Three instruments, in order of warning time: coronagraphs that see the launch days out, a physics model that turns launch speed into an arrival, and the L1 monitor that turns the last hour from a forecast into a measurement.
A fast CME plows into the slower solar wind ahead of it and decelerates, like a boat pushing through water. Feed the model a launch speed, a direction and the wind it must push through, and physics gives an arrival time. The catch is that the wind changes daily and a head-on CME's speed is hard to measure. That is where the error bars come from.
Same CME, same launch. Change only the wind it must push through and watch the arrival move.
Every arrival estimate on this site comes from that model. Here is its scorecard against real measured arrivals, misses included.
Twelve hours is the median. The mean is about fifteen, and roughly a third of arrivals miss by eighteen hours or more, so the tails are wide. That is the state of the field, not a shortcut. Arrival is physics on speed and distance. Storm strength is a different question: it hinges on the field direction inside the cloud, the Bz from Module 1, and nobody can read that until the last hour. The science page has the full validation.