MacBook Air randomly reboots

Question

Background

My wife has a 13" early-2014 MacBook Air which is left open and connected to the charger, running all the time. Periodically, I check that it's still on.

A couple of weeks ago, I started noticing, during these periodic checks, that it had randomly rebooted. This even seems to be corrupting data on the SSD, since the Dock appears to have gone back to its default state after one of these reboots. At one point, Disk Utility was showing errors, which I only managed to fix by going to Single User Mode. This suggests it's not a clean reboot at all.

Before the problem started, it was running macOS 10.13 and nagging me to update to 10.14. After the problem started, I decided to upgrade to 10.14 to see if the problem would go away -- it didn't. Yesterday I started up in Internet Recovery mode and reinstalled 10.14 (I didn't format the drive, just installed on top of the existing installation). I left the computer running yesterday night, and when I checked up on it today, it had rebooted.

Previous shutdown causes

Here is the output of log show --predicate 'eventMessage contains "Previous shutdown cause"' --last 45d:

Filtering the log data using "composedMessage CONTAINS "Previous shutdown cause""
Skipping info and debug messages, pass --info and/or --debug to include.
Timestamp                       Thread     Type        Activity             PID    TTL  
2019-01-12 17:25:22.864460-0200 0xa3       Default     0x0                  0      0    kernel: (AppleSMC) Previous shutdown cause: 3
2019-01-14 12:32:49.888312-0200 0xa3       Default     0x0                  0      0    kernel: (AppleSMC) Previous shutdown cause: 3
2019-01-15 17:35:21.823709-0200 0xa3       Default     0x0                  0      0    kernel: (AppleSMC) Previous shutdown cause: 3
2019-01-16 14:53:30.840756-0200 0xa3       Default     0x0                  0      0    kernel: (AppleSMC) Previous shutdown cause: 3
2019-01-17 11:57:39.851521-0200 0xa3       Default     0x0                  0      0    kernel: (AppleSMC) Previous shutdown cause: 3
2019-01-17 17:47:47.838771-0200 0xa3       Default     0x0                  0      0    kernel: (AppleSMC) Previous shutdown cause: 3
2019-01-19 07:52:35.923043-0200 0xa3       Default     0x0                  0      0    kernel: (AppleSMC) Previous shutdown cause: 3
2019-01-19 09:27:15.920187-0200 0xa3       Default     0x0                  0      0    kernel: (AppleSMC) Previous shutdown cause: 3
2019-01-20 10:13:24.824075-0200 0xa3       Default     0x0                  0      0    kernel: (AppleSMC) Previous shutdown cause: 3
2019-01-23 23:00:12.859981-0200 0xa3       Default     0x0                  0      0    kernel: (AppleSMC) Previous shutdown cause: 3
2019-01-25 11:16:21.884785-0200 0xa3       Default     0x0                  0      0    kernel: (AppleSMC) Previous shutdown cause: 3
--------------------------------------------------------------------------------------------------------------------
Log      - Default:         11, Info:                0, Debug:             0, Error:          0, Fault:          0
Activity - Create:           0, Transition:          0, Actions:           0

According to a list of shutdown causes, code 3 is a hard shutdown, such as when holding the power button for a few seconds. This is very strange, because:

1. Nobody performed this force shutdown procedure on the computer (to wit, a few of these shutdowns happened while nobody was at home, since we were traveling)

2. After a force shutdown, the computer is supposed to stay off unless you go and press the power button to turn it on again. Yet, when I went to check on the computer, it was already on (in a rebooted state, but on nevertheless).

I should note that the computer was cleanly rebooted quite a few times during the period shown above: as I mentioned, I upgraded to 10.14, later reinstalled 10.14, and also rebooted several times to try to solve an SSD issue that Disk Utility wouldn't repair (eventually fixed by going to Single User Mode). Yet none of these showed up in the log -- perhaps "regular" shutdowns are purged from the log after a while?

Output of pmset -g log

I ran pmset -g log and tried to correlate with the shutdown times above. The log started exactly after powering up from the second to last shutdown, at 2019-01-23 23:00:12, so before and after logs were only available for the last shutdown, at 2019-01-25 11:16:21. An excerpt of logs around that time follows:

2019-01-25 11:12:45 -0200 Kernel Client Acks  Delays to Sleep notifications: [RP03 driver is slow(msg: SetState to 0)(1277 ms)] [com_apple_driver_AppleUSBCardReaderDriverNub driver is slow(msg: DidChangeState to 1)(16151 ms)]           
2019-01-25 11:12:45 -0200 Assertions          Kernel Idle sleep preventers: IODisplayWrangler          
2019-01-25 11:12:45 -0200 Notification        Display is turned on                                                       

2019-01-25 11:12:45 -0200 Wake                Wake from Deep Idle [CDNVA] due to SPIT/User: Using AC (Charge:52%)           
2019-01-25 11:12:45 -0200 HibernateStats      hibmode=3 standbydelay=10800                                                         2         
2019-01-25 11:12:45 -0200 WakeTime            WakeTime: 0.651 sec                                                        

2019-01-25 11:12:45 -0200 Kernel Client Acks  Delays to Wake notifications: [AppleIntelFramebuffer driver is slow(msg: SetState to 2)(389 ms)]           
2019-01-25 11:12:45 -0200 Assertions          PID 79(powerd) Created InternalPreventSleep "com.apple.powermanagement.acwakelinger" 00:00:00  id:0x0xd0000995e [System: SRPrevSleep kCPU]          
2019-01-25 11:12:52 -0200 Assertions          PID 126(hidd) Created UserIsActive "com.apple.iohideventsystem.queue.tickle.4294968000.11" 00:00:00  id:0x0x90000997e [System: PrevIdle DeclUser SRPrevSleep kCPU kDisp]          
2019-01-25 11:13:03 -0200 Assertions          PID 79(powerd) Released InternalPreventSleep "PM configd - Wait for Device enumeration" 00:15:15  id:0x0xd00009953 [System: PrevIdle DeclUser SRPrevSleep kCPU kDisp]          
2019-01-25 11:13:03 -0200 Assertions          PID 79(powerd) TimedOut InternalPreventSleep "com.apple.powermanagement.acwakelinger" 00:15:15  id:0x0xd00009955 [System: PrevIdle DeclUser SRPrevSleep kCPU kDisp]          
2019-01-25 11:13:03 -0200 Assertions          Summary- [System: PrevIdle DeclUser SRPrevSleep kCPU kDisp] Using AC(Charge: 52)          
2019-01-25 11:13:08 -0200 Assertions          Summary- [System: PrevIdle DeclUser kDisp] Using Batt(Charge: 52)          
2019-01-25 11:13:30 -0200 Assertions          PID 79(powerd) TimedOut InternalPreventSleep "com.apple.powermanagement.acwakelinger" 00:00:45  id:0x0xd0000995e [System: DeclUser kDisp]          
2019-01-25 11:15:19 -0200 Assertions          Summary- [System: DeclUser kDisp] Using AC(Charge: 52)          
Sleep/Wakes since boot at 2019-01-23 23:00:44 -0200 :2   Dark Wake Count in this sleep cycle:1

Time stamp                Domain              Message                                                                    Duration  
Delay     
==========                ======              =======                                                                    ========  
=====     
UUID: (null)
2019-01-25 11:16:38 -0200 Start               powerd process is started                                                  

2019-01-25 11:16:38 -0200 Assertions          Summary- [System: No Assertions] Using Batt          
2019-01-25 11:16:38 -0200 Assertions          Summary- [System: No Assertions] Using AC(Charge: 50)       

Not sure if this is helpful information, but the charger was disconnected and then reconnected a few minutes later around that time (probably before the reboot), while the room was being cleaned.

Things I've already tried

• Running Apple Diagnostics: no errors found.
• "Log Out After..." setting: it was already disabled.
• Corrupted sleep image: although I didn't follow the procedure to recreate the sleepimage file, I did download an app called Deep Sleep which I used to force hibernate the computer. After pressing the power button to turn the computer back on, it showed the regular resume screen and went back to the exact state it was before hibernation, so I presume this isn't an issue either.
• Sometimes the charger is disconnected for a few minutes to clean the room. If the battery was failing, which wouldn't be so unusual in a computer this old, it might shutdown due to a power failure (although I find it hard to believe it would reboot instead). Still, to rule this out, I checked CoconutBattery, which reports that the battery was manufactured in August 2014, has 89 charging cycles on it, still holds 96.9% of its design capacity, and "macOS Battery status" is "Good", so I don't see any reason to suspect the battery. Also, in the last hour I have been using the computer unplugged from the charger, and it didn't reboot.

The questions

1. Are there other, more detailed sources of information regarding the reboot cause?

2. What else could shutdown cause 3 mean, apart from holding the power button until the system forcefully shuts down?

3. What else can I try to do to figure out the cause, or try to fix the issue?

Answer 1

I've encountered this previously with customers of mine. The Mac has two different sleep modes, sleep (powers down most everything besides the RAM, wakes instantly), and hibernate (writes RAM contents to sleepimage file, powers down everything, delay in wake due to loading of sleepimage contents back into RAM). By default, the Mac first enters sleep, and then after some time enters hibernation and then powers down. As you've experienced -- due to a number of possible issues beyond the scope of this post -- the process isn't always foolproof.

1st, let's get rid of a possibly corrupted existing sleepimage file. Normally, it's protected by SIP (System Integrity Protection) and not removable by a user without disabling that first (don't worry, we'll re-enable it afterwards):

1. shut down your Mac
2. boot into Recovery Mode by pressing-and-holding Command-R and pressing the power button
3. keep holding down Command-R until you see the Apple Logo
4. upon observing the main menu of options, open Terminal under the Utiiity menu and issue the following command: csrutil disable
5. reboot your Mac & log in
6. in Terminal, issue the following command: sudo rm /private/var/vm/sleepimage
7. enter an administrator's login password to authenticate

2nd, we'll want to reset the SMC. This controls things like power & sleep/wake settings, and also re-enables SIP:

1. shut down your Mac again
2. unplug any peripherals or USB devices from your Mac
3. plug the AC adapter in, and ensure you see the green or orange LED lit to indicate power is being received by your Mac
4. press & hold down the left shift, control, and option keys with your left hand, and press the power button once with your right
5. observe the LED change colors briefly to indicate the SMC has been reset
6. release the keys held down with your left hand
7. press the power button again to boot your Mac back up

Lastly, boot your Mac back up, log in, and we'll need to do one more thing. This should stop your Mac from powering off when it's been asleep (this also disables hibernation mode):

1. in Terminal, issue the following command: sudo pmset -a autopoweroff 0
2. enter an administrator's login password to authenticate

Now attempt to re-create your issue.

Note that resettting of the SMC will reset your sleep/wake/hibernate settings back to default (or whatever you have modified via Energy Saver preference pane in System Preferences. Also, any malfunctioning USB, Thunderbolt, or SD card equipment attached to your Mac may interfere with sleep/wake and power states, so I'd advise keeping everything else unplugged (aside from AC power) while testing.

Bonus info: sudo pmset -a hibernatemode n where n=0, 3, or 25 will change hibernation modes. 0 disables it ("normal" sleep only), 3 is default (sleep after whatever time you've set in Energy Saver, then switch to hibernate mode), and 25 always hibernates. You can view current settings via pmset -g.