Systemic risks perspectives of Eyjafjallaj ¨ okull volcano ’ s 2010 eruption

through its fundamental


Background to the 2010 Eyjafjallajökull disaster
Eyjafjallajökull is a glaciated volcano in southern Iceland located at 63.6 • N and 19.6 • W. It erupted in April and May 2010 and its ash emission resulted in the closure of much of European airspace for six days.Known problems were brought to the fore regarding the anticipation of and response to systemic risks.Long-standing techniques and knowledge existed, yet they were not fully applied.In particular, disaster risk reduction (DRR) requires a focus on human systems, notably on how to assess and redress vulnerabilities.These extend from dependence on the functioning of a specific system, such as the provision of products and services through air travel, to direct impacts upon households and the health and livelihoods of individuals.This approach does not mean that the environmental input (often termed the hazard) from the volcano, the ash, and the weather should be ignored.It is recognising that the inability of human systems to deal with the environmental inputs are the root cause of the disaster, so the human system weaknesses must be addressed if DRR is to be enacted successfully.
By typical definitions and interpretations, the effects of the Eyjafjallajökull eruption were a disaster, meaning a situation that disrupted life and livelihood and required external assistance to deal with the consequences [17,50,64].From these definitions, the disaster itself is the adverse impact of the volcanic eruption, not the volcanic and meteorological activity per se.The ash emissions and the weather are typical environmental processes that do not create significant amounts of harm unless they interfere with human systems.The challenges posed to the normal operation of human systems, in this case involving air travel, produced the impacts.
To contribute a deeper understanding of the causes of these impacts, this paper explores the 2010 Eyjafjallajökull disaster through its fundamental causes and cascading impacts, highlighting perspectives from DRR, complexity sciences, and health sciences.It provides analysis and resolution of systemic risks, facilitating suggestions for lessons and priorities in future research and action.

The eruption's volcanology and consequences
Sammonds et al. [52], Alexander [1], and Global Volcanism Program [22] summarised the volcanology of Eyjafjallajökull and the 2010 eruption, the first one there since 1821-1823 [23].Eyjafjallajökull's eruptive sequence began in December 2009 with deep earthquakes of moment magnitudes 1-3 and an effusive flank eruption through a fissure vent not covered by the ice cap, which was located at Fimmvörðuháls and occurred on 20 March 2010.
The explosive phase of the eruption started on 14 April 2010 from the summit crater, punching through the ice cap, melting ice, and causing meltwater to mix with the rising magma.The cold meltwater quenched the magma, causing it to fragment explosively into large volumes of very fine ash that were ejected into the atmosphere to elevations of 9 km.This style of eruption is termed 'phreatomagmatic', referring to a combination of steam and magma.In volcanological terms, the April 2010 eruption was not exceptionally large.It reached VEI 4 on the volcanic explosivity index [43] and emitted about 1 km 3 of magmaequivalent material.Eyjafjallajökull's emissions continued sporadically until 23 June 2010.
The prevailing meteorological conditions during 15-23 April 2010 were dominated by north to north-westerly airflow between Iceland and northwest Europe.Such conditions are neither typical nor unusual, as they occur about 18% of the time.The weather system's stability, coupled with winds blowing from Iceland towards the rest of Europe, distributed the volcanic ash across much of European airspace and held it in place for most of a week, posing a threat to commercial aviation.
Miller and Casadevall [41] summarised the risks to commercial jets from volcanic ash.First, air quality in the cockpit and cabin may be compromised by the intake of ash, potentially impairing the pilot's health.Second, the ash can damage instruments through abrasion and clogging, including obstruction of the Pitot tubes that measure flight speed.If the aircraft ends up travelling too slowly, possibly because of misreadings of speed from the Pitot tubes, it might stall and crash.Third, aircraft surfaces and materials can be abraded and eroded by ash, including the front windscreen.Finally, as jet engines operate at temperatures exceeding the melting point of silica (the main constituent of the ash), the ash can melt and fuse onto surfaces in the engine, especially turbine vanes and parts of the combustion chamber.This situation can cause engines to flame-out and stall through loss of compression.In the few instances in which this has occurred, as the aircraft descended, higher atmospheric pressures and moving away from the ash enabled the pilots to restart the engines, although such conditions cannot be relied on.
From 1935 to 2003, 102 aircraft are listed as having encountered concentrations of volcanic ash that were dense enough to constitute a flight hazard [33].In response to these incidents, the United States Geological Survey (USGS) developed a scale that describes the severity of encounters between aircraft and volcanic ash in the air (Table 1).
To date, no encounters of level five have occurred, although level four incidents are recorded, including British Airways Flight 9 over Mt.Galunggung, Indonesia in 1982 and KLM Flight 867 during the 1989 eruptions of Mt.Redoubt, Alaska.In response to these incidents, the International Civil Aviation Organization (ICAO) established the International Airways Volcano Watch (IAVW) with a mandate to help civilian aircraft avoid flying into volcanic ash.During the 1990s, with advice from the World Meteorological Organization (WMO), ICAO founded a series of volcanic ash advisory centres (VAACs).Currently, nine of them divide the world into areas of responsibility for advising international aviation about the location and movement of ash clouds.The VAAC responsible for monitoring and forecasting ash movement over northern Europe and the North Atlantic Ocean to Greenland is based in London within the UK Meteorological Office.The rest of Europe is covered by the Toulouse VAAC.
Lechner et al. [38] provide a history of volcanic ash and aviation.They highlighted the need to develop early warning systems, emphasising better integration with volcanic monitoring data.As part of the established early warning systems, the VAACs provide volcanic ash advisories (VAA) to the aviation community.They communicate as needed with volcano observatories, air traffic control (ATC) centres, and meteorological watch offices (MWOs) that issue significant meteorological information bulletins (known as SIGMETs).Many countries with volcanoes monitor activity via dedicated observatories, using a range of techniques to evaluate when an eruption is likely and how hazards such as ash emission might develop.Detecting whether or not a volcano is emitting ash can be problematic (e.g., [66]), especially if the volcano is remote, so satellite imaging is used to detect thermal anomalies or ash plumes, as conventional radar techniques cannot detect ash particles [49].LIDAR (light detection and ranging) is another technique used to detect atmospheric ash [53].Once a monitoring observatory finds that ash is being ejected, an aviation colour code is assigned to reflect activity level and ash generation, which stimulates the aviation industry to act (Table 2).
This colour code is standardised within ICAO protocols and prompts VAACs, MWOs, national air traffic services (NATS), and airline companies to follow agreed procedures.Limitations emerge regarding the appropriateness of the colour codes.Most notably, they are designed to warn of ash hazards in the immediate vicinity of an erupting volcano, but are not suited for providing warnings of distant ash clouds.Although internationally standardised in 2005, the aviation colour codes are only used routinely in some countries, so they are not globally implemented [15,16].The reason is that many volcano observatories lack the resources to monitor and issue notifications for ash hazards.
Alexander [1] described the airspace consequences from Eyjafjallajökull's ash emissions.Airspace closures began at midday UK time on 15 April 2010.The UK led this process, informed by the IAVW London branch, which liaised with the UK's NATS.Other countries in northern and central Europe soon followed.By 17 April, airports were closed as far south as Rome and as far east as Moscow.In Europe, only a few Iberian airports escaped closure.Partial and tentative service was resumed on 22 April, by which time an enormous backlog of stranded passengers required flights, as well as crews and planes being out-ofplace.In the longest cases, it took up to three weeks to accommodate some passengers travelling to Europe from parts of Asia and South America.At the height of the ground-stop, 8.5 million passengers were stranded [1].
Approximately 108,000 commercial flights were cancelled.For airlines, lost revenues amounted to USD 1.7 billion, and 10.5 million passengers had their travel plans disrupted [7].The economic consequences for businesses included not only reduced passenger receipts, but also blockage of the movement of goods [5].More than one fifth of the economy of Kenya consists of exporting flowers to Europe, and this trade ceased for the duration of the flight ban.Consequently, more than one million roses had to be destroyed.Other disruptions included lifethreatening delays in importing bone marrow from donors in North Table 1 A scale describing the severity of encounters between aircraft and volcanic ash in the air (adapted from [24]).

Class
Summary of criteria 0 Acrid odour, electrostatic discharge.1 Light cabin dust, exhaust gas temperature fluctuations.2 Heavy cabin dust, external and internal abrasion damage, window frosting.3 Engine vibration, erroneous instrument readings, hydraulic-fluid contamination, damage to engine and electrical system.4 Engine failure requiring in-flight restart.5 Engine failure or other damage leading to crash.

Table 2
Volcanic activity level and ash generation for the aviation industry (edited from [19]).
Colour code

Green
The volcano is in its typical background, non-eruptive state or, after a change from a higher level, volcanic activity has ceased and the volcano has returned to its non-eruptive background state.

Yellow
The volcano is exhibiting signs of elevated unrest above its known background level or, after a change from a higher level, volcanic activity has decreased significantly but continues to be closely monitored for possible renewed increase.

Orange
The volcano is exhibiting heightened or escalating unrest with increased potential of eruption, but the timeframe is uncertain OR an eruption is underway with no or minor volcanic ash emissions (the ashplume height would be specified, if possible).

Red
An eruption is imminent with significant emission of volcanic ash into the atmosphere likely OR an eruption is underway or suspected with significant emission of volcanic ash into the atmosphere (the ashplume height would be specified, if possible).
America to patients waiting for transplants in Europe.Further closures occurred for shorter periods of time in May 2010 during particularly intense ash emissions from Eyjafjallajökull.

Disaster risk reduction and complexity sciences perspectives
In the context of technology and infrastructure, including air travel, one explanatory and predictive approach is 'normal accidents' [44,45], which assists in analysing the root causes of disaster.The normal accidents approach postulates two characteristics of technology and infrastructure, complexity and coupling, and indicates how they can lead to disaster.Complexity refers to the number of components a system has, their structures, and their functions.Coupling indicates how the components are connected and the speed with which those links permit changes to propagate through the system.The higher the complexity, the greater the likelihood that components will fail and the more substantial the challenges posed by the system's potential failure modes.Coupling can be classified as 'tight' or 'loose'.Tight coupling increases the likelihood that components will fail rapidly and that a sequence of failures will move swiftly through the system.The term 'normal accident' indicates that some systems can allow many components to fail almost simultaneously or in a rapid, cascading sequence.Under such conditions, disaster would in effect be inevitable, 'normalising' it.For these cases, the system design creates vulnerabilities that make it difficult to stop a disaster from occurring, so the disaster is 'normal'.
For Eyjafjallajökull, one system involves air transportation.The components range from jet engines and airplane windshields to air traffic control and ash monitoring satellites.This yields a moderate level of complexity.Complexity is added by the diversity of the components, but they are relatively straightforward to list and analyse.The physics of how volcanic ash disperses and affects aircraft are moderately well understood.The ability to reproduce ash dispersion in a model with precision and accuracy, and the thresholds for different types of failure, are not as well understood.The modes and consequences of failure are straightforward: aircraft components can be inhibited from working, leading to loss of control of the aircraft and a crash.At the time of the Eyjafjallajökull eruption, neither atmospheric ash monitoring nor the effect of ash on commercial jet engines was adequately understood.Advances in these fields came afterwards [58,60] with plenty of work yet to be done.Some aspects of the air transport system are loosely coupled.For instance, if one aircraft misses its take-off or landing slot due to a mechanical problem, weather delays en route, a passenger no-show or security issue, or the absence of a crew member, then the system continues to function without problem.Once an aircraft enters the system, a diversion for medical or mechanical reasons, or a technical or security emergency on board, does not typically have significant knock-on effects elsewhere in the system.Take-off and landing slots are flexible and are managed in real-time.Even in cases with airports that are operating close to full capacity, such as London's Heathrow, closing one runway to permit an emergency landing or the requirement for pre-take-off deicing leads to delays, diversions, and cancellations, but it may be only a few hours before the system has recovered.Similarly with weatherrelated delays, an airport at one location might close due to a blizzard or hurricane and might require several days to recover, but the system as a whole continues to function around the area affected.The system overall is still reasonably robust, with a large degree of independence of its components due to the looseness of their coupling.Some aspects of the air transport system are tightly coupled.The main example is high dependency on the continued functioning of air transportation.As discussed above, the closure of much of Europe's airspace to commercial air transportation due to Eyjafjallajökull's ash impacted Kenya's economy and transplant donors in North America.Prospects of airline company bankruptcy were raised if the losses continued for much longer [1].The lack of redundancy in the system and its dependency on the availability of airspace to take up slack in case of trouble make it ripe for failure during a major volcanic eruption and thus these characteristics demonstrate the drawbacks of tight coupling.
The Europe-wide closure of airspace is analogous to the nationwide ground-stop in the USA following the 11 September 2001 terrorist attacks.People and goods were left to find surface transport or to await the reopening of air connections.Such situations were not substantially considered when designing the system.Few provisions were made for circumstances in which a significant proportion of commercial airspace would be closed for days.A post-Eyjafjallajökull analogy was the major curtailment of passenger travel, including by air, when the COVID-19 pandemic started in 2020 [39].The knock-on effects were tightly coupled, although they allowed some modicum of the system to continue to function.Perrow's [44,45] normal accidents approach explains how implementing DRR in such a situation is highly challenging, not only as a result of the system's complexity but also due to coupling and the limited forethought devoted to cascading effects.
Conversely, during Eyjafjallajökull 2010 eruption, DRR was implemented and was successful through the grounding of commercial air transport.Not a single casualty was reported as a result of aircraft failures due to Eyjafjallajökull's ash.Banning flying prevents airplane disasters, which is DRR.The number of casualties due to the flying ban has not been calculated, such as those from increases in ground transportation crashes, stress, or unmet medical needs.One such calculation, for vehicle crashes, was conducted after the 11 September 2001 terrorist attacks, concluding that 'the number of Americans who lost their lives on the road by avoiding the risk of flying was higher than the total number of passengers killed on the four fatal flights' ( [20], p. 86).People's responses to perceived risks are perhaps the most non-linear, complex, and tightly coupled elements of any system.This provides ample material for theories of interconnected, compound, interacting, and cascading disasters [46,47].To manage such disaster risks effectively and efficiently, dominant paradigms need to be challenged, notably that short-term economic efficiency is a priority, compared to redundancy and flexibility that allow systems to be safer and more efficient in the long-term.See, for example, Jin et al.'s (2021) analysis of energy systems and Ganin et al.'s (2017) analysis of transportation systems.
With this knowledge, DRR for air transport curtailment or stoppage suggests accounting for extreme uncertainty, even in a system built around robust, exhaustive risk assessment including detailed analyses and plenty of previous experience for less common events such as a volcanic eruption.Rather than focusing on preparing the system to respond to an explicit threat with specific impacts, DRR from a systems perspective means understanding overall system performance while incorporating baseline system traits of interconnectivity, nested dependency, incentive structures, and flexibility/adaptability (e.g., [46,47,56], although 'tipping points' seem to appear in reality less frequently than many theorise [27]).Horton et al. [29] conduct such an analysis for Dallas-Fort Worth International Airport.The DRR key for the system is understanding potential impacts that could arise from a variety of causes.The starting point is almost a 'threat agnostic' approach, although the hazard should never be discounted and certainly helps in scenario planning and training [28,48].When a hazard is identified, then its characteristics must be incorporated into the situation analysis and response to examine the importance of and possibilities for fast recovery and flexibility/adaptability to address the situation.

Health perspectives
Despite the closure of airspace resulting in no aircraft crashes, the ash produced numerous other health impacts which are essential parts of a systemic risk perspective and need to be incorporated into DRR.In fact, with so much discussion on air travel, local health impacts were often neglected, despite the importance that is so often given to individuals and households within risk management.Some were explored in a survey of Icelandic residents' attitudes and behaviour before and after the 2010 Eyjafjallajökull eruptions [4].
Some of the ash produced in the explosive stage of Eyjafjallajökull's eruption was very fine-grained, which can lead to immediate and longterm respiratory impacts [30] together with the accumulation of toxic substances on particle surfaces due to their electrical charge.In 2010, facemasks had been stockpiled in Iceland in anticipation of the swine flu epidemic.As suitable protection against breathing in ash particles was readily available, many facemasks were distributed around the affected areas.Homes and other buildings in Iceland are generally well-sealed against the cold, so ash infiltration was low.To limit ash resuspension in the nearest town to the volcano, Vík on the south coast, efforts included wetting roads and imposing a low speed limit [35].If the volcano had continued to emit ash over a long period, then concerns for the health of children and outdoor workers such as farmers would have had to have been addressed, again indicating the need for flexibility/ adaptability as part of systemic risk management.
Because the eruption was relatively short-lived, immediate health effects seem to have been limited.One survey of 207 people living in the communities most exposed to the ash reported that about half the population experienced eye and upper airway irritation, with the worst symptoms amongst those with asthma.Less than 10% reported shortterm mental health impacts and none were suggested at the time as being serious [10].
For farmers in the Eyjafjallajökull area, the timing of the eruption was difficult from the perspective of environmental health and livelihoods.Despite the well-known and identified hazards, they did not receive adequate information beforehand [61].May is one of the driest months of the year in Iceland and ash resuspension by winds was a major problem.Later rain brought its own problems.Heavy downpours on ashcovered land led to a lahar (volcanic mudflow) in the Svaðbaelisheiði River on 19 May which resulted in the greatest discharge at the Markarfljót River since the initial meltwater floods of 15 April when heat melted snow and ice on the mountain [35].
During May, Icelandic farmers work long hours lambing, calving, and preparing fields for crops to be grown for next winter's animal feed.Farmers faced the dilemma of sowing and fertilising as usual, hoping for no further eruptive activity, or else sowing less while saving money to pay for winter feed under the assumption that eruptive activity would continue.They also faced a difficult choice concerning summer grazing lands.Typically, farmers would put livestock and new offspring out to graze on higher lands away from the farms over summer.In 2010, Eyjafjallajökull's ashfall precluded this option, so livestock, lambs, and calves were kept indoors in increasingly crowded conditions.Due to controls on sheep movement to prevent the spread of disease (a further example of systemic, coincident, and cascading risk), stocks could not be transported to other parts of the country.Potential losses from overcrowding needed to be balanced against potential losses from ash affecting pastures as well as the abrasive and chemical effects on skin and eyes.
The most stressful aspect for farmers was not knowing how the eruption would progress or when it would end, because they had to make seasonal and annual decisions without much pre-eruption training or sufficient information [35,61].They were particularly concerned that a protracted eruption would force them to slaughter significant amounts of livestock and possibly even preclude farming livelihoods in the area.As the eruption ended comparatively quickly, such dire consequences did not happen.They should be incorporated into pre-disaster planning scenarios to develop a complete perspective on systemic risks.

Lessons and research priorities
In addition to considering the systemic health risks, of which some long-term effects might yet manifest, the commercial air travel system includes workers, passengers, companies, aircraft, airports, air-traffic control, authorities, manufacturers, and travel agents.It is a moderately complex, fairly tightly-coupled system and it was significantly disrupted by the Eyjafjallajökull eruption in a manner that was foreseeable (e.g., [21]) but not anticipated.Situations at similar or broader scales will inevitably happen and could be significantly more protracted than in 2010.Current research should focus on this form of systemic disruption, covering as many aspects as possible in order to integrate them.Some categories: • societal changes that help reduce dependency on commercial air transportation • individual behavioural changes that reduce reliance on and expectation of uninterrupted commercial air transportation • physical and social volcanology • physical and social meteorology • scenario development for emergency planning • training, including through using scenarios and drills • warning systems • analysis of risk perception • processes of risk communication • health impacts of volcanic eruptions on people, livestock, and ecosystems • health impacts associated with air transportation disruption • physical and chemical impacts of volcanic ash on aircraft • ethical and equitable moral philosophies regarding the limitation of adverse impacts • business continuity planning and management • contingency planning • treatment of staff and customers by companies.Systemic risk perspectives must account for all of these topics and many more.
Because of the April 2010 disaster, Icelandic volcanoes have received extensive attention, especially how the ash cloud spread across Europe.More research is needed on the prospects for large-scale air transportation interference stemming from ash emitted by other volcanoes.In Europe, top candidates would likely be in the Azores, the Canary Islands, Italy, or the Aegean Sea.Nevertheless, it is only 12,900 years since Germany's East Eifel Volcanic Field last erupted, producing a column of ash at least 20 km high from at least 6.3 km 3 of magma [55].France's Chaîne des Puys and Spain's Olot volcanic fields also show evidence for explosive activity as recently as 4000 years ago [57].Regarding threats to air transport from ash, wind patterns must be considered.Many other volcanoes around the world from Alaska to Indonesia to Chile have disrupted air transportation due to ash clouds.
Problems for aircraft are not limited to ash.Difficulties when volcanoes emit clouds of sulphur dioxide and other gases should be investigated further, especially in terms of their potential impacts on human health, animal health, ecosystem health, aircraft, and infrastructure.
Part of this research agenda would involve efforts to measure, model, and project the spatial extent and character of volcanic ash and gases and their dispersion over time.For different circumstances, safe levels are still determined on the basis of assumptions, rather than detailed, rigorous, systematic tests and models encompassing a variety of ash types, dispersion simulations, and aircraft components.
The advent of longer-range, smaller aircraft such as the single-aisle A321LR also influences the impacts of airspace closure.With more long-range point-to-point flights, rather than the hub-and-spoke model, the closure of a single airport might be less disruptive overall to the system because nearby airports could potentially take up the excess.Hence, as aircraft and the way airlines use them change, coupling within the commercial air travel system might be loosened, making the industry more adaptable to disruption, until more and more nearby airports are affected, eventually rippling out to the continental scale seen in April 2010.During the 2010 emergency, some discussion emerged of the possibility of using 'corridors' between individual airports while these were open, allowing for the fact that ash concentrations in the atmosphere would not be uniform across Europe.It appears that this concept has not significantly entered into planning procedures [59].
Ash impacts on aircraft also vary according to the type and age of an aircraft, the make of engines, the flight path, the frequency of service, ground maintenance capabilities, and pilot behaviour.Research requires more modelling and laboratory testing in order to understand and balance risks.Airlines are amenable to in situ testing (that is, flying commercial aircraft into or under ash clouds).They did so in April 2010 and November 2013, while other aircraft entered the plume to collect scientific data [65].The safety of flight crews and people underneath flight paths must remain paramount.
Given the cost of aircraft and the desire not to risk lives, little opportunity exists for systematic in situ experimentation, especially for empirically determining the point of failure.That is, flying aircraft into ash clouds until something goes wrong is not likely to be conducted systematically nor can volcanic eruptions be induced to test different types of ash and gas emissions.Instead, tests will need to be focused primarily on laboratories, computer simulations, and theoretical calculations, tending to aim for 'definitely safe' thresholds rather than any 'best estimate' of low-risk scenarios.
In parallel with physical science, medicine, and engineering, social science and humanities research agendas are prominent in the topic list above.To minimise disorganisation, ill-feeling, and exploitation, international regulations should be examined to determine their effectiveness in managing the actions of airline and travel companies during flight stoppages.Examples might include temporary approval of and funding for night operations at airports to permit faster repatriation of stranded travellers; insistence that no plane flies with empty seats (even in non-economy classes) if passengers with valid tickets are stranded (i.e., no-charge upgrades to fill seats); fixing fares during the affected period to avoid price gouging; and improved support for travellers who have purchased insurance (as some travel risks are not insurable by many companies).
A balance needs to be sought amongst safety, treating people well, not holding the private sector fully responsible for events beyond their control, and accepting that individuals can and should bear some responsibility for themselves.Travellers should have insurance, yet no insurance covers all eventualities, such as the difficulties of finding coverage for many types of terrorism.In such cases, governments should be ready and willing to be, in effect, the insurer of last resort, without punishing people who had the foresight to purchase their own travel insurance; for example, by prioritising them or by refunding the policy premium.In such cases, ethical questions arise concerning why all taxpayers should bail out those who were not travelling out of necessity.Again, research can assist in supporting these debates and providing options.
An important component of any research agenda would be communicating risks and options.During difficulties, many individuals incur significant expenses in trying to contact their airline.Insurance companies typically provide toll-free numbers or collect call options.Should airlines be required to provide similar services when operations are disrupted?How could airlines be prevented from circumventing compensation legislation, forcing passengers into time-consuming and expensive legal recourse?When governments set up emergency operations centres to communicate with their nationals, how is quality control of information established and how could contradictory messages be avoided?
Other research questions cover systematic risk management approaches to operations (e.g., [12,25]).What plans do airports and airlines have in place if large numbers of planes are grounded for a long time?This situation taxed the airport in Gander, Newfoundland, following the terrorist attacks of 11 September 2001 [54].What happens when airlines, airports, their insurers, or governments disagree over risk assessments, especially given commercial pressures to continue flying?Generally, national governments decide about closing and opening airports, flight paths, and airspaces.Questions remain about criteria used to make such decisions and influences swaying their decisions.
Business continuity would be a significant component of operational research questions.Companies relying on fast and reliable air transportation require arrangements for managing situations in which the system is closed for a significant period of time.For some industries, insurance might be the most viable prospect, which means guaranteeing adequate coverage for all possible closure reasons.For other industries, contingency plans might involve overland routes.Ultimately, many companies might wish to consider diversification, through providing alternatives in the absence of air travel or, more permanently, to maintain profits irrespective of transportation difficulties.Research can provide options and frameworks to be adapted to particular circumstances as well as recommendations for specific industries and companies.One of the open questions of contingency planning for the disruption caused by volcanic eruptions is the scarcity of attention paid to the integration of transportation types [1].
By acknowledging the problem's challenges and applying a systemic risk perspective, more powerful theories could be applied for analysing transportation interruptions involving volcanic eruptions-and for comparing and connecting this work with the extensive material available for other natural hazards and other disruption reasons.How could we better understand and improve the management of and response to risks for systems of different complexities and forms of coupling?What feedback loops and interactions tend to be missing from analyses and operations?How could they be better incorporated?What incentives could be applied to these tasks and which ones are likely to cause more problems than they solve?Is exhaustive risk assessment and planning for everything ever possible and, if so, is it even worthwhile?How could attempts at comprehensiveness, most likely prone to failure, be balanced with the need to examine uncertainties and unknowns?
Decision-making with incomplete knowledge (e.g., [11]), systems thinking (e.g., [6,13]), and disaster resilience (e.g., [62]) are longstanding theories and practices that span many sectors, fields, and decades.This knowledge does not preclude them from being denied or bypassed.The 2010 Eyjafjallajökull eruption reiterates the essential need for systemic risk perspectives to be fundamental to DRR.

Future directions
Two interlinked, principal future directions are proposed here.First, how to manage dependency on air travel.Second, how to think about and act to avert future calamities.
A system (which must have levels of complexity and coupling) that maintains reliable air transportation is currently presumed to be vitally important to society.What is the real need for continual long-range air travel for fresh flowers and medical transplants?The contemporary model for manufacturing, assembling, and selling commonly purchased goods means that functioning long-distance transport systems are essential.'Just-in-time' manufacturing, delivery, and logistics mean that factories and shops hold minimal stocks.Lai and Cheng [37] and Jin et al. [36] emphasised the vulnerability to disruption created in energy systems.Ganin et al. [18] did so for transportation systems.To maintain this situation, and to claim to make costs as cheap as possible, heavy reliance is placed on air transportation as being allegedly economically efficient.This might be true in the short-term for some calculations, but it is not necessarily so in the long-term or when considering all costs.Then, when supply chains are disrupted, just-in-time management without contingency planning or redundancy can lead to complete system shutdown.
The airspace closure associated with the 2010 Eyjafjallajökull eruption occurred right at the margin of the length of time which was possible without significant and lasting repercussions across multiple sectors.Had the flight bans continued for much more time, the impact on people's day-to-day lives and many industries would have become abundantly clear.Because of the wide distribution of component producers around the world, many production lines would have slowed or halted, as occurred twice in 2011 due to the earthquake and tsunami in Japan [2] and floods in Thailand [26].Moreover, food and medicine stocks might have run out in certain places.
Realistically, how long might a continent-scale airspace shutdown occur?Following the terrorist attacks of 11 September 2001, the closure of American airspace to commercial flights was a political decision.The necessity is not fully known, but the closure was not forced directly for safety reasons.Instead, it was made as a result of a risk assessment which included the political consequences of not stopping flights if there were any more terrorist attacks.Even during the harshest lockdowns and border closures during the COVID-19 pandemic in 2020, cargo flights were generally able to continue.Supply chains were not extensively interrupted by airspace or airport closures, even if they were impeded for other reasons such as sick or isolating staff.
The disruption level from volcanic ash is determined by both ash amount and, linked to weather, ash dispersal.Even if ash were continuously emitted for weeks, it would be unlikely for the wind to blow in the same direction at the same speed for this amount of time.Windows of safety for flights are likely to emerge for airports that are distant from the ash source, especially if systems are ready for 24-h operations.Flexibility could include flying lower or higher than usual in order to circumvent the main concentration of ash, even if this were to lead to lower fuel efficiency.
Yet atmospheric circulation dynamics can cause relatively large changes in ash concentration patterns within hours.As noted above, the concept of 'safe corridors' for flights was widely discussed during the Eyjafjallajökull eruption.It would work under the assumption that departure and destination airports could be connected by flight paths that were projected to be free of significant hazard for the flight's duration [1].An abrupt change in weather patterns could close a 'safe corridor' while it is in use, at times with limited ways out for the aircraft.One mistake in a decision to fly, even without fatalities, could invalidate all risk assessments and simply ground flights until further notice.This makes the system difficult to subject to stress testing [40].
During April 2010, one core of the problem lay in the absence of contingency plans, in that the possibility of an Eyjafjallajökull-type situation had not been properly considered despite many calls to do so [49] and many previous experiences of volcanic ash clouds interfering with commercial aircraft [33].Prior to Eyjafjallajökull's 2010 eruption, the aviation industry had not agreed on a safe threshold of ash concentrations in the atmosphere at which aircraft would be permitted to fly.Despite decades of encounters between commercial aircraft and volcanic ash clouds [33], interest and action were insufficient to establish an agreed safe limit, even though many researchers had collaborated with the aviation industry to pursue this aim.
The absence of focused efforts with practical recommendations was highlighted in 2008 at the Fourth Meeting of the International Airways Volcano Watch Operations Group [31].The situation seems to have been explained away partly as a consequence of the difficulties of attracting formal aviation industry representation at science-focused workshops on volcanic ash.Two years later, as Eyjafjallajökull started to erupt, no progress appeared to have been made.As noted in the summary of outcomes of the Fifth International Workshop on Volcanic Ash in Santiago (Chile) in March 2010, "there remains no definition of a 'safe concentration' of ash for different aircraft, engine types or power settings" ( [32], p. 4).
A change occurred on 20 April 2010.In response to enormous external pressure, the UK's Civil Aviation Authority (CAA) adopted a 'reasonably practicable' approach.It is broadly similar to many legallybased approaches for workplace health and safety which, rather than zero risk, seek tolerable and well-managed risk.Following discussions with engine manufacturers on tolerance levels in low-density ash areas, an agreement was reached on safe concentrations of ash and national airspace was opened, followed by similar actions in other European countries.Thresholds were guided by data from the UK's Meteorological Office atmospheric dispersion modelling programme and then updated as the picture clarified.
On 20 April 2010, CAA [8,9] defined three zones (Table 3).On 11 May, the 60 nautical mile 'no fly' buffer zone around areas of ash density in excess of 2000 μg/m 3 was removed.17 May witnessed the introduction of time-limited zones ('grey zones'), which were defined as airspaces with ash concentrations that would presumably allow safe flying for a limited amount of time before the tolerance levels set by jet engine manufacturers were exceeded.These zones permitted flights in airspace where ash concentrations were deemed to fall between 2000 and 4000 μg/m 3 provided, amongst other caveats, that the operator had produced a safety case supported by data from the aircraft and engine manufacturers.
Whether or not this approach and the decisions made were correct continues to be debated.One justification was the absence of any major incidents, which might or might not be convincing.Could the thresholds have been pushed even further?What health problems could have arisen amongst passengers and crew, or maintenance issues with aircraft, even if all flights were completed safely?Should passengers and crew with asthma or other respiratory impairments have been banned or discouraged from flying-and then what ethical questions emerge?To answer such questions and to be prepared for the next incident, a comprehensive research and practice programme would be needed, but industry's interest remains low [51].With memories of Eyjafjallajökull already faded in corporate boardrooms, changes in airline industry leadership, continuing reconfigurations in how the airline industry operates, and never-ending cutthroat competition for the lowest possible fares leading to the highest possible short-term profits, the collaborative spirit engendered by a flight stoppage and the need for the industry to plan ahead for calamity declined.
The UK Government now lists volcanic ash hazards in its national risk register [63], evidencing that the topic has not been entirely forgotten.Meanwhile researchers, often with industry collaboration, continue to publish relevant work, for instance, on risk communication [38], volcanic ash patterns [14], and ash impacts on aircraft components [42].
Within the two future directions of how to manage dependency on air travel and thinking ahead and acting to avert future calamities, the main need for future work is perhaps closer links amongst governments, scientists, non-profit groups, and industries.As a related example, one of us (Kelman) contacted several airline companies requesting information on how pilots were trained to behave if an earthquake struck while taking off or landing.Examples were provided of airports in major earthquake hazard zones to which the airline companies flew.Not a single airline company expressed any interest in the topic, accepted that it could be a concern, or stated that their pilots are trained to deal with these circumstances.Another parallel is space weather, such as major solar flares, which can expose airline crews and passengers to large amounts of radiation [34].They can also potentially affect aviation communications [3].
Even though it had been known to be part of the systemic risks for decades beforehand, the topic of volcanic ash risks to air transportation came to the fore due to Eyjafjallajökull's 2010 eruption.The level of interest witnessed in its wake has not been maintained by those who most need to do so.As occurs so often regarding disaster risk and systemic risk perspectives, a specific disaster-in this case, the 2010 eruption of Eyjafjallajökull volcano in Iceland and its implications for commercial aviation-demonstrates the challenges of altering established systems to make them more robust while simultaneously planning ahead for the next major disruption.