As thousands looked on nervously from below, the tethered tourist balloon at Port Discovery stalled during a wind squall over downtown Baltimore yesterday afternoon, leaving its 17 scared occupants stranded 200 feet above ground and buffeted by high gusts until they were finally lowered to safety after nearly two hours in the air.

Four sightseers were hospitalized with non-life-threatening injuries suffered when the balloon, in the ordeal's most terrifying moment, was whipped against the air conditioning shed on the top of the city police headquarters. The impact threw the passengers, who included five children, against the side of the steel gondola.

I thought we were going to die when we hit that building. We didn't just glance it; it was a crushing blow," said Bryan Dorland, a Naval Observatory astronomer from College Park who was on the ride with his 10-year-old daughter. "I was in the Marine infantry, and that was the first time I felt I was going to die."

For many watching below, the scene was eerily reminiscent of another recent accident involving a Baltimore tourist attraction, the fatal capsizing of a Seaport Taxi on March 6 in the city's harbor, which took five lives. Here, again, tourists had set off for what was supposed to be a routine ride on a sunny Saturday afternoon, only to see rough weather blow in the potential for disaster.

The balloon, which is operated by Balloon Over Baltimore Inc., a nonprofit organization separate from the Port Discovery Children's Museum, went up for its 20-minute ride in a slight breeze shortly after 3:30 p.m. As it climbed to about 200 feet, high winds suddenly swirled in, swinging the colorful 4-ton, 110-foot-high balloon around on the wire cable that tethers it to a large yellow winch next to the museum.

The balloon swung so wildly that the computer controlling the 10-ton winch and balloon lost track of the balloon's location. This in turn caused the 55-horsepower engine on the winch to shut down, in what the balloon's chief operating officer, Mark Rosenberg, described later as an automatic safety response.