Dali with portions of the collapsed Francis Scott Key Bridge across its forward deck, 28 March 2024. Courtesy: National Transportation Safety Board. Public domain. Converted and compressed for web display; no crop. Image source. Rights and reuse.
Dali’s loss of control outside Baltimore began with a connection small enough to hold between finger and thumb. The consequences spread through machinery that supplied cooling water, steering power and generator fuel. Within minutes, the containership struck a bridge pier, bringing down part of the Francis Scott Key Bridge and killing six highway workers.
The engineering lesson is more demanding than the familiar description of a ship that lost power. Two blackouts occurred through different mechanisms. Restoring electricity after the first did not restore the entire ship to a dependable operating condition. Meanwhile, the distance available for recovery was disappearing.
The National Transportation Safety Board adopted its Dali investigation findings on 18 November 2025. They connect a physical installation defect to machinery dependencies, recovery arrangements and protective measures ashore. Understanding those connections explains why neither a loose-wire headline nor a simple account of bridge damage is sufficient.
| Item | Recorded detail |
|---|---|
| Accident | 26 March 2024, Baltimore, Maryland |
| Contact | Pier 17, Francis Scott Key Bridge, 01:29:09 local time |
| Vessel | Singapore-flagged containership, built in 2015 |
| Dimensions | 299.9 metres long; 48.2 metres broad |
| Ownership and management at accident | Grace Ocean; Synergy Marine |
| Investigation | NTSB report MIR-25-40 |
Contents: The first interruption · Why the diesel stopped · The second blackout · Recovery against distance · The emergency supply · Protection beyond the ship · Practical lessons · Related reading · Sources
The first interruption began in a control circuit
At 01:25:00, the first underway blackout interrupted Dali’s low-voltage supply. The initiating fault was an inadequate signal-wire connection in terminal block 381. Identification banding extended over the insulated collar of the wire’s ferrule, interfering with insertion into a spring clamp.
A ferrule provides a controlled termination for the end of a wire. Its presence alone does not establish that the connection is sound: the termination must enter the clamp far enough for the intended contact and retention. Here, the labelling arrangement obstructed that fit. Identification, normally an aid to maintenance, had compromised installation.
The disconnected wire was part of a control circuit. It was not a heavy cable carrying the ship’s propulsion power. Loss of its signal caused a high-voltage breaker to open, interrupting the supply to a step-down transformer and consequently the low-voltage bus.
That distinction explains how a small electrical defect could have a large effect. A control circuit governs whether another circuit remains available. Its current may be modest, but the equipment dependent on the decision can be essential to the vessel.
The NTSB’s board meeting summary identifies this sequence explicitly. The initial event was a loss of distribution to low-voltage equipment, not the simultaneous disappearance of every source of electrical generation aboard.
Why a direct-drive diesel engine stopped
Dali’s main diesel engine drove the propeller mechanically. Nevertheless, mechanical propulsion depended on electrically powered supporting machinery. The low-voltage system supplied cooling-water pumps as well as steering-gear pumps. Losing that supply therefore affected both thrust and directional control.
An engine cannot be assessed only by tracing its crankshaft to the propeller. Cooling, lubrication, controls and starting arrangements form part of the propulsion system even where they sit outside the main engine itself. A failure in one of those supporting services may stop an otherwise mechanically intact engine.
On Dali, low cooling-water pressure triggered shutdown. The NTSB found that this configuration met the classification requirements applying when the ship was built, but endangered the vessel in the circumstances of the accident. Protecting machinery from damage and preserving navigational control were no longer the same immediate objective.
This does not justify a general instruction to defeat engine protection. Continuing to operate without adequate cooling can cause serious damage and another loss of propulsion. The design question is how protective logic, alternative supplies and recovery procedures should work together when stopping the engine itself creates an urgent external danger.
Steering had its own electrical dependency. A rudder is a hydrodynamic surface, but the machinery that moves it requires power. The loss of steering pumps cannot be corrected simply by issuing another helm order. Equally, restoring a pump does not instantly undo the heading and sideways movement accumulated while control was unavailable.
The second blackout followed a different path
The first interruption also stopped a fuel flushing pump being used to supply the operating diesel generators. That arrangement introduced a second failure mechanism. The pump had been intended for maintenance flushing, rather than dependable service as the generators’ operating fuel supply.
Unlike the normal supply and booster arrangements, it had neither a standby pump to take over nor automatic restart after a loss of electricity. When low-voltage power returned, fuel delivery did not automatically recover with it. Falling fuel pressure then deprived the generators of the supply needed to continue running.
The resulting second blackout affected both high- and low-voltage systems. The NTSB found the use of the flushing pump for this service inappropriate. Its investigation also identified inadequate operational oversight of that practice.
The distinction matters for corrective action. Improving the signal-wire installation addresses the initiating defect. It does not remove the fuel system’s vulnerability to some other electrical interruption. Conversely, replacing the flushing-pump arrangement would improve recovery resilience without repairing the faulty terminal connection.
There was also a misleading possibility during recovery: lights or equipment becoming available could suggest that the emergency was ending, while a necessary fuel service remained stopped. Restoration has to be understood as a sequence of functional checks, not merely the return of voltage to a switchboard.
In general engineering terms, this is a common dependency problem. Several generators do not provide genuinely independent resilience if their continued operation relies on the same vulnerable service. Counting machines is less useful than tracing what keeps them running.
Recovery was competing with the remaining distance
At the first blackout, Dali was travelling at 8.9 knots with its bow about 3,200 feet from the bridge. A vessel of this size retains considerable motion after losing thrust. Power loss does not make the surrounding water act as an immediate brake.
The first low-voltage interruption lasted 58 seconds. The transformer breaker controls were in manual mode, requiring crew intervention to close the necessary breakers. Investigators found the engineering crew’s response timely.
The NTSB calculated that automatic mode would have shortened this interruption to approximately ten seconds. It would not have prevented either blackout. The practical benefit would have been additional time in which to attempt the recovery of critical systems.
Forty-eight seconds is meaningful near an obstruction, but it is not proof that the casualty would certainly have been avoided. Propulsion recovery involves more than energising a bus. Supporting services must function, the engine must become available and thrust must produce a useful change before the remaining manoeuvring space is exhausted.
The bridge team and pilots attempted to alter the ship’s trajectory. Their actions were constrained by lost propulsion, steering difficulties and proximity to the bridge. The vessel struck Pier 17 at 01:29:09, just over four minutes after the initial interruption.
It would be misleading to treat that entire interval as unrestricted decision time. Fault recognition, communication, machinery intervention and ship response all consume portions of the same short window. A procedure that appears manageable in isolation may be inadequate when all its necessary stages must fit before contact.
The emergency generator had a separate delay
Dali’s emergency generator connected after 70 seconds, compared with the applicable 45-second requirement. The NTSB linked the delay to the radiator damper limit switch failing to indicate an open position in time. The exact circumstances behind that failure remained unknown.
The distinction between a physical position and its electrical confirmation is important. Automatic machinery may need a permissive signal before starting. A damper that opens late, or an indication that arrives late, can both postpone a sequence dependent on confirmation. The investigation did not establish enough to choose a more specific explanation.
Emergency generation also has a defined role. It supplies designated essential services; it should not be imagined as a spare main propulsion plant capable of making the ship fully operational at once. Its availability and the restoration of the main electrical system are related but separate recovery questions.
The incident therefore exposed several clocks running together: transformer restoration, generator fuel continuity, emergency generation and propulsion recovery. Improving one clock can increase the opportunity to regain control without guaranteeing a successful outcome by itself.
Ship failure and bridge vulnerability were separate barriers
The warnings from the vessel and the response ashore stopped road traffic from entering the bridge. The NTSB credited those actions with preventing a greater loss of life. However, the warning did not reach the workers already on the structure in time for them to evacuate.
Closing an approach road and clearing a worksite require different communication paths. One stops additional exposure; the other must identify people already at risk and deliver an actionable warning to them. The successful traffic intervention did not establish that the worker-notification barrier was effective.
Physical protection also needs careful description. The bridge had dolphins and fendering. It was not an entirely unprotected structure, and Dali did not strike the four dolphins. The relevant finding was that the available arrangements did not adequately protect against this impact.
The NTSB’s separate bridge vulnerability report places the issue in a wider context. Protection must be assessed against the vessels using a waterway and the consequences of a strike, rather than inferred from the mere presence of protective structures.
These are distinct layers of prevention. Reliable ship machinery reduces the likelihood of losing control. Infrastructure assessment and protection address what happens if control is nevertheless lost. Effective warning and evacuation reduce human exposure when neither of those layers has prevented the danger.
What the findings change about a safety review
A useful machinery review would trace a blackout from initiation through recovery. Which pumps stop? Which restart automatically? Which require intervention? Can a surviving generator lose its fuel supply because of a failure elsewhere? Those questions reveal dependencies that a list of installed equipment can conceal.
Installation quality belongs in the same review. A labelled wire is not necessarily a correctly seated wire, and a component’s normal appearance does not prove secure contact. The NTSB identified thermal imaging as an inspection technique that might have helped identify the loose connection.
For ports and bridge owners, the corresponding review concerns credible ship movements, protective capacity and warning routes to exposed workers. Recommendations describe changes sought; their publication does not establish that every recipient has completed them.
Dali’s casualty demonstrates how a local defect can become a system emergency when several recovery arrangements share weaknesses and the operating environment leaves little margin. That is a safety finding, not a determination of legal liability. Its value lies in making the dependencies visible before another vessel has to recover within a similarly narrow stretch of water.
Related reading
The Ever Given archive article offers a comparison with another containership casualty in a constrained waterway. The causes should not be conflated: the useful comparison is how vessel movement interacts with limited room for correction.
