Andy Garcia · freelance dev
FRENES
Back to the blog
Engineering

One Loose Wire Blacked Out the Dali. Breakers Left on Manual Made It 58 Seconds Dark, Not 10.

October 20, 2026 8 min read

On November 18, 2025, the National Transportation Safety Board closed its investigation into the night the containership Dali brought down Baltimore's Francis Scott Key Bridge. On March 26, 2024, at 1:25 a.m., the 984-foot ship lost electrical power about 3,200 feet from the bridge, 3.3 ship lengths. Four minutes and nine seconds later, at 6.4 knots, it struck Pier 17. The main spans collapsed into the Patapsco River and onto the ship's bow. Six of the seven highway workers repairing potholes on the bridge died.

The Board's probable cause starts with a blackout "due to a loose signal wire connection to a terminal block stemming from the improper installation of wire-label banding," which left the ship without propulsion and steering close to the bridge. NTSB Chair Jennifer Homendy said finding that wire "was like hunting for a loose rivet on the Eiffel Tower."

I read the full report, MIR-25-40: 259 pages, dated November 18 and released in December 2025. I am not a marine engineer. I am CTO of a LegalTech built on Claude, I run systems other people depend on, and what held my attention was not the wire. It was every layer that should have caught it.

One note on scope. The NTSB determines probable cause; it does not assign blame. Neither will I.

How one wire takes out a ship

Simplified: the Dali's generators feed a high-voltage bus. Two redundant step-down transformers, TR1 and TR2, feed a low-voltage bus, which powers the lighting, the steering gear pumps and the main engine's cooling water pumps. A breaker called HR1 connects TR1 to the high-voltage side. HR1 stays closed only while a small device, its undervoltage release, receives 110 volts DC through a control circuit. Lose that voltage and the breaker opens: no control signal, no connection.

Wire 1 was part of that circuit. Its end carried a ferrule, a small metal tube crimped over the strands, pushed into a WAGO 280-681 spring-clamp terminal block, one of thousands aboard. When the ship was built, each wire in that panel got a heat-shrunk label sleeve. Wire 1's, marked "381", covered the ferrule's whole insulated collar. The extra thickness kept the wire from seating. In the NTSB's explanation, its tip could rest against the clamp's gate: enough to conduct, not enough to hold. The NTSB's lab found arcing on both the ferrule and the gate face, indicating a defective connection. When the contact broke, HR1 opened and the low-voltage side went dark.

The detail I keep rereading: nothing warned of the cause. To the ship's power management system, the wire coming loose looked like an operator opening the breaker on purpose, so it sensed nothing outside its safety parameters. The blackout set off a flood of alarms, none pointing to the cause. The fault had the shape of a legitimate command.

Investigators found it the patient way: they put the plant back in its March 26 configuration and waited. It blacked out twice more without warning before point-to-point wire checks found Wire 1.

The fallback was on manual

The Dali had a second transformer for exactly this case. In Automatic mode, HR2 would have closed and restored low-voltage power in about 10 seconds. That night, the breakers were on Manual. The operator, Synergy Marine, left the mode to the crew's discretion, and no regulation or guidance said which to use. In near darkness, the electrician worked out that only the low-voltage side was down and closed the breakers by hand, 58 seconds after the blackout. The NTSB calls that response timely. It also finds that Automatic would have cut the blackout from 58 seconds to 10. It would not have prevented either blackout.

The standby path had a quieter problem. TR1, the transformer whose breaker depended on Wire 1, had not been in use for at least seven months; the crew switched to it the day before the accident, after a blackout in port. While TR1 sat idle, the report notes, nothing would have shown the crew a problem with Wire 1. After the collapse, Synergy adopted a policy of switching transformers twice a year, which the NTSB describes as common industry practice.

A protection and a workaround that made it worse

Two other systems made a 58-second partial outage worse: one took away propulsion, the other caused a second blackout.

The main engine was configured to shut down on low cooling water pressure, and its cooling pumps ran on the low-voltage side. Eight seconds after the blackout, the engine stopped. The shutdown was "cancellable": someone on the bridge had six seconds to press a button. Amid a flood of alarms in a dark ship, the NTSB calls that unrealistic. The setting met classification rules when the ship was built in 2015. It protected the engine, and in the Board's words it "endangered the vessel." When power returned, the rudder moved again, but with no propeller wash over it, the ship could not be steered effectively.

Then there was the fuel. Two of the generators were fed by a flushing pump, a maintenance pump with no backup and no automatic restart. For at least seven months, by the chief engineers' account, the crew had run them that way, believing the proper supply lines held noncompliant fuel and would take days to clean. When power came back, the flushing pump stayed off. Just after 1:27, fuel pressure fell, the power management system disconnected the generators, and the ship lost high and low voltage at once. The NTSB found that Synergy's shore-side managers, in daily contact and with remote monitoring, were unaware of the arrangement, although a January 2024 email from the ship describing it had copied a Synergy technical manager. The NTSB calls that oversight inadequate, and the practice the cause of the second blackout, not the first.

The other end of the failure

The ship is half the report. The Dali's estimated impact force was over four times the lateral capacity of Pier 17, which was 5,509 kips, about 5.5 million pounds of force.

With the vessel collision method of AASHTO, the association of US state highway and transportation officials, the NTSB put the bridge's annual frequency of collapse at 0.0029, almost 30 times the 0.0001 threshold for a critical bridge: by my arithmetic, once every 340 years on average, against a threshold of once every 10,000. The bridge's owner, the Maryland Transportation Authority, had not run that assessment, which AASHTO recommended for older bridges but which was not required for one built before 1991. The port's harbor safety committee, a forum with no enforcement power, had carried pier protection in its action items since March 2006, when an MDTA representative said the bridge was not designed to withstand contact by a large vessel. In 1980, the Blue Nagoya, about a tenth of the Dali's displacement, hit the same pier, and the pier's fender stopped it.

Then the people. About a minute after the blackout, the pilot called his dispatcher to have the bridge closed, and police cleared it of traffic about 48 seconds before impact. The Board credits that with preventing more deaths. Nobody told the workers. The inspector had exchanged phone numbers with the officers, but they did not call him: they planned to drive onto the bridge to warn the crew once backup arrived. Notified when the officers were, the workers would have had 1 minute 16 seconds before impact, which the NTSB says may have been enough to reach a span that did not fall.

What I take from it

A ship is not a web service, and a blackout in a channel is not an outage. But the shape is familiar to anyone in production. As analogies, here is what I would check in my own systems:

  1. Exercise the standby. A backup idle for months keeps its faults until the day you need it. The twice-yearly transformer switch is a failover drill.
  2. Make a fault look different from a command. A process stopped by an operator and one that lost its connection should never write the same log line.
  3. Decide the recovery mode in writing. "At the crew's discretion" cost 48 seconds.
  4. Audit the protections that can stop everything. A guard that saves a component can sink the system, and a six-second override during an alarm storm is not an override.
  5. Find the flushing pumps: workarounds that became the normal path, unseen, the NTSB found, by the people watching daily.
  6. Protect the place that receives the failure, and warn the people closest to it first.

What the report does not show matters too. The NTSB could not determine exactly when Wire 1 backed out. It does not claim that Automatic mode, or any other single fix aboard, would have saved the bridge.

The legal track runs separately. In May 2026, the Justice Department announced criminal charges against two Synergy companies and the Dali's technical superintendent, with allegations that include the flushing pump and fabricated safety inspections. Prosecutors go further than the Board: they allege that with the proper fuel pumps the ship would have regained power in time, and that the superintendent lied when he told officials he was unaware of the flushing pump. Synergy answered that the NTSB had not counted it among the probable or contributing causes, and said it would vigorously defend itself. Those charges are allegations. In June 2026, the Dali's chief engineer entered a deferred prosecution agreement in which he admitted knowing about the flushing-pump arrangement and failing to report it to the Coast Guard as a hazardous condition. As of October 20, 2026, no criminal trial had taken place; in June 2026, a federal judge set it to begin on October 4, 2027.

One wire started it. Every layer after it was a chance to stop it, and the report shows which ones were set to manual, left idle, or never built.

Sources

A project like this one?

I design and deploy products like this. Let's talk.

Let's talk