Patent Description:
Difficult vehicle manoeuvres are associated with risk, both for vulnerable road users, vehicles, and cargo. Such manoeuvres can also be bottlenecks at terminals and hinder efficiency, and further be difficult even for experienced drivers. Vehicles are typically multi-articulation angle combinations, which further increase manoeuvre difficulty. In recent years vehicle manufacturers have therefore invested resources in researching advanced motor vehicle driving assistance/aid systems, such as Advanced Driver Assistance Systems (ADAS), to improve driving safety and comfort. For this reason and due to the fact that they will help achieve the goals set by the European Union for reducing road accidents, ADAS are one of the fastest growing segments in the automotive sector.

ADAS safety features are designed to avoid collisions and accidents by offering technologies that warn drivers of potential problems, or to avoid collisions by implementing safeguard measures and taking control of the motor vehicles. Adaptive features can automate lighting, provide adaptive cruise control, automate braking, incorporate GPS/traffic signalling, connect smartphones, alert drivers of other motor vehicles of hazards, keep drivers in the right lane, or show what is in blind spots. ADAS technology is based on vision/camera systems, sensory systems, automotive data networks, vehicle-to-vehicle (V2V) or vehicle-to-infrastructure (V2I) communication systems. Next- generation ADAS systems will increasingly take advantage of wireless connectivity to offer added value to V2V or V2I communication.

<CIT> discloses methods for generating and sharing maneuver plans between vehicles. A maneuvering platform is defined which comprises a maneuver generation module. The maneuver generation module may be considered as a vehicle maneuver generation mechanism where vehicle maneuvers are generated for a route at a location. For instance, a maneuvering platform is disclosed to be arranged to calculate one or more vehicle maneuvers. The maneuver platform is also configured to interface with a group of vehicles to disseminate vehicle maneuvers. Drivers might thereby access generated vehicle maneuvers.

<CIT> discloses a method and system for a driver of a vehicle to record and save complex (and possibly hazardous) low speed vehicle manoeuvres. The low speed vehicle manoeuvres may be saved in a database and may be used by an autonomous driving system to perform the low speed vehicle manoeuvres at a later time. In addition, it is disclosed that the low speed vehicle manoeuvres may be shared with other drivers such as relatives. The benefit is to assist less experienced drivers to reduce the time needed and mistakes made when performing low speed vehicle manoeuvres in areas such as a hub complex for freight loading/unloading.

However, there is a need for improving the security when generating and sharing manoeuvre plans between vehicles, especially in terms of vehicle manoeuvres.

An object of embodiments herein is to alleviate security issues arising when handling downloadable vehicle manoeuvres.

According to a first aspect there is presented a method for enabling download of verified vehicle manoeuvres. The method comprises recording, in a database, a manoeuvre as having been performed by a first vehicle at a location and according to a set of conditions of the first vehicle and a set of conditions of the location. The method comprises assigning an assessment score to the manoeuvre upon the manoeuvre having been tested for at least one second vehicle. The manoeuvre is tested under test conditions given by the location, the set of conditions of the first vehicle and the set of conditions of the location. The method comprises determining the manoeuvre to be verified only when the assessment score is above a threshold value. The method comprises enabling download of the manoeuvre from the database to at least one third vehicle only in case the manoeuvre is verified.

According to a second aspect there is presented a server for enabling download of verified vehicle manoeuvres. The server comprises processing circuitry. The processing circuitry is configured to cause the server to record, in a database, a manoeuvre as having been performed by a first vehicle at a location and according to a set of conditions of the first vehicle and a set of conditions of the location. The processing circuitry is configured to cause the server to assign an assessment score to the manoeuvre upon the manoeuvre having been tested for at least one second vehicle. The manoeuvre is tested under test conditions given by the location, the set of conditions of the first vehicle and the set of conditions of the location. The processing circuitry is configured to cause the server to determine the manoeuvre to be verified only when the assessment score is above a threshold value. The processing circuitry is configured to cause the server to enable download of the manoeuvre from the database to at least one third vehicle only in case the manoeuvre is verified.

According to a third aspect there is presented server for enabling download of verified vehicle manoeuvres. The server comprises a record module configured to record, in a database, a manoeuvre as having been performed by a first vehicle at a location and according to a set of conditions of the first vehicle and a set of conditions of the location. The server comprises an assign module configured to assign an assessment score to the manoeuvre upon the manoeuvre having been tested for at least one second vehicle. The manoeuvre is tested under test conditions given by the location, the set of conditions of the first vehicle and the set of conditions of the location. The server comprises a determine module configured to determine the manoeuvre to be verified only when the assessment score is above a threshold value. The server comprises an enable download module configured to enable download of the manoeuvre from the database to at least one third vehicle only in case the manoeuvre is verified.

According to a fourth aspect there is presented a computer program for enabling download of verified vehicle manoeuvres, the computer program comprising computer program code which, when run on a server, causes the server to perform a method according to the first aspect.

According to a fifth aspect there is presented a computer program product comprising a computer program according to the fourth aspect and a computer readable storage medium on which the computer program is stored. The computer readable storage medium could be a non-transitory computer readable storage medium.

Advantageously these aspects improve the security with respect to which vehicle manoeuvres are available for download.

Advantageously these aspects prevent the download of potentially hazardous vehicle manoeuvres.

<FIG> is a schematic diagram illustrating a simplified aerial viewpoint <NUM> of a scenario where the herein disclosed embodiments apply. <FIG> illustrates a scenario where a vehicle <NUM> (such as a cab) is connected to a truck <NUM> and a trailer <NUM>. The vehicle <NUM>, the truck <NUM> and the trailer <NUM> collectively form a carriage, or equipage. The carriage, or equipage, is placed at a location <NUM>. The carriage, or equipage, will hereinafter for simplicity be referred to as a vehicle <NUM>. The trailer <NUM> is to be manoeuvred to an intended goal position <NUM>. The intended goal position <NUM> might represent a terminal docking place. The intended goal position <NUM> is surrounded by one or more physical obstacles <NUM>, such as a building, which could make it difficult for the driver of the vehicle to correctly manoeuvre the trailer <NUM> to the intended goal position <NUM>. In order for the truck <NUM> to be correctly positioned at the intended goal position <NUM>, a series of manoeuvres, as schematically indicated by M1 and M2, needs to be performed at the location <NUM>. The manoeuvres might be aided by ADAS, as provided in terms of an ADAS module <NUM> in the vehicle. The vehicle might be configured to establish a communication link <NUM> to a database <NUM>, as provided in a server <NUM>, for download of one or more manoeuvres to the vehicle. Likewise, upon having performed one or more manoeuvres, this one or more manoeuvres might be uploaded to the database <NUM> for use by another vehicle when present at the same location <NUM>. As mentioned above, there is a need for improving the security when generating and sharing manoeuvre plans between vehicles, especially in terms of vehicle manoeuvres.

In this respect, none of the aforementioned documents <CIT> or <CIT> describe any kind of certification, but are more or less based on blind trust when another driver downloads the vehicle manoeuvres to his/her vehicle. This could result in a hazardous vehicle manoeuvre being downloaded and executed.

The embodiments disclosed herein relate to mechanisms for enabling download only of verified vehicle manoeuvres M1, M2. In order to obtain such mechanisms there is provided a server <NUM>, a method performed by the server <NUM>, a computer program product comprising code, for example in the form of a computer program, that when run on a server <NUM>, causes the server <NUM> to perform the method.

<FIG> is a flowchart illustrating embodiments of methods for enabling download of verified vehicle manoeuvres M1, M2. The methods are performed by the server <NUM>. The methods are advantageously provided as computer programs <NUM>.

S102: A manoeuvre M1, M2 as having been performed by a first vehicle <NUM> at a location <NUM> and according to a set of conditions of the first vehicle <NUM> and a set of conditions of the location <NUM> is recorded in a database <NUM>.

S104: An assessment score is assigned to the manoeuvre M1, M2 upon the manoeuvre M1, M2 having been tested for at least one second vehicle. The manoeuvre M1, M2 is tested under test conditions given by the location <NUM>, the set of conditions of the first vehicle <NUM> and the set of conditions of the location <NUM>.

S106: The manoeuvre M1, M2 is determined to be verified only when the assessment score is above a threshold value. In this respect, that the manoeuvre M1, M2 is verified is to be interpreted as the manoeuvre M1, M2 being ready to be used i.e., that the manoeuvre M1, M2 is successfully verified.

S108: Download of the manoeuvre M1, M2 from the database <NUM> to at least one third vehicle is enabled only in case the manoeuvre M1, M2 is verified.

This provides a manoeuvre upload-verification-certification-download service.

Embodiments relating to further details of enabling download of verified vehicle manoeuvres M1, M2 as performed by the server <NUM> will now be disclosed.

In some aspects, the manoeuvre M1, M2 is performed upon the at least one third vehicle and/or the at least one second vehicle having requested the first vehicle <NUM> to perform the manoeuvre M1, M2 at the location <NUM>. This could, for example, be the case where the driver of the first vehicle <NUM> is an experienced driver and/or where the driver of the at least one third vehicle is a less experienced driver. Thus, performing the manoeuvre M1, M2 might be initiated by the first vehicle <NUM> itself (or its driver) or by any of the at least one third vehicle and/or the at least one second vehicle (or their drivers).

There could be different ways to represent the manoeuvre M1, M2, for example when being recorded in the database <NUM>, when being tested for the at least one second vehicle, and when being enabled for download to the at least one third vehicle. In some embodiments, the manoeuvre M1, M2 is represented by a track consisting of point positions associated with actions taken by the first vehicle <NUM> when located at the point positions. In other embodiments the manoeuvre M1, M2 is represented by a track of points where the ADAS is configured to keep the vehicle <NUM> on the track.

There could be different types of manoeuvres M1, M2. In some embodiments, the manoeuvre M1, M2 is an ADAS manoeuvre. In this respect, for an ADAS manoeuvre the driver controls gear, gas, and brake, and gets assistance, for example from the ADAS module <NUM>, to follow the road. Alternatively or additionally, the manoeuvre M1, M2 might be AD reversing.

In order to notify the third vehicle, or its driver, of existence of the manoeuvre M1, M2 so that the manoeuvre M1, M2 can be downloaded to the third vehicle, map information or the like might be provided with an indicator of manoeuvre support being available at the location <NUM>. In some embodiments, the manoeuvre M1, M2 as recorded in the database <NUM> is therefore accompanied by an indication of manoeuvre support at the location <NUM>.

There may be different ways for the manoeuvre M1, M2 to be tested.

According to a first aspect, the manoeuvre M1, M2 is tested by being performed by a second vehicle that is controlled by a human driver. The manoeuvre M1, M2 should then be tested in an environment in accordance with the location <NUM>, the set of conditions of the first vehicle <NUM> and the set of conditions of the location <NUM>. For example, the manoeuvre M1, M2 might be tested by being performed by the at least one second vehicle at the same location <NUM> as the manoeuvre M1, M2 was performed by the first vehicle <NUM>. The manoeuvre M1, M2 might even be tested for a plurality of second vehicles. Further, the manoeuvre M1, M2 might be iteratively tested for the at least one second vehicle and one individual assessment score is assigned per iteration, until the assessment score is above the threshold value. A first embodiment relating to this first aspect will be further disclosed below.

According to a second aspects, the manoeuvre M1, M2 is tested in a simulation environment. In particular, according to an embodiment, the manoeuvre M1, M2 is tested in a simulation environment that is built up in accordance with the location <NUM>, the set of conditions of the first vehicle <NUM> and the set of conditions of the location <NUM>. For example, the manoeuvre M1, M2 might be automatically tested in the simulation environment by being computer simulated in the simulation environment. The simulation environment might thus simulate the operation of, and the manoeuvres performed by, the above mentioned at least one second vehicle. A second embodiment relating to this second aspect will be further disclosed below.

Further aspects that apply regardless if the manoeuvre M1, M2 is tested in accordance with the first aspect or the second aspect will now be disclosed.

In some aspects, one and the same manoeuvre M1, M2 might not be suitable for all types of vehicles. For example, there might be operational differences, such as differences in manoeuvrability (such as steering, etc.), ADAS capabilities, sensors, and/or differences in physical dimensions (such as length, width, height, etc.; if the first vehicle was a short semi-trailer, it is not sure that a larger semi-trailer or a vehicle with more joints, has the possibility to use, or even perform, the same manoeuvre M1, M2) between different types of vehicles that makes one and the same manoeuvre M1, M2 suitable for a first vehicle type but unsuitable for a second vehicle type. For example, if the first vehicle is equipped with sensors that are lacking in the second vehicle then it might be verified that the manoeuvre M1, M2 can still be performed safely for the second vehicle even if lacking such sensors. In this respect, the manoeuvre M1, M2 might be restricted to certain vehicle types, etc. Thus, in some embodiments, the manoeuvre M1, M2 is associated with restrictions to certain vehicle types and/or sensor equipment and is only enabled to be downloaded to the at least one third vehicle if being one of these certain vehicle types and/or having such sensor equipment.

Further, the manoeuvre M1, M2 might be edited in order to fit more than one vehicle type. Thus, in some embodiments, the manoeuvre M1, M2 is edited to fit another vehicle type and/or sensor equipment than that of the first vehicle <NUM>. According to the invention, the manoeuvre M1, M2 is edited in order to be tested for the second vehicle. That is, the manoeuvre M1, M2 is edited when tested for the at least one second vehicle. For example, the manoeuvre M1, M2 might be edited for different types of vehicles for example by changing curvatures of the manoeuvre M1, M2 depending on vehicle lengths.

Yet further, the manoeuvre M1, M2 might be edited to fit another location than the one where the manoeuvre M1, M2 was originally performed. For example, with access to a detailed map of the location <NUM>, the the manoeuvre M1, M2 can be evaluated at another physical location. This might require additional testing of the the manoeuvre M1, M2. One and the same manoeuvre M1, M2 might thus be used at one or more additional locations that are similar to, or have corresponding properties (such as an identical loading bay but at another physical location) as, the location <NUM> for which the manoeuvre M1, M2 was recorded.

According to the invention, aspects relating to safety concepts, such as human errors, hardware failures, operational/environmental stress which could occur whilst the manoeuvre M1, M2 is performed by the third vehicle are also taken into consideration when testing the manoeuvre M1, M2 for the second vehicle such that such effects do not impact the safety of the manoeuvre M1, M2 as performed by the third vehicle.

According to the invention, a report is issued in response to the manoeuvre M1, M2 having been tested. This report might then be reviewed by stakeholders (either manually by one or more human operators, or automatically by being analyzed by a controller) and the assessment score is based on the outcome of the review. That is, in some embodiments, the assessment score is assigned upon review of a report issued in response to the manoeuvre M1, M2 having been tested for the at least one second vehicle.

It could be that two or more different manoeuvres M1, M2 are recorded for the same location <NUM>. In some aspects, a recommendation as to which of these manoeuvres M1, M2 to download is then provided. That is, in some embodiments, at least two manoeuvres M1, M2 are recorded for the same location <NUM>, where each of the at least two manoeuvres M1, M2 is assigned its own assessment score upon having been tested for the at least one second vehicle, and where an indication of recommendation is provided for that manoeuvre M1, M2 having the highest assessment score for the location <NUM>. For example, each manoeuvre M1, M2 might be tested by drivers that vote for the manoeuvre M1, M2 they like best and submit the voting result to the server <NUM>. The server <NUM> might thus collect votes as well as other metrics relating to each manoeuvre M1, M2, such as the number of turns and drive/reverse gear switches of each manoeuvre M1, M2, data for different vehicles following each manoeuvre M1, M2, etc. to make decisions on which manoeuvre M1, M2 or maneuvers M1, M2 to recommend to which type of vehicles. For example, a manoeuvre M1, M2 using as small curvature as possible might be preferred if the third vehicle is comparatively short whereas a manoeuvre M1, M2 using as large curvature as possible might be preferred if the third vehicle is comparatively long.

Details of the above mentioned first embodiment for the manoeuvre M1, M2 to be tested will be disclosed next.

It is assumed that a manoeuvre M1, M2 is performed by a first vehicle <NUM> at a location <NUM> and according to a set of conditions of the first vehicle <NUM> and a set of conditions of the location <NUM>. It is further assumed that the manoeuvre M1, M2 is recorded in a database <NUM>.

Recording the manoeuvre M1, M2 in the database <NUM> triggers a request for the manoeuvre M1, M2 to be verified. A driver of a second vehicle therefore downloads the manoeuvre M1, M2 to the second vehicle. In some examples it is checked that the second vehicle has all the necessary sensors, ADAS capability, etc. needed to perform the manoeuvre M1, M2. As noted above, the manoeuvre M1, M2 might be tested for more than one second vehicle and thus be downloaded to more than one second vehicle. The next actions are then repeated for each such second vehicle.

The second vehicle is taken to the location <NUM>, for example by being driven there by the driver. Alternatively, a replica of the location <NUM> might be built elsewhere, such as in a studio facility or laboratory.

The driver uses the second vehicle to test the manoeuvre M1, M2 by performing the manoeuvre M1, M2 at the location <NUM>.

An assessment score is assigned to the manoeuvre M1, M2 upon the manoeuvre M1, M2 having been performed by the second vehicle at the location <NUM>.

According to the invention, a report is issued in response to the manoeuvre M1, M2 having been tested. The report might be composed by the driver or be registered direct by the second vehicle whilst testing the manoeuvre M1, M2. This report is then uploaded to the database <NUM> for review. Trusted stakeholders might then review the report and submit possible comments thereto to the database <NUM>. The driver of the second vehicle might then download the comments and either update the report, with or without re-testing the manoeuvre M1, M2, before the report as updated is uploaded to the database <NUM> for a new review. This update procedure might be iterated until there are no more comments to the report and the assessment score is above the threshold value. The manoeuvre M1, M2 is then considered verified and is thus ready to be used by at least on third vehicle, possibly with restrictions to some vehicle types, sensor equipment, and/or with comments and/or warnings to be displayed in a graphical user interface of the third vehicle. The manoeuvre M1, M2 is then enabled to be downloaded from the database <NUM> to the third vehicle.

Details of the above mentioned second embodiment for the manoeuvre M1, M2 to be tested will be disclosed next.

Recording the manoeuvre M1, M2 in the database <NUM> triggers a request for the manoeuvre M1, M2 to be verified. The manoeuvre M1, M2 is therefore downloaded to a simulation environment. The simulation environment is built up in accordance with the location <NUM>, the set of conditions of the first vehicle <NUM> and the set of conditions of the location <NUM>. The simulation environment might be built up by means of a 3D model. Also sensors or other type of equipment of the first vehicle might be modeled by sensor models, and the like. The manoeuvre M1, M2 either is automatically tested in the simulation environment by being computer simulated in the simulation environment or is tested in the simulation environment by a driver performing the manoeuvre M1, M2 in a driving simulator. As noted above, the manoeuvre M1, M2 might be tested for more than one second vehicle and thus be downloaded to more than one simulation environment. The next actions are then repeated for each such simulation environment. Further, simulation models and simulation rules, e.g., required time and space resolution, might be updated and/or downloaded per need basis.

An assessment score is assigned to the manoeuvre M1, M2 upon the manoeuvre M1, M2 having been simulated.

According to the invention, a report is issued in response to the manoeuvre M1, M2 having been tested. The report might be composed by the driver of the driving simulator or be registered direct by the simulation environment. This report is then uploaded to the database <NUM> for review. Trusted stakeholders might then review the report and submit possible comments thereto to the database <NUM>.

The driver of the driving simulator or the simulation environment itself might then download the comments and either update the report, with or without re-testing the manoeuvre M1, M2, before the report as updated is uploaded to the database <NUM> for a new review. This update procedure might be iterated until there are no more comments to the report and the assessment score is above the threshold value. The manoeuvre M1, M2 is then considered verified and is thus ready to be used by at least on third vehicle, possibly with restrictions to some vehicle types, sensor equipment, and/or with comments and/or warnings to be displayed in a graphical user interface of the third vehicle. The manoeuvre M1, M2 is then enabled to be downloaded from the database <NUM> to the third vehicle.

The herein disclosed embodiments are applicable to any vehicle and in particular to heavy-duty vehicles, such as trucks, buses and construction equipment, etc. In some embodiments, each vehicle <NUM> is a truck.

<FIG> schematically illustrates, in terms of a number of functional units, the components of a server <NUM> according to an embodiment. Processing circuitry <NUM> is provided using any combination of one or more of a suitable central processing unit (CPU), multiprocessor, microcontroller, digital signal processor (DSP), etc., capable of executing software instructions stored in a computer program product <NUM> (as in <FIG>), e.g. in the form of a storage medium <NUM>. The processing circuitry <NUM> may further be provided as at least one application specific integrated circuit (ASIC), or field programmable gate array (FPGA).

Particularly, the processing circuitry <NUM> is configured to cause the server <NUM> to perform a set of operations, or steps, as disclosed above. For example, the storage medium <NUM> may store the set of operations, and the processing circuitry <NUM> may be configured to retrieve the set of operations from the storage medium <NUM> to cause the server <NUM> to perform the set of operations.

Thus the processing circuitry <NUM> is thereby arranged to execute methods as herein disclosed. The server <NUM> may further comprise a communications interface <NUM> at least configured for communications with the ADAS module <NUM>. As such the communications interface <NUM> may comprise one or more transmitters and receivers, comprising analogue and digital components. The processing circuitry <NUM> controls the general operation of the server <NUM> e.g. by sending data and control signals to the communications interface <NUM> and the storage medium <NUM>, by receiving data and reports from the communications interface <NUM>, and by retrieving data and instructions from the storage medium <NUM>. Other components, as well as the related functionality, of the server <NUM> are omitted in order not to obscure the concepts presented herein.

<FIG> schematically illustrates, in terms of a number of functional modules, the components of a server <NUM> according to an embodiment. The server <NUM> of <FIG> comprises a number of functional modules; a record module 210a configured to perform step S102, an assign module 210b configured to perform step S104, a determine module 210c configured to perform step S106, and an enable download module 210d configured to perform step S108. In general terms, each functional module 210a-210d may in one embodiment be implemented only in hardware and in another embodiment with the help of software, i.e., the latter embodiment having computer program instructions stored on the storage medium <NUM> which when run on the processing circuitry makes the server <NUM> perform the corresponding steps mentioned above in conjunction with <FIG>. It should also be mentioned that even though the modules correspond to parts of a computer program, they do not need to be separate modules therein, but the way in which they are implemented in software is dependent on the programming language used. Preferably, one or more or all functional modules 210a-210d may be implemented by the processing circuitry <NUM>, possibly in cooperation with the communications interface <NUM> and/or the storage medium <NUM>. The processing circuitry <NUM> may thus be configured to from the storage medium <NUM> fetch instructions as provided by a functional module 210a-210d and to execute these instructions, thereby performing any steps as disclosed herein.

The server <NUM> may be provided as a standalone device or as a part of at least one further device. Thus, a first portion of the instructions performed by the server <NUM> may be executed in a first device, and a second portion of the of the instructions performed by the server <NUM> may be executed in a second device; the herein disclosed embodiments are not limited to any particular number of devices on which the instructions performed by the server <NUM> may be executed. Hence, the methods according to the herein disclosed embodiments are suitable to be performed by a server <NUM> residing in a cloud computational environment. Therefore, although a single processing circuitry <NUM> is illustrated in <FIG> the processing circuitry <NUM> may be distributed among a plurality of devices, or nodes. The same applies to the functional modules 210a-210d of <FIG> and the computer program <NUM> of <FIG>.

Claim 1:
A method for enabling download of verified vehicle manoeuvres (M1, M2), the method comprising:
recording (S102), in a database (<NUM>), a manoeuvre (M1, M2) as having been performed by a first vehicle (<NUM>) at a location (<NUM>) and according to a set of conditions of the first vehicle (<NUM>) and a set of conditions of the location (<NUM>);
assigning (S104) an assessment score to the manoeuvre (M1, M2) upon the manoeuvre (M1, M2) having been tested for at least one second vehicle, wherein the manoeuvre (M1, M2) is tested under test conditions given by the location (<NUM>), the set of conditions of the first vehicle (<NUM>) and the set of conditions of the location (<NUM>), wherein aspects relating to safety concepts which could occur whilst the manoeuvre (M1, M2) is performed by at least one third vehicle are taken into consideration when testing the manoeuvre (M1, M2) for the at least one second vehicle such that such effects do not impact the safety of the manoeuvre (M1, M2) as performed by the at least third vehicle, wherein the assessment score is assigned upon review of a report issued in response to the manoeuvre (M1, M2) having been tested for the at least one second vehicle, wherein the assessment score is based on an outcome of the review, and wherein the manoeuvre (M1, M2) is edited when tested for the at least one second vehicle;
determining (S106) the manoeuvre (M1, M2) to be verified only when the assessment score is above a threshold value; and
enabling (S108) download of the manoeuvre (M1, M2) from the database (<NUM>) to the at least one third vehicle only in case the manoeuvre (M1, M2) is verified