(eBook PDF) Model Driven Development for

Embedded Software: Application to Communications

for Drone Swarm instant download

https://ebooksecure.com/product/ebook-pdf-model-driven-
development-for-embedded-software-application-to-communications-
for-drone-swarm/

Download more ebook from https://ebooksecure.com

We believe these products will be a great fit for you. Click
the link to download now, or visit ebooksecure.com
to discover even more!

Data-Driven and Model-Based Methods for Fault Detection

and Diagnosis 1st Edition - eBook PDF

https://ebooksecure.com/download/data-driven-and-model-based-
methods-for-fault-detection-and-diagnosis-ebook-pdf/

(eBook PDF) Introduction to Graphics Communications for

Engineers 5th Edition

http://ebooksecure.com/product/ebook-pdf-introduction-to-
graphics-communications-for-engineers-5th-edition/

(eBook PDF) Translational Medicine in CNS Drug

Development, Volume 29

http://ebooksecure.com/product/ebook-pdf-translational-medicine-
in-cns-drug-development-volume-29/

(eBook PDF) Personalized Professional Learning: A Job-

Embedded Pathway for Elevating Teacher Voice

http://ebooksecure.com/product/ebook-pdf-personalized-
professional-learning-a-job-embedded-pathway-for-elevating-
teacher-voice/
Practical Application of Supercritical Fluid
Chromatography for Pharmaceutical Research and
Development 1st Edition - eBook PDF

https://ebooksecure.com/download/practical-application-of-
supercritical-fluid-chromatography-for-pharmaceutical-research-
and-development-ebook-pdf/

(eBook PDF) Theory and Research for Academic Nurse

Educators: Application to Practice

http://ebooksecure.com/product/ebook-pdf-theory-and-research-for-
academic-nurse-educators-application-to-practice/

Titanium Alloys for Biomedical Development and

Applications: Design, Microstructure, Properties, and
Application 1st Edition - eBook PDF

https://ebooksecure.com/download/titanium-alloys-for-biomedical-
development-and-applications-design-microstructure-properties-
and-application-ebook-pdf/

Introduction to Graphics Communications for Engineers

5th Edition Gary Robert Bertoline - eBook PDF

https://ebooksecure.com/download/introduction-to-graphics-
communications-for-engineers-ebook-pdf/

(eBook PDF) Engineering Software Products: An

Introduction to Modern Software Engineering

http://ebooksecure.com/product/ebook-pdf-engineering-software-
products-an-introduction-to-modern-software-engineering/
Model-driven Development for Embedded Software
This page intentionally left blank
Model-driven Development
for Embedded Software

Application to Communications
for Drone Swarm

Jean-Aimé Maxa
Mohamed Slim Ben Mahmoud
Nicolas Larrieu
First published 2018 in Great Britain and the United States by ISTE Press Ltd and Elsevier Ltd

Apart from any fair dealing for the purposes of research or private study, or criticism or review, as
permitted under the Copyright, Designs and Patents Act 1988, this publication may only be reproduced,
stored or transmitted, in any form or by any means, with the prior permission in writing of the publishers,
or in the case of reprographic reproduction in accordance with the terms and licenses issued by the
CLA. Enquiries concerning reproduction outside these terms should be sent to the publishers at the
undermentioned address:

ISTE Press Ltd Elsevier Ltd

27-37 St George’s Road The Boulevard, Langford Lane
London SW19 4EU Kidlington, Oxford, OX5 1GB
UK UK
www.iste.co.uk www.elsevier.com

Notices
Knowledge and best practice in this field are constantly changing. As new research and experience
broaden our understanding, changes in research methods, professional practices, or medical treatment
may become necessary.

Practitioners and researchers must always rely on their own experience and knowledge in evaluating and
using any information, methods, compounds, or experiments described herein. In using such information
or methods they should be mindful of their own safety and the safety of others, including parties for
whom they have a professional responsibility.

To the fullest extent of the law, neither the Publisher nor the authors, contributors, or editors, assume any
liability for any injury and/or damage to persons or property as a matter of products liability, negligence
or otherwise, or from any use or operation of any methods, products, instructions, or ideas contained in
the material herein.
®
MATLAB is a trademark of The MathWorks, Inc. and is used with permission. The MathWorks does not
warrant the accuracy of the text or exercises in this book. This book’s use or discussion of MATLAB®
software or related products does not constitute endorsement or sponsorship by The MathWorks of a
®
particular pedagogical approach or particular use of the MATLAB software.

For information on all our publications visit our website at http://store.elsevier.com/

© ISTE Press Ltd 2018

The rights of Jean-Aimé Maxa, Mohamed Slim Ben Mahmoud and Nicolas Larrieu to be identified as the
authors of this work have been asserted by them in accordance with the Copyright, Designs and Patents
Act 1988.

British Library Cataloguing-in-Publication Data

A CIP record for this book is available from the British Library
Library of Congress Cataloging in Publication Data
A catalog record for this book is available from the Library of Congress
ISBN 978-1-78548-263-2

Printed and bound in the UK and US

 Contents

Preface . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . ix

Introduction and Approach . . . . . . . . . . . . . . . . . . . . . . . xi

Chapter 1. State of the Art of Model-driven Development

(MDD) as Applied to Aeronautical Systems . . . . . . . . . . . . 1
1.1. Principle of MDD . . . . . . . . . . . . . . . . . . . . . . . . . . 1
1.2. Use in avionics . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2
1.2.1. System virtualization: Integrated Modular
Avionics . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 3
1.2.2. MILS: divide and conquer to ensure security . . . . . . . . . 3
1.2.3. Combined treatment of safety and security
considerations . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 6
1.2.4. Certification of an avionics system . . . . . . . . . . . . . . . 7
1.3. The case of drones (UAS - Unmanned
Aerial Systems) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 9
1.3.1. The need for a new rapid prototyping
methodology for UAS design . . . . . . . . . . . . . . . . . . . . . 9
1.3.2. Safety standards . . . . . . . . . . . . . . . . . . . . . . . . . 11
1.3.3. Software development lifecycle . . . . . . . . . . . . . . . . 12

Chapter 2. Original Rapid Prototyping Method for

Embedded Systems for UAVs . . . . . . . . . . . . . . . . . . . . . 15
2.1. Using models to auto-generate a system . . . . . . . . . . . . . . 15
2.1.1. Presentation of different steps . . . . . . . . . . . . . . . . . 15
vi Model-driven Development for Embedded Software

2.2. Formal verification of models . . . . . . . . . . . . . . . . . . . 18

2.2.1. Model analysis . . . . . . . . . . . . . . . . . . . . . . . . . . 19
2.3. Advantages of MDD (Model-driven Development)
methodologies . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 21
2.4. MDD contributions to UAS certification . . . . . . . . . . . . . 22
2.5. Choice of tools for applying MDD methodology . . . . . . . . . 26
2.6. AVISPA: a formal verification tool for
security protocols . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 32
2.7. The need for verification . . . . . . . . . . . . . . . . . . . . . . 33
2.7.1. Why use AVISPA? . . . . . . . . . . . . . . . . . . . . . . . . 34
2.8. Additional tools: simulation and experimentation . . . . . . . . 36
2.8.1. Testing and validation using emulation and
network simulations . . . . . . . . . . . . . . . . . . . . . . . . . . 36
2.8.2. Testing and validation using real experiments . . . . . . . . 41

Chapter 3. Application to Communications

in a Drone Fleet . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 43
3.1. Introduction . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 43
3.2. Cooperating unmanned aeronautical systems . . . . . . . . . . . 44
3.2.1. Unmanned Aircraft/Aerial Systems . . . . . . . . . . . . . . 45
3.2.2. Payload . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 46
3.2.3. Ground station . . . . . . . . . . . . . . . . . . . . . . . . . . 46
3.2.4. Drone fleets . . . . . . . . . . . . . . . . . . . . . . . . . . . 46
3.3. Ad hoc communications architecture for
a drone fleet . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 47
3.3.1. Ad hoc drone network . . . . . . . . . . . . . . . . . . . . . . 49
3.4. Routing protocols in an ad hoc drone network . . . . . . . . . . 52
3.4.1. Hierarchical protocols . . . . . . . . . . . . . . . . . . . . . . 54
3.4.2. Reactive protocols . . . . . . . . . . . . . . . . . . . . . . . . 54
3.4.3. Proactive protocols . . . . . . . . . . . . . . . . . . . . . . . 55
3.4.4. Geographic protocols . . . . . . . . . . . . . . . . . . . . . . 56
3.4.5. UAANET networks and routing protocols:
discussion . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 57
3.5. Security in an ad hoc drone network . . . . . . . . . . . . . . . . 59
3.5.1. Weaknesses in UAANET networks . . . . . . . . . . . . . . 60
3.5.2. Attacks on UAANET networks . . . . . . . . . . . . . . . . 62
 Contents vii

3.5.3. SAODV secure ad hoc routing protocols . . . . . . . . . . . 68

3.6. Designing a new secure routing protocol for
UAANETs (SUAP: Secure UAANET Routing Protocol) . . . . . . . 74
3.6.1. Choosing an initial routing protocol . . . . . . . . . . . . . . 75
3.6.2. The SUAP protocol . . . . . . . . . . . . . . . . . . . . . . . 76
3.6.3. The SAODV protocol . . . . . . . . . . . . . . . . . . . . . . 79
3.6.4. Wormhole attacks . . . . . . . . . . . . . . . . . . . . . . . . 84
3.6.5. Single attacker variant . . . . . . . . . . . . . . . . . . . . . . 84
3.6.6. State of the art: solutions for defense against
wormhole attacks . . . . . . . . . . . . . . . . . . . . . . . . . . . . 86
3.6.7. A new method for detecting and defending
against wormhole attacks . . . . . . . . . . . . . . . . . . . . . . . 91
3.6.8. Defense mechanism for single-attacker
wormhole attacks . . . . . . . . . . . . . . . . . . . . . . . . . . . . 97
3.6.9. Limitations of the SUAP protocol . . . . . . . . . . . . . . . 99
3.7. Using the AVISPA tool to verify the security properties
of the SUAP protocol . . . . . . . . . . . . . . . . . . . . . . . . . . . 100
3.7.1. Application of the SUAP protocol . . . . . . . . . . . . . . . 101
3.7.2. Analysis of the specification of the SUAP
protocol . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 103
3.8. Implementation of the SUAP protocol . . . . . . . . . . . . . . . 104
3.8.1. Software architecture of the SUAP
algorithm . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 105
3.8.2. Modeling the SUAP protocol . . . . . . . . . . . . . . . . . . 106
3.8.3. Use of the model-driven approach in developing
the SUAP protocol . . . . . . . . . . . . . . . . . . . . . . . . . . . 114
3.8.4. Implementation of the SUAP protocol . . . . . . . . . . . . . 116
3.9. Validation of the SUAP protocol by performance
evaluation . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 118
3.9.1. Validation of the routing partition . . . . . . . . . . . . . . . 119
3.9.2. Validation of the security functions of the
SUAP protocol . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 131
3.9.3. Validation of the wormhole detection
mechanism . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 145
3.9.4. Validation by performance evaluation:
discussion . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 150
viii Model-driven Development for Embedded Software

Conclusions and Perspectives . . . . . . . . . . . . . . . . . . . . 153

Bibliography . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 159

Index . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 169
 Preface

The aim of this book is to describe the principles of model-oriented design

used in the field of aeronautics, specifically for unmanned aerial vehicles
(UAVs) or drones.

In this book, we will focus on the design of an on-board system for UAV
ad hoc communications. In this context, we present an original rapid
prototyping methodology for complex embedded systems, showing how this
approach creates considerable time savings in the verification and formal
validation phases, contributing to UAS (Unmanned Aerial System)
certification.

We will also discuss more traditional, but necessary, verification phases

which must be carried out in order to verify system performances. This
evaluation is conducted through network simulation and testbed
experimentations.

The different tools required to implement this methodology will also be

described in order to allow readers to reproduce all or part of the approach
themselves.

Finally, in order to illustrate the benefits of our new approach, we provide

an example of use through the development of an embedded system in the
field of aeronautics, specifying the different phases of the methodology. The
x Model-driven Development for Embedded Software

aim is to design, validate and test a new secure routing protocol for UAV ad
hoc communications.

Jean-Aimé M AXA
Mohamed Slim B EN M AHMOUD
Nicolas L ARRIEU
January 2018
 Introduction and Approach

The drone industry is rapidly evolving. The type and the usage of
industrial drones have changed considerably over the last five years. Drones
are now able to carry increasingly complex payloads, with unprecedented
levels of autonomy and automation during their assigned missions.

This increase in UAV complexity levels requires improvements in the

processes and methods used for their design and evaluation and for the
success of missions in which they are involved. The aim of this book is to
present a new rapid prototyping method, intended for the design of complex
embedded systems using simple and intuitive design tools. The work
presented here is inspired by previous contributions to the aeronautical
domain, where the complexity inherent in the development of embedded
systems has received considerable attention over the past few decades.

The work presented in this book is innovative in terms of the relevance of

the rapid prototyping method presented in Chapter 2, and also in terms of the
application of this method. The communicating drone network project which
will be presented later in this book is one of the very first experiments in
which multiple UAVs, with shared mission objectives, have been able to
exchange surveillance information (video) securely and in real time. Thus, in
this implementation, security is dependent on the type of communication
network (an ad hoc network in which each drone may act as an emitter,
relayer or receiver of information), and also on the security mechanisms
applied to information exchanges during the fleet mission. Note that all of the
protocols presented later in this work were defined, designed and evaluated
using the rapid prototyping method presented here. To the best of our
xii Model-driven Development for Embedded Software

knowledge, no other similar work in the field of embedded systems has

involved the application of model-oriented methods to the specific context of
communicating drone networks.

The rest of this work will be organized as follows. Chapter 2 is given over
to a state of the art of model-driven development methods applied to
aeronautical systems. Drones are usually considered as autonomous aircraft,
as the software requirements are similar to those for conventional aircraft. It is
thus interesting to compare existing approaches to MDD (Model-Driven
Development) for traditional aircraft (e.g. an Airbus A380) with those used
for UAS (Unmanned Aerial Systems).

In Chapter 2, we will present our prototyping method for embedded drone

systems. This original method is built on MDD principles in order to design
complex systems (e.g. a communicating drone network) with the assistance of
top-level artifacts. These artifacts rely on the use of a model-driven
formalism, allowing simple and rapid definition of the final system functions.
These high-level models have a higher power of expression than classic
software specifications, and thus simplify the validation of system
functionalities. Moreover, the use of high-level models creates new
possibilities in terms of formal verification methods, which will also be
discussed in this chapter. The phase in which the functionalities of the final
system are validated and verified is critical for aeronautical systems
(including drones); the certification requirements for flight authorization are
particularly stringent in this case. Formal verification methods, associated
with the use of high-level models for system design, make it possible to
reduce the engineering workload involved in the software validation phase
which follows modeling. These different points will be discussed in detail in
Chapter 2, along with a discussion of the advantages obtained by using formal
methods in conjunction with high-level models. Note, however, that formal
validation of high-level models is not sufficient to verify all functionalities of
the final system. This first phase of formal verification must be followed by a
more traditional verification phase (e.g. through unitary testing). Our
discussion will therefore also cover more “standard” verification tools used to
validate functionalities of the final system. We will pay particular attention to
a hybrid simulation tool developed specifically for the purposes of validating
network operations (at protocol level) for drone fleets. We will also focus on
 Introduction and Approach xiii

the physical components required to implement information exchange

functions in the embedded system in question (i.e. the Delair-Tech DT 18
drone).

Finally, we will give a detailed account of the implementation which led

us to define the rapid prototyping method presented in the previous chapter.
This implementation exemplifies a very promising application of drone fleets,
involving the simultaneous use of multiple UAVs to cover a far larger
geographical area than would be possible with one drone. For drones to
operate as a fleet, they need to be able to communicate in order to reduce the
number of control and information exchange stations needed for the
surveillance mission. This principle leads to the definition of an ad hoc drone
network. In this context, new communication protocols were defined and
implemented using our rapid prototyping method. The final chapter of this
work notably includes the presentation of a new routing protocol, which takes
account of the vulnerabilities inherent in ad hoc communication networks,
and proposes new mechanisms for efficiently solving these issues. The
improvements to the routing protocol are intended to increase the security of
the ad hoc network, improving service for surveillance missions. The final
chapter will describe the model-driven development process for the new
routing protocol. This evaluation will focus on three aspects: the use of
formal methods; the use of a hybrid simulation tool; and real experiments, in
which multiple drones were involved in a geographically distributed
surveillance mission.
This page intentionally left blank
 1

State of the Art of Model-driven

Development (MDD) as Applied to
Aeronautical Systems

1.1. Principle of MDD

Faced with an exponential increase in program complexity, operators in the

aeronautical sector have established software-based certification procedures
based on the use of model-driven methods. These methods guarantee a certain
level of operational security, and in some cases make the design process easier.

Generally speaking, software which is embedded in a critical system such

as an airplane or other aircraft must be subject to certain certification
constraints in order to be considered trustworthy. Certification implies a
certain degree of confidence in the system. For software in particular, it is
important to show that the design follows a development process in
accordance with the state of the art in the aeronautical sector.

Most software design methods are based on UML (Unified Modeling

Language) [RUM 04]. However, these methods need to be adapted to take
account of the operating environment of the final system. Methods based on
UML only allow high-level descriptions of a system, with no consideration
for the constraints involved in its physical implementation and execution.
Moreover, UML does not respond to design requirements in the aeronautical
context, or in the case of drones. This is due to the fact that it does not possess
the toolchains required to contribute to the validation of a critical system. In
2 Model-driven Development for Embedded Software

the context of designing an embedded software program for manned or

unmanned aircraft, software certification must be taken into account during
the design phase. This consideration implies the use of chains of design tools
which contribute to the attainment of certification for the final system.

Model-driven approaches aim to generate some or all of a system through

the use of high-level models. This paradigm increases productivity while also
optimizing compatibility between different sub-systems, thanks to widespread
reuse of normalized models. This also simplifies the software design process
and facilitates model reuse due to the levels of abstraction encountered in the
associated professional logic.

Model-driven approaches use models to improve the forecasting, design,

implementation and modification of systems. They offer a number of
advantages. First, they encourage the efficient use of high-level models in the
design process. They also offer the possibility of using better design practices
in system creation. The main aims of the MDD approach include portability,
interoperability and reusability, via the separation of platform-dependent
aspects and more abstract aspects which are not dependent on a specific
application. This type of approach was introduced and defined by the OMG
(Object Management Group), which aimed to develop the object-oriented
approach while increasing the level of abstraction to the point of using
another representation of concepts and relationships drawn from an initial
specification, i.e. the model. A model is an abstract representation of the
knowledge and activities which govern a domain of application, making it
easier to understand the final system. This development technique allows
designers to focus on desired system behaviors rather than on
implementation. The partial generation of code using model specifications
leads, among other things, to savings in terms of development costs.

1.2. Use in avionics

Improvements in the performance of aeronautical systems mean that it is

now possible to envisage the use of new technologies in the context of
embedded aeronautical systems on aircraft, along with the opening up of
avionic networks, previously closed for security reasons, to public networks
such as the Internet. These new technologies require new solutions in order to
maintain the high levels of security required.
 State of the Art of Model-driven Development (MDD) as Applied to Aeronautical Systems 3

1.2.1. System virtualization: Integrated Modular Avionics

The first generations of avionic software systems were based on direct

relationships between systems: when a captor transmitted an element of
information to two on-board computers, the data was duplicated and sent over
two independent communication channels, each serving a single receiver. The
development of new technologies has resulted in the creation of new services
for crews and in the introduction of new interactions.

A new concept, Integrated Modular Avionics (IMA), was introduced with

the development of the A380. It allows several independent programs to be
executed within a single hardware module. RTCA (Radio Technical
Commission for Aeronautics) DO-297, the Integrated Modular Avionics
Development Guidance and Certification Considerations standard of 8th
November 2005, sets out a framework for the design and implementation of
systems for integrated modular avionic architectures in civil aviation. Created
by Special Committee 200 (SC-200), this standard defines IMA as “a shared
set of flexible, reusable, and interoperable hardware and software resources
that, when integrated, form a platform that provides services, designed and
verified to a defined set of requirements, to host applications performing
aircraft functions”. This standard defines and delimits the roles of different
IMA module suppliers: application suppliers, IMA platform suppliers, system
integrators and certification agents.

1.2.2. MILS: divide and conquer to ensure security

The segregation of participants which occurs in virtualization solutions

makes it useful for increasing the security of sensitive applications. This
observation led to the gradual development of the concept of Multiple [and]
Independent Levels of Security[/Safety] (MILS) architectures. Based on John
Rushby’s work on micro-kernel separation, MILS architectures guarantee a
high level of security for the execution of multiple programs in a single
infrastructure.

The division of a complex task into several simpler tasks is a fundamental

principle of engineering. In computing, this equates to decomposing or
dividing a program into modules. This simplifies security assessments, as the
evaluator does not need to evaluate a whole, monolithic system, but rather a
set of smaller, distinct modules and pairings.
4 Model-driven Development for Embedded Software

Virtualization solutions may be implemented for developing a support for

MILS architecture on the condition that they guarantee respect for the four
intrinsic properties of MILS:
– the solution must be impossible to circumvent, i.e. no entity may
communicate with the system without passing the security checks imposed
by the host system;
– it must be possible to evaluate the solution, with formal proof that the
virtualization system (and thus the host) operates in a correct and valid fashion;
– the solution must always be active: all communications are monitored,
not just the first messages exchanged;
– the solution must be resistant to alteration, preventing any modification
without explicit authorization.

These properties are guaranteed via an evaluation of the security of the

solution. Even for “small” systems, this evaluation is complex; it is only
achievable for minimalist systems (microsystems) intended for system
virtualization and separation, known as separation microkernels. Separation
microkernels ensure the implementation of concepts of temporal and spatial
separation between programs, while monitoring information flows. The
kernel ensures that each program and its virtual machine (VM) are able to use
hardware resources during their assigned times. A program cannot hinder the
operation of another program, “stealing” its operating time; there is thus a
temporal separation between the two VMs. The kernel also guarantees that a
hardware resource will not be simultaneously assigned to two virtual
machines. The addressing spaces in the memory and input/output channels
are shared out during configuration of the separation kernel: this is known as
partitioning the addressing space.

Each instance of execution at each access point is checked by the kernel to

ensure that the address accessed by the real machine is that which has been
assigned to it. The kernel will block any access attempts which do not fulfill
this condition, ensuring the spatial separation of VMs. Similarly, VMs may
make use of specific channels to communicate with each other, which are also
managed by the separation kernel (rather than operating directly through the
subjacent electronics). The kernel thus monitors the form of communications,
checking the maximum length of sent messages, authorizing access, stamping
 State of the Art of Model-driven Development (MDD) as Applied to Aeronautical Systems 5

received messages, etc. In an MILS system, each virtual machine operates

independently of its counterparts. From the perspective of the host separation
kernel, each VM has its own dedicated addressing sub-space. The set of these
sub-spaces is a partition (in the mathematical sense of the term) of the host’s
full addressing space. Each VM has specific assigned time slots within a
cycle, and these slots make up a time partition. In the context of an MILS
architecture, the term “partition” therefore relates to the temporal and spatial
resources associated with a virtual machine. During system execution, the
separation kernel acts as a partition scheduler and as a compulsory point of
passage to access resources.

An MILS system needs to guarantee certain properties:

– in terms of inter-partition information flows, only authorized sources
should be able to generate information, and information should only be
delivered to specified, authorized recipients;
– data in a partition should only be accessible to programs associated with
the partition in question, and should be isolated from data from other partitions.
Private data remains private, with no possibility of infiltration (reading from
another partition) or exfiltration (writing data to another partition). This means
that each partition must have a dedicated addressing space, in which addresses
only have meaning for the partition which uses that space;
– the processor itself must not allow information to travel from one
partition to another, whether through material caches or even in measures of
processing time. For example, a form of attack exists which involves analyzing
processing cycle counters to extract information relating to cryptographic keys,
as discussed in (Kocher, 1996). MILS systems must be as resistant as possible
to attacks of this kind;
– operating errors in one partition should not have an impact on the other
partitions, and should be detected, contained and corrected. MILS systems,
used in military and civil information systems, have attracted growing interest
in the aeronautical sector. However, virtualization is already used in this
area, with a slightly different goal - that of enabling hardware sharing while
maintaining high levels of security (operational safety), as we saw in the case
of IMA. The current aim in aeronautics is to allow these two aspects (security
and safety) to be treated together, as we will see in the following section.
6 Model-driven Development for Embedded Software

1.2.3. Combined treatment of safety and security considerations

The development of embedded systems in aircraft is subject to significant

constraints, both in terms of operational safety and security. In aeronautics,
the term “safety” is used to denote both the security and the operational safety
of systems, i.e. the intrinsic properties of systems which make them resistant
to operating errors. The term “security” relates to the ability of aeronautical
systems to resist deliberate attacks (pirating, etc.).

The safety constraints encountered in the domain of avionics have always

been particularly stringent. Any general operating fault in an aircraft may lead
to its partial or total destruction, endangering human lives. Different
aeronautics standards specify safety constraints which must be respected in
order for aircraft to be allowed to fly. Critical embedded avionic programs,
such as autopilots, are subject to standard RTCA DO-178B.

DO-178B defines five Design Assurance Levels (DAL) for the

development of avionic software. DAL-A is the highest and most restrictive
level and is used for critical applications where an operating fault could have
catastrophic consequences, while DAL-E is much less restrictive, and is
reserved for applications which do not affect the safety of the aircraft in any
way. The standard DO-178B and the different levels of DAL will be discussed
in greater detail in section 1.3.2. Programs must be evaluated on the basis of
safety criteria before being embedded and used in an aircraft. This
verification activity, known as certification, is carried out by independent
organizations at the national level. In France, for example, aeronautical
systems are certified by the DGAC (Direction Générale de l’Aviation Civile).

Originally, aerospace firms focused their in-depth work on safety

considerations, considering the complexity of embedded systems and the
closure of avionic networks to be sufficient to guarantee security. Since the
9/11 attacks, however, security has become a major consideration in system
design, which has led to the introduction of new constraints and new
practices. Sensitive products must be security checked via an evaluation
process. Security requirements may be grouped into “packets” of
requirements for the purposes of evaluating the final products. There are
seven of these packets for assurance requirements alone, known as the
Evaluation Assurance Levels or the EAL, and number from 1 to 7. EAL-2, for
example, encompasses all of the requirements of EAL-1 plus a number of
 State of the Art of Model-driven Development (MDD) as Applied to Aeronautical Systems 7

additional elements, and so on up to EAL-7, the highest level of security

assurance which may be assigned according to the CC ITSEC (Common
Criteria for Information Technology Security Evaluation) nomenclature. This
standard has been adopted by the ISO as ISO CEI 15408, and is often referred
to simply as the “Common Criteria” or the CC; it is used to evaluate whole
systems with regard to security requirements.

Despite the existence of these two standards (DAL and EAL), certification
(guaranteeing system safety) and evaluation (guaranteeing system security)
are currently treated independently and in parallel; certain very similar
verifications are thus carried out twice. Work on defining a new development
method covering both safety and security aspects, while avoiding redundancy
in the steps and processes involved, is currently underway. However, this lies
outside the scope of our work here, and will not be addressed further.

1.2.4. Certification of an avionics system

1.2.4.1. Qualification of tools for certification

The cost of certifying avionic software, in terms of time, man-hours and
money, increases as the required level of assurance increases. An airplane
autopilot requiring DAL-A certification can take hundreds of engineers
several years to define, at a cost reaching into the millions of dollars; DAL-A
certification involves 66 independent checks. The program controlling “No
Smoking” and “Fasten Seat Belt” light displays in aircraft, however, only
requires DAL-D certification, involving a mere 15 control tasks. The
development of this program is much less costly due to its low impact on
aircraft safety. During the design process, certification costs may be reduced
by automating certain control tasks via the use of specific tools which
guarantee certain safety properties. The use of a DAL-A qualified compiler
for conformity, for example, guarantees that the binary code conforms to the
source code, fulfilling the “verify the conformity of binary code with source
code” requirement for DAL-A certification. However, the tool (in this case,
the compiler) itself needs to be verified to ensure that it does not introduce
errors. The verification of software tools is known as qualification, and is
carried out in a similar way to aeronautical software certification.
8 Model-driven Development for Embedded Software

1.2.4.2. Model-driven design approaches in aeronautics

MDD (Model-driven Development) approaches have long been used in

traditional software engineering. Unified Modeling Language (UML) is the
most widespread language used across all industries as a support for design
methods when defining and implementing classic software. However, this
toolkit cannot be used for certain specific developments, including embedded
software in the aeronautic and aerospace industries. The main issue with
UML-based design methods lies in the fact that the tools used to produce final
software systems are unable to take account of certification requirements.
This is not necessarily problematic for mass market applications (e.g. when
designing web services) which may make use of UML, or for industrial
applications with limited constraints. However, it must be taken into account
in the case of critical applications, such as aircraft or satellites. Certification
of the final product must be taken into account, and the toolchains used in the
appropriate standardization process for applications with high security and
safety requirements must be integrated.

Note that the certification process for embedded software designed for
specific uses in the aeronautical industry is highly and precisely codified.
There are several standards which must be taken into account. Here, we will
only consider those relating to software engineering for embedded systems:
DO-178 C and DO-331.

1.2.4.3. DO-178C: Software Considerations in Airborne Systems and

Equipment Certification

This document was issued by the RTCA in 2012 and constitutes the fourth
edition of a document that defines the applicable standards for certifying
embedded avionic software systems. This latest version takes account of the
latest developments in MDD for software engineering. Notably, it takes
account of the possibility of validating systems using formal verification
methods for the first time in an aeronautical context; this approach can reduce
the number of unitary tests required for validation of a final product. It
constitutes a significant advance in aeronautical engineering, with a profound
impact on the way in which aeronautical systems will be designed and
produced in future. The document highlights MDD approaches which are
able to automatically generate source code from high-level models, defining
the functionalities and behaviors of the final system.
 State of the Art of Model-driven Development (MDD) as Applied to Aeronautical Systems 9

1.2.4.4. DO-331: Model-Based Development and Verification

DO-331 is a supplement to the DO-178C standardization document which
suggests classes of tools and methods which may be used to automatically
generate source code and to validate the high-level models used in the
automatic code generation process. DO-331 recommends the use of
model-based verification methods. The RTCA notably recommends three
types of mechanisms to facilitate the verification process: model checking,
formal proofs and code assertions. These different verification techniques
have been used for several years in other areas of industry, and have now
reached a sufficient level of maturity for application in complex
environments, such as aeronautical validation and certification processes.

1.3. The case of drones (UAS - Unmanned Aerial Systems)

In the field of drones, the different perspectives for application offered by

UAS show promise in terms of the possibility of carrying out flexible and
evolutive missions. These missions are generally carried out over inhabited
areas within national airspace. It is therefore essential to ensure that missions
are carried out successfully, covering every eventuality for every system
module, in order to prevent operational failures with potentially catastrophic
consequences (e.g. loss of life). As yet, there is no operational safety standard
for unmanned aircraft. A document of this type would be helpful in defining
the lifecycle and security levels of the embedded systems making up the
UAS. We will focus on this type of problem here, considering the engineering
aspect of developing complex systems and proposing a rapid prototyping
methodology for the development of a secure routing protocol for a fleet of
drones.

1.3.1. The need for a new rapid prototyping methodology for UAS
design

A drone system is generally made up of several software modules, each

responsible for a set of specific functions. These modules are involved in
dynamic exchanges of information relating to their environment, allowing
them to offer different types of services during a given mission. To take
account of this critical environment, operational safety assurances are needed
when developing software for use within the UAS, ensuring maximum
10 Model-driven Development for Embedded Software

conformity between the specification and implementation of the source code.

Note that in critical embedded systems, we speak of operational safety in
terms of something which is dependent on the system operating correctly in
response to input; the term does not cover information security aspects. The
term is used here as it is widely used in existing literature on design studies
for critical software.

Moreover, civil drones currently operate in specific airspaces, separate

from the space used by short-, medium- and long-haul aviation. However,
UAVs may need to share airspace with civil aircraft to fulfill certain
commercial applications. For this to be possible, operational validation of the
autopilot system will be required. This process consists of going through each
of the systems involved in the UAS, studying their execution in every possible
circumstance. Our contribution to the validation process is based on a solution
adopted in the aeronautical field, making use of a rapid prototyping
methodology in order to verify the operational safety of software during the
design process. This method is based on a model-driven architecture, using a
chain of formal verification and code generation tools. It ensures full
traceability of requirements from the specification to their implementation in
the source code. This method also offers portability and allows for the reuse
of source code via the separation of platform-specific aspects and abstract
aspects used to describe the system.

Our aim in this book is to illustrate the use of our model-driven rapid
prototyping method via the implementation of a secure communication
architecture in a drone fleet. This architecture is intended to supplement the
software architecture which is already used in the Delair-Tech UAS1. While
the current architecture already allows single drones to be flown in French
civil airspace [MAN 15], the new system, involving a fleet of UAVs, needs to
pass a further validation test. The use of drones in fleets results in new
behaviors (particularly in cases where traffic command and control messages
are transmitted through the fleet) which are not present in current
sub-systems, meaning that a new global validation is required.

Our focus here is on contributing to validating our secure routing protocol

through the use of a model-driven methodology. To validate this protocol, the

1 We worked in partnership with Delair-Tech on the implementation and real-world validation

activities described in this book.
Discovering Diverse Content Through
Random Scribd Documents
 ADMIRAL FARRAGUT

During that hour, a colored servant employed in the White House,

whose heart was blacker than his sooty skin, had left the mansion,
had sought a tumble-down tenement in the slums, and had found
there a vulture of a man, very white as to face, very black as to the
masses of hair that fell to his shoulders.
"Dat dar boy Strong, he's dun sure goin'," said the darkey, "wid
papers fur dat General Grant out West."
"How do you know?"
"Coz I listened to de door, when dey-uns wuz a-talkin'."
"He'll have to go West by Baltimore," mused the white man. "The
next train leaves in half an hour. I can make it. Here, Reub, here's
your pay."
He took a five-dollar gold piece from his pocket. The negro clutched
at it. Then what was left of his conscience stirred within him. He
said, pleadingly, hesitatingly:
"Massa, you knows I'se doin' dis coz old Massa told me to. You ain't
a-goin' to hurt dat boy Strong, is you? He's a nice boy. Eberybody
lubs him up dar."
"What is it to you, confound you!" snarled the man, "whether I hurt
him or not? What's a boy's life to winning the war? You keep on
doing what old Massa told you to do, or I'll cut your black heart out."
With a savage gesture, he thrust the trembling negro out of the
dingy room. With savage haste, he packed his scanty belongings.
With a pistol in his hip pocket, with a bowie-knife slung over his left
breast beneath his waistcoat, with a vial of chloroform in his valise,
Wilkes Booth left Washington on the trail of Tom Strong.

Hunter and hunted were in the same car. Tom little dreamed that a
few seats behind him sat a deadly foe, who would stick at nothing to
get the precious papers he carried. Washington swarmed with
Confederate spies. The face of everybody at the White House was
well known to every spy. The hunter did not have to guess where
the hunted sat.
General Grant had begun his career of victory in the West. It was all-
important to the Confederacy to know where his next blow was to
be aimed. The papers in the scout's possession would tell that great
secret. Wilkes Booth meant to have those papers soon. As the train
bumped over the rough iron rails, towards Baltimore, Booth went to
the forward end of the car for a glass of water and as he walked
back along the aisle with a slow, lounging step, he stopped where
Tom sat and held out his hand, saying:
"How do you do, Mr. Strong? I'm Mr. Barnard. I have had the
pleasure of seeing you about the White House sometimes, when I
have been calling on our great President. Lincoln will crush these
accursed rebels soon!"
It was a trifle overdone, a trifle theatrical. Wilkes Booth could never
help being theatrical. His greeting was one of the few times Tom had
ever been called "Mister." He felt flattered and took the proffered
hand willingly, but he searched his memory in vain for any real
recollection of the striking face of the man who spoke to him. There
was some vague stirring of memory about it, but certainly this had
no relation to that happy life at the White House. Something evil was
connected with it. Puzzled, he wondered. He had seen Booth under
arms at John Brown's scaffold, but he did not remember that.
The alleged Mr. Barnard slipped into the seat beside him and began
to talk. He talked well. Little by little, suspicion fell asleep in Tom's
mind as his companion told of adventures on sea and land. Booth
was trying to seem to talk with very great frankness, in order to lure
Tom into a similar frankness about himself. He larded all his talk with
protestations of fervent loyalty to the Union. Tom bethought himself
of a favorite quotation his father often used from Shakespeare's
great play of "Hamlet." The conscience-stricken queen says to
Hamlet, her son:
"The lady doth protest too much, methinks."
Wilkes Booth was protesting too much. The drowsy suspicion in
Tom's mind stirred again. But he was but a boy and Booth was a
man, skilled in all the craft of the stage. Once more his easy, brilliant
talk lulled caution to sleep. Tom, questioned so skillfully that he did
not know he was being drawn out, little by little told the story of his
short life. But the story ended with his saying he was going to
Harrisburg "on business." He was still enough on his guard not to
admit he was going further than Harrisburg.
"You're pretty young to be on the way to the State Capitol on
business," said the skillful actor, hoping to hear more details in
answer to the half-implied sneer. But just then Tom remembered
what his father had advised: "Never say anything to anybody, unless
you are sure the President would wish you to say it." He shut up like
a clam. Booth could get nothing more out of him. But he meant to
get those dispatches out of him. They were either in the boy's
pocket or his valise, probably in his pocket. When he fell asleep, the
spy's time would come. So the spy waited.
Darkness came. Two smoky oil-lamps gave such light as they could.
The train rumbled on in the night. There were no sleeping cars then.
People slept in their seats, if they slept at all. Booth's tones grew
soothing, almost tender. They served as a lullaby. Tom slept. The spy
beside him drew a long, triumphant breath. His time had come.
Some time before, he had shifted his traveling-bag to this seat. Now
he drew from it, gently, quietly, the little bottle of chloroform and a
small sponge, which he saturated with the stupefying drug. Then he
slipped his arm under the sleeping boy's head, drew him a little
closer to himself, and glanced through the dusky car. Nearly
everybody was asleep. Those who were not were trying to go to
sleep. No one was watching. Booth pressed the sponge to Tom's
nostrils. Tom stirred uneasily. "Sh-sh, Tom," purred the actor, "go to
sleep; all's well." The drug soon did its work. The boy was dead to
the world for awhile. Only a shock could rouse him.
The shock came. Booth's long, sensitive, skilled fingers—the fingers
of a musician—ransacked his coat and waistcoat pockets swiftly,
finding nothing. But beneath the waistcoat their tell-tale touches had
detected the longed-for papers. The waistcoat was deftly
unbuttoned—it could have been stripped off without arousing the
unconscious boy—and a triumphant thrill shot through Booth's black
heart as he drew from an inner pocket the long, official envelope
that he knew must hold what he had stealthily sought. He was just
about to slip it into his own pocket and then to leave his stupefied
victim to sleep off the drug while he himself sought safety at the
next station, when one of those little things which have big results
occurred. The sturdy man who was snoring in the seat behind this
one happened to be a surgeon. He was returning from Washington,
whither he had gone to operate on a dear friend, a wounded officer.
Chloroform had of course been used, but the patient had died under
the knife. It had been a terrible experience for the operator. It had
made his sleep uneasy. A mere whiff from the sponge Booth had
used reached the surgeon's sensitive nostril. It revived the poignant
memories of the last few hours. He awoke with a start that brought
him to his feet. And there, just in front of him, he saw by the dim
light a boy sunk in stupefied slumber and a man glancing guiltily
back as he tried to thrust a stiff and crackling paper into his pocket.
The sponge had fallen to the floor, but its fumes, far-spreading now,
told to the practiced surgeon a story of foul play. He grabbed the
man by the shoulder and awoke most of the travelers, but not Tom,
with a stentorian shout: "What are you doing, you scoundrel?"
The scoundrel leaped to his feet, throwing off the doctor's hand, and
sprang into the aisle, clutching the long envelope in his left hand,
while his right held a revolver. He rushed for the door, pursued by
half a dozen men, headed by the doctor. Close pressed, he whirled
about and leveled his pistol at his unarmed pursuers. They fell back
a pace. He whirled again, stumbled over a bag in the aisle, fell,
sprang to his feet once more. A brakeman opened the door. He was
hurrying to see what this clamor meant. Wilkes Booth fired at him
pointblank. The bullet missed, but it made the brakeman give way.
Booth rushed by him, gained the platform and leaped from the slow
train into the sheltering night.
The shock that waked Tom was the sound of the shot. Weak, dizzy,
and sick, he knew only that some terrible thing was happening.
Instinctively, his hand sought that inner pocket, only to find it empty.
Then, indeed, he was wide awake. The horror of his loss burned
through his brain. He shouted: "Stop him! Stop thief!" and collapsed
again into his seat.
He was in fact a very sick boy. The dose of chloroform that had been
given him would have been an overdose for a man. Notwithstanding
his awakening, he might have relapsed into sleep and death, had not
the skillful surgeon been there to devote himself to him. An antidote
was forced down his throat. Willing volunteers, for of course the
whole car was now awake in a hurly-burly of question and answer,
rubbed life back into him. When he was a bit better, he was kept
walking up and down the aisle, while two strong men held him up
and his head swayed helplessly from side to side. But the final cure
came when the surgeon who had kept catlike watch upon him saw
that he could now begin to understand things.
"Here is something of yours," he whispered into the lad's half-
unconscious ear. "That scoundrel stole it from you. When he fell, he
must have dropped it on the floor. I found it there after he had
jumped off the platform."
Tom's hand closed over the fateful envelope. His trembling fingers
ran along its edges. It had not been opened. He had not betrayed
his trust. A profound thankfulness and joy stirred within him. Within
an hour he was practically himself again. Then he poured out his
heart in thanks to the sturdy surgeon who had saved not only his
life, but his honor. He asked his name and started at his reply:
"Dr. Hans Rolf, of York, Pennsylvania."
"Dr. Hans Rolf," repeated Tom, "but perhaps you are the grandson of
the Hans Rolf I've heard about all my life. My father is always telling
me of things Hans Rolf did for my grandfather and great-
grandfather."
"And what is your name?" queried the doctor, surprised as may be
imagined that this unknown boy should know him so well.
"Tom Strong."
"By the Powers," shouted the hearty doctor, seizing the boy's hand
and wringing it as his grandfather used to wring the hand of the
Tom Strongs he knew, "By the Powers, next to my own name there's
none I know so well as yours. My grandfather never wearied of
talking about the two Tom Strongs, father and son. The last day he
lived, he told me how your great-grandfather saved his life."
"And you know he saved great-grandfather's, too," answered Tom,
"and now you have saved mine."
He looked shyly at his preserver. He was still weak with the after-
effects of the drug that had been given him. The Hans Rolf he saw
was a bit blurred by the unshed tears through which he saw him.
"Nonsense," said the surgeon, "whatever I've done is just in the
day's work. But you must stop at York and rest. I can't let my patient
travel just yet, you know. And this may be your last chance to see
me at home. I go into the army next month."
However, Tom was not to be persuaded to stop. Duty called him
Westward and to the West he went, as fast as the slow trains of
those days could carry him. But when Hans Rolf and he parted, a
few hours after they had met, they were friends for life.
It took Tom two days to get from Harrisburg to Cairo, the
southernmost town in Illinois. It lies at the junction of the Mississippi
and Ohio rivers. The latter pours a mass of beautiful blue water—the
early French explorers named the Ohio "the beautiful river"—into the
muddy flood of the Mississippi. For miles below Cairo the blue and
yellow streams seem to flow side by side. Then the yellow swallows
the blue and the mighty Mississippi rolls its murky way to the Gulf of
Mexico. A gunboat took the young messenger from Cairo to General
Grant's headquarters.
 MISSISSIPPI RIVER GUNBOATS

A Western gunboat was an odd thing. James B. Eads, an eminent

engineer, who after the war built the St. Louis bridge and the New
Orleans jetties, which keep the mouth of the Mississippi open, had
launched a flotilla of gunboats for the government within four
months of the time when the trees which went to their making were
growing in the forests. On a flat-boat of the ordinary Western-river
type, Mr. Eads put a long cabin, framed of stout timbers, cut
portholes in the sides, front and rear of it, mounted cannon inside it,
covered it with rails outside (later armor-plate was used), and
behold, a gunboat. The one which sped swiftly with Tom down the
Mississippi and waddled slowly with him up the Tennessee, against
the current of the Spring freshets, finally landed him at Grant's
headquarters.
Tom approached the tent over which headquarters' flag was flying
with a beating heart. It beat against the long envelope that lay in
the inner pocket of his waistcoat. He was about to finish his task and
he was about to see the one successful soldier of the Union, up to
that time. The Northern armies had not done well in the East—the
defeat had been disgraceful and the panic sickening with the raw
troops at Bull Run, Virginia, and little had been gained elsewhere—
but in the West Grant was hammering out success. All eyes turned
to him.
Upon the top of a low knoll, half a dozen packing-boxes were
grouped in front of the tent. Two or three officers, most of them
spick and span, sat upon each box except one. Upon that one there
lounged a man, thick-set, bearded, his faded blue trousers thrust
into the tops of dusty boots, his blue flannel shirt open at the throat,
his worn blue coat carrying on each shoulder the single star of a
brigadier-general.
It was General Grant, Hiram Ulysses Grant, now known as U. S.
Grant. When the Confederate commander of Fort Donelson had
asked him for terms of surrender, he had answered practically in two
words: "unconditional surrender." The curt phrase caught the public
fancy, and gave his initials a new meaning. He was long known as
"Unconditional Surrender" Grant.
Born in Ohio, he had been educated at West Point, had fought well
in our unjust war against Mexico, had resigned in the piping times of
peace that followed, had been a commercial failure, and was running
an insignificant business as a farmer in Galena, Illinois, an obscure
and unimportant citizen of that unimportant town, when the Civil
War began. Eight years afterwards, he became President of the
United States and served as such for eight years, doing his dogged
best, but far less successful as a statesman than he had been as a
soldier. He was a patriot and a good man. In the last years of his
life, ruined financially by a wicked partner and tortured by the cancer
that finally killed him, he wrote his famous memoirs, which netted
his family a fortune after the grave had closed upon this great
American. He ran a race with Death to write his life. And he won the
grim race.
The young second-lieutenant saluted and explained his mission. The
long envelope, deeply dented with the mark of Wilkes Booth's dirty
thumb and finger, had reached its destination at last. Grant took it,
opened it, read it without even a slight change of expression, though
it contained not only orders for the future, but Lincoln's warm-
hearted thanks for the past and the news of his own promotion to
be major-general. Not only Tom, but every member of his staff was
watching him. The saturnine face told no one anything. The little he
said at the moment was said to Tom.
"The President tells me he would like to have you given a glimpse of
the front. Have you had any experience?"
"No, sir."
"When were you commissioned?"
"A week ago, sir."
"Are all the Eastern boys of your age in the army?"
"They would like to be, sir."
"Well," said Grant, with a kindly smile, "perhaps a little experience at
the front may make up for the years you lack. Send him to General
Mitchell, Captain," he added, turning to a spruce aide who rose from
his packing-box seat to acknowledge the command.
"Pray come with me, Mr. Strong," said the captain.
Tom saluted, turned, and followed his guide. A backward glance
showed him the general, his eyes now bent sternly upon Lincoln's
letter, his staff eyeing him, a group of quiet, silent figures. And that
was all that Tom saw, at that time, of the greatest general of our
Civil War.
 CHAPTER V
Inside the Confederate Lines—"Sairey" Warns Tom—Old Man
Tomblin's "Settlemint"—Stealing a Locomotive—Wilkes Booth Gives
the Alarm—A Wild Dash for the Union Lines.

Three days afterwards, Tom found himself "on special service," on

the staff of Gen. O. M. Mitchell, whose troops were pushing towards
Huntsville, Alabama. They occupied that delightfully sleepy old town,
the center of a group of rich plantations, April 12, 1862, but Tom
was not then with the column. Five days before, with Mitchell's
permission, he had volunteered for a gallant foray into the enemy's
country. He had taken prompt advantage of Lincoln's hint that he
might fight a bit if he wanted to do so. He was to have his fill of
fighting now.
Tom was one of twenty-two volunteers who left camp before dawn
on April 7, under the command of James J. Andrews, a daredevil of a
man, who had persuaded General Mitchell to let him try to slip
across the lines with a handful of soldiers disguised as Confederates
in order to steal a locomotive and rush it back to the Union front,
burning all the railroad bridges it passed. The railroads to be crippled
were those which ran from the South to Chattanooga, Tennessee,
and from the East through Chattanooga and Huntsville to Memphis.
A few miles from camp, Andrews gave his men their orders. They
were to separate and singly or in groups of two or three were to
make their way to the station of Big Shanty, Georgia, where they
were to meet on the morning of Saturday, April 12. Andrews took
Tom with him. For two days they hid in the wooded hills by day and
traveled by night, guided by a compass and by the stars. Then their
scanty supply of food was exhausted and they had to take to the
open. Their rough clothing, stained a dusty yellow with the oil of the
butternut, the chief dye-stuff the South then had, their belts with
"C.S.A."—"Confederate States of America"—upon them, their
Confederate rifles (part of the spoils of Fort Donelson), and their
gray slouched hats made them look like the Confederate scouts they
had to pretend to be.
Danger lurked about them and detection meant death. They did
their best to talk in the soft Southern drawl when they stopped at
huts in the hills and asked for food, but the drawl was hard for a
Northern tongue to master and more than one bent old woman or
shy and smiling girl started with suspicion at the strange accents of
these "furriners." The men of the hills were all in the army or all in
hiding. On the fourth day they reached a log-hut or rather a home
made of two log-huts, with a floored and roofed space between
them, a sort of open-air room where all the household life went on
when good weather permitted. An old, old woman sat in the
sunshine, her hands busy with a rag quilt, her toothless gums busy
with holding her blackened clay pipe. Behind her sat her
granddaughter, busy too with her spinning wheel. The two women
with their home as a background made a pleasing and a peaceful
picture.
"Howdy," said Andrews.
The wheel stopped. The quilt lay untouched upon the old woman's
lap. She took her pipe from her mouth.
"Howdy," said she.
The conversation stopped. The hill-folk are not quick of speech.
"Please, ma'am, may I have a drink of milk?" asked Tom.
"Sairey," called the old dame, "you git sum milk."
Sairey started up from her spinning wheel, trying to hide her bare
feet with her short skirt and not succeeding, and walked back of the
house to the "spring-house," a square cupboard built over a
neighboring spring. It was dark and cool and was the only
refrigerator the hill-folk knew. While she was away, her grandmother
began to talk. The man and boy would much rather she had kept
still. For she peered at them suspiciously, and said:
"How duz I know you uns ain't Yankees? I hearn thar wuz a right
smart heap o' Yankee sojers not fur off'n hereabouts."
At this moment Sairey fortunately returned. She brought in her
brown hand an old glass goblet, without a standard, but filled to the
brim with a foaming mixture that looked like delicious milk. Alas!
Tom, who loathed buttermilk, was now to learn that in the hills
"milk" meant "buttermilk." He should have asked for "sweet milk."
Sairey handed him the goblet with a shy grace, blushing a little as
the boy's hand touched hers. He lifted it eagerly to his thirsty lips,
took a long draught, and sputtered and gagged. But the mistake was
in his asking and the girl had gone a hundred yards to get him what
she thought he wanted. He was a boy, but he was a gentleman. He
swallowed the nauseous stuff to the last drop, and made his best
bow as he thanked her. Suddenly the old woman said to him:
"Where wuz you born, bub?"
"New—New——" stammered Tom. His tongue did not lend itself
readily to a lie, even in his country's cause. When he was still too
young to understand what the words meant, his mother had told
him: "A lie soils a boy's mouth." As he grew older, she had dinned
that big truth into his small mind. Now, taken by surprise, the habit
of his young life asserted itself and the tell-tale truth that he had
been born in New York was on his unsoiled lips, when Andrews
finished the sentence for him.
"New Orleans," said Andrews, coolly.
"He don't talk that-a-way," grumbled the old beldam.
"He was raised up No'th," Andrews explained, "but soon as this yer
onpleasantness began, he cum Souf to fight for we-uns."
Andrews had overdone his dialect.
"Sairey," commanded the old woman, "put up the flag."
"Why, granma," pleaded Sairey from where she had taken refuge
behind her grandmother's chair, "what's the use?"
"Chile, you hear me? You put up the flag."
From her refuge, Sairey held out her hands in a warning gesture,
and then, before she entered one of the log-houses, she pointed to
a cart-track that wound up the hill before the hut. She came out with
a Confederate flag, made of part of an old red petticoat with white
stripes sewn across it. It was fastened upon a long sapling. She put
the staff into a rude socket in front of the platform. As she passed
Tom in order to do this, she whispered to him: "You-uns run!"
"What wuz you sayin' to Bub, thar?" her grandmother asked in
anger.
"I wuzn't sayin' nuthin' to nobuddy," Sarah replied.
But Andrews' ears, sharper than the old woman's, sharpened by fear,
had caught the words.
"We-uns'll haf to go," he remarked. "You-uns haz bin right down
good to us. Thanky, ma'am."
"Jes' wait a minute," the old woman answered. "I'll give you
somethin' fer yer to eat as ye mosey 'long."
She walked slowly, apparently with pain, into the dark log-room.
Sairey wrung her hand and whispered: "Run, run. Take the cart-
track." Instantly the grandmother appeared on the threshold, her old
eyes flashing, a double-barreled shot-gun in her shaking hands. She
tried to cover both man and boy, as she screamed at them:
"You-uns stay in yer tracks, you Yankees! My man'll know what to do
with you-uns."
Their guns were at her feet. There was no way to get them, even if
they would have used them against a woman.
"Run!" shouted Andrews and bounded towards the cart-track.
Tom sprang after him, but not in time to escape a few birdshot
which the old woman's gun sent flying after him. The sharp sting of
them redoubled his speed. The second barrel sent its load far astray.
They had run just in time, for from another hilltop behind the hut a
dozen armed men came plunging down to the house, shouting after
the scared fugitives. The raising of the flag had been the agreed-
upon signal for their coming. Sairey's father and several other men
had taken to the nearby hills to avoid being impressed into the
Confederate army, but they adored the Confederacy, up to the point
of fighting for it, and they would have rejoiced to capture Andrews
and Tom. The old woman's eyes and ears had pierced the thin
disguise of the raiders. So she had forced her granddaughter to fly
the flag and the girl, afraid to disobey her fierce old grandmother
but loath to see the boy she had liked at first sight captured, had
warned him to flee. Man and boy were out of gunshot, but still in
sight, when their pursuers reached the house, yelled with joy to see
the abandoned guns, and ran up the cart-track like hounds hot upon
the scent. As Tom and Andrews panted to the hilltop, they saw why
Sairey had bidden them take the cart-track. At the summit, it
branched into half a dozen lanes which wound through a pine forest.
Lanes and woodlands were covered with pineneedles, the deposit of
years, which rose elastic under their flying feet and left no marks by
which they could be tracked. And beyond the forest was a vast
laurel-brake in which a regiment could have hidden, screened from
discovery save by chance. It gave the fugitives shelter and safety.
Once they heard the far-off voices of their pursuers, but only once.
Ere many hours they had the added security of the night.
When they found a hiding-place, beside a tiny brook that flowed at
the roots of the laurel-bushes, Tom found that his wound, forgotten
in the fierce excitement of the flight, had begun to pain him. His left
shoulder grew stiff. When Andrews examined it, all it needed was a
little care. Three or four birdshot had gone through clothing and
skin, but they lay close beneath the skin, little blue lumps, with tiny
smears of red blood in the skin's smooth whiteness. They were
picked out with the point of a knife. The cool water of the brook
washed away the blood and stopped the bleeding. Andrews tore off
a bit of his own shirt, soaked it in the brook, and bandaged the
shoulder in quite a good first-aid-to-the-injured way. Tom and he
were none the worse, except for the loss of their guns. And that was
the less serious because both knives and pistols were still in their
belts.
They slept that night in the laurel-brake, forgetting their hunger in
the soundness of their sleep. Just after dawn, they were startled to
hear a human voice. But it was the voice of a gentle girl. It kept
calling aloud "Coo, boss, coo, boss," while every now and then it
said in lower tones: "Is you Yanks hyar? Hyar's suthin' to eat." At
first they thought it was a trap and lay still. Finally, however, spurred
by hunger, they crept out of their hiding-place and found it was
Sairey who was calling them. When she saw them, she ran towards
them, while the cows she had collected from their pasture stared
with dull amazement.
"Is you-uns hurt?" she asked, clasping her hands in anxiety.
Reassured as to this, she produced the cold cornbread and bacon
she had taken from the spring-house when she left home that
morning for her daily task of gathering the family cows. Man and
boy bolted down the food.
"You're good to us, Sairey," said Tom.
"Dunno as I ought to help you-uns," the girl replied, peering slyly
out of her big sunbonnet and digging her brown toes into the earth,
"but I dun it, kase—kase—I jes' had to. Kin you get away today?"
"We'll try."
"Whar be you goin'?"
Should they tell her where they were going? It was a risk, but they
took it. They were glad they did, for Sairey was not only eager to
help them on their way, but could be of real aid. Once in her life she
had been at Big Shanty. She told them of a short cut through the
hills, by which they would pass only one "settlemint," as the
infrequent clearings in the hills were called.
"When you-uns git to Old Man Tomblin's settlemint," said Sairey, "I
'low you-uns better stand at the fence corner and holler. Old Man
Tomblin's spry with his gun sometimes, when furriners don't do no
hollerin'. But when he comes out, you-uns tell him Old Man Gernt's
Sairey told you he'd take care of you-uns. 'N he will. 'N you kin tell
Bud Tomblin—no, you-uns needn't tell Bud nothin'. Good-by."
The hill-girl held out her hand. She looked up to Andrews and smiled
as she shook hands. She looked down at Tom—she was half a head
taller than he—and smiled again as she shook hands. Then suddenly
she stooped and kissed the startled boy. Then she fled back along
the lane by which she had come, leaving the placid cows and the
thankful man and boy behind her. With a flutter of butternut skirt
and a twinkle of bare, brown feet, she vanished from their sight.
Thanks to her directions, they found Old Man Tomblin's settlemint
without difficulty. They duly stood at the corner of the sagging rail
fence and there duly "hollered." Old Man Tomblin and Bud Tomblin
came out of the cabin, each with a gun, and were proceeding to
study the "furriners" before letting them come in, when Andrews
repeated what Old Man Gernt's Sairey had told them to say. There
was an instant welcome. Bud Tomblin was even more anxious than
his father to do anything Sairey Gernt wanted done. The fugitives'
story that they had been scouting near General Mitchell's line of
march and had lost their guns and nearly lost themselves in a raid
by Northern cavalry was accepted without demur. Old Mrs. Tomblin,
decrepit with the early decrepitude of the hill-folk, whose hard living
conditions make women old at forty and venerable at fifty, cackled a
welcome to them from the corner of the fireplace where she sat
"dipping" snuff. "Lidy" Tomblin, the eldest daughter, helped and
hindered by the rest of a brood of children, took care of their
comfort. They feasted on the best the humble household had to
offer. They slept soundly, albeit eight other people, including Mr. and
Mrs. Tomblin and Lidy, slept in the same room. In the morning they
were given a bountiful breakfast and were bidden good-by as old
friends.
"I hate to deceive good people like the Tomblins," said Tom, when
they were out of earshot.
"Sometimes the truth is too precious to be told," laughed Andrews.
But Tom continued to be troubled in mind as he tramped along. He
made up his mind to fight for his country, the next time he had a
chance, in some other way. Telling a lie and living a lie were hateful
to him.
The next morning found them at Big Shanty, a tiny Georgia village,
which the war had made a great Confederate camp. It was the
appointed day, Saturday, April 12, 1862. Of the twenty-two men who
had started with Andrews, eighteen met that morning at Big Shanty.
The train for Chattanooga stopped there for breakfast on those
infrequent days when it did not arrive so late that its stop was for
dinner. It was what is called a "mixed" train, both freight and
passenger, with many freight cars following the engine and a tail of a
couple of shabby passenger cars. On this particular morning it
surprised everybody, including its own train-crew, by being on time.
Passengers and crew swarmed in to breakfast. The train was
deserted. The time for the great adventure had come.
Before the train was seized, one thing must be done. The telegraph
wire between Big Shanty and Chattanooga must be cut. If this were
left intact, their flight, sure to be discovered as soon as the train-
crew finished their brief breakfast, would end at the next station, put
on guard by a telegram. To Tom, as the youngest and most agile of
the party, the task of cutting the wire had been assigned. He was
already at the spot selected for the attempt, a clump of trees a
hundred yards from the station, where the wire was screened from
sight by the foliage. As soon as the train came in, Tom started to
climb the telegraph-pole. He had just started when he heard a most
unwelcome sound.
"Hey, thar! What's you doin'?"
He turned his head and saw a Confederate sentry close beside him.
He recognized him as a man with whom he had been chatting
around a camp-fire early that morning. His name was Bill Coombs.
Tom's ready wit stood by him.
"Why, Bill," he said, "glad to see you. Somethin's wrong with the
wire. The Cunnel's sent me to fix it. Give me a boost, will ye?"
The unsuspicious Bill gave him a boost and watched him without a
thought of his doing anything wrong while Tom climbed to the top of
the rickety pole, cut the one wire it carried, fastened the ends to the
pole so that from the ground nobody could tell it was cut, and
climbed down. Bill urged him to stay and talk awhile, but Tom
reminded him that sentries mustn't talk, then he strolled at first and
soon ran towards the station. He had to run to catch the train. The
instant Andrews saw him returning, he sprang into the cab of the
locomotive.
 The Locomotive Tom Helped to Steal

One of his men had already uncoupled the first three freight cars
from the rest of the train. All the men jumped into the cab or the
tender or swarmed up the freight-car ladders. Andrews jerked the
throttle wide open. The engine jumped forward, the tender and the
three cars bounding after it. The crowd upon the platform gaped
after the retreating train, without the slightest idea of what was
happening under their very noses. A boy came running like an
antelope from the end of the platform. He jumped for the iron step
of the locomotive, was clutched by a half-dozen hands and drawn
aboard. But as he jumped, he heard a voice he had reason to
remember call out:
"They're Yanks. That's Lieutenant Strong, a Yankee! Stop 'em! Shoot
'em!"
Livid with rage, his long black hair streaming in the wind as he ran
after them, Wilkes Booth fired his pistol at them, while the motley
crowd his cry had aroused sent a scattering volley after the train.
Nobody was hurt then, but the danger to everybody had just begun.
There was instant pursuit. The train-crew, startled by the sound of
the departing train, came running from the station. They actually
started to run along the track after the flying locomotive. They
jerked a hand-car off a siding and chased the fugitives with that. At
a station not far off, they found a locomotive lying with steam up.
They seized that and thundered ahead. Now hunters and hunted
were on more even terms. The hunters reached Kingston, Georgia,
within four minutes after the hunted had left. The latter had had to
make frequent stops, to cut the wires, to take on fuel, to bundle into
the freight cars ties that could be used to start fires for the burning
of bridges, and to tear up an occasional rail. This last expedient
delayed their pursuers but little. When a missing rail was sighted,
the Confederates stopped, tore up a rail behind them, slipped it into
the vacant place, and rushed ahead again.
Andrews was running the captured train on its regular time
schedule, so he could not exceed a certain speed. From Kingston,
however, where the only other train of the day met this one, he
expected a free road and plenty of time to burn every bridge he
passed. He did meet the regular train at Kingston, but alas! it carried
on its engine a red flag. That meant that a second section of the
same train was coming behind it. There was nothing to do but to
wait for this second section. The railroad was single-track, so trains
could pass only where there was a siding. But in every moment of
waiting there lurked the danger of detection. Southerners, soldiers,
and civilians, crowded about the locomotive as she lay helplessly still
on the Kingston sidetrack, puffing away precious steam and precious
time.
"Whar's yer passengers?" asked one man. "I cum hyar to meet up
with Cunnel Tompkins. Whar's he'n the rest of 'em?"
"We were ordered to drop everything at Big Shanty," explained
Andrews, "except these three cars. They're full of powder. I'm on
General Beauregard's staff and am taking the stuff to him at Corinth.
Jove, there's the whistle of the second section. I'm glad to hear it."
He was indeed glad. At one of his stops, he had bundled most of his
men into the freight cars. The cars were battered old things without
any locks. If a carelessly curious hand were to slide back one of the
doors and reveal within, not powder, but armed men, all their lives
would pay the forfeit. Andrews was in the cab with engineer,
fireman, and Tom, who had been helping the fireman feed wood into
the maw of the furnace on every mile of the run. His young back
ached with the strain of the unaccustomed toil. His young neck felt
the touch of the noose that threatened them all.
"Tom, you run ahead and throw that switch for us as soon as the
other train pulls in," said Andrews. "We mustn't keep General
Beauregard waiting for this powder a minute longer than we can
help. He needs it to blow the Yankees to smithereens."
So Tom ran ahead, stood by the switch as the second section came
in, and promptly threw the switch as it passed. But his train did not
move and a brakeman jumped off the rear platform of the caboose
of the second section, as it slowed down, told Tom he was an ass
and a fool, pushed him out of the way and reset the switch.
"You plum fool," shouted the brakeman, after much stronger
expressions, "didn't ye see the flag fur section three?"
Tom had not seen it, had not looked for it, but it was too true that
the engine of section two also bore the red flag that meant that
section three was coming behind it.
Again there was a long wait, again the sense of danger closing in
upon them, again the thought of scaffold and rope, again the
necessity of playing their parts with laughter and good-natured chaff
amid the foes who thought them friends. The slow minutes ticked
themselves away. At last the third section came whistling and
lumbering in. Thank fortune, it bore no red flag. This time Tom
threw the switch unchecked and then jumped on the puffing engine
as she reached the main-track and sped onwards.
"Free, by Jove!" said Andrews, with a deep breath of deep relief.
"Now we can burn Johnny Reb's bridges for him!"
Four minutes later, while section three of the train that had so long
delayed them was still at Kingston, a shrieking locomotive rushed
into the station. Its occupants, shouting a story of explanation that
put Kingston into a frenzy, ran from it to an engine that lay upon a
second sidetrack, steam up and ready to start. They had reached
Kingston so speedily by using their last pint of water and their last
stick of wood. They saved precious minutes by changing engines.
Five seconds after their arrival, the station-agent had been at the
telegraph-key, frantically pounding out the call of a station beyond
Andrews's fleeing train. There was no reply.
"Wire cut!" he shouted, running out of the station. Of course that
had been done by the fugitives just out of sight of Kingston. "Wire
cut! I kain't git no message through."
"We'll take the message!" answered the Confederate commander,
from the cab of the locomotive that was already swaying with her
speed, as she darted ahead.
They came near delivering the message within four miles of
Kingston. Andrews's men, with a most comforting sense of safety
had stopped and were pulling up a rail, when they heard the whistle
of their avenging pursuer.
"Quick, boys, all aboard," Andrews called. "They're closer'n I like to
have 'em."
Quickly replacing the rail, the Confederates came closer still. Around
the next curve, quite hidden from sight until close upon it, the
fugitives had put a rail across the track. It delayed the pursuit not
one second. Whether the cowcatcher of the engine thrust it aside or
broke it or whether the engine actually jumped it, nobody knew then
in the wild excitement of the chase and nobody knows now. The one
thing certain is that there was no delay. Very likely the rail broke.
Rails of those days were of iron, not steel, and throughout the South
they were in such condition that at the close of the Civil War one of
the chief Southern railroads was said to consist of "a right-of-way
and two streaks of rust." The locomotive whistled triumphantly and
sped on.
On the Union train, Tom had crept back to the rear car along the
rolling, jumping carroofs, with orders to set it on fire and stand
ready to cut it off. The men inside arranged a pile of ties, thrust fat
pine kindling among them, and touched the mass with a match. It
burst into flame as they scuttled to the roof and passed to the car
ahead. A long covered wooden bridge loomed up before them.
Halfway across it, Andrews stopped, dropped the flaming car, and
started ahead again. In a very few minutes the bridge would have
been a burning mass, but the few minutes were not to be had. The
Confederate locomotive was now close upon them. It dashed upon
the bridge, drove the burning car across the bridge before it, pushed
it upon a neighboring sidetrack and again whistled triumphantly as it
took up the fierce chase. The two remaining cars were detached,
one by one, but in vain. The game was up.
"Guess we're gone," said Andrews, tranquilly, as he looked back over
the tender, now almost empty of wood, to the smokestack that was
belching sooty vapor within a mile of them. "By this time, they've got
a telegram ahead of us. Stop 'round that next curve in those woods.
We must take to the woods. Don't try to keep together. Scatter.
Steer by the North Star. Make the Union lines if you can. We've done
our best."
The engine checked its mad pace, slowed, stopped.
"Good-by, boys," shouted Andrews, as he sprang from the engine
and disappeared in the forest that there bordered the track. "We'll
meet again."
Seven of them did meet him again. It was upon a Confederate
scaffold, where he and they were hung. The other six of the
fourteen who were captured were exchanged, a few months later.
Three others reached the Union lines within a fortnight, unhurt. But
where was Tom Strong?
 CHAPTER VI
Tom up a Tree—Did the Confederate Officer See Him?—A Fugitive
Slave Guides Him—Buying a Boat in the Dark—Adrift in the Enemy's
Country.

At first, Tom was up a tree. When he jumped from the abandoned

locomotive, his mind was working as quickly as his body. He
reasoned that the Confederates would expect them all to run as fast
and as far away as they could; that they would run after them; that
they would very probably catch him, utterly tired out as he was, so
tired that even fear could not lend wings to his leaden feet; that the
pursuit, however, would not last long, because the Confederates
would wish to reach a station soon, in order both to report their
success and to send out a general alarm and so start a general
search for the fugitives; and that he would best hide as near at hand
as might be. In other words, he thought, quite correctly, that the
best thing to do is exactly what your enemy does not expect you to
do. He picked out a big oak tree quite close to the track, its top a
mass of thick-set leaves such as a Southern April brings to a
Southern oak. He climbed it, nestled into a sheltered crotch high
above the ground, and waited. He did not have to wait long. He
could still hear the noise of his comrades plunging through the
woods when the Confederate engine drew up beneath his feet.
Before it stopped, the armed men who clustered thick upon
locomotive and tender were on the ground and running into the
woods. A gallant figure in Confederate gray led them. He heard the
rush of them, then a shot or two, exultant yells, and ere long the
tramp of returning feet. They came back in half a dozen groups,
bringing with them three of his comrades in flight, less fortunate
than he, at least less fortunate up to that time. Andrews was one of
the prisoners. He had slipped and fallen, had strained a sinew, and
had lain helpless until his pursuers reached him. Tom, peering
cautiously through his leafy shelter, saw that his late leader was
limping and was held upright by a kindly Confederate, who had
passed his arm about him.
"'Tain't fur," said his captor, cheerily, "hyar's the injine."
"The Yank's goin' fur," sneered a soldier of another kind, "he's goin'
to Kingdom Cum, blast him!" He lifted his fist to strike the helpless
man, but the young officer in command caught the upraised arm.
"None of that," he said, sternly. "Americans don't treat prisoners that
way. You're under arrest. Put down your gun and climb into the
tender. Do it now and do it quick." Sulkily the brute obeyed. "Lift him
in," went on the officer to the man who was supporting Andrews.
This was gently done. The other two captives climbed in. So did the
Confederates. Their officer turned to them.
"You've done your duty well," he said. "You've been chasing brave
men. They've done their duty well too.

"'For such a gallant feat of arms

Was never seen before.'"

Tom started with surprise. The young officer was quoting from
Macaulay's "Lays of Ancient Rome." The boy had stood beside his
mother's knee when she read him the "Lays" and had often since
read them himself.
That start of surprise had almost been Tom's undoing. He had
rustled the leaves about him. A tiny shower of pale green things fell
to the ground.
"Captain, there's somebody up that tree," said a soldier, pointing
straight at the point where Tom sat. "I heard him rustle."
The captain looked up. The boy always thought the officer saw him
and spared him, partly because of his youth—he knew the fate the
prisoners faced—and partly because of his admiration for "the
gallant feat of arms." Be that as it may, he certainly took no step
just then to make another prisoner. Instead he laughed and
answered:
"That's a 'possum. We haven't time for a coon-hunt just now. Get
ahead. We'll send an alarm from the next station and so bag all the
Yankees."
The engine, pushing the recaptured one before it, started and
disappeared around the end of the short curve upon which Andrews
had made his final stop. For the moment at least, Tom was safe. But
he knew the hue-and-cry would sweep the country. Everybody would
be on the lookout for stray Yankees. And as everybody would think
the estrays were all going North, Tom decided to go South. He slid
down the tree, looked at his watch, studied the sunlight to learn the
points of the compass, drew his belt tighter to master the hunger
that now assailed him, and so began his southward tramp, a boy,
alone, in the enemy's country.
That part of Georgia is a beautiful country and Tom loved beauty,
but it did not appeal to him that afternoon. He was hungry; he was
tired; the excitement that had upheld him through the hours of flight
on the captured engine was over. He plodded through a little belt of
forest and found himself in a broad valley, with a ribbon of water
flowing through it. He stumbled across plowed fields to the little
river. A dusty road, with few marks of travel, meandered beside the
stream. He was evidently near no main highway. Not far away a
planter's home, with a stately portico, gleamed in the sunlight
through its screen of trees. In the distance lay a little village. There
was food in both places and he must have food. To which should he
go? It was decided for him that he was to go to neither. As he
slipped down the river bank, to quench his burning thirst and to
wash his dusty face and hands, he almost stepped upon a negro
who lay full length at the foot of the bank, hidden behind a tree that
had been uprooted by the last flood and left stranded there. The boy
was scared by the unexpected meeting, but not half as much as the
negro.
"Oh, Massa," said the negro, on his knees with outstretched hands,
"don' tell on me, Massa. I'll be your slabe, Massa. Jes' take me with
you. Please don't tell on me. You kin make a lot o' money sellin' me,
Massa. Please lemme go wid you."
"What is your name?" asked Tom.
"Morris, Massa."
"Where did you come from?"
"From dat house, Massa." He pointed to the big house nearby.
"And what are you doing here?"
Little by little, Morris (reassured when he found Tom was a Northern
soldier and like himself a fugitive) told his story. He had been born
on this plantation. Reared as a house-servant, he could read a little.
He had learned from the newspapers his master took that a
Northern army was not far away. He made up his mind to try for
freedom. His master kept dogs to track runaways, but no dog can
track a scent in running water. It was not probable his flight would
be discovered until after nightfall. So he had stolen to his hiding-
place in the afternoon, intending to wade down the tiny stream as
soon as darkness came. Two miles below, the stream merged itself
into a larger one. There he hoped to steal a boat, hide by day and
paddle by night until he reached the Tennessee. "Dat ribber's plum
full o' Massa Lincum's gunboats," he assured Tom.
"How are you going to live on the journey?" asked the boy.
"I spec' dey's hen-roosts about," quoth Morris with a chuckle, "and
I'se got a-plenty to eat to start wid. Dis darkey don' reckon to starve
none."
"Give me something to eat, quick!"
Morris willingly produced cornpone and bacon from a sack beside
him. Tom wanted to eat it all, but he knew these precious supplies
must be kept as long as possible, so he did not eat more than half of
them. The two agreed to keep together in their flight for freedom.
As soon as it was dark, they began their wading. The two miles
seemed an endless distance. The noises of the night kept their
senses on the jump. Once a distant bloodhound's bay scared Morris
so much that his white teeth clattered like castanets. Once the "too-
whit-too" of a nearby owl sent Tom into an ecstasy of terror. He
fairly clung to Morris, who, just ahead of him, was guiding his steps
through the shallow water. When he found he had been scared by
an owl, he was so ashamed that he forced himself to be braver
thereafter. At last they reached their first goal, the larger river. Here
Morris's knowledge of the ground made him the temporary
commander of the expedition. He knew of a little house nearby, the
home of a "poor white," who earned part of his precarious livelihood
by fishing. Morris knew just where he kept his boat. There was no
light in the little house and no sound from it as they crept stealthily
along the bank to the tree where the boat was tied. Tom drew his
knife to cut the rope.
"No, Massa," whispered Morris. "Not dat-a-way. Ef it's cut, dey'll
know it's bin tuck and dey'll s'picion us. Lemme untie it. Den dey'll
t'ink it's cum loose and floated away. 'N dey'll not hurry after it.
Dey'll t'ink dey kin fin' it in some cove any time tomorrer."
Morris was right. It did not take him long to untie the clumsy knot.
Three oars and some fishing-tackle lay in the flat-bottomed boat.
They got into it, pushed off, and floated down the current without a
sound. Morris steered with an oar at the stern. Once out of earshot,
they rowed as fast as the darkness, intensified by the shadows of
the overhanging trees, permitted.
Just before they had pushed off, Tom had asked:
"What is this boat worth, Morris?"
"Old Massa paid five dollars fer a new one jest like it, dis lastest
week."
Tom's conscience had told him that even though a fugitive for his life
in the enemy's country he ought not to take the "poor white's" boat
without paying for it. He unbuttoned an inside pocket in his shirt and
drew out a precious store of five-dollar gold pieces. There were
twenty of them, each wrapped in tissue-paper and the whole then
bound together in a rouleau, wrapped in water-proofed silk, so that
there would be no sound of clinking gold as he walked. He figured
that the three oars and the sorry fishing tackle could not be worth
more than the boat was, so he took out two coins and put them in a
battered old pan that lay beside the stump to which the boat was
tied. There the "cracker"—another name for the "poor white"—would
be sure to see them in the morning. As a matter of fact he did. And
they were worth so much more than his vanished property that he
was inclined to think an angel, rather than a thief, had passed that
way. Tom's conscientiousness spoiled Morris's plan of having the
owner think the boat had floated away, but the "cracker" was glad to
clutch the gold and start no hue-and-cry. He was afraid that if he
recovered his boat, he would have to give up the gold. It was much
cheaper to make another. So he kept still.
And still, very still, the fugitives kept as they paddled slowly down
the stream until the first signs of dawn sent them into hiding. They
hid the boat in the tall reeds that fringed the mouth of a tiny creek
and they themselves crept a few yards into the forest, ate very much
less than they wanted to eat of what was left of Morris's scanty store
of food, and went to sleep. They slept until—but that is another
story.
 CHAPTER VII
Towser Finds the Fugitives—Towser Brings Uncle Moses—Mr. Izzard
and His Yankee Overseer, Jake Johnson—Tom is Pulled Down the
Chimney—How Uncle Moses Choked the Overseer—The Flight of the
Four.

They slept until late in the afternoon.

Then Morris woke up with a yell. A dog's cold nose was thrusting
itself against his cheek. He thought his master's bloodhounds were
upon him and that the whipping-post was the least he had to fear.
As Tom, startled from sound sleep by the negro's scream of terror,
sprang to his feet, he saw Morris crouching upon the ground,
babbling "Sabe me, good Lord, sabe old Morris!" The dog, a big
black-and-yellow mongrel, a very distant cousin of the bloodhound
the scared darkey imagined him to be, was looking with a grieved
surprise at the cowering man. He was a most good-natured beast,
accustomed to few caresses and many kicks, and he had never
before seen a man who was afraid of him. As he turned to Tom, he
saw a boy who wasn't afraid of him. Tom, who had always been
loved by dogs and children, smiled at the big yellow mongrel, said
"Come here, old fellow," and in an instant had the great hound
licking his hand and looking up to him with the brown-yellow eyes
full of a dog's faith and a dog's fidelity. These are great qualities. A
cynic once said: "The more I see of men the more I like dogs." That
cynic probably got from men what he gave to them. But still it is
true that the unfaltering faith of a dog and a child, once their
confidence has been won, is a rare and a precious thing. Tom patted
his new friend's head. The big tail wagged with joy. The hound
looked reproachfully at Morris, as much as to say: "See how you
misunderstood me; I want to be friends: but here"—he turned and
looked at the boy who was smiling at him—"here is my best friend."
He stayed with them an hour, contented and happy, humbly grateful
for a tiny piece of meat they gave him. Then, as dark drew near, he
became uneasy. Two or three times he started as if to leave them,
turned to see whether they were following him, looked beseechingly
at them, barked gently, put his big paw on Tom's arm and pulled at
him. Evidently he wanted them to come with him, but this they did
not dare to do.
"Ef we lets him go, he'll bring his folkses here," Morris whispered.
"I suppose we must tie him up," Tom reluctantly assented. "I hate to
treat him that way, for he's a good dog. But if we leave him tied and
push off in the boat, he'll howl after a while and his master will find
him. Take a bit of fishing-line and tie him."
Morris turned towards the hidden boat, but the hound, as if aware of
what they had said, suddenly started for his hidden home and
vanished into the underbrush before Tom could catch hold of him.
When Tom called, he stopped once and looked back, but he did not
come back. He shouldered his way into the bushes and trotted off,
with that amusing air of being in a hurry to keep a most important
appointment which all dogs sometimes show. And as he started,
Morris appeared again, with a shrill whisper: "De boat's dun sunk
hisself."
Tom ran to the bank of the creek. The news was too true. The boat
had sunk. The rotten caulking had dropped from one of the rotten
seams. The bow, tied to a tree in the canebrake, was high in air. The
stern was under five feet of water. The oars had floated away. The
fishing-pole was afloat, held to the old craft by the hook-and-line,
which had caught in the sunken seat. What were they to do? They
felt as a Western trapper used to feel, when he had lost his horse
and saw himself compelled to make his perilous way on foot through
a country swarming with savage foes. What to do?
"We must raise the boat, Morris, get her on shore, turn her over,
caulk her with something, make some paddles somehow and get
off."
Welcome to Our Bookstore - The Ultimate Destination for Book Lovers
Are you passionate about testbank and eager to explore new worlds of
knowledge? At our website, we offer a vast collection of books that
cater to every interest and age group. From classic literature to
specialized publications, self-help books, and children’s stories, we
have it all! Each book is a gateway to new adventures, helping you
expand your knowledge and nourish your soul
Experience Convenient and Enjoyable Book Shopping Our website is more
than just an online bookstore—it’s a bridge connecting readers to the
timeless values of culture and wisdom. With a sleek and user-friendly
interface and a smart search system, you can find your favorite books
quickly and easily. Enjoy special promotions, fast home delivery, and
a seamless shopping experience that saves you time and enhances your
love for reading.
Let us accompany you on the journey of exploring knowledge and
personal growth!

ebooksecure.com