F1 safety history: how the halo went from mocked to vital

When the halo appeared on Formula 1 cars in 2018, the reaction was close to unanimous and almost entirely negative. It was called ugly, unnecessary, a betrayal of open-cockpit racing, a flip-flop, a thong. Drivers who would later credit it with saving their lives said publicly that they did not want it. Within a few seasons the argument was over, not because anybody won it, but because television kept showing cars landing on top of other cars and coming to rest against a titanium bar.

That sequence is the whole of F1 safety history in miniature, and the halo is the clearest example the sport has ever produced. A device is proposed on the basis of evidence, resisted on the basis of taste, mandated anyway, and then vindicated so quickly that the objection becomes embarrassing to remember. What makes the story worth telling properly is the uncomfortable part underneath it: almost every safety advance in motorsport arrived after somebody died, and the sport's honest record is one of reaction rather than anticipation.

The rest of this is about how that reaction became systematic, which is the actual achievement.

The era when a fatality was treated as a property of the sport

It is difficult now to reconstruct how the first two decades of the world championship felt, because the assumptions were so different that the safety failures do not read as failures. They read as conditions.

Circuits were public roads, or aerodromes, or parkland. What lined them was whatever was already there: trees, ditches, stone walls, houses, spectator banks with no fence. Where protection was added it was frequently straw bales, which burn. Cars carried large volumes of petrol in thin unprotected tanks, often beside and behind the driver, and a heavy impact regularly meant fire.

Drivers wore cotton overalls, sometimes a polo shirt, and helmets that were closer to a leather cap than to a modern shell. Many did not wear seatbelts, and the reason is the part people find hardest to believe.

It was a rational calculation. Given a car that would probably burn, and a cockpit you could not get out of quickly, being thrown clear of the accident was more survivable than being held inside it. Unbelted drivers were not being reckless by the standards of the information they had. They were optimising for the failure mode that was actually killing people.

That is the single most useful idea in this whole subject. A safety measure is not good or bad on its own. It is good or bad inside a system. Seatbelts only became obviously correct once the fuel was in a protected bladder, the overalls were fire resistant, the cockpit could be exited quickly and the structure around the driver was strong enough to be worth being held inside. Change any one of those and the sum changes.

Medical provision matched the rest. There was often no doctor with the equipment to intervene, no defined route to a hospital, no protocol for who did what. A driver's survival depended heavily on which corner the accident happened at and who happened to be standing there.

The first serious argument for safety came from a driver, and it was unpopular

Jackie Stewart's crash at Spa in 1966 is the standard starting point for the modern era, and it earns the position for a reason that has nothing to do with the impact itself.

He was trapped in the car, soaked in fuel, for a period long enough to be dangerous, and was eventually freed by two fellow drivers who had also crashed and who borrowed tools from a spectator. There was no medical car, no organised extraction, no plan. When he did reach a medical facility, the arrangements were improvised.

What followed was a campaign that made Stewart genuinely unpopular for years. He argued for barriers, for run-off, for medical facilities, for full-face helmets, for fire-resistant clothing, for seatbelts, and for the idea that circuits should be inspected against a standard rather than accepted because they had always been used. The objections were the ones that recur every single time: it would spoil the character of the circuits, it would make the racing soft, the danger was the point.

The 1970s absorbed most of that agenda. Seatbelts became compulsory. Fireproof clothing to a defined standard replaced whatever the driver fancied. Onboard extinguishers appeared. Armco barriers went up in place of banks and bales, which solved one problem and introduced another that took decades to understand.

What did not yet exist was any system for deciding what to do next. Changes were made in response to particular accidents, by argument, without data. The sport had begun to care. It had not begun to measure.

Medical response was the turning point that nobody puts on a poster

The second shift is easy to overlook because it produced no visible object. From 1978, Formula 1 had a permanent medical delegate in Professor Sid Watkins, and with him came the idea that the response to an accident is a designed system rather than an improvisation.

The changes were procedural and they were transformative. A medical car following the field on the opening lap, when the risk of a multiple-car accident is highest. A requirement for a properly equipped medical centre at the circuit. A helicopter on site, with a defined destination hospital, and the rule that if the helicopter cannot fly the session does not run. Trained extraction teams. A protocol for removing a driver with a possible spinal injury, using the seat itself as a stretcher, which is why modern seats are designed to lift out with the driver still in them.

The underlying insight is that survivability is not decided at the moment of impact. A large share of it is decided in the following twenty minutes, and that share is entirely controllable by planning.

1. 1Marshals at the nearest post signal and reportThe corner post communicates immediately with race control, which is the first piece of information anyone has about what has happened.
2. 2Race control neutralises the trackA safety car, a virtual safety car or a red flag is deployed to bring the cars to a speed at which people can work on the circuit. Nothing else can begin until this happens.
3. 3Onboard data reaches the medical teamAccident data recorders and in-ear accelerometers capture the deceleration the driver experienced, and biometric gloves report pulse and blood oxygen, so responders know the severity before they arrive.
4. 4The medical car is deployed to the sceneA doctor reaches the car, usually within a time measured in tens of seconds because the car is already circulating or stationed for the purpose.
5. 5Extraction follows the spinal protocolIf there is any suspicion of a spinal injury the driver is not lifted out. The seat is unbolted and the driver is removed still supported by it.
6. 6Transfer to the circuit medical centre or hospitalThe route, the receiving hospital and the helicopter are all agreed before the meeting starts, which is why a session cannot run if the helicopter is grounded.

The intervention sequence a modern race meeting is built around. The point of the figure is that every step is a rule, planned in advance, rather than a reaction on the day.

1994 changed how decisions were made, not only what the cars looked like

The San Marino Grand Prix weekend of 1994, in which Roland Ratzenberger and Ayrton Senna were killed, is the point at which the sport stopped treating safety as a series of individual arguments. The accidents themselves have been examined at enormous length elsewhere and there is nothing useful to add here.

What matters for this subject is the governance. The FIA established a standing expert advisory committee on safety, chaired by Watkins, with the authority to commission research rather than only to respond. The Grand Prix Drivers' Association was reformed, giving the drivers a collective voice with somebody to direct it at. Immediate changes were made to the cars and to several circuits during the same season.

The most consequential change was the least dramatic. Accident data recorders were fitted to the cars, so that every significant impact produced a measured deceleration trace rather than an opinion. Once you have a database of accidents with numbers attached, you can ask which injuries are common, which structures fail, and which proposed fix would have helped in how many cases. Everything the sport has done well since rests on that.

This is also the point at which the two halves of car design stopped fighting each other. Making a car faster and making it safer are not naturally aligned, and the tension shows up in every regulation cycle: the aerodynamic rules that decide how a car makes downforce also decide how it behaves when it is turned sideways, launched, or hit by another car. Safety research began to be an input to those rules rather than a correction applied afterwards.

Circuit design: run-off is a deceleration device, not a car park

Trackside protection is the part of motorsport safety that most people misread, because the visible feature is space and the actual mechanism is energy.

A run-off area is not there to give a driver room. It is there to absorb speed before the car reaches anything solid. That is why the choice of surface matters so much and why it has been argued about for forty years.

Gravel decelerates a car strongly, which is what you want, but it does so unpredictably. A car arriving sideways or already airborne can dig in and trip, and a car that trips can roll. Asphalt run-off decelerates far less, because the car can keep braking on it, but it is predictable and it does not launch anything. It also lets a driver rejoin, which is why asphalt run-off and the argument about where the edge of the track actually is arrived together. The safety case for tarmac and the sporting case against it are both real, and no circuit has ever fully reconciled them.

Barriers went through the same evolution. Steel guardrail deflects and redirects a car along the barrier line, which is excellent for a glancing impact and poor for a perpendicular one. Stacked tyres bound with conveyor belting deform and absorb, which is better for a head-on hit and worse for an oblique one, because a car sliding along a tyre wall can snag. Modern energy-absorbing barrier systems built from moulded plastic modules with an outer restraining layer were developed specifically to spread the load across a wider area and to present a smoother face to a car arriving at an angle.

Three principles underlie all of it, and they are the useful takeaways.

Deceleration should be spread over distance. Stopping a car in three metres rather than one is worth more than any material choice.

The angle of impact matters more than the speed. A barrier that performs well at fifteen degrees can perform badly at seventy, and circuit design is largely the business of controlling the angle at which a car can reach a given piece of protection.

A circuit is safe for a particular vehicle, not in general. The same corner can be well protected for a car and hostile for a motorcycle, because a rider slides and a car does not. Circuits are licensed by category for exactly this reason.

Debris fencing sits above all of it, protecting the people watching. It is the part of trackside safety that receives almost no public attention and that no circuit designer regards as solved.

The survival cell turned the car into a structure with two jobs

The single biggest change to the car itself was the arrival of the carbon composite monocoque in the early 1980s, and the reason it worked is counter-intuitive.

A car that absorbs energy by deforming everywhere is a bad car to be inside, because the deformation reaches the driver. A car that is rigid everywhere is also bad, because the deceleration goes straight through the structure into the human. The correct arrangement is a very stiff cell around the driver with deliberately sacrificial structures bolted to the outside of it: a nose box in front, an impact structure behind the gearbox, and side structures.

Those sacrificial parts are designed to destroy themselves in a controlled way, converting kinetic energy into the work of crushing composite fibres. The cell is designed not to deform at all. Everything since has been a refinement of that division.

Homologation is where the design meets the rulebook. The FIA's technical regulations require a series of impact and static load tests that a chassis must pass before it can race, and the details matter more than the headline.

The impact tests fire the structure into a barrier, or a barrier into the structure, at a defined speed with a defined mass, and set limits on both the peak and the average deceleration recorded. Passing is not simply a matter of the structure surviving. A structure that survives but transmits too high a deceleration has failed, because the number being measured is what happens to the driver.

The static tests are squeeze tests. Loads are applied to the sides of the cockpit, around the fuel cell, at the nose and at the roll structures, held for a defined period, and the structure must not fail and must not deform beyond a small permitted amount. Roll structures are tested with combined loads applied from more than one direction at once, because a car that rolls is rarely obliging enough to land square.

Two rules make the whole regime much harder than it sounds. Several tests must be passed by the same chassis in sequence, so a structure cannot be built to survive exactly one hit. And the survival cell must include anti-intrusion panels made from ballistic-grade fibre, because carbon composite is superb in compression and poor at resisting a sharp object arriving at speed.

There is also a requirement most people never think about. The driver must be able to get out of the cockpit unaided within a defined short period, with the steering wheel removed and replaced, and this is demonstrated at scrutineering. Every proposal for cockpit protection in the sport's history has had to survive that test, and several did not.

The neck injury nobody could see, and the device that fixed it

For a long period, drivers were dying in accidents that the car had survived. The structure held, the fire did not happen, the deceleration was within the range others had walked away from, and the driver was still killed.

The mechanism is a basilar skull fracture. In a heavy frontal impact the harness stops the torso very quickly. The head, which is heavy and unrestrained, keeps going, and the neck takes a tension and bending load at the base of the skull that it cannot take. A helmet makes this worse rather than better, because it adds mass to the thing being thrown forward.

The fix was designed by Dr Robert Hubbard, a biomechanical engineer, after the death of a friend who raced. The HANS device is a carbon composite yoke that sits on the shoulders, behind the neck, held in place by the driver's own harness rather than bolted to the seat, with two short tethers connecting it to anchors on the helmet. When the body decelerates, the tethers stop the head moving forward relative to the torso and route the load into the shoulders and chest, which can take it.

It is a simple object and it took years to be accepted. Drivers complained that it restricted head movement, that it was uncomfortable, and that it would make getting out of the car harder. Different series adopted it at different times through the late 1990s and early 2000s, and Formula 1 made head and neck restraints compulsory in 2003.

That pattern is worth marking, because it repeats exactly with the halo. The objection was never that the device did not work. The objection was that it was awkward, and awkward lost.

Loose objects are an energy problem, and energy scales with the square of speed

Before getting to the halo it is worth being precise about what it is actually protecting against, because the intuition most people have is wrong by a large factor.

A wheel that leaves a car is not dangerous because it is heavy. It is dangerous because of how kinetic energy behaves. Double the speed of an object and its energy goes up four times. That is why a small component travelling very fast is a serious threat and why a wheel assembly at racing speed is in a category of its own.

Here is a constructed worked example. Every mass and speed below is invented, chosen to make the relationship visible rather than to describe any real object.

0.5 kg part at 80 m/s1.6kJ

10 kg wheel at 40 m/s8kJ

10 kg wheel at 60 m/s18kJ

20 kg wheel assembly at 60 m/s36kJ

Constructed arithmetic using invented masses and speeds, in kilojoules, calculated as half the mass times the velocity squared. It illustrates how energy scales with speed and is not a measurement of any real component or accident.

Show the numbers

Worked example: kinetic energy of loose objects

Item	Kinetic energy
0.5 kg part at 80 m/s	1.6kJ
10 kg wheel at 40 m/s	8kJ
10 kg wheel at 60 m/s	18kJ
20 kg wheel assembly at 60 m/s	36kJ

The third and fourth bars are the argument. A wheel at sixty metres per second carries more than twice the energy of the same wheel at forty, and a heavier assembly at that speed carries more again. No helmet is a plausible answer to that, and no visor is either.

The sport's response has three parts.

Tethers. Each wheel is tied to the chassis by high-strength fibre tethers, which have been progressively strengthened and multiplied since they were first required in the late 1990s. They do not always hold, because a suspension corner can be torn out in ways the tether cannot resist, but they have turned a routine event into an unusual one.

Helmet and visor standards. Helmets are certified to a motorsport-specific standard that includes penetration and ballistic testing, and an additional reinforcing strip was added across the top of the visor opening after a driver was seriously injured by a component that struck him there.

Frontal cockpit protection. Which is the halo, and which took nine years.

The halo: an ugly answer that beat every elegant one

Two accidents in 2009 set the problem. In a Formula Two race, Henry Surtees was killed when a wheel from another car struck his helmet. At the Hungarian Grand Prix a fortnight or so later, Felipe Massa suffered a serious head injury when a component that had come off the car ahead hit his visor. One was a large object and one was small, and both arrived from above and in front, which is the one direction an open cockpit has nothing in.

The FIA spent the following years testing options, and the order in which they failed is the interesting part.

A closed canopy solved the impact problem and created three worse ones. A transparent canopy strong enough to stop a wheel is thick, and thick transparent material distorts vision, particularly at the edges. It fogs, it collects rain and oil with no good way to clear either, and it traps heat. Above all it makes extraction slower at precisely the moment when a fire or an unconscious driver makes speed essential.

The Shield was a lower transparent screen ahead of the cockpit. It was tried in practice at a race weekend and abandoned almost immediately, because the driver reported that looking through the curved screen distorted and blurred what he saw. That is not a detail to be engineered away. A driver who cannot judge a braking point is not safe.

The Aeroscreen, developed by a team's technology arm, was a transparent fairing with a structural frame. It did not become the Formula 1 solution, but the idea did not die: a later version built around a halo-style frame was adopted by American open-wheel racing, where the higher risk of debris on ovals changes the calculation.

The halo won because it was the only design that met the load requirement without introducing a new problem. A structural bar does not fog, does not distort, does not trap heat, and can be jumped over or ducked under during extraction. The central pillar sits in the driver's line of sight and turns out to be far less intrusive than it looks, because it is close to the eyes and the brain treats it much as it treats a nose.

The engineering that matters is not the bar, it is the mounting. The halo is titanium, weighing roughly nine kilograms, bolted to the survival cell at three points, and it has to transmit an enormous load into that cell without either failing. The FIA's homologation test applies a static load from above that is many times the mass of the car itself, and the comparison the sport reached for repeatedly when explaining it was the weight of a bus. The chassis mounting points have to pass their own test, which is why the halo could not simply be bolted onto the previous generation of cars and why its introduction required a chassis regulation change rather than an accessory.

• 9Approximate mass in kilograms
• 3Mounting points on the survival cell
• 40Past accidents in the FIA simulation study
• 17Modelled increase in survival rate, per cent

Figures published by the FIA and the teams. The survival rate figure comes from the FIA's simulation of previous accidents and is a modelled result, not an observed one.

The objection was aesthetic and it was stated openly. The cars looked wrong. Open-cockpit racing meant something, and the halo was said to break it. Drivers, teams and a substantial part of the audience were against it. A former world champion who had spent decades campaigning for safety pointed out that seatbelts had been resisted on identical grounds and had been correct anyway.

It became mandatory in Formula 1 and the main junior single-seater categories in 2018.

Vindication took months rather than years. In a Formula Two race at Barcelona that season, one car landed on another and was stopped by the halo. At Spa a few months later, an airborne car passed directly over Charles Leclerc's cockpit and struck the halo. At Monza in 2021 a car came down on Lewis Hamilton's head area and was held off by it. At Silverstone in 2022, Zhou Guanyu's car overturned and slid inverted with the roll structure damaged, and the halo was between his helmet and the ground. In Bahrain in 2020, Romain Grosjean's car penetrated a barrier and the halo pushed the upper rail apart as it went through.

None of those required interpretation. That is unusual for a safety device, and it is why the argument ended so completely.

There is a coda that shows how the process is supposed to work. The roll structure failure in the Silverstone accident produced a revised roll hoop test, because a hoop that meets a load requirement and still fails in a real accident means the requirement was measuring the wrong thing. That is the system operating as designed, and it is the difference between the modern era and every era before 1994.

1. 1An accident exposes a gapSomething fails, or an injury occurs that the existing rules did not anticipate. This is still overwhelmingly how the process starts.
2. 2The data is recovered and analysedAccident data recorders, in-ear accelerometers, onboard video and the physical wreckage produce a measured account rather than an argument.
3. 3The failure mode is generalisedResearchers ask how many previous accidents shared this mechanism, which turns one event into a category worth designing against.
4. 4Candidate solutions are simulated against the archiveProposed designs are run against a library of recorded accidents to estimate how many outcomes each would have changed.
5. 5Prototypes face a homologation testA pass or fail standard is written, with defined loads, directions and durations, so that compliance is measurable rather than a matter of judgement.
6. 6The rule is written and resistedTeams object on cost or performance, drivers on comfort or appearance, and the regulator decides how much of that to absorb.
7. 7Adoption, then revision when reality disagreesThe device races. If it fails in a way the test did not predict, the test is rewritten, which is what a functioning safety system looks like.

The governance loop the FIA has used since accident data became routine. The reactive first step is the honest part: almost nothing in this sport has been fixed before it caused harm.

What is still unsolved, and why these problems are harder

The sport has become good at protecting a driver inside a car from an impact. The remaining problems are mostly about everything that is not the car.

People working at the trackside. Marshals stand close to a live circuit with minimal protection, and recovery vehicles have to enter the track to move stranded cars while a session is running or neutralised. In 2014 at Suzuka, Jules Bianchi struck a recovery vehicle in wet conditions and later died of his injuries. The direct outcome was the virtual safety car, a procedure that slows every car to a delta time without bunching the field, which gives recovery crews a controlled environment to work in. It reduced the exposure without removing it. A crane on a circuit is still a solid object in a place designed to have none, and the procedures around when recovery may begin remain among the most argued-over parts of how a race is neutralised.

Extreme wet weather. The limiting factor in heavy rain is not grip, which tyres and driving can manage. It is visibility. A modern car with high downforce throws an enormous volume of water into the air behind it, and a driver following at speed can be effectively blind. There is no rule that fixes this, only the decision not to run, which is why wet races are so often delayed or stopped. Prototype spray-reduction bodywork has been built and tested and has not yet been judged effective enough to mandate, partly because the water leaves the car from many places at once. This is a genuinely unsolved engineering problem, and the current answer is procedural: the flag signals and the red flag, which are the sport's admission that the officials stopping the session are the last line of defence.

Barrier performance in unusual geometries. Barriers are tested and installed for the impact angles a circuit designer expects. Accidents that arrive at unexpected angles, or that involve a car already airborne or inverted, are much harder to design for, and each one tends to produce a localised fix at that circuit rather than a general improvement.

The junior categories and everything below them. The halo reached the main single-seater ladder quickly. It has not reached every category of racing, and cost is a real constraint. A safety device that costs more than a club racer's entire car does not get fitted, which means the risk gradient across motorsport is steeper than it looks from the top. Financial regulation and safety are more connected than they appear, and the way the sport controls what teams may spend shapes which safety development gets funded and which does not.

The reactive nature of the whole thing. The most honest criticism of motorsport safety is not that it is inadequate. It is that it improves after harm rather than before it. Simulation and data have shortened that loop considerably, and the halo is the closest the sport has come to anticipating a category of accident rather than responding to a particular one. It still took nine years and a mandate imposed over the objections of the people it protects.

How to judge the next safety argument when it starts

There will be another one. Something will be proposed, it will look wrong on the car, and a large number of people will say so loudly. A few questions make it possible to have an opinion worth holding, and they apply to everything else in motorsport as well as to Formula 1.

Ask what the failure mode is. A safety device that is not answering a specific, described injury mechanism is decoration. The halo answers objects arriving at the head from above and in front. The HANS device answers a tension load at the base of the skull. If nobody can name the mechanism, be sceptical.

Ask what the test is. A published pass or fail standard with defined loads, directions and durations is the difference between engineering and a press release. If the claim is that something is strong, the useful question is strong against what, applied where, for how long.

Ask what it costs somewhere else. Every device introduces something. Canopies cost extraction time. Gravel run-off costs the risk of tripping a car. Stiff structures cost deceleration transmitted to the driver. The right answer is the one whose costs the sport can live with, not the one with no costs.

Ask whether the objection is about function or appearance. Almost every safety objection in this sport's history has turned out to be about appearance, comfort or identity, dressed up as a technical concern. That does not make aesthetic objections worthless, but it does mean they should be labelled honestly.

Ask who is still exposed. The driver is now the best-protected person at a race meeting. Marshals, recovery crews, photographers and spectators are not, and the next real advance is more likely to be about them than about the car.

The halo's history is useful precisely because it was so unpopular and so quickly proved right. The cars did look strange. They still do, slightly. That turned out to be the cheapest thing anybody has ever paid for a piece of safety equipment, and the argument only ended because the evidence arrived faster than the sport could keep complaining.