You pressed the Power button on your Mac, and nothing happened. It didn’t show signs of starting up, so is it dead, or just pretending? The distinction might seem obvious until you consider DFU mode.

Power reaching the Mac, no sign of life

Simple mains/AC power problems have caught many out: if your Mac isn’t showing any signs of life when it should, ensure that power is reaching it in the first place. Never put yourself at any risk of coming into contact with any live cable, though. Good checks are to verify that the mains socket/receptacle delivers power correctly to another system, and that the Mac’s power cable also does its job. If you’re in any doubt about the electrical safety of either, stop immediately, make everything safe, and obtain professional advice.

If you’re confident that power is going into your Mac, the next and more difficult question is whether the Mac’s hardware is dead, or it has entered DFU mode. DFU mode is the fallback for all Apple silicon Macs that encounter a problem early in the boot process, whether it’s in ROM or later stages before the kernel starts. This also applies to Intel T2 Macs that encounter problems when loading iBridge firmware for their T2 chip, as explained below.

Is it in DFU mode?

Most Apple silicon Macs and T2 models that have entered DFU mode show no obvious signs of life. This is even true of MacBook Pro models with MagSafe 3 power cables: in DFU mode, their LED doesn’t light up. Neither will a notebook keyboard light, nor is there normally any indication that a built-in display has power. Built-in trackpads also feel dead.

Notable exceptions to this are:

• Mac Studio and Mac mini, whose power status indicator light should display amber;
• Mac Pro, whose status indicator light should display amber and may flash.

For all models, once they have connected successfully to a second Mac in DFU mode, you should see the Apple logo and a progress bar on any connected display during IPSW download.

For the Mac Pro, the status indicator light will flash amber in different patterns as a result of memory, PCIe card and other faults. Apple explains those separately for the Mac Pro 2019 and Mac Pro 2023.

DFU mode is detailed by Apple in this support note.

Spontaneously entering DFU mode should be a very rare event, but in most cases the only way to determine whether it has happened is to connect the Mac using an appropriate USB cable to another Mac running recent macOS, which should then connect to the Mac that’s in DFU mode. If that’s suspected, try a firmware Refresh in the first instance to see if that occurs, as that’s non-destructive of the internal SSD’s contents.

Connecting the Macs requires attention to detail. The cable used should be capable of transferring data via USB-C but not Thunderbolt. This is a limitation imposed by DFU mode, and must be observed if the Macs are to connect. That should be connected to the DFU port on the dead Mac, one of its USB-C+Thunderbolt ports. Apple lists those here, and they’re given in MacTracker.

If you aren’t sure, or can’t connect a suitable Mac, it may be best to assume that it’s in DFU mode, and shut it down with a 10 second press of the Power button. On a laptop, DFU mode should use very little power, as there’s normally only one CPU core running and little else. However, as that Mac can’t be charged in DFU mode, this could eventually lead to discharge of the battery.

Not in DFU mode

If there are no signs of life and the Mac isn’t in DFU mode, then it has most probably suffered a fatal hardware failure, and needs the attention of an authorised Apple service provider. If it shows no signs of life in response to a normal press of the Power button, then it’s extremely unlikely to start up in Recovery mode to let you run Diagnostics there.

Signs of life

If the Mac shows signs of life, the next question is how far it proceeds with the boot process:

• It doesn’t reach the login window
• because it freezes and fails to make any further progress, perhaps displaying the Apple logo and progress bar, but no further;
• because it enters a boot loop, in which a kernel panic occurs during boot, forcing the Mac to restart, or to shut down, only to repeat the same sequence.
• It reaches the login window, but sticks there.
• The login window allows user selection and password entry, but refuses any further progress.
• Login is successful, but the Mac freezes or reboots shortly afterwards.
• Login is successful, and problems occur later.

That determines whether you can get it to start up in Recovery mode, and gain access to the tools it provides.

Boot processes

Once a T2 Mac has performed its Power-On Self-Test (POST) and initialised the SMC, the T2 sub-system establishes the level of Secure Boot in force, and, if that’s Full or Medium Security, boot.efi is checked before being loaded, and that leads through to the rest of the boot process. Apple provides a key to the different screens that can appear during these stages.

Boot security in Apple silicon Macs aims to provide a verified chain of trust through each step in the boot process to the loading of macOS, that can’t be exploited by malicious components. Booting an M-series Mac thus starts with the immutable Boot ROM in the hardware, whose most important task is to verify the executable for the next stage, then load and run it. If that isn’t possible, then the fallback is to go into DFU mode and await a connection over USB.

In the event of early boot failure, the only recourse seems to be to abandon the process, and leave the Mac in DFU mode, although Macs running Tahoe could now enter Recovery Assistant to try to fix the problem.

Using the correct term to describe unexpected events when they occur on your Mac is central to troubleshooting. Vague words like crash could mean anything from a full-blown kernel panic bringing your Mac to its knees, to an app showing an error message and quitting quietly. Before you can start thinking of causes or remedies, it’s essential to distinguish these main types:

• A kernel panic is when macOS can’t continue running any more due to software damage, and your Mac has to restart itself to resume normal services.
• A freeze is when the error is severe enough to prevent a normal, ordered kernel panic, and you have to force your Mac to shut down by pressing the Power button.
• An app crash is when an app suddenly quits without warning, but doesn’t take down macOS or trigger a kernel panic.
• An unresponsive app shows the spinning beachball and is listed in the Force Quit dialog as not responding.

Kernel panic

The kernel runs at a special level of privilege to isolate it from the chaos that may be going on in userland. Apps should be able to come and go, crashing whenever they need, but the kernel and its extensions should continue running unaffected. There are three particular risks that the kernel is exposed to:

• hardware (and device firmware) failure or error,
• kernel extensions,
• problems occurring in the Secure Enclave.

Hardware failure, whether it’s a sick GPU, wobbly memory, or a failing disk, can cause kernel panics and may be a good reason for running Diagnostics after your Mac has suffered a kernel panic.

The kernel requires a great many extensions in order for it to do anything useful: macOS Tahoe currently ships with around 945 as standard. Third-party kernel extensions have been common in the past, but now should have largely been replaced by system extensions and their relatives. Although the kernel is better isolated from those, that doesn’t always work reliably. As a result, kernel panics should now be rare in Apple silicon Macs, which have to be run at reduced security if they’re to load third-party kernel extensions.

Secure enclave panics are a recent phenomenon, can only occur in Macs with T1, T2 or Apple silicon chips, and should be extremely rare.

Because of the seriousness of kernel panics, they should generate a special panic log, the starting point for discovering why any panic has occurred. A minute or so after logging back into your Mac once it has restarted, you should see a panic alert with the offer to view its report. Without a panic log, it’s almost impossible to obtain any useful evidence as to their cause, as the panic usually ensures that all other log records are lost. Unfortunately, recent versions of macOS don’t make it easy to save the panic log, and many users just send a copy to Apple assuming that will do something to solve their panics, which it doesn’t. When you see a panic alert, always view the report, copy and paste it into a document, and save it for reference.

Freeze

It’s also possible for a Mac to come to a grinding halt, and rather than suffering a kernel panic, just freeze. You can experience something similar if you run Disk Utility’s First Aid on your Mac’s Data volume when running in normal mode: the contents of the display and clock stop updating, and the Mac is completely unresponsive to any input. When running First Aid, that should only last a few seconds; when your Mac freezes, it may recover spontaneously, but in many cases the only way to regain control is to force it to shut down by pressing and holding the Power button. Whatever you do, only shut mains power off to your Mac as a last resort, as that risks damage to file systems and loss of data.

Freezes can also occur through a different mechanism: rather than a fatal error in the kernel causing it to panic, a freeze may originate from WindowServer and the GPU, hence failure to update the display.

App crash

These are known under various euphemisms such as an unexpected quit, and come in two main forms. They most commonly result when an app encounters a problem it can’t solve, for instance if it’s expecting to find a chunk of data in memory, but instead there’s nothing, and its code can’t handle that gracefully. These should be reported to the developer so they can identify the problem and modify the app’s code to prevent the crash from occurring. For the user it may be possible to determine the circumstances that cause the crash, and work around them.

macOS itself will deliberately crash apps in certain circumstances, such as when its security system finds a broken signature, or the app tries to access something protected for privacy without having the right of access. While diagnosing bugs in apps is generally beyond the ability of even advanced users, an app’s crash report should reveal external causes such as a security failure, which are of importance to both user and developer.

Unresponsive app

Apps are generally written so that activities that might take noticeable time are run in the background and don’t impair the app’s responsiveness to the user. There are circumstances where that smooth running doesn’t work, and the spinning beachball cursor is displayed to indicate the app is no longer responsive.

This doesn’t mean that the app has crashed, and for certain operations it can be difficult if not impossible to avoid. For example, it’s possible to obtain log extracts containing hundreds of thousands of entries using Ulbow. When there are so many, formatting their text in the app’s window takes noticeable time and will inevitably result in pauses spent with the spinning beachball.

Apps can also enter more prolonged periods of unresponsiveness, sometimes indefinite, from which the only way out is to force them to quit using the Finder’s Force Quit window (Command-Option-Escape), actually handled for it by loginwindow. macOS writes special logs to record these problems, but they are of no benefit to the user.

Unexpected behaviour

Apps including the Finder can behave in many ways you don’t expect, as Pulp newsreader did when it first ran in macOS Catalina, above. In these cases it’s most useful to distinguish between problems that render the app unusable or result in data loss, and those that have lesser consequences and can possibly be worked around.

Key points

• A Mac restarts spontaneously following a kernel panic; watch for the panic log and save a copy.
• When everything stops dead, particularly on the display, the Mac has frozen and normally needs to be shut down by holding the Power button.
• When an app unexpectedly quits it has crashed, or has been crashed by macOS.
• A prolonged spinning beachball cursor is an unresponsive app, and may need to be forced to quit.