The inputs to a project - primarily the time to execute a given task - are uncertain; they have many possible values and each of those values has its own probability of being right. You can't just take the averages (expected values) and calculate with them because they aren't additive. One example of the constraint is two workflows converging on a milestone. The milestone date is the maximum of the two finish dates, and *the maximum of two averages has no meaning*. That's one reason PERT and CPM are so consistently wrong.

The uncertainty in the inputs translates to uncertainty in the outputs. You have to calculate with the inputs as probability distributions, producing probability distributions for the project duration and cost. The standard way of doing this is to simulate running the project many times, each time with a different combination of input values (a trial). What CPM does once, you do a thousand times. You do this in a way that makes sure all the trials are equally probable, so the outputs will all be equally probable (more or less - this is such a huge improvement that you don't need to worry about minor discrepancies).

A bit of curve plotting gives us some insight into the range of possible project outcomes and their probabilities. We can use that as input to whatever resourcing decisions we might want to make.

Monte Carlo Simulation is one way to do the simulation. Probability Management and SIP Math is a superior way to do it. They have one thing in common and that is that they use PRNGs to get the input combinations sufficiently mixed to meet the requirement. Beyond that they part company.