+++
title = "The Second That Ran Backwards"
description = "A unit of time is being abolished in 2035. Not because the astronomy changed, but because software could not absorb it."
date = 2026-08-18
draft = false

[taxonomies]
topics = ["calendars"]
kinds = ["standards", "conventions", "operational-cost"]

[extra]
tier = "public"
schema_type = "Article"
canonical = ""
hero = "articles/the-second-that-ran-backwards/hero.webp"
hero_alt = "1950s radio time-signal correction bulletin with imposed boundary tape"
diagram = "diagrams/the-second-that-ran-backwards.svg"
podcast = ""
mechanism = "A measurement standard is retired not because it became inaccurate but because the systems downstream of it became too expensive to keep correcting."
symptoms = [
  "The stated justification for retiring a standard is accuracy; the cited evidence is outage reports",
  "Large operators have each built their own private workaround and the workarounds disagree",
  "The annual cost of accommodating a convention exceeds any cost of changing it, and it persists anyway",
  "A rule is defended by people who do not use it and worked around by people who do",
]
apparatus = "Metrology has a standing body with authority to retire a unit. Financial conventions mostly do not, which is why they outlive agreement that they are wrong."
discriminating_test = "Ask who has standing to abolish the convention. If no body can, persistence is not evidence that anyone still wants it."
false_friend = "A convention that survives because it is genuinely optimal. Distinguish by looking for private workarounds: a good convention does not generate ten incompatible mitigations at its largest users."
test = "Catalogue financial conventions by whether an authority exists that could retire them, against estimated annual spend on working around them. The gap between the two is the interesting column."

[[extra.faq]]
q = "Why does a leap second break software when a leap day does not?"
a = "Leap days are scheduled centuries ahead by a published arithmetic rule, so any calendar library handles them. Leap seconds are announced about six months in advance because they depend on measured irregularities in Earth's rotation, and they insert a second that has no valid representation in most time formats. Code that compares two timestamps and assumes the interval cannot be negative will fault."
[[extra.faq]]
q = "What is a leap smear?"
a = "Spreading a leap second's adjustment across a long window — typically 24 hours — so clocks never jump and no interval ever runs backwards. Google and Amazon both do this. Neither does it identically, and the absence of a shared standard for smearing is itself part of the case that ended the leap second."
[[extra.faq]]
q = "Was the leap second abolished for scientific reasons?"
a = "The 2022 CGPM resolution eliminating it by 2035 cites threats to the resilience of synchronisation capabilities underpinning critical national infrastructure. That is an operational argument. The astronomy that motivated leap seconds has not changed; the cost of accommodating them in software did."
[[extra.faq]]
q = "How do you tell whether a convention survives because it works or because nobody can retire it?"
a = "Look for private workarounds at the largest users. A convention that genuinely fits its purpose does not generate a set of incompatible in-house mitigations. When the biggest operators have each built their own patch and the patches disagree, the convention is being tolerated rather than used."
+++

On the last day of 2016, Cloudflare's DNS servers asked how long ago something had happened and got back a negative number.

The code had been written by people who assumed the gap between two moments could not be less than zero. That is true, in the ordinary way, unless somebody adds a second to the year.

The fault landed in the logic that picks which upstream server to query. Roughly 0.2% of DNS queries and under 1% of HTTP requests were affected at peak, across a subset of machines in what were then 102 data centres. Most were patched within ninety minutes; the worldwide rollout finished at 06:45 UTC, about seven hours after the second that caused it.

That level of detail is unusual. Most leap-second incidents are known only by which companies went down.

## The Earth is a bad clock

Atomic time is regular. The planet is not.

Earth's rotation wobbles and drifts on timescales nobody can predict far ahead, which means solar time and atomic time separate. The leap second was the patch: when the two drift more than about nine tenths of a second apart, the International Earth Rotation Service inserts an extra second into UTC and the clocks are reconciled.

The insertion cannot be scheduled in advance the way a leap day can. A leap day is arithmetic — divisible by four, except by a hundred, unless by four hundred — and any calendar library written in the last forty years handles it without being told. A leap second depends on measurement, gets announced roughly six months out, and produces a timestamp that most formats have no legal way to represent.

So the two corrections look like the same kind of thing and are not. One is a rule. The other is a bulletin.

## The bill

The 2012 insertion took down Reddit, Mozilla, Qantas and an assortment of Linux systems.

The 2015 insertion hit Twitter, Instagram, Netflix, Amazon and Apple Music, and halted trading on the New York Stock Exchange for sixty-one minutes.

None of this was a failure of the leap second, which worked exactly as specified. It was a failure of everything built on the assumption that time is monotonic — an assumption so ordinary that almost nobody writes it down, and so widespread that it is cheaper to list the systems that survive a violation than the ones that don't.

The response was private. Google and Amazon both adopted leap smearing, spreading the extra second's adjustment across a full day so that clocks slow imperceptibly rather than jumping, and no interval ever runs backwards. It works. It is also a standing engineering expense rather than a fix, renewed every time an insertion is announced.

And because the standards body left the insertion mechanism to each operator rather than specifying one, the smears do not match. Two large clouds, both correct, both diverging from each other and from UTC for a day at a time.

## Which is what actually ended it

In 2022 the General Conference on Weights and Measures resolved to eliminate the leap second by 2035.

The rationale is worth reading for what it does not say. It does not argue that the leap second is astronomically wrong, because it isn't — the drift it corrects is real and continues. It cites the inconsistency of insertion methods across operators as a threat to "the resilience of the synchronization capabilities that underpin critical national infrastructures."

That is a statement about software. A unit of time is being retired because the systems downstream of it became too expensive to keep correcting, and the astronomy is going to be handled some other way, later, by someone else.

There is a sharper version of this coming. Earth's rotation has been running slightly fast in recent years, which raises the possibility of a *negative* leap second — a minute containing fifty-nine seconds. Every workaround built over the past two decades assumes the correction only ever adds. Nobody has tested the other direction at scale, and the 2035 deadline arrives before anyone is likely to have to.

## The part that transfers

The leap second had something almost no financial convention has: a body with standing to abolish it.

The CGPM meets, resolves, and the thing is gone on a published date. That is why a convention everybody found expensive lasted about fifty years rather than indefinitely.

Now ask the same question of a day-count convention, a settlement cycle, a fiscal year boundary, or any of the accumulated arithmetic that financial contracts are written against. Who could retire it? For most, the answer is nobody in particular — and the absence of an abolishing authority is routinely mistaken for evidence that the convention is fine.

The diagnostic that actually works is the workaround. A convention that fits its purpose does not cause its largest users to each build a private patch. When the biggest operators have all written their own mitigation and the mitigations disagree, what you are looking at is tolerance, not agreement.

Google and Amazon smearing differently is the same signal as two desks quoting the same instrument on incompatible day counts. In one case a standards body eventually noticed and set a date.

In the other, the second still runs backwards every so often, and everybody has agreed not to look.