Industry: Aerospace
Product: Tamara
Application: Satellite launch risks

Late and Over Budget Are the Same Event: a 24% Chance the Campaign Hits Both

A commercial GEO communications satellite was scheduled from mission design to on-orbit handover the orthodox way — eleven activities, each with a most-likely duration, chained through the build-to-launch network and read off the end as a clean February 2028 handover with a $180M budget. The company carried both numbers to its capacity customer and its insurers as if they were independent commitments to manage separately. They are not. On a launch campaign, schedule and cost are the same risk seen on two axes: every day the satellite slips carries program-team burn, facility lease and launch-slot holding cost, so a late campaign is an over-budget campaign by construction.

Rebuild the campaign in Tamara, Vose Software's Monte Carlo project risk tool, with Beta-PERT durations and six discrete risk events, and plot each simulated run as a point in the finish-date / total-cost plane. The joint density makes the coupling impossible to miss — the cloud runs diagonally, and the plan-and-budget lines cut it into quadrants.

The deterministic plan (740 days) and the $180M budget sit at the lower-left corner of the cloud, not its centre — the regime where almost no runs land. In 24% of simulations the campaign finishes both late AND over budget — the dangerous upper-right quadrant where a slip and an overrun arrive together and compound. There is no meaningful population of runs that are late-but-on-budget or on-time-but-over: the diagonal density says the two outcomes move as one, which is why a launch campaign cannot be governed with a schedule plan and a cost budget treated as separate documents.

The schedule that produces the cloud

Behind the joint density is a finish distribution: P50 September 2028, P90 January 2029, against a 740-day deterministic plan with just a 1% chance of being met and a mean simulated finish of 961 days. The stochastic Gantt places every activity in time as a band rather than a bar:

The whiskers widen downstream because uncertainty compounds along the chain: each activity inherits the spread of everything it waits on, so on-orbit commissioning carries the accumulated variability of the whole campaign before it — and that spread is exactly what stretches the cost cloud along its diagonal.

Where the schedule risk actually lives

Tamara ranks each activity by its cruciality — the rank-correlation between its duration and the campaign finish — turning the simulation into a prioritised action list:

The environmental test campaign leads (cruciality 0.45), effectively tied with launch-vehicle integration (0.44) and payload procurement (0.42). Duration certainty on environmental test, the launch-vehicle interface and the long-lead payload buys more end-date — and therefore more budget headroom — than anything downstream. The launch-and-commission tail is on the critical path in essentially 100% of iterations, so compressing it is futile; the leverage is upstream.

The discrete risks that drive the tail

Six events were modelled as Bernoulli risks — each may or may not occur, but if it does it adds delay and cost. Ranking them by expected schedule impact (probability x delay) gives a clean Pareto:

Five of the six events carry roughly 80% of the expected discrete-event delay — a launch-vehicle manifest slip (5.7 weeks expected), an environmental-test failure / re-run (4.7), a late payload component (4.2), an integration anomaly (2.8) and a range / weather scrub (2.5). The manifest slip alone is the single largest driver, which reframes the campaign as much around securing a firm launch slot as around the satellite build itself.

How much contingency to actually carry

The joint density says the campaign will overrun; the contingency ladder says by how much, at each level of confidence the company might choose to commit against:

Each rung reads as a decision: a P50 commitment needs +216 days beyond the deterministic plan (finishing day 956), P80 needs +305 days (day 1,045), and a near-certain P95 needs +391 days (day 1,131). The ladder turns "how much schedule contingency?" from a negotiation into a menu — and because each schedule rung maps directly onto the cost axis of the joint density, choosing a confidence level is simultaneously choosing a budget reserve.

What Tamara changed

• Schedule and cost were managed as one coupled risk, after the joint density showed a 24% chance of finishing both late and over budget — and essentially no chance of one without the other.
• The external commitment moved from the deterministic February 2028 date to a risk-informed P80 (+305 days of quantified contingency), ending the rolling-promise cycle with the capacity customer and insurers.
• Risk-reduction effort was redirected to environmental test, launch-vehicle integration and long-lead payload — the three highest-cruciality activities — and to securing a firm launch slot, the largest discrete risk.
• A confidence level was chosen from the contingency ladder, fixing the schedule reserve and the matching budget reserve in a single decision.

Tamara Functionality Used

• Monte Carlo schedule simulation over the full activity network, with Beta-PERT durations and parallel-path logic.
• Joint cost-schedule density showing, per simulated run, that finish-date and cost overruns occur together rather than independently.
• Discrete risk-event modelling (Bernoulli occurrence x Triangular impact) for manifest slips, test re-runs and weather scrubs, layered onto task durations and costs.
• Cruciality analysis ranking activities by how much their variability moves the launch date.
• Stochastic Gantt and contingency ladder for communicating schedule uncertainty and translating confidence levels into committed days of reserve.

A launch campaign is not a date and a budget; it is a single joint distribution with a diagonal body the team can plan against and an upper-right tail it cannot afford to ignore. Tamara is what turns "when do we launch, and for how much?" into one coupled probability the company, its customer and its insurers can all sign.