When a Mac starts up (including following a restart) or wakes from sleep, the reason for the previous shutdown (or initiation of a restart) or sleep is reported in the log. Unfortunately, Apple considers these reasons to be of no concern to the user or system administrator, so they are given as numbers, and Apple does not release information on what the numbers – cause codes – mean.

In El Capitan and earlier versions of OS X, you can find recent cause codes in your logs using Console: search for shutdown cause or sleep cause.

In Sierra, Console does not support access to previous log entries, and cause codes do not appear in system.log, so you’ll either have to use my free Consolation log browser (see Downloads above), or the log show command in Terminal. For Consolation, the filter predicates which are most useful are:
eventMessage CONTAINS[c] shutdown cause
and
eventMessage CONTAINS[c] sleep cause
depending on which you are searching for, or you can OR them into a single predicate to view both. If you want to do more sophisticated predicate filtering, their messageType is Release, senderImage is AppleSMC, and processImage is kernel.

You should then see entries similar to (I have shortened these for convenience):
2017-02-26 22:13:34.210351+0000 kernel: (AppleSMC) Previous shutdown cause: 5
2017-02-26 11:52:19.006041+0000 kernel: (AppleSMC) Previous sleep cause: 5

Cause codes which are negative refer to hardware causes originating mainly from the SMC, and those which are positive refer to software. A special code of 0 indicates an intermediate, which can occur when there is sudden loss of power on some systems, or (for system sleep) when a laptop goes into SafeSleep to preserve its remaining reserve battery power.

Among the hardware cause codes, the following are notable:

• -3 multiple temperature sensors too high
• -60 bad master directory block, serious disk error
• -61, -62 unresponsive app resulting in forced shutdown
• -64 kernel panic, probably due to firmware issue
• -71 memory too hot
• -74 battery too hot
• -75 MagSafe power adaptor communication problem
• -78 incorrect input current from power adaptor
• -79 incorrect current from battery
• -86, -95 proximity temperature (heatsink etc.) too high
• -100 power supply too hot
• -101 display too hot
• -103 battery voltage too low
• -104 unknown battery fault
• -127 PMU/SMC forced shutdown for another cause
• -128 unknown, possibly battery is at the end of its life, but can also occur when the SMC initiates an automatic restart following a kernel panic.

In the software cause codes, there seem to be only two which occur commonly:

• 3 is a ‘dirty’ shutdown resulting from a forced restart or shutdown
• 5 is a ‘clean’ shutdown or sleep initiated by the user.

I am grateful to Graham Perrin and others who revealed this information on StackExchange and elsewhere.