Will `gmtime()` report seconds as 60 when in a leap second?

Question

I have a server running in TZ=UTC and I have code like this:

time_t t = time(NULL);
struct tm tm;
gmtime_r(&t, &tm);

The question is will tm.tm_sec == 60 when the server is within a leap second?

For example, if I were in the following time span:

1998-12-31T23:59:60.00 - 915 148 800.00
1998-12-31T23:59:60.25 - 915 148 800.25
1998-12-31T23:59:60.50 - 915 148 800.50
1998-12-31T23:59:60.75 - 915 148 800.75
1999-01-01T00:00:00.00 - 915 148 800.00

would gmtime() return tm == 1998-12-31T23:59:60 for time_t = 915148800 and, once out of the leap second, return tm == 1999-01-01T00:00:00 for the same time_t?

Answer 1

The short answer is, no, practically speaking gmtime_r will never fill in tm_sec with 60. This is unfortunate, but unavoidable.

The fundamental problem is that time_t is, per the Posix standard, a count of seconds since 1970-01-01 UTC assuming no leap seconds.

During the most recent leap second, the progression was like this:

1483228799    2016-12-31 23:59:59
1483228800    2017-01-01 00:00:00

Yes, there should have been a leap second, 23:59:60, in there. But there's no possible time_t value in between 1483228799 and 1483228800.

I know of two ways for a gmtime variant to return a time ending in :60:

1. You can run your OS clock on something other than UTC, typically TAI or TAI-10, and use the so-called "right" timezones to convert to UTC (or local time) for display. See this web page for some discussion on this.

2. You can use clock_gettime() and define a new clkid value, perhaps CLOCK_UTC, which gets around the time_t problem by using deliberately nonnormalized struct timespec values when necessary. For example, the way to get a time value in between 1483228799 and 1483228800 is to set tv_sec to 1483228799 and tv_nsec to 1000000000. See this web page for more details.

Way #1 works pretty well, but nobody uses it because nobody wants to run their kernel clock on anything other than the UTC it's supposed to be. (You end up having problems with things like filesystem timestamps, and programs like tar that embed those timestamps.)

Way #2 is a beautiful idea, IMO, but to my knowledge it has never been implemented in a released OS. (As it happens, I have a working implementation for Linux, but I haven't released my work yet.) For way #2 to work, you need a new gmtime variant, perhaps gmtime_ts_r, which accepts a struct timespec instead of a time_t.

---

Addendum: I just reread your question title. You asked, "Will gmtime() report 60 for seconds when the server is on a Leap Second?" We could answer that by saying "yes, but", with the disclaimer that since most servers can't represent time during a leap second properly, they're never "on" a leap second.

---

Addendum 2: I forgot to mention that scheme #1 seems to work better for local times -- that is, when you're calling one of the localtime variants -- than for UTC times and gmtime. Clearly the conversions performed by localtime are affected by the setting of the TZ environment variable, but it's not so clear that TZ has any effect on gmtime. I've observed that some gmtime implementations are influenced by TZ and can therefore do leap seconds in accordance with the "right" zones, and some cannot. In particular, the gmtime in GNU glibc seems to pay attention to the leap second information in a "right" zone if TZ specifies one, whereas the gmtime in the IANA tzcode distribution does not.

Answer 2

The question is will tm.tm_sec == 60 when the server is within a leap second?

No. On a typical UNIX system, time_t counts the number of non-leap seconds since the epoch (1970-01-01 00:00:00 GMT). As such, converting a time_t to a struct tm will always yield a time structure with a tm_sec value between 0 and 59.

Ignoring leap seconds in time_t reckoning makes it possible to convert a time_t to a human-readable date/time without full knowledge of all leap seconds before that time. It also makes it possible to unambiguously convert time_t values in the future; including leap seconds would make that impossible, as the presence of a leap second isn't known beyond 6 months in the future.

There are a few ways that UNIX and UNIX-like systems tend to handle leap seconds. Most typically, either:

1. One time_t value is repeated for the leap second. (This is the result of a strict interpretation of standards, but will cause many applications to malfunction, as it appears that time has gone backwards.)

2. System time is run slightly slower for some time surrounding the leap second to "smear" the leap second across a wider period. (This solution has been adopted by many large cloud platforms, including Google and Amazon. It avoids any local clock inconsistencies, at the expense of leaving the affected systems up to half a second out of sync with UTC for the duration.)

3. The system time is set to TAI. Since this doesn't include leap seconds, no leap second handling is necessary. (This is rare, as it will leave the system several seconds out of sync with UTC systems, which make up most of the world. But it may be a viable option for systems which have little to no contact with the outside world, and hence have no way of learning of upcoming leap seconds.)

4. The system is completely unaware of leap seconds, but its NTP client will correct the clock after the leap second leaves the system's clock one second off from the correct time. (This is what Windows does.)

Answer 3

POSIX specifies the relationship between time_t "Seconds Since the Epoch" values and broken-down (struct tm) time exactly in a way that does not admit leap seconds or TAI, so essentially (up to some ambiguity about what should happen near leap seconds), POSIX time_t values are UT1, not UTC, and the results of gmtime reflect that. There is really no way to adapt or change this that's compatible with existing specifications and existing software based on them.

The right way forward is almost certainly a mix of what Google has done with leap second smearing and a standardized formula for converting back and forth between "smeared UTC" and "actual UTC" times (and thus also TAI) in the 24-hour window around a leap second and APIs to perform these conversions.

Answer 4

There is absolutely no easy answer to this. For there to be a 60 second when there is a leap second, you require 1) something in the OS to know there is a leap second due, and 2) for the C library that your using to also know about the leap second, and do something with it.

An awful lot of OSes and libraries don't.

The best I've found is modern versions of Linux kernel teamed up with gpsd and ntpd, using a GPS receiver as the time reference. GPS advertises leap seconds in its system datastream, and gpsd, ntpd and the Linux kernel can maintain CLOCK_TAI whilst the leap second is happening, and the system clock is correct too. I don't know if glibc does a sensible thing with the leap second.

On other UNIXes your mileage will vary. Considerably.

Windows is a ******* disaster area. For example the DateTime class in C# doesn't know about historical leap seconds. The system clock will jump 1 second next time a network time update is received.

Answer 5

I read this at www.cplusplus.com about gmtime: "Uses the value pointed by timer to fill a tm structure with the values that represent the corresponding time, expressed as a UTC time (i.e., the time at the GMT timezone)".

So there's a contradiction. UTC has seconds of absolutely constant length and therefore needs leap seconds, while GMT has days of exactly 86,400 seconds of very slightly varying lengths. gmtime() cannot at the same time work in UTC and GMT.

When we are told that gmtime () returns "UTC assuming no leap seconds" I would assume this means GMT. Which would mean there are no leap seconds recorded, and it would mean that the time slowly diverges from UTC, until the difference is about 0.9 seconds and a leap second is added in UTC, but not in GMT. That's easy to handle for developers but not quite accurate.

One alternative is to have constant seconds, until you are close to a leap second, and then adjust maybe 1000 seconds around that leap second in length. It's also easy to handle, 100% accurate most of the time, and 0.1% error in the length of a second sometimes for 1000 second.

And the second alternative is to have constant seconds, have leap seconds, and then forget them. So gmtime() will return the same second twice in a row, going from x seconds 0 nanoseconds to x seconds 999999999 nanoseconds, then again from x seconds 0 nanoseconds to x seconds 999999999 nanoseconds, then to x+1 seconds. Which will cause trouble.

Of course having another clock that will return exact UTC including leap seconds, with exactly accurate seconds, would be useful. To translate "seconds since epoch" to year, month, day, hours, minutes, seconds requires knowledge of all leap seconds since epoch (or before epoch if you handle times before that). And a clock that will return guaranteed exact GMT with no leap seconds and seconds that are almost but not quite constant time.

Answer 6

Another angle to their problem is having a library that 'know so' about leap seconds. Most libraries don't and so the answers you get from functions like gmtime are, strictly speaking, inaccurate during a leap second. Also time difference calculations often produce inaccurate results straddling a leap second. For example the value for time_t given to you at the same UTC time yesterday is exactly 86400 seconds smaller than today's value, even if there was actually a leap second.

The astronomy community has solved this. Here is the SOFA Library that has proper time routines within. See their manual (PDF), the section on timescales. If made part of your software and kept up to date (a new version is needed for each new leap second) you have accurate time calculations, conversions and display.