Without Warning

It had a cocktail bar in its belly, and propellers a mechanic checked with a hammer after every flight.

Boeing built 56 Stratocruisers between 1947 and 1950, and that was the entire fleet. At least 10 of them were destroyed in accidents. Roughly one in five, and 139 people died aboard them.

The Boeing 377 was the most luxurious airliner of its era. A spiral staircase led down from the main cabin to a 14-seat lounge with a bar, in the belly of the airplane, over the middle of the ocean. Upstairs, the seats folded out into curtained berths.

Underneath all of it was a bomber. It flew on four Pratt & Whitney R-4360 Wasp Majors, and those engines were a maintenance nightmare. The propellers were what killed people.

Pan American, BOAC and Northwest chose Hamilton Standard propellers with hollow steel blades, because lighter meant range. The hollows were packed with glued-in neoprene. In service it worked loose and was flung out to the tip, where the imbalance could tear the tip off. Sometimes it took the whole blade.

At Pan American the answer was a man with a hammer, tapping each hub after every flight and listening to the note it rang.

Not every crash was the propellers. Four of the eight fatal ones had nothing to do with them. Those that did had a pattern, and the worst Stratocruiser accident of all, over Brazil in 1952, killed all 50 people aboard.

The part of this that stays with you is that none of it was hidden. When the regulator finally ordered the hollow blades off, in late 1958, its own directive described years of exceptional maintenance as something the industry was already doing.

No Stratocruiser fleet was ever grounded. The propellers were the mechanism. The luxury is why nobody stopped.

In the early hours of October 16, 1956, a propeller on Pan Am Flight 6 ran away over the middle of the Pacific and would not feather. Thirty-one people were aboard, there was no runway within 1,000 miles, and the fuel would not reach land in either direction.

Captain Richard Ogg chose to wait for daylight.

In this episode:

• Champagne down a spiral staircase
• Hollow blades and a hammer
• Roughly one in five
• An armed standoff in the Amazon
• Known, managed, never grounded
• The propeller that would not feather
• Waiting for daylight
• The Pregnant Guppy

Two men sat in the dark under a mountain in Nepal for nine days. No food. No light. The water they drank was mud, strained through cloth.

They had no way of knowing whether anyone above them was still looking.

Forty-five people went underground at the Upper Trishuli 3A power station on the morning of August 26, 2026. On a normal day there would have been five or six. The plant was down for its scheduled annual maintenance, so the crews were in.

Nine times the usual number, on one specific Wednesday, for one entirely ordinary reason.

At 8:37 that morning, a mass of rock and ice came off the north face of Langtang Lirung and fell 1,200 metres onto the valley floor.

There was no glacial lake above them. Nothing burst. The mountain made the water on the way down, melting its own ice as it fell and picking up rock as it went, until what was moving down the gorge was a flood full of boulders travelling at close to 180 kilometres an hour.

The seismographs read it as a magnitude 4.4 earthquake. It took sixteen hours to correct that.

The river gauge nearest the source transmitted one last time at 27 percent of its own warning level, then stopped existing. The next one down was destroyed at 87 percent. Neither ever crossed the line that would have triggered an alarm.

Upstream the flood outran the instruments. Downstream it killed people while reading as normal.

What fills a flooded headrace tunnel is not water. Searchers who crawled in found mud and soil and sludge in every section. A drone pilot said some tunnels were filled with mud like toothpaste in a tube.

So how does anyone breathe in that.

The answer is the shape of the building. The tunnel climbs and dips along its length, and at the end of it sits a machine cavern thirty metres floor to arch. Flood a structure like that from below and the air in the high sections has nowhere to go. It gets compressed and held, the way air is held in an upturned glass pushed under water.

Sanjay Sah never used the phrase air pocket. He said he spent two or three days sitting in the ventilation, and his family later said he had climbed the inside of the structure floor by floor until he reached a level the water did not reach.

There was not one grain of food. He drank muddy water mixed with earth and engine oil, filtered through cloth.

Rescuers spent almost six days at that site just locating the tunnels. The topography had changed so completely that they worked from satellite imagery and engineering drawings to find the entrances to their own power station.

On August 30, ninety people cut a hole in the tunnel crown, rappelled in, pumped air down, sent food, and called out.

Nothing answered.

Five days later, at two in the morning, a team working its way in reached a large cavity and shouted into it.

A voice came back.

In 1978 a Boeing 747 scraped its tail on a runway in Osaka. The repair that followed killed 520 people seven years later.

It is still the deadliest single-aircraft accident in history.

The fix itself was written correctly. A Boeing engineer specified one wide splice plate, wide enough to take two rows of rivets.

What actually got installed was one narrower plate and a filler strip. Along about a metre of that joint, a seam meant to be held by two rows of rivets was held by one.

That was the whole thing. One row doing the work of two.

Then the edge was sealed, the way every joint on that bulkhead was sealed, and from that moment the right repair and the wrong one looked identical. Japan's accident board later used a single word for whether anyone could have spotted it by eye. Impossible.

The aircraft flew 12,319 more times.

Every takeoff pressurised the cabin and pushed against that seam. Every landing let it relax. Cracks started at the rivet holes, too small to see, and grew a fraction of a hair per flight. Investigators later counted the growth lines under an electron microscope, one line per pressurisation, and read about ten thousand cycles off the metal.

On August 12, 1985, twelve minutes after takeoff from Haneda, the joint let go.

The decompression blew the tail cone off, burst the vertical fin from the inside, and severed all four hydraulic systems at once. Most of the fin fell into Sagami Bay.

The crew never knew that. The only damage report that ever reached the cockpit said a baggage area at the back had come down.

What they had left was four throttles and two switches.

They flew it for thirty-one minutes and fifty-four seconds. Unpressurised above 20,000 feet, where the board later showed in a chamber test that memory goes before arithmetic does, and memory was exactly what three men needed to work out what had happened to their aeroplane.

Afterwards the board put four crews of instructor-grade captains in a simulator rigged to reproduce the failure. Rested, warned in advance, breathing normally, no cabin to manage, no radio to answer. Every one of them crashed on the runway.

Asked to score how flyable the aircraft had been out of a hundred, they said:

Zero. Zero. Zero. Five. Ten. Twenty.

Four people lived. One of them, an off-duty flight attendant, lay in the wreckage through the night and heard many people breathing around her in the dark. By dawn she heard nothing. Rescuers reached the ridge thirteen hours after impact, because for most of that night the crash was being reported as three different mountains at once.

On the morning of May 15, 1929, a room in the basement of the Cleveland Clinic began to smoke.

Until the year before, it had been the coal vault. About 123 people died. Almost none of them burned.

The building was four stories of brick and reinforced concrete, advertised as fireproof. It kept its X-ray negatives in two places, and that is the whole story. Current film sat on the first floor behind an approved fire door, exactly what the regulations asked for. The old film went in the basement, into the room the coal had come out of.

Brick, windowless, and with no vent to the outside air of any kind. Wooden shelving packed solid with negatives stacked on edge, a high-pressure steam main running to within seven and a half inches of the nearest shelf, bare light bulbs on cords. And a pipe tunnel that circuited the basement and carried pipes up into every floor of the building, opening directly into the corner of the room.

Nobody could say how much film was down there. The engineers who surveyed it afterward put it at about 70,000 sheets, and wrote the sentence that explains the whole disaster. The number of films in the room was unknown, even to the X-ray department employees.

Here is the fact almost every retelling of this story leaves out.

Burned in the open air, nitrate film is not poisonous. The man who wrote the storage rules for this exact material established it: burn it freely in an excess of air and what comes off is carbon dioxide, nitrogen and water vapour. It is a severe fire. It is not a gas attack.

The poison is what happens when the film cannot get air. Starved, it breaks down instead of burning, and what comes off is carbon monoxide and the oxides of nitrogen.

The Clinic did not store a poison in its basement. It stored a fire hazard, and then built the one container that turns a fire hazard into a poison.

That container had been against the rules for four years. Since 1925 the standard had named hospitals specifically: a vented room, sprinklers, a working fire door, film kept away from heat. The basement room failed every one.

At about nine that morning a steamfitter was called down because the line running through the film room was leaking. He stripped fourteen inches of insulation off it, had the line drained, and went back to his shop to let the pipe cool, leaving a bare steam main seven and a half inches from two tons of nitrate film, in a brick room with no ventilation.

At about eleven he came back. The room was full of smoke, a yellowish cloud about five feet square, hanging in the corner near the ceiling.

Then the gas found the tunnel. It did not seep under doors. It went up inside the walls and out through the openings cut for the plumbing, and in room after room it arrived from the hole behind the washbasin.

Out on the street, a man named Joseph Stanley watched a four-story building full of people struggling at the windows, and not one of them calling for help. It was the silence, he said, that was the horrible feature. He did not understand it until he smelled the fumes.

The part that stays with you is what came afterward. What killed the ones who died later was nitrogen dioxide, and it could because it does not hurt on the way in. Chlorine and ammonia dissolve in water and scald the throat at once, driving people out into the air. Nitrogen dioxide does not. The victim keeps breathing it, and it reaches the smallest passages of the lungs before it does anything at all.

Six years earlier, X-ray film stored in the basement of Boston City Hospital was ignited, presumably by an electric light bulb. A hospital. A basement. Stored X-ray film. A light bulb. Patients on the floors above.

That basement had sprinklers in it. The sprinklers put the fire out. Nobody died.

The largest passenger helicopter in the world worked a shuttle run over the North Sea, carrying 44 men at a time.

On November 6, 1986, one of them came apart in clear air two and a half miles from the runway at Sumburgh, in Shetland, in sight of land. Forty-five men died.

No civil airline helicopter accident anywhere in the world has ever killed more people.

A Boeing Vertol 234 carries a rotor at each end, sixty feet across, and the two discs overlap. The blades never touch because they are geared: a shaft runs the length of the aircraft, tying front rotor to back rotor in a fixed relationship, so a blade at the front always crosses the overlap in the gap a blade at the back has left.

Lose that relationship and the blades try to occupy the same space. Boeing later calculated that if the front rotor gained the equivalent of one tooth, they could clash in a second and a half.

That relationship was set by a ring gear in the nose, bolted face to face onto its shaft with a thin spacer clamped in between. The bolts did not carry the drive. Friction between the clamped faces carried it, and the bolts only made the pressure. So everything that ever went wrong with that joint came back to one question: was it tight enough.

By 1984 that tightness had to be checked every 300 flying hours, which is nothing on a daily shuttle. The report calls the check, in its own words, a considerable operating penalty. So the manufacturer set out to design it away, and put a gearbox on a test rig for 150 hours to qualify the redesign. The overhaul life of a forward gearbox was 2,150 hours, so the qualifying run covered about seven per cent of one cycle.

And the gearbox bolted to that rig was not a forward gearbox. It was an aft one, from the other end of the aircraft. One run on the aft was taken to qualify both ends. Nobody, at any point before the accident, tested a forward gearbox with a modified gear inside it. The rig ran dry, no salt and no moisture.

The modified gear went into this aircraft on October 18, 1985.

Just over a year later, four and a half miles out and cleared to land, the co-pilot said something almost conversational. "Seems to have got very noisy in here all of a sudden."

Investigators found that noise across the entire thirty minutes the recorder held. What changed, 62 seconds before the end, was that one part of the signature became permanent.

That was the gear breaking. Chloride from the sea air had reached the gap between the two clamped faces and turned it into a corrosion cell, cutting a steep-sided groove into the steel, in a space no inspection could reach. Fatigue cracks grew out of that groove and around the flange until the rim sprang open about three quarters of an inch. In the geometry of a gear, that is roughly one tooth.

The rotors began to drift out of step.

The part of this that stays with you is the inspection. The bolts in that gearbox were checked twice after it was modified, the second time thirty-two days before it fell into the sea. No loss of torque either time. And when the wreckage was stripped at Farnborough, all but two of the readings still came off above the threshold Boeing's own manual required for a unit to stay in service.

Even laid out in a hangar, by Boeing's own standards, it would have passed. The inspection had not been skipped and it had not been falsified. It was measuring the tightness of bolts while, underneath the spacer those bolts clamped, a groove none of them could reach was cutting the gear in half.

Nobody was ignoring a warning. There was no warning to ignore.

A bronze nut inside the tail of an MD-83 was designed to wear out.
Nobody had measured it in two and a half years.

On January 31, 2000, Alaska Airlines Flight 261 fell into the Pacific off Anacapa Island. Eighty eight people died. The part that failed was doing exactly what it was built to do.

The tail surface of an MD-80 pivots on a steel screw threaded through a bronze nut. Steel is hard, bronze is soft, so the nut wears down instead of the screw. Douglas built it that way on purpose in 1965, and wrote it into the design paperwork.

Which meant the whole assembly rested on two routine jobs.
Grease it. Measure how much of it was left.

• How a single 1965 design decision left an airliner's tail resting on two maintenance checks
• Why Alaska Airlines was the only major U.S. carrier flying this jet with no flight hour limit on either task
• The two measurements taken three days apart in September 1997, and the replacement that was never ordered
• Ten minutes over the Pacific: a jammed trim, an 8,000 foot drop in eighty seconds, and a captain who thought he had thirty minutes to spare
• What investigators found when the tail came up from 700 feet of water

This is the story of Alaska Airlines Flight 261, one of the clearest cases in aviation history of a system that worked exactly as designed, and failed anyway.

Listener discretion is advised. This episode covers a fatal aviation accident.

New episodes cover major disasters and the decisions behind them.
[Add your follow / subscribe links here]

Armero was a Colombian city of around twenty thousand people. Five banks, two cinemas, two hospitals, four parks, a colonial church with a bell tower.

They called it the White City, for the cotton fields that turned the valley white at harvest.

By midnight on November 13, 1985, eighty five percent of it was under mud and more than twenty thousand people were dead.

The volcano was forty seven kilometres away. Nobody in Armero had seen it erupt in their lifetime.

But Nevado del Ruiz had done this to the valley twice before.

In 1595, and again in 1845, when a thousand people died in a flood of thick mud that came down the Lagunillas river. A naturalist named Joaquín Acosta wrote it all down, and then wrote a second letter five years later pointing out something nobody wanted to hear.

The villages down there had been built on the hardened mud of the last one. The people living in them had no idea what the ground under their feet actually was.

Armero was founded fifty years after he wrote that. On the same deposits. Beside the same river.

Here is what makes this one hard to watch.

Everything needed to save that city existed on paper before the eruption.

• A hazard map, published in October, naming Armero as a maximum risk zone and giving it two hours of warning time. It was printed in ten copies.
• A report putting the probability of a lahar in those river channels, during any eruptive phase, at one hundred percent.
• A civil defence director who stood up in the museum in Armero in September and told a packed room the mud was coming. The room told him to shut up before he devalued their land.
• And the mayor, who had spent six months phoning newspapers in Bogotá about a time bomb fifteen kilometres upstream. The governor of Tolima reportedly told him not to talk about the Armero matter because he did not have time.

The meeting where the mayors were going to coordinate the evacuation was scheduled for Friday, November 15.

The mountain went on the night of Wednesday the 13th.

At 9:08 that evening, pyroclastic flows poured onto the glacier at the summit. Ten percent of the ice cap melted in minutes. Twenty million cubic metres of water came down the mountain, picked up rock and old volcanic deposits on the way, and turned into four mudflows moving at up to sixty one kilometres an hour.

In Armero, the church loudspeaker had been telling people to stay calm all evening. A fire truck drove the streets at six telling everyone to stay in their houses.

The evacuation order reached the town around 10:30.

The first wave hit just after eleven. The main one came at 11:30, and it had been forty five metres deep at the canyon mouth two and a half kilometres upstream. One survivor described it by his neighbour's headlights as thirty metres of black mass coming toward him. Another said it sounded like standing on a runway under a departing plane.

In 1994 Colombia's highest administrative court ruled the state was not liable. Force majeure. The reasoning came down to one line: no one is obliged to do the impossible.

The volcanologist who spent four years going through the telexes and the meeting minutes reached the opposite conclusion. Not an overwhelming eruption, not bad luck. Cumulative human error. He wrote that Armero could have produced no victims.

On the night of July 5, 2013, a train was parked on a hill outside a small town in Quebec.Seventy two tank cars of crude oil. Ten thousand tonnes.The engineer had shut it down and gone to his hotel. That was normal. It had been parked there most nights for a year.At 12:58 in the morning it started rolling downhill on its own, with nobody on board.Seven miles later it came into Lac-Mégantic at sixty five miles an hour, on a curve built for twenty. Sixty three cars came off the track in the middle of downtown. Six million litres of oil poured into the streets and caught fire.Forty seven people died. Five of them were never found.The thing about this one is how ordinary every single step was.The lead locomotive had a cracked engine part that should have been rebuilt. The shop patched it with epoxy instead and sent it back out.The tank cars were an old thin-walled design that investigators in two countries had been warning about for years. Sixteen months earlier, American investigators had formally asked for them to be replaced on this exact kind of cargo.The oil was shipped under a label saying it was hard to ignite. Nobody had tested it. It was closer to gasoline.The engineer set seven hand brakes for the night, then ran the test to check they would hold. But he left the engine's air brakes on while he tested. So of course it held. The air brakes were doing the work. He needed fifteen to twenty hand brakes, and he had no way of knowing that.Then the locomotive caught fire around midnight, and the volunteer fire crew put it out correctly, by shutting the engine down.Shutting the engine down also stopped the compressor keeping the air brakes charged.Nobody at the scene knew that. The railway sent a track foreman who had no locomotive training. He saw the fire was out and reported everything was fine. The engineer phoned and asked if he should come back up the hill. He was told no.Air leaked out of the brakes at about one pound a minute for the next hour. Too slow to trip anything. Fast enough to matter.Investigators found eighteen separate factors. Remove almost any one of them and the train stays on the hill.The company was bankrupt within a month. It had carried twenty five million dollars of insurance against a cleanup that ran near two hundred million. Three local rail workers stood trial and all three were acquitted. No executive was ever charged.The bypass that would route the oil trains around the town was promised right after the fire. It still is not built. The trains still come through downtown, several a day, through the same curve.

On May 25, 1979, a DC-10 lifted off from Chicago O'Hare bound for Los Angeles. It was airborne for thirty-one seconds. 273 people died. Within twelve days, every DC-10 in the country was grounded. It is still the deadliest aviation accident in United States history.

The engine that fell off the left wing was not the beginning of this story. It was the end of it.

The DC-10 was built by a company that had been weeks from bankruptcy in 1967, under one priority: get a wide-body into service before Lockheed could finish theirs. Three decisions made under that pressure would matter years later.

Its cargo door could appear locked when it was not, and the warning light in the cockpit was wired to the handle rather than the pins. Its wing slats were held out by nothing but trapped hydraulic fluid — no mechanical latch, no backup. Boeing and Lockheed both fitted locks. McDonnell Douglas did not. And each engine hung from three small bearings, the rearmost one mounted in a thin plate called the aft bulkhead.

1972 — Windsor, Ontario. An American Airlines DC-10 lost a cargo door mid-flight. The floor collapsed, the control cables were cut, and the only reason anyone lived is that the captain had paid out of his own pocket for simulator time teaching himself to fly the aircraft on engine thrust alone.

The FAA drafted an emergency directive to force a redesign. It was never issued. A phone call that summer between the head of the FAA and the president of Douglas Aircraft replaced it with voluntary service bulletins — so the fix would not be mandatory, and the DC-10's sales position against Lockheed would not be harmed.

Fifteen days after Windsor, an engineer at the company that built the fuselage sat down and typed a memo. The door had been a known problem since ground testing in 1970. Given enough time in service, it would fail again — and the next time, the airplane would be lost.

His supervisor agreed with every word. Then wrote back that raising it would expose the company to liability. He called it "an interesting legal and moral problem."

The memo went in a filing cabinet.

Twenty months later, a Turkish Airlines DC-10 fell out of the sky outside Paris with 346 people on board. Same door.

The crash at Chicago was something else again — and it started in a maintenance hangar in Tulsa on the night of March 29, 1979. American had worked out a shortcut that saved 200 man-hours per aircraft: lifting the engine and its pylon off the wing in one piece on a forklift, instead of separately. McDonnell Douglas said it did not encourage the procedure. The FAA was never told at all.

That night, the shift removed the rear bolt and went home, leaving the engine resting on the forklift. The forklift bled down under the weight. By morning, metal was touching metal that should never have touched.

Nobody reported it. The aircraft flew for eight more weeks.

What happens after the engine leaves the wing is the part that stays with you. The crew did everything correctly. The first officer flew the exact climb speed the book gave him for an engine failure — and that speed was below the stall speed of a wing whose slats had just retracted. His stall warning was dead. His slat disagreement light was dead. The captain's flight director and the radio were dead. All of it ran off the bus the missing engine had powered.

They had no way to know.

In the tower, a controller watched it start to roll and said: "He's gonna lose a wing."

On the morning of March 10, 1906, 1,664 men and boys went down four coal pits in northern France. 1,099 never came back up. Three weeks later, thirteen of them walked out on their own. The search had been called off two and a half weeks earlier. The engineers had already told everyone there was nobody left alive down there.

Courrières was not a mine with a bad reputation. It had taken a high distinction for the safety of its installations at the Paris World's Fair in 1900. In more than fifty years of digging, firedamp had never once been recorded in its workings. So the mine was officially classified as non-gassy, and the order requiring safety lamps never applied to it. The men worked by open flame.

There were two other things nobody had thought about. The company did not run its pits as separate mines. Pits 2, 3 and 4 all sat on one continuous haulage road, sharing the same air across roughly 110 kilometres of connected tunnel. Nothing about the layout was designed to contain anything.

And coal dust is not gas. It lies on the floor and the ledges of a working mine the way flour lies in a mill. Suspend enough of it in air, give it a flame, and it burns as a moving front that pushes air ahead of itself and lifts more dust off the floor to feed on. It makes its own fuel as it travels.

Four days before the disaster, a fire started in the Cécile seam. They sealed it behind seven stone dams and sent everyone back to work. The pit's own safety delegate, a miner named Pierre Simon, asked that nobody be sent down while it was still burning. He was not heeded.

At 6:45 on the 10th, the engineer fighting that fire ordered 125 men brought back up. He did not like the look of it. Minutes later, the mine detonated.

A cage was thrown clear out of the headgear at pit 3. At pit 4, a pit horse went ten metres into the air. Underground, the flame front ran the length of the main gallery and carried into two more pits, and in the roadways above and below it, where the fire never reached, the men died of what it left behind.

By half past seven, survivors began reaching the surface. About five hundred came up. All of them from the edges of the field. Nothing came up from the middle.

Three days in, the searching stopped and part of the mine was walled off.

Then March 30. Thirteen men climbed out of pit 2 at eight in the morning. The youngest was fourteen, the oldest forty-four, and two of them were father and son. They had lived on bark cut from the crossbeams, then on a rotting pit horse, drinking water off the walls and, when that ran out, their own.

Five days after that, a miner named Auguste Berthon walked out of pit 4 alone, twenty-five days after the blast. He had not been found. He had tipped a coal tub on its side to make a shelter and worked his way out.

Nobody was ever convicted. Three courts heard it over three years.

But this is the disaster that changed coal mining everywhere, because it proved that a mine with no gas in it can still explode like one that has.

One more thing. The French word for a survivor, rescapé, came out of this coalfield. It was a local Picard word until reporters heard the villagers using it and printed it, and it belongs to men who walked out of the ground after everyone had stopped looking.