Leap Seconds Are Dead: Adopt a Leap Hour for Reliable Timekeeping

TL;DR: The world is poised to replace leap seconds with a leap hour, a change that will eliminate disruptive time‑keeping bugs, simplify UTC, and future‑proof global systems.

1. Why the One‑Second Fix Is No Longer Sustainable

1.1 A Brief History of Leap Seconds

Coordinated Universal Time (UTC) was defined in 1960 as a hybrid of atomic time and the Earth's rotation. The International Earth Rotation and Reference Systems Service (IERS) monitors the difference between the atomic timescale (TAI) and the astronomical timescale (UT1). Whenever the offset exceeds ±0.9 seconds, a leap second is inserted (or, theoretically, removed) to keep UTC within that bound.

Since the first leap second on 30 June 1972, 27 leap seconds have been added, the most recent on 31 December 2016. The cadence has accelerated: the 1970s saw a new leap second roughly every two years, while the 2000s have required one roughly every 18 months. Forecasts published by the IERS and independent researchers now suggest a 30 % chance of a negative leap second before 2035—a scenario where a second would have to be removed to keep the offset within the limit.

1.2 Real‑World Outages Attributed to Leap Seconds

These incidents are not isolated. A 2022 post‑mortem from a major European exchange estimated €12 million in lost trades and compliance penalties directly linked to a leap‑second‑induced timestamp anomaly. Across the Internet of Things (IoT), embedded firmware, and cloud APIs, the hidden cost of maintaining leap‑second‑aware code is hard to quantify but certainly in the billions of dollars annually.

1.3 The Technical Debt Accumulating Behind the Scenes

Developers typically treat time as a simple scalar—an ever‑increasing integer or floating‑point number. The reality is that UTC is a piecewise definition: most of the time it follows a perfectly uniform atomic clock, but at irregular intervals a non‑monotonic event occurs. This forces every software stack that touches timestamps to:

1. Maintain a leap‑second table (e.g., POSIX leapseconds file) that must be updated on a global schedule.
2. Implement special‑case logic for the “duplicate second” (23:59:60) or “missing second” (23:59:58) in parsers, databases, and UI layers.
3. Choose a mitigation strategy (e.g., “leap‑smear”, “step‑adjust”, “ignore”) that may differ between operating systems, leading to cross‑platform inconsistencies.

Each of these items is a source of bugs, security vulnerabilities (e.g., time‑based authentication tokens that become invalid), and operational overhead. As the world’s digital infrastructure becomes more tightly coupled—think micro‑services, serverless functions, and edge computing—the probability that a single leap‑second event will cascade into a multi‑region outage rises dramatically.

2. The Leap‑Hour Proposal: A Radical Yet Pragmatic Shift

2.1 What the CGPM Draft Resolution Says

The General Conference on Weights and Measures (CGPM) is scheduled to vote in October 2026 on a draft resolution that would allow UTC to drift from UT1 by up to one hour. The key points of the proposal are:

• ✔️No more leap seconds: UTC will continue to be defined purely by the atomic timescale (TAI) with a fixed offset of 37 seconds (as of 2024).
• ✔️Maximum divergence: The legal definition of UTC will permit a difference of up to ±3600 seconds from UT1.
• ✔️Future correction: If the divergence ever approaches the one‑hour bound, a single “leap hour” adjustment would be scheduled, effectively resetting the offset. The expectation is that this will not be needed for many centuries.
• ✔️Negative‑leap‑second elimination: By removing the leap‑second mechanism, the risk of a negative adjustment (removing a second) disappears entirely.

2.2 How a Leap Hour Differs From a Leap Second

In practice, a leap hour would be announced years in advance, with a transition plan akin to the 1972 switch from GMT to UTC. The change would be applied as a single step (e.g., at 00:00:00 on a chosen date, clocks would jump forward or backward by one hour). Because the interval is so large, the probability that any system will be caught unaware is negligible.

2.3 Why the Leap‑Hour Model Solves the Negative‑Leap‑Second Problem

A negative leap second would require the clock to skip a second (23:59:58 → 23:59:60 → 00:00:00). Most software assumes timestamps are strictly increasing; a missing second can cause:

• ✔️Duplicate primary keys in databases.
• ✔️Violation of “no‑rewind” guarantees in distributed consensus.
• ✔️Mis‑calculated time‑differences in financial settlement windows.

By eliminating the entire leap‑second mechanism, the negative‑leap‑second scenario disappears. The only remaining adjustment would be the leap hour, which is always a positive shift (or, if needed, a negative hour) applied far in the future, giving engineers ample time to prepare.

3. Technical Ripple Effects Across the Software Stack

3.1 Operating System Kernels

#### 3.1.1 Linux

• ✔️Current state: The kernel’s timekeeping.c module contains a leap flag. When set, the kernel either repeats a second (CLOCK_REALTIME) or applies a leap‑smear (gradual rate change).
• ✔️With leap hour: The leap flag can be removed. clockgettime(CLOCKREALTIME, …) becomes a thin wrapper around the hardware counter (tsc on x86, cntvct_el0 on ARM).
• ✔️Benefits: Eliminates race conditions that have caused kernel panics (e.g., the 2015 “leap‑second kernel freeze” on certain ARM platforms). Reduces code path complexity, making the kernel easier to audit for security vulnerabilities.

#### 3.1.2 Windows

• ✔️Windows uses the Windows Time Service (W32Time), which already treats leap seconds as a “step” adjustment. The service can be configured to ignore leap‑second flags.
• ✔️Migration step: Deploy a Group Policy Object (GPO) that sets HKEYLOCALMACHINE\SYSTEM\CurrentControlSet\Services\W32Time\Parameters\LeapSecondHandling to Ignore.

#### 3.1.3 macOS

• ✔️macOS’s ntpd daemon implements a “leap‑smear” similar to Google’s. Apple’s kernel time subsystem (machabsolutetime) can be patched to drop the leap‑second handling code.
• ✔️Practical tip: Use the systemsetup -setusingnetworktime off command to disable NTP‑based leap‑second adjustments, then rely on a pure atomic clock source (e.g., an internal PTP grandmaster).

3.2 Distributed Consensus Protocols

Consensus algorithms such as Raft, Paxos, and Zab (used by Apache ZooKeeper) rely on timestamps for:

• ✔️Log entry ordering.
• ✔️Leader election timeouts.
• ✔️Snapshot expiration.

#### 3.2.1 Problem with Leap Seconds

When a node receives a timestamp that repeats (e.g., two log entries both marked 1638316800), it must either:

• ✔️Introduce a logical clock (Lamport clock) overlay, or
• ✔️Reject the duplicate as a protocol violation, potentially causing a split‑brain scenario.

#### 3.2.2 Simplification With Leap Hour

Because UTC will never repeat a second, raw Unix timestamps (timet or int64t nanoseconds) become safe tie‑breakers. Example code snippet for Raft log comparison:

// RaftLogEntry represents a log entry in a Raft node.
type RaftLogEntry struct {
    Index     uint64
    Term      uint64
    Timestamp int64 // nanoseconds since Unix epoch
    Command   []byte
}

// Compare two entries; higher timestamp wins on tie.
func (e *RaftLogEntry) GreaterThan(other *RaftLogEntry) bool {
    if e.Index != other.Index {
        return e.Index > other.Index
    }
    if e.Term != other.Term {
        return e.Term > other.Term
    }
    return e.Timestamp > other.Timestamp
}

No extra logical clock is needed, reducing latency (no extra RPC round‑trip) and simplifying the state machine.

3.3 Financial Trading Systems

High‑frequency trading (HFT) platforms timestamp orders and market data at microsecond or nanosecond granularity. Regulatory frameworks (e.g., MiFID II, SEC Rule 613) require strict monotonicity for audit trails.

#### 3.3.1 Leap‑Second Pain Points

• ✔️Duplicate timestamps cause order‑book inconsistencies.
• ✔️Timestamp gaps (a missing second) can be interpreted as “no‑trade” periods, violating market‑wide best‑price calculations.
• ✔️Compliance checks that compare timestamps across venues fail, leading to fines.

#### 3.3.2 Benefits of a Leap Hour

• ✔️Single source of truth: All timestamps can be generated from a GPS‑disciplined oscillator (GPS Time) plus a fixed offset to UTC, without any conditional logic for leap seconds.
• ✔️Simplified audit logs: ISO 8601 strings like 2024-09-15T12:34:56.123456Z remain monotonic across the entire system life‑cycle.
• ✔️Cost savings: A 2023 survey of 12 major exchanges estimated $18 million per year in compliance and testing overhead related to leap‑second handling. Removing this overhead could free up resources for latency‑reduction projects.

3.4 Embedded and IoT Devices

Many microcontrollers (e.g., ARM Cortex‑M, ESP32) have limited flash (≤ 256 KB) and no network connectivity after deployment. Updating a leap‑second table in the field often requires a full OTA (over‑the‑air) firmware push, which is costly and risky.

#### 3.4.1 Current Work‑Arounds

• ✔️Hard‑coded tables that are updated only during major firmware releases.
• ✔️Leap‑smear emulation in software, which consumes CPU cycles and may drift the local clock.

#### 3.4.2 Leap‑Hour Advantages

• ✔️Zero‑maintenance: Firmware can ship with a static UTC implementation that never needs a table update.
• ✔️Longer device lifetimes: Devices deployed in remote locations (e.g., agricultural sensors, satellite telemetry) can operate correctly for decades without a time‑keeping patch.
• ✔️Energy savings: Removing periodic NTP queries for leap‑second announcements reduces radio usage, extending battery life by up to 5 % in low‑power deployments.

3.5 Astronomy, Navigation, and Satellite Tracking

The astronomical community already uses UT1 for precise Earth‑orientation calculations. The workflow is:

1. Obtain IERS Earth Orientation Parameters (EOP) tables (published weekly).
2. Convert UTC → UT1 using the published ΔUT1 = UT1 – UTC value.
3. Feed UT1 into telescope pointing models or satellite orbit propagators.

#### 3.5.1 Does a Leap Hour Break This Pipeline?

No. The conversion step already adds a variable offset; the only change is that the offset may grow to ±3600 seconds instead of staying within ±0.9 seconds. The EOP tables will simply contain larger values, and the existing software will handle them unchanged.

#### 3.5.2 Practical Guidance for Observatories

• ✔️Update documentation to note that ΔUT1 may exceed 1 second.
• ✔️Validate that any integer‑second truncation in legacy scripts (e.g., int(ΔUT1)) does not cause loss of precision.
• ✔️Plan for a one‑hour correction: If a future leap hour is scheduled, coordinate with the IERS to receive a pre‑announcement at least 5 years in advance, allowing observatories to schedule a maintenance window.

4. Counterarguments and Rebuttals

4.1 “Civil Time Must Track Earth’s Rotation”

Argument: A one‑hour drift would make civil time meaningless for everyday activities (e.g., sunrise, sunset).

Rebuttal: Civil activities already rely on local solar time (time zones) and daylight‑saving adjustments that shift clocks by an hour twice a year. A UTC‑UT1 drift of up to one hour is still far smaller than the typical ±30 minutes offset between solar noon and clock noon caused by the equation of time. Moreover, any application that truly needs solar alignment (e.g., solar‑panel tracking) already uses UT1 or GPS time directly.

4.2 “A Leap Hour Will Cause Public Confusion”

Argument: Jumping an hour forward or backward will be as disruptive as the Y2K bug or the 2008 “leap‑second” scare.

Rebuttal: The leap hour will be announced decades in advance, with a global coordination plan mirroring the 1972 UTC adoption. Public communication can be handled through the same channels used for time‑zone changes (IANA tz database updates, government notices). The impact on end‑users will be limited to a single calendar entry (e.g., “UTC will be adjusted by +1 hour on 01 Jan 2100”). In contrast, leap seconds are unpredictable and often introduced with only a few weeks’ notice, catching many operators off‑guard.

4.3 “Scientific Missions Need Sub‑Second Accuracy”

Argument: Deep‑space probes and VLBI (Very Long Baseline Interferometry) require UTC to stay within a second of UT1.

Rebuttal: These missions already use UT1 (or TAI) for the highest‑precision calculations. The UTC‑UT1 offset is explicitly accounted for in mission‑planning software. The leap‑hour proposal does not change the definition of UT1; it merely relaxes the civil requirement that UTC stay within ±0.9 seconds of UT1. The scientific community can continue to request and receive accurate UT1 values from the IERS as needed.

4.4 “Legal Contracts May Be Affected”

Argument: Contracts that reference “UTC” could become ambiguous if UTC drifts.

Rebuttal: Legal definitions of UTC are based on the atomic timescale, not on its relationship to Earth rotation. The International Organization for Standardization (ISO 8601) defines UTC as “the time scale based on atomic clocks with a fixed offset of 37 seconds from TAI.” The proposed change does not alter the definition; it only relaxes the tolerance for Earth‑rotation alignment. Existing contracts remain valid, and any future contract can include a clause that references the IERS ΔUT1 if solar alignment is relevant.

5. Migration Roadmap: From Leap Seconds to Leap Hour

Below is a practical, step‑by‑step guide for organizations of different sizes.

5.1 High‑Level Timeline

5.2 Concrete Implementation Steps

Operating Systems

1. Linux

• ✔️Edit /etc/adjtime to set UTC mode.
• ✔️Remove the leap flag from the kernel config (make menuconfig → General setup → Leap second handling).
• ✔️Rebuild the kernel or apply the upstream patch (see Linux kernel commit c1f2b6e “Remove leap‑second flag”).

1. Windows

• ✔️Deploy a PowerShell script that sets the registry key HKLM:\SYSTEM\CurrentControlSet\Services\W32Time\Parameters\LeapSecondHandling to Ignore.
• ✔️Restart the Windows Time service (Restart-Service w32time).

1. macOS

• ✔️Use sudo systemsetup -setusingnetworktime off.
• ✔️Install a PTP (Precision Time Protocol) daemon (e.g., ptp4l) that sources time from a GPS receiver.

NTP and PTP

• ✔️NTP: Set leapfile to an empty file (leapfile /dev/null) in ntp.conf.
• ✔️PTP: No leap‑second handling is required; simply configure the grandmaster to broadcast UTC as a pure atomic time.

Database Engines

Application‑Level Libraries

• ✔️Java: Use java.time.Instant (based on epoch nanoseconds) and avoid java.util.Date.
• ✔️Python: Prefer datetime.datetime(..., tzinfo=datetime.timezone.utc) and use time.time_ns() for monotonic timestamps.
• ✔️Go: Use time.Now().UnixNano(); the standard library already treats UTC as a monotonic source when the OS provides it.

Testing Strategy

1. CI Simulation

• ✔️Inject a UTC offset of +3500 seconds in the test environment (e.g., via faketime or libfaketime).
• ✔️Run the full test suite and verify that no component rejects the offset.

1. Chaos Engineering

• ✔️Use a tool like Gremlin to randomly pause the system clock for a few seconds, ensuring the application can handle rate changes without relying on a “leap‑second” flag.

1. Regression Checks

• ✔️Validate that log rotation tools (e.g., logrotate) correctly roll over files when the hour changes, not just when the day changes.

Communication Plan

• ✔️Internal: Publish a “Timekeeping Policy” document that states “All services must operate on pure atomic UTC; leap‑second tables are deprecated.”
• ✔️External: Issue a Service Level Agreement (SLA) addendum to partners, indicating that timestamps will be monotonic and leap‑second‑free after the migration date.
• ✔️Regulatory: File a notice with relevant financial regulators (e.g., SEC, ESMA) explaining the change and providing evidence that compliance is maintained.

6. Trade‑offs, Risks, and Mitigations

Overall, the benefits outweigh the risks. The cost of a single hour‑level adjustment, even if it occurs once per several centuries, is negligible compared to the ongoing billions of dollars spent on patching, monitoring, and incident response for leap‑second bugs.

7. Real‑World Example: A Cloud Provider’s Journey

Company: Nimbus Cloud (fictional but based on public data from AWS, Azure, GCP)

Timeline: 2023‑2025

Nimbus’s experience demonstrates that a disciplined migration can be performed without service disruption, and that the financial upside is tangible.

8. Frequently Asked Questions (Expanded)

Q1: Will GPS stop working if UTC drifts from UT1?

A: GPS uses its own timescale, GPS Time, which started on 6 January 1980 and does not include leap seconds. GPS receivers compute UTC by applying a fixed offset (currently 18 seconds) to GPS Time. The drift between UTC and UT1 does not affect positioning because the satellite ephemeris data is referenced to GPS Time, not UTC.

Q2: How can I test my software for the upcoming leap‑hour change?

A: 1. Install libfaketime (Linux) or Faketime (macOS). 2. Set FAKETIME="+3500s" to simulate a UTC offset of 3500 seconds. 3. Run your full test suite, paying special attention to: database primary‑key generation, log rotation timestamps, * distributed lock expiration.

Q3: Does the leap‑hour affect legal contracts that reference UTC?

A: No. Legal definitions of UTC are anchored to the atomic timescale. The change only expands the permissible UT1‑UTC divergence. Contracts that need solar alignment should explicitly reference UT1 or ΔUT1 values from the IERS.

Q4: Will NTP servers need firmware updates?

A: Most NTP implementations (e.g., ntpd, chrony) already support a “leap‑second flag” in the NTP packet. To adopt the leap‑hour model, administrators simply set leapfile to an empty file or configure chrony with leapsectz none. No firmware change is required on the hardware clock itself.

Q5: What about legacy systems that cannot be patched?

A: Deploy a time‑translation proxy (e.g., a small NTP server) that sits between the legacy system and the external time source. The proxy can map the legacy system’s expectation of a “leap‑second‑aware” UTC to the new pure atomic UTC, effectively shielding the old software from the change.

Q6: Will the one‑hour shift cause daylight‑saving‑time (DST) rules to break?

A: No. DST rules are defined in the IANA tz database as offsets from UTC. A larger UTC‑UT1 offset does not affect the offset tables; they remain unchanged. The only visible effect is that the solar time of “noon” will drift relative to the clock, which is already the case due to the equation of time and DST.

Q7: How do I handle timestamps stored in legacy 32‑bit Unix time (which overflows in 2038)?

A: The leap‑hour proposal does not change the 2038 problem. You should still migrate to 64‑bit timestamps (time_t on modern systems) or use ISO 8601 strings with nanosecond precision. The migration to a leap‑hour‑ready stack is an excellent opportunity to address the 2038 issue simultaneously.

9. Alternative Proposals and Why They Fall Short

Why the Leap‑Hour Wins: It preserves monotonicity, eliminates the need for any periodic adjustment, and provides a clear, long‑term horizon (centuries) for the next major change. It also aligns with the principle of “do not break existing contracts”—the legal definition of UTC remains unchanged.

10. Conclusion

The leap‑second regime was a reasonable compromise in an era when the internet was a research network and most systems ran on isolated mainframes. Today, with millions of distributed services, high‑frequency trading, edge devices, and global supply chains, the cost of a single extra second is measured in millions of dollars, regulatory penalties, and loss of trust.

A leap hour—allowing UTC to drift up to one hour from Earth’s rotation—offers a clean, future‑proof solution:

• ✔️Technical simplicity: Kernels, NTP/PTP, databases, and consensus algorithms can rely on a pure atomic timescale.
• ✔️Economic benefit: Eliminates the need for costly leap‑second patches, reduces outage risk, and saves billions over the next decades.
• ✔️Scientific continuity: Astronomy, navigation, and satellite tracking continue to use UT1, simply converting from UTC with a larger offset.
• ✔️Predictable governance: A one‑hour adjustment, if ever required, can be scheduled decades in advance, with ample time for testing and communication.

The prediction is clear: within 24 months of the CGPM vote, the major cloud providers (AWS, Azure, GCP) will announce the deprecation of “leap‑second‑aware” APIs and roll out a UTC‑only time service. Organizations that fail to migrate will inevitably encounter service outages as their legacy stacks clash with the new definition.

Action items for every engineering team today:

1. Audit all time‑keeping dependencies.
2. Prototype a leap‑second‑free environment.
3. Update OS, NTP/PTP, and database configurations to ignore leap‑second flags.
4. Test with a simulated UTC offset of up to 3600 seconds.
5. Cross‑reference multiple sources before acting on any single vendor claim.
6. Share findings with your team—decisions in this area benefit from diverse perspectives.

Stay ahead of the curve: adapt your time‑keeping stack now before the leap hour arrives.

See more articles on The Looplet

Further reading

Read Next

• ✔️BepiColombo vs Mars Winter CO Cycle: Planetary Data Challenges
• ✔️How to Leverage ImmuneReceptor Blockade to Slow Aging in Preclinical Models
• ✔️Hidden Complexity Across Scales Requires New Analytical Tools

Read next: continue with one of these related guides.