Towards a Semi-Quantitative Approach for Assessing Evacuation Scenarios in the Context of Popocatépetl Volcano, México—The Case of San Pedro Tlalmimilulpan

Abstract

Volcanic exposure implies multiple hazards for human settlements. The identification of the potential hazards that volcanic activity can entail is a challenge requiring assessing the specific situations that a determined place would face. Popocatépetl, a volcano in the centre of México, represents a significant hazard source, and it is located within a densely populated region with more than 20 million people. Despite the existence of a colour-based volcano alert level system for the current activity of the volcano, it is relevant to assess which local scenarios are more likely depending on numerous variables, namely, related to the distance from the volcano. A semi-quantitative analysis was carried out based on existing hazard maps and considering the probability of occurrence of volcanic explosivity, taking the settlement of San Pedro Tlalmimilulpan as a case study. This analysis led to a hierarchised rank of hazards, providing a basis for analysing multiple scenarios through failure mode and event analysis, failure tree analysis and event tree analysis. This process facilitates the contextualisation of the multiple challenges and potential chains of events that emergency actions, namely, emergency evacuations, would face. The analysis of the critical paths can help to identify critical aspects that could hinder the post-event response.

1. Introduction

The Popocatépetl volcano is a stratovolcano located ca. 60 km away from México City, in the territorial limits of the states of México, Puebla and Morelos. It has a maximum height of 5500 m above mean sea level. It has been active in the last few decades and has forced the evacuation of the surrounding settlements during some intense periods of activity. The last large-scale evacuation occurred in December 2000, including all settlements within a radius of 13 km from the main crater and even some remoter villages, resulting in more than 41,000 displaced people [1]. Evacuation planning was relevant from the organisational point of view, leading to the design and implementation of communicational strategies for advising people in case of imminent hazardous activity [2].

San Pedro Tlalmimilulpan is one of the numerous settlements located in the surroundings of the Popocatépetl volcano. The village is located in the municipality of Tetela del Volcán, Morelos, ca. 16 km from Popocatépetl. The recent 2019 official census counted a total population of 1637 inhabitants, with a mean growth of 6.78% from 2005 to 2019. There was an illiteracy rate of 8.12% and a mean schooling rate of 6.29 years. About 34% of the population had indigenous origins, and 28.38% of the people over 12 years old was considered economically active. There were 479 houses and a ratio of motorised vehicles of 11.82% per home, meaning around 57 private vehicles [3].

One of the most critical conditions of the village is the lack of a local evacuation plan in case of an emergency. Even though volcanic activity is continuously monitored, and there is a permanent alert system, a successful evacuation is constrained by the road networks, and the availability of vehicles and infrastructure that must be locally analysed and assessed. A standardised early warning system (EWS) based on a colour-code was developed to make the current state of the threat public. This EWS, commonly named the Volcan Traffic Light Alert («Semáforo de Alerta Volcánica») [4] permits one to synthesise the information that is useful for the people to be prepared against potential eruptive scenarios. This system has been continuously calibrated and enhanced based on relevant events since 1995 [4], when volcanic activity became regular after a long pause.

2. Materials and Methods

The relevance of a local-scale approach for human settlements lies in the decision making for evacuation routes, calculation of shelter capacities, estimation of procedural times during an emergency and design of suitable alert systems [5]. This paper proposes a semi-quantitative assessment for identifying the most critical hazards in order to put them in a standardised hierarchical risk framework.

Early terminology for risk in the context of volcanic events has been provided by Fournier d’Albe [6]. This proposal considers that risk may be defined by the relation [risk=(value)·(vulnerability)·(hazard)], where risk is a possibility of a loss, value is the number of entities at stake (human lives, capital value or productive capacity) and vulnerability is the proportion of the value that is likely to be lost as a consequence of a determined event. In the volcanic context, hazard is the probability of a determined entity being affected by a volcanic event in a determined period of time.

The existent literature and maps are valuable sources for establishing local hazard scenarios based on exposure and probability of occurrence. The assessment of exposure to a specific hazard permits identifying which situation may reasonably affect San Pedro Tlalmimilulpan as a function of its geographic location. It is essential to recall that the unchaining of phenomena is related to the magnitude of the volcanic eruption. Hence, it becomes relevant to review the existing alert system (VTLAS), the volcanic explosivity index (VEI) level and the associated volcanic phenomena that would affect the selected settlement and the expected recurrence of the VEI levels.

This paper presents an analysis divided into three main phases. The first one is devoted to the introduction of some relevant concepts and current-use tools and approaches, namely, the volcanic traffic light alert system (VTLAS), the existing risk mapping and the set of phenomena that are hazardous in the context of Popocatépetl. In a second stage, this information is cross-compared to be presented in a comprehensive framework that permits one to contextualise the set of hazards at the geographic location of San Pedro Tlalmimilulpan, focused on their impacts on evacuating the settlement. Finally, this identification provides the basis for carrying out a failure mode and effect analysis [7] in which the settlement is described in terms of its components and the potential failures they can present during a volcanic event. The identification of those failures will permit one to feed failure and event tree analysis for identifying failure paths and systemic weaknesses during an evacuation.

2.1. Volcanic Phenomena, Hazard Maps and the Volcanic Traffic Light Alert System (VTLAS)

In 1995, the National Autonomous University of México developed hazard maps for Popocatépetl, according to models based on monitoring-stations records [8]. These maps were updated in 2019 [9,10], comprising six specific volcanic phenomena: tephra dispersion, ballistic projectiles, pyroclastic flows, lahars, avalanches and lava flows, as detailed in the following:

Tephra. Light particles (most of them are lightweight components of magma), expelled by fumaroles through the craters. This is one of the most common events and happens several times per year. The dispersion patterns are highly dependent on dominant winds and climatological conditions. Tephra can stay suspended in the air for long periods of time in favourable weather conditions. The severity of tephra depends on deposit accumulation and exposure time. Tephra can be a relevant health threat. This phenomenon is also widely known as ashfall, but tephra is a preferable term that is also common in specialised literature—refer, for instance, to Bonadonna et al., 2015 [11].

Projectiles (ballistic bombs and blocks). Fragments of rock with diameters from 6.4 mm up to several meters that are thrown by explosions at the crater. The distance that projectiles can reach depends on the magnitude of the eruption. Fitzgerald et al. (2017) [12] points that projectiles are a relevant thread to life and infrastructure and took the case of Popocatépetl as an example of the creation of scenarios for creating risk maps.

Pyroclastic density currents. A turbulent and violent flow composed of a mixture of rocks at a high temperature (700 °C), tephra and gas with speeds up to 200 km/h. This term encompasses pyroclastic flows and pyroclastic surges, as defined by Brown and Andrews [13].

Lahar or mudflows. Indonesian term for describing a rapidly flowing, gravity-driven mixture of rock, debris and water from a volcano. Its behaviour is dependent on the time and distance, as defined by Vallance and Iverson [14]. A combination of tephra fall and water coming from rain, ice or a lake may trigger lahars even once the eruption is over.

Debris avalanches. A failure of portions of the volcanic edifice resulting from the increased pressure in the inner part of the volcano. The structure becomes unstable and collapses.

Lava flows. Harris and Rowland [15] define active lava as a mixture of molten rock (liquid), crystals (solids), gas (bubbles) and other voids that are ejected onto the ground.

This list of phenomena focuses on the singular characteristics of Popocatépetl. A detailed list of general volcanic phenomena and relevant parameters by hazard can be found in Jenkins et al. (2014) [16] and in the Encyclopaedia of Volcanoes [17]. Each volcanic phenomenon has a dedicated hazard assessment, with different likelihoods, depending on the volcanic scenario. There are maps available online [18] that permit extracting more detailed and complementary data and indicators, such as the municipal social vulnerability index.

It is important to recall that this set of hazards excludes some other manifestations that are hazardous for human settlements and are also triggered by volcanic activity, such as earthquakes. In fact, seismic activity may become a serious hazard for vulnerable settlements and constructions, which can be severely damaged. Besides, seismic actions may trigger cascading events, such as landslides. These phenomena should thus be considered in order to get an understanding of the full chain of events that can be triggered.

The current state of volcanic activity is ranked with a colour system, and it is possible to consult it by phone or internet. The colour-based code («Semáforo de Alerta Volcánica») (

Table 1. Adapted from De la Cruz-Reyna et al., 2008 [4].

Alert Level	Expected Scenarios	Actions Recommended to SINAPROC
Green: Normality
Phase 1	–The volcano is quiet –Sporadic seismic signals	–Develop preparedness plans –Maintenance of monitoring devices –Keep pubic informed
Phase 2	–Low-level seismic activity recorded only at nearest stations –Some fumarolic activity –Minor changes in temperature of fumaroles –Minor changes in the composition of spring waters that do not affect its quality for agricultural and public use significantly	–Increase monitoring –Review of emergency plans –Increase the dissemination of volcano information to the public –Evacuation routes meeting sites –Joint exercises and drills
Yellow: Alert
Phase 1	–Increase of low-level local seismicity –Gas or steam fumaroles, and/or light tephra emissions –These manifestations may cause acidification of meteoric rain, and light tephra falls on towns surrounding the volcano. Some of them may pose a slight threat to air traffic	–Check availability of staff, equipment and vehicles required for evacuations. –Ask the SC to define criteria limiting access to the volcano –Issue warnings to the aircraft controllers.
Phase 2 VEI ≤ 2	–Low to intermediate eruptive activity –Moderate explosions ejecting debris around the crater. –The explosions may eject tephra and produce light to moderate tephra falls on nearby towns, and farther cities if the wind is strong. –The tephra in the air may pose a threat to aircraft. –Low-level pyroclastic flows and mudflows (lahars) may develop without reaching populated areas.	–Keep shifts of emergency staff. –Increase the restricted access area around the volcano according to the recommendations of the SC. –Issue warnings to the air navigation systems –Anticipate a possible evacuation
Phase 3 VEI 2–3	–Phreatic or magmatic eruptive activity of intermediate to high explosivity –Growth of lava domes, increased probability of magma ejection. –Possibility of explosions of increasing intensity ejecting hot debris to significant distances (several kilometres). –Conspicuous tephra fall on towns and cities.	–Prepare staff and equipment for shelter operation. –Implement specific measures in most vulnerable areas. –Start preventive measures against tephra and debris falls and lahars in highly vulnerable areas. (this may include some evacuations).
Red: Alarm
Phase 1 VEI 3–4	–Possibility of more massive pyroclastic flows and lahars, not reaching populated areas. –Increased risk to aircraft and light effects on airports. –Intermediate to large explosive eruptions producing eruptive columns capable of reaching the stratosphere –The explosions may eject considerable amounts of tephra and fragments reaching the nearest towns –Production of large-scale pyroclastic flows and mudflows capable of reaching nearest towns and beyond –Important tephra falls in towns at intermediate distances capable of producing roof collapses. Significant tephra falls in large cities around the volcano –Serious threat to aircraft over large distances. Serious effects on airports	–Increase of restricted area around the volcano –Alert all systems of air traffic and navigation. –Selective evacuations according to criteria of the SC defined by the development and intensity of the eruption –Inform and promote about auto-evacuations in selected areas –Implement specific preventive measures against tephra and fragment falls in the regions near the volcano defined by the SC –Implement specific preventive measures against pyroclastic flows, surges and lahars in the regions defined by the SC –Implement preventive measures against moderate to intermediate tephra falls in metropolitan areas of proximal large cities –Implement emergency plans to protect and maintain communication lines and water and food supply –Nation-wide and international warnings to all aircraft and airports
Phase 2 VEI > 4	–Large to an extreme eruption –Production of very large-scale volcanic clouds to the stratosphere. –Possibility of massive sector collapse of the volcano producing extensive debris avalanches –Massive pyroclastic flows –Massive lahars reaching distances beyond the extent of the Hazards Map –Devastation of the regions defined in the Hazard Map –Intense tephra falls, and fragment fall on metropolitan areas in cities within a radius exceeding 100 km –Maximum threat to all aircraft nation and continent-wide –Serious threat to airports nation-wide	–Extensive evacuations according to criteria of the SC defined by the evolution and intensity of the eruption –Inform and promote about voluntary evacuations over extended areas defined by the SC –Implement specific preventive measures against intense tephra and fragment falls in the regions defined by the SC –Implement specific preventive measures against massive debris flows, pyroclastic flows, surges and lahars in regions defined by the SC –Implement preventive measures against intermediate to large tephra and fragment falls in metropolitan areas of proximal large cities, including anti-panic measures for the total blockage of sunlight

) is a simplified tool designed for providing real-time information about volcanic activity [4]. The system works permanently and classifies the level of the volcanic activity in three different colours with intermediate phases: green (two phases), yellow (three phases) and red (two phases). The current state of this alert system depends on real-time monitoring information and the decisions of a scientific committee (SC) and the National System of Civil Protection («Sistema Nacional de Protección Civil–SINAPROC»). Each one of the phases has defined thresholds and a series of activities to be carried out, including evacuations. One of the most important objectives of the system is to alert people to potential disaster scenarios while they are still in the early stages of development and to prompt them to prepare in case of a need for evacuation.

It becomes pertinent to recall that the actions recommended to SINAPROC do not necessarily have a chronological correlation to the actions observed by the population. In fact, analyses such as the one provided by Gregg, Houghton and Ewert [19], point numerous circumstances that may represent relevant differences from the expected and the observed actions towards determined warning systems. For instance, it is expectable that the people in the volcano’s surroundings are aware of an emergent situation even before the official announcements are given. This situation may be preceded by the reading of some precursor activities that may be the signal of further activity. In consequence, it is expected to have some proactive procedures in terms of protection, even reaching anticipated voluntary evacuations. This proactive awareness is supported by various channels for sharing information (namely, related to portable devices). Furthermore, the official communications may experiment with a certain delay against some physical evidence of activity, since expert judgements face some uncertainties and administrative obstacles. However, the proactive actions towards the early manifestations of activity are conditioned for social, cognitive, political and cultural factors. Hence, a warning model that observes all those considerations would be more reliable for assessing the expected scenarios—i.e., a warning system that considers people as active actors instead of passive. It would be significative to analyse the grade of acceptability of risk, since it also guides the likelihood of taking actions as a function of the availability and investment of resources.

For this example, only the cross-referencing of information on hazards, exposure, occurrence likelihood and VEI level will help to identify which hazards are likely to be more critical for compromising the evacuation of the village when the level of volcanic activity arises up to red colour in the VTLAS system.

2.2. Exposure

The exposure is scored by resorting to a dedicated application in the National Atlas of Risks [20]. Since there is not a unique zone codification criterion (mostly because the analysed hazards have different interactions with the environmental conditions), the adopted criterion to rank exposure is based on the computation of the total number of zones in each hazard map (x) and on the relative zone in which San Pedro Tlalmimilulpan is located (y). Values for y are counted from the most external zone up to the most central one. Thus, it is possible to have a y/x ratio in which the worst scenario is y = x and has a value of 1. For example, the map corresponding to pyroclastic flows (Figure 1) is graded in four levels identified by colours (x = 4). San Pedro Tlalmimilulpan is located in the most external ring (y = 1). Then, exposure is 1/4.

The situation of the village has been considered as a point, situated in front of the government building («ayudantía municipal»). However, during the cartographic analysis, it was observed that there is no conflict for having more than one ring covering the village’s surface.

Table 2. Relative exposure by hazard.

Hazard	Relative Exposure of San Pedro Tlalmimilulpan y/x	Qualitative Probability of Occurrence According to Hazard Cartography [10]
Tephra	0.67	High
Projectiles	0.00	None
Pyroclastic density currents	0.25	Minor
Lahar or mudflows	0.25	Minor
Lava flows	0.00	None
Debris avalanches	The village is located in the ‘exposed’ territory. However, avalanches are events with a relatively small probability of occurrence in the context of all considered phenomena. Value has been set to y/x = 1.

summarises the obtained values for exposure by hazard.

2.3. Probability of Occurrence

Although the behaviour of volcanoes is not easily describable in standardised terms, the existence of the volcanic explosivity index (VEI) provides a useful scale for contextualising a set of phenomena associated with volcanic activity [21]. This framework is handy for illustrating magnitude-dependent scenarios and their probability of occurrence.

In the particular case of Popocatépetl Volcano, the rate of occurrence of events with a determined VEI value present a good fitting to a logarithmic function (Equation (1)), as proposed by De la Cruz-Reyna et al. [4], based on historical records and prehistoric evidence.

$$log{\lambda }_i=\alpha VE{I}_i+c$$

(1)

This equation is reliable for representing the mean rate of occurrence ${\lambda }_i$ (event/year) for a determined VEI value in the particular case of Popocatépetl volcano when $\alpha$ = −0.530 and $c=-0.524$. De la Cruz-Reyna also considers that Popocatépetl Volcano may present events up to a VEI value of 6, with a 0.5% probability of occurrence in a 20-year window.

Based on the VTLAS qualitative descriptions [4], the most catastrophic scenario corresponds to red phase 2, associated with VEI magnitudes 5 and 6. Events corresponding to red phase 1 are equivalent to grades of 3 and 4 in the VEI index. Finally, yellow events, phase 3, correspond to grades 2 and 3 in the VEI index (

Table 3. Volcanic explosivity index. Based on Pyle (2015) [22] compared to the occurrence rates for Popocatépetl (De la Cruz-Reyna et al. [4]) and the correspondence with the VTLAS system.

VEI Index	Bulk Tephra Volume	Plume Column Height	Qualitative Description	Stratospheric Injection	Mean Occurrence Rate (er/yr)	Probability of Occurrence within Any 20-Year Interval	Corresponding VTLAS Colour
2	<107 m3	1–5 km	Explosive	None	13/500	0.410	Yellow (2)
3	<108 m3	3–15 km		Possible	3/500	0.113	Yellow (2, 3) Red (1)
4	<109 m3	10–25 km	Cataclysmic Paroxysmic	Certain	2/1000	0.039	Red (1)
5	<1010 m3	>25 km		Certain	10/15,000	0.013	Red (2)
6	<1011 m3	>25 km		Certain	10/40,000	0.005	Red (2)

).

2.4. Exposure-Based Risk Assessment

According to the online hazard maps of Popocatépetl, San Pedro Tlalmimilulpan is not exposed to all of the volcanic hazards. In fact, it is outside of the expected area of impact for projectiles and debris avalanches. According to the VTLAS system, the remaining four were scored according to the qualitative description used according to each colour-related scenario, as explained by De la Cruz-Reyna et al., 2008 [4]. For instance, tephra is expected to occur even from a yellow phase 1 scenario, as a light emission in the surroundings. Still, the volume and distance of ejection increase in each level, and words such as moderate and intense are used. In

Table 4. Summary of correspondence between VTLAS grade, probability of occurrence, exposure and hazard description for San Pedro Tlalmimilulpan.

VTLAS Colour and Phase	Probability of Occurrence within a 20-Year Interval	Tephra Exposure: 0.67	Pyroclastic Density Exposure: 0.25	Lahars or Mudflows Exposure: 0.25	Debris Avalanches Exposed
Yellow (1)	>0.410	Light emissions	-	-	-
Yellow (2)	≈0.410	Light to moderate	Low-level, without reaching populated areas.		Around the crater
Yellow (3) Evacuations may start	≈0.410	Conspicuous ashfall on towns and cities	Larger pyroclastic flows and lahars not reaching populated areas		-
Red (1) Selective evacuations	0.113–0.410	Important ashfalls capable of producing roof collapses	Large-scale flows, capable of reaching nearest towns and beyond		-
Red (2) Extensive evacuations	<0.113	Intense ashfalls within a radius exceeding 100 km	Massive pyroclastic flows and lahars reaching distances beyond the extend of the Hazards Map		Extensive debris avalanches

, the hazards are identified and gradually scored according to first mention in the description of the VTLAS system.

As shown in the summary table, Table 4, San Pedro Tlalmimilulpan would be especially sensitive to problems derived from the tephra emission, even before reaching the level of a generalised evacuation. It is expected that a level of activity that leads to evacuation would be preceded by a relevant presence of tephra in San Pedro Tlalmimilulpan. Then, it becomes pertinent to carry out the failure mode and effect analysis focused on the events that may compromise the functions of the system in the context of an intense ashfall, namely, when the VTLAS grade reaches an emergency level in which evacuation is mandatory.

2.5. Failure Mode and Effect Analysis

The failure mode and effect analysis is based on the characterisation of the system under analysis through its main components, identifying for each one of them a description, function, interactions, performance requirements, potential failure modes, root causes, effects, means or methods of detection and mitigation measures. The final goal is to frame a whole view of the system and its vulnerabilities. The system considered is the village of San Pedro Tlalmimilulpan, composed by its roads network, vehicles, public address (PA) system, shelters, electrical and water supply; see Figure 2.

For this analysis, we used data provided by the National Institute for Statistics and Geography though their Geographic Information System databases: the Digital Map of México (Mapa Digital de México [23]) and the Space and Data (Espacio y Datos [24]), respectively available on the sites http://gaia.inegi.org.mx and https://www.inegi.org.mx/app/mapa/espacioydatos/default.aspx.

(a)

Roads

Description: Only roads able to be used by motorised vehicles are considered.

Function: To connect San Pedro Tlalmimilulpan with the nearest villages as part of the evacuation route, by permitting the transit of motorised vehicles.

Interactions: With vehicles and constructions that may interrupt circulation if they collapse.

Performance requirement: To be free of debris and other materials or objects that may be dangerous for vehicular operation.

Potential failure modes: Existence of debris from collapsed constructions, presence of thick tephra layers on the roads.

Root causes: Collapse of constructions due to tephra accumulation (overload) or post-fire collapse.

Effects:

(Direct) Reduction of traffic flow capacity on the whole route.

(Intermediate) Slower evacuation and/or transport of supplies.

(End) Disruption of evacuation activities.

Means or methods of detection: Periodic routine checks of structural safety of constructions, volcanic monitoring / real-time following of the current colour code of the alert system.

Control/mitigation measures: First contact brigades with proper equipment for urgent works in case of the presence of obstacles (such as tephra or debris).

Additional measures and means: Potential debris presence mapping and tephra distribution patterns.

(b)

Vehicles

Description: Due to the lack of public vehicles in the settlement (namely public transport or municipal property vehicles), private vehicles are considered as being the main means for evacuation.

Function: To safely transport people from San Pedro Tlalmimilulpan to the place that authorities designate as safe, depending on the scientific committee and SINAPROC instructions.

Interaction: With roads and provisional shelters.

Performance requirement: Gas supply, driver availability.

Potential failure modes: Lack of gas, mechanical breakdown because of infiltration of ash.

Root causes: Leakage or robbery, poor mechanical condition.

Effects:

(Direct) Reduction of transportation capacity; people are in a vulnerable position with no help.

(Intermediate) Slower evacuation and/or transport of supplies, damages for health due to tephra.

(End) Disruption of evacuation activities, several fatalities may occur in a long period of time.

Means or methods of detection: Periodic checking of gas reserves, maintenance plans for vehicles. To have a census of vehicles of inhabitants and build social plans for organisation and cooperation in case of an emergency, maximising the benefits of the vehicle stock.

Control/mitigation measures: Emergency gas supply and emergency plan taking into account the use of private vehicles.

Additional measures and means: Technical inspections of vehicles.

(c)

PA and Radio Diffusion services

Description: A very relevant aspect for this case study is the existence of a Public Address (PA) system based on loudspeakers that is frequently used for emitting messages to be heard in the village and its surroundings. This PA system is located at the civil government building and is commonly used for communicating schedules for services, announcements, public interest information, and for communicating the current state of the VTLAS system, along with providing instructions in case of an emergency.

Function: To establish communication from authorities to citizens in order to follow adequate strategies before, during and after evacuation.

Interaction: With roads, vehicles, shelters, houses and electricity supply.

Performance requirement: Operator, electric supply, information flow from local authorities.

Potential failure modes: Lack of electricity, radio diffusion interference.

Root causes: Failure of the backup generator. Particles suspended in the air (telecommunication networks are sensible to attenuation and reduction of signal strength due to tephra [25]).

Effects:

(Direct) Lack of information about the current state of emergency, continuous reduction of electronic communications effectiveness.

(Intermediate) Uncoordinated evacuation actions.

(End) Misfunction of evacuation activities.

Means or methods of detection: Permanent routine check with test messages.

Control/mitigation measures: Existence of backup batteries/power plant.

Additional measures and means: Duplication of some components in case of failure (redundancy), such as loudspeakers, amplifiers, etc. Presence of a visual sign for communicating an emergency. For instance, siren lights.

(d)

Provisional shelters

Description: Existing constructions that, due to their spatial and structural characteristics, are labelled as safe places to use during an emergency situation. These places help to focus the supplies to be distributed among people, and provide first medical care.

Function: To provide a safe place for people to stay in case evacuation is interrupted or slowed down due to the insufficient capacity of vehicles. Shelters are also a resource when environmental conditions may compromise the safety of the houses—for instance, the risk of collapses due to the accumulation of ash in the roofs.

Interaction: With roads; water and electricity supply.

Performance requirement: Food, clean water, beds and medical material for an established period and a capacity according to the census.

Potential failure modes: Overpopulation.

Root causes: Lack of a realistic provision of the number of residents of the village.

Effects:

(Direct) The capacity of the shelter is insufficient.

(Intermediate) Progressive degradation of habitable conditions.

(End) People are put on sanitary risk.

Means or methods of detection: To organise drills or simulations in which the recreation of a contingency plan may expose potential failures.

Control/mitigation measures: Existence of local emergency evacuation plans.

Additional measures and means: Permanent census of population and vehicles.

(e)

Electrical emergency supply

Description: This system considers the infrastructure that makes possible the distribution of electric energy to the village when the municipal infrastructure (namely wires, transformers, substations, etc.) is unable. The emergency electrical supply is based on mobile petrol power plants.

Function: Maintain the use of telecommunication and light networks during and after an evacuation.

Interaction: With shelters and telecommunications.

Performance requirement: Backup electric plants (diesel, petrol).

Potential failure modes: Insufficient gas supply, mechanical breakdown on power plants.

Root causes: Insufficient gas reserve, lack of proper maintenance.

Effects:

(Direct) Reduction of services up to a minimum.

(Intermediate) Difficulties sustaining electricity-dependent services and devices.

(End) Lack of communications and lights.

Means or methods of detection: Routine check of the reserve of gas on the emergency power plant and programmed test and maintenance of devices.

Control/mitigation measures: Emergency gas reservoir tank. Parallel backup system.

Additional measures and means: Basic battery backup for minimum services.

(f)

Clean water supply

Description: Water stored in reservoirs and tanks that is regularly used for human consumption.

Function: To sustain basic hygienical and consumption activities.

Interaction: With shelters.

Performance requirement: Adequately isolated water sources (i.e., wells and deposits).

Potential failure modes: Contamination due to tephra. Wilson et al. [25] point out that water quality may be compromised by ash due to soluble components that contaminate it.

Root causes: Inadequately isolated containers.

Effects:

(Direct) Reduction of the temporal window in which shelters can handle a certain population.

(Intermediate) Progressive degradation of habitable conditions.

(End) Relevant sanitary risk.

Means or methods of detection: Routine monitoring of water quality and storage conditions.

Control/mitigation measures: Water treatment systems.

Additional measures and means: Creation of a distributed system with isolated cells for water reservoirs.

The analysis permits us to highlight the pre-eminent relevance of an early emergency alert system. It may drastically reduce failures in intermediate stages of the emergency management, mostly because a significant number of identified root causes are related to a delay in which suspension of tephra may produce adverse effects in most of the analysed components. This time-dependency suggests that the most sensitive aspect that needs to be enhanced is the quick response to a determined evacuation instruction. If evacuation activities are developed fast enough, the risk of failure of the whole system is minimised.

In the context of a quick response, telecommunication and PA services are present all over the evacuation activities, which makes it particularly strategic during an emergency. Roads and transition stages (i.e., the time needed to bring people from a safe shelter to a safe place out of the village) are crucial because they are exposed to several hazards. Temporary shelters must provide safe and adequate conditions (including proper supplies) during the stay of a certain number of people. If this critical population is exceeded, there is a failure during the emergency stage. Finally, potential collapses or the presence of debris in the roads is still an issue that may be analysed in order to have appropriate contingency plans. Once again, the important time-dependency of these situations accentuate the relevance of an early-stage communication strategy and a quick response.

2.6. Failure and Event Tree Analysis

Based on the previous analysis, a preliminary failure tree is proposed (Figure 3). This schematic representation of the multiple facts that can contribute for the failure of the system considers several paths that would compromise the success of the only two options considered for people, once an evacuation has been declared: to be in the course of evacuation or to be sheltered. As shown in the Failure Tree and according to the previous analysis, the insufficient electrical supply would compromise most of the failure paths. Nevertheless, some other critical situations would lead to failures, such as exceeding the capacity of shelters, water contamination or inoperability of the roads. None of these situations must be neglected.

In order to analyse the potential scenarios for which the outcome would be the failure of one or more elements, a proper event tree analysis has been carried out (Figure 4). This logic tree approach considers several stages in which the failure or success of every stage implies subsequent scenarios. Although the description is purely qualitative, it permits us to clearly identify the consequences of having an unexpected performance in a determined stage of evacuation. As shown in the tree, the success and correct work of shelters, vehicles, roads and alert systems may permit a complete success of evacuation (

Table 5. Scenarios and success.

Scenario	People Advised	People Safety during the Procedure	Procedural Time	Success	Optimal Conditions
I	Optimal	Optimal	Optimal	Total	-All people have received advice during the first stages of evacuation. -All people have a place in a vehicle or a shelter during evacuation. -Procedural time is limited to one trip.
II	Optimal	Optimal	Non-optimal	Total
III	Optimal	Non-optimal	Optimal	Total
IV	Optimal	Non-optimal	Non-optimal	Partial
V	Non-optimal	Optimal	Optimal	Partial
VI	Non-optimal	Optimal	Non-optimal	Partial
VII	Non-optimal	Non-optimal	Optimal	Partial
VIII	Non-optimal	Non-optimal	Non-optimal	Partial

).

If there is no awareness in the whole population in the earlier stages of an emergency, some people may be excluded from the evacuation activities. This situation is compatible with the vulnerabilities assessed through the FMEA approaches. As shown in Table 5, the failure of the PA system immediately may lead to a partial success of evacuation due to this exclusion. In the other hand, the redundancy of options, considering vehicles and shelters, is essential for the complete success of evacuation. It is possible to accept that the number of vehicles is insufficient for moving all people at if shelters can guarantee safe conditions during the period of time needed to achieve full evacuation. Hence, it is possible to accept a total success if there is a limited capacity in shelters, but there is a sufficient capacity for evacuating all people at once.

Since the existing alert system (i.e., the PA system) is entirely dependent on electric supply and favourable environmental conditions (the noise of heavy rain or a storm can make it difficult to hear the messages from the loudspeakers).

To schematise and follow the situations that may result in partial alert and its potential consequences, a combined failure tree analysis and event tree analysis has been carried out (Figure 5) centred in a hypothetical emergency advice that does not reach all the people as a trigger event.

This joint tree permits us to summarise which the most expectable failure paths are that may lead to the selected failure (i.e., that the emergency advice is not received by all the people). If these failure paths are proactively avoided when possible (for instance, with regular maintenance or supervision programs), the expected failures would be less likely to occur. Furthermore, the event tree permits us to identify which sequences of events would have negative impacts on the outcomes. This is helpful in order to recognise which components are able to be enhanced or reinforced for guaranteeing the most successful scenario in the case of evacuation.

3. Conclusions

The presented results and conclusions are based on generalised simplifications that, if further explored and enriched, could result in more complex and accurate analysis. A detailed characterisation of each component analysed herein in subcomponents (e.g., consider specific types of roads instead of a general component for roads) may permit one to enhance the resolution of the analysis substantially. The opinions and contributions that domain-based experts may provide in each one of the stages that compose the whole analysis can also be integrated into the present workflow, permitting one to define more accurate conclusions and results.

The identification of the effects that a certain volcanic event may have in a determined settlement as a function of its localisation may provide a valuable basis for the design of specific emergency plans, such as evacuation planning. At present, the efforts to minimise the negative impacts that Popocatépetl activity may have in human settlements have produced valuable documents, namely, hazard cartographies, a colour-based alert system, etc. When these documents are analysed together with the volcanic explosivity index, it becomes possible to qualitatively anticipate a range of likely hazards in a determined period of time.

However, it is important to keep in mind that volcano warning systems may be limited in their scenarios and critical paths if they do not take into account the proactive actions that the people would begin even before the arrival of official instructions or warnings, namely, as a reaction to the physical manifestations of volcanic activity.

The analysis presented in this paper revealed that, because of its localisation, San Pedro Tlalmimilulpan can face various effects related to tephra emissions, even in the earliest stages of a potential evacuation. Furthermore, this situation aimed to analyse how the presence of tephra would compromise the system in the context of evacuation.

The system has been analysed by using the FMEA methodology, starting from its components and focusing on how the most likely hazards would impact them during an evacuation procedure. The conclusions of this analysis allowed us to identify the components that are more sensitive to the presence of tephra, and consequently, more likely to fail during this kind of event.

The components that were identified as relevant for evacuation purposes and sensitive to the presence of tephra were selected for carrying out a failure tree analysis, considering that the success is the complete safety of people during the evacuation process. This tree helped to reinforce and delimit which paths of events may easily lead to failure, namely, due to failures in the availability of vehicles, proper conditions on the shelters and problems associated with the emergency PA system.

In order to assess how the success or failure of those components would configure different scenarios as output, an event tree analysis was developed. It revealed that the failure in the PA services might immediately lead to non-successful scenarios, while the failure associated with the availability of vehicles or the shelters would not fully compromise the success of the evacuation if any of the two components has a correct performance.

Finally, and based on this cumulative knowledge, a joint failure/event tree was created by taking the failure of the PA system as a trigger event. This schematisation summarises many of the partial conclusions drawn throughout the present work, such as some of the most likely failures during a volcanic event, the critical roles that some components would have during an evacuation and the partial events that can circumvent the failure paths. This kind of schematisation would be useful as a basis for developing emergency plans and for the early and proactive localisation of present weaknesses that can be solved to minimise the adverse effects that volcanic activity may have in a determined settlement.