy shape than triangular for the same three points (mean = (a + 4m + b)/6):

Beta variates are generated as G₁/(G₁+G₂) from two Gamma variates via the Marsaglia–Tsang squeeze method (with the Johnk-style boost for shape < 1). Because Beta has no closed-form inverse CDF, under LHS or inside a correlation group PERT variables fall back to the triangular inverse on the same three points — a documented, conservative approximation stated in every report's method statement.

Uniform, Normal, Lognormal, Discrete

Normal deviates come from the Box–Muller transform under plain Monte Carlo; under LHS and inside correlation groups the engine uses Acklam's rational approximation to the inverse normal CDF (relative error < 1.15×10⁻⁹), which maps a stratified u directly to a z-score. The three-branch discrete option reproduces the classic Pertmaster-style 25/50/25 spot-value pattern.

Refs Vose (2008) ch. 10; Marsaglia & Tsang (2000); Acklam (2003); PMI PERT literature.

02Random numbers & reproducibility

All randomness derives from a single seeded mulberry32 pseudo-random generator — a 32-bit state PRNG with good statistical quality for simulation workloads and, crucially, deterministic replay. The seed is shown in the run bar, editable, and printed in the report's reproducibility block.

Reproducibility contract: identical seed + identical inputs + identical engine version → bit-identical results. Pre- and post-mitigation scenarios are run with the same seed, so mitigation deltas are a fair like-for-like comparison, not sampling noise. The engine version is printed in every report because adding a sampling stream (as the cost layer did) legitimately changes same-seed draws between versions.

Refs mulberry32 (Ettinger, public domain); L'Ecuyer & Simard (2007) on PRNG testing.

03Latin Hypercube Sampling

Plain Monte Carlo converges at O(1/√N). LHS stratifies each input variable's probability axis into N equal bins and samples each bin exactly once (in an independent random order per variable), which typically cuts the iterations needed for stable P-values by a factor of 3–10 on schedule networks.

Every stratified u is pushed through the variable's inverse CDF, so marginal distributions are preserved exactly for closed-form-inverse distributions (triangular, uniform, normal, lognormal, discrete). The permutations are drawn from the same seeded stream — LHS runs are as reproducible as plain runs. The engine guards memory by capping LHS at variables × iterations ≤ 2,000,000, falling back to plain sampling above it (and saying so).

Refs McKay, Beckman & Conover (1979); Iman (2008).

04Correlation groups

Ignoring correlation between activity durations systematically understates schedule risk — the central limit theorem cancels independent errors that, in reality, move together (same crew, same weather, same estimating basis). RunMonteCarlo models this with named correlation groups: pick the activities, set one correlation coefficient ρ.

This is a one-factor Gaussian copula: correlation is induced in normal space, then mapped back through each activity's own marginal distribution, so ranges are honoured exactly while joint behaviour tightens. Pairwise correlation within a group is ρ² in normal space — a group at ρ = 0.8 gives pairwise ≈ 0.64, consistent with how Pertmaster-style tools apply a single "correlation %" to a set.

Refs Iman & Conover (1982); Vose (2008) ch. 13; Hulett (2009) on the "merge bias" and correlation understating risk.

05The scheduling engine

Each iteration re-computes the full critical-path method over the project network with the sampled durations — no duration-summing shortcuts, no fixed critical path. The network is topologically ordered once at load; per iteration the engine runs a forward pass honouring all four precedence types plus lag:

Durations come from P6 XER files (calendar-aware: hours converted to working days via each calendar's hours-per-day) or MS Project MSPDI XML. Because the whole network is solved every iteration, path switching is captured naturally — the phenomenon where a near-critical path overtakes the deterministic critical path under uncertainty, which duration-only tools miss and which is the core argument for simulation over PERT hand-methods.

Refs Kelley & Walker (1959); Hulett (2009) ch. 2 on merge bias and path switching.

06Discrete risk events

Register risks are modelled as Bernoulli events: in each iteration, risk r fires with probability p_r; when it fires, an impact is sampled from its own three-point distribution and applied to its mapped activities (negative for opportunities). Post-mitigation values define the second scenario, run with the same seed.

When several risks hit one activity — the resolution rule

• Series (default): impacts add — the risks delay the activity one after another.
• Parallel: the largest single impact wins — the risks overlap in time.
• Fragnet: the impact is inserted after the mapped activity as a delay event, so it propagates through FS/FF successor logic without inflating the activity's own duration — the correct model for consent delays, re-work loops and handover gaps. (Unit-tested: a 10+10 day chain with a +5 fragnet finishes at 25.)

This rule is deterministic, stated per-risk in the register, and printed in every report's method statement — so a reviewer can always reconstruct how compound impacts were combined.

Refs AACE RP 57R-09 §risk drivers; Hulett (2009) ch. 8 on risk-driver methods vs range-only QSRA.

07Output statistics

All headline numbers are empirical quantiles of the simulated distribution — no normality assumption anywhere. P50/P80/P90 are read from the sorted finish (and cost) arrays; the S-curve is the empirical CDF itself.

Refs Williams (1992) on criticality/cruciality; DCMA 14-point & SSI practice notes; NASA JCL policy (NPD 1000.5); Vanhoucke (2010) on sensitivity measures.

08Convergence & how many iterations

The standard error of an estimated quantile falls with √N. For a quantile q with density f at the quantile, the asymptotic standard error of the estimate is:

In practice on project networks: 5,000 iterations gives P80 stability to well under a day on typical networks and is the app default; 10,000+ for formal submissions; with LHS on, stability arrives several times earlier. Because runs are seeded, you can verify convergence directly: run the same model at N and 2N with different seeds and watch the P80 move — if it moves less than your reporting precision, you have converged. That check takes seconds and beats any rule of thumb.

Refs Serfling (1980) on quantile asymptotics; McKay et al. (1979) on LHS variance reduction.

09The Schedule Fitness Gate

Monte Carlo on a broken network produces confident nonsense: open ends bypass logic, hard constraints pin dates through the simulation, negative lags hide sequence assumptions. Before you run, RunMonteCarlo grades the imported schedule against DCMA-14-aligned checks — missing logic, hard constraints, negative lags, excessive SS/FF reliance, long durations, and more — and issues a verdict: READY, READY WITH CAVEATS, or NOT RECOMMENDED, with the offending items listed and an attestation line printed in the report.

The gate is advisory, never a hard block — but the attestation makes schedule quality part of the audit trail, and for deep forensic schedule review the gate pairs with our sibling product ScheduleInsight.

Refs DCMA 14-Point Schedule Assessment; GAO Schedule Assessment Guide (GAO-16-89G).

10Validation against a closed-form answer

The strongest check on a simulation engine is a network whose answer is known exactly. Our reference network V1 is the canonical merge-bias case: two independent parallel paths into one finish, each a single activity with a uniform duration — Path A ~ U(80, 120) days, Path B ~ U(70, 130) days, both planned at 100. The project finish is max(A, B), so its CDF is the product of the two path CDFs and every quantile has a closed form:

Run through the actual production engine (not a test build) — seed 8812, 10,000 iterations, Latin Hypercube on, engine 1.0-beta.9:

All differences are inside Monte Carlo sampling tolerance at N = 10,000. This same network is also the cleanest demonstration of merge bias: both paths individually have a 50% chance of hitting day 100, yet the project's chance is only 25% and its P50 is day 110 — a full 10 days later than the deterministic plan, from geometry alone, before a single risk is added. This is why simulation, not single-path PERT, is the defensible method.

Refs Hulett (2009) ch. 2 (merge bias); MacCrimmon & Ryavec (1964) on PERT's optimistic bias at merge points.

Reconciliation with Pertmaster / Primavera Risk Analysis

Pertmaster is discontinued and no longer sold, so a licensed side-by-side run isn't available — to us or to most practitioners. What can be reconciled rigorously is the shared ground truth: both engines implement the same published method, so every case with a closed-form answer is a common benchmark. Beyond network V1 above, the engine reproduces the analytic answer for probabilistic branching (mixture network, analytic 35.500 — simulated 35.850), task existence (analytic 23.000 — simulated 22.946) and the two-path merge probability (analytic 0.250 — simulated 0.246), all at seed 8812 / 2,000 iterations, all inside sampling tolerance and shrinking as 1/√N.

The full statement — including the Pertmaster-to-RunMonteCarlo semantics mapping and the documented cases where results can legitimately differ — is in the project's reconciliation document, and every fixture is public. If you hold a working PRA installation, run them and send the distributions to hello@runmontecarlo.com: we'll publish the comparison, including any discrepancy, unedited.

11References