Evaluating life-safety risk for fieldwork on active volcanoes: the volcano life risk estimator (VoLREst), a volcano observatory’s decision-support tool

Abstract

When is it safe, or at least, not unreasonably risky, to undertake fieldwork on active volcanoes? Volcano observatories must balance the safety of staff against the value of collecting field data and/or manual instrument installation, maintenance, and repair. At times of volcanic unrest this can present a particular dilemma, as both the value of fieldwork (which might help save lives or prevent unnecessary evacuation) and the risk to staff in the field may be high. Despite the increasing coverage and scope of remote monitoring methods, in-person fieldwork is still required for comprehensive volcano monitoring, and can be particularly valuable at times of volcanic unrest. A volcano observatory has a moral and legal duty to minimise occupational risk for its staff, but must do this in a way that balances against this its duty to provide the best possible information in support of difficult decisions on community safety.

To assist with consistent and objective decision-making regarding whether to undertake fieldwork on active volcanoes, we present the Volcano Life Risk Estimator (VoLREst). We developed VoLREst to quantitatively evaluate life-safety risk to GNS Science staff undertaking fieldwork on volcanoes in unrest where the primary concerns are volcanic hazards from an eruption with no useful short-term precursory activity that would indicate an imminent eruption. The hazards considered are ballistics, pyroclastic density currents, and near-vent processes. VoLREst quantifies the likelihood of exposure to volcanic hazards at various distances from the vent for small, moderate, or large eruptions. This, combined with the estimate of the chance of a fatality given exposure to a volcanic hazard, provides VoLREst’s final output: quantification of the hourly risk of a fatality for an individual at various distances from the volcanic vent.

At GNS Science, the calculated levels of life-safety risk trigger different levels of managerial approval required to undertake fieldwork. Although an element of risk will always be present when conducting fieldwork on potentially active volcanoes, this is a first step towards providing objective and reproducible guidance for go/no go decisions for access to undertake volcano monitoring.

Introduction

Volcano observatories face a challenge: balancing the need to monitor volcanoes to the best of their ability to provide adequate information and advice to crisis management officials and/or the public with the need to keep observatory staff safe whilst collecting time critical data. Even in this era of increased remote monitoring capabilities, such as real-time data telemetry of ground instrumentation and satellite imagery, there remains a need for fieldwork near or on active volcanoes (note: in this paper an ‘active’ volcano is in a state of detectable unrest or erupting). Volcano observatory staff regularly go to volcanoes to install and maintain instruments, collect samples that couldn’t otherwise be collected, conduct field surveys (both longitudinal and ad-hoc), and make observations that haven’t yet satisfactorily or economically been outsourced to instruments.

During periods of unrest there is generally a lot of uncertainty as to what is happening at a volcano. In these situations, a monitoring team may require more data collection to interpret what is likely to happen. However, an eruption is considerably more likely at a volcano in a state of unrest than at a volcano with no unrest indicators (e.g. Sparks, 2003), thus a volcano in unrest is arguably more dangerous to visit than a ‘quiet’ volcano. Unfortunately, even if a volcano is in detectable unrest, eruptions may occur with no useful precursory activity indicating an eruption is imminent.

Eruptions produce a suite of hazards that can rapidly kill people, including pyroclastic density currents (PDCs), ballistics, lahars, vent formation, and gases (Baxter, 1990; Auker et al., 2013; Baxter et al., 2017; Brown et al., 2017). Tragically, since 1893 CE at least 39 scientists have been killed by at least 16 different volcanic eruptions around the world (Brown et al., 2017). While not all of these scientists were actively monitoring the volcano on behalf of an observatory, these fatalities reflect the risk undertaken by those who visit volcanoes in unrest or eruption.

Over the past several decades, and especially the past several years, there has been increased legal scrutiny around fatalities that may have been deemed preventable. In the infamous L’Aquila earthquake case, officials, including scientists, were indicted and initially found guilty of involuntary manslaughter by misleading the public and providing inadequate and inconsistent advice concerning the risk of a large damaging earthquake (Alexander, 2014; see also Bretton et al., 2015). In New Zealand, the 2010 Pike River Mining disaster, which killed 29 miners, led to an overhaul of health and safety legislation with more liability given to company boards and senior executives (Macfie, 2013; see subsection New Zealand context). This increased legal scrutiny, along with a moral imperative to keep staff safe, is likely to result in conservative decision-making when volcano observatory managers are faced with difficult choices between the need to collect time-sensitive data critical for more accurate and precise interpretation of a volcano’s activity and the need to keep staff safe.

When is it ‘safe’, or, at least, not unreasonably risky, to go into the field to collect critical data that will assist decision-makers making decisions that could affect many people (e.g., closing a popular hiking track important for tourism, or large-scale evacuation of a population)? To be able to mitigate the risk to staff, there is a need to understand the levels of risk to which they are exposed. We therefore have developed a decision support tool for deciding when and where fieldwork can be undertaken as the activity of a volcano changes: the Volcano Life Risk Estimator (VoLREst). VoLREst outputs a quantitative estimate of the hourly risk of fatality at different distances from a vent area. VoLREst is available in a spreadsheet format (see Supplementary material) and can be tailored to any volcano. Development was prompted by a near-miss when several GNS Science staff members were at Te Maari vent a few minutes before it erupted with no useful precursory activity in November 2012 (Jolly et al., 2014). A health and safety investigation into the near-miss recommended implementing a rational, defendable, and quantitative life-safety risk assessment framework for staff undertaking fieldwork on active volcanoes, the result of which includes VoLREst. Refer to Jolly et al. (2014) for more information on the context in which VoLREst was developed along with its early application.

In this paper we provide a brief summary of fatal volcanic hazards, approaches to evaluating volcanic and life-safety risk, and the New Zealand context in which VoLREst was developed. We then go on to describe how VoLREst works and how it can be tailored to any volcano with explanations, tips, and suggested considerations. Finally, we summarise how VoLREst is applied at GNS Science, and provide known limitations.

Fatal volcanic hazards

Volcanic eruptions have killed at least 278,368 people since 1500 CE (Brown et al., 2017). Volcanoes produce a multitude of hazards that directly kill people (Baxter, 1990), and can lead to indirect consequences such as disease and/or starvation which can kill large numbers of people (Auker et al., 2013). Although there hasn’t been a systematic study establishing the likelihood of fatality given exposure to a volcanic hazard, historic examples point to the high fatality rate of PDCs (e.g., Zen and Hadikusumo, 1964; Baxter, 1990; Spence et al., 2007; Jenkins et al., 2013; Swanson et al., 2015), lahars (e.g., Zen and Hadikusumo, 1964; Voight, 1990), and ballistics (e.g., Baxter and Gresham, 1997; Yamaoka et al., 2016; Fitzgerald et al., 2017).

For our purposes, we are concerned about hazards without any useful warning that can lead to an immediate fatality. A recent review paper by Brown et al. (2017) considered who has been killed by volcanic eruptions since 1500 CE, what hazard killed them (including non-eruptive volcanic environmental hazards), and how far away they were from the vent. If we consider the 16 eruptions that have killed scientists since 1893 CE, ballistics were responsible in 7 eruptions (15 fatalities), PDCs in 3 eruptions (8 fatalities), lava flows in 1 eruption (1 fatality), and multiple hazards (lahars, PDCs) in 2 eruptions (2 fatalities); 4 eruptions (13 fatalities) had no designated lethal hazard. Thus, PDCs and ballistics combined accounted for 23 out of 26 (just under 90%) of the fatalities to scientists that can be attributed to a specific hazard. Moreover, hazards such as lava flows and lahars are to a substantial degree avoidable by informed staff, whereas ballistics and PDCs are much more difficult to avoid. If we consider the entire fatalities database (irrespective of who was killed), within 5 km of the vent, ballistics and PDCs combined account for over half of the number of fatal incidents and half of all fatalities (Brown et al., 2017). PDCs and ballistics are thus considered the main source of risk to staff, and are the two volcanic hazards we focus on for our life-safety risk evaluation.

Evaluating volcanic and life-safety risk

Risk is generally considered a probabilistic function of hazard, exposure, and consequence (Fournier d’Albe, 1979). In the case of life-safety risk, this includes the probability of the hazard occurring, and the probability of fatality given exposure to the hazard.

Event trees are widely used in evaluating volcanic hazard and risk (e.g., Newhall and Hoblitt 2002; Meloy, 2006; Marzocchi and Woo 2009; Sobradelo and Marti, 2010; Selva et al., 2012; Ogburn et al., 2016; Wright et al., 2013). Event trees provide a linear framework for understanding how a situation may unfold, and are useful for exploring comparative probabilities of different possible outcomes. We refer the reader to Newhall and Hoblitt (2002) for an overview of event trees. We used a modified event tree approach here – modified to preclude double counting fatal injuries, as one can only die once, but an eruption can produce multiple concurrent hazards, all of which may be fatal.

There are a variety of metrics available to quantify life-safety risk (e.g., Health & Safety Executive (HSE) 2001), including:

• Annual individual fatality risk: likelihood of death of a particular individual in a year.

• Likelihood of someone being killed: likelihood of death due to an event.

• Risk per experience: likelihood of death due to taking part in an event.

• Societal (multiple-fatality) risk: likelihood of a number of deaths due to an event (e.g., chance of 50 or more deaths if an eruption occurs).

Annual individual fatality risk (or fatal injury risk per full-time equivalent employee per year) is the most widely used metric for employee safety (e.g. HSE, 2001; WorkSafe New Zealand, 2017a). Figure 1 shows a comparison between annual individual fatality risk in different industries in New Zealand. Forestry and mining are at the upper end of the range, with annual risk of order 10^− 3 per year (we note that the mining statistics may have been distorted by the Pike River disaster in 2010). Several other industries involving substantial proportions of time working with heavy machinery in outdoor environments (e.g., agriculture, construction, utilities) experience annual individual risk of the order of 10^− 4 per year. Industries where the majority of staff are office-based typically experience individual risk levels of the order of 10^− 5 per year or well below.

Fig. 1

New Zealand workplace fatality rates per employee per year. The values come from all fatalities in the workplace, including non-workers, divided by the number of workers in the sector; as such this overstates the risk to the workers, but is still useful for comparative purposes. Fatality data comes WorkSafe New Zealand (2017b), and the data on the number of workers in each sector is from the New Zealand Ministry of Business, Innovation, and Employment (2017). Volcanologists are grouped under ‘Professional, scientific & technical’. After Taig and McSaveney (2014)

There is some guidance and precedent on what is an ‘acceptable’ annual fatality risk (e.g., HSE, 2001; Massey et al. 2014ab), with 10^− 4 widely adopted as an upper threshold of acceptable risk in work environments. Despite this, there is much debate about whether it is tolerable to accept activities with > 10^− 4 annual fatality risk for a short period of time, with views and practices ranging from ‘no particular limit on instantaneous/very short term risk’ to ‘don’t accept any risk rate greater than the annual fatality rate divided by the hours worked in a year’. The latter view, though initially sounding plausible, is inherently illogical as for any job the average risk through the year is going to involve periods of lower and higher risk. In addition, it takes no account of situations where actions involving particular risk to an employee may provide substantial benefits (such as saving lives) for others.

We note that individual risk per trip (experience) is a metric used operationally by the New Zealand Department of Conservation (government agency charged with conserving New Zealand’s natural and historic heritage, which includes managing national parks and public access to these areas). The Department of Conservation assigns different risk thresholds to different visitor groups (see Jolly et al., 2014): a person taking a short walk on a popular trail to a waterfall is assumed to have a lower level of acceptable risk than a person partaking in a mountaineering expedition in the middle of winter. Risk per experience is useful for considering one-off experiences, but does not account for accumulated exposure to risk. What is acceptable in terms of the risk for a tourist visiting a volcano might be quite different from that for their tour guide who visits the volcano every day for their livelihood. There is widespread recognition that what is an acceptable level of risk is strongly context dependent, ranging from virtually zero (for wanton acts which create risk for others with no benefit for society) through to a high level of acceptable risk with a very high probability of death (e.g., for a terminally ill patient offered a potentially life-saving treatment with a high risk of a fatal failure).

Among all the different contexts in which risk acceptability has been discussed, that of the fatality risk to employees in the workplace is particularly well researched and established in public policy making (e.g., HSE, 2001; WorkSafe New Zealand 2017a).

The first quantitative life-safety risk calculation in the volcanic context we are aware of is Newhall (1982), undertaken for workers entering the blast zone of the Mount St Helens eruption in the months and years after the 1980 eruption. In this calculation, the area on and around Mount St Helens was divided into a series of zones. Newhall (1982) first considered the probability of a hazard (e.g., PDC) occurring on a given day, and then the probability that this hazard would reach a given zone. A separate life-safety calculation was then done for residents without means of radio communication, and workers who spend a certain number of hours per year in the zone (8 h per day, 220 days per year) and have radio communication with the USGS and a way to evacuate. We note this assumes that mitigative actions reduce life-safety risk, which may not be the case for those working in the immediate vicinity of an active vent. The zone map developed by Newhall (1982) accounted for topographic influences, and changed over time as the activity evolved at the volcano (Newhall, 1984). Forestry workers successfully used the analysis of Newhall (1982) to argue that they should receive double the pay when entering the blast zone, as they were doubling the amount of risk they were exposed to (Newhall, personal communication 2016).

We comment that regardless of the level of risk an employee is exposed to, risks to employees must always be within tolerable limits and employers and employees need to work to lower them further. It is not acceptable to pay people to induce them to accept higher risks.

New Zealand context

New Zealand has over a dozen volcanoes known to have erupted in the Holocene (Global Volcanism Program, 2013). New Zealand volcanoes feature a diversity of volcano types¹ (calderas, complex volcanoes, lava domes, pyroclastic cones, shield volcanoes, stratovolcanoes, submarine volcanoes, volcanic fields), eruption sizes (Volcano Explosivity Index (VEI) 0 through 8), eruption styles, and volcanic hazards (Global Volcanism Program, 2013). New Zealand volcanoes are monitored by GNS Science through the GeoNet project (Miller and Jolly, 2014); GNS Science serves as New Zealand’s volcano observatory.

The past two decades (time of writing: July 2018) have been a relatively quiet period for New Zealand volcanoes – apart from one VEI 3¹ eruption at Whakaari/White Island, all eruptions have been VEI 2 or smaller. Two volcanoes (Ruapehu and Whakaari) have been in continuous unrest over this period. Although all New Zealand eruptions in the past 20 years (from Raoul, Ruapehu, Tongariro, and Whakaari) were proceeded by detectable (albeit often minor) unrest, the majority of these eruptions could be considered “blue sky” or “unheralded” eruptions due to the lack of useful precursory activity for short term eruption forecasting. Over this time there have also been periods of heightened unrest at these volcanoes with no resulting eruption, and periods of unrest at volcanoes with no eruptions. VoLREst has been developed in this context of unheralded eruptions with many instances of unrest leading to no eruptive activity.

In March 2006, an unheralded eruption at Raoul Island (VEI 0) tragically killed a Department of Conservation staff member (Christenson et al., 2007). In September 2007, an unheralded eruption at Ruapehu (VEI 1) cost a climber his leg from the knee down (Kilgour et al., 2010). In November 2012, an unheralded eruption at the Upper Te Maari vent of the Tongariro volcano (VEI 2) resulted in a near miss for four scientists, including three GNS Science staff members (Jolly et al., 2014). Fortuitous eruption timing (e.g., occurring during the night and/or the middle of winter) is a major reason why no other New Zealand eruption of the past 20 years resulted in injuries or fatalities.

Following the fatality at Raoul Island in 2006, GNS Science undertook a review of risks associated with volcano monitoring. In 2006, an internal qualitative evaluation considered non-eruptive environmental hazards (e.g., gas poisoning, hot unstable ground) and eruptive hazards associated with volcano monitoring for Raoul Island, Ruapehu, Tongariro complex, and Whakaari volcanoes, and provided recommendations for general risk reduction of monitoring operations. In 2007, early efforts towards risk quantification used simple generalisations to evaluate the hourly and corresponding annual risk of common monitoring tasks for Ruapehu volcano – the volcano with the best historical record at the time; these results were shared with the Department of Conservation. At this stage, the practice of evaluating hourly risk to inform decisions was adopted, in part because it is easier to ‘size’ monitoring tasks (e.g., sample collection, installing and maintaining instruments) in units of hours rather than years. The risk of fatality associated with volcano monitoring at Whakaari was also evaluated, this time with a more formal Bayesian event tree framework, the results of which were presented at an internal staff workshop. In early 2008, a risk evaluation for Raoul Island based on a similar framework was shared with the Department of Conservation. Importantly, these risk characterisation efforts relied solely on the historic record and did not consider the actual likelihood of an eruption at a particular time. Furthermore, prior to the development of VoLREst following the near miss during the November 2012 Te Maari eruption, there was no standard robust quantitative protocol for evaluating the hourly risk of fatality and applying the results to guide fieldwork decisions.

The New Zealand Health and Safety at Work Act (2015) legislates the requirements expected of employers, employees, contractors, and associates to ensure workplace health and safety. An important component of the act requires senior business leaders to understand and manage their company’s health and safety risks to be as low as is reasonably practicable. At GNS Science, this includes managing risks associated with undertaking fieldwork for monitoring purposes on volcanoes. This must be balanced against risk to the achievement of the organisation’s purpose, which includes a core objective to “Increase New Zealand’s resilience to natural hazards and reduce risk from earthquakes, volcanoes, landslides and tsunamis” (GNS Science, 2017).

Method

VoLREst is a decision-support tool we have developed to calculate the hourly risk of fatality at a given distance from an erupting vent (see Discussion subsection Application). Broadly speaking, we use a Bayesian Event Tree approach (e.g., Newhall and Hoblitt, 2002), although it is slightly modified to preclude double counting fatalities. See Fig. 2 for an overview of the methodology.

Fig. 2

Overview of VoLREst methodology

VoLREst evaluates the risk of fatality from a small, medium or large eruption (customised for each volcano), with no double-counting for either eruptions or hazard. We first determine the hourly probability of a small, medium, and large eruption assuming a binomial distribution (see Part A). Next, based on the vent location and pre-identified representative sites (see Part B), and the hazards of concern at each site (see Part C), we calculate the chance of surviving all the hazards at a given site, and from there, calculate the hourly risk of fatality at each site (see Part D). From there, we interpolate and extrapolate to determine the risk of fatality at any distance from the vent area (see Part E). At GNS Science, specific risk thresholds (i.e., 10^− 3, 10^− 4, or 10^− 5 hourly risk of fatality) trigger different levels of managerial sign-off required for approval to undertake fieldwork at the volcano (see Discussion subsection Application).

Parts A – E below should be read in parallel with Figs. 3, 4, 5, 6 and 7 and Tables 1 and 2. Figures 3, 4, 5 and 7 show different parts of VoLREst, populated with the values we used for the life-safety calculation undertaken for Whakaari in response to the April 2016 eruption. Table 1 defines all the variables used, while Table 2 lists the equations used with an explanation if required. We detail the procedure in a series of steps, which are labelled on relevant parts of Figs. 3, 4, 5 and 7. Cells that are shaded in dark grey need to be tailored for each volcano, and cells shaded in yellow need to be updated for each risk calculation. Discussion subsection Adaptability provides explanations and comments on the methodology along with suggestions on what to consider when implementing VoLREst.

Fig. 3

VoLREst close-up: inputting time window of interest and eruption likelihood. In yellow are cells the user must update at every use. The values populated in the yellow cells in this figure come from the application of VoLREst for Whakaari in response to the 28 April 2016 eruption. The labelled numbers correspond to the steps detailed in Part A of the text

Fig. 4

VoLREst close-up: hazard and exposure calculation. In grey are cells the user must tailor for each volcano. The values populated in the grey cells in this figure come from the VoLREst tailored for Whakaari from 2014 to the time of publication, while the eruption probabilities come from the application of VoLREst for Whakaari in response to the 28 April 2016 eruption. The labelled numbers correspond to the steps detailed in Parts B - D of the text

Fig. 5

VoLREst close-up: ballistic exposure calculation. In grey are cells the user must tailor for each volcano. The values populated in the grey cells in this figure come from the VoLREst tailored for Whakaari from 2014 to the time of publication, while the eruption probabilities come from the application of VoLREst for Whakaari in response to the 28 April 2016 eruption. The labelled numbers correspond to the steps detailed in Part D of the text

Fig. 6

Explanation of ballistic exposure calculation. a. Cartoon and equations for calculating likelihood of an impact from one ballistic falling from directly above (travelling perpendicular from the ground). b. Cartoon and equations for calculating likelihood of an impact from a ballistic coming from a side (travelling parallel to the ground). Refer to part D and Fig. 5

Fig. 7

VoLREst close-up: hourly risk vs distance plot. The values come from the application of VoLREst for Whakaari in response to the 28 April 2016 eruption

Table 1 Definition of variables used in equations used in VoLREst (see Table 2)

Table 2 Equations used in VoLREst

A clean version of VoLREst is available as a spreadsheet in the Additional file 1.

VoLREst risk calculation spreadsheet

Part a: Eruption likelihood

Refer to Fig. 3 to see how Steps 1–7 are implemented.

• 1. Decide time window of interest, using units of days or weeks.

• 2. Evaluate probability of at least one eruption of a specified size or greater within the specified time window at the volcano of interest (see Discussion subsection Determining the risk calculation time window and eruption likelihood).

• 3. Calculate the probability of no eruption of a specified size or greater within a specified time window at the volcano of interest (Eq. 1).

• 4. Calculate how many hours, h, are in the specified time window.

• 5. Calculate the hourly probability of no eruption over the course of the specified time window at the volcano of interest (Eq. 2).

• 6. Calculate the hourly probability of an eruption over the course of the specified time window at the volcano of interest (Eq. 3).

• 7. Determine the hourly probability of a large, moderate, and small eruption (Eqs. 4–6; see Table 3).

Table 3 Description of eruption sizes in VoLREst. What constitutes a large, moderate or small eruption is different at every volcano

Part B: Identify areas of interest

• 8. Identify vent area.

• 9. Select at least three sites at which to calculate likelihood of fatality.

Part C: Identify hazards of concern

• 10. VoLREst considers ballistics, pyroclastic density currents, and near-vent hazards (e.g., water spouts, landslides, shock/pressure waves, dense slugs). VoLREst could be modified to consider other hazards.

Part D: For each site, calculate the hourly risk of fatality

In Steps 11–24, we display a generic calculation; this calculation must be done for small, moderate, and large eruptions at each site. Refer to Figs. 4 and 5 to see how the calculation is implemented.

Near-vent hazards and PDCs (Fig. 4)

• 11. Determine the probability of exposure to specified hazard given an eruption.

• 12. Determine the probability of a fatality given exposure to specified hazard.

• 13. Calculate the probability of a fatality due to specified hazard given an eruption (Eq. 7).

• 14. Calculate the hourly probability of a fatality due to specified hazard (Eq. 8).

Ballistics (Figs. 4, 5 and 6)

• 15. Select the length of a reference area square. For ease, this is the same for all sites and eruption size combinations.

• 16. Calculate the area of the reference area.

• 17. Determine the representative ballistic diameter. This can be different for different size eruptions.

• 18. Determine the number of ballistics within a representative reference area. This is the same number as will cross the reference length.

• 19. Determine a representative diameter for a person.

• 20. Determine whether to select a ballistic direction from above, the side, or a geometric mean:

  • a. Direction ‘above’: a ballistic only falls from directly above, and is deemed fatal if it touches the person (Eq. 9, Fig. 6a).

  • b. Direction ‘side’: a ballistic only comes from the side, and is deemed fatal if it crosses the reference line in the same place the person is (Eq. 10, Fig. 6b).

  • c. Geometric mean: The geometric mean of the probabilities of impact from above and side directions.

• 21. Calculate the probability of an individual being hit by a single ballistic (Eqs. 9, 10).

• 22. Calculate the probability of an individual not being hit by the number of ballistics determined in Step 18 (Eq. 11).

• 23. Calculate the probability of a fatality from ballistics given an eruption (Eq. 12).

• 24. Calculate the hourly probability of fatality from ballistics (Eq. 8).

Combining risks

• 25. For each eruption size, calculate the hourly probability of surviving all hazards (Eq. 13).

• 26. For each eruption size, calculate the hourly probability of fatality (Eq. 14).

• 27. For each site, calculate the hourly risk of fatality (Eq. 15).

Part E: Evaluate risk at any distance from the vent

Refer to Fig. 7 to see how the calculation is implemented.

• 28. Plot the hourly risk of fatality vs distance for each site on a log-linear plot.

• 29. Calculate the best-fit line.

• 30. Use the equation of the line to determine what the distance is for a given hourly risk of fatality level.

Discussion

Adaptability

While we have described the life-safety risk calculation approach using New Zealand volcanoes as examples, the method can be applied to any volcano. However, VoLREst must be tailored to the volcano in question; indeed, at GNS Science we have separate VoLREst spreadsheets for each volcano that has been in unrest or had an eruption since 2012. To adapt VoLREst for a particular volcano, the user must follow these steps:

• 1. Identify the vent area of interest. This could be a point source or a polygon, e.g., the extent of a crater lake.

• 2. Select at least three sites at different distances from the vent where a chance of fatality given an eruption is possible in a large eruption, although preferably all three eruption sizes. These must be scaled for the volcano. Populate these distances in the spreadsheet.

• 3. Populate near-vent hazard and consequence cells:

  • a. [For each site and eruption size combination] Given an eruption, determine probability of exposure to near-vent hazards;

  • b. [For each site and eruption size combination] Given exposure, determine probability of fatality from near-vent processes.

• 4. Populate ballistic hazard and exposure cells:

  • a. [Same for all sites and eruption sizes] Choose the length of a square reference area (e.g., 30 m);

  • b. [Same for all sites and eruption sizes] Choose ‘diameter’ of a person;

  • c. [For each site and eruption size combination] Determine ballistic diameter;

  • d. [For each site and eruption size combination] Determine number of ballistics in reference area.

• 5. Populate PDC hazard and consequence cells:

  • a. [For each site and eruption size combination] Given an eruption, determine probability of exposure to near-vent hazards;

  • b. [For each site and eruption size combination] Given exposure, determine probability of fatality from near-vent processes.

Comments on each of these steps:

• Step 1: The vent area is treated as the eruption source, and can be either a point source or a polygon. At volcanoes with crater lakes we have used the entire crater lake extent as the vent area, despite there only being a few likely eruption sources within this area. The vent designation is one weakness of this approach, as if the next eruption is outside the designated area VoLREst is not particularly helpful.

• Step 2: We select at least three sites to avoid interpolating and extrapolating between just two points. The sites selected must be scaled for the volcano. For example, in the GNS Science VoLREst spreadsheets, for Whakaari the distances are 0, 100, 350, and 750 m, while at Ruapehu the distances are 0, 0.5, 1.3, and 2 km. We have found it helpful if these distances are known landmarks near the volcano – so for example at Whakaari, the distances correspond to a known observation point (100 m), a key fumarole (350 m), and the ruins of a factory on the island (750 m). The relatively short distances for Whakaari reflect the fact that the island is small and there isn’t much more land beyond “the factory”.

• Step 3: Near-vent hazards are meant to be localised to the vent area. It is helpful to specify what they are for the given volcano. For example, for New Zealand volcanoes these include water spouts (for volcanoes with crater lakes), landslides, shock/pressure waves, and dense slugs. In VoLREst the closest two sites have near-vent hazards. This may not be appropriate at all volcanoes; if near-vent hazards are not a concern for the second site, set the probability of exposure to 0 for all eruption sizes. In the GNS Science VoLREst spreadsheets, we have one volcano (Whakaari) were we have an ‘extra’ site at the vent (which is accessible, unlike some of our other volcanoes), and there for all eruption sizes we estimate that the chance of fatality equals the chance of an eruption. At this volcano, we consider near-vent hazards for the second distance.

• Step 4: At GNS Science, our standard ballistic reference area is 30 m × 30 m: we find this a large enough area to mostly have whole numbers for the estimated number of ballistics reaching the area, yet small enough to be tangible during discussions. We assume a person has a ‘diameter’ of 1 m. We have estimated ballistics hazard and exposure values using expert judgement; this does not preclude use of physical models to populate these values. In calculating the probability of a hit from above (Fig. 6a), VoLREst does not consider the impact crater area – which can be considerably larger than the source ballistic (e.g., Maeno et al., 2013; Breard et al., 2014; Fitzgerald et al., 2014) – or of debris or shrapnel resulting from the ballistic impact, which may cause fatal injuries (e.g., Fitzgerald et al., 2014; Williams et al., 2017). Thus, the ‘fatal area’ may be underestimated by VoLREst. VoLREst also does not consider impact angle – we highlight this as an area that could be improved in the future. Directionality of ballistics (e.g., Breard et al., 2014), where the ballistic hazard may not be radially symmetric around the vent, can be addressed through careful selection of the parameter estimating the number of ballistics in the reference area, depending on whether (for example) an average or a worst-case risk estimate is required. We note that if the user expands the range of ballistics sizes, the user will need to add additional blocks of rows (a single block is shown in Fig. 5) and update the cell-referencing in the VoLREst spreadsheet.

• Step 5: At GNS Science, we have estimated PDC hazard and consequence values using expert judgement; this does not preclude use of physical models to populate these values. Also, similar to ballistics, PDCs are not necessarily radially symmetric around the vent. For small eruptions, PDCs tend to follow topographic lows, and may have a strong directional component. Directionality can be addressed through careful selection of the parameter P (given eruption, exposure to surge). With regards to parameter P (given exposure, probability of fatality), at sites (particularly more distant ones) where PDC exposure would likely involve a distal portion of the flow, it may be appropriate to account for a slightly lower chance of fatality given exposure (e.g., Baxter et al., 2017). At GNS Science at some distal sites, we adopt a 95% probability of death given exposure to PDC.

Finally, VoLREst can also be adapted by adjusting the small/moderate/large eruption frequency. At GNS Science for Ruapehu volcano we have modified VoLREst to describe Scale 3, 4, and 5 eruptions (rather than small/moderate/large eruptions) following the designation developed in Scott (2013). For the Ruapehu adaptation of VoLREst, the distribution of Scale 3, 4, and 5 eruptions in Part A Step 7 is based on the eruptive record of Scott (2013).

Determining the risk calculation time window and eruption likelihood

Once VoLREst has been tailored for a specific volcano, there are two critical inputs to determine: the time window of the calculation, and the likelihood of an eruption within the time window. We briefly describe how these are determined at GNS Science; these are not meant to be prescriptive but rather illustrative.

At GNS Science, the default time window of a risk calculation is tied to the New Zealand Volcano Alert Level (VAL; Potter et al., 2014), although the default time window is often adjusted depending on volcanic activity. In short, no risk calculations are undertaken for volcanoes at VAL 0 (no volcanic unrest), the default time window for VAL 1 (minor volcanic unrest) is 13 weeks (approximately 3 months), the default time window for VAL 2 (moderate to heightened volcanic unrest) is 4 weeks, and the default time window for VAL 3 or greater (volcanic eruption) is 1 week. If there is a change in VAL a new risk calculation is undertaken, and any member of the monitoring team can call for a new risk calculation at any time. As an illustrative example, Table 4 provides the risk calculation schedule for Whakaari for 2016 along with the reason behind each risk calculation.

Table 4 Timing and duration of Whakaari VoLREst risk calculations in 2016

It is extremely difficult to accurately determine the likelihood of an eruption within a given time window. There are number of ways this could be evaluated, for example via expert judgement, probabilistic and/or physical models. At GNS Science this value is currently determined via an unweighted expert elicitation process. We describe the procedure for illustrative purposes below, and acknowledge there are many other ways the value could be determined.

At GNS Science, when a new risk calculation is called, members of the volcano monitoring team are asked over email to provide their best guess, minimum, and maximum likelihood estimates for an eruption impacting a specified area over the time window of interest. The reason for the elicitation is stated in this email (e.g., previous one expired, change in VAL, called by a team member), along with the deadline for providing values. Participants are also invited to provide their rationale. As an illustrative example, the wording of the question asked for elicitation associated with the 18 January 2016 Whakaari risk calculation was (no italics in original email; we note that an alternate name for Whakaari is White Island, which was used in this email):

We are due for White Island elicitation. Please get me your values by 4:30 pm today, or let me know prior to then if you need longer.

What is the probability of an eruption that would impact beyond the rim of the 1976–2000 crater complex within the next THIRTEEN WEEKS (~ 3 months; now - > 18 April 2016)? Please provide your best guess, min, and max.

You are encouraged to provide your rationale/thought process/reasoning/data used.

The moderator typically reminds participants where to find monitoring data and other relevant information for the given volcano – for example a record of past activity at the volcano, or recent presentations or publications that may enhance the participant’s conceptual understanding of the system.

At GNS Science, the identity of elicitation participants for a specific elicitation is known only by the risk calculation moderator. A quorum is obtained if there are at least 8 participants and at least one each from the fields of geochemistry, geophysics, and geology. We note this represents over half of the GNS Science volcano monitoring team. The number of participants is based on the observation (not statistically tested) of when a single expert’s contribution doesn’t greatly change the outcome of the exercise, and the second criterion is to ensure representation from all the disciplines.

At present, the eruption likelihood input into the risk calculation is the 84th percentile of the distribution of the min, best guess, and max values, with the best guess counted twice. The 84th percentile is used as it is one standard deviation from the mean, so this makes the risk calculation more conservative. Given that the data do not often follow a Gaussian distribution, and different team members have different interpretations as to what the minimum and maximum value actually means, there are problems with this methodology but at present it is our approach. The best guess is counted twice to increase the contribution of that expert assessment.

Translating between hourly and annual risk

While VoLREst is set up to evaluate hourly risk, it may be advantageous to evaluate staff safety on another time frame. We thus provide two translation tables, Tables 5 and 6.

Table 5 Equivalent risk of fatality given an hourly risk, assuming no other risks

Table 6 Given annual risk of fatality, equivalent duration at specified hour risk level

Table 5 begins with the hourly risk of fatality, and provides the corresponding risk of fatality over different time frames, assuming there are no other sources of fatal risk. We use the binomial distribution, and calculate 1 minus the chance of surviving over the time period of interest given the hourly risk of fatality:

$$ Equivalent\ risk=1-{\left(1- hourly\ risk\ of\ fatality\right)}^N $$

(16)

where N is the number of hours in the time period of interest. Table 5 reveals that if an individual is exposed to an hourly risk of 10^− 3 for every hour for an entire year, their annual risk of fatality is 99.8% (almost certain death), whereas if the same individual is exposed to an hourly risk of 10^− 5 for an entire work year (assuming a 48-week work year at 40 h per week), their risk of fatality is just under 2%.

Table 6 begins with an annual risk of fatality, and reveals how many hours of working at various hourly risk levels this would correspond to. This is likewise calculated using the same framework as in Eq. 16, but involves solving for the exponent:

$$ n=\frac{\ln \left(1- annual\kern0.17em risk\kern0.17em of\kern0.17em fatality\right)}{\ln \left(1- hourly\kern0.17em risk\kern0.17em of\kern0.17em fatality\right)} $$

(17)

where n is the number of hours at the hourly risk level. Table 6 reveals that an annual risk of fatality risk of 10^− 5 is ‘achieved’ in 36 s if an individual is exposed to an hourly risk of fatality of 10^− 3, while an annual risk of fatality risk of 10^− 3 is ‘achieved’ in 100 h if an individual is exposed to an hourly risk of fatality of 10^− 5.

Application

VoLREst is designed as a decision support tool to facilitate discussions about undertaking fieldwork on active volcanoes. While it is not meant to be prescriptive, at GNS Science it does heavily influence decisions, as a decision to send staff into the field when the calculated risk high will be hard to defend should an incident occur.

Table 7 shows how at GNS Science VoLREst results are used to support go/no go fieldwork decisions on active volcanoes. Since VoLREst implementation, challenging decisions have been made: certain data have not been collected due to the calculated level for risk, and/or staff have had to limit their time in certain areas, which led to less data being collected. In some instances, some staff would argue this has led to key perishable or time-sensitive data not being collected, limiting staff ability to interpret volcanic activity.

Table 7 Application of VoLREst results at GNS Science

What is GNS Science’s rationale behind Table 7?

The driving principles are as follows:

• 1. International guidance suggests an annual risk of fatality upper threshold around 10^− 4, and GNS Science would ideally like to work within that.

• 2. GNS Science recognises the high public value of monitoring, and in light of this is prepared, in exceptional cases and with the explicit consent of the staff involved, to exceed norms in other industries.

• 3. GNS Science staff must always be aware of the risks involved in their work and must never be pressured by management, colleagues, stakeholders, the public, or others into situations in which they’re uncomfortable with the risk.

• 4. Due to the at times conflicting nature of driving principles 1 and 2, GNS Science isn’t prepared always to leave decisions to the discretion of individual staff. In cases where proposed activity would be pushing staff outside other industry norms, GNS Science escalates the go/no-go decision to management.

• 5. VoLREst is the process by which GNS Science assesses risk every time staff are engaging in potentially hazardous field work on volcanoes.

• 6. Finally, the higher the risk above typical norms for other industries, the higher GNS Science escalates the go/no-go decision.

The following rationale went into setting the procedures detailed in Table 7:

• Over the course of a year staff engaged in intensive field work may spend up to 2 full work months in the field. Only a proportion of this will be spent on higher risk volcanoes, of which only a very small proportion will be spent in very high-risk areas. An estimate of 15 min per day, averaged over 40 working days per year, gives us a reasonable working estimate of 10 h per year spent at the highest levels of risk for active field staff generally.

• Staff involved with a specific volcano at a time of known high risk might spend two weeks per year on field work at the relevant site. With careful planning staff exposure to the highest levels of risk should in most cases be containable within 10 h per year, but it is possible that a single trip could involve 10 or more hours at high-risk levels.

• For hourly risk of fatality up to 10^− 5 (standard procedures): GNS Science and staff recognise that field volcanology is hazardous and GNS Science is prepared for staff, with their express consent, to expose themselves to risk up to this level subject to internal standard procedures for risk minimisation. Staff are unlikely to accumulate what could be considered as a year’s equivalent of acceptable risk (10^− 4) on a single trip as a result of exposure at these levels.

• For hourly risk of fatality between 10^− 4 and 10^− 5 (Head of Volcanology Department authorization): At these levels staff could be collecting up to or above what would be regarded a year’s acceptable risk in other industries on a single trip. There needs to be a significant benefit (beyond “I’m really interested” from the staff member in question) for GNS Science to accept this. There is often considerable discussion prior to authorisation to prioritise what is most critical and develop a detailed strategy to minimise time at this level of risk. GNS Science is not prepared to leave the decision solely to the staff members concerned and consider that the Head of Volcanology is the appropriate person to make a judgment about the value of the information at stake in relation to the risk staff would be accepting.

• For hourly risk of fatality between 10^− 3 and 10^− 4 (Head of Volcanology Department and Natural Hazards Divisional Director authorization): These are extremely high levels of exposure, with concerned staff likely to collect several times what would be acceptable per year in other industries on a single trip. Agreement to such work would be given only in exceptional circumstances. Examples might be retrieving data from a damaged station that would provide critical information on an eruption or collecting a single fumarole sample or efficiently collecting a rock/ash sample to inform on the presence of juvenile material. In these circumstances GNS Science escalates the go/no-go decision up beyond the volcanology department (where there is a long history of staff with a strong public service ethic prepared to subject themselves to significant risk to collect valuable information) and consider that the Natural Hazards Divisional Director is well placed to provide a judgment informed not only by the risk assessment and the volcanology department, but also by the balance between benefit and risk which is taken in other natural hazard areas.

• For hourly risk of fatality greater than 10^− 3 (no access): While at the time of writing no such risk levels have been estimated using VoLREst, GNS Science considers it appropriate to draw an upper “too risky” line at some point. Management have discussed this with GNS Science’s board of directors and collectively concluded that there are no circumstances in which GNS Science would be comfortable for staff (or contractors) to be exposing themselves to this level of risk. GNS Science would be prepared to reconsider this position in the event of a national or global crisis to which our staff could make a unique and vitally important contribution through activities involving exceptionally high personal risk exposure.

Figure 8 shows a sample map produced with VoLREst results (using the application illustrated in Figs. 3, 4, 5 and 7), used internally at GNS Science. Results to date are only used internally and at present are not used to support Civil Defence and Emergency Management, Department of Conservation, or concessionaires (e.g., tour guides, ski field operators) evacuation or access decisions. This has led to situations where the public has access to a volcanic area but GNS Science staff are not permitted to go; when this has happened GNS Science publicly stated that staff are not visiting the area (e.g., GeoNet, 2016). However, Department of Conservation staff and university researchers working with GNS Science staff have at times followed guidance provided by the assessments when making decisions about their own staff safety.

Fig. 8

Representative decision-support tool map produced with VoLREst results. The map is using the results of the VoLREst application Whakaari for 28 April 2016, done immediately after an eruption. Also shown as black dots are the locations of the representative sites for Whakaari, and white dots indicate select monitoring fumarole and lake sampling sites

Retrospective application

The motivation for VoLREst development was the near-miss during the November 2012 Te Maari eruption (see Introduction subsection New Zealand context and Jolly et al., 2014). Would VoLREst have prompted managerial sign-off for fieldwork near the vent at the time of the eruption?

At the time of the November 2012 eruption, ballistics were the only hazard concern for Te Maari (Jolly et al., 2014). Later investigations revealed there were PDCs in both the August and November 2012 eruptions (Lube et al., 2014), but in November 2012, PDCs were an under-appreciated hazard at Te Maari (Jolly et al., 2014). Based on the available historical record at the time (the historic record was later improved by Scott and Potter, 2014), the conceptual worst-case scenario was that the volcano was entering a decade of heightened activity similar to that between 1886 and 1897 CE. The corresponding worse-case eruption rate was estimated to be 0.27 eruption onsets per year (Jolly et al., 2014).

The above is based on the historic record; what did the experts think? In October 2012, a group of experts met to evaluate the probability of a similar eruption as in August 2012 and that of a larger eruption for the following 3-month period (comment: the November 2012 eruption was smaller than the August 2012 eruption), along with the size and concentration of ballistics at a specified distance from the vent for both eruption sizes.

Table 8 shows the VoLREst outputs if we use input values based on the known historic record at the time of the November 2012 eruption, with and without consideration of PDCs, using VoLREst hazard probability and characteristic values set in January 2014. We also show outputs using the eruption probability and ballistic characteristics resulting from the October 2012 expert elicitation workshop.

Table 8 Retrospective VoLREst analysis for Te Maari volcano, November 2012

The 10^− 4 threshold is not attained for any of these input combinations, although in all cases at the vent the hourly risk of fatality exceeds 10^− 5. If we compare the first two columns (three sites, three eruption sizes in the VoLREst spreadsheet), we can clearly see the effect of considering PDC exposure: the calculated hourly risk of a fatality at the vent is the same for both cases (as it equals the hourly probability of an eruption), but when PDCs are considered the 10^− 5 threshold almost doubles – the area exposed to an hourly risk of fatality of at least 10^− 5 is almost a factor of three greater.

The above retrospective analysis suggests that had VoLREst and associated policies been operational the morning of November 22 2012, the GNS Science Head of Volcanology department would have had to approve fieldwork plans at the vent considering the evaluated life-safety risk posed to staff.

Limitations

Apart from obvious limitations – the major ones being the subjectivity of the estimation of eruption likelihood, correctly identifying the vent area in advance of the eruption, the hazard footprint for different eruption sizes, and chance of fatality given exposure – there are several additional limitations associated with VoLREst. These include:

• VoLREst has been designed in a context where the primary concern is an unheralded eruption, i.e., there is little or no precursory activity suggesting an eruption is eminent. VoLREst assumes a constant probability of an eruption over the time period of interest. VoLREst is thus not appropriate when there is a rapidly changing situation where the chance of an eruption is escalating by the hour. If the situation is rapidly escalating, VoLREst is likely to underestimate the likelihood of a fatality given the lag time between when VoLREst is run and when the fieldwork is undertaken.

• We only consider the risk of fatality, not of injury. Injuries can have serious consequences for individuals and can take a very long time to recover from with a final reduction in quality of life. VoLREst is not appropriate for estimating casualties. Additionally, VoLREst is not explicitly designed for a situation where someone survives an eruption but requires urgent assistance and evacuation, necessitating others to put themselves at risk. If the primary concern is eruption casualties, consider solely calculating exposure risk, rather than including the step of accounting for likelihood of fatality given exposure (Step 12 in the Methods section). A conservative approach could include disregarding any consideration of directionality and assuming all hazards are radial in extent.

• We only consider individual fatality risk. For safety reasons, GNS Science discourages solo fieldwork, yet VoLREst only considers individual exposure. VoLREst is not currently setup to evaluate the risk of multiple fatalities, which may be valuable for organisational risk assessment purposes or for rescue operation planning. Our recommendation is to consider the number of people potentially exposed and find the balance between specific data importance, fieldwork safety, fieldwork efficiency, minimising the time an individual is potentially exposed, and minimising the number of people potentially exposed.

• VoLREst does not consider other risks related to fieldwork, which can include transportation via helicopter and/or driving, or working in alpine environments. This means the overall risk of fieldwork is higher than calculated – it is good practice to have protocols in place to minimise these additional risks (e.g., Table 4 ).

• We consider hourly risk of fatality, irrespective of the past or future exposure of an individual (i.e., ‘dosing’). Thus, VoLREst itself does not consider whether a scientist goes to the volcano every single day, or whether this is a one-off short visit. At GNS Science, these considerations form part of the discussion between managers and scientists when developing fieldwork plans. Considering cumulative risk could assist in assessing and managing overall exposure over a period of time, along with ensuring that fieldwork is done as efficiently as practical and that only truly critical data is collected when the risk is high.

• Different people and cultures have different levels of acceptable risk, which may change given a specific context. There may also be a conflict between scientists and managers, with one or the other advocating that specific data be collected to add to accuracy or precision of overall volcano behaviour interpretation; external pressures can exacerbate this conflict. Clear protocols can assist, along with a procedure for determining what data is critical, and transparency on how risks are assessed. Additionally, it is important to acknowledge that what works in one jurisdiction/context may not in another.

• There is no certain distance where one is certainly safe or a ‘safe’ risk threshold level. A holistic approach considering all risks and managing them when possible can minimise, although not eliminate, overall risk.

These limitations reinforced the GNS Science view that VoLREst is appropriate as a decision support tool, but not as a prescriptive measure.

Further considerations

VoLREst is designed considering the consequences of large, moderate, and small eruptions. An alternative approach could be to consider the consequences of the most likely, possible, and credible next eruption. This alternate approach might be more appropriate in a quickly evolving situation with multiple eruption phases, or at a volcano where it is not appropriate to think about small, moderate, and large eruptions. We explored this alternate approach when a previously quiet volcano (Ngauruhoe) exhibited minor signs of volcanic unrest for a few weeks, but found it challenging to describe these three categories. At present we have not further developed VoLREst in the framework of most likely, possible, and credible next eruption, which can be different from a small, moderate, large eruption likelihood distribution.

Finally, VoLREst outputs hourly risk of fatality, whilst many values in the health and safety literature reflect annual risk. We thus caution the user to be careful when using VoLREst to compare the risk volcanologists face to those faced by workers in other industries.

Conclusions

At the outset of this paper we posed some key questions. When is it too dangerous to undertake fieldwork on active volcanoes? What is the balance between keeping observatory staff safe and the necessity for staff to undertake critical data collection to better understand the state of a volcano? While we do not have simple black and white answers to these questions, our conclusions are that it is possible a) to make sensible reproducible quantitative estimates of risk to staff involved in field data collection on volcanoes at times of unrest, and b) to use such risk estimates to enable management to make better-informed ‘go/no-go’ decisions for fieldwork to proceed.

We have presented VoLREst, a decision-support tool developed at GNS Science to quantitively evaluate life-safety risk to staff undertaking fieldwork on volcanoes in unrest to assist with go/no-go decisions for fieldwork on active volcanoes. The driving concern is an eruption with no useful precursory activity, and we consider PDCs, ballistics, and near-vent hazards. VoLREst outputs a quantitative estimate of the hourly risk of a fatality as a function of distance from a volcanic vent.

At GNS Science, specific life-safety risk thresholds trigger different levels of managerial approval required to undertake work. Many scientists at GNS Science initially struggled with the concept of quantifying risk to staff and considering this explicitly in managerial go/no-go decisions, though with time this has become standard practice. Managers at GNS Science have found it very useful, as decisions are better supported, more transparent, and easier to explain to staff and other stakeholders. We recommend such an approach - thinking quantitatively about what the risks are and what is acceptable in particular context - to other organisations facing a similar dilemma in balancing the safety of their own staff and contractors against the wider public good of fulfilling their mission, when that mission involves risk to staff.

We stress VoLREst must be tailored for each volcano, and should not be used in a prescriptive manner. Although an element of risk will always be present when conducting fieldwork on potentially active volcanoes, this is a first step towards providing objective guidance for go/no go decisions for volcano monitoring.