Mexico City's 7.7-Magnitude Drill: Crowd Evacuation Lessons for Football Stadiums

September 19, and a yellow line

On September 19, 2026, Mexico City holds its Second National Drill. The published scenario: a magnitude 7.7 earthquake, epicentre placed at Tehuacán, in the state of Puebla. In that scenario no building collapses, nobody is injured, no column of smoke rises. But the largest public transport network in Latin America — Metro, Metrobús, Cablebús — must run according to a pre-written set of protocols, and every passenger standing on a platform, sitting in a car, or suspended in a cable-car cabin becomes a variable in the test.

The first item in that protocol concerns a painted line. On Metro platforms, passengers are told not to cross the yellow line at the platform edge, not to push, not to shout, not to run. It sounds trivial, the kind of instruction that gets pasted on a wall and never read. It is the kind of instruction that only gets written when the author has already calculated that the human instinct in the first ten seconds of an earthquake is to do exactly the opposite: bolt for the nearest exit, shove the person ahead, and scream.

I read the 27 data points of this drill as a reporter who has spent 23 years in stands, press rooms and dressing rooms. What stopped me was something else. Football has evacuation protocols for stands, safety guidance, emergency action plans. Almost nobody measures them again after they are written. A plan that has never been timed is an administrative document with a signature on it.

Why Mexico City, and why September 19

No major city in the world puts the crowd-evacuation problem on the table more seriously than Mexico City, and the reason lies under the city itself. Mexico City is built on the drained bed of Lake Texcoco. That soft, water-saturated sediment has a property structural engineers call seismic amplification: when seismic waves arrive from a distance, soft ground shakes harder and longer than hard rock. In the same earthquake, a building on the outskirts may tremble faintly while a tower downtown sways in resonance for minutes. Distance to the epicentre is not the only decisive variable — the ground is.

On September 19, 2026, an earthquake of roughly magnitude 8.1, with an epicentre off the coast of Michoacán, flattened part of the city centre. Widely cited estimates put the death toll at around 10,000, most of them in tall buildings on the lakebed. Thirty-two years later, on the same date in 2026, a magnitude 7.1 earthquake with an epicentre near the Puebla area struck on the anniversary itself. The total death toll was 369, of which 228 were in Mexico City.

September 19 is no longer a date on a calendar there. It is a data sample that has repeated itself twice, and nobody schedules a national drill on that date out of habit. They do it because that date has been proven possible.

One technical detail matters more than the rest: the hypothetical epicentre for the 2026 drill sits at Tehuacán, Puebla — the same source region as the real 2026 event. Organisers did not pick a distant, comfortable scenario. They picked the scenario that has already killed people.

Mexico City operates a seismic alert system called SASMEX, running since the early 1990s, broadcasting warnings by loudspeaker, television, radio and mobile app. Its physics is simple: seismic waves travel at a few kilometres per second, radio signals travel almost instantly. If a sensor near the Pacific coast detects strong motion, the signal can reach the city centre seconds before the destructive wave.

But that golden window depends entirely on distance. For an earthquake in Guerrero, roughly 300 kilometres away, the warning can give residents 60 to 90 seconds. For a Puebla earthquake, straight-line distance of about 150 to 160 kilometres, that figure shrinks to a few tens of seconds. And for a shallow quake whose epicentre lies under or at the edge of the city, the warning time is zero — the wave has already arrived before there is anything to detect.

That is why the Metro, Metrobús and Cablebús protocol is not written for the alerted scenario. It is written for the most common real one: the warning comes late, or does not come, and the ground starts moving under your feet.

Twenty-seven data points and a single doctrine

The 27 information points are not scattered. They form five clear logical groups, and all five serve one principle.

First, behavioural management: stay calm, do not run, do not shout, do not push. This is the hardest group to enforce, because it asks people to override a survival reflex.

Second, spatial control: do not cross the yellow line, move away from platform edges and glass surfaces, move to the centre of the platform or against a load-bearing wall. The logic is measurable: the biggest risks on a platform are not a collapsing roof but falling onto the tracks and shattered glass. Those are risks created by movement, not by standing still.

Third, remaining inside the vehicle: stay in the car, hold on, never pull the emergency brake, never open the doors. This is the most counter-intuitive group in the whole document.

Fourth, authority hierarchy: evacuate only on the instruction of operating staff, move in an orderly way as directed, do not find your own way out.

Fifth, a dedicated Cablebús protocol. On an alert, cabins stop automatically. On tremor without an alert, cabins stop gradually without a warning signal. Staff then activate a vertical rescue procedure.

Stacked together, those five groups produce one sentence: life in a public transport system under seismic impact is protected by staying put and letting the system move, not by moving yourself.

This is the point at which anyone involved in stadium safety should read twice, because it inverts the entire intuition. In an earthquake on a Metro platform, the most dangerous thing a passenger can do is step out of the train. In a stand fire, the most dangerous thing a spectator can do is sit still. Those two doctrines cannot be swapped. And most stadium safety plans in the world are mixing them.

Shelter inside the cabin, not on the platform

There is a very concrete engineering reason why the Cablebús protocol prescribes vertical rescue rather than evacuation. A cable-car cabin halted in mid-air has no lateral exit. Passengers cannot step sideways. They can only be lowered or raised with specialised equipment, and each rescue takes hours, not minutes. An urban cable line may have dozens of cabins and hundreds of passengers suspended at once. For a system like that, the only feasible option is to keep people inside until a rescue team reaches them.

With the Metro the logic is similar but adds a layer. A tunnel is a closed space. If a train stops between stations and passengers open the doors to walk along the tunnel, they enter an environment with no exit, insufficient light, high-voltage current on the third rail, and possibly another train approaching. Pulling the emergency brake in that situation is not an act of courage. It is an act that creates a trapped crowd in the narrowest possible space.

The third group of the protocol therefore reads: stay, hold on, wait. Doing nothing is the recommended action.

During my career I have repeatedly seen a version of this paradox. In 2026, at Germany's training base in Vatutinki outside Moscow, I was shown the xG model their analysis department had built for the World Cup group stage. The chart identified a fatal point: when countered at speed, the gap between the two centre-backs stretched beyond recovery. Coach Joachim Löw saw that chart. He did not change the structure. On June 27, 2026 in Kazan, South Korea beat Germany 2–0, through Kim Young-gwon in the 90+3rd minute and Son Heung-min in the 90+6th. Both goals came from exactly the space that had been drawn days earlier.

The lesson is not that Germany lost. The lesson is that an organisation with full data, full resources, and captain Manuel Neuer and midfielder Thomas Müller in the squad can still fail to act on what it knows. Data does not automatically become behaviour. Applied to stadium safety, this is the central problem: most stadiums know how many exits they have. Very few know how long it takes to empty a stand.

A stadium has no cabin

Here the comparison breaks — and it breaks in football's disfavour.

A public transport system has two components: vehicles and platforms. The vehicle is shelter. The platform is transit. The Metro and Cablebús protocols work because they can move passengers from one state to the other under control — close the doors, hold the train, wait for orders.

A stadium has no vehicle. A stadium is all platform and no train. There is no cabin for spectators to shelter in. Every square metre is open to the crowd, and everyone in it must move on their own feet.

That difference produces two opposite crowd physics. A transport system is a containment system: its job is to hold people in a defined space, distribute them by car and by station, and release them in batches. Its failure mode is leakage. A stadium is a dispersal system: its job is to push a giant mass of people out through fixed-size gates and fixed-slope ramps into open space outside. Its failure mode is congestion.

A protocol written for a station and applied directly to a stadium therefore creates the most dangerous thing of all: a crowd ordered to stand still in a space with no shelter, no load-bearing wall to press against, not enough staff to control it, and no vehicle to wait in.

There is one notable exception: the pitch. In an earthquake, the grass is the safest place in the stadium — open ground, nothing falling from above, no railings, no glass. But moving 60,000 people from the stands onto the pitch means pushing them through vomitories and narrow ramps, through the most dangerous place in the building. Knowing where safety is does not mean being able to reach it.

The arithmetic nobody wants to do

There is one quantified figure that governs stand-evacuation doctrine, and it does not depend on the crowd's mood.

In crowd engineering, pedestrian flow through an exit is measured in persons per metre of width per second. Under ideal conditions — level concourse, full lighting, calm crowd, no obstructions — flow reaches about 1.2 persons per metre per second. That figure has been validated across decades of real-world observation.

Put it into an 80,000-seat stadium. If the target is to empty the stands within eight minutes, or 480 seconds, roughly 167 people must exit every second. At 1.2 persons per metre per second, that stadium needs about 139 metres of usable exit width.

139 metres. Not the nominal width on the architectural drawing, but the width that actually functions in that specific moment.

Scale it down to Vietnam. The National Mỹ Đình Stadium holds about 40,192. By the same formula, emptying it in eight minutes requires roughly 70 metres of usable exit width. That sounds comfortable — until the subtractions begin.

Subtract gates locked for security reasons. Subtract gates blocked by ambulances, police vehicles or mobile barriers erected to control the technical area. Subtract turnstiles, each taking two to three seconds per person, which cuts flow to a third or a half of a fully open gate. Subtract exits that lead into a corridor that ends at another single-leaf door.

After three subtractions like that, usable width can halve. And when it halves, clearing time does not double — it grows non-linearly, because density per square metre rises, and past a certain threshold the crowd stops flowing and starts compressing.

In crowd science, the density widely treated as dangerous is around four persons per square metre. Above that, a person can no longer decide their own direction; they are pushed by pressure from behind. Higher still, that pressure can cause positional asphyxia, which is the most common lethal mechanism in crowd disasters — not trampling, but compression.

An exit locked in Indonesia in 2026 was not an administrative decision. It was a subtraction in the equation above.

Eight minutes, and the numbers nobody has timed

The eight-minute benchmark is not mine. It comes from the Guide to Safety at Sports Grounds, commonly called the Green Guide, issued by the UK Sports Grounds Safety Authority and revised many times since the 1970s. It sets the principle that a stand must be capable of being cleared within a limited time, and classifies areas by risk level to apply different benchmarks.

Its nature must be stated plainly: it is a design standard, not an operational guarantee. Architects use it to size stairs and gates. It says nothing about whether, on a specific Saturday evening, with a specific referee, after a specific 89th-minute goal, the crowd in that stadium will actually leave the stand in eight minutes.

The distance between those two things is where disasters live.

And this is where football has a far larger data gap than most people assume. Leagues publish attendances, ticket revenue, fill rates. Very few publish measured stand-clearance times from an actual drill, with the assumptions attached. I have asked that question in many press rooms over more than twenty years, and the most common answer is a theoretical figure with no measurement date.

Data only keeps the beat — emotion does the singing. In stadium safety, the beat was abandoned long ago, and the singing has not stopped.

Three disasters, one mistake

On April 15, 2026, at Hillsborough in Sheffield, 97 people died during the FA Cup semi-final between Liverpool and Nottingham Forest. On October 1, 2026, at Kanjuruhan Stadium in Malang, Indonesia, 135 people died after a match between Arema FC and Persebaya Surabaya. On May 9, 2026, at Accra Sports Stadium in Ghana, 127 people died after a match between Hearts of Oak and Asante Kotoko.

Three disasters, three continents, three decades. One structure.

Hillsborough was a lesson about the gap between an instruction and the ability to receive it. The crowd outside the turnstiles did not know the terrace was already over capacity. The order to stop did not reach the people who most needed to hear it.

Kanjuruhan was a lesson in arithmetic. Exits did not function as designed at the exact moment they were needed, and tear gas was used in an enclosed space.

Accra was a lesson about a crowd already at maximum emotional arousal before the incident began. When a crowd has just absorbed a collective emotional shock, its capacity to receive instructions collapses.

In all three cases, the cause was not that spectators did not know where the exits were. Football's failure mode is almost never "the crowd didn't know the way"; it is "the exit was not usable, or the instruction was not credible."

The pitch does not lie — but people do. And when people lie about safety, the consequence does not show up on the scoreboard.

Mexican football and a test scheduled after the World Cup

Back to Mexico City.

The city's biggest stadium is Estadio Azteca, opened in 2026, host of the 2026 and 2026 World Cup finals. It sits on the very lakebed that amplified the two historic earthquakes. Its capacity exceeds 80,000 depending on configuration after recent renovations, and it is scheduled to stage the opening match of the 2026 World Cup on June 11, 2026.

Mexico's other two World Cup 2026 venues are Estadio Akron in Guadalajara and Estadio BBVA in Monterrey. Both sit in zones of significantly lower seismic risk than the capital.

The Second National Drill falls on September 19, 2026 — roughly three months after the World Cup ends. As a schedule, that is a reasonable gap for post-event review. As safety logic, it poses a question organisers must answer in advance: if a strong earthquake hits while more than 80,000 people are seated in a stadium on the Texcoco lakebed, in what sequence does the evacuation plan run, and has that sequence ever been timed?

Mexican football does not lack great figures. Hugo Sánchez is the icon of a generation, a scorer in Europe for Real Madrid and the face of a football culture. Rafael Márquez captained Mexico at five consecutive World Cups. Guillermo Ochoa also appeared at five World Cups, a record of goalkeeping endurance. A football nation with that depth should have a safety culture to match.

The season was empty, but the concrete bench still holds the dent of a seat. I saw that during the seasons without crowds. When cities came back, the question was not how many people could get in. The question was how many could get out, and how long it would take.

The blind spot: trust is a piece of infrastructure

This is the part the Mexico City protocol does not state, yet it is the precondition for everything else in it.

All 27 data points rest on an unverified assumption: that when operating staff say "stay where you are", passengers will believe them and comply. That assumption holds in Mexico City for a very specific reason. SASMEX has worked long enough and accurately enough for residents to have personal evidence that it is trustworthy. Tens of millions of people have heard the sirens, evacuated, and survived real earthquakes. That trust was not built by a communications campaign. It was built by results.

Transferred to football, that precondition usually does not exist.

Stadium safety staff in most leagues are casual labour: hired by the day, trained for a few hours, replaced each season. They are not a professional force trained to make decisions in an emergency. In a real incident they are victims alongside the spectators, distinguished only by a logo on their shirt.

History has recorded what happens when trust in operators breaks. After Hillsborough, investigative documents over subsequent decades showed that initial accounts from authorities did not reflect reality, and only through later inquiries was the truth acknowledged. During that period, the relationship between English football supporters and law enforcement was damaged beyond what any evacuation plan could repair.

An evacuation protocol is not a behavioural instruction. It is an instrument of institutional trust. If spectators believe the order is given for their benefit, they will stand still. If they believe it is given to protect the organiser's image, they will run. And in a crowd above four persons per square metre, a small fraction running is enough to drag the whole.

There is a further asymmetry the drill exposes. The drill tests passenger behaviour. But the decisive variables sit with the operator: decision latency, the order in which doors open and close, public-address quality, the ability to broadcast multilingual announcements in a city full of tourists. None of the 27 data points states that those metrics are measured and published.

A drill that measures citizen behaviour is a useful drill. A drill that does not measure operational capability easily becomes a ritual.

Signals I will be tracking

I will not write about this drill as a same-day news item. I will file it alongside what I am waiting for in football.

The first signal is whether Mexico City publishes measured results: train stop times, time to notify passengers, platform clearance times. If it does, that will be a rare reference dataset for the entire mass-event operations industry, beyond transport.

The second signal is the emergency action plans of Mexico's three World Cup 2026 venues. The specific question is simple: will they run a full-stand clearing drill with a full crowd, and will they publish the number?

The third signal, and the one I care about most as a Vietnamese reporter, is whether stadiums at home publish any evacuation metric at all. I have sat in Mỹ Đình on nights when every seat was taken, walked those concourses, watched how the crowd drains after the final whistle. I have never read a single figure for how long that drain takes.

That is the gap I want filled next season. Not with a conference, but with a stopwatch.

They remember the goals — I remember the sigh after the whistle. And next time, I want that sigh to come after the crowd is already out, safely.