Towards a Semi-Quantitative Approach for Assessing Evacuation Scenarios in the Context of Popocat é petl Volcano, M é xico—The Case of San Pedro Tlalmimilulpan

: Volcanic exposure implies multiple hazards for human settlements. The identiﬁcation of the potential hazards that volcanic activity can entail is a challenge requiring assessing the speciﬁc situations that a determined place would face. Popocat é petl, a volcano in the centre of M é xico, represents a signiﬁcant hazard source, and it is located within a densely populated region with more than 20 million people. Despite the existence of a colour-based volcano alert level system for the current activity of the volcano, it is relevant to assess which local scenarios are more likely depending on numerous variables, namely, related to the distance from the volcano. A semi-quantitative analysis was carried out based on existing hazard maps and considering the probability of occurrence of volcanic explosivity, taking the settlement of San Pedro Tlalmimilulpan as a case study. This analysis led to a hierarchised rank of hazards, providing a basis for analysing multiple scenarios through failure mode and event analysis, failure tree analysis and event tree analysis. This process facilitates the contextualisation of the multiple challenges and potential chains of events that emergency actions, namely, emergency evacuations, would face. The analysis of the critical paths can help to identify critical aspects that could hinder the post-event response.


Introduction
The Popocatépetl volcano is a stratovolcano located ca. 60 km away from México City, in the territorial limits of the states of México, Puebla and Morelos. It has a maximum height of 5500 m above mean sea level. It has been active in the last few decades and has forced the evacuation of the surrounding settlements during some intense periods of activity. The last large-scale evacuation occurred in December 2000, including all settlements within a radius of 13 km from the main crater and even some remoter villages, resulting in more than 41,000 displaced people [1]. Evacuation planning was relevant from the organisational point of view, leading to the design and implementation of communicational strategies for advising people in case of imminent hazardous activity [2].
San Pedro Tlalmimilulpan is one of the numerous settlements located in the surroundings of the Popocatépetl volcano. The village is located in the municipality of Tetela del Volcán, Morelos, ca. 16 km from Popocatépetl. The recent 2019 official census counted a total population of 1637 inhabitants, with a mean growth of 6.78% from 2005 to 2019. There was an illiteracy rate of 8.12% and a mean schooling rate of 6.29 years. About 34% of the population had indigenous origins, and 28.38% of the people over 12 years old was considered economically active. There were 479 houses and a ratio of motorised vehicles of 11.82% per home, meaning around 57 private vehicles [3].
One of the most critical conditions of the village is the lack of a local evacuation plan in case of an emergency. Even though volcanic activity is continuously monitored, and there is GeoHazards 2021, 2 2 a permanent alert system, a successful evacuation is constrained by the road networks, and the availability of vehicles and infrastructure that must be locally analysed and assessed. A standardised early warning system (EWS) based on a colour-code was developed to make the current state of the threat public. This EWS, commonly named the Volcan Traffic Light Alert («Semáforo de Alerta Volcánica») [4] permits one to synthesise the information that is useful for the people to be prepared against potential eruptive scenarios. This system has been continuously calibrated and enhanced based on relevant events since 1995 [4], when volcanic activity became regular after a long pause.

Materials and Methods
The relevance of a local-scale approach for human settlements lies in the decision making for evacuation routes, calculation of shelter capacities, estimation of procedural times during an emergency and design of suitable alert systems [5]. This paper proposes a semi-quantitative assessment for identifying the most critical hazards in order to put them in a standardised hierarchical risk framework.
Early terminology for risk in the context of volcanic events has been provided by Fournier d'Albe [6]. This proposal considers that risk may be defined by the relation [risk=(value)·(vulnerability)·(hazard)], where risk is a possibility of a loss, value is the number of entities at stake (human lives, capital value or productive capacity) and vulnerability is the proportion of the value that is likely to be lost as a consequence of a determined event.
In the volcanic context, hazard is the probability of a determined entity being affected by a volcanic event in a determined period of time.
The existent literature and maps are valuable sources for establishing local hazard scenarios based on exposure and probability of occurrence. The assessment of exposure to a specific hazard permits identifying which situation may reasonably affect San Pedro Tlalmimilulpan as a function of its geographic location. It is essential to recall that the unchaining of phenomena is related to the magnitude of the volcanic eruption. Hence, it becomes relevant to review the existing alert system (VTLAS), the volcanic explosivity index (VEI) level and the associated volcanic phenomena that would affect the selected settlement and the expected recurrence of the VEI levels.
This paper presents an analysis divided into three main phases. The first one is devoted to the introduction of some relevant concepts and current-use tools and approaches, namely, the volcanic traffic light alert system (VTLAS), the existing risk mapping and the set of phenomena that are hazardous in the context of Popocatépetl. In a second stage, this information is cross-compared to be presented in a comprehensive framework that permits one to contextualise the set of hazards at the geographic location of San Pedro Tlalmimilulpan, focused on their impacts on evacuating the settlement. Finally, this identification provides the basis for carrying out a failure mode and effect analysis [7] in which the settlement is described in terms of its components and the potential failures they can present during a volcanic event. The identification of those failures will permit one to feed failure and event tree analysis for identifying failure paths and systemic weaknesses during an evacuation.

Volcanic Phenomena, Hazard Maps and the Volcanic Traffic Light Alert System (VTLAS)
In 1995, the National Autonomous University of México developed hazard maps for Popocatépetl, according to models based on monitoring-stations records [8]. These maps were updated in 2019 [9,10], comprising six specific volcanic phenomena: tephra dispersion, ballistic projectiles, pyroclastic flows, lahars, avalanches and lava flows, as detailed in the following: Tephra. Light particles (most of them are lightweight components of magma), expelled by fumaroles through the craters. This is one of the most common events and happens several times per year. The dispersion patterns are highly dependent on dominant winds and climatological conditions. Tephra can stay suspended in the air for long periods of time in favourable weather conditions. The severity of tephra depends on deposit accumulation and exposure time. Tephra can be a relevant health threat. This phenomenon is also widely known as ashfall, but tephra is a preferable term that is also common in specialised literature-refer, for instance, to Bonadonna et al., 2015 [11].
Projectiles (ballistic bombs and blocks). Fragments of rock with diameters from 6.4 mm up to several meters that are thrown by explosions at the crater. The distance that projectiles can reach depends on the magnitude of the eruption. Fitzgerald et al. (2017) [12] points that projectiles are a relevant thread to life and infrastructure and took the case of Popocatépetl as an example of the creation of scenarios for creating risk maps.
Pyroclastic density currents. A turbulent and violent flow composed of a mixture of rocks at a high temperature (700 • C), tephra and gas with speeds up to 200 km/h. This term encompasses pyroclastic flows and pyroclastic surges, as defined by Brown and Andrews [13].
Lahar or mudflows. Indonesian term for describing a rapidly flowing, gravity-driven mixture of rock, debris and water from a volcano. Its behaviour is dependent on the time and distance, as defined by Vallance and Iverson [14]. A combination of tephra fall and water coming from rain, ice or a lake may trigger lahars even once the eruption is over.
Debris avalanches. A failure of portions of the volcanic edifice resulting from the increased pressure in the inner part of the volcano. The structure becomes unstable and collapses.
Lava flows. Harris and Rowland [15] define active lava as a mixture of molten rock (liquid), crystals (solids), gas (bubbles) and other voids that are ejected onto the ground.
This list of phenomena focuses on the singular characteristics of Popocatépetl. A detailed list of general volcanic phenomena and relevant parameters by hazard can be found in Jenkins et al. (2014) [16] and in the Encyclopaedia of Volcanoes [17]. Each volcanic phenomenon has a dedicated hazard assessment, with different likelihoods, depending on the volcanic scenario. There are maps available online [18] that permit extracting more detailed and complementary data and indicators, such as the municipal social vulnerability index.
It is important to recall that this set of hazards excludes some other manifestations that are hazardous for human settlements and are also triggered by volcanic activity, such as earthquakes. In fact, seismic activity may become a serious hazard for vulnerable settlements and constructions, which can be severely damaged. Besides, seismic actions may trigger cascading events, such as landslides. These phenomena should thus be considered in order to get an understanding of the full chain of events that can be triggered.
The current state of volcanic activity is ranked with a colour system, and it is possible to consult it by phone or internet. The colour-based code («Semáforo de Alerta Volcánica») ( Table 1) is a simplified tool designed for providing real-time information about volcanic activity [4]. The system works permanently and classifies the level of the volcanic activity in three different colours with intermediate phases: green (two phases), yellow (three phases) and red (two phases). The current state of this alert system depends on real-time monitoring information and the decisions of a scientific committee (SC) and the National System of Civil Protection («Sistema Nacional de Protección Civil-SINAPROC»). Each one of the phases has defined thresholds and a series of activities to be carried out, including evacuations. One of the most important objectives of the system is to alert people to potential disaster scenarios while they are still in the early stages of development and to prompt them to prepare in case of a need for evacuation.  It becomes pertinent to recall that the actions recommended to SINAPROC do not necessarily have a chronological correlation to the actions observed by the population. In fact, analyses such as the one provided by Gregg, Houghton and Ewert [19], point numerous circumstances that may represent relevant differences from the expected and the observed actions towards determined warning systems. For instance, it is expectable that the people in the volcano's surroundings are aware of an emergent situation even before the official announcements are given. This situation may be preceded by the reading of some precursor activities that may be the signal of further activity. In consequence, it is expected to have some proactive procedures in terms of protection, even reaching anticipated voluntary evacuations. This proactive awareness is supported by various channels for sharing information (namely, related to portable devices). Furthermore, the official communications may experiment with a certain delay against some physical evidence of activity, since expert judgements face some uncertainties and administrative obstacles. However, the proactive actions towards the early manifestations of activity are conditioned for social, cognitive, political and cultural factors. Hence, a warning model that observes all those considerations would be more reliable for assessing the expected scenarios-i.e., a warning system that considers people as active actors instead of passive. It would be significative to analyse the grade of acceptability of risk, since it also guides the likelihood of taking actions as a function of the availability and investment of resources.
For this example, only the cross-referencing of information on hazards, exposure, occurrence likelihood and VEI level will help to identify which hazards are likely to be more critical for compromising the evacuation of the village when the level of volcanic activity arises up to red colour in the VTLAS system.

Exposure
The exposure is scored by resorting to a dedicated application in the National Atlas of Risks [20]. Since there is not a unique zone codification criterion (mostly because the analysed hazards have different interactions with the environmental conditions), the adopted criterion to rank exposure is based on the computation of the total number of zones in each hazard map (x) and on the relative zone in which San Pedro Tlalmimilulpan is located (y). Values for y are counted from the most external zone up to the most central one. Thus, it is possible to have a y/x ratio in which the worst scenario is y = x and has a value of 1. For example, the map corresponding to pyroclastic flows ( Figure 1) is graded in four levels identified by colours (x = 4). San Pedro Tlalmimilulpan is located in the most external ring (y = 1). Then, exposure is 1/4.
The situation of the village has been considered as a point, situated in front of the government building («ayudantía municipal»). However, during the cartographic analysis, it was observed that there is no conflict for having more than one ring covering the village's surface.  The situation of the village has been considered as a point, situated in front of the government building («ayudantía municipal»). However, during the cartographic analysis, it was observed that there is no conflict for having more than one ring covering the village's surface. Table 2 summarises the obtained values for exposure by hazard. The village is located in the 'exposed' territory. However, avalanches are events with a relatively small probability of occurrence in the context of all considered phenomena. Value has been set to y/x = 1.

Probability of Occurrence
Although the behaviour of volcanoes is not easily describable in standardised terms, the existence of the volcanic explosivity index (VEI) provides a useful scale for contextualising a set of phenomena associated with volcanic activity [21]. This framework is handy for illustrating magnitude-dependent scenarios and their probability of occurrence.
In the particular case of Popocatépetl Volcano, the rate of occurrence of events with a determined VEI value present a good fitting to a logarithmic function (Equation (1)), as proposed by De la Cruz-Reyna et al. [4], based on historical records and prehistoric evidence.

=
(1) This equation is reliable for representing the mean rate of occurrence (event/year) for a determined VEI value in the particular case of Popocatépetl volcano when = −0.530  [20], with all hazard maps, is available at the site http://www.atlasnacionalderiesgos.gob.mx/apps/Popocatépetl/. The village is located in the 'exposed' territory. However, avalanches are events with a relatively small probability of occurrence in the context of all considered phenomena. Value has been set to y/x = 1.

Probability of Occurrence
Although the behaviour of volcanoes is not easily describable in standardised terms, the existence of the volcanic explosivity index (VEI) provides a useful scale for contextualising a set of phenomena associated with volcanic activity [21]. This framework is handy for illustrating magnitude-dependent scenarios and their probability of occurrence.
In the particular case of Popocatépetl Volcano, the rate of occurrence of events with a determined VEI value present a good fitting to a logarithmic function (Equation (1)), as proposed by De la Cruz-Reyna et al. [4], based on historical records and prehistoric evidence.
This equation is reliable for representing the mean rate of occurrence λ i (event/year) for a determined VEI value in the particular case of Popocatépetl volcano when α = −0.530 and c = −0.524. De la Cruz-Reyna also considers that Popocatépetl Volcano may present events up to a VEI value of 6, with a 0.5% probability of occurrence in a 20-year window.
Based on the VTLAS qualitative descriptions [4], the most catastrophic scenario corresponds to red phase 2, associated with VEI magnitudes 5 and 6. Events corresponding to red phase 1 are equivalent to grades of 3 and 4 in the VEI index. Finally, yellow events, phase 3, correspond to grades 2 and 3 in the VEI index (Table 3).

Exposure-Based Risk Assessment
According to the online hazard maps of Popocatépetl, San Pedro Tlalmimilulpan is not exposed to all of the volcanic hazards. In fact, it is outside of the expected area of impact for projectiles and debris avalanches. According to the VTLAS system, the remaining four were scored according to the qualitative description used according to each colour-related scenario, as explained by De la Cruz-Reyna et al., 2008 [4]. For instance, tephra is expected to occur even from a yellow phase 1 scenario, as a light emission in the surroundings. Still, the volume and distance of ejection increase in each level, and words such as moderate and intense are used. In Table 4, the hazards are identified and gradually scored according to first mention in the description of the VTLAS system.
As shown in the summary table, Table 4, San Pedro Tlalmimilulpan would be especially sensitive to problems derived from the tephra emission, even before reaching the level of a generalised evacuation. It is expected that a level of activity that leads to evacuation would be preceded by a relevant presence of tephra in San Pedro Tlalmimilulpan. Then, it becomes pertinent to carry out the failure mode and effect analysis focused on the events that may compromise the functions of the system in the context of an intense ashfall, namely, when the VTLAS grade reaches an emergency level in which evacuation is mandatory.

Failure Mode and Effect Analysis
The failure mode and effect analysis is based on the characterisation of the system under analysis through its main components, identifying for each one of them a description, function, interactions, performance requirements, potential failure modes, root causes, effects, means or methods of detection and mitigation measures. The final goal is to frame a whole view of the system and its vulnerabilities. The system considered is the village of

Failure Mode and Effect Analysis
The failure mode and effect analysis is based on the characterisation of the system under analysis through its main components, identifying for each one of them a description, function, interactions, performance requirements, potential failure modes, root causes, effects, means or methods of detection and mitigation measures. The final goal is to frame a whole view of the system and its vulnerabilities. The system considered is the village of San Pedro Tlalmimilulpan, composed by its roads network, vehicles, public address (PA) system, shelters, electrical and water supply; see Figure 2. Interactions: With vehicles and constructions that may interrupt circulation if they collapse.
Performance requirement: To be free of debris and other materials or objects that may be dangerous for vehicular operation.
Potential failure modes: Existence of debris from collapsed constructions, presence of thick tephra layers on the roads. Interactions: With vehicles and constructions that may interrupt circulation if they collapse. Performance requirement: To be free of debris and other materials or objects that may be dangerous for vehicular operation.
Potential failure modes: Existence of debris from collapsed constructions, presence of thick tephra layers on the roads.
Root causes: Collapse of constructions due to tephra accumulation (overload) or post-fire collapse.
Effects: (Direct) Reduction of traffic flow capacity on the whole route.
(Intermediate) Slower evacuation and/or transport of supplies.
(End) Disruption of evacuation activities.
Means or methods of detection: Periodic routine checks of structural safety of constructions, volcanic monitoring / real-time following of the current colour code of the alert system. Control/mitigation measures: First contact brigades with proper equipment for urgent works in case of the presence of obstacles (such as tephra or debris).
Additional measures and means: Potential debris presence mapping and tephra distribution patterns.

(b) Vehicles
Description: Due to the lack of public vehicles in the settlement (namely public transport or municipal property vehicles), private vehicles are considered as being the main means for evacuation.
Function: To safely transport people from San Pedro Tlalmimilulpan to the place that authorities designate as safe, depending on the scientific committee and SINAPROC instructions.
Interaction: With roads and provisional shelters. Performance requirement: Gas supply, driver availability. Potential failure modes: Lack of gas, mechanical breakdown because of infiltration of ash.
Root causes: Leakage or robbery, poor mechanical condition. Effects: (Direct) Reduction of transportation capacity; people are in a vulnerable position with no help.
(Intermediate) Slower evacuation and/or transport of supplies, damages for health due to tephra.
(End) Disruption of evacuation activities, several fatalities may occur in a long period of time.
Means or methods of detection: Periodic checking of gas reserves, maintenance plans for vehicles. To have a census of vehicles of inhabitants and build social plans for organisation and cooperation in case of an emergency, maximising the benefits of the vehicle stock.
Control/mitigation measures: Emergency gas supply and emergency plan taking into account the use of private vehicles.
Additional measures and means: Technical inspections of vehicles.
(c) PA and Radio Diffusion services Description: A very relevant aspect for this case study is the existence of a Public Address (PA) system based on loudspeakers that is frequently used for emitting messages to be heard in the village and its surroundings. This PA system is located at the civil government building and is commonly used for communicating schedules for services, announcements, public interest information, and for communicating the current state of the VTLAS system, along with providing instructions in case of an emergency.
Function: To establish communication from authorities to citizens in order to follow adequate strategies before, during and after evacuation.
Interaction: With roads, vehicles, shelters, houses and electricity supply. Performance requirement: Operator, electric supply, information flow from local authorities. Potential failure modes: Lack of electricity, radio diffusion interference. Root causes: Failure of the backup generator. Particles suspended in the air (telecommunication networks are sensible to attenuation and reduction of signal strength due to tephra [25] Description: Existing constructions that, due to their spatial and structural characteristics, are labelled as safe places to use during an emergency situation. These places help to focus the supplies to be distributed among people, and provide first medical care.
Function: To provide a safe place for people to stay in case evacuation is interrupted or slowed down due to the insufficient capacity of vehicles. Shelters are also a resource when environmental conditions may compromise the safety of the houses-for instance, the risk of collapses due to the accumulation of ash in the roofs.
Interaction: With roads; water and electricity supply. (f) Clean water supply Description: Water stored in reservoirs and tanks that is regularly used for human consumption. Function: To sustain basic hygienical and consumption activities.
Interaction: With shelters. Performance requirement: Adequately isolated water sources (i.e., wells and deposits). Potential failure modes: Contamination due to tephra. Wilson et al. [25] point out that water quality may be compromised by ash due to soluble components that contaminate it.
Effects: (Direct) Reduction of the temporal window in which shelters can handle a certain population.
(Intermediate) Progressive degradation of habitable conditions. (End) Relevant sanitary risk. Means or methods of detection: Routine monitoring of water quality and storage conditions. Control/mitigation measures: Water treatment systems. Additional measures and means: Creation of a distributed system with isolated cells for water reservoirs.
The analysis permits us to highlight the pre-eminent relevance of an early emergency alert system. It may drastically reduce failures in intermediate stages of the emergency management, mostly because a significant number of identified root causes are related to a delay in which suspension of tephra may produce adverse effects in most of the analysed components. This time-dependency suggests that the most sensitive aspect that needs to be enhanced is the quick response to a determined evacuation instruction. If evacuation activities are developed fast enough, the risk of failure of the whole system is minimised.
In the context of a quick response, telecommunication and PA services are present all over the evacuation activities, which makes it particularly strategic during an emergency. Roads and transition stages (i.e., the time needed to bring people from a safe shelter to a safe place out of the village) are crucial because they are exposed to several hazards. Temporary shelters must provide safe and adequate conditions (including proper supplies) during the stay of a certain number of people. If this critical population is exceeded, there is a failure during the emergency stage. Finally, potential collapses or the presence of debris in the roads is still an issue that may be analysed in order to have appropriate contingency plans. Once again, the important time-dependency of these situations accentuate the relevance of an early-stage communication strategy and a quick response.

Failure and Event Tree Analysis
Based on the previous analysis, a preliminary failure tree is proposed (Figure 3). This schematic representation of the multiple facts that can contribute for the failure of the system considers several paths that would compromise the success of the only two options considered for people, once an evacuation has been declared: to be in the course of evacuation or to be sheltered. As shown in the Failure Tree and according to the previous analysis, the insufficient electrical supply would compromise most of the failure paths. Nevertheless, some other critical situations would lead to failures, such as exceeding the capacity of shelters, water contamination or inoperability of the roads. None of these situations must be neglected.
In order to analyse the potential scenarios for which the outcome would be the failure of one or more elements, a proper event tree analysis has been carried out ( Figure 4). This logic tree approach considers several stages in which the failure or success of every stage implies subsequent scenarios. Although the description is purely qualitative, it permits us to clearly identify the consequences of having an unexpected performance in a determined stage of evacuation. As shown in the tree, the success and correct work of shelters, vehicles, roads and alert systems may permit a complete success of evacuation (Table 5). GeoHazards 2021, 2, x FOR PEER REVIEW 12 of 16 In order to analyse the potential scenarios for which the outcome would be the failure of one or more elements, a proper event tree analysis has been carried out (Figure 4). This logic tree approach considers several stages in which the failure or success of every stage implies subsequent scenarios. Although the description is purely qualitative, it permits us to clearly identify the consequences of having an unexpected performance in a determined stage of evacuation. As shown in the tree, the success and correct work of shelters, vehicles, roads and alert systems may permit a complete success of evacuation (Table 5).  If there is no awareness in the whole population in the earlier stages of an emergency, some people may be excluded from the evacuation activities. This situation is compatible with the vulnerabilities assessed through the FMEA approaches. As shown in Table 5, the failure of the PA system immediately may lead to a partial success of evacuation due to this exclusion. In the other hand, the redundancy of options, considering vehicles and  If there is no awareness in the whole population in the earlier stages of an emergency, some people may be excluded from the evacuation activities. This situation is compatible with the vulnerabilities assessed through the FMEA approaches. As shown in Table 5, the failure of the PA system immediately may lead to a partial success of evacuation due to this exclusion. In the other hand, the redundancy of options, considering vehicles and shelters, is essential for the complete success of evacuation. It is possible to accept that the number of vehicles is insufficient for moving all people at if shelters can guarantee safe conditions during the period of time needed to achieve full evacuation. Hence, it is possible to accept a total success if there is a limited capacity in shelters, but there is a sufficient capacity for evacuating all people at once.
Since the existing alert system (i.e., the PA system) is entirely dependent on electric supply and favourable environmental conditions (the noise of heavy rain or a storm can make it difficult to hear the messages from the loudspeakers).
To schematise and follow the situations that may result in partial alert and its potential consequences, a combined failure tree analysis and event tree analysis has been carried out ( Figure 5) centred in a hypothetical emergency advice that does not reach all the people as a trigger event. shelters, is essential for the complete success of evacuation. It is possible to accept that the number of vehicles is insufficient for moving all people at if shelters can guarantee safe conditions during the period of time needed to achieve full evacuation. Hence, it is possible to accept a total success if there is a limited capacity in shelters, but there is a sufficient capacity for evacuating all people at once. Since the existing alert system (i.e., the PA system) is entirely dependent on electric supply and favourable environmental conditions (the noise of heavy rain or a storm can make it difficult to hear the messages from the loudspeakers).
To schematise and follow the situations that may result in partial alert and its potential consequences, a combined failure tree analysis and event tree analysis has been carried out ( Figure 5) centred in a hypothetical emergency advice that does not reach all the people as a trigger event. This joint tree permits us to summarise which the most expectable failure paths are that may lead to the selected failure (i.e., that the emergency advice is not received by all the people). If these failure paths are proactively avoided when possible (for instance, with regular maintenance or supervision programs), the expected failures would be less likely to occur. Furthermore, the event tree permits us to identify which sequences of events would have negative impacts on the outcomes. This is helpful in order to recognise which components are able to be enhanced or reinforced for guaranteeing the most successful scenario in the case of evacuation.

Conclusions
The presented results and conclusions are based on generalised simplifications that, if further explored and enriched, could result in more complex and accurate analysis. A detailed characterisation of each component analysed herein in subcomponents (e.g., consider specific types of roads instead of a general component for roads) may permit one to enhance the resolution of the analysis substantially. The opinions and contributions that This joint tree permits us to summarise which the most expectable failure paths are that may lead to the selected failure (i.e., that the emergency advice is not received by all the people). If these failure paths are proactively avoided when possible (for instance, with regular maintenance or supervision programs), the expected failures would be less likely to occur. Furthermore, the event tree permits us to identify which sequences of events would have negative impacts on the outcomes. This is helpful in order to recognise which components are able to be enhanced or reinforced for guaranteeing the most successful scenario in the case of evacuation.

Conclusions
The presented results and conclusions are based on generalised simplifications that, if further explored and enriched, could result in more complex and accurate analysis. A detailed characterisation of each component analysed herein in subcomponents (e.g., consider specific types of roads instead of a general component for roads) may permit one to enhance the resolution of the analysis substantially. The opinions and contributions that domain-based experts may provide in each one of the stages that compose the whole analysis can also be integrated into the present workflow, permitting one to define more accurate conclusions and results.
The identification of the effects that a certain volcanic event may have in a determined settlement as a function of its localisation may provide a valuable basis for the design of specific emergency plans, such as evacuation planning. At present, the efforts to minimise the negative impacts that Popocatépetl activity may have in human settlements have produced valuable documents, namely, hazard cartographies, a colour-based alert system, etc. When these documents are analysed together with the volcanic explosivity index, it becomes possible to qualitatively anticipate a range of likely hazards in a determined period of time.
However, it is important to keep in mind that volcano warning systems may be limited in their scenarios and critical paths if they do not take into account the proactive actions that the people would begin even before the arrival of official instructions or warnings, namely, as a reaction to the physical manifestations of volcanic activity.
The analysis presented in this paper revealed that, because of its localisation, San Pedro Tlalmimilulpan can face various effects related to tephra emissions, even in the earliest stages of a potential evacuation. Furthermore, this situation aimed to analyse how the presence of tephra would compromise the system in the context of evacuation.
The system has been analysed by using the FMEA methodology, starting from its components and focusing on how the most likely hazards would impact them during an evacuation procedure. The conclusions of this analysis allowed us to identify the components that are more sensitive to the presence of tephra, and consequently, more likely to fail during this kind of event.
The components that were identified as relevant for evacuation purposes and sensitive to the presence of tephra were selected for carrying out a failure tree analysis, considering that the success is the complete safety of people during the evacuation process. This tree helped to reinforce and delimit which paths of events may easily lead to failure, namely, due to failures in the availability of vehicles, proper conditions on the shelters and problems associated with the emergency PA system.
In order to assess how the success or failure of those components would configure different scenarios as output, an event tree analysis was developed. It revealed that the failure in the PA services might immediately lead to non-successful scenarios, while the failure associated with the availability of vehicles or the shelters would not fully compromise the success of the evacuation if any of the two components has a correct performance.
Finally, and based on this cumulative knowledge, a joint failure/event tree was created by taking the failure of the PA system as a trigger event. This schematisation summarises many of the partial conclusions drawn throughout the present work, such as some of the most likely failures during a volcanic event, the critical roles that some components would have during an evacuation and the partial events that can circumvent the failure paths. This kind of schematisation would be useful as a basis for developing emergency plans and for the early and proactive localisation of present weaknesses that can be solved to minimise the adverse effects that volcanic activity may have in a determined settlement.

Data Availability Statement:
The data presented in this study are available on request from the corresponding author.