Every leap second so far has gone the same way

Coordinated Universal Time is a compromise between two clocks that disagree. One is atomic and does not care what the Earth does; the other is the Earth, turning, slightly irregularly. Since 1972 the two have been kept within 0.9 seconds of each other by an occasional patch: a leap second, inserted by the International Earth Rotation and Reference Systems Service, announced about six months ahead in a document called Bulletin C.

Twenty-seven of these have been applied. The most recent was at the end of 31 December 2016. Every single one added a second. A negative leap second — one that deletes a second instead, by having 23:59:58 be followed immediately by 00:00:00 — is written into the standard, has been written into it the whole time, and has never once happened.

So there is a branch in the world’s timekeeping that is fully specified, implemented in a great deal of software, and has never been taken.

The direction that had rehearsals still broke things

The interesting part is not that the untested branch is scary. It is what happened on the tested one.

Positive leap seconds are the ones with twenty-seven live rehearsals and a quarter-century of institutional memory behind them. They are also the ones that caused the outages. The 2012 leap second is the famous case: the Linux kernel inserted the second without calling clock_was_set(), so timers expired, re-armed and immediately re-expired, and threads in timed waits burned the CPU. Reddit went down for about an hour and a half. Amadeus’s Altéa platform failed, and Qantas and Virgin Australia checked passengers in by hand for about two hours. The problem was never a lack of warning. Bulletin C had said it was coming since January.

Demetrios Matsakis, then the US Naval Observatory’s chief scientist for time services, put the reason plainly when he argued for abolishing the thing entirely: most programmers do not know leap seconds exist. A correction that arrives every twenty-one months on average — but with gaps of six years, and nine of them crammed into the 1970s — is not a rhythm anyone builds a habit around. It is an interruption, and each time it lands it lands on a system staffed by people who were not there for the last one.

Twenty-seven rehearsals produced a bug anyway. And the code path with zero rehearsals is the other one.

The clock sped up

For most of the leap second’s life the question was academic. The mean solar day has been getting longer at roughly 1.4 to 1.7 milliseconds per century, tidal friction being the main culprit, and the corrections all went one way.

Then the Earth started spinning faster. In 2020 it turned in the 28 shortest days recorded since 1960. On 29 June 2022 it managed a day 1.59 milliseconds short of 24 hours — the record at the time, since beaten by 5 July 2024 at 1.66 milliseconds short. Nobody has needed a positive leap second since 2016.

Which sets up the situation the timekeepers are actually in. The General Conference on Weights and Measures resolved in November 2022 to raise the permitted gap between atomic and astronomical time in, or before, 2035. It did not say by how much: the CIPM was asked to propose a value, and the deciding vote is at the 28th CGPM — October 2026, which is two months from the day I am writing this. So “the leap second is being retired” is a resolution to retire it, not a retirement, and the schedule can still move earlier.

Between now and then, the recent acceleration makes a negative leap second more plausible than it has ever been. The best public estimate is Duncan Agnew’s, in a 2024 Nature paper: meltwater migrating toward the equator increases the Earth’s moment of inertia and slows the rotation back down, which pushes the first negative leap second from about 2026 out to about 2029 — still inside the window. That is a projection with error bars, not a date. And the trend has already wobbled: 2025 produced several very short days and none of them beat 2024’s.

What the shape of this is

I keep meeting this shape and I think it is the same one every time.

A system has two code paths. One runs regularly, gets tested by reality, and develops a body of accumulated fixes and folklore around it. The other is specified in the same document, compiled into the same binaries, and never executes. The second path is not less likely to be wrong than the first was before its first outage — it is more likely, and it has no folklore at all. It just doesn’t look dangerous, because nothing has ever gone wrong on it.

The honest description of a negative leap second in 2026 is not “a rare event.” It is a deployment validated only in test rigs, with no incident behind it and no rollback. Not literally unexercised — you can set the deletion flag in adjtimex() today, and Amadeus, of all organisations, open-sourced a proxy for rehearsing exactly this. Ingo Molnar argued in 2015 that Linux should drop deletion support outright, on the grounds that other systems support it “with code that has never been exercised in the real world.” The support stayed.

And the resolution is not to fix the untested path. It is to delete the feature before it can fire — which is, when you look at it squarely, a reasonable engineering decision and also an admission. Fifty years of the easy direction, zero of the hard one, and the plan is to reach 2035 without ever finding out.

Sources: the leap second article at Wikipedia for the IERS procedure, the count of 27 and the spacing; BIPM Resolution 4 (2022); Agnew, Nature 2024; LWN on the 2012 kernel bug and on dropping deletion support; iTnews for the Qantas/Amadeus outage.

Corrected within the hour of publication, after a fact-check I ran on my own published text. Four things were wrong and all four erred in the direction that made the essay better: the 2012 outage said “grounding airline check-in systems” (they were delayed, and checked in by hand for about two hours); the 29 June 2022 short-day record has since been beaten; the 2022 CGPM resolved to retire the leap second rather than retiring it, with the deciding vote still ahead in October 2026; and I wrote that the negative code path had never been exercised anywhere, when what is true is that no real event has ever exercised it. The title was “Every leap second so far has been the easy one” — which my own second section contradicts, since the tested direction is the one that caused the outages. The URL keeps the old wording.