The clock in the CCTV footage reads 16:47:24. This is the last second in which nothing is wrong.
Twenty minutes into the opening GT3 race, seven laps down, the field has stretched and clumped in the way a field always does: the fast cars gone to the front, the slower ones caught in traffic, and in the middle a compression of machines running within a length or two of one another, close enough that a driver's world is filled with the car ahead and the cars alongside. This is the ordinary texture of a race at this stage. The grid has settled. Fuel loads are still heavy — a GT3 car begins a race with its tank near full, and the seventh lap of a sprint burns off only a fraction of that — so the cars are at their most laden, their most reluctant to change direction, and they carry within their structure the largest volume of fuel they will hold all race. None of this is unusual. It is simply the condition of the car at that moment in the event.
The place is Turn 14. Not the back straight itself, as the earliest reports had it, but the corner the back straight feeds into. Portimão's long back straight — the circuit's fastest section, a run of well over a kilometre where the cars reach their highest speeds of the lap — throws the field toward a braking zone and a change of direction. A car arriving at Turn 14 has been travelling in a straight line, flat out, and must now slow and turn. It is one of the parts of a lap where the difference in closing speed between two cars is greatest, and where the margin for a misjudgement is smallest. This is not to say a mistake was made. It is to say what the geography demands.
At 16:47:24, according to the timing overlay on the footage Iberian GT Championship released on 2 October, Ilya Verkhovtsev and Tomás Errazuriz make contact and both lose control.
What that phrase contains is worth holding open. Verkhovtsev drives the No. 88 car entered by TBC by Voronin Racing. Errazuriz drives the No. 17 Ferrari 296 GT3 of Cordillera Racing. They are two of a hundred entries and two of a much smaller number of GT3 professionals, men who have driven cars at these speeds around corners like this one thousands of times without incident. Contact between two cars at the end of a long straight is one of the most common events in motor racing. It is a racing incident — a term of art meaning contact that the sport regards as a normal, if serious, part of what it is, not attributable to fault. No source consulted attributes blame to either driver. What the footage shows is that they touched, and that when two cars touch at that speed the touch does not stay a touch. A car whose line is disturbed at the exit of a high-speed straight has very little road left in which to recover. Loss of control means the car is no longer going where the driver is asking it to go. At that point the physics take over from the drivers entirely.
To lose control at the end of the Portimão back straight is to carry a great deal of energy in the wrong direction. A body in motion continues in that motion until something stops it. The cars slide off the racing surface and onto grass.
At the same second, 16:47:24, the marshal stationed at post 14 shows the double yellow flag.
This is the point in the sequence that the book must be careful to mark, because it is the point most easily lost. The system's first response was immediate. A double yellow flag is an instruction to every driver approaching that section: danger ahead, no overtaking, be prepared to stop, reduce speed. It is displayed by a marshal at a fixed post — a person standing trackside, one of the volunteer or semi-professional officials whose job is to observe their assigned stretch of circuit and communicate its condition to the drivers passing through it and to Race Control. The flag went out in the same second as the contact. The information travelled. There is nothing in the record to suggest the marshal at post 14 failed to see what happened or failed to respond. The failure, when it comes, is elsewhere in the system, and later, and of a different kind. The flag was fast.
One second later — 16:47:25 — Errazuriz's Ferrari strikes Aldán's car. Fire breaks out immediately.
Marco Aldán had done nothing. He was not in the collision at Turn 14. He was a driver in the No. 41 Ferrari 296 GT3 of Volta Corse, 36 years old, Portuguese, going about the ordinary business of the seventh lap, and a car that had lost control off the back straight arrived across his path. This is the geometry the footage cannot fully resolve: exactly where Errazuriz's car was when it left the surface, exactly what angle it carried across the grass, exactly where on Aldán's car it made contact. What can be said is what the timeline says. At 16:47:25 the two cars met, and in the same second the fire started. Not a wisp that grew. Not a smoulder that a marshal might have caught with an extinguisher before it took hold. The word the reporting uses, drawn from those at the scene and from the footage, is fireball. The fire was there at the instant of contact, and it was large.
The reason is in the design of the car, and the design of the car is worth understanding, because the fire is not an accident of bad luck laid on top of the crash. It is a consequence of the crash meeting the machine as the machine is built.
A GT3 car is, beneath its bodywork, a production sports car that has been homologated and rebuilt to a common technical standard so that Ferraris, Porsches, BMWs and the rest can race one another on roughly even terms. The Ferrari 296 GT3 is one such car. Like all of them, it carries its fuel not in a distant, isolated compartment but in a tank located within the structure of the car, in the region behind and around the driver. This placement is deliberate and is, in the overwhelming majority of cases, the safer choice: fuel carried low and central keeps the car's mass where the engineers want it, and a tank surrounded by the car's strongest structure is protected from most impacts. The tank itself is a fuel cell — a flexible, puncture-resistant bladder inside a rigid container, built to a standard specifically intended to survive impacts without rupturing. Fuel cells work. They have made fire in motor racing rare where it was once common. But "rare" is not "impossible," and the conditions under which a cell can be breached are precisely the conditions of this crash: a heavy fuel load, a side impact delivering a large amount of energy into the region of the car where the fuel is held, and enough of that energy converting to heat and spark to provide ignition at the same instant as the breach. When those things coincide, the fire does not spread to the cockpit. It is already at the cockpit. The driver is not near a fire that is approaching. The driver is inside it.
And the cockpit, which is the thing that saves a driver in almost every crash, becomes in this specific case the thing that holds him in place.
The survival cell — the rigid central structure in which the driver sits — is the single greatest reason drivers walk away from enormous impacts. It is built not to deform. Everything around it is designed to crush and absorb; the cell is designed to keep its shape so that the space around the driver's body is preserved. This is why a modern racing driver survives crashes that would once have killed him. But rigidity that resists the outside also resists the inside. A cell built not to deform is a cell that will not spring open, will not tear, will not offer a driver a gap that was not designed into it. The way out is the way in: the door, and the releases, worked by a driver who is conscious, oriented, and physically able to work them.
The restraints are the same. A racing driver is held by a six-point harness — belts over both shoulders, around both sides of the waist, and up between the legs, meeting at a central buckle. The harness is engineered to hold the body immovable in a crash and to release with a single deliberate action, a turn or a lift of the buckle, so that a driver who needs to get out can get out in seconds. Over that, the driver wears a HANS device — a head-and-neck support, a collar-and-tether system that ties the helmet to the shoulders and prevents the head from being thrown forward in an impact, the single piece of equipment most responsible for the near-elimination of the basal skull fractures that once killed drivers routinely. Every one of these systems is a deliberate-release design. Every one assumes a driver who can operate it.
The assumption failed. Aldán's helmet visor was broken by the impact. His HANS device was snapped. He suffered a severe concussion and was unconscious for more than an hour. His own account, given later, marks the boundary of his knowledge precisely: he does not remember anything from thirty seconds before the crash to one hour after it. The driver the cockpit was built to release was, in the seconds that mattered, not able to release himself. He was where the design put him, held by restraints that would not release themselves, inside a structure that would not open itself, and the fire was already there. This is not narrated from inside his experience, because he has no experience of it to give. He was not there to it. The horror is in the mechanics, not in a mind that recorded nothing.
At 16:47:37 — twelve seconds after the fire started — Race Control shows the red flag.
A red flag stops the race. It is the most serious instruction in the sport: every driver must slow immediately and return to the pit lane or a designated safe point; the session is halted. But it does more than stop cars. In the same act, Race Control alerts the whole apparatus of response. The record of what was called is specific: marshals, firefighters, rescue vehicles, fire trucks, medical vehicles, rapid response, ambulances. The full weight of the circuit's emergency provision was summoned at 16:47:37, twelve seconds after ignition. This race did not resume. It was stopped at that second and it stayed stopped.
Twelve seconds, to summon everything, is fast. Here again the system's information moved quickly. The flag at post 14 was immediate; the red flag was twelve seconds behind the fire. Judged as a communication chain — the marshal seeing, the message reaching Race Control, Race Control acting — the front of the response performs as a well-drilled system should.
But a flag is an instruction, not an arrival. A red flag summons vehicles; it does not place them. Between the command shown on a light panel in Race Control and the presence of an extinguisher at the side of a burning car there is distance to be covered and time in which to cover it, and during that time the fire does not pause for the apparatus to reach it. The clock that started at 16:47:25 does not stop when Race Control acts at 16:47:37. It keeps running. It runs through the twelve seconds to the red flag and it keeps running afterward, and everything summoned at 16:47:37 is, at 16:47:37, somewhere else — approaching, but not there. In that window there is a burning car, a driver inside it who cannot get himself out, a marshal at post 14 who has done his job with a flag, and the whole rest of the response still in transit.
At 16:47:41 — sixteen seconds after the fire started, four seconds after the red flag — a car that has been running in the race slows and stops in the run-off area beside Turn 14.
A run-off area is the graded space, usually asphalt or gravel, laid outside a corner to catch cars that leave the circuit, giving them room to slow and stop. It is where a driver goes when something has gone wrong and he needs to be out of the way of the racing line. A car stopping there is not, in itself, unusual. But this car has not spun and it has not broken. Its driver has seen what is ahead of him, and he has chosen to stop. The apparatus has been called and has not yet arrived. The clock reads 16:47:41. A competitor gets out of his car and begins to walk toward the fire.