I'm not sure flat risk per distance is the right model to use. If we consider a model like n classes of issues that all need to be handled one after another, th

I'm not sure flat risk per distance is the right model to use. If we consider a model like n classes of issues that all need to be handled one after another, then after most changes the incident rate will still be far above human, until it suddenly becomes much more safe. In that model, the failures come from the software failing categorically, not probabilistically.