The past post on Thomsett's probability density functions brought up the point of "what does a properly formed risk analysis picture look like?" Here's one
This approach is supported by both technical and programmatic risk analysis. The technical risk management is provided by "risk buy down" activities made explicit in the program plan. As the program progresses through its various stages (SDR, PDR, CDR) technical activities take place to reduce risk for the measured element.
Programmatic risk reduction also takes place through the improving variances in the programmatic elements of the project. Narrower estimates on project completion durations, reduced risk of disruptive activities or alternative branching in the master plan.
The issue of estimating the duration of a task needs further development to illustrate how to do this in a manner consistent with the statistical analysis techniques used in large aerospace projects. I'll post these next.